WEBVTT
00:00:05.839 --> 00:00:09.119
Welcome to the Cybersecurity Podcast by C Council.
00:00:09.279 --> 00:00:11.679
I'm Jay Bavisi, your host.
00:00:11.919 --> 00:00:16.960
Every security operations center in the world today claims that their socks AI powered.
00:00:17.280 --> 00:00:26.239
My guest today is Jeremy Hale, the chief cybersecurity evangelist at Foresight Cybersecurity, where he leads the Google SACOps partnership.
00:00:26.480 --> 00:00:29.359
Ladies and gentlemen, please welcome Jeremy Hale.
00:00:29.600 --> 00:00:31.120
Jeremy, welcome to the show.
00:00:31.359 --> 00:00:31.920
Thank you, Jeremy.
00:00:32.159 --> 00:00:36.079
Let's start by talking about agenciai socks.
00:00:36.159 --> 00:00:36.479
Okay.
00:00:36.880 --> 00:00:43.840
Every vendor in the world or every MSSP that has a SOC claims that we're using AI.
00:00:44.079 --> 00:00:48.240
Because if they don't, then they are seen as the old school SOC, right?
00:00:48.719 --> 00:00:53.600
For our audience, let's start by talking about what is an agentic AI sock.
00:00:53.920 --> 00:00:54.159
Sure.
00:00:54.399 --> 00:01:02.159
I think there's a lot of promise in the possibility of fully autonomous security operations built using agents.
00:01:02.399 --> 00:01:15.680
And there are absolutely companies out there today that are automating components of that agentic SOC framework, but the impossible thing to get past is actually risk determination having a human in the loop.
00:01:16.319 --> 00:01:34.560
The complex thing about this is that while certain functions, investigation, triage, data aggregation, enrichment, correlation, things like that are all things that could be handled by agents pretty seamlessly, there has to be a qualifier or a risk determination made by someone or something at some point.
00:01:34.959 --> 00:01:38.000
And the representation of that risk is the difficult hurdle.
00:01:38.159 --> 00:01:41.920
I think that that, from an industry perspective, is the next great solve.
00:01:42.239 --> 00:01:49.760
Where within some limitation of deterministic or probabilistic uh statistics, an agent could make a decision like that.
00:01:49.920 --> 00:01:58.000
But the question I always ask customers who come to us and say that they want a fully autonomous SOC is who do we fire when something goes wrong?
00:01:58.480 --> 00:01:59.920
Do we just dismiss the agent?
00:02:00.079 --> 00:02:02.400
Do we just terminate our relationship with one another?
00:02:03.200 --> 00:02:10.080
But back to your question about vendors, I do think that uh most of the leading vendors are deploying agentic practices today, right?
00:02:10.159 --> 00:02:20.879
You have very large hyperscalers that are looking to consolidate and add time to value, time to detection, basically MTTX, mean time to do this thing, and enhancing that, right?
00:02:21.120 --> 00:02:38.240
I think the approach that we've taken at Foresight is a little a little different in the sense that we kind of view agentic deployments in the SOC as a uh an ability to hand our analysts tricorders and give the ability to like scan the rock, find out if it blows up if you throw it in water, and we're really expanding into other forays there.
00:02:38.560 --> 00:02:40.879
But I think that that's the next new wave, right?
00:02:41.039 --> 00:02:48.240
And and there's more that we could certainly talk about in like the shift in data and where data is aggregated and how agents will be used in the future there.
00:02:48.800 --> 00:02:54.240
So as far as MSSPs are concerned, I'm talking about across the world, not just in North America.
00:02:54.479 --> 00:02:54.800
Sure.
00:02:54.960 --> 00:03:00.639
Um most MSSPs would well, not most, but all MSSPs would use some sort of a sim, right?
00:03:00.800 --> 00:03:01.120
Yes.
00:03:01.360 --> 00:03:04.879
Uh some even in certain countries they use open source SIMs.
00:03:05.280 --> 00:03:06.800
And that's uh that's normal.
00:03:07.120 --> 00:03:13.840
Those that are using the premier vendors as a as a sim have got AI already in built.
00:03:14.159 --> 00:03:19.520
Why then is the work that Foresight is doing with uh Google important?
00:03:20.879 --> 00:03:23.759
Well, uh there's a couple of use cases there, right?
00:03:23.919 --> 00:03:30.319
There's an upcoming shift in the paradigm from where data exists today, and then more traditional use cases.
00:03:30.479 --> 00:03:36.960
So from a global perspective, you have data sovereignty, nation states, regulated industries.
00:03:37.120 --> 00:03:42.479
There's security protocols around the data, how it's generated, where it goes, who has access to it.
00:03:42.719 --> 00:03:54.639
The bacon of AI tools, specifically with Google's platforms being Vertex and Gemini, now even opening that up to Claude, to other frontier models so as to not impact workflows for customers.
00:03:54.960 --> 00:04:01.919
I think that the uh the reason that we're seeing a turn towards uh agentic is the old data problem, right?
00:04:02.080 --> 00:04:05.759
We are increasingly generating more and more and more telemetry.
00:04:06.080 --> 00:04:14.400
Foresight uh focuses on Vertex and Gemini specifically as models because they're so close to the portfolio of services that we offer, right?
00:04:14.479 --> 00:04:23.600
So these Google native tools and the services that we put around those as a wrapper see us building and specializing in that ecosystem and assisting customers with getting to security.
00:04:23.759 --> 00:04:34.319
I think that the paradigm shift that is coming up, though, is the ability for there to be a harness that supports, an AI harness that supports interaction with those models.
00:04:34.560 --> 00:04:39.680
The idea of a SIM may become something that is deprecated pretty rapidly here, right?
00:04:39.759 --> 00:04:47.120
The idea of needing to aggregate logs into a centralized plane and normalize those logs so that they can be put into fields.
00:04:47.199 --> 00:04:48.480
This is just mathematics, right?
00:04:48.560 --> 00:04:55.680
You take a log source, you put them into common vectors or fields, you then have correlation that takes place over detection logic.
00:04:55.920 --> 00:05:09.040
What we're probably going to see is a shift in the logs staying where they reside, essentially a hyperscaler like a Google or an Azure or an AWS, and then allowing the agents to synthesize that telemetry in a raw capacity where it resides.
00:05:09.279 --> 00:05:12.160
So the shift is a lot like cell phones in the 90s, Jay, right?
00:05:12.240 --> 00:05:16.959
It's like minutes become commoditized, this idea of text messages are no longer paid for.
00:05:17.120 --> 00:05:20.480
The data too will become commoditized and part of the assumption.
00:05:20.639 --> 00:05:25.680
And the agents and the token burn is what they will start billing for, and that shift of the cost model.
00:05:25.839 --> 00:05:28.160
But the technology has to support it, and we're not quite there yet.
00:05:28.319 --> 00:05:28.720
We're getting there.
00:05:29.040 --> 00:05:41.839
So does does Google's model also ingest foreign LLMs if they want to use if somebody was used Kimmy 2.6 or any others, uh it uses Claude, as you said.
00:05:41.920 --> 00:05:46.480
But is there a limitation to which models can be can be used?
00:05:46.639 --> 00:05:47.839
Or it can be any?
00:05:48.399 --> 00:05:48.639
Yeah.
00:05:49.120 --> 00:05:54.639
The data and access to that data is given through APIs and credentials, right?
00:05:54.720 --> 00:06:03.199
You're essentially viewing agents as these privileged users that get to go in and access that API and perform certain functions across that data set.
00:06:03.439 --> 00:06:14.800
Uh the answer is yes, simply, that you could wire basically anything into Google's platform, but there's a good amount of engineering, upkeep, maintenance, parsing that would need to take place to kind of build that out.
00:06:14.959 --> 00:06:22.079
But they purposefully, in very Google ways, make it so that it is open, accessible, and that you can build within those ecosystems.
00:06:22.560 --> 00:06:29.519
So when we talk about agentic AI, at least in SOX, we're seeing L1 jobs going away.
00:06:29.759 --> 00:06:30.000
Sure.
00:06:30.240 --> 00:06:31.759
And to what you have said, right?
00:06:31.920 --> 00:06:33.279
Agents are being taken over.
00:06:33.600 --> 00:06:37.279
But then there's a counter argument for human in the loop.
00:06:37.439 --> 00:06:37.759
Sure.
00:06:37.920 --> 00:06:45.360
But what we're seeing across the world is that more and more L1s are going away, and now it's L2, now L2 is going away, and left with an L3.
00:06:45.759 --> 00:06:47.680
So what's your take on this?
00:06:47.839 --> 00:06:49.199
Um two questions.
00:06:49.360 --> 00:06:55.439
One, is this a natural progression of the way the agentic technology is going to take over human jobs?
00:06:55.600 --> 00:07:00.480
And number two, how does the concept of human in the loop survive in an agentic AI socks?
00:07:00.800 --> 00:07:02.399
Again, I think it's about risk determination.
00:07:02.480 --> 00:07:04.959
And we haven't eliminated jobs, we've only grown.
00:07:05.120 --> 00:07:20.560
Uh the inclusion of agentic uh components to our SOC, so think triage, threat hunting analysis, has made our people more efficient and essentially 10, 15 times the workload, right?
00:07:20.959 --> 00:07:30.480
Because they're able to rapidly dismiss and evaluate false positives and reprioritize time towards learning and towards other more meaningful work, right?
00:07:30.560 --> 00:07:35.680
When we when we talk about an MSSP, the role in the MSSP is shifting in consultancy, you know.
00:07:36.079 --> 00:07:38.800
Uh I'm gonna bring this up because I think it's really relevant.
00:07:39.040 --> 00:07:47.360
But uh during the Industrial Revolution uh in France and in England, there was a significant shift towards machinery that was powered by coal.
00:07:47.600 --> 00:07:57.839
And there was an almost Luddite response to some of those machines in the textile factories in the late 1700s, early 1800s in France and England.
00:07:57.920 --> 00:08:01.920
And in fact, it it led to violence and uh some riots, right?
00:08:02.079 --> 00:08:22.720
Um there's this philosopher, uh it's called Javon's paradox, actually, where uh what ended up happening over time as the workers adopted the usage of the machine was that they become highly more productive, and then the demand from the business ownership increases in terms of the output.
00:08:22.879 --> 00:08:27.360
And I view agentic inclusion in the SOC as that very similar motion.
00:08:27.600 --> 00:08:35.360
There are only a handful of companies that promise fully autonomous SOC operations, but those are very focused and they're very narrow.
00:08:35.759 --> 00:08:46.080
Agents that are capable of arriving to a deterministic point and then enforcing an action have to be tested and simulated in a very rigorous way.
00:08:46.320 --> 00:08:57.600
Without clean data, you are experiencing hallucinations within those agents, and there is a risk that you assume in allowing that kind of control to take place without the human in the loop.
00:08:57.840 --> 00:09:04.480
So I don't know what the future holds if I did uh I'd be living on a beach somewhere, you know, you know what I mean?
00:09:04.799 --> 00:09:17.120
But that but the the idea of no longer needing consultancy or needing human control from a philosophical perspective on the outcome of a security posture is pretty unlikely in the next decade or so.
00:09:17.360 --> 00:09:21.600
I do see that L1s and L2 work, which is the drudge of the SOC.
00:09:21.840 --> 00:09:26.639
And I started my career a long time ago, red teaming banks, working in a SOC.
00:09:26.799 --> 00:09:28.080
That is a hard job.
00:09:28.240 --> 00:09:34.799
There is a very high level of burnout amongst those people when you're working in a queue and you're triaging alerts over and over and over again.
00:09:35.039 --> 00:09:54.720
When you have agentic capabilities that can essentially correlate all of those alerts into single cases that show patterns from a heuristics perspective, and then you start working in the boundary boxes of statistical analysis where there's prevalence or things that are just outside of the norm, those are the things that agents do really, really well.
