Full Transcript for The AI harness

like SeaWorld or something too when I was because I was editorial assistants. I I was the receptionist too. yeah, me and my other EAs, we shared that. So that was fun. but that was for a couple of years and then but I was also the go-to tech person there. Matthew Chiodi: Ha ha. Diana Kelley: And then I went to PWS Kent in Boston and I was an an ⁓ editor there. And where they they kind of pivoted me into an actual technical role there initially in editorial ⁓ because was right when software was becoming a thing. So all of the and we were a a a math textbook, math and science textbook publishing company. ⁓ And so Matthew Chiodi: Mm-hmm. Diana Kelley: the stuff that we were acquiring, it was starting to come with this really rudimentary software. So it was like very cutting edge. You know, you as the professor can actually generate questions from the textbook with this software, so to create your own quizzes and things. So this was really like it was like woohoo, it was really very new. And nobody really knew what to do about that. So I became the person who was acquiring, you know, really the the software part of it. I became the go-to person for that. And then I was training the sales reps on how to use it. And it went down to I don't, I don't know what it was called at the time. You call it an SKO now. and we were having that in Florida for our company. And was doing the training and our parent company person was there because we were gonna start tying all of the all the different the nine subcompanies, textbook companies together so we could buy paper in both. So she was there sort of, you know, trying to figure some stuff out, talking to people, meaning people. So it was a woman and her boss, the CIO, was a woman, which was interesting too. But ⁓ anyway, she me. presenting this software to the editorial team, ⁓ to the sales team. And she said, look, I need somebody to run the network in Boston for our two subs in Boston. And I think you should do it. And I was like, I don't know. So because it was actually pretty hard to work my way up an editorial in Boston at the time. it had only been it had been like three and a half, four years maybe, but it felt like forever. Cause you know, I'm a kid. This is my first job. So I'm like, it's my entire career. And And and and she she was like, I you can really do it. And I'm like, I don't know, you know, but I'd always been doing the IT part. then I said, Well, how much does it pay? And it was more than double what I was earning. And I was like, I will give that a shot. Okay. ⁓ yeah, what was shock was surprising to me was that I had thought editorial as being this very creative endeavor, but Matthew Chiodi: money does matter. Money people are like, ⁓ Diana Kelley: you a lot of editorial work is you correct other people, you know, you the acquisitions part, you find the authors, you go sort of lure them in, you get them to sign with you, then with someone else. There's a lot of just, you know, this, do this. It wasn't quite ⁓ had this fantasy I was gonna be Maxwell Perkins, who was famously the editor of F Scott Fitzgerald and and Hemingway and really impactful in their writing. You know, I had in my mind like I'm gonna be Maxwell's right. It's not that way for most editors. So but what was interesting was when I went over to IT, there were all these problems nobody knew how to solve. I had to get really super creative and learn things. I mean, even at one point to add extra memory to one version of the Mac, you had to like open with your little butterfly tool. So it was like I'd sit there on the floor like ⁓ opening it. Then you had to ⁓ snip wire on the motherboard and then install new memory, which is broke some warranty. But anyway, we had to do it because we needed the memory. But you it's like stuff like that where I'm like, it was like I just felt like, ⁓ my gosh, I'm learning so much. It's so creative. It felt more creative than than editorial. so that was like really fun for me was I was like, this is that's why I didn't look back. The money mattered, but it was just it that I I really felt like there's just so much to learn in this this area. So that's why I I stayed. then my pivot to security was interesting. You didn't ask, did I tell you? Like ⁓ she's just along. Matthew Chiodi: ⁓ please. Please. Now I wanna I wanna hear this. This is what I think most people who are again or maybe don't start as cybersecurity majors are most curious about. Is like how do you how do you get there? So you're you're this is really good. Keep going. Diana Kelley: Yeah. So I'm I'm basically somebody who didn't like me said, You're like the the computer mechanic, you know? Like we just bring our computers in and you fix them. I was like, okay, thanks. but so there I was ⁓ more or less the computer mechanic. I went to another company in the Boston area where ended up teaching myself how to actually write software for that company. It was a logistics company. I rewrote all of their their front end and back end software and also managed their network. But still not in security per se. Then I went to a startup in Cambridge, Massachusetts called Dataware Technologies. And we were getting ourselves onto the internet for the first time. I installed like their first mail gateway so that we could like actually send mail outside of our own network, which was really like huge for us. But we were excited because we could give updates to our customers via FTP. And I was so proud, so proud of what I built for I'd taken them from coax to like, you know, Cat 5 or was it Cat maybe Cat 3 at time. Anyway, you know, it was like I had done all these like great things for the company and then started to tie our nine offices together. And they wanted to distribute their software to their customers, the updates, patches and things. And I and I was like, we could this by FTP and they can just log in and they can get the software. Which again, people now are like, of course.

