WEBVTT
00:00:06.400 -->
00:00:19.920Hey everyone, really excited for this conversation today to dig in where AI security is actually delivering value in security operations with a true innovator and expert in the field at Anvilogic.
00:00:21.679 -->
00:00:21.920Good.
00:00:22.079 -->
00:00:24.960Nice to meet you, Evan, and thanks for having me on the show.
00:00:25.359 -->
00:00:26.960Really excited to chat.
00:00:27.519 -->
00:00:33.600So much happening in this area that I'm really excited to tap into your expertise.
00:00:33.840 -->
00:00:39.359Before that, how would you describe Anvil Logic and the journey and the mission you're on?
00:00:40.159 -->
00:00:41.600Again, thank you for having me.
00:00:42.320 -->
00:00:44.960Anvil Logic is a seven-year-old company.
00:00:45.119 -->
00:00:48.320We've been building an agentic SecOps platform.
00:00:48.640 -->
00:01:14.000And that's exactly what we do is with AI automate core SOC functions that enterprise SOCs do, such as data onboarding, detection engineering, hunting, triage, investigation, and any sort of ecosystem integrations, such as sending all of this enrichment off down to a ticketing system or a case management, whatnot.
00:01:14.159 -->
00:01:24.560So effectively, today what we sell to large enterprises is our agent ExecOps platform that automates key functions that they do daily.
00:01:29.359 -->
00:01:39.599You recently said that the AI sock story should really start with detection quality, not flashy demos of AI that we see so much.
00:01:40.079 -->
00:01:42.799Why do so many vendors seem to skip that part?
00:01:43.200 -->
00:01:47.920Yeah, that's a great question, and uh it is an important aspect of what we do.
00:01:48.159 -->
00:01:57.200Um in terms of a completeness of uh platform, the key functions start with even further left of detections.
00:01:57.439 -->
00:02:19.280They start with effective data management, such as identifying data sources where they may sit, which may be anywhere in the enterprise, and having an effective strategy to onboard such data for detections, which means having a framework for how the data is going to be standardized, normalized, stored, described, enriched, and whatnot.
00:02:19.520 -->
00:02:52.000And then from there, you get into the detection engineering lifecycle, which is identifying what sort of detections that particular organization needs vis-a-vis the data sources that they have, and uh continuously validating and tuning such detections and being able to uh allow the user to kind of interoperate in the uh changing dynamics of their landscape, the uh threat landscape, the data sources that uh are available to them and whatnot.
00:02:52.319 -->
00:03:02.560And then you get to the alert triage and investigation phase, and this is where you see a lot of organizations start to jump into because it is the easiest place to get plugged into.
00:03:02.800 -->
00:03:08.240Once all of the hard work is done and alerts are coming out, albeit alerts can get noisy.
00:03:08.560 -->
00:03:21.680It is easy to plug in a shim layer at that point and say, give me all of your alerts, and I'll pass it on to an LLM to kind of get me some enriched information back and then help you cull down the alerts.
00:03:21.919 -->
00:03:23.439That's a band-aid approach.
00:03:23.599 -->
00:03:30.319Sometimes band-aids are important, and uh some environments do require that, but that's the easy place to begin.
00:03:30.479 -->
00:03:43.520You haven't solved the fundamental problem, which is ineffective alert strategy, noisy alerts, and uh, you know, perhaps even uh gaps on adopt data and detections you don't have.
00:03:43.680 -->
00:03:50.719All of those problems are not solved by just inserting LLM wrapping solutions to the alert triage phase.
00:03:50.960 -->
00:03:58.719So, like I said, band-aids are to be used when you have to staunch some sort of bleeding, but you really need to solve the problem further ahead.
00:03:58.879 -->
00:04:13.599So that's how we uh kind of uh envision and uh deploy is start with a with a firm data strategy and then a detection strategy, and then the rest will follow much, much easier, which we do too, right?
00:04:13.759 -->
00:04:20.879We have to close the loop, but uh just beginning here and starting here and just only staying here isn't sufficient.
