WEBVTT
00:00:00.160 --> 00:00:01.120
Hello everyone.
00:00:01.280 --> 00:00:11.199
It's me, John Oltsick, analyst at large at theCUBE Research, and I'm here for another episode of my podcast, The Cybersecurity Bridge.
00:00:11.839 --> 00:00:19.120
If you're one of the few people in the world who's never seen the Cybersecurity Bridge, I'm going to give you the Kevin and uh home alone look.
00:00:21.839 --> 00:00:22.800
What are you doing?
00:00:24.399 --> 00:00:28.399
The Cybersecurity Bridge podcast is about cybersecurity.
00:00:28.480 --> 00:00:31.760
And in each episode, we look at an area of cybersecurity.
00:00:32.159 --> 00:00:35.119
We break that the podcast into three sections.
00:00:35.520 --> 00:00:39.280
In the first section, we talk about the present of that area of cybersecurity.
00:00:39.679 --> 00:00:43.920
In the second section, we talk about the future of that area of cybersecurity.
00:00:44.079 --> 00:00:46.640
And in the third, that's the cybersecurity bridge.
00:00:46.880 --> 00:00:49.520
How do we get from the present to the future?
00:00:49.920 --> 00:00:51.759
And I've got an old friend on.
00:00:51.920 --> 00:01:01.039
I've got a lot of old friends that participate, but this old friend, uh really smart person that I've known for years, Brian Dye, the CEO of CoreLight.
00:01:01.439 --> 00:01:02.079
Brian, welcome.
00:01:02.799 --> 00:01:03.679
John, thanks for having me.
00:01:03.759 --> 00:01:04.799
It's great to see you again.
00:01:06.319 --> 00:01:13.280
And we're going to be talking more or less about uh network security and a lot of other areas peripheral to network security.
00:01:13.359 --> 00:01:19.280
But before we do, are you ready for a cybersecurity trivia question, Brian?
00:01:20.239 --> 00:01:23.599
How about I'm as ready as I can possibly be, even if that doesn't mean I'm ready.
00:01:23.680 --> 00:01:24.159
Hit me, John.
00:01:24.319 --> 00:01:26.239
We'll uh worst case I get super embarrassed.
00:01:26.879 --> 00:01:27.200
Okay.
00:01:28.000 --> 00:01:30.560
So I think you'll get this, but we'll see.
00:01:30.959 --> 00:01:35.519
Um we can't talk about network security without thinking of firewalls.
00:01:35.599 --> 00:01:42.560
And so the question is who wrote the first technical paper describing firewalls?
00:01:42.719 --> 00:01:48.640
And the bonus would be if you knew what year and what company and even why they wrote this, but I'll explain.
00:01:49.120 --> 00:01:52.239
Was it Dave Brizzoto?
00:01:52.959 --> 00:01:54.719
Was it Nigam Nitra?
00:01:55.040 --> 00:01:56.480
Was it Bill Cheswick?
00:01:57.120 --> 00:01:59.439
Jeff Mogul or Gil Schwed?
00:02:00.560 --> 00:02:01.680
Oh my gosh.
00:02:02.239 --> 00:02:09.520
Uh there's a section on like Wait, wait, don't tell me, this uh NPR podcast where like the guest gets to call to the audience.
00:02:09.599 --> 00:02:11.759
I feel like I wish I had to call the audience right now.
00:02:12.080 --> 00:02:15.360
I'm gonna go with Cheswick, but it's a complete guess.
00:02:15.919 --> 00:02:16.240
Okay.
00:02:16.560 --> 00:02:18.560
Uh no, it's not dope cheswick.
00:02:18.800 --> 00:02:20.639
No, I did extensive research.
00:02:20.719 --> 00:02:23.680
I spent months, months doing this.
00:02:23.759 --> 00:02:26.719
Uh holding apparently on Google, yeah.
00:02:27.039 --> 00:02:33.759
And and uh as a Massachusetts native, I'm proud of the fact that the first technical paper was in 1988.
00:02:34.080 --> 00:02:42.960
It was by a guy named Jeff Mogle at Digital, Digital Equipment Corporation, which uh was in Maynard, Massachusetts, and I brought my kids up in the next town.
00:02:43.199 --> 00:02:47.599
And it was in relation or in response to the Morris worm in 1988.
00:02:47.759 --> 00:02:56.080
So Cheswick, I think, was uh instrumental in the actual implementation of firewalls, but uh the first paper, Jeff Mogle.
00:02:56.879 --> 00:02:59.039
So let's move beyond that.
00:02:59.199 --> 00:03:01.120
Uh one piece of history, great stuff.
00:03:02.000 --> 00:03:08.719
So tell me, so I had uh Greg Bell on last year, and uh and he is your colleague at at Corlay.
00:03:08.960 --> 00:03:15.439
But tell me, what's the state of network security and and how have things changed in the last year?
00:03:16.240 --> 00:03:18.639
You know, it's uh it's actually really fascinating.
00:03:18.800 --> 00:03:21.280
We're in a bit of a reinvention, I would say.
00:03:21.520 --> 00:03:23.680
And there's two big forces driving it.
00:03:23.919 --> 00:03:43.520
One is if you look at the last 10 or 15 sys advisories, about 80% of them have a line stuck in there that says, as one of their top three recommendations, that says you should do network baseline and anomaly detection because you need to be able to find and address these perimeter evasive attacks that are doing living off the land.
00:03:43.680 --> 00:03:48.960
So that evolution of the threat landscape that is doing what attackers always do, right?
00:03:49.039 --> 00:03:52.800
Going to the weak spot in the defensive kind of uh infrastructure, that's a big one.
00:03:52.960 --> 00:04:04.960
And the second big one is this AI acceleration, the attacker's use of AI and the acceleration, which leads to automation, which leads to needing great data as as uh as part of that automation program.
00:04:05.199 --> 00:04:18.240
So all those are forcing, frankly, defenders to take a look at, you know, call it the 15-year-old security stack, kind of net flow, standalone IDS and PCAP, and saying, oh, wait, that's not good enough for the modern era.
00:04:18.399 --> 00:04:24.000
So, you know, lots to unpack there, but like that that moment of reinvention is probably the biggest thing.
00:04:24.879 --> 00:04:28.720
And so let now let's talk about how that's being reinvented.
00:04:28.879 --> 00:04:33.920
So uh I think of Coralite and I think of Zeek and Bro, I think of Suricata.
00:04:34.240 --> 00:04:39.120
And so, how are those things being reinvented to address the kinds of things that you just talked about?
00:04:39.519 --> 00:04:42.480
You know, it it falls into a couple of categories.
00:04:42.720 --> 00:04:45.439
First is just raw points of visibility.
00:04:45.600 --> 00:04:52.879
You know, I am incredibly surprised at, you know, even some of the largest banks that we talk to that you would think would be on the cutting edge of everything.
00:04:52.959 --> 00:04:54.720
And by the way, they generally are.
00:04:54.879 --> 00:05:07.199
But even amongst that ecosystem, you'll find folks that are saying, hey, we've been doing a ton at the endpoint, we've been doing a ton on identity, we haven't really been looking at network outside of the firewall for the past eight or 10 or 12 years.
00:05:07.439 --> 00:05:16.560
And so with this recognition that, gee, I haven't actually even been paying attention to this world, and now I kind of need to make it a priority, that's been a really big thing.
00:05:16.720 --> 00:05:20.959
Uh, and that what that turns into is placement of points of visibility.
00:05:21.199 --> 00:05:28.560
Because if what you're looking for is living off the land attacks, sitting there at the perimeter is only a portion of what you're doing, right?
00:05:28.720 --> 00:05:33.360
So sitting at kind of traditional north-south data center ingress-egress, it's not the full picture.
00:05:33.439 --> 00:05:38.720
You need to look at your secure enclaves, like your DNS subnets, your VPN concentrators, things like that.
00:05:38.800 --> 00:05:41.519
And you need to be looking at key points in your East-West.
00:05:41.600 --> 00:05:42.560
So that's one big thing.
00:05:42.720 --> 00:05:45.199
Just points of visibility is a big change.
00:05:45.439 --> 00:05:51.759
The second big change is moving from signatures to behavioral and kind of ML for detection.
00:05:51.920 --> 00:06:01.759
So if you look at a, you know, the the bane of the traditional IDS world, it's that they become alert cannons that kind of catch the known, but they don't catch the modern or the novel attacks.
00:06:01.920 --> 00:06:14.160
And so a lot of what's happening in this kind of NDR reinvention is you bring behavioral, you bring supervised and unsupervised ML, you bring more analytics compute to find the types of attacks that go beyond what signatures can do.
00:06:14.399 --> 00:06:16.319
By the way, you still need the signatures.
00:06:16.560 --> 00:06:17.040
Why?
00:06:17.279 --> 00:06:20.560
Cheap, cheerful, effective for a bunch of kind of basic stuff.
00:06:20.639 --> 00:06:22.639
So I'm not saying to take those out of the equation.
00:06:22.720 --> 00:06:24.000
That doesn't help anybody.
00:06:24.079 --> 00:06:28.319
Uh, but you know, you do have to kind of move beyond into some of the more advanced kind of forms of math.
00:06:28.480 --> 00:06:39.680
Uh, and then the third one is realizing that the evidence, the ground truth of what's happening on the network turns up to be incredibly useful for a wide range of use cases.
00:06:39.839 --> 00:06:44.480
That could be compliance or fraud or API security or insider threat.
00:06:44.560 --> 00:06:46.560
I mean, it's amazing what folks are doing.
00:06:46.720 --> 00:06:53.040
But the real compelling one right now is I need it as the fuel for my AI sock reinvention, right?
00:06:53.120 --> 00:06:55.680
My the automation programs I'm trying to drive in the SOC.
00:06:55.759 --> 00:06:57.279
So those are the big three.
00:06:58.160 --> 00:07:01.920
Yeah, and I I'm just gonna complain a little bit here.
00:07:02.160 --> 00:07:11.519
I think there are a couple of things that have happened in the last two years, or not two years, but the last few years, that uh are um just hyperbole by the industry.
00:07:11.680 --> 00:07:15.199
One is that XDR is all you need, or even EDR is all you need.
00:07:15.279 --> 00:07:18.720
You don't need NDR, you don't need to monitor the network.
00:07:19.199 --> 00:07:20.639
Absolutely not true.
00:07:21.279 --> 00:07:29.040
And then the the second one is that uh network security is all about signatures, and signatures are looking uh in the rear view mirror.
00:07:29.199 --> 00:07:30.480
And that's not true.
00:07:30.720 --> 00:07:34.959
So um I know I'm ranting, but uh it sounds like you agree.
00:07:35.439 --> 00:07:36.160
Oh for sure.
00:07:36.319 --> 00:07:38.879
And look, the the I'll I'll pile on a little bit.
00:07:38.959 --> 00:07:47.279
If you think about the change in customer conversations we've had over the past few years, you know, we would find four years ago it was a it was a binary conversation.
00:07:47.360 --> 00:07:48.560
It was really interesting.
00:07:48.800 --> 00:07:54.879
Folks had either kind of wrapped their head around this and said, oh, wait, I have a super well deployed EDR environment.
00:07:55.040 --> 00:07:58.000
And by the way, if you don't have EDR, you shouldn't even talk to us.
00:07:58.079 --> 00:08:00.000
You should go get a modern EDR and go get deployed.
00:08:00.079 --> 00:08:01.920
I'll I'll say that until the cows come home.
00:08:02.079 --> 00:08:10.639
But you would get folks that were at a super well-deployed EDR still seeing a bunch of issues, and then they were forced into the realization of exactly what you said.
00:08:10.720 --> 00:08:17.519
Like, oh, turns up the MITRE attack framework has an entire category of threats best observed and found from the network, and there's a reason for that.
00:08:17.680 --> 00:08:18.639
Like, you know, go figure.
00:08:18.800 --> 00:08:24.160
So you would have a set of folks that deeply understood that and were kind of among the early adopters of the NDR category.
00:08:24.240 --> 00:08:32.480
And then you had the other half of folks we were talking to where the first part of every customer conversation was, I've got a great EDR wide wide e Jew.
00:08:32.559 --> 00:08:39.200
And you know, the ratio of that was 50-50 four years ago, and it's 90-10 now, right?
00:08:39.279 --> 00:08:40.879
And I think there's a lot of things that go into that.
00:08:40.960 --> 00:08:43.519
But this recognition that, like, look, let's not kid ourselves, right?
00:08:43.600 --> 00:08:45.519
Defense and depth exist for a reason.
00:08:45.840 --> 00:08:49.360
You know, the endpoint gives you depth, the network gives you breadth, it's not a new concept.
00:08:49.440 --> 00:08:51.200
We're just doing a lot better now.
00:08:51.519 --> 00:09:00.639
Yeah, not to mention, Brian, that uh a lot of the attacks go after devices that don't have an EDR agent, as we know.