Yeah, but it was this was all really groundbreaking at the time. So I was so proud of myself. And then not know entirely how to protect all of my bastion hosts out on the internet. So had Matthew Chiodi: Of course, right? Like, well, what else would you do? Diana Kelley: Actually, there was a flaw and I was using one of my hosts was N T, had a flaw in it. Some some folks that were doing wares, W-A-R-E-Z. Do you remember where? Yeah. So they so you you could for anybody who doesn't, you you crack the licensing key for games, and then you need somebody, you needed a way to distribute it. So you would basically take over somebody else's system ⁓ then dump all your wares on it and then tell all your friends on the BBS, like, hey, you can go get this free. Matthew Chiodi: might know what that is. Yes, I do. Diana Kelley: new game where where there's no licensing on it. So they had had found a vulnerability in in my bat my my externally facing system ⁓ it over and yeah I found this out because like the hard drive kept filling up and I'm like, what's going on? it was Christmas Eve too and I had sent everybody home on my team except for me and a consultant. And we just sat there from like 5 36 when we saw this anomaly happening until like late, late. Matthew Chiodi: Good boss. Diana Kelley: but we finally eradicated them. And you know, I spent time thinking, well, what happened? I wanted to research, I wanted to understand, and I realized that you can do everything right, but if you don't secure it, then the attackers are gonna get to you. And I decided at that point, it because I just became convinced over that sort of like that. Was like this really like eye-opening moment. You know, I went to our our head of know, our CEO and to our Our president and I said, look, this is I think the most important thing we can do. We have to these systems. There's nothing, you know, nothing gonna work unless we secure the internet. ⁓ So is this is a a top priority now. ⁓ And they Yeah, okay, you know, sort of do whatever you have to do. but I did ask some of my mentors at the time what they thought about I said, I'm not gonna pursue being sort of CIO direction. I I think security has to get solved first. ⁓ And I was told, Don't do that because know we don't think about the security of the phone. It's gonna be like the security of the phone, and you're gonna have spent a lot of years getting a deep skill in this heranich area that's gonna be solved and and you're gonna not few you're you're gonna future unproof ⁓ your career if you do this. And said, I I get that and I respect that, but this is such a big problem, and we will never get the benefit of the internet if we don't. Matthew Chiodi: Mm. Diana Kelley: Have proper security built in that I'm gonna go do that anyway. So I I went off and that's that's that was how I made that hard pivot. And I think that that's a little bit different and different to, you know, in addition to having an English background, the other thing I think is really sort of different about how I came to this is that didn't go in thinking that I was gonna be like a super cool black hat getting the bad guys. I went into this specifically because I loved building networks and having people be able to use these networks. And I was so angry that somebody was going to take that ability away from them. You know, that I was like, we the the business needs the business. And that means that that all of you people need to get you bad guys need to get away. So I went into it that way, not like I'm gonna hunt the bad guys, but just like nope, business got to do what business got to do. And I think that a slightly different mindset from a lot of security people. ⁓ Matthew Chiodi: Mm. Diana Kelley: And I think that also was probably pretty helpful because again, you're hearing that so often now of you know CISO needs to really understand the business and enable the business. And that's that was how I went into security was just how do we enable the business. Matthew Chiodi: I love that. I love that. So that's that's a awesome kind of transition into not that different from what you're doing today in the world of AI and what we're talking about now, right? So you're talking about this is obviously ⁓ number of years ago there where you had to sound like convince your boss that, hey, we need to do something about security, which would have been extremely novel then. Right now it's like, well, of course we're gonna secure. And obviously there's all security issues have gone away because we talk about that, right? ⁓ back then specifically. ⁓ Diana Kelley: Right. Matthew Chiodi: you would have been bringing up something that was absolutely new and novel. And you would have had to make the case for that. So now we are in this what seems like this radically different time where we're talking about autonomous systems. we've we were talking before the show about the whole news that's going on last couple of weeks with open AI and hugging face, with A's I open AI model, you know, escaping this ⁓ test environment. So all that to say, you know, you are Diana Kelley: Yeah. Yeah. Yeah. Matthew Chiodi: very much focused on AI and AI security right now, again, at the forefront. In our prep call, one of the things that you brought up, and I think this is something I'm starting to hear more and more about, is the concept a harness. And you had said that, you know, people often conflate the LLM with the harness around it. Two questions. Like first of all, what is a harness? And ⁓ is that distinction ⁓ Diana Kelley: Yeah. Yeah. Matthew Chiodi: So important for security leaders. Diana Kelley: Yeah, so so the the LLM itself is a is a flat file. So the AI part, the truly AI artificial intelligence part, when you say an AI system, the ⁓ part is the LLM, it's the large language model, and it's a it's a file. And unless you you have to run it in a system, you have to train it, you have to there are all these things to