00:04:21.600 -->
00:04:24.639Well, given your uh medical analogy here, I like that.
00:04:24.720 -->
00:04:31.680I think triage is is is is kind of the word of the day, and certainly when it comes to alert noise, that is a problem.
00:04:31.759 -->
00:04:38.079You actually claim a 98% accuracy and and reduction in that alert noise.
00:04:38.240 -->
00:04:40.160That that's kind of amazing to hear.
00:04:40.319 -->
00:04:45.279Tell me more about that and what your customers are seeing in action and actuality.
00:04:45.600 -->
00:04:46.560Yeah, yeah, sure.
00:04:46.720 -->
00:04:55.680Um, that is one of our more popular use cases for um our uh AI workflow automation uh is that investigations phase.
00:04:55.920 -->
00:05:10.879So typically what happens in an enterprise is you you have alerts coming from various places, and those alerts need a lot of contextualization, they need a lot of enrichment because just the alert as a standalone entity isn't sufficient.
00:05:11.040 -->
00:05:14.079This is where the human beings come in, the L1, L2 analysts.
00:05:14.160 -->
00:05:23.360They spend a lot of time looking up that alert and trying to correlate it with the other identifying information and building a whole context around it.
00:05:23.600 -->
00:05:30.560And then they figure out what to do if it truly were looking like a true positive uh incident.
00:05:30.800 -->
00:05:48.160And there's a bunch of playbooks that they have to either write or use from institutional knowledge and practices, and that's what the process is all about, and that's why it's so heavily manual and it's impossible to triage and then investigate hundreds, if not thousands, of such alerts coming in daily.
00:05:48.399 -->
00:06:12.319So this is where we kind of shift left and say the reason why we get to a 98% accuracy is because we are able to go achieve the full context from the beginning to the end, not just start where someone else left off, which is the alert phase, but to go all the way back to say the data was this, and the detections that ran on the data were like this.
00:06:12.480 -->
00:06:17.839Therefore, the alerts I understand a lot better because I have the full context.
00:06:18.160 -->
00:06:22.480So our enrichment begins right at the data phase.
00:06:22.639 -->
00:06:41.680How we describe the data, how we normalize it, how we store it in uh uh uh ETL for uh normalized form, and then the detections that play on top of it, every stage of it is enriched, every stage of it is labeled with the right mitre attack um uh technique or uh tactic.
00:06:41.920 -->
00:06:43.600It is fully labeled.
00:06:43.759 -->
00:06:52.639And therefore, by the time we come to the alert phase, we know what data corresponding to what detections ticked off that alert in the first place.
00:06:52.879 -->
00:06:55.199So it's half the job is already done.
00:06:55.360 -->
00:07:01.279So we have a greater accuracy because we don't have to go figure out where this alert came from.
00:07:01.439 -->
00:07:03.439We already know the history of it.
00:07:03.600 -->
00:07:08.720So that's why we are more successful and have a high rate of success in terms of accuracy.
00:07:09.199 -->
00:07:10.240That's really interesting.
00:07:10.319 -->
00:07:15.120I think you use the term explainability in your your focus there.
00:07:15.279 -->
00:07:16.720I found that interesting.
00:07:16.959 -->
00:07:21.920Why is that show your work uh kind of becoming such a critical requirement?
00:07:22.319 -->
00:07:25.120Yeah, if we listen to our teachers, we'd know that, right?
00:07:25.279 -->
00:07:27.040Show your work at all times.
00:07:27.199 -->
00:07:28.720That's exactly what we do.
00:07:28.879 -->
00:07:31.600Is no one wants to trust a black box.
00:07:31.759 -->
00:07:32.959It takes a long time.
00:07:33.199 -->
00:07:43.439I mean, if you sit in a self-driving car, for instance, I have a self-driving car, and I've practically turned off everything except lane assist, which is plane drift uh detection.
00:07:43.680 -->
00:07:45.279Because I don't quite trust it yet.
00:07:45.360 -->
00:07:47.360But I slowly turn things on, right?