00:09:00.879 --> 00:09:18.559
Uh, and the attackers are smart, they know that to circumvent EDR, you could manipulate the EDR itself, uh, change the logs, build some kind of EDR-resistant malware, or you could attack elsewhere, and that's where the network security comes in.
00:09:18.639 --> 00:09:20.159
So it's really important.
00:09:20.639 --> 00:09:29.840
Yeah, and by the way, uh, one of our advisors is Rob Joyce, who used to run cyber for the NSA, used to run tailored access operations for the NSA back when that unit had that name.
00:09:30.000 --> 00:09:32.000
Uh wonderful human being on many levels.
00:09:32.240 --> 00:09:36.000
He and I did a joint session at RSA, not this past one, but the year before.
00:09:36.080 --> 00:09:42.080
And he had a great example of that, where there was an attack that had been published where the attacker got a webcam.
00:09:42.240 --> 00:09:51.360
They got shell on the Linux operating system in the webcam, and then they were you from that shell, they were doing SMB mounts and driving encryption from the webcam.
00:09:51.679 --> 00:09:53.759
And, you know, Rob kind of summarized it well.
00:09:53.840 --> 00:09:57.600
He says, no one has that attack in their throat in their threat profile.
00:09:57.759 --> 00:10:01.360
Like no one's modeling for that because it's just so creative.
00:10:01.519 --> 00:10:03.759
But to your point, that's exactly what folks do, right?
00:10:03.840 --> 00:10:06.159
They're going to bypass the no defenses any way they can.
00:10:06.320 --> 00:10:07.840
That's the good, the latest example.
00:10:08.000 --> 00:10:19.919
And you know, we've all heard, and this is absolutely true, that the time period from uh announcement of a disclose of a vulnerability to exploit of that vulnerability used to be three weeks.
00:10:20.159 --> 00:10:21.440
Now it's hours.
00:10:21.600 --> 00:10:30.240
And with Glasswig and Mythos and the and that not just those, but honestly the continued progress of the flexion of the foundation models, this this isn't going away, right?
00:10:30.320 --> 00:10:34.799
This ability to kind of find and exploit these novel attack paths is only accelerating.
00:10:35.440 --> 00:10:40.000
Yeah, now before we move on to the future, I want to ask you one more question about the present.
00:10:40.080 --> 00:10:57.279
And it's it's related to AI, and that is uh in my research, I noted that uh that Coralite and also the Zeke community, the Circata community are now building in guardrails to monitor AI traffic itself.
00:10:57.440 --> 00:11:00.480
So uh that's probably something people most people don't know about.
00:11:00.559 --> 00:11:02.000
So can you talk about that?
00:11:02.320 --> 00:11:10.399
Yeah, and it it's really an extension of the point I made earlier, where if you have ground truth of what's happening on the network, you've got this fantastic data source.
00:11:10.559 --> 00:11:14.799
And asking what the use case is for great data is like asking what the use case is for plastic.
00:11:14.960 --> 00:11:16.080
It's all of them, right?
00:11:16.159 --> 00:11:17.679
And this is just one good example.
00:11:17.840 --> 00:11:23.120
So if you think about detecting shadow AI, you see that activity happening on the network.
00:11:23.200 --> 00:11:27.519
You're right, you see the foundation models, you see MCP servers, you see agents, right?
00:11:27.600 --> 00:11:32.960
And so it was actually very straightforward to extend our current app identification capabilities.
00:11:33.120 --> 00:11:39.679
And frankly, even before we did that, folks were using the data we generate in a threat hunting style to go and find these things.
00:11:39.919 --> 00:11:55.440
So, you know, this a lot of the way we think about the value of NDR as a category and the value that we as CoreLight are trying to provide is if we can give you ground truth of what's happening on your network, that is going to let you answer the question of tomorrow that you don't know about today.
00:11:55.600 --> 00:12:03.679
And so today's hot topic of the of the day is help me find the new shadow, uh shadow IT, which is you know unauthorized Gen AI applications.
00:12:03.840 --> 00:12:04.720
100% true.
00:12:04.960 --> 00:12:08.000
We've also got folks saying, hey, what about post-quantum?
00:12:08.080 --> 00:12:10.720
How do I understand the encryption ciphers happening on my network?
00:12:10.879 --> 00:12:15.919
We've got tons of folks saying, hey, this net new vulnerability, how do I find examples of those exploits?
00:12:16.080 --> 00:12:22.000
And not to mention the more mundane stuff like, oh, can I automate more of my compliance attestation and kind of things like that?
00:12:22.240 --> 00:12:25.279
All those are a function of do I have the right data?
00:12:25.440 --> 00:12:32.080
Do I have the right coverage, vantage points for that data, uh, and do I have the right kind of uh uh time retention of that data?
00:12:32.240 --> 00:12:39.519
So we really think about the data as the first class citizen, and then you know, we leverage that data to answer all these types of questions.
00:12:40.960 --> 00:12:45.440
Yeah, that's a good answer that tees up our discussion on the future.
00:12:45.679 --> 00:12:57.279
And again, this uh something that most people may not understand is the role of the network in AI model development and application development.
00:12:57.440 --> 00:13:02.000
And that's true in training, it's true in inference, it's true in data ingestion.
00:13:02.240 --> 00:13:06.639
So talk about that and then talk about the security implications involved in that.
00:13:06.960 --> 00:13:09.120
Yeah, it it's a it's a great point, John.
00:13:09.279 --> 00:13:36.080
And one of the ahas that a lot of folks also don't realize was because of the open source heritage we came from and the really set of elite defenders that we serve, both in the in the pay community and in the in the open source community, uh, we were able to get engaged in the actual model development and tuning programs at a number of the big flagship providers, because they want those models to understand the canonical security data and be able to act on it out of the box with no further vendor tuning, right?
00:13:36.159 --> 00:13:38.159
This is to everyone's kind of mutual advantage.
00:13:38.320 --> 00:13:47.200
And so if we think about what are the implications of that, we see folks doing a uh a progression of AI-based automation kind of across the SOC.
00:13:47.519 --> 00:13:53.840
And because of the breadth that the network provides, we're one of three really essential ingredients in that automation, right?
00:13:53.919 --> 00:13:57.919
You need endpoint for depth, you need network for breadth, you need identity to bring it together.
00:13:58.080 --> 00:14:01.360
I'm not telling, I'm I'm not, you know, I'm not speaking rocket science here, right?
00:14:01.440 --> 00:14:02.559
Those are pretty foundational.
00:14:02.720 --> 00:14:08.240
So when you do that, we're seeing folks move through a three-part evolution, if you will.
00:14:08.399 --> 00:14:10.399
Step one is assistance.
00:14:10.480 --> 00:14:12.799
Help me do what I'm doing today, but do it faster.
00:14:13.039 --> 00:14:20.960
And so, you know, we and a bunch of other folks do things like, hey, translate this alert into English, help me, uh, help me understand what I should do next, right?
00:14:21.039 --> 00:14:22.879
Give me investigation guidance, things like that.
00:14:22.960 --> 00:14:25.200
Uh natural language query, that's a good example.
00:14:25.440 --> 00:14:33.200
This phase where a lot of folks are in right now, uh, and we're actually uh leading in the category in this, is moving from assistance to full automation.
00:14:33.360 --> 00:14:38.240
So we will take the riskiest assets in the environment and run a soup to nuts investigation.
00:14:38.399 --> 00:14:42.559
And you know, the key here is you've got to be transparent and you've got to earn trust.
00:14:42.639 --> 00:14:44.399
And of course, you have to be accurate, right?
00:14:44.480 --> 00:14:48.320
And and this is gonna be one of the key pivots to kind of how I think things need to evolve.
00:14:48.480 --> 00:15:02.799
But where I think things are going, which is gonna be truly game-changing, is when you get multi-product integration and a true AI SOC that's gonna enable not just kind of not just task automation, but true workflow automation.
00:15:02.960 --> 00:15:09.759
And instead of having to worry about defending an individual, you know, trusting an individual tool, you get kind of triangulation across tools.
00:15:09.919 --> 00:15:15.600
So kind of the new defense in depth, I think, is going to be cross-AI triangulation, right, in a really big way.
00:15:16.559 --> 00:15:17.519
I think so too.
00:15:17.600 --> 00:15:19.759
I talked a lot about that with people at RSA.
00:15:20.000 --> 00:15:23.519
And I think there's some consensus on that.
00:15:23.600 --> 00:15:34.799
Then there are some other people who have more of a proprietary agenda, but talk more about that because I I mean, historically, I've always thought of Coralite as just a great monitoring and data system.
00:15:34.960 --> 00:15:39.759
And now that data is going to feed other models, it's going to feed other tools.
00:15:39.919 --> 00:15:48.000
Now I see a future where that kind of specialization is in the identity side, it's on the data side, with it's already in the endpoint, the network side.
00:15:48.159 --> 00:15:52.159
So, how does that all work uh collaboratively and come together?
00:15:52.480 --> 00:15:55.360
Yeah, there's two things I think that are really driving this.
00:15:55.600 --> 00:16:00.240
One is domain expertise, and two is the SIM moving to a federated model.
00:16:00.399 --> 00:16:06.080
So, our kind of mental model of how this agentix SOC is going to work uh is imagine it like a table.
00:16:06.240 --> 00:16:09.440
You're gonna have your individual detection and response domains, right?
00:16:09.519 --> 00:16:12.960
You've got EDR, NDR, ITDR, you know, can add them all up.
00:16:13.039 --> 00:16:14.320
Those are the legs of the table.
00:16:15.200 --> 00:16:19.120
The job of each leg is to be the master of its domain, right?
00:16:19.279 --> 00:16:28.080
So we need to provide, you know, we generate the best data we can, generate the best analytics we can, and drive our own kind of AI-based automation within our leg of the table.
00:16:28.320 --> 00:16:42.240
Then we have to be a constructive partner to the SIM or AI SOC tool or frankly the large language models, kind of whatever folks are doing at that cross AI layer, because there's a subset of data that's gonna continue to need to be aggregated, right?
00:16:42.320 --> 00:16:45.759
The alerts and a little bit of context around those alerts is kind of a no-brainer.
00:16:45.919 --> 00:16:48.080
That's your minimum threshold that you need to bring in.
00:16:48.320 --> 00:16:51.919
But, you know, I, you know, both CrowdStrike and Cisco are investors of ours.
00:16:52.000 --> 00:16:56.320
And I would tell you that both of them believe that you're gonna have to move to a federated model, right?
00:16:56.639 --> 00:16:58.159
At least in some way, shape, or form.
00:16:58.320 --> 00:17:00.000
Different people are tackling it different ways.
00:17:00.159 --> 00:17:04.000
The certainly the AI SOC startups are certainly starting with a federated model.
00:17:04.160 --> 00:17:12.400
So you've got the alerts in the context centrally, but now each of us, EDR, NDR, ITDR, you name it, we have to be kind of an agentic partner.
00:17:12.480 --> 00:17:19.920
So imagine you're doing uh, and actually, we just did an announcement at RSA around CrowdStrike Charlotte and their AI canvas that actually enables this.
00:17:20.079 --> 00:17:30.160
If you're doing an investigation in Charlotte and you want to say, hey, tell me more about this alert or tell me more about this IP address, you don't want to have to like re-ingest all the possible data and do that locally.
00:17:30.240 --> 00:17:38.000
You want to be able to do either an MCP or an agent-to-agent call to another tool, in this case Corlite, and say, hey, tell me what you know about this IP.
00:17:38.160 --> 00:17:39.920
And we're not going to give you the world.
00:17:40.000 --> 00:17:46.960
We're going to do our own novel analysis and kind of bring the results of that kind of back to the AI analyst workbench, if you will.
00:17:48.240 --> 00:17:52.000
Brian, what you just described is SOPA 2026.
00:17:52.240 --> 00:17:55.759
SOPA is my model that I came out of ESG with.
00:17:56.000 --> 00:18:01.039
Um, but that's basically what you're what you're talking about, and I'm going to write more about that.
00:18:01.599 --> 00:18:08.799
Um so let me, you mentioned anthropic in the mythos uh uh release, and there's a lot of press about that this week.
00:18:09.440 --> 00:18:20.480
And um for those of you people who don't know, that's uh uh it's it's uh apparently uh architected so it can detect vulnerabilities extremely quickly at machine speed.
00:18:20.720 --> 00:18:21.839
What will that do?
00:18:22.640 --> 00:18:26.000
So I'm gonna let me throw a little bit of speculation.
00:18:26.720 --> 00:18:36.640
What's stopping us from understanding what it's finding and translating that immediately through AI into virtual patches on something like Suricata?
00:18:36.960 --> 00:18:39.920
Uh am I way off base here or is that possible?
00:18:40.240 --> 00:18:42.880
You are not off base, and that's absolutely where we're all going.
00:18:43.119 --> 00:18:56.720
And I would add a use case to that, by the way, because if you think about what's transforming already, and I and I I hope what what everyone's seeing when they look at Glasswing and Mythos is this is doing a thing that's already happening just way better.
00:18:56.880 --> 00:18:59.680
So it's not like there's something brand new that's never being done before here.