00:09:54.960 --> 00:09:58.960
And those are the outcomes that we drive for customers when we're providing services to them.
00:09:59.360 --> 00:10:02.480
So agents compute human decides, pretty much.
00:10:02.960 --> 00:10:05.440
The risk determination is the major factor there, though.
00:10:05.600 --> 00:10:05.840
Yeah.
00:10:06.159 --> 00:10:09.840
However, this is a non-deterministic technology.
00:10:10.080 --> 00:10:22.159
And you and I both know, Jeremy, that when we do any form of a uh prompt or any form of a scan, you'll ask a question to a frontier model five times and you'll get five different answers.
00:10:22.879 --> 00:10:27.360
All five may be correct, but all five may not necessarily be the same.
00:10:27.600 --> 00:10:37.519
Now, in a SOC environment, because you're building a agentic AI SOC with Google, your engineering needs to consider that.
00:10:37.679 --> 00:10:48.480
How do you go about making sure that you're able to build an agentic SOC, which is a non-deterministic technology, but making sure that it doesn't do two things.
00:10:48.639 --> 00:10:52.000
One, hallucinate, and number two, gives you consistency.
00:10:52.399 --> 00:11:01.759
So that's again where a lot of I think a lot of the consultancy and and best practices and the measured approach to deployment of agents in the workflow.
00:11:02.000 --> 00:11:06.960
You don't start with very targeted use cases with agents first, right?
00:11:07.120 --> 00:11:15.039
So think data manipulation, access to APIs, the ability to do things at machine speeds that humans can't really do, right?
00:11:15.200 --> 00:11:23.600
There are already clear use cases where agents are far better at humans ever will be at mathematics, at synthesizing at running queries at code.
00:11:23.840 --> 00:11:27.039
But you have to start with capabilities and maturities.
00:11:27.120 --> 00:11:35.120
And this goes all the way back to nomenclature that Google invented probably a little over 20 years ago now, right, in the CMM matrix, CMM zero to five.
00:11:35.440 --> 00:11:41.679
And in a realistic conversation with clientele who are looking at MSSP, there's typically two reasons they approach us.
00:11:41.759 --> 00:11:50.799
One, they don't care how the sausage is made and they want their brand and stakeholders to be protected and they want to be able to grow the business and they don't plan on investing in security.
00:11:51.039 --> 00:11:57.519
Two, they need a little bit of enablement or training, they need an extension of the bench, so to speak, from a blue team perspective.
00:11:57.679 --> 00:12:06.320
Or three, we are the frontier experts in the Google security portfolio, and they're coming to us to understand that massive wall of knobs and levers, right?
00:12:06.639 --> 00:12:09.279
And so in that way, we're teaching people to fish.
00:12:09.440 --> 00:12:20.879
But it starts in all of those enterprise conversations, and I'll use that specifically because typically mid-market and SMB customers are not looking to build agentic frameworks that accomplish security use cases.
00:12:21.039 --> 00:12:27.200
It's an assumed component, as you had mentioned before, of the service that they're that we're providing them, right?
00:12:27.440 --> 00:12:32.799
But in an enterprise engagement, typically those customers have agentic use cases already.
00:12:32.960 --> 00:12:38.879
Most enterprises are wading into agents for the empowerment of their business to accomplish certain tasks.
00:12:39.039 --> 00:12:49.840
There's a very measured approach to understanding their layered controls and getting to a point where they can begin to consume some of the benefits of agentic frameworks or using agents in a security capacity at all.
00:12:50.080 --> 00:13:05.120
Generally, once data is normalized and we get to that point where things are like nice and clean, you know, and we can tell that the logs are flowing, normalization is taking place, we're at basically four nines in terms of normalization, then we'll start building agents into the automation playbooks.
00:13:05.200 --> 00:13:07.200
And that's really the evolution we're going to see.
00:13:07.440 --> 00:13:18.799
There's no difference really today between calling an agent and calling a cloud run function that would have been a piece of code that sat as Python and a playbook and an orchestration and automation layer.
00:13:18.960 --> 00:13:29.679
So when you call that swarm of agents to go do very prescriptive tasks, you're still just calling that piece of code that goes out and does something and provides the return that it's expecting you to want, right?
00:13:29.840 --> 00:13:35.279
And you're saying like you can ask five times, it'll give you five different answers, all of them maybe right or structured differently.
00:13:35.440 --> 00:13:38.399
It's trying to make sure that you're satisfied with the answer.
00:13:38.639 --> 00:13:52.960
But if you set up markdowns and guidelines and files and restrict the identity of the agent to only do very prescriptive things, as opposed to being all-encompassing or an advanced general intelligence, uh, those are the outcomes that customers are looking for.
00:13:53.120 --> 00:13:59.519
And it is a measured, tested, simulated kind of building block thing, much like building an automation playbook in a source.
00:14:00.000 --> 00:14:01.519
So let's talk of the industry a little bit.
00:14:02.000 --> 00:14:19.759
We've seen the industry uh sway left, where we say it fire all humans and buy all the tokens because agents will rule the world, and then we swerve right and we said fire all the tokens and hire all the humans because we're not getting the work done, and then we are kind of you know wobbling in the middle.
00:14:20.000 --> 00:14:31.120
As a MSSP in the US, and you're talking you're dealing with many customers, from your customer's perspective, how much of importance is there on governance that's been placed?
00:14:31.360 --> 00:14:33.759
Agentic or shall I say AI governance?
00:14:34.159 --> 00:14:34.799
That's a great question.
00:14:34.960 --> 00:14:42.639
I think that's the next real frontier of managed security service providers or active consultancy around security posture, right?
00:14:42.960 --> 00:14:49.519
In the US, 42,001 is the new guideline by which agents must be surveilled.
00:14:49.600 --> 00:15:01.360
And as federal entities, public sector entities begin to adopt some of these hyperscale platforms with agentic capabilities nested, there will have to be observability to what takes place in the span.
00:15:01.600 --> 00:15:18.960
And what I mean by that is if we are creating a fleet of agents that do prescriptive tasks with permissive access to the environment, we're going to have to have the ability to synthesize what behaviors or what communications are taking place between those agents as those communications take place.
00:15:19.120 --> 00:15:20.399
And there's difficulty in that.
00:15:20.559 --> 00:15:23.440
The aggregation of data across those agents.
00:15:23.840 --> 00:15:25.120
Where is the harness built?
00:15:25.200 --> 00:15:27.840
What kind of protocols and rules do we put in place?
00:15:28.080 --> 00:15:30.000
Part of that starts with the prompt.
00:15:30.159 --> 00:15:32.320
So now we're starting to get into intent.
00:15:32.720 --> 00:15:39.679
And this is kind of getting sci-fi stuff, but we start looking at patterns regarding the prompts, regarding what the agents are doing.
00:15:39.759 --> 00:15:43.519
There's a difference between an agent that sits there and does a prescriptive task.
00:15:44.080 --> 00:15:56.240
It says, okay, I see this detection, I'm going to go pull this information from Google Threat Intelligence and I'm going to provide a dossier on this hash or on this IP address or on this domain back to the human analyst.
00:15:56.480 --> 00:15:57.440
That's all I do.
00:15:57.840 --> 00:16:07.600
When we start allowing agents to quantify risk and call other tools, that governance and security around the agentix span is really the next wave.
00:16:07.840 --> 00:16:08.960
Wiz does it very well.
00:16:09.120 --> 00:16:23.679
They have a platform that they call Atlas that basically maps all of the agents, every model, whether it's homegrown, whether it's a frontier model in the environment, and it starts drawing lines between communication of those agents and the users that are accessing them.
00:16:23.919 --> 00:16:31.679
And we've got another partner called Safe AI, which is amazing in terms of the capabilities that they have in observability of the span.
00:16:31.759 --> 00:16:36.080
And they're very much on the forefront of introducing that security protocol.
00:16:36.159 --> 00:16:43.200
But it's the real challenge for most CISOs today, is like I'm being told I have to deploy AI, I am deploying AI, how do I secure this?
00:16:43.679 --> 00:16:49.919
So that response of yours would invite a one-hour conversation because there are so many things to unpack.
00:16:50.399 --> 00:16:50.559
Sure.
00:16:50.799 --> 00:16:56.639
So let me keep the uh ISO Ford 2001 and the NIST RMF, which you didn't mention, in one box.
00:16:56.720 --> 00:16:57.440
We'll come to that.
00:16:57.600 --> 00:16:57.840
Sure.
00:16:58.000 --> 00:17:01.279
Let's start talking about agentic intent first, right?
00:17:01.440 --> 00:17:01.600
Sure.
00:17:02.240 --> 00:17:02.960
I won't take that.
00:17:03.039 --> 00:17:04.880
And I want to break that into two parts.
00:17:05.200 --> 00:17:08.880
One, uh, you're right, there is observability of agents.
00:17:09.039 --> 00:17:13.039
The problem is the price is very prohibitive to a lot of customers.
00:17:13.359 --> 00:17:22.000
If we are looking at uh agentic observability across the world, and and let me preface this by describing the way I see the world.
00:17:22.079 --> 00:17:38.079
I see the world divided into three parts the top 5%, the Googles and the Salesforce and the Microsoft, who have all the resources and they have ISO 42001 and the VIS teams and red teams and pen test teams and cyber teams and clients of Foresight, consultants.
00:17:38.400 --> 00:17:44.799
And then you've got a far left who say that AI means Chat GPT or Cloud.
00:17:45.039 --> 00:17:46.240
We have two subscriptions.
00:17:46.319 --> 00:17:47.519
We are AI.
00:17:47.680 --> 00:17:58.160
And then the vast majority that sit in the middle who say, well, we understand AI is a lot more, but we don't really understand how am I going to adopt, how am I going to defend, and how am I going to govern AI.
00:17:58.240 --> 00:18:01.440
And that's the that's the large part of the organization.
00:18:01.759 --> 00:18:09.680
This mid-tier cannot afford uh, you know, tier one uh solutions and observability that might cost you a million dollars, for example.
00:18:09.920 --> 00:18:10.240
Sure.
00:18:10.400 --> 00:18:13.680
Um and and that causes a industry why.
00:18:13.759 --> 00:18:15.599
When I say industry, I'm talking of global industry.
00:18:15.759 --> 00:18:16.400
Industry Y.
00:18:16.559 --> 00:18:23.680
Think about a business in Hokkaido, Japan, and think about a business in Jordan, and think of a business in New Zealand, right?
00:18:23.759 --> 00:18:34.400
And they all have agentic uh abilities in the organization, but they don't have observability, and neither can they afford uh you know safe AI or a Wiz or any other vendor license.
00:18:34.480 --> 00:18:41.680
But that's a that's a problem that MSSPs need to solve because there are many mid-tier businesses that have to have to handle.
00:18:41.920 --> 00:18:44.640
So I wanted to preface that that scenario.
00:18:44.880 --> 00:18:46.240
Now comes my question.
00:18:46.480 --> 00:19:02.559
So knowing that that's the global problem right now, how do mid-sized businesses deal with intend drift, deal with conversations around blast radius, deal with conversations about agent-to-agent communication, right?
00:19:02.799 --> 00:19:13.039
Uh deal with transfer of governance that is inherent in one agent, and how does an agent uh transfer that when it communicates with another agent?
00:19:13.200 --> 00:19:18.400
There are so many layers to peel just by talking about the industry.
00:19:18.559 --> 00:19:18.720
Trevor Burrus, Jr.
00:19:18.880 --> 00:19:20.160
That's a big question.
00:19:20.480 --> 00:19:22.160
But uh I'll do my best.
00:19:23.599 --> 00:19:25.119
But you see where I'm going with, of course.
00:19:25.599 --> 00:19:25.920
Yeah, yeah.
00:19:26.000 --> 00:19:42.319
I think that there's a very interesting wave, and I'll start here, but there's a very interesting wave, and you've seen this, Jay, of this wave of AI startup companies that have this very niche use case, and they're using agents to do this very prescriptive thing to try to solve a problem in the industry.