00:07:47.519 -->
00:07:51.279And that's exactly the mode that we want to be in with our platform too.
00:07:51.439 -->
00:07:55.439So I don't want a black box answer saying this one's good and this one's bad.
00:07:55.759 -->
00:08:01.120Every step of the way, we have paragraphs of text that explain what happened there.
00:08:01.279 -->
00:08:03.360So the full context is explained.
00:08:03.519 -->
00:08:08.079If there is a detection we ask that you deploy, we explain why.
00:08:08.240 -->
00:08:15.839And we also explain what data sources get you what level of efficacy in this detection version versus this detection version.
00:08:15.920 -->
00:08:21.600If you added one more data source, we could get you up level to this detection, which tells you a bit more.
00:08:21.839 -->
00:08:28.000So every step the way the human being feels like they understand why something is happening.
00:08:28.160 -->
00:08:31.439And that is, you know, sometimes what we call a decision trace.
00:08:31.600 -->
00:08:37.919It's essentially knowing the rationale behind an action is as important as the action itself.
00:08:38.159 -->
00:08:55.919This is where we start to capture the institutional knowledge that uh exists in an enterprise because your enterprise stock, the best of your enterprise stock's work is done by the best of people who know the context, who know uh the environment, and who had the experience of uh being there.
00:08:56.159 -->
00:08:58.639And that's what we need to capture in our systems.
00:08:58.799 -->
00:09:03.519So when an action happens, we need to know why, as much as we need to know what the action was.
00:09:03.679 -->
00:09:05.440So we encapsulate all of that.
00:09:05.600 -->
00:09:08.320And that is the explainability that is really important.
00:09:08.639 -->
00:09:15.679At one point, when the efficacy of the system has been proven, there will be more trust, people will turn on more.
00:09:15.919 -->
00:09:42.799So even in our newer AI workflow automation capability that we've called blueprints, what we do is we have a step that you can insert anytime called the human in the loop step, which is after n number of things that we do, you can insert that step right there, and it'll say, unless and until the human being has inspected and validated and verified and given you the green signal, you shall not proceed to the next set of steps.
00:09:43.120 -->
00:09:45.440So that uh you know is important.
00:09:45.759 -->
00:09:50.399And just plugging in a human in the loop without context isn't useful either.
00:09:50.639 -->
00:09:56.320You've got to give them the explainability and the transparency behind actions, and then plug the human in.
00:09:56.480 -->
00:10:01.840And over time, let people gain trust to say, I don't need so many human-in-the-loop steps.
00:10:01.919 -->
00:10:03.759Maybe just here and here will do.
00:10:03.919 -->
00:10:05.679That's where we want to get to.
00:10:06.879 -->
00:10:07.679Fascinating.
00:10:07.840 -->
00:10:12.000And speaking of humans, I mean, the security teams today are juggling so much.
00:10:12.159 -->
00:10:15.039I mean, maybe they have 40 browser tabs open.
00:10:15.120 -->
00:10:20.080They already got Splunk and Sentinel Databricks and Snowflake tabs open.
00:10:20.320 -->
00:10:23.440Um, that's a you know, a lot of fragmentation problems.
00:10:24.399 -->
00:10:31.120Uh one of the top problems you're you're hearing from CISAs, that's one of them, but one of the others that you're you're trying to help with.
00:10:31.840 -->
00:10:32.320Yep.
00:10:32.559 -->
00:10:38.399Now you uh hit the nail on the head that with those technologies, by the way, those are what dominate the environment today.
00:10:38.559 -->
00:10:43.039We see a lot of Splunk, a lot of Sentinel, and a lot of snowflaking data breaks.
00:10:43.279 -->
00:10:45.039So the data lies everywhere.
00:10:45.600 -->
00:10:55.600What we've uh said right from the beginning uh of our company was the vision was to have a federated approach to security operations.
00:10:55.840 -->
00:11:02.000So we took this approach of the old legacy world was bring all your data into one place and then we can build on top of that.