00:18:59.759 --> 00:19:05.839
It's just doing a lot better, so much better that even the anthropic folks are like, holy cow, we can't let this get in the hands of the bad folks, right?
00:19:06.000 --> 00:19:09.599
So if you look at the implications on that, I think there's two, there's two sides of it.
00:19:09.680 --> 00:19:12.480
There's the Vuln side and there's the detection engineering side.
00:19:12.640 --> 00:19:13.519
Okay, they're related.
00:19:13.599 --> 00:19:15.359
They're both sides of the same coin, right?
00:19:15.519 --> 00:19:28.720
So on the vuln side, you know, all of us as providers, I mean, certainly us as a as a provider into really high-end critical uh infrastructure providers, we have had deep in our ethos for a long time that we cannot be the Vuln in our customer supply chain.
00:19:28.880 --> 00:19:32.240
Like that's a that's a company-ending kind of uh event for us.
00:19:32.400 --> 00:19:38.559
So, for example, our InfoSec team is four times the size of our IT team, which is just kind of a crazy statement when you think about it, right?
00:19:38.640 --> 00:19:39.839
Most folks, that's inverted, right?
00:19:39.920 --> 00:19:42.000
You know, your IT team is four times the size of InfoSec.
00:19:42.319 --> 00:19:43.839
So like that's been a big priority.
00:19:44.000 --> 00:19:54.799
And so all of us as security providers need to be super aggressive about using every tool we can to find the vulnerabilities in our own code, ensuring that those are rock solid and can't be exploited.
00:19:54.960 --> 00:19:56.400
That is an IQ test.
00:19:56.480 --> 00:19:58.960
Uh, it's not just an IQ test, it's an ethics test.
00:19:59.039 --> 00:19:59.920
Like, let's be honest, right?
00:20:00.000 --> 00:20:01.920
Like that needs to be kind of front and center.
00:20:02.079 --> 00:20:06.480
But the other opportunity here, think about the automation for the defender.
00:20:06.799 --> 00:20:12.480
Right now, you know, a lot of folks are focusing on the highest value thing we can do, right?
00:20:12.559 --> 00:20:15.759
Which is security teams are overwhelmed by the volumes of alerts.
00:20:15.920 --> 00:20:18.000
They have a they cannot get to all of those.
00:20:18.079 --> 00:20:21.519
So this isn't a dollar savings or a or a hey count reduction problem.
00:20:21.599 --> 00:20:23.839
This is how deep in my security queue can I go.
00:20:24.000 --> 00:20:28.319
So we're all going after how do we automate the triage and the instant response process, right?
00:20:28.480 --> 00:20:31.599
Again, highest value thing makes a ton of sense.
00:20:31.839 --> 00:20:33.279
Where are we gonna go next?
00:20:33.519 --> 00:20:35.680
We're gonna keep going down that value chain, right?
00:20:35.759 --> 00:20:48.880
Because if you look at threat hunting and detection engineering, the same tools that let you go and kind of understand where the vulnerabilities are are also gonna be incredibly effective as saying, hey, here's the types of things we see folks doing in this environment.
00:20:49.039 --> 00:20:54.000
How do we go and closed loop automate both the threat hunting and the actual alert creation, right?
00:20:54.079 --> 00:20:56.480
The detection engineering part part of that process.
00:20:56.640 --> 00:20:59.680
I think this is gonna unlock all sorts of opportunities.
00:20:59.839 --> 00:21:05.759
And if you go back to kind of where's the evolution here, back to your SOPA paper, because again, you are you are 100% spot on here.
00:21:05.839 --> 00:21:07.039
I've I've read that work.
00:21:07.200 --> 00:21:15.759
The we're evolving from human assistance to human in the loop, where most folks are now or where they're trying to get to, to full automation.
00:21:15.920 --> 00:21:19.519
And the real key question is how do we earn the trust, right?
00:21:19.599 --> 00:21:24.720
To kind of, you know, as as defenders and as providers to kind of move through that maturity cycle.
00:21:26.400 --> 00:21:27.839
I I totally agree.
00:21:28.000 --> 00:21:42.160
And um I appreciate what you just said because I think there's a little panic with uh anthropic with those, and we should certainly uh have respect for what it can do and what uh vulnerabilities it can open.
00:21:42.480 --> 00:21:46.160
Um, but we also have to look at the opportunity there, and you just described that.
00:21:46.319 --> 00:21:49.599
I I think that that's uh it's up to our industry to do that.
00:21:49.839 --> 00:21:54.319
Um so now let's move on to the cybersecurity bridge, how we get from here to there.
00:21:54.559 --> 00:21:59.759
So one thing I think, and I I looked again, I did some research and um I saw that Suracana.
00:22:00.319 --> 00:22:04.240
8.0 came out, uh Zeek 8.0 and 8.1 came out.
00:22:04.400 --> 00:22:07.680
So clearly these are active uh projects.
00:22:08.079 --> 00:22:23.839
Do we have the uh the horsepower in the community to keep up with all of the things that we talked about in terms of just basic security, threat detection, response, data uh ingestion, and the AI component as well?
00:22:23.920 --> 00:22:26.799
Is that are those communities robust enough to do that?
00:22:27.200 --> 00:22:27.839
Absolutely.
00:22:28.000 --> 00:22:31.759
Uh the i when I think about kind of the strengths of the communities, a couple of things come to mind.
00:22:31.920 --> 00:22:43.920
One, do we actually have the coding horsepower to make sure that we are uh coding horsepower and automation to be able to find and uh and address not just uh new features, but ensure that we're kind of staying on top of vulnerabilities.
00:22:44.000 --> 00:22:52.240
And like I said, because of the ethos of the providers, both us and the developers in the in the extended Suricata community, uh I have zero questions on that.
00:22:52.480 --> 00:22:53.839
I feel like the ethos is there.
00:22:53.920 --> 00:22:58.720
And bear in mind, what are all uh what are we at Coralite doing, like a lot of other software developers?
00:22:58.880 --> 00:23:02.160
We're looking to use the AI tools to accelerate what we can do.
00:23:02.319 --> 00:23:07.279
So, you know, Coralite happens to be really well capitalized and investing very aggressively for growth.
00:23:07.440 --> 00:23:11.759
You know, we built RD by about 40% last year, which is a non-trivial number.
00:23:11.920 --> 00:23:26.559
If you can take that type of raw dollar investment and then make that a 2x throughput by using the same kind of engineering, you know, tools for engineering acceleration that the attackers are using for destructive capability, I don't think we're gonna be facing a throughput or a bandwidth problem.
00:23:26.880 --> 00:23:39.759
I think we're actually we're facing a moment where with when you combine the AI leverage, internal AI leverage, uh, and the actual staffing levels that we're putting in, we're gonna have a ton of calories to go make some fantastic things happen.
00:23:40.000 --> 00:23:48.480
The second thing that gives me a lot of of courage and confidence here is there is a there is a feedback system that's been happening for the last 30 years.
00:23:48.640 --> 00:23:52.000
It's actually this year's the 30th anniversary of the Zeek project, right?
00:23:52.079 --> 00:23:53.839
Uh it's kind of a milestone year.
00:23:54.079 --> 00:24:02.079
But the reason that that project has done so well, and the reason that the data is so powerful is that it's a living, breathing, evolving data set.
00:24:02.240 --> 00:24:12.640
So there's this virtuous cycle of, you know, elite IR analysts and elite, you know, uh IR consultants, you know, uh some of the biggest organizations in the world, they're facing these challenges.
00:24:12.720 --> 00:24:17.599
They find they need a new data type or a new capability in the detection models or whatever it is, right?
00:24:17.680 --> 00:24:20.480
Not just a model, a capability in the detection models.
00:24:20.640 --> 00:24:25.519
They go then push on kind of the Bazique project, the Suricata project, those get added in, right?
00:24:25.599 --> 00:24:27.200
And then the flywheel continues, right?
00:24:27.279 --> 00:24:30.960
Because novel data enables novel analytics and that whole flywheel continues.
00:24:31.200 --> 00:24:35.839
I didn't appreciate that until, you know, because I've I've been at Correlate about eight years.
00:24:36.000 --> 00:24:44.640
Uh, I think maybe the second year in, I got with, sat down with one of our founders, Seth Hall, and I had him show me what the data set looked like eight years earlier.
00:24:44.880 --> 00:24:47.039
And it was like a completely different data set.
00:24:47.119 --> 00:24:48.640
It was like the two things had never met.
00:24:48.720 --> 00:24:52.160
And so you really, you know, it's it's kind of like watching your kids grow up.
00:24:52.319 --> 00:24:55.039
From one week to another, you can't see your kid change.
00:24:55.440 --> 00:24:57.039
One year to another, you see him change.
00:24:57.119 --> 00:25:00.799
And when they bridge from elementary to middle school to high school, you're dealing with different human beings.
00:25:00.960 --> 00:25:03.519
And the open source project is exactly like that.
00:25:03.599 --> 00:25:05.440
And that flywheel of innovation.
00:25:05.519 --> 00:25:17.119
So as these elite defenders are wrestling with shadow IT and AI-driven automation and living off the land detection, all these things, they're continuing to push on us as the providers of that tech to do better.
00:25:17.200 --> 00:25:26.559
And that that flywheel is what gives me confidence that uh that, or let me restate that flywheel and the bandwidth execute on it, because the two things do have to go together.
00:25:26.720 --> 00:25:28.640
That gives me a lot of confidence.
00:25:30.079 --> 00:25:31.599
Yeah, well described.
00:25:31.759 --> 00:25:37.759
Um does Zeke still have that bro logo with the eye looking at you?
00:25:38.400 --> 00:25:47.359
No, uh, yeah, to be overly candid, you know, the the original name of Bro all those years ago was kind of wonderfully intellectual.
00:25:47.519 --> 00:25:51.759
It was a reference to George Orwell's Big Brother and the dual-edged nature of network monitoring.
00:25:51.839 --> 00:25:53.200
It can be used for good or evil.
00:25:53.279 --> 00:25:54.640
That all made a ton of sense.
00:25:54.880 --> 00:26:02.000
Right until you got to the late teens and the early 20s, when, like, honey, I'm going to Vegas for Brocon was no longer an acceptable sentence.
00:26:02.079 --> 00:26:06.160
Uh, that renaming had to change for very obvious reasons.
00:26:06.240 --> 00:26:09.839
So the project is now called Zeke, and they've actually changed the logo around.
00:26:09.920 --> 00:26:17.519
So now it's a it's a stylized Z that if you look at it has arrows that basically represent uh they're indicative of network connections.
00:26:17.680 --> 00:26:28.640
So uh if we we uh being the corp uh the the kind of the the main corporate sponsor for that project, uh we we wanted to help uh help it live up to its reputation from a branding perspective.
00:26:28.720 --> 00:26:29.519
How about that?
00:26:29.839 --> 00:26:30.160
Okay.
00:26:30.720 --> 00:26:33.279
Because that I logo always frightened me.
00:26:33.680 --> 00:26:37.200
It's just like yeah, it's like a cyclops looking at you.
00:26:37.519 --> 00:26:38.240
But I digress.
00:26:39.680 --> 00:26:40.640
Like a lot of things in life.
00:26:41.119 --> 00:26:42.400
Just a long time ago.
00:26:42.720 --> 00:26:45.920
Um so uh I'm gonna ask you something about Coralite.
00:26:46.079 --> 00:26:51.519
So on Corlite's website, I noticed uh and read a little bit about something called the Polaris project.
00:26:51.839 --> 00:27:03.920
And if you could describe that, it seems like something you're doing uh that would be very beneficial for specific kind of uh LLMs uh for network security.
00:27:04.079 --> 00:27:06.799
Am I wrong or is it well, please describe it?
00:27:07.119 --> 00:27:08.319
No, you're you're spot on.
00:27:08.400 --> 00:27:13.039
And really what it comes down to is networks are messy.
00:27:13.200 --> 00:27:32.240
And so if you think about how you do kind of malware detection, you know, tool set detection, novel attack detection, kind of broadly speaking, security content development, you know, the network doesn't work, doesn't uh it's not easy to do what VirusTotal does, for example, where there's tons of just malware samples, you generate a new model, you throw it against VirusTotal, you see how it works.
00:27:32.400 --> 00:27:41.039
I'm not saying that's easy because amassing the IP set that VirusTotal represents is a multi-year effort and is a massive asset to the community.
00:27:41.119 --> 00:27:43.119
So I'm not denigrating anything there.
00:27:43.279 --> 00:27:46.880
But the network, by definition, is a super messy thing.
00:27:47.039 --> 00:27:51.440
And because you're tracking behaviors, those behaviors can vary, right?
00:27:51.599 --> 00:27:52.799
Some of them are more durable.
00:27:52.880 --> 00:27:58.000
So if you look at how a command and control tool set operates, that's a much more durable thing with a longer half-life.
00:27:58.160 --> 00:28:01.440
Some of them are very novel to how that particular network operates.
