บทถอดความฉบับเต็มของ DtSR Episode 722 - Vulnerability Math Ain't Mathing

00:05:22.319 But wait, it hasn't quite turned out that way. 00:05:24.160 --> 00:05:26.160 Can we talk about that tech debt concept? 00:05:26.399 --> 00:05:35.040 Because when we talk about debt, at least in a financial context, it's we've borrowed and then there's interest and we have to pay it back one day. 00:05:35.360 --> 00:05:40.160 When it comes to patching security vulnerabilities, does that scenario really apply? 00:05:40.480 --> 00:05:46.800 Meaning we have a backlog of patches we haven't applied for security problems. 00:05:47.040 --> 00:05:53.759 But if the adversary never, ever, ever exploits them, why do we ever, ever, ever have to patch them? 00:05:53.920 --> 00:05:58.959 Is it really debt that accumulates with interest in the same way as we imagine the term? 00:05:59.120 --> 00:06:00.399 Is that really true? 00:06:01.839 --> 00:06:02.000 Okay. 00:06:03.040 --> 00:06:08.560 98.5% of all known vulnerabilities have never been exploited. 00:06:08.879 --> 00:06:09.040 Ever. 00:06:09.360 --> 00:06:10.079 That we know of. 00:06:10.720 --> 00:06:11.519 That we know of. 00:06:12.240 --> 00:06:17.600 We can only go by what we know about CVEs. 00:06:17.759 --> 00:06:24.800 If you actually increase it to all the things that haven't made a CVE that should be a C VE, it's it's substantially way worse than that. 00:06:25.839 --> 00:06:27.360 Well, the percentage is lower. 00:06:27.439 --> 00:06:28.399 It gets into the tenths. 00:06:29.040 --> 00:06:30.800 Yeah, tenths of a percent. 00:06:33.519 --> 00:06:35.439 What okay, let's let's let's try it this way. 00:06:35.519 --> 00:06:43.920 And let's be really honest about this because we're asking people to spend time and money organizations patching that stuff is not free. 00:06:45.680 --> 00:06:59.199 I mean, we we have to really think of if most vones will never be exploited, what is the value of finding let alone patching these this can I can I give you can I give a potentially dangerous real-world example? 00:06:59.279 --> 00:07:01.759 Because I I don't I wonder if if anybody else is having a difficult time. 00:07:02.720 --> 00:07:03.839 We're down the rabbit hole, Raf. 00:07:04.000 --> 00:07:04.639 Lay it on us. 00:07:05.279 --> 00:07:17.920 So you you you go to your you go to a mechanic shop to get your oil change, and they tell you that you've got seven other things that need to be done immediately because they could cause your car to explode on the highway. 00:07:18.240 --> 00:07:20.079 You choose not to fix any of those. 00:07:20.240 --> 00:07:23.199 300,000 miles later, nothing's happened. 00:07:23.839 --> 00:07:25.199 Is where we are. 00:07:25.920 --> 00:07:26.560 Yeah. 00:07:27.120 --> 00:07:27.439 Okay. 00:07:27.839 --> 00:07:30.079 Um, and it's not just like from the last year. 00:07:30.240 --> 00:07:32.639 I mean, go back as far as you want. 00:07:33.120 --> 00:07:34.000 This is the number. 00:07:34.079 --> 00:07:39.199 It's like, you know, the I just can't count CVE vulnerabilities,

but it's about 1.5% now. 00:07:39.439 --> 00:07:42.720 It was about that number the year before, the year before that. 00:07:42.959 --> 00:07:45.120 A decade back, it was the same number. 00:07:45.279 --> 00:07:47.759 The adversaries don't need that many vulnerabilities. 00:07:47.920 --> 00:07:52.160 We're we're wasting a lot of time and energy and money fixing things that don't have to be. 00:07:52.399 --> 00:07:58.879 But to your to your analogy there, Raf, I mean, you you're saying like a qualified mechanic finds things wrong with your car. 00:07:59.040 --> 00:08:01.920 Any one of them could cause massive catastrophe. 00:08:02.000 --> 00:08:09.120 And and uh, and according to that mechanic, whether we can trust them or not, some amount of time those things end in catastrophe. 00:08:09.519 --> 00:08:13.120 You you might even say, well, that's such a slow, that's such a low number, it's only eight things. 00:08:13.199 --> 00:08:14.319 I might as well get it fixed. 00:08:14.480 --> 00:08:15.920 But what if it's not eight things? 00:08:16.079 --> 00:08:23.199 What if it's hundreds of thousands of things or millions of things, or tens or hundreds of millions of things, like some of our customers we're talking to? 00:08:23.519 --> 00:08:28.959 Well, and then some of them are like, Well, this thing could poke you if you rubbed your eyeball on it, or whatever. 00:08:29.040 --> 00:08:30.240 It's like, I mean, what? 00:08:30.399 --> 00:08:31.680 Like, no one's doing that. 00:08:32.399 --> 00:08:34.480 Like, these are just coming to reasonable. 