to make it sort of do its thing so you can perform inference. But I people a lot of times misunderstand when you're interacting with Claude or you're interacting with OpenAI or or Copilot, you're interacting with software and the software that wraps the LLM. There's some some software right around it that's part of its actual runtime. There's also the the harness which can be the business logic around it. But these are software components. So when you talk to Claude, you're interfacing with software. And then that software is doing the work of taking your prompt a lot whole lot of other information, putting that into the context window, deciding what goes into the memory for the markdown, you know, what what's going to be in the memory, which part of the previous turns might get included, all these things, and then sends that to the LLM. The LLM performs the inference and the output of that, the software picks that up and then it's either instructions on how the software should act or it's a response that you send back to the the original query or like the person on the other end. ⁓ that When people think of AI, they often just think of all this system as once. Why does this matter? There's a couple of reasons why it matters. The first is for model agility. And if you your harness set up with your business logic and what you're going to put around it, then the you can swap out your models, which we're seeing more and more. I mean, we're seeing this already in the interfaces easily. You know, we're now ⁓ To the point that I think I might be getting too complex where both, you know, Chat GPT and Claude, it's like, which model do you want? Like, I don't know. You know, like, do you want sonnet? You want haiku? Do you want to go with Fable? That's gonna cost you. But you know, I think people are probably like, so we're all sort of feeling this model agility, but we know that we can replace models. ⁓ means that maybe if you've built a lot of stuff around open AI, you have a more transferability to a different, to a different model, getting a cheaper model. There's that. Matthew Chiodi: Yeah, pick it for me. Diana Kelley: But there's also that the security itself in the LLM, it doesn't exist in the sense that that sounds very like what? but in the sense that the LLM doesn't know right from wrong. It's been trained ⁓ data. and then reinforce to have certain weights going one way or another so that how the kind of output you can kind of steer it a little bit, but remember non-deterministic, you can't always steer it the way that you want. That's how LLMs work. what into that context window, whether it's trusted data or untrusted data, when it gets to the inference point at the LLM, it's not to be able to figure out what was trusted and what was untrusted. ⁓ Even if tag it as trusted into the LLM, The way that it works, that the inference works, it still can't give you at a security deterministic control level, it's not going to be able to separate from the other. That's we get indirect prompt injection, not because they're, you know, somebody's bad or it's martable. It's just really, this is the architecture of how they work. So it's important for us to know that once something gets to the LLM, the LLM itself is not a security control. It's an incredible tool. But it's not a security control. So what does that mean for us as security people? That means that our security controls have to be before it goes into the context window, before it gets to the AI itself, the LLM, not the AI system. But so the harness itself can give us and management around that. Choose what goes. Maybe if it sees an instruction that doesn't look like something you want to send to the LLM, it could strip it out. When I say season instruction, there are a lot of ways can do that. It could do it deterministically through regular expressions, it could do it with machine learning classifiers in front of the LLM, it could do a whole other LLM itself. There are a lot of different ways, but to do that before you get to the one that you have to do the inference on the one that you're depending on for your move forward movement here. you got a whole lot of security that can happen in the software around the LLM. And then once it's out of the LLM, you have. downstream security and controls that you can have either in the harness or in the ecosystem around it to stop the LLM from doing something that maybe it shouldn't, like escape a sandbox, for example. so why does it matter? It matters because the AI itself, the LLM, doesn't have the ability to understand security context the way that that determin and can't apply it reliably the way that we can with deterministic systems. ⁓ Matthew Chiodi: Hm. Diana Kelley: And the harness around it, the ecosystem around it, that's where we need to put all the security controls and and decision points. And that's a huge thing for for us as as security and and builders because there's been a lot of sort of just maybe. I'll call it hopium. You know, like people really have just the AI's so smart. We're not gonna need security. And I have heard this from from executives, and I I love that. I think it's ⁓ Great to love technology and to think it's gonna advance, but the truth is that right now that is not how these systems work. And until there's a major technical advance, there's not that's not gonna be how it works. So the LLM isn't a security control, but the harness and the software around it is where we need to put all of our security controls. Matthew Chiodi: If I hear you correctly, it sounds like a lot of this revolves around what OASP probably a decade ago would would have called sanitization of inputs, right? Sanitizing your inputs. a lot of that come down? Is that kind of an oversimplification of it? But it sounds like ⁓ got the LLM at the core and you've got the harness and all these other pieces around it. It sounds like you're saying that we shouldn't, at least at this period of time,