00:19:42.400 --> 00:20:05.839
And this goes outside of security, but this is also very heavily occurring in security where you'll have a team of engineers that have built something that's very prescriptive, and then the next frontier model or the next update of something from one of the hyperscalers completely makes that entire business model and the company irrelevant because that functionality is built into the default platform of the hyperscale capability.
00:20:06.079 --> 00:20:15.440
And that I think also extrapolates cleanly into the need for quality partnerships in a team expansion perspective.
00:20:15.599 --> 00:20:33.839
And this will feel a little bit like a plug, but that's one of the promises that we bring to customers is not really the need to be able to consume all of that from a financial or technology perspective, but to know that the outcomes are being arrived to and that a lot of that governance and observability is provided through the active services and partnership.
00:20:34.000 --> 00:20:36.400
I think that that is the method with all things, right?
00:20:36.559 --> 00:20:40.720
Typically you look for consultants or you look for relationships that achieve those outcomes.
00:20:40.880 --> 00:20:46.160
And if you have a mandate that you're set upon by your business, think regulatory requirements.
00:20:46.400 --> 00:20:57.440
Typically there's consultancy or a Sherpa through the valley, if you will, that can help you arrive to that outcome and also provide you consumption of those techniques through an alternative or consolidated platform.
00:20:57.920 --> 00:21:06.880
How does Foresight deal with a development of human capability in an area where there is a massive platform shift?
00:21:07.039 --> 00:21:08.559
AI is one of those moments, right?
00:21:08.799 --> 00:21:17.759
Because I was talking to an analyst yesterday and I said to the analyst, I said, everything that we did in a deterministic world, we have to redo in a non-deterministic world.
00:21:17.839 --> 00:21:19.039
And I said, What do you mean by that?
00:21:19.119 --> 00:21:24.559
And I said, What I mean by that is we did red teaming in a in a deterministic world.
00:21:24.640 --> 00:21:27.599
We gotta do that again in a non-deterministic world, right?
00:21:27.839 --> 00:21:41.119
Observability, if you look at UEBA, there's something that you know that we used to do in a deterministic world, figuring out which human being is logging in at three o'clock in the morning in the office, downloading files, is exactly what we gotta do.
00:21:41.200 --> 00:21:44.000
That's observability in the AI world.
00:21:44.240 --> 00:21:56.480
So MSSPs across the world are gonna need to skill up and get the uh professionals that organizations are relying on to be able to guide organizations how to adopt defendant governance.
00:21:56.640 --> 00:21:59.759
So, what's the best practice in Foresight on how you are building?
00:22:00.319 --> 00:22:01.680
Talent within Foresight.
00:22:02.000 --> 00:22:04.559
I believe you're more than 140 professionals.
00:22:04.960 --> 00:22:05.440
148.
00:22:05.680 --> 00:22:12.640
Yeah, take us through the thought process of how are you keeping them up to speed with what's going on in the world so that they are able to help your clients.
00:22:13.039 --> 00:22:34.720
So I think this also goes back to a previous question about reducing drudge and creating a culture or an environment within our ecosystem where learning is encouraged, where the tools are accessible, where credentials are part of the status quo, where the idea of bettering oneself and our skill set has a an outcome on the propriety of the business, right?
00:22:34.880 --> 00:22:40.799
The ability for us to reflect ourselves as professionals is critical to building relationships.
00:22:41.359 --> 00:22:48.000
This is going to sound very cheesy, but we we really do view ourselves as like the defenders standing in the breach for our customers.
00:22:48.240 --> 00:22:55.279
We do not people who don't share that uh ideology don't typically last very long at Foresight, right?
00:22:55.440 --> 00:23:02.559
And it sounds that sounds ironfisted, but the truth is that our engineering teams comprise 90% of our total company, right?
00:23:02.640 --> 00:23:10.720
It's it's all developers, it's all security engineers, it's automation engineers, it's forward-deployed engineers, it's AI engineers.
00:23:10.880 --> 00:23:23.119
Uh they tend to collaborate, and we have a culture where people can like really raise their hands and come up with better ideas and propose and beta test things that improve services and improve security outcomes for our clientele.
00:23:23.359 --> 00:23:28.160
And I think that that's a reflection of how close we are to Google in their proximity as well.
00:23:28.319 --> 00:23:32.160
They run a very publisher-parish kind of mentality within Google, right?
00:23:32.240 --> 00:23:35.599
You essentially have to post a new thesis on an annual basis.
00:23:35.680 --> 00:23:37.759
And I think there's an expectation around that.
00:23:38.000 --> 00:23:50.559
How that gets to customers and readiness, there's not much in the way of viability for an MSSP that falls behind the curve from a technical perspective or isn't ready or aware that there's a wave or a change coming to the industry.
00:23:50.880 --> 00:23:56.640
Typically, those companies tend to peter out as well or start moving down market, right?
00:23:57.039 --> 00:24:10.000
Away from the enterprise, into the mid-market, into the SMB because they're providing an outcome or service to clientele that are looking for holistic security, but don't have the technical aptitudes or the desire to get into those platforms.
00:24:10.400 --> 00:24:15.680
The nature of the customers that we typically engage on the Google side tend to be very large enterprises.
00:24:15.839 --> 00:24:20.240
We have mid-market customers, we have SMB customers that consume the platform as well.
00:24:20.480 --> 00:24:29.519
But there's an amount of education that I think is required not only for the professionalism, but in order for us to be able to actually stand in the breach and accomplish the things that we're being asked to accomplish.
00:24:29.920 --> 00:24:30.400
Understand.
00:24:30.559 --> 00:24:32.720
Let's let's now open that box of governance.
00:24:33.200 --> 00:24:33.359
Sure.
00:24:33.680 --> 00:24:36.799
The the NIST RMF and ISO 42001.
00:24:36.960 --> 00:24:40.960
If I'm not wrong, ISO 42001 has 190 plus controls.
00:24:41.200 --> 00:24:41.519
It does.
00:24:41.680 --> 00:24:42.480
In in total.
00:24:42.720 --> 00:24:54.880
And we all know, uh Jeremy from ISO 27001, that uh uh having an ISO standard and living an ISO standard are two different parallel tracks of a of a railway track.
00:24:55.119 --> 00:24:55.440
Certainly.
00:24:55.599 --> 00:24:55.839
Right?
00:24:56.000 --> 00:25:04.160
Just because you have the ISO 42001 does not mean that you're operating one under the policies that you have uh committed to.
00:25:04.319 --> 00:25:06.480
And and that's a tall, tall order.
00:25:06.640 --> 00:25:11.119
It's not easy for any organization to actually implement ISO Fourier 2001.
00:25:11.279 --> 00:25:29.039
So, from your experience in working with various industries at Foresight, do you see uh more and more organizations needing to show their compliance of Foray 2001 because of regulatory requirements and yet see serious gaps in their day-to-day operations?
00:25:30.640 --> 00:25:38.880
And mostly that that has to do with so on the federal space, when you start getting into like IL-4, IL5, IL six, like classified data.
00:25:39.119 --> 00:25:39.279
Right.
00:25:39.599 --> 00:25:47.519
There's very little in the way of true agentic system adoption from uh parties that are not the government themselves.
00:25:47.599 --> 00:25:48.799
And I'm just referring to the U.S.
00:25:49.039 --> 00:25:49.279
Right.
00:25:49.440 --> 00:26:00.000
Uh we do a lot of work with the European Space Agency, and you have a conglomerate of tens of different countries, each with their own national security agencies, each with their own policies and mandates.
00:26:00.160 --> 00:26:03.440
Not much in the way of agentic adoption there either, right?
00:26:03.839 --> 00:26:22.000
Uh on the commercial side and the very large enterprise side, I would say that the vertical that is most governed and the ones that have the most significant gap and are really running to 42,001 in this framework around agentic security, compliance, is the healthcare and life sciences vertical, right?
00:26:22.240 --> 00:26:27.599
You have a tremendous amount of research that goes into some of these very large medical institutions.
00:26:27.920 --> 00:26:41.680
Some of that is privileged and governed data around patients, uh personally identifiable telemetry, uh, documentation around certain cases that may have been months or years as hospitals are working with certain patients.
00:26:41.920 --> 00:26:47.599
The only way to really achieve that kind of compliance on the front end is to go more cloud, right?
00:26:47.680 --> 00:26:51.839
You you cannot effectively we have models now that can be deployed on-prem.
00:26:52.079 --> 00:26:57.200
Google themselves now doing air-gapped or contained on-premises models that can be leveraged.
00:26:57.440 --> 00:27:14.079
But in order to really effectively do that, it starts with deployment of the telemetry into cloud, lifting away from physical data centers and physical endpoints to aggregate telemetry within a hyperscaler's environment to make it replicated, touched from multiple angles, et cetera.
00:27:14.240 --> 00:27:18.480
And then once that cloud architecture is deployed, the policies are native by default.
00:27:18.640 --> 00:27:21.839
And when agents are deployed, they're governed by default.
00:27:22.000 --> 00:27:30.400
And so it's essentially like onboarding to a net new sim or a net new SOAR and having a library of detection content that is already built.
00:27:30.559 --> 00:27:35.279
Uh it does require a little bit of a fundamental shift in the overall platform.
00:27:35.519 --> 00:27:46.240
I think the real gaps are some of the kind of, well, let's throw this against the wall and see if it sticks in terms of regulation, and there's a difficulty in enforcing some of those standards in these businesses.
00:27:46.319 --> 00:27:49.839
Aaron Powell And how do you intend to overcome these difficulties?
00:27:49.920 --> 00:27:54.720
Aaron Powell The conversation is around consolidation and compliance and observability through the platform itself.
00:27:54.880 --> 00:28:14.000
It should occur natively, and that's what I think the shift is really uh suggesting is what's taking place is getting agnostic about where the data resides, but the AI harness itself or the framework over those agents and governance, having defined policies that allow you to essentially enforce as if the agents were users.
00:28:14.160 --> 00:28:18.960
And that's the big next push is identification and privileged access across agentix forms.
00:28:19.279 --> 00:28:26.400
So identifying uh identification, privileged access is one, uh but temporal contacts is another completely.
00:28:26.799 --> 00:28:27.279
It is right?
00:28:27.440 --> 00:28:27.519
Yeah.
00:28:27.759 --> 00:28:32.960
I would not be surprised if many people that are listening to this podcast will have no clue what you and I are talking about.
00:28:33.119 --> 00:28:48.000
But which is why which is why I'm saying that there is an entire industry that's moving towards the the edge of where the industry is moving, understanding and determining agentic intent and intent drift and temporal contacts and blast radius.
00:28:48.079 --> 00:29:00.480
And there's an entire segment that's thinking that ChatGPT is AI, and then there's a middle layer that's being pressured by the bots to say implement AI now and show me as a cost saving.
00:29:00.720 --> 00:29:02.880
As a cost saving, which is not always the truth.
00:29:03.200 --> 00:29:07.759
Which many CEOs have done and then realize that oops, we forgot token cost is actually a thing.
00:29:08.000 --> 00:29:09.359
Are you still looking for a job?
00:29:09.519 --> 00:29:09.759
Right.
00:29:09.920 --> 00:29:10.160
Right?
00:29:10.480 --> 00:29:10.640
Right?
00:29:10.880 --> 00:29:18.240
So what I'm trying to say is that there is a to an MSSP like you and to a cybersecurity leader like me, this is common talk.
00:29:18.480 --> 00:29:25.759
But we have a duty as a as an industry to bring along the businesses where the actual civilization exists.
00:29:26.000 --> 00:29:26.160
Sure.
00:29:26.400 --> 00:29:28.880
These businesses that exist actually serve civilization.
00:29:29.119 --> 00:29:32.480
Our duty is to bring them along and make sure that they think through that.