00:11:02.240 -->
00:11:03.759That's just an impossible thing.
00:11:03.919 -->
00:11:05.360And it never happened.
00:11:05.600 -->
00:11:13.679People thought it happened and they put a lot of data in, but there was still what we call a lot of dark data sitting out here that no one was with.
00:11:13.840 -->
00:11:17.120But today, what we are saying is look, it's a federated approach.
00:11:17.360 -->
00:11:24.559Leave the data where it is, and we can push our federated queries and therefore build detections and correlate here.
00:11:24.879 -->
00:11:32.639You don't need to move a lot of expensive data against the laws of physics into some place just so you can run a query on it.
00:11:32.799 -->
00:11:35.600We can be very federated about this approach.
00:11:35.840 -->
00:11:54.320So we see a lot of enterprises, particularly large enterprises, move in the direction of leaving data where it is or implementing a data lake strategy where it is much more cost-effective, much more elastic, uh, much more uh open to run other workloads on.
00:11:54.480 -->
00:12:07.600They're uh kind of uh divesting away from the legacy sim approaches to the more federated approaches, which suits our uh platform uh capabilities as well as our vision.
00:12:07.759 -->
00:12:11.919And uh so that's how I think I imagine the world will continue to be.
00:12:12.559 -->
00:12:13.440Amazing.
00:12:13.679 -->
00:12:18.399Uh so you you spent three decades or so in security analytics.
00:12:18.559 -->
00:12:19.919That's quite a journey.
00:12:20.159 -->
00:12:25.440Um, how does your SOC today differ from that of two, three years ago?
00:12:25.600 -->
00:12:29.039And maybe you can then talk about what we'll be in another two or three years.
00:12:29.200 -->
00:12:32.159Things are moving at such speed, it's really incredible.
00:12:32.480 -->
00:12:33.200Yeah, yeah.
00:12:33.360 -->
00:12:34.399That's a great question.
00:12:34.639 -->
00:12:43.120For the longest time, even uh, I think for about 15 years, the SOC score remained the SIM, and it still does.
00:12:43.279 -->
00:12:47.919But that SIM was very, very monolithic in nature, right?
00:12:48.000 -->
00:12:59.120And uh that uh meant you move all the data into one place, and then you have proprietary languages uh to query, uh, you have proprietary formats of data that sit on top.
00:12:59.279 -->
00:13:05.360And the whole thing is legacy, therefore, uh, from today's perspective, and very, very proprietary and monolithic.
00:13:05.519 -->
00:13:14.000That we've kind of in in the first wave a couple years ago, started to show to the industry that you don't need to do that.
00:13:14.159 -->
00:13:26.799You can, in fact, have a data lake strategy where some of your newer cloud data that you were not putting in your legacy systems could go to, and uh, someone like an Anvilogic can unify and correlate across both of these.
00:13:27.039 -->
00:13:37.840So we started to uh create validation in the industry that your legacy can be augmented by uh data lake, so creating a hybrid strategy.
00:13:38.000 -->
00:13:40.399That was the first wave of transformation.
00:13:40.559 -->
00:13:53.279And now the second wave of transformation has begun where uh large enterprises are uh you know subscribing to this and either hybridizing or completely leapfrogging to the new data lake world, which is great.
00:13:53.440 -->
00:13:55.360Now that's happening at one dimension.
00:13:55.600 -->
00:14:02.320The second dimension that has started to happen in the last couple of years is how you apply AI to the usability.
00:14:02.480 -->
00:14:22.240Now, all of this is infrastructure, which is important, but then there is the usability dimension, which is where AI has come in, where it has helped human operations be automated and at a rate at which humans will never be able to keep up, and that's how AI works, but it is going through its steps of gaining trust.
00:14:22.399 -->
00:14:31.679And that's why all of this explainability and human in the loop and applying AI to a function at a time rather than say your whole SOC has been AI-fied.
00:14:32.080 -->
00:14:43.120We're saying no, your data management has certain AI workflows, and here's a in our power glance a blueprint to automate data onboarding.