expect. security to be the in the LLM itself because it's non-deterministic. the harness is what, you know, generically speaking, we need to be looking at to do it to do that sanitization. Is that right? Diana Kelley: Yeah, the harness is where we put the trust boundaries. So the the context window, which is that thing right before it goes into inference, it's all of the the in info, not just your prompt or some agent's prompt, but you know, previous turns, memory, any files, right? That that is where you can't that's not that's not a trust, that's not a ⁓ security trust boundary that we can control. At the level that we control control the other trust boundary. So yeah. And I I think of an way for people that are like, this seems like a lot, is that if you think about it as contamination and So contamination is if anything gets into that context window before it gets to the LLM that you don't want. Matthew Chiodi: Mm. Diana Kelley: and it could be malicious, it could be not malicious. You know, sometimes we just write, you know, you write a bad prompt and you didn't give the LLM what it needed to give you a good answer, kind of thing. So there's a lot of ways to quote contaminate. ⁓ but there's contamination, so making sure that we've ⁓ what goes into the prompt as of as as well formed and crafted as it can be and without malicious content. And then is when the instructions come out of the prompt, out of the LLM inference. what what gets done with those instructions, you know, things like does it send an email, does it grab confidential data and then try ⁓ attempt to exfiltrate it. So contamination and consequence, and when we think and I often will talk about it, you know, ⁓ people understand it as you're using Claude or you're using Chat GPT. But the thing that people have to kind of which is a great way to understand it once you've got that in your brain, ⁓ okay, now You have to put that on steroids because an agentic, it could be 200 agents going around and around and around, you know, like basically spinning back, you know, content into into to the LLM again and again and again and again. that's where so it's like it's really helpful to think of it as like you chatting with one of these, ⁓ but you have to get your brain ready to go to this is at agentic scale. So you can spawn it's 300, 1000 agents very if you have the compute power very, very quickly. And they can just keep rerunning a loop again and again, or you know, be phasing over that loop in multiple turns. so it it goes really I hate that I don't like buzz buzzwords, but it scale and machine speed are really doing very ⁓ work when people talk about it with agents because they do mean ⁓ up a ton, you know, hundreds. Matthew Chiodi: Mm-hmm. Diana Kelley: thousands at a time and then that machine speed it's you can just keep going back and sending you know trying again and again and that's sort of back to hugging face and and open ai know I've read a of stuff gets very anthropomorphic

⁓ like know like the open AI agents are just they're relentless they will not stop and it's like well I mean ⁓ software yeah Matthew Chiodi: Mm-hmm. They're not gonna stop unless they run out tokens, right? Diana Kelley: Well, yeah. I mean there's software if you you if you set it up to keep doing this until it's complete, it will keep doing it until it's complete. You don't think of software as relentless, you think of it as software. And that's the agents there. so yeah. So ⁓ I think that those How how to think about it. Matthew Chiodi: So you've you've argued that AI is not magical. You said it's software, it's math, it's data. Although what you just said, even though you know people said that you said it's, you know, people try to give it, you know, human type of characteristics, it does sound pretty magical sometimes, right? When we talk about it. Now, that being said, you've also said that it's a completely different kind of software asset. So given what we've kind of talked about, like what Diana Kelley: Yeah. Matthew Chiodi: You know, we kind of generically talk about AI security now, which is also a a loaded term to use the term AI security, but is how is it different from what we've called AppSec over the last few years? Or is it is it the same thing? Like help us try to break that apart a little bit. Diana Kelley: Yeah, yeah, and the the not math, not magic, it's math is absolutely the case. Although do wanna also say that in 2017 when Google came out with Transformers and Transformers or how we got from like the AI, I sort of my professional career on, you know, Watson to what we're doing now. ⁓ it was thanks to Transformers and the great work of of engineers at Google. And a lot of people when tran they were working on Transformers said this would never work. And quite frankly, that are incredibly smart and a lot of them will say, we're not entirely sure why it works as well. So I think that's where there's that that little flight, flight feeling of magic. But yeah, I mean, but grounded in like this is actually math. And how is this different from from AppSec? And that goes to Matthew Chiodi: So there's a little bit of magic. Diana Kelley: ML secop. So when we talk about an entirely new artifact, that's the LLM Models have not been part of the software lifecycle until if unless you were a machine learning engineer, they it's not until the last few years have you been even thinking about models in your in your development lifecycle. ⁓ And that is a different artifact that you can put ⁓ malicious code in there in ways that's different than you put in other kind because it's not traditional software. So so there's a lot of so that is something new. You do we do need to scan it. You know, early on when I was back at Protect AI. I mean people were just downloading models off a hugging face and starting to, you know, just develop AI, you know, applications in their organization. Nobody had scanned that model for anything like malicious. So