00:29:32.640 --> 00:29:35.039
How do you think we can accomplish that as an industry?
00:29:35.359 --> 00:29:35.920
Consolidation.
00:29:36.799 --> 00:29:39.519
I was thinking there'll be no question where I'll make you pause.
00:29:40.319 --> 00:29:43.599
Well, consol consolidation, and and I do think that that's coming.
00:29:43.839 --> 00:29:45.359
2035, right around there.
00:29:45.759 --> 00:29:46.079
Explain to me.
00:29:46.400 --> 00:29:47.200
Let's talk in the next 10.
00:29:47.519 --> 00:29:48.559
What do you see as a consolidation?
00:29:48.799 --> 00:30:13.119
I think the hyperscalers were c will continue to consume companies and technologies and types of technologies and use their megalithic resources at their disposal in order to consolidate and make it more democratic for businesses of all size to fire up, use these tools, and uh operationalize from a centralized platform.
00:30:13.359 --> 00:30:27.200
I think the Israeli startups will continue to be highly disruptive, but I think Google, Microsoft, AWS, CrowdStrike, Oracle to some extent, probably Cisco still kind of banging around, Palo, but there will be further and further consolidation.
00:30:27.279 --> 00:30:31.920
I think that that's going to be rapidly increased as we continue to move down this pathway towards the Trevor Burrus.
00:30:32.079 --> 00:30:33.839
What will happen to the startup ecosystem?
00:30:34.319 --> 00:30:41.519
I think the startup ecosystem will uh continue to flourish, but I believe acquisition values will drop.
00:30:41.680 --> 00:30:44.960
I don't know that there will be significant I'm just postulating here.
00:30:45.039 --> 00:30:48.640
I don't I don't want to sound crazy or anything, but I actually do think acquisition values will drop.
00:30:48.720 --> 00:30:54.799
Aaron Powell Yeah, because wipe coding is is democratizing the ability of anyone to dream up.
00:30:55.039 --> 00:31:03.200
In fact, now I can even do uh agentic AI novel research using a frontier model that's prompted well.
00:31:03.359 --> 00:31:03.519
Yeah.
00:31:03.759 --> 00:31:10.319
So therefore the value of uh of a platform, it's it's uh I wouldn't say gone, but it's diminished significantly.
00:31:10.720 --> 00:31:13.279
I think the Chinese are catching up to the Americans very rapidly.
00:31:13.440 --> 00:31:17.519
I think the Indians are catching up very, very rapidly to American models as well.
00:31:17.759 --> 00:31:24.000
I think India and China represent a significant impact to security globally over the course of the next 20 years or so.
00:31:24.240 --> 00:31:28.240
I'm hoping that that stays fairly friendly and in the way some of that is going.
00:31:28.400 --> 00:31:31.440
Historically, it hasn't always been rainbow and sunshine, right?
00:31:31.680 --> 00:31:35.519
Uh but I am an optimist about the future of AI.
00:31:35.680 --> 00:31:49.920
I'm also a realist about implications in the way it can be used because I do it every day in practice and I see customers trying to deploy it, and we don't get swept up in the marchite of there being this magical robot in the sky that's going to fix all of our security problems.
00:31:50.079 --> 00:31:54.319
I believe Mythos is the greatest sales tool ever created.
00:31:54.480 --> 00:32:01.680
It has produced such a huge wave of concerns regarding these boogeyman vulnerabilities out there.
00:32:01.839 --> 00:32:31.119
But in practice and in seeing it deployed, uh, it's real and it's capable of discovering vulnerabilities, zero days, attack pathways that absolutely need to be mended, but that creates a business opportunity within the hyperscaler that's deploying a tool like that to create something like a code mender at Google, to lean forward with agentic threat defense, to put people in this toGAF methodology where we're recursively testing and iterating on the improvements.
00:32:31.359 --> 00:32:36.799
None of that changes in the historical security philosophy of working with an enterprise or cybersecurity.
00:32:36.960 --> 00:32:42.640
It's about identifying attack pathways, shoring them up, testing them, finding new attack pathways.
00:32:42.880 --> 00:32:47.039
We're never really more than 99% of the way there, Jay, right, with any customer.
00:32:47.119 --> 00:32:48.960
It's not like we just wipe our hands and we walk away.
00:32:49.119 --> 00:32:51.839
There's always something new, some change that's going to happen.
00:32:52.000 --> 00:33:07.759
But to go back to your original question about how do we bring that middle segment forward, I think you have to make it more open, more accessible, and continue to consolidate functionality into something that has a predictable cost model, which is something we've kind of brushed around a little bit.
00:33:07.839 --> 00:33:11.839
But tokenization right now and agentic utilization is not predictable.
00:33:12.000 --> 00:33:12.559
It's not.
00:33:12.720 --> 00:33:21.119
We've had accidental$250,000 queries we've run where we had to ask for forgiveness for some of those because we were doing some iterative testing.
00:33:22.640 --> 00:33:23.200
Yes, absolutely.
00:33:26.160 --> 00:33:27.279
They would have said pay, right?
00:33:27.680 --> 00:33:34.720
You know, we don't that predictability, I think, is what makes it so more customers can lean into it.
00:33:34.960 --> 00:33:38.480
The way that they've entered into the market was brilliant.
00:33:38.799 --> 00:33:46.640
They have created infrastructure, they began getting Sentinel and Google security operations and Splunk out into the market.
00:33:46.799 --> 00:33:56.640
They started creating agentic functionality and including those aspects into the platform free of charge and free to use, and are now shifting to a token burn model.
00:33:56.799 --> 00:34:03.599
And that goes back to the data becoming, I think, commoditized, the idea of data just residing where it resides.
00:34:04.079 --> 00:34:05.519
You're a technologist, you know this.
00:34:05.680 --> 00:34:14.400
Keeping data in BigQuery, in BigQuery, is far cheaper than keeping that telemetry hot in a separate platform like a sim, right?
00:34:14.480 --> 00:34:14.639
Right.
00:34:14.960 --> 00:34:26.559
And if a model can reach out or an agent can reach out to that telemetry and synthesize at machine speeds and pull back context, then the cost transference goes to all of these data centers we're building in Texas.
00:34:26.719 --> 00:34:30.320
All of this massive growth around these frontier models.
00:34:30.400 --> 00:34:32.400
Uh, and that's the next big shift, I think.
00:34:32.960 --> 00:34:34.559
So, Jeremy, we are almost out of time.
00:34:34.639 --> 00:34:35.599
I want to ask you a question about.
00:34:36.000 --> 00:34:43.199
You you have helped countless enterprises implement cybersecurity solutions, especially in the AI era.
00:34:43.760 --> 00:34:44.639
What stands out?
00:34:44.800 --> 00:34:58.559
What is normally the largest problem that, in in your opinion, is the largest problem in in bringing an organization from a traditional security culture to an AI era culture?
00:34:58.960 --> 00:34:59.920
That's a great question.
00:35:00.239 --> 00:35:04.079
Because I I think that and there's a lot of different answers to it though, Jay.
00:35:04.159 --> 00:35:04.400
Right?
00:35:04.480 --> 00:35:06.239
Like the uh some of it is financial.
00:35:06.400 --> 00:35:26.719
The biggest barrier for some customers is a lack of transparency on the financial implications, which is very good for my business in terms of what we do from an MSSP perspective, because we are spending our resources to build those outcomes, to provide those outcomes, to give that agentic framework to customers.
00:35:26.960 --> 00:35:29.599
Sometimes I think it's education and training and enablement.
00:35:29.760 --> 00:35:37.039
I I don't always believe that there's a clear understanding of what that outcome or what that goal of utilization of AI is.
00:35:37.199 --> 00:35:39.760
If it's security, we can educate on that very cleanly.
00:35:39.840 --> 00:35:42.000
Here's how we use it, here's what we would recommend.
00:35:42.159 --> 00:35:46.320
If you have separate teams that are looking to do other things, let us help you build that.
00:35:46.480 --> 00:35:56.800
I think that there's also, although people don't really talk about this, uh, a reservation to uh kind of giving over some of that responsibility, hesitation around that, right?
00:35:56.960 --> 00:36:06.559
You have people that have built careers or practices around their security posture for the last 10 years that there is no pain now, so why would we introduce new pain to some of them?
00:36:06.800 --> 00:36:07.039
Right.
00:36:07.280 --> 00:36:15.280
And that shift is always part of the trust motion, the conversation with those clientele and getting them to see a better path forward or a better way forward.
00:36:15.519 --> 00:36:18.239
And there are those that will never make the shift, right?
00:36:18.480 --> 00:36:24.159
Where there are requirements that keep them where they're at, even though they may be using agentic frameworks in other ways.
00:36:24.480 --> 00:36:24.639
Right.
00:36:24.880 --> 00:36:25.840
Right, fantastic.
00:36:26.000 --> 00:36:26.960
One final question.
00:36:27.119 --> 00:36:34.480
As a cybersecurity professional, what is the one thing that keeps you up awake at night at the industry that we are in?
00:36:35.599 --> 00:36:40.400
Um I do think machine speed attacks are going to accelerate.
00:36:40.880 --> 00:36:42.960
Uh they are absolutely accelerating.
00:36:43.599 --> 00:37:13.199
Some of the frontier model capabilities around vulnerability and zero days, everybody's vibe coding, yes, but when models are explicitly designed to break software and to create new attacks, if we start approaching what Kurzweil called the singularity in terms of advanced general intelligence, if cryptography is cracked and we have to start rolling cryptography to at machine speeds to compensate for the cracking of cryptography.
00:37:13.519 --> 00:37:14.079
BQC.
00:37:14.400 --> 00:37:19.039
Yes, that's the stuff, that's the thing that we're like, I will finally just find a beach.
00:37:19.360 --> 00:37:32.159
Yeah, you know, my my fear is that I I think I mean with whatever we're seeing with front-end models now, I think the cracks in the dam of AI is beginning to be seen because encryption, there are already clear cracks coming.
00:37:32.400 --> 00:37:32.480
Yes.
00:37:32.800 --> 00:37:38.159
And my fear is one fine day, the dam breaks, and we're not ready for a PQC world.
00:37:38.719 --> 00:37:44.400
I think that uh, you know, things like blockchain, financial systems, energy grids, right?
00:37:44.480 --> 00:37:51.599
There's a lot of downstream implications that may not exactly be intentional by that discovery that that happen.
00:37:51.920 --> 00:37:56.320
And uh, you know, not to be apocalyptic, but that those are the terrifying things.
00:37:56.480 --> 00:37:56.639
Right.
00:37:56.880 --> 00:38:03.760
Because there's nothing we could do as an MSSP or a security practitioner to reset global cryptography, right?
00:38:03.920 --> 00:38:11.440
To reset the keys that we hold dear uh in order for us to maintain those chains of custody, privacy, and command over those systems.
00:38:11.679 --> 00:38:11.760
Right.
00:38:11.840 --> 00:38:12.000
Yeah.
00:38:12.320 --> 00:38:17.360
Jeremy, it's been a pleasure talking to you and thank you for being part of the cybersecurity podcast by IC Council.
00:38:17.599 --> 00:38:17.920
Thank you.
00:38:18.079 --> 00:38:23.599
That was Jeremy Hale, the chief cybersecurity evangelist at Foresight Cybersecurity.
00:38:23.760 --> 00:38:32.239
One thing that's very clear in the conversation is that the idea of agentix sock is not just in the labs, it's already in production.
00:38:32.719 --> 00:38:37.599
If you like the conversation, we'll appreciate you sharing this on your social media.
00:38:37.840 --> 00:38:47.280
We'll also like it if you share this conversation with the one person in cybersecurity that you think can actually benefit from listening to this deep conversation.
00:38:47.679 --> 00:38:57.119
Until I bring you other movers and shakers of the cybersecurity industry, this is Jay Bavisi checking out from AC Council's Cybersecurity Podcast.
00:38:57.360 --> 00:38:58.400
Good night.