00:14:43.279 -->
00:14:46.639And here's everything it does, and that's use case number one.
00:14:46.879 -->
00:14:50.559Use case number two, let's now get your detections automated.
00:14:50.639 -->
00:14:52.799Here's how a blueprint for that could work.
00:14:52.960 -->
00:14:58.720And it could be rolling out new detections or doing continuous detection validation, whatever it is.
00:14:58.960 -->
00:15:03.600And then a use case number three would be how do you triage and investigate it now?
00:15:03.759 -->
00:15:05.440Let's automate that workflow.
00:15:05.600 -->
00:15:07.679And that's kind of the approach we've taken.
00:15:07.759 -->
00:15:13.679So we I see this as the third wave of disruption to that traditional SOC architecture.
00:15:13.840 -->
00:15:15.600But it's happening in two dimensions.
00:15:15.759 -->
00:15:24.080One dimension is the infrastructure dimension, which is transforming from that monolithic proprietary state to a more open data lake state.
00:15:24.240 -->
00:15:30.879And the second dimension is the usability dimension, which is AI automating specific workflows.
00:15:31.120 -->
00:15:34.080And to do that, you need to be an expert in the industry.
00:15:34.240 -->
00:15:38.399Otherwise, you don't know what the workflow is and you cannot automate it.
00:15:39.120 -->
00:15:40.399Oh, really well said.
00:15:40.799 -->
00:15:47.519So there's a lot of um media stories these days about AI replacing analysts or replacing lots of people.
00:15:47.600 -->
00:15:48.799I think it's overblown.
00:15:48.960 -->
00:15:57.360But what's your take on AI replacing people on the human equation and really genuinely helping security teams?
00:15:57.759 -->
00:16:01.519Yeah, I think there's partial truth to that, uh, Evan.
00:16:01.759 -->
00:16:03.759I think it's often overblown.
00:16:04.000 -->
00:16:18.480And uh in a lot of industries, including in security, people kind of use um that sort of uh you know, um, analogy to um automation from the Industrial Revolution to other places to now uh pretty loosely.
00:16:18.879 -->
00:16:33.600I think the I go back to knowing the domain and the workflows of that domain, the ontology of that domain, essentially knowing security entity relationships and the local environment is fundamental before you can automate anything.
00:16:33.759 -->
00:16:44.960And a product like ours that has been there and uh drawn a lot of uh data gravity to it from which to learn and then augment with LLMs is what it takes to automate.
00:16:45.120 -->
00:17:02.480But having said that, there is some truth too, yes, we can automate, and we have shown automation of real human mundane tasks so that those L1 type analysts, sometimes even L2 type analysts, can move up to L3 and L4 and do better work.
00:17:02.879 -->
00:17:13.599So it is essentially making organizations more efficient and hiring people at greater and higher levels, where personally their job satisfaction is a lot better.
00:17:13.839 -->
00:17:21.680If you look at the uh average industry, the churn at the L1, L2 and the burnout is so high that they're losing productivity anyway.
00:17:21.759 -->
00:17:32.640By the time they train, uh an L1 analyst or even an L2 sometimes is 12 months, and then in 18 months they burn out and move on elsewhere, and then you get the new wave of people.
00:17:32.880 -->
00:17:34.319It's just it's impossible.
00:17:34.480 -->
00:17:36.160That's the sort of thing that shouldn't happen.
00:17:36.240 -->
00:17:45.759That's where AI and automation can really play a good role, is to keep uh the institutional memory and practices and the learnings and continue to grow.
00:17:45.920 -->
00:17:47.200It's never going to go away.
00:17:47.359 -->
00:17:48.960It's never gonna get burnt out.
00:17:49.119 -->
00:18:03.279Move your people up the stack so they get more intelligent work done rather than mundane data wrangling and uh you know detection building and tuning and learning new proprietary languages of new data lakes and whatnot.
00:18:03.519 -->
00:18:05.200Leave all that to the machine.