00:08:34.799 --> 00:08:36.960 I I keep coming back to Spectre and Meltdown. 00:08:37.039 --> 00:08:46.240 Like the world had a literal meltdown over this, and it was such a nothing burger for 99.9998% of the world. 00:08:47.279 --> 00:08:50.240 I I I don't, yeah, you're right. 00:08:50.559 --> 00:09:03.360 And by the way, I've been having worked in large enterprise, I have been in the position where you get a vet, you get an industry score that says this is a 10 out of 10, this must be patched immediately. 00:09:03.600 --> 00:09:22.720 You go to bat, you win the argument, the mid-range Unix team applies the patch, you blow up an entire card processing system for 36 hours, and the and I'm willing to stake my career on the fact that that was never going to be exploited anywhere in that environment. 00:09:23.279 --> 00:09:24.960 That's that's the deal. 00:09:25.200 --> 00:09:36.480 Now, here's the thing before, and I'll qualify before, these arbitrary scoring systems, patching these issues the way we have been, it's the best we could do with the information that we had at the time. 00:09:36.720 --> 00:09:40.000 It's only someone recently do we know what vulnerabilities are exploited. 00:09:40.080 --> 00:09:44.879 It's only someone recently that we gotten data from the insurance carriers on what leads to financial loss. 00:09:45.120 --> 00:09:49.759 What it's told us is that all our guessing previously, unfortunately,

was just wrong. 00:09:49.919 --> 00:09:50.960 It was just wrong. 00:09:51.120 --> 00:09:53.600 So the issue wasn't that we were doing it wrong before. 00:09:53.840 --> 00:09:56.799 The issue now is are we going to continue doing it wrong now? 00:09:56.960 --> 00:09:58.799 Because that's the way it's always been done. 00:09:59.120 --> 00:10:23.519 But what we're what you're asking for is an entire industry of multi-billion dollar, maybe more industry that's built around scanning, classifying, and forcing and tracking and prioritizing and God, whatever else is in there of vulnerabilities that effectively you're saying don't freaking matter. 00:10:23.840 --> 00:10:25.679 We know statistically they don't matter. 00:10:25.840 --> 00:10:29.519 And maybe right there, all those characteristics is exactly the problem. 00:10:29.679 --> 00:10:36.559 Why aren't they focused on reducing financial loss rather than focus on fixing as many vulnerabilities as humanly possible? 00:10:36.799 --> 00:10:38.399 That's that's contradiction. 00:10:38.480 --> 00:10:44.320 I mean, what what benefit is to the business if you're gonna spend the same amount of money patching as you would of getting hacked? 00:10:44.480 --> 00:10:45.919 I mean, what's what's the issue? 00:10:46.720 --> 00:10:48.159 Back back to your car analogy. 00:10:48.240 --> 00:10:50.960 Let's say you have 100,000 volumes to go fix or something. 00:10:51.120 --> 00:10:52.960 You're gonna spend more money in the car's worth. 00:10:53.039 --> 00:10:54.320 Why are we doing this again? 00:10:54.639 --> 00:10:56.080 I've had that conversation as well. 00:10:56.240 --> 00:10:59.279 Like, why would we why would we do this? 00:10:59.440 --> 00:11:05.600 And and I I know we gosh, it's been a long time, but I had this, we've had this conversation on this podcast. 00:11:05.679 --> 00:11:08.480 I don't know if it was you, Rob, I think somebody else before. 00:11:08.720 --> 00:11:14.960 But the the conversation of like at some point you just go, uh I I'm not gonna fix all this. 00:11:15.039 --> 00:11:20.320 I'm gonna let my insurance carrier like just like I'm gonna do my best, and then the rest is gonna be insurance. 00:11:20.720 --> 00:11:23.039 And then right there, what is our best? 00:11:23.200 --> 00:11:25.039 What is what is reasonable? 00:11:25.360 --> 00:11:25.840 Right. 00:11:26.639 --> 00:11:32.720 But like is our is our best using everything we got and all the patch capacity that we have, is that our best? 00:11:33.200 --> 00:11:36.879 Or is it best like this is the conversation we have with CSOs now? 00:11:37.360 --> 00:11:43.200 What if you just uh look for, scan for, and fix all the known exploited vulnerabilities? 00:11:43.600 --> 00:11:50.720 That way, when and if you get breached, you'll be the first one that would ever get breached on that issue. 00:11:51.039 --> 00:11:51.840 The first one. 00:11:52.000 --> 00:11:54.080 I mean, who can expect any more than that? 00:11:54.240 --> 00:11:54.960 You were the first. 