00:28:01.599 --> 00:28:05.200
And what is normal on that network is going to be very, very different.
00:28:05.359 --> 00:28:11.440
So you really need to be pretty intimate with your customers to understand what novel, what kind of good content development looks like.
00:28:11.599 --> 00:28:14.799
And so the Polaris program was a response to that challenge.
00:28:14.960 --> 00:28:25.599
So what we do is we essentially enter into kind of content co-development relationships with some of our key customers, where they let us put um actual production sensors into their environments.
00:28:25.759 --> 00:28:28.880
And as a result, we use those sensors that are out of production.
00:28:28.960 --> 00:28:39.920
So they're there for the labs team to kind of do work on to iterate on new content in a way that we get feedback from the organization we are serving and direction from the organization we're serving.
00:28:40.079 --> 00:28:47.200
So we make sure that we are not just coming up with things that we think are a good idea, but we're getting kind of real live kind of direction from the defenders we're working with.
00:28:47.359 --> 00:28:52.079
And we get really good feedback on have you characterized this correctly, right?
00:28:52.240 --> 00:28:55.759
Because the key with the network is the signal to noise ratio.
00:28:55.920 --> 00:28:57.759
That's what it all comes down to, right?
00:28:57.920 --> 00:29:06.240
And so we often think about the difference between a um a false positive and real but uninteresting and dead wrong.
00:29:06.400 --> 00:29:09.119
Like there's three actual levels that matter here, right?
00:29:09.279 --> 00:29:12.799
The first two have value, the third one absolutely doesn't, right?
00:29:12.880 --> 00:29:14.720
But we need, you know, we need the human feedback.
00:29:14.880 --> 00:29:21.519
And if you think about how that fits into an LM and AI world, this is something that I think all of us as vendors are learning.
00:29:21.599 --> 00:29:36.400
And actually, I was just listening to a uh uh uh the the recording of a webcast of a presentation from uh one of the uh uh AI detection engineers who just left Meta and super well-staffed, very sophisticated organizations, you might imagine.
00:29:36.559 --> 00:29:48.559
They realized that simply even going to the defenders themselves and asking them to label what was a good detection from an LLM-based kind of workflow wasn't effective because the analysts didn't agree.
00:29:48.720 --> 00:29:56.640
So you could give the same set of verdicts to the to a the the common pool of analysts, and you would get a pretty wide-ranging set of views.
00:29:56.799 --> 00:30:03.759
And when you get that difference in labeling data, it really destroys the ability to of a model to kind of do uh reinforcement learning.
00:30:03.920 --> 00:30:10.400
So a lot of what we are driving towards is understanding the and assessing the reasoning process of these models.
00:30:10.559 --> 00:30:13.759
And so who do you need feedback from to assess your reasoning process?
00:30:14.079 --> 00:30:15.200
The analysts, right?
00:30:15.279 --> 00:30:16.799
Which comes back to the Polaris program.
00:30:16.960 --> 00:30:23.519
So both from a content direction and from a kind of content quality standpoint, that program has been super essential for us.
00:30:23.599 --> 00:30:28.640
And I'm really grateful to the organizations we work with that that see that mutual interest, right?
00:30:28.720 --> 00:30:31.759
They want to see kind of great content and be able to steer it as well.
00:30:31.839 --> 00:30:35.279
So it really is kind of a two-way, two-way street of benefits, if you will.
00:30:36.079 --> 00:30:38.880
Is that aligned at all to the mitre attack framework?
00:30:39.039 --> 00:30:41.039
It seems like it might be to me.
00:30:41.359 --> 00:30:47.440
It generally is, but one of the nice things about working with the the real defenders is they are not constrained by that framework.
00:30:47.519 --> 00:30:50.400
I think the mitre attack framework is an awesome asset.
00:30:50.559 --> 00:30:52.960
Huge credit to the MITRE team for putting that together.
00:30:53.200 --> 00:31:01.200
It is a, I think it's one of the frankly massively marquee uh uh uh developments that have created common language for all of us.
00:31:01.279 --> 00:31:06.400
But when you're talking to the real defenders, what they're most focused on is what are the attacks that I'm missing?
00:31:06.640 --> 00:31:13.200
And then, yes, afterwards, we will make sure that we kind of think about how that map into the MITRE framework and kind of keep building that aspect of the community.
00:31:13.359 --> 00:31:24.240
But you know, a good example of a non-MITRE kind of piece of content development was that a lot of our customers really care about the volume versus value ratio in the evidence, right?
00:31:24.400 --> 00:31:28.480
Because we could generate three times more data than we do today.
00:31:28.799 --> 00:31:34.799
That is a problem if that data isn't valuable enough to pay for the storage and analysis of it.
00:31:34.960 --> 00:31:41.920
Uh, and in particular, let's say that you're uh putting all this data into a SIM and that SIM prices on a volume basis.
00:31:42.079 --> 00:31:45.200
Now you really care about kind of the volume versus value of that data.
00:31:45.359 --> 00:31:57.759
So a lot of what uh what or one of the big initiatives that we've been driving in this program is how do we do a really smart job of making sure that we tune and filter the data volume to be still incredibly impactful, right?
00:31:57.839 --> 00:32:03.839
So you can't take out the, you can't simply say, oh, I'm gonna alert and only keep the context around the alert.
00:32:04.079 --> 00:32:11.920
That is a failure, like a deep, deep failure, because now you are believing that your alerting is 100% accurate.
00:32:12.160 --> 00:32:16.960
Anyone who believes that is smoking something and should not be doing kind of content development, right?
00:32:17.119 --> 00:32:22.240
So you can so now the question is, how do you take out only the truly known good?
00:32:22.480 --> 00:32:26.240
The stuff that you've got really high conviction has no further analysis, right?
00:32:26.400 --> 00:32:28.000
How do you draw that line?
00:32:28.160 --> 00:32:42.319
And so between our Polaris program, and we actually do a bunch of work with CISA on this particular front, they were a really great kind of co-development partner here, coming up with how do you draw that value, how do you draw that line and kind of make sure that you're getting the best value for volume?
00:32:42.480 --> 00:32:50.799
That's another good example that is incredibly customer valuable, but is kind of outside of the for uh outside the direct structure of the MITRE attack framework.
00:32:51.680 --> 00:32:58.079
Yeah, the value per volume or the volume associated with volume is a critical metric.
00:32:58.240 --> 00:33:00.640
And we've been chasing that for years.
00:33:00.960 --> 00:33:05.039
Uh, and there's been a misguided approach that more is better.
00:33:05.200 --> 00:33:10.640
I see that with threat intelligence, I see that with logs, and more is never better.
00:33:10.720 --> 00:33:12.480
Uh more is messier.
00:33:12.640 --> 00:33:20.400
And so to the extent that you can do that, or we can use AI to do that, I I think that's a great uh advancement that we're providing.
00:33:20.960 --> 00:33:33.839
Yeah, and the only thing I would add is, and I think this is going to be part of the AI uh evolution, there aren't that many companies that treat the data coverage and quality as its own first class set of metrics.
00:33:34.160 --> 00:33:34.480
Right?
00:33:34.559 --> 00:33:44.960
The and it we saw this uh in the early days of the company, that when we looked at the folks that were that were buying from us and we asked them why they bought, one of the biggest words they used was visibility.
00:33:45.519 --> 00:33:52.559
And to the, I'll call them the converted, that is an incredibly powerful word because think about what the inverse is.
00:33:52.720 --> 00:34:05.519
When you have lack of visibility, you have a hole in your network, you have a hole in your entire defensive program, and that hole propagates through what you think your detection coverage is, what you think your uh detection volume is, what you think your MT MTTR is, right?
00:34:05.680 --> 00:34:10.639
You know, to quote one CISO I met with, he said, look, we have we had 3,000 security incidents last year.
00:34:10.719 --> 00:34:11.920
That's not what worries me.
00:34:12.079 --> 00:34:14.880
My worry is that we had 3,200 and we don't know it, right?
00:34:14.960 --> 00:34:16.320
We didn't know the last 200.
00:34:16.400 --> 00:34:18.880
So this visibility word is incredibly powerful.
00:34:19.039 --> 00:34:25.199
And one of the things I think is going to happen is that folks, as folks are rolling out their AI automation programs, what do you have to do?
00:34:25.360 --> 00:34:28.079
You have to map your process incredibly well.
00:34:28.320 --> 00:34:36.159
Mapping that process will lead you into mapping not just the people and the organizational handoffs and the tools, but it will lead to mapping the data you need.
00:34:36.239 --> 00:34:41.920
And is that data actually available in all the parts of your environment and for the right duration of time?
00:34:42.320 --> 00:34:46.239
Because, you know, think about why people uh go to NDR from PCAP.
00:34:46.320 --> 00:34:50.880
It's because if you keep even 30 days of PCAP, then you're dead blind on day 31.
00:34:51.199 --> 00:34:54.719
How many folks have a conscious understanding of the implication of that sentence, right?
00:34:54.800 --> 00:34:59.119
You know, the folks that use visibility as a powerful word, they absolutely get that, right?
00:34:59.199 --> 00:35:04.480
And that's uh I think the AI adoption and the AI automation is going to exaggerate that understanding.
00:35:06.159 --> 00:35:08.000
Yes, once again, you've nailed it.
00:35:08.159 --> 00:35:12.159
Um understanding what you need, how to get it.
00:35:12.639 --> 00:35:21.760
That's another area where I find a lot of people struggle, is uh they start with the detection or the response, and they don't understand the link to the data.
00:35:21.920 --> 00:35:28.320
So Brian, we're just scratching the surface here, but alas, we're out of time.
00:35:28.400 --> 00:35:31.599
So I'm gonna ask you the question I ask all my guests at the end.
00:35:32.159 --> 00:35:40.320
Tell me the one piece of advice that you'd give to CISOs, cybersecurity practitioners in the network security domain.
00:35:41.199 --> 00:35:44.079
You know, to me it's all around AI automation.
00:35:44.159 --> 00:35:50.480
And I think the the guidance would be pick the first two processes you want to automate and map them.
00:35:51.679 --> 00:36:00.000
That is the I think uh just a mandate right now because A, if you're not looking to fight fire with fire, then you're gonna be outgunned worse than you already are.
00:36:00.159 --> 00:36:01.599
Nobody wants to be in that position.
00:36:01.920 --> 00:36:09.679
Second, by mapping the process, you will discover all sorts of things about your team, your organization, your technology that have all sorts of positive side effects.
00:36:09.840 --> 00:36:13.760
And three, once you map the process, you can start to automate it.
00:36:13.840 --> 00:36:21.360
And my biggest kind of plus one, if I could sneak and do a one and a one A here, the one A would be don't let perfect be the enemy of the good.
00:36:21.599 --> 00:36:21.920
Right.
00:36:22.000 --> 00:36:25.119
You know, it's it's uh, I think of it like the Waymo analogy, right?
00:36:25.199 --> 00:36:29.119
Uh, if you if you've ever ridden a Waymo, way I was I was amazed, it's an awesome experience.
00:36:29.199 --> 00:36:29.840
I loved it.
00:36:29.920 --> 00:36:32.800
You know, people get freaked out when a Waymo has an accident.
00:36:33.039 --> 00:36:37.840
The reality is the Waymo's safety record is way better than all of us as human beings, right?
00:36:37.920 --> 00:36:46.480
So don't let perfect be the enemy of the good because we're all evolving to a world where the new defense in depth is actually AI cross AI triangulation.
00:36:46.559 --> 00:36:50.719
And so the sooner we get ourselves kind of on that path, the better it's going to be for everybody.
00:36:50.800 --> 00:36:55.920
And the very first step is pick the two processes you want to automate and map them out.
00:36:57.119 --> 00:37:07.840
And I'll just add, if you pick those processes, then you should be able to map from the processes to the data that you need to follow through on that, which we just talked about.
00:37:08.079 --> 00:37:08.880
So, Brian.
00:37:09.840 --> 00:37:13.280
Many, many thanks for participating in my podcast.
00:37:13.360 --> 00:37:14.159
I really appreciate it.
00:37:14.400 --> 00:37:15.599
This was this was great.
00:37:15.679 --> 00:37:19.679
I'm over here nodding and smiling the whole time when I wasn't on camera.
00:37:19.760 --> 00:37:23.360
So it was it was really uh a good experience for me.
00:37:23.440 --> 00:37:24.400
So thank you very much.
00:37:24.719 --> 00:37:25.920
Hey, John, my pleasure.
00:37:26.000 --> 00:37:26.960
It's great to talk to you.
00:37:27.039 --> 00:37:30.880
I have always followed your work and and uh just uh it's a privilege to join the podcast.
00:37:30.960 --> 00:37:32.320
So looking forward to more in the future.
00:37:32.559 --> 00:37:33.199
Well, thank you.
00:37:33.440 --> 00:37:35.360
You're flattering me, and I'll take it.
00:37:35.519 --> 00:37:43.599
Uh, but for my audience, thanks for watching and stay tuned for the next episode of the Cybersecurity Bridge podcast.