00:00:05.839 --> 00:00:09.119
Welcome to the Cybersecurity Podcast by C Council.
00:00:09.279 --> 00:00:11.679
I'm Jay Bavisi, your host.
00:00:11.919 --> 00:00:16.960
Every security operations center in the world today claims that their socks AI powered.
00:00:17.280 --> 00:00:26.239
My guest today is Jeremy Hale, the chief cybersecurity evangelist at Foresight Cybersecurity, where he leads the Google SACOps partnership.
00:00:26.480 --> 00:00:29.359
Ladies and gentlemen, please welcome Jeremy Hale.
00:00:29.600 --> 00:00:31.120
Jeremy, welcome to the show.
00:00:31.359 --> 00:00:31.920
Thank you, Jeremy.
00:00:32.159 --> 00:00:36.079
Let's start by talking about agenciai socks.
00:00:36.159 --> 00:00:36.479
Okay.
00:00:36.880 --> 00:00:43.840
Every vendor in the world or every MSSP that has a SOC claims that we're using AI.
00:00:44.079 --> 00:00:48.240
Because if they don't, then they are seen as the old school SOC, right?
00:00:48.719 --> 00:00:53.600
For our audience, let's start by talking about what is an agentic AI sock.
00:00:53.920 --> 00:00:54.159
Sure.
00:00:54.399 --> 00:01:02.159
I think there's a lot of promise in the possibility of fully autonomous security operations built using agents.
00:01:02.399 --> 00:01:15.680
And there are absolutely companies out there today that are automating components of that agentic SOC framework, but the impossible thing to get past is actually risk determination having a human in the loop.
00:01:16.319 --> 00:01:34.560
The complex thing about this is that while certain functions, investigation, triage, data aggregation, enrichment, correlation, things like that are all things that could be handled by agents pretty seamlessly, there has to be a qualifier or a risk determination made by someone or something at some point.
00:01:34.959 --> 00:01:38.000
And the representation of that risk is the difficult hurdle.
00:01:38.159 --> 00:01:41.920
I think that that, from an industry perspective, is the next great solve.
00:01:42.239 --> 00:01:49.760
Where within some limitation of deterministic or probabilistic uh statistics, an agent could make a decision like that.
00:01:49.920 --> 00:01:58.000
But the question I always ask customers who come to us and say that they want a fully autonomous SOC is who do we fire when something goes wrong?
00:01:58.480 --> 00:01:59.920
Do we just dismiss the agent?
00:02:00.079 --> 00:02:02.400
Do we just terminate our relationship with one another?
00:02:03.200 --> 00:02:10.080
But back to your question about vendors, I do think that uh most of the leading vendors are deploying agentic practices today, right?
00:02:10.159 --> 00:02:20.879
You have very large hyperscalers that are looking to consolidate and add time to value, time to detection, basically MTTX, mean time to do this thing, and enhancing that, right?
00:02:21.120 --> 00:02:38.240
I think the approach that we've taken at Foresight is a little a little different in the sense that we kind of view agentic deployments in the SOC as a uh an ability to hand our analysts tricorders and give the ability to like scan the rock, find out if it blows up if you throw it in water, and we're really expanding into other forays there.
00:02:38.560 --> 00:02:40.879
But I think that that's the next new wave, right?
00:02:41.039 --> 00:02:48.240
And and there's more that we could certainly talk about in like the shift in data and where data is aggregated and how agents will be used in the future there.
00:02:48.800 --> 00:02:54.240
So as far as MSSPs are concerned, I'm talking about across the world, not just in North America.
00:02:54.479 --> 00:02:54.800
Sure.
00:02:54.960 --> 00:03:00.639
Um most MSSPs would well, not most, but all MSSPs would use some sort of a sim, right?
00:03:00.800 --> 00:03:01.120
Yes.
00:03:01.360 --> 00:03:04.879
Uh some even in certain countries they use open source SIMs.
00:03:05.280 --> 00:03:06.800
And that's uh that's normal.
00:03:07.120 --> 00:03:13.840
Those that are using the premier vendors as a as a sim have got AI already in built.
00:03:14.159 --> 00:03:19.520
Why then is the work that Foresight is doing with uh Google important?
00:03:20.879 --> 00:03:23.759
Well, uh there's a couple of use cases there, right?
00:03:23.919 --> 00:03:30.319
There's an upcoming shift in the paradigm from where data exists today, and then more traditional use cases.
00:03:30.479 --> 00:03:36.960
So from a global perspective, you have data sovereignty, nation states, regulated industries.
00:03:37.120 --> 00:03:42.479
There's security protocols around the data, how it's generated, where it goes, who has access to it.
00:03:42.719 --> 00:03:54.639
The bacon of AI tools, specifically with Google's platforms being Vertex and Gemini, now even opening that up to Claude, to other frontier models so as to not impact workflows for customers.
00:03:54.960 --> 00:04:01.919
I think that the uh the reason that we're seeing a turn towards uh agentic is the old data problem, right?
00:04:02.080 --> 00:04:05.759
We are increasingly generating more and more and more telemetry.
00:04:06.080 --> 00:04:14.400
Foresight uh focuses on Vertex and Gemini specifically as models because they're so close to the portfolio of services that we offer, right?
00:04:14.479 --> 00:04:23.600
So these Google native tools and the services that we put around those as a wrapper see us building and specializing in that ecosystem and assisting customers with getting to security.
00:04:23.759 --> 00:04:34.319
I think that the paradigm shift that is coming up, though, is the ability for there to be a harness that supports, an AI harness that supports interaction with those models.
00:04:34.560 --> 00:04:39.680
The idea of a SIM may become something that is deprecated pretty rapidly here, right?
00:04:39.759 --> 00:04:47.120
The idea of needing to aggregate logs into a centralized plane and normalize those logs so that they can be put into fields.
00:04:47.199 --> 00:04:48.480
This is just mathematics, right?
00:04:48.560 --> 00:04:55.680
You take a log source, you put them into common vectors or fields, you then have correlation that takes place over detection logic.
00:04:55.920 --> 00:05:09.040
What we're probably going to see is a shift in the logs staying where they reside, essentially a hyperscaler like a Google or an Azure or an AWS, and then allowing the agents to synthesize that telemetry in a raw capacity where it resides.
00:05:09.279 --> 00:05:12.160
So the shift is a lot like cell phones in the 90s, Jay, right?
00:05:12.240 --> 00:05:16.959
It's like minutes become commoditized, this idea of text messages are no longer paid for.
00:05:17.120 --> 00:05:20.480
The data too will become commoditized and part of the assumption.
00:05:20.639 --> 00:05:25.680
And the agents and the token burn is what they will start billing for, and that shift of the cost model.
00:05:25.839 --> 00:05:28.160
But the technology has to support it, and we're not quite there yet.
00:05:28.319 --> 00:05:28.720
We're getting there.
00:05:29.040 --> 00:05:41.839
So does does Google's model also ingest foreign LLMs if they want to use if somebody was used Kimmy 2.6 or any others, uh it uses Claude, as you said.
00:05:41.920 --> 00:05:46.480
But is there a limitation to which models can be can be used?
00:05:46.639 --> 00:05:47.839
Or it can be any?
00:05:48.399 --> 00:05:48.639
Yeah.
00:05:49.120 --> 00:05:54.639
The data and access to that data is given through APIs and credentials, right?
00:05:54.720 --> 00:06:03.199
You're essentially viewing agents as these privileged users that get to go in and access that API and perform certain functions across that data set.
00:06:03.439 --> 00:06:14.800
Uh the answer is yes, simply, that you could wire basically anything into Google's platform, but there's a good amount of engineering, upkeep, maintenance, parsing that would need to take place to kind of build that out.
00:06:14.959 --> 00:06:22.079
But they purposefully, in very Google ways, make it so that it is open, accessible, and that you can build within those ecosystems.
00:06:22.560 --> 00:06:29.519
So when we talk about agentic AI, at least in SOX, we're seeing L1 jobs going away.
00:06:29.759 --> 00:06:30.000
Sure.
00:06:30.240 --> 00:06:31.759
And to what you have said, right?
00:06:31.920 --> 00:06:33.279
Agents are being taken over.
00:06:33.600 --> 00:06:37.279
But then there's a counter argument for human in the loop.
00:06:37.439 --> 00:06:37.759
Sure.
00:06:37.920 --> 00:06:45.360
But what we're seeing across the world is that more and more L1s are going away, and now it's L2, now L2 is going away, and left with an L3.
00:06:45.759 --> 00:06:47.680
So what's your take on this?
00:06:47.839 --> 00:06:49.199
Um two questions.
00:06:49.360 --> 00:06:55.439
One, is this a natural progression of the way the agentic technology is going to take over human jobs?
00:06:55.600 --> 00:07:00.480
And number two, how does the concept of human in the loop survive in an agentic AI socks?
00:07:00.800 --> 00:07:02.399
Again, I think it's about risk determination.
00:07:02.480 --> 00:07:04.959
And we haven't eliminated jobs, we've only grown.
00:07:05.120 --> 00:07:20.560
Uh the inclusion of agentic uh components to our SOC, so think triage, threat hunting analysis, has made our people more efficient and essentially 10, 15 times the workload, right?
00:07:20.959 --> 00:07:30.480
Because they're able to rapidly dismiss and evaluate false positives and reprioritize time towards learning and towards other more meaningful work, right?
00:07:30.560 --> 00:07:35.680
When we when we talk about an MSSP, the role in the MSSP is shifting in consultancy, you know.
00:07:36.079 --> 00:07:38.800
Uh I'm gonna bring this up because I think it's really relevant.
00:07:39.040 --> 00:07:47.360
But uh during the Industrial Revolution uh in France and in England, there was a significant shift towards machinery that was powered by coal.
00:07:47.600 --> 00:07:57.839
And there was an almost Luddite response to some of those machines in the textile factories in the late 1700s, early 1800s in France and England.
00:07:57.920 --> 00:08:01.920
And in fact, it it led to violence and uh some riots, right?
00:08:02.079 --> 00:08:22.720
Um there's this philosopher, uh it's called Javon's paradox, actually, where uh what ended up happening over time as the workers adopted the usage of the machine was that they become highly more productive, and then the demand from the business ownership increases in terms of the output.
00:08:22.879 --> 00:08:27.360
And I view agentic inclusion in the SOC as that very similar motion.
00:08:27.600 --> 00:08:35.360
There are only a handful of companies that promise fully autonomous SOC operations, but those are very focused and they're very narrow.
00:08:35.759 --> 00:08:46.080
Agents that are capable of arriving to a deterministic point and then enforcing an action have to be tested and simulated in a very rigorous way.
00:08:46.320 --> 00:08:57.600
Without clean data, you are experiencing hallucinations within those agents, and there is a risk that you assume in allowing that kind of control to take place without the human in the loop.
00:08:57.840 --> 00:09:04.480
So I don't know what the future holds if I did uh I'd be living on a beach somewhere, you know, you know what I mean?
00:09:04.799 --> 00:09:17.120
But that but the the idea of no longer needing consultancy or needing human control from a philosophical perspective on the outcome of a security posture is pretty unlikely in the next decade or so.
00:09:17.360 --> 00:09:21.600
I do see that L1s and L2 work, which is the drudge of the SOC.
00:09:21.840 --> 00:09:26.639
And I started my career a long time ago, red teaming banks, working in a SOC.
00:09:26.799 --> 00:09:28.080
That is a hard job.
00:09:28.240 --> 00:09:34.799
There is a very high level of burnout amongst those people when you're working in a queue and you're triaging alerts over and over and over again.
00:09:35.039 --> 00:09:54.720
When you have agentic capabilities that can essentially correlate all of those alerts into single cases that show patterns from a heuristics perspective, and then you start working in the boundary boxes of statistical analysis where there's prevalence or things that are just outside of the norm, those are the things that agents do really, really well.