00:18:05.440 -->
00:18:15.440So I think there is some truth to some human um analyst positions are going to be up-leveled and therefore will not be done by humans anymore.
00:18:15.599 -->
00:18:24.160It's like uh, you know, uh spray painting painting cars in an uh industry assembly line in a car manufacturing industry.
00:18:24.319 -->
00:18:26.240I mean, who wants to do that anyway, right?
00:18:26.640 -->
00:18:31.440That's the sort of thing uh we are considering here in security analytics as well, is happening.
00:18:31.599 -->
00:18:38.720So element of truth is certainly there, but is it also being overblown to all jobs are being taken by AI?
00:18:38.880 -->
00:18:40.160Honestly, no.
00:18:41.599 -->
00:18:43.440Yeah, really great insight.
00:18:43.759 -->
00:18:49.279And um, you know, talk about to the degree you can, your roadmap, where are you investing, innovating?
00:18:49.440 -->
00:18:51.680Anything you could share over the next year or so?
00:18:52.160 -->
00:18:52.640Absolutely.
00:18:52.799 -->
00:18:58.559Again, I think I will um uh uh draw the focus back to those two axes.
00:18:58.799 -->
00:19:07.119I think it is important for us to continue to stay on course with the federator approach as well as the AI usability and workflow automation approach.
00:19:07.359 -->
00:19:13.519So our roadmap involves both more platforms to support, more AI workflows to automate.
00:19:13.680 -->
00:19:24.880And the AI workflow automation we've uh trademarked as uh what we call blueprints, and that's what we announced recently, uh, you know, and we're gonna do some more announcements on that uh coming up very soon.
00:19:25.039 -->
00:19:29.519So we're putting all of our investments into AI workflow automation.
00:19:29.680 -->
00:19:43.039And that is the future of Agentic SecOps, is to be able to automate core SOC functions with extreme knowledge of that domain and data pertinent to that domain in the local environment, and that's our future.
00:19:43.200 -->
00:19:44.319That's what we continue to do.
00:19:44.559 -->
00:19:47.039Agentic secops, everything.
00:19:47.440 -->
00:19:48.079Brilliant.
00:19:48.319 -->
00:19:50.640And where can folks meet you or the team?
00:19:50.799 -->
00:19:56.160Um got some industry events still happening despite the summer and like that coming up in a couple months.
00:19:56.240 -->
00:19:57.920Where where will you be in the team?
00:19:58.240 -->
00:20:11.599Yeah, we are at the uh Gartner uh IT and risk uh risk and security symposium or risk and security conference summit, I think it's called, in Maryland, um, coming up in a week, first week of June.
00:20:11.759 -->
00:20:17.759Uh, we will also be at the uh Snowflake Summit and the Databricks Summits, uh, all happening in June.
00:20:17.920 -->
00:20:21.359And then uh in uh Black Hat, of course, early August.
00:20:21.440 -->
00:20:25.039And we've got some announcements to make all through this time in the summer.
00:20:25.119 -->
00:20:28.640So the summer is a heavy work period for us.
00:20:29.039 -->
00:20:30.240No rest for the weary.
00:20:30.319 -->
00:20:32.079Well, congratulations on all the work.
00:20:32.160 -->
00:20:35.440It's much needed, incredibly important work from all of us.
00:20:35.519 -->
00:20:37.440So we're rooting for you onwards and upwards.
00:20:37.759 -->
00:20:38.720Thank you so much, Evan.
00:20:38.960 -->
00:20:40.240Really pr a pleasure here.
00:20:40.559 -->
00:20:41.440Thanks, Garthik.
00:20:41.519 -->
00:20:43.279And thanks everyone for listening, watching.
00:20:43.440 -->
00:20:49.359Also checking out the TV show, uh techimpact.tv on Bloomberg Television and Fox Business.
00:20:49.599 -->
00:20:50.160Thanks, everyone.
00:20:50.240 -->
00:20:50.960Thanks, Garth.
00:20:51.279 -->
00:20:51.759Thank you, Evan.