00:00:00.160 --> 00:00:01.120
Hello everyone.
00:00:01.280 --> 00:00:11.199
It's me, John Oltsick, analyst at large at theCUBE Research, and I'm here for another episode of my podcast, The Cybersecurity Bridge.
00:00:11.839 --> 00:00:19.120
If you're one of the few people in the world who's never seen the Cybersecurity Bridge, I'm going to give you the Kevin and uh home alone look.
00:00:21.839 --> 00:00:22.800
What are you doing?
00:00:24.399 --> 00:00:28.399
The Cybersecurity Bridge podcast is about cybersecurity.
00:00:28.480 --> 00:00:31.760
And in each episode, we look at an area of cybersecurity.
00:00:32.159 --> 00:00:35.119
We break that the podcast into three sections.
00:00:35.520 --> 00:00:39.280
In the first section, we talk about the present of that area of cybersecurity.
00:00:39.679 --> 00:00:43.920
In the second section, we talk about the future of that area of cybersecurity.
00:00:44.079 --> 00:00:46.640
And in the third, that's the cybersecurity bridge.
00:00:46.880 --> 00:00:49.520
How do we get from the present to the future?
00:00:49.920 --> 00:00:51.759
And I've got an old friend on.
00:00:51.920 --> 00:01:01.039
I've got a lot of old friends that participate, but this old friend, uh really smart person that I've known for years, Brian Dye, the CEO of CoreLight.
00:01:01.439 --> 00:01:02.079
Brian, welcome.
00:01:02.799 --> 00:01:03.679
John, thanks for having me.
00:01:03.759 --> 00:01:04.799
It's great to see you again.
00:01:06.319 --> 00:01:13.280
And we're going to be talking more or less about uh network security and a lot of other areas peripheral to network security.
00:01:13.359 --> 00:01:19.280
But before we do, are you ready for a cybersecurity trivia question, Brian?
00:01:20.239 --> 00:01:23.599
How about I'm as ready as I can possibly be, even if that doesn't mean I'm ready.
00:01:23.680 --> 00:01:24.159
Hit me, John.
00:01:24.319 --> 00:01:26.239
We'll uh worst case I get super embarrassed.
00:01:26.879 --> 00:01:27.200
Okay.
00:01:28.000 --> 00:01:30.560
So I think you'll get this, but we'll see.
00:01:30.959 --> 00:01:35.519
Um we can't talk about network security without thinking of firewalls.
00:01:35.599 --> 00:01:42.560
And so the question is who wrote the first technical paper describing firewalls?
00:01:42.719 --> 00:01:48.640
And the bonus would be if you knew what year and what company and even why they wrote this, but I'll explain.
00:01:49.120 --> 00:01:52.239
Was it Dave Brizzoto?
00:01:52.959 --> 00:01:54.719
Was it Nigam Nitra?
00:01:55.040 --> 00:01:56.480
Was it Bill Cheswick?
00:01:57.120 --> 00:01:59.439
Jeff Mogul or Gil Schwed?
00:02:00.560 --> 00:02:01.680
Oh my gosh.
00:02:02.239 --> 00:02:09.520
Uh there's a section on like Wait, wait, don't tell me, this uh NPR podcast where like the guest gets to call to the audience.
00:02:09.599 --> 00:02:11.759
I feel like I wish I had to call the audience right now.
00:02:12.080 --> 00:02:15.360
I'm gonna go with Cheswick, but it's a complete guess.
00:02:15.919 --> 00:02:16.240
Okay.
00:02:16.560 --> 00:02:18.560
Uh no, it's not dope cheswick.
00:02:18.800 --> 00:02:20.639
No, I did extensive research.
00:02:20.719 --> 00:02:23.680
I spent months, months doing this.
00:02:23.759 --> 00:02:26.719
Uh holding apparently on Google, yeah.
00:02:27.039 --> 00:02:33.759
And and uh as a Massachusetts native, I'm proud of the fact that the first technical paper was in 1988.
00:02:34.080 --> 00:02:42.960
It was by a guy named Jeff Mogle at Digital, Digital Equipment Corporation, which uh was in Maynard, Massachusetts, and I brought my kids up in the next town.
00:02:43.199 --> 00:02:47.599
And it was in relation or in response to the Morris worm in 1988.
00:02:47.759 --> 00:02:56.080
So Cheswick, I think, was uh instrumental in the actual implementation of firewalls, but uh the first paper, Jeff Mogle.
00:02:56.879 --> 00:02:59.039
So let's move beyond that.
00:02:59.199 --> 00:03:01.120
Uh one piece of history, great stuff.
00:03:02.000 --> 00:03:08.719
So tell me, so I had uh Greg Bell on last year, and uh and he is your colleague at at Corlay.
00:03:08.960 --> 00:03:15.439
But tell me, what's the state of network security and and how have things changed in the last year?
00:03:16.240 --> 00:03:18.639
You know, it's uh it's actually really fascinating.
00:03:18.800 --> 00:03:21.280
We're in a bit of a reinvention, I would say.
00:03:21.520 --> 00:03:23.680
And there's two big forces driving it.
00:03:23.919 --> 00:03:43.520
One is if you look at the last 10 or 15 sys advisories, about 80% of them have a line stuck in there that says, as one of their top three recommendations, that says you should do network baseline and anomaly detection because you need to be able to find and address these perimeter evasive attacks that are doing living off the land.
00:03:43.680 --> 00:03:48.960
So that evolution of the threat landscape that is doing what attackers always do, right?
00:03:49.039 --> 00:03:52.800
Going to the weak spot in the defensive kind of uh infrastructure, that's a big one.
00:03:52.960 --> 00:04:04.960
And the second big one is this AI acceleration, the attacker's use of AI and the acceleration, which leads to automation, which leads to needing great data as as uh as part of that automation program.
00:04:05.199 --> 00:04:18.240
So all those are forcing, frankly, defenders to take a look at, you know, call it the 15-year-old security stack, kind of net flow, standalone IDS and PCAP, and saying, oh, wait, that's not good enough for the modern era.
00:04:18.399 --> 00:04:24.000
So, you know, lots to unpack there, but like that that moment of reinvention is probably the biggest thing.
00:04:24.879 --> 00:04:28.720
And so let now let's talk about how that's being reinvented.
00:04:28.879 --> 00:04:33.920
So uh I think of Coralite and I think of Zeek and Bro, I think of Suricata.
00:04:34.240 --> 00:04:39.120
And so, how are those things being reinvented to address the kinds of things that you just talked about?
00:04:39.519 --> 00:04:42.480
You know, it it falls into a couple of categories.
00:04:42.720 --> 00:04:45.439
First is just raw points of visibility.
00:04:45.600 --> 00:04:52.879
You know, I am incredibly surprised at, you know, even some of the largest banks that we talk to that you would think would be on the cutting edge of everything.
00:04:52.959 --> 00:04:54.720
And by the way, they generally are.
00:04:54.879 --> 00:05:07.199
But even amongst that ecosystem, you'll find folks that are saying, hey, we've been doing a ton at the endpoint, we've been doing a ton on identity, we haven't really been looking at network outside of the firewall for the past eight or 10 or 12 years.
00:05:07.439 --> 00:05:16.560
And so with this recognition that, gee, I haven't actually even been paying attention to this world, and now I kind of need to make it a priority, that's been a really big thing.
00:05:16.720 --> 00:05:20.959
Uh, and that what that turns into is placement of points of visibility.
00:05:21.199 --> 00:05:28.560
Because if what you're looking for is living off the land attacks, sitting there at the perimeter is only a portion of what you're doing, right?
00:05:28.720 --> 00:05:33.360
So sitting at kind of traditional north-south data center ingress-egress, it's not the full picture.
00:05:33.439 --> 00:05:38.720
You need to look at your secure enclaves, like your DNS subnets, your VPN concentrators, things like that.
00:05:38.800 --> 00:05:41.519
And you need to be looking at key points in your East-West.
00:05:41.600 --> 00:05:42.560
So that's one big thing.
00:05:42.720 --> 00:05:45.199
Just points of visibility is a big change.
00:05:45.439 --> 00:05:51.759
The second big change is moving from signatures to behavioral and kind of ML for detection.
00:05:51.920 --> 00:06:01.759
So if you look at a, you know, the the bane of the traditional IDS world, it's that they become alert cannons that kind of catch the known, but they don't catch the modern or the novel attacks.
00:06:01.920 --> 00:06:14.160
And so a lot of what's happening in this kind of NDR reinvention is you bring behavioral, you bring supervised and unsupervised ML, you bring more analytics compute to find the types of attacks that go beyond what signatures can do.
00:06:14.399 --> 00:06:16.319
By the way, you still need the signatures.
00:06:16.560 --> 00:06:17.040
Why?
00:06:17.279 --> 00:06:20.560
Cheap, cheerful, effective for a bunch of kind of basic stuff.
00:06:20.639 --> 00:06:22.639
So I'm not saying to take those out of the equation.
00:06:22.720 --> 00:06:24.000
That doesn't help anybody.
00:06:24.079 --> 00:06:28.319
Uh, but you know, you do have to kind of move beyond into some of the more advanced kind of forms of math.
00:06:28.480 --> 00:06:39.680
Uh, and then the third one is realizing that the evidence, the ground truth of what's happening on the network turns up to be incredibly useful for a wide range of use cases.
00:06:39.839 --> 00:06:44.480
That could be compliance or fraud or API security or insider threat.
00:06:44.560 --> 00:06:46.560
I mean, it's amazing what folks are doing.
00:06:46.720 --> 00:06:53.040
But the real compelling one right now is I need it as the fuel for my AI sock reinvention, right?
00:06:53.120 --> 00:06:55.680
My the automation programs I'm trying to drive in the SOC.
00:06:55.759 --> 00:06:57.279
So those are the big three.
00:06:58.160 --> 00:07:01.920
Yeah, and I I'm just gonna complain a little bit here.
00:07:02.160 --> 00:07:11.519
I think there are a couple of things that have happened in the last two years, or not two years, but the last few years, that uh are um just hyperbole by the industry.
00:07:11.680 --> 00:07:15.199
One is that XDR is all you need, or even EDR is all you need.
00:07:15.279 --> 00:07:18.720
You don't need NDR, you don't need to monitor the network.
00:07:19.199 --> 00:07:20.639
Absolutely not true.
00:07:21.279 --> 00:07:29.040
And then the the second one is that uh network security is all about signatures, and signatures are looking uh in the rear view mirror.
00:07:29.199 --> 00:07:30.480
And that's not true.
00:07:30.720 --> 00:07:34.959
So um I know I'm ranting, but uh it sounds like you agree.
00:07:35.439 --> 00:07:36.160
Oh for sure.
00:07:36.319 --> 00:07:38.879
And look, the the I'll I'll pile on a little bit.
00:07:38.959 --> 00:07:47.279
If you think about the change in customer conversations we've had over the past few years, you know, we would find four years ago it was a it was a binary conversation.
00:07:47.360 --> 00:07:48.560
It was really interesting.
00:07:48.800 --> 00:07:54.879
Folks had either kind of wrapped their head around this and said, oh, wait, I have a super well deployed EDR environment.
00:07:55.040 --> 00:07:58.000
And by the way, if you don't have EDR, you shouldn't even talk to us.
00:07:58.079 --> 00:08:00.000
You should go get a modern EDR and go get deployed.
00:08:00.079 --> 00:08:01.920
I'll I'll say that until the cows come home.
00:08:02.079 --> 00:08:10.639
But you would get folks that were at a super well-deployed EDR still seeing a bunch of issues, and then they were forced into the realization of exactly what you said.
00:08:10.720 --> 00:08:17.519
Like, oh, turns up the MITRE attack framework has an entire category of threats best observed and found from the network, and there's a reason for that.
00:08:17.680 --> 00:08:18.639
Like, you know, go figure.
00:08:18.800 --> 00:08:24.160
So you would have a set of folks that deeply understood that and were kind of among the early adopters of the NDR category.
00:08:24.240 --> 00:08:32.480
And then you had the other half of folks we were talking to where the first part of every customer conversation was, I've got a great EDR wide wide e Jew.
00:08:32.559 --> 00:08:39.200
And you know, the ratio of that was 50-50 four years ago, and it's 90-10 now, right?
00:08:39.279 --> 00:08:40.879
And I think there's a lot of things that go into that.
00:08:40.960 --> 00:08:43.519
But this recognition that, like, look, let's not kid ourselves, right?
00:08:43.600 --> 00:08:45.519
Defense and depth exist for a reason.
00:08:45.840 --> 00:08:49.360
You know, the endpoint gives you depth, the network gives you breadth, it's not a new concept.
00:08:49.440 --> 00:08:51.200
We're just doing a lot better now.
00:08:51.519 --> 00:09:00.639
Yeah, not to mention, Brian, that uh a lot of the attacks go after devices that don't have an EDR agent, as we know.