which so when we were like it's a different artifact and it's like, well, but we have a A V or we have, you know, file scanning. It's like need a different thing. This is different. So when we say different artifact, that's that's what it's about. and certainly different activity and behavior when you look at how agentic being driven by LLM ⁓ can it really gets into a very different state. So we have a a different, it's a different ⁓ development lifecycle, the way that you train these systems, you know, even things like Back in the day when you were looking at doing a proper training on an application or testing on application, we were always like, never use production data. You know, don't ever ever test with production data. That's the worst thing you can do. So that's how we were trained up on traditional app sec. It lie real data is how you train a machine learning model, and LLMs are just an a a form a machine learning model. ⁓ So Even that kind of mindset of like where it was like never test with with real data. And it's like, well, we have to test. So how you how you manage the data that you're doing with the training, how you do the reinforcement learning, testing the the models, all of these things are actually different. And adjacencies and connections to AppSec, ⁓ but really did have to get new tools, new procedures, new approaches for this this new. kind of of deployment, both for a different artifact machine learning models, but also for how we test them and how we deploy them and how we build them into our good old software harnesses from before. ⁓ Matthew Chiodi: You know, in the early days of cloud, cloud security, we had, you know, the the main flaw was misconfigurations. And if we looked at why that was the case, often had to do with that cloud environments, again, in the early days were manually built. They were one-offs. Everything was a was like a snowflake. And we and then we talked early on about shifting left, right? How do we shift security left? ⁓ eventually, not that things are perfect, but eventually things, you know, any environments that were operating with any kind of scale moved to Diana Kelley: Yeah. Matthew Chiodi: infrastructure as code, right? And therefore we could put it through a CI C D pipeline. We could do checks on it before the environments were created. And it really did bring down, you know, environments became more standardized, et cetera. Where does that kind of that model of that called that factory like model going through this process, where are we at today in in AI, AI security with that? Are we moving toward that kind of model? Are we just still so early and things are changing so fast? What what's your opinion on that? Diana Kelley: Yeah. I I love that. And you know, it is interesting like with that model because it went from the the one-off to we could get secure deployment patterns and you and you know and use it for as code. And now we're actually got to a point where a lot of it's becoming

sort of automated, you know, the quote in AI let the AI do it, you know, YOLO mode, which is actually working out better than than I had initially thought it would. But yeah, where are we with with AI for that? I think we're still in the finding the secure deployment patterns part of the maturity. And it's in part because we all had access to these tools so quickly. And there was a lot of push from the top of, you know, adopt these tools, they're gonna save us money, they're gonna differentiate us from our competitors. So everybody run out and adopt. So we've got pretty much the entire organization has adopted. Matthew Chiodi: Mm. Diana Kelley: AI tooling in in some or all of their their work, whether it's you know the the engineers who are out there working with Langchain and they're creating everything from scratch, or we've got the CEO trying to vibe code stuff, which happens surprisingly often nowadays, it seems. Yeah, to the you know, the folks at the front desk who are who are automating certain tasks with skills in in Claude or with an agent that they've got they've built out of of from inside of Chat GPT. So there's there's And and securing these is is very different for security organizations. So that secure deployment pattern, right? You want a different secure deployment pattern for Langchain than you do for somebody who's just creating something for their own use within Chat GPT or maybe a use for their team or something. ⁓ we've got different impact levels, we've got different models for secure deployment patterns, and we're trying to catch up with all the different that people are adopting these solutions. There's also agents embedded in our SAS now. So I think that we're still we're still a little bit early getting those nice repeatable deployment patterns. And I think that we will have a little bit more of a challenge. ⁓ And that there wasn't a big challenge in cloud, because it's actually, I mean, that that was a huge lift for us to go from, yeah, it took us a long time. I think, you know, we're gonna have that in AI, but also it's gonna be a little bit more complicated just because we have so many different Matthew Chiodi: And it took a long time. Diana Kelley: use cases and ways that people are adopting it adopting it and that it's literally the whole company is adopting and it's not just the the cloud engineers and the the engineering team. So early, but I think you're absolutely right. I think it's gonna go where you had and how long? I d I don't know. Maybe two years because we're early, but we're also moving pretty quickly with AI. I don't think it's gonna be a a an incredibly long time before we start having ⁓ much more reliable deployment patterns and also that IT can offer to the look, you want to create agents, here's our agent factory. This is the secure way to do it. Here's how to roll it out. And that I am seeing a lot more. So I mean I maybe even a a year, two years from now, I think we'll be in a much better state.