00:09:54.960 --> 00:09:58.960
And those are the outcomes that we drive for customers when we're providing services to them.
00:09:59.360 --> 00:10:02.480
So agents compute human decides, pretty much.
00:10:02.960 --> 00:10:05.440
The risk determination is the major factor there, though.
00:10:05.600 --> 00:10:05.840
Yeah.
00:10:06.159 --> 00:10:09.840
However, this is a non-deterministic technology.
00:10:10.080 --> 00:10:22.159
And you and I both know, Jeremy, that when we do any form of a uh prompt or any form of a scan, you'll ask a question to a frontier model five times and you'll get five different answers.
00:10:22.879 --> 00:10:27.360
All five may be correct, but all five may not necessarily be the same.
00:10:27.600 --> 00:10:37.519
Now, in a SOC environment, because you're building a agentic AI SOC with Google, your engineering needs to consider that.
00:10:37.679 --> 00:10:48.480
How do you go about making sure that you're able to build an agentic SOC, which is a non-deterministic technology, but making sure that it doesn't do two things.
00:10:48.639 --> 00:10:52.000
One, hallucinate, and number two, gives you consistency.
00:10:52.399 --> 00:11:01.759
So that's again where a lot of I think a lot of the consultancy and and best practices and the measured approach to deployment of agents in the workflow.
00:11:02.000 --> 00:11:06.960
You don't start with very targeted use cases with agents first, right?
00:11:07.120 --> 00:11:15.039
So think data manipulation, access to APIs, the ability to do things at machine speeds that humans can't really do, right?
00:11:15.200 --> 00:11:23.600
There are already clear use cases where agents are far better at humans ever will be at mathematics, at synthesizing at running queries at code.
00:11:23.840 --> 00:11:27.039
But you have to start with capabilities and maturities.
00:11:27.120 --> 00:11:35.120
And this goes all the way back to nomenclature that Google invented probably a little over 20 years ago now, right, in the CMM matrix, CMM zero to five.
00:11:35.440 --> 00:11:41.679
And in a realistic conversation with clientele who are looking at MSSP, there's typically two reasons they approach us.
00:11:41.759 --> 00:11:50.799
One, they don't care how the sausage is made and they want their brand and stakeholders to be protected and they want to be able to grow the business and they don't plan on investing in security.
00:11:51.039 --> 00:11:57.519
Two, they need a little bit of enablement or training, they need an extension of the bench, so to speak, from a blue team perspective.
00:11:57.679 --> 00:12:06.320
Or three, we are the frontier experts in the Google security portfolio, and they're coming to us to understand that massive wall of knobs and levers, right?
00:12:06.639 --> 00:12:09.279
And so in that way, we're teaching people to fish.
00:12:09.440 --> 00:12:20.879
But it starts in all of those enterprise conversations, and I'll use that specifically because typically mid-market and SMB customers are not looking to build agentic frameworks that accomplish security use cases.
00:12:21.039 --> 00:12:27.200
It's an assumed component, as you had mentioned before, of the service that they're that we're providing them, right?
00:12:27.440 --> 00:12:32.799
But in an enterprise engagement, typically those customers have agentic use cases already.
00:12:32.960 --> 00:12:38.879
Most enterprises are wading into agents for the empowerment of their business to accomplish certain tasks.
00:12:39.039 --> 00:12:49.840
There's a very measured approach to understanding their layered controls and getting to a point where they can begin to consume some of the benefits of agentic frameworks or using agents in a security capacity at all.
00:12:50.080 --> 00:13:05.120
Generally, once data is normalized and we get to that point where things are like nice and clean, you know, and we can tell that the logs are flowing, normalization is taking place, we're at basically four nines in terms of normalization, then we'll start building agents into the automation playbooks.
00:13:05.200 --> 00:13:07.200
And that's really the evolution we're going to see.
00:13:07.440 --> 00:13:18.799
There's no difference really today between calling an agent and calling a cloud run function that would have been a piece of code that sat as Python and a playbook and an orchestration and automation layer.
00:13:18.960 --> 00:13:29.679
So when you call that swarm of agents to go do very prescriptive tasks, you're still just calling that piece of code that goes out and does something and provides the return that it's expecting you to want, right?
00:13:29.840 --> 00:13:35.279
And you're saying like you can ask five times, it'll give you five different answers, all of them maybe right or structured differently.
00:13:35.440 --> 00:13:38.399
It's trying to make sure that you're satisfied with the answer.
00:13:38.639 --> 00:13:52.960
But if you set up markdowns and guidelines and files and restrict the identity of the agent to only do very prescriptive things, as opposed to being all-encompassing or an advanced general intelligence, uh, those are the outcomes that customers are looking for.
00:13:53.120 --> 00:13:59.519
And it is a measured, tested, simulated kind of building block thing, much like building an automation playbook in a source.
00:14:00.000 --> 00:14:01.519
So let's talk of the industry a little bit.
00:14:02.000 --> 00:14:19.759
We've seen the industry uh sway left, where we say it fire all humans and buy all the tokens because agents will rule the world, and then we swerve right and we said fire all the tokens and hire all the humans because we're not getting the work done, and then we are kind of you know wobbling in the middle.
00:14:20.000 --> 00:14:31.120
As a MSSP in the US, and you're talking you're dealing with many customers, from your customer's perspective, how much of importance is there on governance that's been placed?
00:14:31.360 --> 00:14:33.759
Agentic or shall I say AI governance?
00:14:34.159 --> 00:14:34.799
That's a great question.
00:14:34.960 --> 00:14:42.639
I think that's the next real frontier of managed security service providers or active consultancy around security posture, right?
00:14:42.960 --> 00:14:49.519
In the US, 42,001 is the new guideline by which agents must be surveilled.
00:14:49.600 --> 00:15:01.360
And as federal entities, public sector entities begin to adopt some of these hyperscale platforms with agentic capabilities nested, there will have to be observability to what takes place in the span.
00:15:01.600 --> 00:15:18.960
And what I mean by that is if we are creating a fleet of agents that do prescriptive tasks with permissive access to the environment, we're going to have to have the ability to synthesize what behaviors or what communications are taking place between those agents as those communications take place.
00:15:19.120 --> 00:15:20.399
And there's difficulty in that.
00:15:20.559 --> 00:15:23.440
The aggregation of data across those agents.
00:15:23.840 --> 00:15:25.120
Where is the harness built?
00:15:25.200 --> 00:15:27.840
What kind of protocols and rules do we put in place?
00:15:28.080 --> 00:15:30.000
Part of that starts with the prompt.
00:15:30.159 --> 00:15:32.320
So now we're starting to get into intent.
00:15:32.720 --> 00:15:39.679
And this is kind of getting sci-fi stuff, but we start looking at patterns regarding the prompts, regarding what the agents are doing.
00:15:39.759 --> 00:15:43.519
There's a difference between an agent that sits there and does a prescriptive task.
00:15:44.080 --> 00:15:56.240
It says, okay, I see this detection, I'm going to go pull this information from Google Threat Intelligence and I'm going to provide a dossier on this hash or on this IP address or on this domain back to the human analyst.
00:15:56.480 --> 00:15:57.440
That's all I do.
00:15:57.840 --> 00:16:07.600
When we start allowing agents to quantify risk and call other tools, that governance and security around the agentix span is really the next wave.
00:16:07.840 --> 00:16:08.960
Wiz does it very well.
00:16:09.120 --> 00:16:23.679
They have a platform that they call Atlas that basically maps all of the agents, every model, whether it's homegrown, whether it's a frontier model in the environment, and it starts drawing lines between communication of those agents and the users that are accessing them.
00:16:23.919 --> 00:16:31.679
And we've got another partner called Safe AI, which is amazing in terms of the capabilities that they have in observability of the span.
00:16:31.759 --> 00:16:36.080
And they're very much on the forefront of introducing that security protocol.
00:16:36.159 --> 00:16:43.200
But it's the real challenge for most CISOs today, is like I'm being told I have to deploy AI, I am deploying AI, how do I secure this?
00:16:43.679 --> 00:16:49.919
So that response of yours would invite a one-hour conversation because there are so many things to unpack.
00:16:50.399 --> 00:16:50.559
Sure.
00:16:50.799 --> 00:16:56.639
So let me keep the uh ISO Ford 2001 and the NIST RMF, which you didn't mention, in one box.
00:16:56.720 --> 00:16:57.440
We'll come to that.
00:16:57.600 --> 00:16:57.840
Sure.
00:16:58.000 --> 00:17:01.279
Let's start talking about agentic intent first, right?
00:17:01.440 --> 00:17:01.600
Sure.
00:17:02.240 --> 00:17:02.960
I won't take that.
00:17:03.039 --> 00:17:04.880
And I want to break that into two parts.
00:17:05.200 --> 00:17:08.880
One, uh, you're right, there is observability of agents.
00:17:09.039 --> 00:17:13.039
The problem is the price is very prohibitive to a lot of customers.
00:17:13.359 --> 00:17:22.000
If we are looking at uh agentic observability across the world, and and let me preface this by describing the way I see the world.
00:17:22.079 --> 00:17:38.079
I see the world divided into three parts the top 5%, the Googles and the Salesforce and the Microsoft, who have all the resources and they have ISO 42001 and the VIS teams and red teams and pen test teams and cyber teams and clients of Foresight, consultants.
00:17:38.400 --> 00:17:44.799
And then you've got a far left who say that AI means Chat GPT or Cloud.
00:17:45.039 --> 00:17:46.240
We have two subscriptions.
00:17:46.319 --> 00:17:47.519
We are AI.
00:17:47.680 --> 00:17:58.160
And then the vast majority that sit in the middle who say, well, we understand AI is a lot more, but we don't really understand how am I going to adopt, how am I going to defend, and how am I going to govern AI.
00:17:58.240 --> 00:18:01.440
And that's the that's the large part of the organization.
00:18:01.759 --> 00:18:09.680
This mid-tier cannot afford uh, you know, tier one uh solutions and observability that might cost you a million dollars, for example.
00:18:09.920 --> 00:18:10.240
Sure.
00:18:10.400 --> 00:18:13.680
Um and and that causes a industry why.
00:18:13.759 --> 00:18:15.599
When I say industry, I'm talking of global industry.
00:18:15.759 --> 00:18:16.400
Industry Y.
00:18:16.559 --> 00:18:23.680
Think about a business in Hokkaido, Japan, and think about a business in Jordan, and think of a business in New Zealand, right?
00:18:23.759 --> 00:18:34.400
And they all have agentic uh abilities in the organization, but they don't have observability, and neither can they afford uh you know safe AI or a Wiz or any other vendor license.
00:18:34.480 --> 00:18:41.680
But that's a that's a problem that MSSPs need to solve because there are many mid-tier businesses that have to have to handle.
00:18:41.920 --> 00:18:44.640
So I wanted to preface that that scenario.
00:18:44.880 --> 00:18:46.240
Now comes my question.
00:18:46.480 --> 00:19:02.559
So knowing that that's the global problem right now, how do mid-sized businesses deal with intend drift, deal with conversations around blast radius, deal with conversations about agent-to-agent communication, right?
00:19:02.799 --> 00:19:13.039
Uh deal with transfer of governance that is inherent in one agent, and how does an agent uh transfer that when it communicates with another agent?
00:19:13.200 --> 00:19:18.400
There are so many layers to peel just by talking about the industry.
00:19:18.559 --> 00:19:18.720
Trevor Burrus, Jr.
00:19:18.880 --> 00:19:20.160
That's a big question.
00:19:20.480 --> 00:19:22.160
But uh I'll do my best.
00:19:23.599 --> 00:19:25.119
But you see where I'm going with, of course.
00:19:25.599 --> 00:19:25.920
Yeah, yeah.
00:19:26.000 --> 00:19:42.319
I think that there's a very interesting wave, and I'll start here, but there's a very interesting wave, and you've seen this, Jay, of this wave of AI startup companies that have this very niche use case, and they're using agents to do this very prescriptive thing to try to solve a problem in the industry.