00:09:00.879 --> 00:09:18.559
Uh, and the attackers are smart, they know that to circumvent EDR, you could manipulate the EDR itself, uh, change the logs, build some kind of EDR-resistant malware, or you could attack elsewhere, and that's where the network security comes in.
00:09:18.639 --> 00:09:20.159
So it's really important.
00:09:20.639 --> 00:09:29.840
Yeah, and by the way, uh, one of our advisors is Rob Joyce, who used to run cyber for the NSA, used to run tailored access operations for the NSA back when that unit had that name.
00:09:30.000 --> 00:09:32.000
Uh wonderful human being on many levels.
00:09:32.240 --> 00:09:36.000
He and I did a joint session at RSA, not this past one, but the year before.
00:09:36.080 --> 00:09:42.080
And he had a great example of that, where there was an attack that had been published where the attacker got a webcam.
00:09:42.240 --> 00:09:51.360
They got shell on the Linux operating system in the webcam, and then they were you from that shell, they were doing SMB mounts and driving encryption from the webcam.
00:09:51.679 --> 00:09:53.759
And, you know, Rob kind of summarized it well.
00:09:53.840 --> 00:09:57.600
He says, no one has that attack in their throat in their threat profile.
00:09:57.759 --> 00:10:01.360
Like no one's modeling for that because it's just so creative.
00:10:01.519 --> 00:10:03.759
But to your point, that's exactly what folks do, right?
00:10:03.840 --> 00:10:06.159
They're going to bypass the no defenses any way they can.
00:10:06.320 --> 00:10:07.840
That's the good, the latest example.
00:10:08.000 --> 00:10:19.919
And you know, we've all heard, and this is absolutely true, that the time period from uh announcement of a disclose of a vulnerability to exploit of that vulnerability used to be three weeks.
00:10:20.159 --> 00:10:21.440
Now it's hours.
00:10:21.600 --> 00:10:30.240
And with Glasswig and Mythos and the and that not just those, but honestly the continued progress of the flexion of the foundation models, this this isn't going away, right?
00:10:30.320 --> 00:10:34.799
This ability to kind of find and exploit these novel attack paths is only accelerating.
00:10:35.440 --> 00:10:40.000
Yeah, now before we move on to the future, I want to ask you one more question about the present.
00:10:40.080 --> 00:10:57.279
And it's it's related to AI, and that is uh in my research, I noted that uh that Coralite and also the Zeke community, the Circata community are now building in guardrails to monitor AI traffic itself.
00:10:57.440 --> 00:11:00.480
So uh that's probably something people most people don't know about.
00:11:00.559 --> 00:11:02.000
So can you talk about that?
00:11:02.320 --> 00:11:10.399
Yeah, and it it's really an extension of the point I made earlier, where if you have ground truth of what's happening on the network, you've got this fantastic data source.
00:11:10.559 --> 00:11:14.799
And asking what the use case is for great data is like asking what the use case is for plastic.
00:11:14.960 --> 00:11:16.080
It's all of them, right?
00:11:16.159 --> 00:11:17.679
And this is just one good example.
00:11:17.840 --> 00:11:23.120
So if you think about detecting shadow AI, you see that activity happening on the network.
00:11:23.200 --> 00:11:27.519
You're right, you see the foundation models, you see MCP servers, you see agents, right?
00:11:27.600 --> 00:11:32.960
And so it was actually very straightforward to extend our current app identification capabilities.
00:11:33.120 --> 00:11:39.679
And frankly, even before we did that, folks were using the data we generate in a threat hunting style to go and find these things.
00:11:39.919 --> 00:11:55.440
So, you know, this a lot of the way we think about the value of NDR as a category and the value that we as CoreLight are trying to provide is if we can give you ground truth of what's happening on your network, that is going to let you answer the question of tomorrow that you don't know about today.
00:11:55.600 --> 00:12:03.679
And so today's hot topic of the of the day is help me find the new shadow, uh shadow IT, which is you know unauthorized Gen AI applications.
00:12:03.840 --> 00:12:04.720
100% true.
00:12:04.960 --> 00:12:08.000
We've also got folks saying, hey, what about post-quantum?
00:12:08.080 --> 00:12:10.720
How do I understand the encryption ciphers happening on my network?
00:12:10.879 --> 00:12:15.919
We've got tons of folks saying, hey, this net new vulnerability, how do I find examples of those exploits?
00:12:16.080 --> 00:12:22.000
And not to mention the more mundane stuff like, oh, can I automate more of my compliance attestation and kind of things like that?
00:12:22.240 --> 00:12:25.279
All those are a function of do I have the right data?
00:12:25.440 --> 00:12:32.080
Do I have the right coverage, vantage points for that data, uh, and do I have the right kind of uh uh time retention of that data?
00:12:32.240 --> 00:12:39.519
So we really think about the data as the first class citizen, and then you know, we leverage that data to answer all these types of questions.
00:12:40.960 --> 00:12:45.440
Yeah, that's a good answer that tees up our discussion on the future.
00:12:45.679 --> 00:12:57.279
And again, this uh something that most people may not understand is the role of the network in AI model development and application development.
00:12:57.440 --> 00:13:02.000
And that's true in training, it's true in inference, it's true in data ingestion.
00:13:02.240 --> 00:13:06.639
So talk about that and then talk about the security implications involved in that.
00:13:06.960 --> 00:13:09.120
Yeah, it it's a it's a great point, John.
00:13:09.279 --> 00:13:36.080
And one of the ahas that a lot of folks also don't realize was because of the open source heritage we came from and the really set of elite defenders that we serve, both in the in the pay community and in the in the open source community, uh, we were able to get engaged in the actual model development and tuning programs at a number of the big flagship providers, because they want those models to understand the canonical security data and be able to act on it out of the box with no further vendor tuning, right?
00:13:36.159 --> 00:13:38.159
This is to everyone's kind of mutual advantage.
00:13:38.320 --> 00:13:47.200
And so if we think about what are the implications of that, we see folks doing a uh a progression of AI-based automation kind of across the SOC.
00:13:47.519 --> 00:13:53.840
And because of the breadth that the network provides, we're one of three really essential ingredients in that automation, right?
00:13:53.919 --> 00:13:57.919
You need endpoint for depth, you need network for breadth, you need identity to bring it together.
00:13:58.080 --> 00:14:01.360
I'm not telling, I'm I'm not, you know, I'm not speaking rocket science here, right?
00:14:01.440 --> 00:14:02.559
Those are pretty foundational.
00:14:02.720 --> 00:14:08.240
So when you do that, we're seeing folks move through a three-part evolution, if you will.
00:14:08.399 --> 00:14:10.399
Step one is assistance.
00:14:10.480 --> 00:14:12.799
Help me do what I'm doing today, but do it faster.
00:14:13.039 --> 00:14:20.960
And so, you know, we and a bunch of other folks do things like, hey, translate this alert into English, help me, uh, help me understand what I should do next, right?
00:14:21.039 --> 00:14:22.879
Give me investigation guidance, things like that.
00:14:22.960 --> 00:14:25.200
Uh natural language query, that's a good example.
00:14:25.440 --> 00:14:33.200
This phase where a lot of folks are in right now, uh, and we're actually uh leading in the category in this, is moving from assistance to full automation.
00:14:33.360 --> 00:14:38.240
So we will take the riskiest assets in the environment and run a soup to nuts investigation.
00:14:38.399 --> 00:14:42.559
And you know, the key here is you've got to be transparent and you've got to earn trust.
00:14:42.639 --> 00:14:44.399
And of course, you have to be accurate, right?
00:14:44.480 --> 00:14:48.320
And and this is gonna be one of the key pivots to kind of how I think things need to evolve.
00:14:48.480 --> 00:15:02.799
But where I think things are going, which is gonna be truly game-changing, is when you get multi-product integration and a true AI SOC that's gonna enable not just kind of not just task automation, but true workflow automation.
00:15:02.960 --> 00:15:09.759
And instead of having to worry about defending an individual, you know, trusting an individual tool, you get kind of triangulation across tools.
00:15:09.919 --> 00:15:15.600
So kind of the new defense in depth, I think, is going to be cross-AI triangulation, right, in a really big way.
00:15:16.559 --> 00:15:17.519
I think so too.
00:15:17.600 --> 00:15:19.759
I talked a lot about that with people at RSA.
00:15:20.000 --> 00:15:23.519
And I think there's some consensus on that.
00:15:23.600 --> 00:15:34.799
Then there are some other people who have more of a proprietary agenda, but talk more about that because I I mean, historically, I've always thought of Coralite as just a great monitoring and data system.
00:15:34.960 --> 00:15:39.759
And now that data is going to feed other models, it's going to feed other tools.
00:15:39.919 --> 00:15:48.000
Now I see a future where that kind of specialization is in the identity side, it's on the data side, with it's already in the endpoint, the network side.
00:15:48.159 --> 00:15:52.159
So, how does that all work uh collaboratively and come together?
00:15:52.480 --> 00:15:55.360
Yeah, there's two things I think that are really driving this.
00:15:55.600 --> 00:16:00.240
One is domain expertise, and two is the SIM moving to a federated model.
00:16:00.399 --> 00:16:06.080
So, our kind of mental model of how this agentix SOC is going to work uh is imagine it like a table.
00:16:06.240 --> 00:16:09.440
You're gonna have your individual detection and response domains, right?
00:16:09.519 --> 00:16:12.960
You've got EDR, NDR, ITDR, you know, can add them all up.
00:16:13.039 --> 00:16:14.320
Those are the legs of the table.
00:16:15.200 --> 00:16:19.120
The job of each leg is to be the master of its domain, right?
00:16:19.279 --> 00:16:28.080
So we need to provide, you know, we generate the best data we can, generate the best analytics we can, and drive our own kind of AI-based automation within our leg of the table.
00:16:28.320 --> 00:16:42.240
Then we have to be a constructive partner to the SIM or AI SOC tool or frankly the large language models, kind of whatever folks are doing at that cross AI layer, because there's a subset of data that's gonna continue to need to be aggregated, right?
00:16:42.320 --> 00:16:45.759
The alerts and a little bit of context around those alerts is kind of a no-brainer.
00:16:45.919 --> 00:16:48.080
That's your minimum threshold that you need to bring in.
00:16:48.320 --> 00:16:51.919
But, you know, I, you know, both CrowdStrike and Cisco are investors of ours.
00:16:52.000 --> 00:16:56.320
And I would tell you that both of them believe that you're gonna have to move to a federated model, right?
00:16:56.639 --> 00:16:58.159
At least in some way, shape, or form.
00:16:58.320 --> 00:17:00.000
Different people are tackling it different ways.
00:17:00.159 --> 00:17:04.000
The certainly the AI SOC startups are certainly starting with a federated model.
00:17:04.160 --> 00:17:12.400
So you've got the alerts in the context centrally, but now each of us, EDR, NDR, ITDR, you name it, we have to be kind of an agentic partner.
00:17:12.480 --> 00:17:19.920
So imagine you're doing uh, and actually, we just did an announcement at RSA around CrowdStrike Charlotte and their AI canvas that actually enables this.
00:17:20.079 --> 00:17:30.160
If you're doing an investigation in Charlotte and you want to say, hey, tell me more about this alert or tell me more about this IP address, you don't want to have to like re-ingest all the possible data and do that locally.
00:17:30.240 --> 00:17:38.000
You want to be able to do either an MCP or an agent-to-agent call to another tool, in this case Corlite, and say, hey, tell me what you know about this IP.
00:17:38.160 --> 00:17:39.920
And we're not going to give you the world.
00:17:40.000 --> 00:17:46.960
We're going to do our own novel analysis and kind of bring the results of that kind of back to the AI analyst workbench, if you will.
00:17:48.240 --> 00:17:52.000
Brian, what you just described is SOPA 2026.
00:17:52.240 --> 00:17:55.759
SOPA is my model that I came out of ESG with.
00:17:56.000 --> 00:18:01.039
Um, but that's basically what you're what you're talking about, and I'm going to write more about that.
00:18:01.599 --> 00:18:08.799
Um so let me, you mentioned anthropic in the mythos uh uh release, and there's a lot of press about that this week.
00:18:09.440 --> 00:18:20.480
And um for those of you people who don't know, that's uh uh it's it's uh apparently uh architected so it can detect vulnerabilities extremely quickly at machine speed.
00:18:20.720 --> 00:18:21.839
What will that do?
00:18:22.640 --> 00:18:26.000
So I'm gonna let me throw a little bit of speculation.
00:18:26.720 --> 00:18:36.640
What's stopping us from understanding what it's finding and translating that immediately through AI into virtual patches on something like Suricata?
00:18:36.960 --> 00:18:39.920
Uh am I way off base here or is that possible?
00:18:40.240 --> 00:18:42.880
You are not off base, and that's absolutely where we're all going.
00:18:43.119 --> 00:18:56.720
And I would add a use case to that, by the way, because if you think about what's transforming already, and I and I I hope what what everyone's seeing when they look at Glasswing and Mythos is this is doing a thing that's already happening just way better.
00:18:56.880 --> 00:18:59.680
So it's not like there's something brand new that's never being done before here.