Matthew Chiodi: I I agree with you. I I think that you're absolutely right in terms of the complexity. Before it was just, you know, maybe two or three teams in enterprise that were truly interacting with any scale with cloud. And ⁓ was only at the time one or two cloud providers. It was AWS and maybe Azure, right? And Google wasn't even the early days wasn't really Diana Kelley: I was gonna say, ⁓ G C P no love for G C P Matthew Chiodi: ⁓ maybe it was they were always kind of like they were always kind of the smaller player, but but even at most, right, people were dealing with three platforms. Now, like you said, AI is built into pretty much every piece of SAS technology. that's living on your endpoint has AI involved in it. So the literally the the amount of complexity of trying to get all of those into some type of deployment pattern, that's just that is a that is a process challenge for any organization. So I agree with you. I I think we're Diana Kelley: Yeah. Yeah. Matthew Chiodi: I love baseball analogies. I think we're probably in like first or second inning with this, but I think the rate at which we're going to move through those innings is probably going to be compressed. Whereas cloud, this was the better part of a decade to get there. I think because we do have AI that is helping to generate software, I think that's going to compress the problem down. But I agree with you as well, going back to a point you made, which is, know, technologists getting very easily people outside of technology saying, Well, I guess maybe we won't have a need for security because Mythos is going to solve all these problems. ⁓ Diana Kelley: Okay. Yeah. Matthew Chiodi: And maybe it's self serving, but I I just I don't see that happening anytime I think humans in the loop are likely going to be something we're we're working through for ⁓ for ⁓ AI safety for probably a very long time. Diana Kelley: Yeah, I I think so. I I don't think that I mean I I don't think that AI AI is an incredible way to to speed human beings up, to take off some of the repetitive tasks, but not AI isn't human replacement. And ⁓ I I and this is something that even back from my IBM Watson days, you know, I was always saying this is we was we were always looking at how it augments and then for some reason they're became this big movement of like it's gonna replace everybody. And I mean I crazy stuff, right? You know, CEOs saying, I'm gonna fire everybody at my company. I I don't see ⁓ ⁓ if we did get technological advances and we did get to AGI, I'm just not sure that that's really the place to go with AI. I think that it's it's really very much humans using AI to augment, speed things up, and in some cases make things more reliable too. But Yeah, not just places. They're not us. They don't think like us. Matthew Chiodi: So you you've been very active in industry as well. You're co-chairing the CSA's AARM, which is the Autonomous Action Runtime Management Working Group. That's a mouthful. first all, tell us a little bit like what is the what's the problem the group is trying to solve? And how that from, you know, for example, all the other tools that organizations have today? They've got the alphabet soup of tools, DLP, EDR, app set controls. Diana Kelley: Yeah. Yeah. Yeah. Matthew Chiodi: What what problem is the group trying to solve that's not addressed today? Diana Kelley: Yes. So it was founded by Herman Erico, who is a he's a a product manager at Vanta. And after he developed AARM donated it to CSA because the thinking was that it it's live and and thrive more more effectively in an open community. And what was as you could even imagine as a product manager, it's like, well, people say, I'm gonna magically stop your AI. So it's autonomous action, it's it's the runtime. It's that consequence part. It's that if it's trying to email your your if the the agent is trying to email your secrets out or s exfiltrate them some other way, what's gonna stop that? And lot of of vendors saying, I can stop it, I can stop it. And and Herman just sitting back and saying, Look, let's think about what that really mean. You need obviously to stop it, you need to have a way to stop it. You need to have a way to allow it. So, you know, sort of even going back to firewall DLP stuff. with agents, you may need to defer it. So it's just take a little of time, check. Yeah, and you may need to, you know, and maybe do some other automatic check. You may also need to send it up to some higher authorization level to have a human come in. So sat down said, if if we're gonna say that we can stop agents from doing stuff. What does that actually mean technically in a way that is apples to apples for everybody? So you don't just have folks saying, I can do that, I can do that. So buyers on the other end, right? You know, operational CISO hat on. It's like, how do I know that you're doing it? So it's these are the things that it would need to do to be effective. And then Matthew Chiodi: Mm. Diana Kelley: a standard that you can benchmark a system against to say, is it actually doing it that or not? So that's really what it serves. It serves to help the buyers, the operational side of the house be able to understand what is it I would need a system to do to say that it's actually stopping agentic runtime misbehavior, you know, and or controlling the agentic runtime. then how do I know that you're really able to have you been tested against a normalized standard ⁓ benchmark? And that's that's what the original vision was which which ⁓ was out with the original one why is it a working group now because well isn't it done was working alone for the most part and you and so you know when you want something to be bigger and and accepted you know more globally right you you start have you need other voices coming in and having a conversation and saying ⁓ let's reassess say what is this going to look like if we want to have this be something that that a whole