00:11:55.039 --> 00:11:57.200 There's nothing you really could more you could have done. 00:11:57.519 --> 00:12:01.519 How would you how could anybody possibly know what the next vulnerability is? 00:12:01.759 --> 00:12:03.759 You know, that there are ways to do this. 00:12:03.919 --> 00:12:06.720 Like patch management can only go so far. 00:12:06.879 --> 00:12:12.000 At some point, fast detection response, like we talked about earlier, MDR, canaries, and things like this. 00:12:12.240 --> 00:12:14.399 Just because you get exploited doesn't mean there's a loss. 00:12:14.480 --> 00:12:19.200 There's a way to minimize damage, other than patch everything at all times. 00:12:19.360 --> 00:12:20.639 That's absurd. 00:12:21.840 --> 00:12:32.639 So this this is this is part of, I think, a broader problem in the way that our our niche of IT operates. 00:12:32.799 --> 00:12:35.600 It's very silo focused, right? 00:12:35.759 --> 00:12:42.480 So the Vuln management, the scanning and patching people will tell you this is the most important thing, do this above all else. 00:12:42.720 --> 00:12:47.200 The detection and response people will tell you that's the most important thing, do this above all else. 00:12:47.440 --> 00:12:51.519 The like everybody else has their the most, this is the most important thing. 00:12:51.679 --> 00:12:54.639 And we really have been terrible. 00:12:54.799 --> 00:13:05.120 And I mean, 30 years in, we've been terrible at saying this is what reasonable looks like across the entire spectrum of things you're supposed to do. 00:13:05.360 --> 00:13:07.519 I think maybe because that's hard. 00:13:08.960 --> 00:13:10.559 I haven't seen a lot of effort there. 00:13:10.879 --> 00:13:12.159 You know, it might be cultural. 00:13:12.240 --> 00:13:15.759 Let me just get let me just lay a different analogy for you or a different concept. 00:13:16.080 --> 00:13:28.559 Going back 25, 30, 25 or so years when voe management was really getting going, you really could scan for everything, and you really could you could scan for everything, and you really could patch for everything. 00:13:28.799 --> 00:13:29.360 Yeah. 00:13:29.679 --> 00:13:30.879 You you really could. 00:13:31.120 --> 00:13:38.080 Over the years, the environments got so big, the number of bones got so big, where now you really just can't. 00:13:38.240 --> 00:13:42.480 But I think that culture stuck that scan and patch everything. 00:13:42.639 --> 00:13:48.240 I mean, before then you know, we when we figured out earlier that we couldn't patch everything, then we prioritized. 00:13:48.399 --> 00:13:51.200 You have to patch everything but in this order. 00:13:52.080 --> 00:14:00.159 And right now, well, but we we drew this again, it's it's criticals, highs, mediums, lows, and then everything else. 00:14:00.399 --> 00:14:21.519 And and rather than taking it as a I think rather than looking at it from a rational, like what is going to cause the damage perspective, we and

Rob, we talked about this, like the whole the fact that you know scoring is an absurd black magic that is it's also wrong, for instance. 00:14:21.759 --> 00:14:27.519 We I think there's a many vulnerabilities that have no score at all that are currently being used by the financial adversaries. 00:14:27.759 --> 00:14:29.039 None of no score. 00:14:29.519 --> 00:14:30.320 Oops. 00:14:30.559 --> 00:14:37.039 Um so uh the the the the ins I think the incentive structure is completely broken too. 00:14:37.120 --> 00:14:39.039 Like we you Jemai, you're you're right. 00:14:39.360 --> 00:14:46.799 In that went back a long, long time ago, when you could when somebody asked, hey, where are all the computers in this company? 00:14:46.960 --> 00:14:58.320 You could go, there they are, yeah, and there's my T1, and there's my firewall at the end of it, uh, in between that the internet and us, and I can I can put my you know, I can go touch all the stuff. 00:14:58.399 --> 00:15:01.440 But that that that ability disappeared real fast. 00:15:01.759 --> 00:15:03.360 Long ago, long ago. 00:15:03.600 --> 00:15:14.000 Right, and nothing's and we have we haven't like the the the the practices of invulnerabil vulnerability management remediation hasn't evolved at all. 00:15:14.240 --> 00:15:31.279 Safe to say in the like prioritization space, but like prioritize prior trying to prioritize 10 million things feels like trying to turn to Titanic with a teaspoon, and it's just it like it is categorically failed. 00:15:31.360 --> 00:15:35.440 Like there's nothing that's gonna convince me that we've done a reasonable job anywhere. 