00:18:59.759 --> 00:19:05.839
It's just doing a lot better, so much better that even the anthropic folks are like, holy cow, we can't let this get in the hands of the bad folks, right?
00:19:06.000 --> 00:19:09.599
So if you look at the implications on that, I think there's two, there's two sides of it.
00:19:09.680 --> 00:19:12.480
There's the Vuln side and there's the detection engineering side.
00:19:12.640 --> 00:19:13.519
Okay, they're related.
00:19:13.599 --> 00:19:15.359
They're both sides of the same coin, right?
00:19:15.519 --> 00:19:28.720
So on the vuln side, you know, all of us as providers, I mean, certainly us as a as a provider into really high-end critical uh infrastructure providers, we have had deep in our ethos for a long time that we cannot be the Vuln in our customer supply chain.
00:19:28.880 --> 00:19:32.240
Like that's a that's a company-ending kind of uh event for us.
00:19:32.400 --> 00:19:38.559
So, for example, our InfoSec team is four times the size of our IT team, which is just kind of a crazy statement when you think about it, right?
00:19:38.640 --> 00:19:39.839
Most folks, that's inverted, right?
00:19:39.920 --> 00:19:42.000
You know, your IT team is four times the size of InfoSec.
00:19:42.319 --> 00:19:43.839
So like that's been a big priority.
00:19:44.000 --> 00:19:54.799
And so all of us as security providers need to be super aggressive about using every tool we can to find the vulnerabilities in our own code, ensuring that those are rock solid and can't be exploited.
00:19:54.960 --> 00:19:56.400
That is an IQ test.
00:19:56.480 --> 00:19:58.960
Uh, it's not just an IQ test, it's an ethics test.
00:19:59.039 --> 00:19:59.920
Like, let's be honest, right?
00:20:00.000 --> 00:20:01.920
Like that needs to be kind of front and center.
00:20:02.079 --> 00:20:06.480
But the other opportunity here, think about the automation for the defender.
00:20:06.799 --> 00:20:12.480
Right now, you know, a lot of folks are focusing on the highest value thing we can do, right?
00:20:12.559 --> 00:20:15.759
Which is security teams are overwhelmed by the volumes of alerts.
00:20:15.920 --> 00:20:18.000
They have a they cannot get to all of those.
00:20:18.079 --> 00:20:21.519
So this isn't a dollar savings or a or a hey count reduction problem.
00:20:21.599 --> 00:20:23.839
This is how deep in my security queue can I go.
00:20:24.000 --> 00:20:28.319
So we're all going after how do we automate the triage and the instant response process, right?
00:20:28.480 --> 00:20:31.599
Again, highest value thing makes a ton of sense.
00:20:31.839 --> 00:20:33.279
Where are we gonna go next?
00:20:33.519 --> 00:20:35.680
We're gonna keep going down that value chain, right?
00:20:35.759 --> 00:20:48.880
Because if you look at threat hunting and detection engineering, the same tools that let you go and kind of understand where the vulnerabilities are are also gonna be incredibly effective as saying, hey, here's the types of things we see folks doing in this environment.
00:20:49.039 --> 00:20:54.000
How do we go and closed loop automate both the threat hunting and the actual alert creation, right?
00:20:54.079 --> 00:20:56.480
The detection engineering part part of that process.
00:20:56.640 --> 00:20:59.680
I think this is gonna unlock all sorts of opportunities.
00:20:59.839 --> 00:21:05.759
And if you go back to kind of where's the evolution here, back to your SOPA paper, because again, you are you are 100% spot on here.
00:21:05.839 --> 00:21:07.039
I've I've read that work.
00:21:07.200 --> 00:21:15.759
The we're evolving from human assistance to human in the loop, where most folks are now or where they're trying to get to, to full automation.
00:21:15.920 --> 00:21:19.519
And the real key question is how do we earn the trust, right?
00:21:19.599 --> 00:21:24.720
To kind of, you know, as as defenders and as providers to kind of move through that maturity cycle.
00:21:26.400 --> 00:21:27.839
I I totally agree.
00:21:28.000 --> 00:21:42.160
And um I appreciate what you just said because I think there's a little panic with uh anthropic with those, and we should certainly uh have respect for what it can do and what uh vulnerabilities it can open.
00:21:42.480 --> 00:21:46.160
Um, but we also have to look at the opportunity there, and you just described that.
00:21:46.319 --> 00:21:49.599
I I think that that's uh it's up to our industry to do that.
00:21:49.839 --> 00:21:54.319
Um so now let's move on to the cybersecurity bridge, how we get from here to there.
00:21:54.559 --> 00:21:59.759
So one thing I think, and I I looked again, I did some research and um I saw that Suracana.
00:22:00.319 --> 00:22:04.240
8.0 came out, uh Zeek 8.0 and 8.1 came out.
00:22:04.400 --> 00:22:07.680
So clearly these are active uh projects.
00:22:08.079 --> 00:22:23.839
Do we have the uh the horsepower in the community to keep up with all of the things that we talked about in terms of just basic security, threat detection, response, data uh ingestion, and the AI component as well?
00:22:23.920 --> 00:22:26.799
Is that are those communities robust enough to do that?
00:22:27.200 --> 00:22:27.839
Absolutely.
00:22:28.000 --> 00:22:31.759
Uh the i when I think about kind of the strengths of the communities, a couple of things come to mind.
00:22:31.920 --> 00:22:43.920
One, do we actually have the coding horsepower to make sure that we are uh coding horsepower and automation to be able to find and uh and address not just uh new features, but ensure that we're kind of staying on top of vulnerabilities.
00:22:44.000 --> 00:22:52.240
And like I said, because of the ethos of the providers, both us and the developers in the in the extended Suricata community, uh I have zero questions on that.
00:22:52.480 --> 00:22:53.839
I feel like the ethos is there.
00:22:53.920 --> 00:22:58.720
And bear in mind, what are all uh what are we at Coralite doing, like a lot of other software developers?
00:22:58.880 --> 00:23:02.160
We're looking to use the AI tools to accelerate what we can do.
00:23:02.319 --> 00:23:07.279
So, you know, Coralite happens to be really well capitalized and investing very aggressively for growth.
00:23:07.440 --> 00:23:11.759
You know, we built RD by about 40% last year, which is a non-trivial number.
00:23:11.920 --> 00:23:26.559
If you can take that type of raw dollar investment and then make that a 2x throughput by using the same kind of engineering, you know, tools for engineering acceleration that the attackers are using for destructive capability, I don't think we're gonna be facing a throughput or a bandwidth problem.
00:23:26.880 --> 00:23:39.759
I think we're actually we're facing a moment where with when you combine the AI leverage, internal AI leverage, uh, and the actual staffing levels that we're putting in, we're gonna have a ton of calories to go make some fantastic things happen.
00:23:40.000 --> 00:23:48.480
The second thing that gives me a lot of of courage and confidence here is there is a there is a feedback system that's been happening for the last 30 years.
00:23:48.640 --> 00:23:52.000
It's actually this year's the 30th anniversary of the Zeek project, right?
00:23:52.079 --> 00:23:53.839
Uh it's kind of a milestone year.
00:23:54.079 --> 00:24:02.079
But the reason that that project has done so well, and the reason that the data is so powerful is that it's a living, breathing, evolving data set.
00:24:02.240 --> 00:24:12.640
So there's this virtuous cycle of, you know, elite IR analysts and elite, you know, uh IR consultants, you know, uh some of the biggest organizations in the world, they're facing these challenges.
00:24:12.720 --> 00:24:17.599
They find they need a new data type or a new capability in the detection models or whatever it is, right?
00:24:17.680 --> 00:24:20.480
Not just a model, a capability in the detection models.
00:24:20.640 --> 00:24:25.519
They go then push on kind of the Bazique project, the Suricata project, those get added in, right?
00:24:25.599 --> 00:24:27.200
And then the flywheel continues, right?
00:24:27.279 --> 00:24:30.960
Because novel data enables novel analytics and that whole flywheel continues.
00:24:31.200 --> 00:24:35.839
I didn't appreciate that until, you know, because I've I've been at Correlate about eight years.
00:24:36.000 --> 00:24:44.640
Uh, I think maybe the second year in, I got with, sat down with one of our founders, Seth Hall, and I had him show me what the data set looked like eight years earlier.
00:24:44.880 --> 00:24:47.039
And it was like a completely different data set.
00:24:47.119 --> 00:24:48.640
It was like the two things had never met.
00:24:48.720 --> 00:24:52.160
And so you really, you know, it's it's kind of like watching your kids grow up.
00:24:52.319 --> 00:24:55.039
From one week to another, you can't see your kid change.
00:24:55.440 --> 00:24:57.039
One year to another, you see him change.
00:24:57.119 --> 00:25:00.799
And when they bridge from elementary to middle school to high school, you're dealing with different human beings.
00:25:00.960 --> 00:25:03.519
And the open source project is exactly like that.
00:25:03.599 --> 00:25:05.440
And that flywheel of innovation.
00:25:05.519 --> 00:25:17.119
So as these elite defenders are wrestling with shadow IT and AI-driven automation and living off the land detection, all these things, they're continuing to push on us as the providers of that tech to do better.
00:25:17.200 --> 00:25:26.559
And that that flywheel is what gives me confidence that uh that, or let me restate that flywheel and the bandwidth execute on it, because the two things do have to go together.
00:25:26.720 --> 00:25:28.640
That gives me a lot of confidence.
00:25:30.079 --> 00:25:31.599
Yeah, well described.
00:25:31.759 --> 00:25:37.759
Um does Zeke still have that bro logo with the eye looking at you?
00:25:38.400 --> 00:25:47.359
No, uh, yeah, to be overly candid, you know, the the original name of Bro all those years ago was kind of wonderfully intellectual.
00:25:47.519 --> 00:25:51.759
It was a reference to George Orwell's Big Brother and the dual-edged nature of network monitoring.
00:25:51.839 --> 00:25:53.200
It can be used for good or evil.
00:25:53.279 --> 00:25:54.640
That all made a ton of sense.
00:25:54.880 --> 00:26:02.000
Right until you got to the late teens and the early 20s, when, like, honey, I'm going to Vegas for Brocon was no longer an acceptable sentence.
00:26:02.079 --> 00:26:06.160
Uh, that renaming had to change for very obvious reasons.
00:26:06.240 --> 00:26:09.839
So the project is now called Zeke, and they've actually changed the logo around.
00:26:09.920 --> 00:26:17.519
So now it's a it's a stylized Z that if you look at it has arrows that basically represent uh they're indicative of network connections.
00:26:17.680 --> 00:26:28.640
So uh if we we uh being the corp uh the the kind of the the main corporate sponsor for that project, uh we we wanted to help uh help it live up to its reputation from a branding perspective.
00:26:28.720 --> 00:26:29.519
How about that?
00:26:29.839 --> 00:26:30.160
Okay.
00:26:30.720 --> 00:26:33.279
Because that I logo always frightened me.
00:26:33.680 --> 00:26:37.200
It's just like yeah, it's like a cyclops looking at you.
00:26:37.519 --> 00:26:38.240
But I digress.
00:26:39.680 --> 00:26:40.640
Like a lot of things in life.
00:26:41.119 --> 00:26:42.400
Just a long time ago.
00:26:42.720 --> 00:26:45.920
Um so uh I'm gonna ask you something about Coralite.
00:26:46.079 --> 00:26:51.519
So on Corlite's website, I noticed uh and read a little bit about something called the Polaris project.
00:26:51.839 --> 00:27:03.920
And if you could describe that, it seems like something you're doing uh that would be very beneficial for specific kind of uh LLMs uh for network security.
00:27:04.079 --> 00:27:06.799
Am I wrong or is it well, please describe it?
00:27:07.119 --> 00:27:08.319
No, you're you're spot on.
00:27:08.400 --> 00:27:13.039
And really what it comes down to is networks are messy.
00:27:13.200 --> 00:27:32.240
And so if you think about how you do kind of malware detection, you know, tool set detection, novel attack detection, kind of broadly speaking, security content development, you know, the network doesn't work, doesn't uh it's not easy to do what VirusTotal does, for example, where there's tons of just malware samples, you generate a new model, you throw it against VirusTotal, you see how it works.
00:27:32.400 --> 00:27:41.039
I'm not saying that's easy because amassing the IP set that VirusTotal represents is a multi-year effort and is a massive asset to the community.
00:27:41.119 --> 00:27:43.119
So I'm not denigrating anything there.
00:27:43.279 --> 00:27:46.880
But the network, by definition, is a super messy thing.
00:27:47.039 --> 00:27:51.440
And because you're tracking behaviors, those behaviors can vary, right?
00:27:51.599 --> 00:27:52.799
Some of them are more durable.
00:27:52.880 --> 00:27:58.000
So if you look at how a command and control tool set operates, that's a much more durable thing with a longer half-life.
00:27:58.160 --> 00:28:01.440
Some of them are very novel to how that particular network operates.