community can embrace and that's really what the working group is and ⁓ you know, and I I ⁓ huge props to Herman because I I watch him every week on this, you having this conversation because once you open it up for a lot of people to have opinions, yeah, you imagine it it it gets very complex, but you also get something that's much more durable, much more rich, and can be ⁓ something that be a standard. But really the initial impetus is if you're gonna say that you can stop agentic runtime, what does that need to look Matthew Chiodi: Everybody has opinions. Yeah. Diana Kelley: And how can we benchmark you your your your offering against that? Matthew Chiodi: What's the, I don't know if adoption is the right word, but what's what's been the adoption with, you know, kind of the, let's call it the some of the incumbents, the Palo Alto's, the CrowdStrike, the, know, all the different players out there. Is this something that they would adopt as part of their Like what would that look like practically speaking if this was massively successful? Diana Kelley: Yeah, so so there's actually a lot of larger organizations have folks in the working group, so there's definitely there's interest. ⁓ now, most of the companies that have gone and and tested themselves a bench ⁓ against benchmark tend to be on the smaller side. ⁓ But know, as this gets and NOMA is one of them, I think we were the first one actually. ⁓ but as this gets more, yeah. Matthew Chiodi: Okay. Congratulations. It's always good to be first. Diana Kelley: it as it gets more ⁓ highly adopted. Well, because it really we're like, yes, this is great. You know, like this makes so much sense. Let's all test against it and say, can we, can we hit the bar or not? but I think it's as it gets, I think that'll be a sign of of popular of of of adoption and importance globally when come when customers start saying, look, I I want to know my agentic runtime has gone against this benchmark. Did you hit that benchmark? Matthew Chiodi: Make sense. Diana Kelley: So I think once we see all the large companies hitting the benchmark, you know, going into the program and hitting the benchmark, I think that's when we'll know, ⁓ this is really done what it was, it was designed to do, which is just to give the buyer ⁓ good understanding of ⁓ is tool that I'm buying able to do what I need it to do? Matthew Chiodi: And if someone's listening and they're like, this sounds really interesting. How do I get involved? Is it an open working group? What does that what does that process look like? Diana Kelley: Yeah, they can go to the CSA. It's the CSAI of CSA. And yeah, you can just look up for the AARM working group. And yeah, I believe it's completely it's open for anybody who wants to to come in and join and have the conversation and ⁓ and more about it. and we, you know, we're it's we're constantly redoing the standard again, getting everybody's sort of ⁓ opinions and and insight in there so that we can get something that that's really very durable and very Matthew Chiodi: So I want to bring the conversation almost full circle to where we started, which was that, you know, you've spent decades helping CISOs get a seat at the table. And I think, you know, AI now has I think, forced that conversation more than anything I've seen in the last decade. So now that, you know, security, you know, they have the space, they're in the room. What are maybe two or three specific things that you think CISOs need be doing differently in order to really be adding value? with this AI conversation and everything that comes along with that. Diana Kelley: Yeah, I I think the first thing to add value to your your board to help to cut through a lot of the headlines and really help them to understand what's going on because it's very easy to get overwhelmed. by the the headlines. You know, it's like, you know, is is this Skynet coming? ⁓ my gosh, this is so scary. You know, there's there's it seems like there's there's some vulnerability announced every day. So number one, help them understand what's going on in the headlines and help them to really see it for what it is technically. So that they're not coming from a place of confusion or being overwhelmed or fear because it there's not a lot plain speak about what's happening. That's the most important. The second most important thing, so because just kind of calm everybody down. Big breath. It's okay. You know? the second most important thing is to understand across your organization ⁓ people are adopting AI, why they're adopting it, and what they're doing with it. because there's there's as I said, most companies, it was like basically this sort of big megaphone from the the C-suite, adopt, you know, and so it was like ⁓ it. Make us better. Now we're starting to see a little bit of the backup where some some companies are saying, Hey, stop adopting our token, you know, spend is way too high and there's Matthew Chiodi: We we missed earnings this quarter because of our token spend, right? Diana Kelley: Yeah, right, right. Yeah. Or like, you know, there's a lot I won't name names, but there's a lot of really big companies that are in the news now where they're like, yeah, we're actually hiring back all those people that we had let go because we need them. so there's a sort of there's there's that. So how do they adopt? And can help them in two that's gonna help you in two ways. One way is you're going to understand what the business is trying to do so that for number three, you're going to be much more set up. You're also going to, you can't manage what you can't see, you know, and you're going to understand how the company's trying to make money. The other really important thing of this step that there are people using AI for things that AI is not great for. It's it's non-deterministic, it's incredible for what it's incredible for. But a great example of what I mean by not great for is that when ⁓ the the leak came with Claude