00:19:42.400 --> 00:20:05.839
And this goes outside of security, but this is also very heavily occurring in security where you'll have a team of engineers that have built something that's very prescriptive, and then the next frontier model or the next update of something from one of the hyperscalers completely makes that entire business model and the company irrelevant because that functionality is built into the default platform of the hyperscale capability.
00:20:06.079 --> 00:20:15.440
And that I think also extrapolates cleanly into the need for quality partnerships in a team expansion perspective.
00:20:15.599 --> 00:20:33.839
And this will feel a little bit like a plug, but that's one of the promises that we bring to customers is not really the need to be able to consume all of that from a financial or technology perspective, but to know that the outcomes are being arrived to and that a lot of that governance and observability is provided through the active services and partnership.
00:20:34.000 --> 00:20:36.400
I think that that is the method with all things, right?
00:20:36.559 --> 00:20:40.720
Typically you look for consultants or you look for relationships that achieve those outcomes.
00:20:40.880 --> 00:20:46.160
And if you have a mandate that you're set upon by your business, think regulatory requirements.
00:20:46.400 --> 00:20:57.440
Typically there's consultancy or a Sherpa through the valley, if you will, that can help you arrive to that outcome and also provide you consumption of those techniques through an alternative or consolidated platform.
00:20:57.920 --> 00:21:06.880
How does Foresight deal with a development of human capability in an area where there is a massive platform shift?
00:21:07.039 --> 00:21:08.559
AI is one of those moments, right?
00:21:08.799 --> 00:21:17.759
Because I was talking to an analyst yesterday and I said to the analyst, I said, everything that we did in a deterministic world, we have to redo in a non-deterministic world.
00:21:17.839 --> 00:21:19.039
And I said, What do you mean by that?
00:21:19.119 --> 00:21:24.559
And I said, What I mean by that is we did red teaming in a in a deterministic world.
00:21:24.640 --> 00:21:27.599
We gotta do that again in a non-deterministic world, right?
00:21:27.839 --> 00:21:41.119
Observability, if you look at UEBA, there's something that you know that we used to do in a deterministic world, figuring out which human being is logging in at three o'clock in the morning in the office, downloading files, is exactly what we gotta do.
00:21:41.200 --> 00:21:44.000
That's observability in the AI world.
00:21:44.240 --> 00:21:56.480
So MSSPs across the world are gonna need to skill up and get the uh professionals that organizations are relying on to be able to guide organizations how to adopt defendant governance.
00:21:56.640 --> 00:21:59.759
So, what's the best practice in Foresight on how you are building?
00:22:00.319 --> 00:22:01.680
Talent within Foresight.
00:22:02.000 --> 00:22:04.559
I believe you're more than 140 professionals.
00:22:04.960 --> 00:22:05.440
148.
00:22:05.680 --> 00:22:12.640
Yeah, take us through the thought process of how are you keeping them up to speed with what's going on in the world so that they are able to help your clients.
00:22:13.039 --> 00:22:34.720
So I think this also goes back to a previous question about reducing drudge and creating a culture or an environment within our ecosystem where learning is encouraged, where the tools are accessible, where credentials are part of the status quo, where the idea of bettering oneself and our skill set has a an outcome on the propriety of the business, right?
00:22:34.880 --> 00:22:40.799
The ability for us to reflect ourselves as professionals is critical to building relationships.
00:22:41.359 --> 00:22:48.000
This is going to sound very cheesy, but we we really do view ourselves as like the defenders standing in the breach for our customers.
00:22:48.240 --> 00:22:55.279
We do not people who don't share that uh ideology don't typically last very long at Foresight, right?
00:22:55.440 --> 00:23:02.559
And it sounds that sounds ironfisted, but the truth is that our engineering teams comprise 90% of our total company, right?
00:23:02.640 --> 00:23:10.720
It's it's all developers, it's all security engineers, it's automation engineers, it's forward-deployed engineers, it's AI engineers.
00:23:10.880 --> 00:23:23.119
Uh they tend to collaborate, and we have a culture where people can like really raise their hands and come up with better ideas and propose and beta test things that improve services and improve security outcomes for our clientele.
00:23:23.359 --> 00:23:28.160
And I think that that's a reflection of how close we are to Google in their proximity as well.
00:23:28.319 --> 00:23:32.160
They run a very publisher-parish kind of mentality within Google, right?
00:23:32.240 --> 00:23:35.599
You essentially have to post a new thesis on an annual basis.
00:23:35.680 --> 00:23:37.759
And I think there's an expectation around that.
00:23:38.000 --> 00:23:50.559
How that gets to customers and readiness, there's not much in the way of viability for an MSSP that falls behind the curve from a technical perspective or isn't ready or aware that there's a wave or a change coming to the industry.
00:23:50.880 --> 00:23:56.640
Typically, those companies tend to peter out as well or start moving down market, right?
00:23:57.039 --> 00:24:10.000
Away from the enterprise, into the mid-market, into the SMB because they're providing an outcome or service to clientele that are looking for holistic security, but don't have the technical aptitudes or the desire to get into those platforms.
00:24:10.400 --> 00:24:15.680
The nature of the customers that we typically engage on the Google side tend to be very large enterprises.
00:24:15.839 --> 00:24:20.240
We have mid-market customers, we have SMB customers that consume the platform as well.
00:24:20.480 --> 00:24:29.519
But there's an amount of education that I think is required not only for the professionalism, but in order for us to be able to actually stand in the breach and accomplish the things that we're being asked to accomplish.
00:24:29.920 --> 00:24:30.400
Understand.
00:24:30.559 --> 00:24:32.720
Let's let's now open that box of governance.
00:24:33.200 --> 00:24:33.359
Sure.
00:24:33.680 --> 00:24:36.799
The the NIST RMF and ISO 42001.
00:24:36.960 --> 00:24:40.960
If I'm not wrong, ISO 42001 has 190 plus controls.
00:24:41.200 --> 00:24:41.519
It does.
00:24:41.680 --> 00:24:42.480
In in total.
00:24:42.720 --> 00:24:54.880
And we all know, uh Jeremy from ISO 27001, that uh uh having an ISO standard and living an ISO standard are two different parallel tracks of a of a railway track.
00:24:55.119 --> 00:24:55.440
Certainly.
00:24:55.599 --> 00:24:55.839
Right?
00:24:56.000 --> 00:25:04.160
Just because you have the ISO 42001 does not mean that you're operating one under the policies that you have uh committed to.
00:25:04.319 --> 00:25:06.480
And and that's a tall, tall order.
00:25:06.640 --> 00:25:11.119
It's not easy for any organization to actually implement ISO Fourier 2001.
00:25:11.279 --> 00:25:29.039
So, from your experience in working with various industries at Foresight, do you see uh more and more organizations needing to show their compliance of Foray 2001 because of regulatory requirements and yet see serious gaps in their day-to-day operations?
00:25:30.640 --> 00:25:38.880
And mostly that that has to do with so on the federal space, when you start getting into like IL-4, IL5, IL six, like classified data.
00:25:39.119 --> 00:25:39.279
Right.
00:25:39.599 --> 00:25:47.519
There's very little in the way of true agentic system adoption from uh parties that are not the government themselves.
00:25:47.599 --> 00:25:48.799
And I'm just referring to the U.S.
00:25:49.039 --> 00:25:49.279
Right.
00:25:49.440 --> 00:26:00.000
Uh we do a lot of work with the European Space Agency, and you have a conglomerate of tens of different countries, each with their own national security agencies, each with their own policies and mandates.
00:26:00.160 --> 00:26:03.440
Not much in the way of agentic adoption there either, right?
00:26:03.839 --> 00:26:22.000
Uh on the commercial side and the very large enterprise side, I would say that the vertical that is most governed and the ones that have the most significant gap and are really running to 42,001 in this framework around agentic security, compliance, is the healthcare and life sciences vertical, right?
00:26:22.240 --> 00:26:27.599
You have a tremendous amount of research that goes into some of these very large medical institutions.
00:26:27.920 --> 00:26:41.680
Some of that is privileged and governed data around patients, uh personally identifiable telemetry, uh, documentation around certain cases that may have been months or years as hospitals are working with certain patients.
00:26:41.920 --> 00:26:47.599
The only way to really achieve that kind of compliance on the front end is to go more cloud, right?
00:26:47.680 --> 00:26:51.839
You you cannot effectively we have models now that can be deployed on-prem.
00:26:52.079 --> 00:26:57.200
Google themselves now doing air-gapped or contained on-premises models that can be leveraged.
00:26:57.440 --> 00:27:14.079
But in order to really effectively do that, it starts with deployment of the telemetry into cloud, lifting away from physical data centers and physical endpoints to aggregate telemetry within a hyperscaler's environment to make it replicated, touched from multiple angles, et cetera.
00:27:14.240 --> 00:27:18.480
And then once that cloud architecture is deployed, the policies are native by default.
00:27:18.640 --> 00:27:21.839
And when agents are deployed, they're governed by default.
00:27:22.000 --> 00:27:30.400
And so it's essentially like onboarding to a net new sim or a net new SOAR and having a library of detection content that is already built.
00:27:30.559 --> 00:27:35.279
Uh it does require a little bit of a fundamental shift in the overall platform.
00:27:35.519 --> 00:27:46.240
I think the real gaps are some of the kind of, well, let's throw this against the wall and see if it sticks in terms of regulation, and there's a difficulty in enforcing some of those standards in these businesses.
00:27:46.319 --> 00:27:49.839
Aaron Powell And how do you intend to overcome these difficulties?
00:27:49.920 --> 00:27:54.720
Aaron Powell The conversation is around consolidation and compliance and observability through the platform itself.
00:27:54.880 --> 00:28:14.000
It should occur natively, and that's what I think the shift is really uh suggesting is what's taking place is getting agnostic about where the data resides, but the AI harness itself or the framework over those agents and governance, having defined policies that allow you to essentially enforce as if the agents were users.
00:28:14.160 --> 00:28:18.960
And that's the big next push is identification and privileged access across agentix forms.
00:28:19.279 --> 00:28:26.400
So identifying uh identification, privileged access is one, uh but temporal contacts is another completely.
00:28:26.799 --> 00:28:27.279
It is right?
00:28:27.440 --> 00:28:27.519
Yeah.
00:28:27.759 --> 00:28:32.960
I would not be surprised if many people that are listening to this podcast will have no clue what you and I are talking about.
00:28:33.119 --> 00:28:48.000
But which is why which is why I'm saying that there is an entire industry that's moving towards the the edge of where the industry is moving, understanding and determining agentic intent and intent drift and temporal contacts and blast radius.
00:28:48.079 --> 00:29:00.480
And there's an entire segment that's thinking that ChatGPT is AI, and then there's a middle layer that's being pressured by the bots to say implement AI now and show me as a cost saving.
00:29:00.720 --> 00:29:02.880
As a cost saving, which is not always the truth.
00:29:03.200 --> 00:29:07.759
Which many CEOs have done and then realize that oops, we forgot token cost is actually a thing.
00:29:08.000 --> 00:29:09.359
Are you still looking for a job?
00:29:09.519 --> 00:29:09.759
Right.
00:29:09.920 --> 00:29:10.160
Right?
00:29:10.480 --> 00:29:10.640
Right?
00:29:10.880 --> 00:29:18.240
So what I'm trying to say is that there is a to an MSSP like you and to a cybersecurity leader like me, this is common talk.
00:29:18.480 --> 00:29:25.759
But we have a duty as a as an industry to bring along the businesses where the actual civilization exists.
00:29:26.000 --> 00:29:26.160
Sure.
00:29:26.400 --> 00:29:28.880
These businesses that exist actually serve civilization.
00:29:29.119 --> 00:29:32.480
Our duty is to bring them along and make sure that they think through that.
00:29:32.640 --> 00:29:35.039
How do you think we can accomplish that as an industry?