00:28:01.599 --> 00:28:05.200
And what is normal on that network is going to be very, very different.
00:28:05.359 --> 00:28:11.440
So you really need to be pretty intimate with your customers to understand what novel, what kind of good content development looks like.
00:28:11.599 --> 00:28:14.799
And so the Polaris program was a response to that challenge.
00:28:14.960 --> 00:28:25.599
So what we do is we essentially enter into kind of content co-development relationships with some of our key customers, where they let us put um actual production sensors into their environments.
00:28:25.759 --> 00:28:28.880
And as a result, we use those sensors that are out of production.
00:28:28.960 --> 00:28:39.920
So they're there for the labs team to kind of do work on to iterate on new content in a way that we get feedback from the organization we are serving and direction from the organization we're serving.
00:28:40.079 --> 00:28:47.200
So we make sure that we are not just coming up with things that we think are a good idea, but we're getting kind of real live kind of direction from the defenders we're working with.
00:28:47.359 --> 00:28:52.079
And we get really good feedback on have you characterized this correctly, right?
00:28:52.240 --> 00:28:55.759
Because the key with the network is the signal to noise ratio.
00:28:55.920 --> 00:28:57.759
That's what it all comes down to, right?
00:28:57.920 --> 00:29:06.240
And so we often think about the difference between a um a false positive and real but uninteresting and dead wrong.
00:29:06.400 --> 00:29:09.119
Like there's three actual levels that matter here, right?
00:29:09.279 --> 00:29:12.799
The first two have value, the third one absolutely doesn't, right?
00:29:12.880 --> 00:29:14.720
But we need, you know, we need the human feedback.
00:29:14.880 --> 00:29:21.519
And if you think about how that fits into an LM and AI world, this is something that I think all of us as vendors are learning.
00:29:21.599 --> 00:29:36.400
And actually, I was just listening to a uh uh uh the the recording of a webcast of a presentation from uh one of the uh uh AI detection engineers who just left Meta and super well-staffed, very sophisticated organizations, you might imagine.
00:29:36.559 --> 00:29:48.559
They realized that simply even going to the defenders themselves and asking them to label what was a good detection from an LLM-based kind of workflow wasn't effective because the analysts didn't agree.
00:29:48.720 --> 00:29:56.640
So you could give the same set of verdicts to the to a the the common pool of analysts, and you would get a pretty wide-ranging set of views.
00:29:56.799 --> 00:30:03.759
And when you get that difference in labeling data, it really destroys the ability to of a model to kind of do uh reinforcement learning.
00:30:03.920 --> 00:30:10.400
So a lot of what we are driving towards is understanding the and assessing the reasoning process of these models.
00:30:10.559 --> 00:30:13.759
And so who do you need feedback from to assess your reasoning process?
00:30:14.079 --> 00:30:15.200
The analysts, right?
00:30:15.279 --> 00:30:16.799
Which comes back to the Polaris program.
00:30:16.960 --> 00:30:23.519
So both from a content direction and from a kind of content quality standpoint, that program has been super essential for us.
00:30:23.599 --> 00:30:28.640
And I'm really grateful to the organizations we work with that that see that mutual interest, right?
00:30:28.720 --> 00:30:31.759
They want to see kind of great content and be able to steer it as well.
00:30:31.839 --> 00:30:35.279
So it really is kind of a two-way, two-way street of benefits, if you will.
00:30:36.079 --> 00:30:38.880
Is that aligned at all to the mitre attack framework?
00:30:39.039 --> 00:30:41.039
It seems like it might be to me.
00:30:41.359 --> 00:30:47.440
It generally is, but one of the nice things about working with the the real defenders is they are not constrained by that framework.
00:30:47.519 --> 00:30:50.400
I think the mitre attack framework is an awesome asset.
00:30:50.559 --> 00:30:52.960
Huge credit to the MITRE team for putting that together.
00:30:53.200 --> 00:31:01.200
It is a, I think it's one of the frankly massively marquee uh uh uh developments that have created common language for all of us.
00:31:01.279 --> 00:31:06.400
But when you're talking to the real defenders, what they're most focused on is what are the attacks that I'm missing?
00:31:06.640 --> 00:31:13.200
And then, yes, afterwards, we will make sure that we kind of think about how that map into the MITRE framework and kind of keep building that aspect of the community.
00:31:13.359 --> 00:31:24.240
But you know, a good example of a non-MITRE kind of piece of content development was that a lot of our customers really care about the volume versus value ratio in the evidence, right?
00:31:24.400 --> 00:31:28.480
Because we could generate three times more data than we do today.
00:31:28.799 --> 00:31:34.799
That is a problem if that data isn't valuable enough to pay for the storage and analysis of it.
00:31:34.960 --> 00:31:41.920
Uh, and in particular, let's say that you're uh putting all this data into a SIM and that SIM prices on a volume basis.
00:31:42.079 --> 00:31:45.200
Now you really care about kind of the volume versus value of that data.
00:31:45.359 --> 00:31:57.759
So a lot of what uh what or one of the big initiatives that we've been driving in this program is how do we do a really smart job of making sure that we tune and filter the data volume to be still incredibly impactful, right?
00:31:57.839 --> 00:32:03.839
So you can't take out the, you can't simply say, oh, I'm gonna alert and only keep the context around the alert.
00:32:04.079 --> 00:32:11.920
That is a failure, like a deep, deep failure, because now you are believing that your alerting is 100% accurate.
00:32:12.160 --> 00:32:16.960
Anyone who believes that is smoking something and should not be doing kind of content development, right?
00:32:17.119 --> 00:32:22.240
So you can so now the question is, how do you take out only the truly known good?
00:32:22.480 --> 00:32:26.240
The stuff that you've got really high conviction has no further analysis, right?
00:32:26.400 --> 00:32:28.000
How do you draw that line?
00:32:28.160 --> 00:32:42.319
And so between our Polaris program, and we actually do a bunch of work with CISA on this particular front, they were a really great kind of co-development partner here, coming up with how do you draw that value, how do you draw that line and kind of make sure that you're getting the best value for volume?
00:32:42.480 --> 00:32:50.799
That's another good example that is incredibly customer valuable, but is kind of outside of the for uh outside the direct structure of the MITRE attack framework.
00:32:51.680 --> 00:32:58.079
Yeah, the value per volume or the volume associated with volume is a critical metric.
00:32:58.240 --> 00:33:00.640
And we've been chasing that for years.
00:33:00.960 --> 00:33:05.039
Uh, and there's been a misguided approach that more is better.
00:33:05.200 --> 00:33:10.640
I see that with threat intelligence, I see that with logs, and more is never better.
00:33:10.720 --> 00:33:12.480
Uh more is messier.
00:33:12.640 --> 00:33:20.400
And so to the extent that you can do that, or we can use AI to do that, I I think that's a great uh advancement that we're providing.
00:33:20.960 --> 00:33:33.839
Yeah, and the only thing I would add is, and I think this is going to be part of the AI uh evolution, there aren't that many companies that treat the data coverage and quality as its own first class set of metrics.
00:33:34.160 --> 00:33:34.480
Right?
00:33:34.559 --> 00:33:44.960
The and it we saw this uh in the early days of the company, that when we looked at the folks that were that were buying from us and we asked them why they bought, one of the biggest words they used was visibility.
00:33:45.519 --> 00:33:52.559
And to the, I'll call them the converted, that is an incredibly powerful word because think about what the inverse is.
00:33:52.720 --> 00:34:05.519
When you have lack of visibility, you have a hole in your network, you have a hole in your entire defensive program, and that hole propagates through what you think your detection coverage is, what you think your uh detection volume is, what you think your MT MTTR is, right?
00:34:05.680 --> 00:34:10.639
You know, to quote one CISO I met with, he said, look, we have we had 3,000 security incidents last year.
00:34:10.719 --> 00:34:11.920
That's not what worries me.
00:34:12.079 --> 00:34:14.880
My worry is that we had 3,200 and we don't know it, right?
00:34:14.960 --> 00:34:16.320
We didn't know the last 200.
00:34:16.400 --> 00:34:18.880
So this visibility word is incredibly powerful.
00:34:19.039 --> 00:34:25.199
And one of the things I think is going to happen is that folks, as folks are rolling out their AI automation programs, what do you have to do?
00:34:25.360 --> 00:34:28.079
You have to map your process incredibly well.
00:34:28.320 --> 00:34:36.159
Mapping that process will lead you into mapping not just the people and the organizational handoffs and the tools, but it will lead to mapping the data you need.
00:34:36.239 --> 00:34:41.920
And is that data actually available in all the parts of your environment and for the right duration of time?
00:34:42.320 --> 00:34:46.239
Because, you know, think about why people uh go to NDR from PCAP.
00:34:46.320 --> 00:34:50.880
It's because if you keep even 30 days of PCAP, then you're dead blind on day 31.
00:34:51.199 --> 00:34:54.719
How many folks have a conscious understanding of the implication of that sentence, right?
00:34:54.800 --> 00:34:59.119
You know, the folks that use visibility as a powerful word, they absolutely get that, right?
00:34:59.199 --> 00:35:04.480
And that's uh I think the AI adoption and the AI automation is going to exaggerate that understanding.
00:35:06.159 --> 00:35:08.000
Yes, once again, you've nailed it.
00:35:08.159 --> 00:35:12.159
Um understanding what you need, how to get it.
00:35:12.639 --> 00:35:21.760
That's another area where I find a lot of people struggle, is uh they start with the detection or the response, and they don't understand the link to the data.
00:35:21.920 --> 00:35:28.320
So Brian, we're just scratching the surface here, but alas, we're out of time.
00:35:28.400 --> 00:35:31.599
So I'm gonna ask you the question I ask all my guests at the end.
00:35:32.159 --> 00:35:40.320
Tell me the one piece of advice that you'd give to CISOs, cybersecurity practitioners in the network security domain.
00:35:41.199 --> 00:35:44.079
You know, to me it's all around AI automation.
00:35:44.159 --> 00:35:50.480
And I think the the guidance would be pick the first two processes you want to automate and map them.
00:35:51.679 --> 00:36:00.000
That is the I think uh just a mandate right now because A, if you're not looking to fight fire with fire, then you're gonna be outgunned worse than you already are.
00:36:00.159 --> 00:36:01.599
Nobody wants to be in that position.
00:36:01.920 --> 00:36:09.679
Second, by mapping the process, you will discover all sorts of things about your team, your organization, your technology that have all sorts of positive side effects.
00:36:09.840 --> 00:36:13.760
And three, once you map the process, you can start to automate it.
00:36:13.840 --> 00:36:21.360
And my biggest kind of plus one, if I could sneak and do a one and a one A here, the one A would be don't let perfect be the enemy of the good.
00:36:21.599 --> 00:36:21.920
Right.
00:36:22.000 --> 00:36:25.119
You know, it's it's uh, I think of it like the Waymo analogy, right?
00:36:25.199 --> 00:36:29.119
Uh, if you if you've ever ridden a Waymo, way I was I was amazed, it's an awesome experience.
00:36:29.199 --> 00:36:29.840
I loved it.
00:36:29.920 --> 00:36:32.800
You know, people get freaked out when a Waymo has an accident.
00:36:33.039 --> 00:36:37.840
The reality is the Waymo's safety record is way better than all of us as human beings, right?
00:36:37.920 --> 00:36:46.480
So don't let perfect be the enemy of the good because we're all evolving to a world where the new defense in depth is actually AI cross AI triangulation.
00:36:46.559 --> 00:36:50.719
And so the sooner we get ourselves kind of on that path, the better it's going to be for everybody.
00:36:50.800 --> 00:36:55.920
And the very first step is pick the two processes you want to automate and map them out.
00:36:57.119 --> 00:37:07.840
And I'll just add, if you pick those processes, then you should be able to map from the processes to the data that you need to follow through on that, which we just talked about.
00:37:08.079 --> 00:37:08.880
So, Brian.
00:37:09.840 --> 00:37:13.280
Many, many thanks for participating in my podcast.
00:37:13.360 --> 00:37:14.159
I really appreciate it.
00:37:14.400 --> 00:37:15.599
This was this was great.
00:37:15.679 --> 00:37:19.679
I'm over here nodding and smiling the whole time when I wasn't on camera.
00:37:19.760 --> 00:37:23.360
So it was it was really uh a good experience for me.
00:37:23.440 --> 00:37:24.400
So thank you very much.
00:37:24.719 --> 00:37:25.920
Hey, John, my pleasure.
00:37:26.000 --> 00:37:26.960
It's great to talk to you.
00:37:27.039 --> 00:37:30.880
I have always followed your work and and uh just uh it's a privilege to join the podcast.
00:37:30.960 --> 00:37:32.320
So looking forward to more in the future.
00:37:32.559 --> 00:37:33.199
Well, thank you.
00:37:33.440 --> 00:37:35.360
You're flattering me, and I'll take it.
00:37:35.519 --> 00:37:43.599
Uh, but for my audience, thanks for watching and stay tuned for the next episode of the Cybersecurity Bridge podcast.