Code and people were just shocked that that Claude itself was using regular expressions to do sentiment analysis before passing the prompt into the context window. And they're like, why would you use that? And it's like, because regular expressions for sentiment analysis, they knew what words they were looking for. We as human beings, when we're angry, we do scan it we go back to some real good, like, you know, reliable words. It's cheap and it's really accurate. So AI is not the answer for everything. So understand what they're doing so you know how the business wants to make money, but also you can help save the business some some time and effort. If you see people adopting AI for stuff it's just not cut out for, it's not the right use case. And then number three, now, so so now you're going back to the board with this is really what's happening, and you're helping them as an advisor understand and be be less overwhelmed. ⁓ you understand. How it's being used in the business and what it's being used for, and you can help optimize that. And then that goes to three, which is now you come back with a plan for the board of, okay, this is how we're using it. This is how we expect to make money. This is what it's best for. This is what we need to do to make sure it's reliable, it's resilient, and it's not going to expose us in a way that we don't ex, you know. that that's gonna put us at risk or get our data at risk. So then taking them to now you're in that security strategy space, but you've won them over with those first two steps because those are business advisory steps for them. Now take them to your your plan for the business. Matthew Chiodi: So if I heard you correctly, let me let me summarize that. So the first one is right now, doesn't matter where you are in the business, you are getting inundated with headlines around AI. It's gonna take your job, it's hack everything, whatever it might be, right? So number one is be the be the voice of reason, be the thought leader in terms of just understanding ⁓ what is. Again, we going back to what we talked about a couple minutes ago, right? It's not magic, it's math. So maybe just explaining people like just the basics. This is what it is. So getting people away from the hype, that's step one. immediately set you up as not only a thought leader, but the voice of reason in the company. That's the first thing you said. The second thing was understand the business is using AI and why they're trying use it. Because obviously, you know, if you're a thought leader kind of in the space, you're learning this, you might say, like, hey, how you're attempting to use this. There's likely better ways to do this that are less expensive, maybe faster. So that's the second thing. the third one then is those first two steps allow you then as a security leader to propose a sus a security strategy that's in lockstep with the business. That sounds brilliant. I mean, it sounds easy, but I know the the the doing of it, the implementation of it is always where it's it becomes difficult as well. Diana Kelley: Yeah. Yes. Yeah. Yeah. Although if you do it at least in that those steps, I think that's going to set you up the most for success because what I'm seeing a lot is and understand it is that the adoption has gone sort of out of control. And so companies are trying to get to to step three first, you know, CISOs are trying to get because they realize that they're and and it you really do need those first two steps in order to be able to, I think really be effective with with step three. But you're right. This is not yeah, it's really easy to go. One, two, three. It this is this is some big work that we've all got. Yeah. Matthew Chiodi: It's easy. But you know what it does come back to one one thing I love, you know, one of my favorite books of all time is the seven habits of highly effective people. And the first habit is begin with the end in mind. That's essentially just the three steps that you spoke about you you can't begin with the end in mind unless you understand what's at what actually AI is, how the business is using it. Then you can come up with a strategy that's tied to that, right? Beginning with the end in mind. So I love that. I love that. Diana Kelley: Yeah. Yeah. Yeah. Yeah. Matthew Chiodi: Well, Diana, you you are obviously very well informed when it comes to all things cyber and AI. The question I have for you is like, how do you stay sharp? What does your daily, weekly routine look like? Diana Kelley: Yeah, I do do I do have to set aside a lot of time to read the headlines, to additional research. I think the most important thing for anybody, certainly look at the headlines. That's one of the reasons that we're doing this thing, this live stream on Fridays, is that just trying to give people these were the the top the top notes of what were going on this week because I think everybody there's so much, but do your to stay ⁓ on top of but then most importantly. Matthew Chiodi: Mm. Diana Kelley: Go underneath it and really try and understand technically what's happening because the headlines are fast and furious and a lot of opinions, but always ask yourself, ⁓ I understand technically what happened? ⁓ you know, and and go back to you, keep doing research, keep all of us are are still in the learning phase. We're still learning. If not exactly how transformers work at this point, we're still learning how people are applying and using them in daily work. This is something that is is happening and transforming every day. don't be afraid to just get be in in in super learning mode right now because all of are I'm I'm know, people will say, ⁓ I listened to you, you know so much. I don't know half it. I don't even know a quarter of it, I don't know a tenth of it. You know, it's like I'm constantly, constantly learning more and more. So I think that's the most important is to really have a a a mindset of read the headlines, but ask actually ask yourself what's underneath those and how's that working and probably gonna need some to do to help you learn. I know I need to research every week, so Matthew Chiodi: Well, Diana, this has been a wonderful conversation. Thank you so much for just sharing the things that you've learned with us and for just kind of giving us a framework to think about a lot of these a lot of these items. Thanks for coming on the show. Diana Kelley: Thank you. Thanks so much.