00:29:35.359 --> 00:29:35.920
Consolidation.
00:29:36.799 --> 00:29:39.519
I was thinking there'll be no question where I'll make you pause.
00:29:40.319 --> 00:29:43.599
Well, consol consolidation, and and I do think that that's coming.
00:29:43.839 --> 00:29:45.359
2035, right around there.
00:29:45.759 --> 00:29:46.079
Explain to me.
00:29:46.400 --> 00:29:47.200
Let's talk in the next 10.
00:29:47.519 --> 00:29:48.559
What do you see as a consolidation?
00:29:48.799 --> 00:30:13.119
I think the hyperscalers were c will continue to consume companies and technologies and types of technologies and use their megalithic resources at their disposal in order to consolidate and make it more democratic for businesses of all size to fire up, use these tools, and uh operationalize from a centralized platform.
00:30:13.359 --> 00:30:27.200
I think the Israeli startups will continue to be highly disruptive, but I think Google, Microsoft, AWS, CrowdStrike, Oracle to some extent, probably Cisco still kind of banging around, Palo, but there will be further and further consolidation.
00:30:27.279 --> 00:30:31.920
I think that that's going to be rapidly increased as we continue to move down this pathway towards the Trevor Burrus.
00:30:32.079 --> 00:30:33.839
What will happen to the startup ecosystem?
00:30:34.319 --> 00:30:41.519
I think the startup ecosystem will uh continue to flourish, but I believe acquisition values will drop.
00:30:41.680 --> 00:30:44.960
I don't know that there will be significant I'm just postulating here.
00:30:45.039 --> 00:30:48.640
I don't I don't want to sound crazy or anything, but I actually do think acquisition values will drop.
00:30:48.720 --> 00:30:54.799
Aaron Powell Yeah, because wipe coding is is democratizing the ability of anyone to dream up.
00:30:55.039 --> 00:31:03.200
In fact, now I can even do uh agentic AI novel research using a frontier model that's prompted well.
00:31:03.359 --> 00:31:03.519
Yeah.
00:31:03.759 --> 00:31:10.319
So therefore the value of uh of a platform, it's it's uh I wouldn't say gone, but it's diminished significantly.
00:31:10.720 --> 00:31:13.279
I think the Chinese are catching up to the Americans very rapidly.
00:31:13.440 --> 00:31:17.519
I think the Indians are catching up very, very rapidly to American models as well.
00:31:17.759 --> 00:31:24.000
I think India and China represent a significant impact to security globally over the course of the next 20 years or so.
00:31:24.240 --> 00:31:28.240
I'm hoping that that stays fairly friendly and in the way some of that is going.
00:31:28.400 --> 00:31:31.440
Historically, it hasn't always been rainbow and sunshine, right?
00:31:31.680 --> 00:31:35.519
Uh but I am an optimist about the future of AI.
00:31:35.680 --> 00:31:49.920
I'm also a realist about implications in the way it can be used because I do it every day in practice and I see customers trying to deploy it, and we don't get swept up in the marchite of there being this magical robot in the sky that's going to fix all of our security problems.
00:31:50.079 --> 00:31:54.319
I believe Mythos is the greatest sales tool ever created.
00:31:54.480 --> 00:32:01.680
It has produced such a huge wave of concerns regarding these boogeyman vulnerabilities out there.
00:32:01.839 --> 00:32:31.119
But in practice and in seeing it deployed, uh, it's real and it's capable of discovering vulnerabilities, zero days, attack pathways that absolutely need to be mended, but that creates a business opportunity within the hyperscaler that's deploying a tool like that to create something like a code mender at Google, to lean forward with agentic threat defense, to put people in this toGAF methodology where we're recursively testing and iterating on the improvements.
00:32:31.359 --> 00:32:36.799
None of that changes in the historical security philosophy of working with an enterprise or cybersecurity.
00:32:36.960 --> 00:32:42.640
It's about identifying attack pathways, shoring them up, testing them, finding new attack pathways.
00:32:42.880 --> 00:32:47.039
We're never really more than 99% of the way there, Jay, right, with any customer.
00:32:47.119 --> 00:32:48.960
It's not like we just wipe our hands and we walk away.
00:32:49.119 --> 00:32:51.839
There's always something new, some change that's going to happen.
00:32:52.000 --> 00:33:07.759
But to go back to your original question about how do we bring that middle segment forward, I think you have to make it more open, more accessible, and continue to consolidate functionality into something that has a predictable cost model, which is something we've kind of brushed around a little bit.
00:33:07.839 --> 00:33:11.839
But tokenization right now and agentic utilization is not predictable.
00:33:12.000 --> 00:33:12.559
It's not.
00:33:12.720 --> 00:33:21.119
We've had accidental$250,000 queries we've run where we had to ask for forgiveness for some of those because we were doing some iterative testing.
00:33:22.640 --> 00:33:23.200
Yes, absolutely.
00:33:26.160 --> 00:33:27.279
They would have said pay, right?
00:33:27.680 --> 00:33:34.720
You know, we don't that predictability, I think, is what makes it so more customers can lean into it.
00:33:34.960 --> 00:33:38.480
The way that they've entered into the market was brilliant.
00:33:38.799 --> 00:33:46.640
They have created infrastructure, they began getting Sentinel and Google security operations and Splunk out into the market.
00:33:46.799 --> 00:33:56.640
They started creating agentic functionality and including those aspects into the platform free of charge and free to use, and are now shifting to a token burn model.
00:33:56.799 --> 00:34:03.599
And that goes back to the data becoming, I think, commoditized, the idea of data just residing where it resides.
00:34:04.079 --> 00:34:05.519
You're a technologist, you know this.
00:34:05.680 --> 00:34:14.400
Keeping data in BigQuery, in BigQuery, is far cheaper than keeping that telemetry hot in a separate platform like a sim, right?
00:34:14.480 --> 00:34:14.639
Right.
00:34:14.960 --> 00:34:26.559
And if a model can reach out or an agent can reach out to that telemetry and synthesize at machine speeds and pull back context, then the cost transference goes to all of these data centers we're building in Texas.
00:34:26.719 --> 00:34:30.320
All of this massive growth around these frontier models.
00:34:30.400 --> 00:34:32.400
Uh, and that's the next big shift, I think.
00:34:32.960 --> 00:34:34.559
So, Jeremy, we are almost out of time.
00:34:34.639 --> 00:34:35.599
I want to ask you a question about.
00:34:36.000 --> 00:34:43.199
You you have helped countless enterprises implement cybersecurity solutions, especially in the AI era.
00:34:43.760 --> 00:34:44.639
What stands out?
00:34:44.800 --> 00:34:58.559
What is normally the largest problem that, in in your opinion, is the largest problem in in bringing an organization from a traditional security culture to an AI era culture?
00:34:58.960 --> 00:34:59.920
That's a great question.
00:35:00.239 --> 00:35:04.079
Because I I think that and there's a lot of different answers to it though, Jay.
00:35:04.159 --> 00:35:04.400
Right?
00:35:04.480 --> 00:35:06.239
Like the uh some of it is financial.
00:35:06.400 --> 00:35:26.719
The biggest barrier for some customers is a lack of transparency on the financial implications, which is very good for my business in terms of what we do from an MSSP perspective, because we are spending our resources to build those outcomes, to provide those outcomes, to give that agentic framework to customers.
00:35:26.960 --> 00:35:29.599
Sometimes I think it's education and training and enablement.
00:35:29.760 --> 00:35:37.039
I I don't always believe that there's a clear understanding of what that outcome or what that goal of utilization of AI is.
00:35:37.199 --> 00:35:39.760
If it's security, we can educate on that very cleanly.
00:35:39.840 --> 00:35:42.000
Here's how we use it, here's what we would recommend.
00:35:42.159 --> 00:35:46.320
If you have separate teams that are looking to do other things, let us help you build that.
00:35:46.480 --> 00:35:56.800
I think that there's also, although people don't really talk about this, uh, a reservation to uh kind of giving over some of that responsibility, hesitation around that, right?
00:35:56.960 --> 00:36:06.559
You have people that have built careers or practices around their security posture for the last 10 years that there is no pain now, so why would we introduce new pain to some of them?
00:36:06.800 --> 00:36:07.039
Right.
00:36:07.280 --> 00:36:15.280
And that shift is always part of the trust motion, the conversation with those clientele and getting them to see a better path forward or a better way forward.
00:36:15.519 --> 00:36:18.239
And there are those that will never make the shift, right?
00:36:18.480 --> 00:36:24.159
Where there are requirements that keep them where they're at, even though they may be using agentic frameworks in other ways.
00:36:24.480 --> 00:36:24.639
Right.
00:36:24.880 --> 00:36:25.840
Right, fantastic.
00:36:26.000 --> 00:36:26.960
One final question.
00:36:27.119 --> 00:36:34.480
As a cybersecurity professional, what is the one thing that keeps you up awake at night at the industry that we are in?
00:36:35.599 --> 00:36:40.400
Um I do think machine speed attacks are going to accelerate.
00:36:40.880 --> 00:36:42.960
Uh they are absolutely accelerating.
00:36:43.599 --> 00:37:13.199
Some of the frontier model capabilities around vulnerability and zero days, everybody's vibe coding, yes, but when models are explicitly designed to break software and to create new attacks, if we start approaching what Kurzweil called the singularity in terms of advanced general intelligence, if cryptography is cracked and we have to start rolling cryptography to at machine speeds to compensate for the cracking of cryptography.
00:37:13.519 --> 00:37:14.079
BQC.
00:37:14.400 --> 00:37:19.039
Yes, that's the stuff, that's the thing that we're like, I will finally just find a beach.
00:37:19.360 --> 00:37:32.159
Yeah, you know, my my fear is that I I think I mean with whatever we're seeing with front-end models now, I think the cracks in the dam of AI is beginning to be seen because encryption, there are already clear cracks coming.
00:37:32.400 --> 00:37:32.480
Yes.
00:37:32.800 --> 00:37:38.159
And my fear is one fine day, the dam breaks, and we're not ready for a PQC world.
00:37:38.719 --> 00:37:44.400
I think that uh, you know, things like blockchain, financial systems, energy grids, right?
00:37:44.480 --> 00:37:51.599
There's a lot of downstream implications that may not exactly be intentional by that discovery that that happen.
00:37:51.920 --> 00:37:56.320
And uh, you know, not to be apocalyptic, but that those are the terrifying things.
00:37:56.480 --> 00:37:56.639
Right.
00:37:56.880 --> 00:38:03.760
Because there's nothing we could do as an MSSP or a security practitioner to reset global cryptography, right?
00:38:03.920 --> 00:38:11.440
To reset the keys that we hold dear uh in order for us to maintain those chains of custody, privacy, and command over those systems.
00:38:11.679 --> 00:38:11.760
Right.
00:38:11.840 --> 00:38:12.000
Yeah.
00:38:12.320 --> 00:38:17.360
Jeremy, it's been a pleasure talking to you and thank you for being part of the cybersecurity podcast by IC Council.
00:38:17.599 --> 00:38:17.920
Thank you.
00:38:18.079 --> 00:38:23.599
That was Jeremy Hale, the chief cybersecurity evangelist at Foresight Cybersecurity.
00:38:23.760 --> 00:38:32.239
One thing that's very clear in the conversation is that the idea of agentix sock is not just in the labs, it's already in production.
00:38:32.719 --> 00:38:37.599
If you like the conversation, we'll appreciate you sharing this on your social media.
00:38:37.840 --> 00:38:47.280
We'll also like it if you share this conversation with the one person in cybersecurity that you think can actually benefit from listening to this deep conversation.
00:38:47.679 --> 00:38:57.119
Until I bring you other movers and shakers of the cybersecurity industry, this is Jay Bavisi checking out from AC Council's Cybersecurity Podcast.
00:38:57.360 --> 00:38:58.400
Good night.