00:15:35.840 --> 00:15:49.519 Well, historically, we we didn't know who the bad guys were, we didn't know we're gonna show up, we didn't know their level of sophistication, we didn't know what they're what they're gonna hit, they didn't know, we didn't know what exploits they were gonna use against us, we didn't know a lot. 00:15:49.679 --> 00:15:56.000 So, all of cybersecurity, all of our standards, practices, best practices is all against all those unknowns. 00:15:56.240 --> 00:16:00.559 Protect everything against everything at all times, especially the super hacker. 00:16:01.120 --> 00:16:05.519 It was a large guess because we were blind to all the actuarial data. 00:16:05.679 --> 00:16:06.799 That was before. 00:16:07.039 --> 00:16:08.879 Now we have actuarial data. 00:16:08.960 --> 00:16:20.480 We know who the adversaries are, we know their general level of sophistication, we know what phones they use, we know the types of systems they target, we know the industries that they target, we know the lost data, we know exactly what to do. 00:16:20.799 --> 00:16:25.519 The only question is will we do it a more evidence-based approach? 00:16:25.679 --> 00:16:29.840 That is what we can actually hold on. 00:16:30.080 --> 00:16:32.320 So Jared, this is probably a good time. 00:16:33.440 --> 00:16:36.399 So we we've we've been talking about this internally. 00:16:36.559 --> 00:16:47.519 At some point, let's say the Vulhampocalypse continues and we continue to see this rapid increase in new CDEs being created, not utilized, just created, right? 00:16:47.840 --> 00:16:50.559 I think everyone can agree that's actually happening. 00:16:51.600 --> 00:17:02.240 So at what point does the cost of goods sold for the average, you know, very large vulnerability management company start going up to the moon as well? 00:17:02.480 --> 00:17:12.559 And at what point do they get so expensive that people literally can't afford them, like except for maybe a handful of very specific machines? 00:17:12.799 --> 00:17:21.279 And therefore they become all but useless until they realize, oh shit, we really need to prioritize and only look for the things that matter. 00:17:21.680 --> 00:17:24.240 Like eventually everyone has to come to where we are. 00:17:24.319 --> 00:17:25.680 We're just already there. 00:17:26.079 --> 00:17:26.799 So you're right. 00:17:27.039 --> 00:17:34.079 So I I think it's an interesting point you make that you didn't you didn't say this out loud, but I think it bears putting this out there. 00:17:35.039 --> 00:17:45.039 I I think there may be a misconception that that's been following us for a long time that all the scanners, vulnerability scanners out there scan for like all the known bones, and they don't. 00:17:45.440 --> 00:17:45.680 Right? 00:17:45.759 --> 00:17:56.079 They scan for some small subset that they think is important and that they can re reliably and reasonably find in you know in networks. 00:17:56.559 --> 00:18:00.640 So you're still not like no matter what, you're not getting the whole thing. 00:18:00.880 --> 00:18:12.400 You're getting somebody's version of what they believe is important against a scoring system that some person believes is important that's created some math to prove it. 00:18:12.720 --> 00:18:16.240 Well, but even that even that limited list is still far too long. 00:18:16.559 --> 00:18:18.559 It's it's two it's two guesses. 00:18:18.720 --> 00:18:25.119 I'm going to guess at which ones I have to scan for, and I'm gonna guess the relative severity of them. 00:18:25.359 --> 00:18:28.319 There's no hard data behind any of this, it's all just guesses. 00:18:28.640 --> 00:18:32.000 What we're saying is like we just wrote a book about it, it's called The End of Guessing. 00:18:32.079 --> 00:18:33.519 How about we don't guess anymore? 00:18:33.680 --> 00:18:35.440 We know what the bad guys are using. 00:18:36.480 --> 00:18:38.720 And they're not using new stuff every day. 00:18:38.960 --> 00:18:40.880 Just fix the ones that they're using. 00:18:40.960 --> 00:18:42.400 There's 619 of them. 00:18:42.559 --> 00:18:43.920 We know the exact number. 00:18:44.240 --> 00:18:48.400 Fix those, force a shift, force an expense onto the adversary. 00:18:48.480 --> 00:18:50.079 It's the exact thing we haven't done. 00:18:50.240 --> 00:18:55.920 Imagine for a moment

that we have just talked with tons of cyber insurance carriers. 00:18:56.240 --> 00:19:06.880 They are suffering 30 to 40 percent of all their claims are remotely exploitable vulnerabilities, and it reduces down to 619 total CVEs. 00:19:07.039 --> 00:19:10.480 We're fixing the wrong ones in the wrong order. 00:19:10.720 --> 00:19:12.160 That's clear. 00:19:12.880 --> 00:19:13.359 Yeah. 00:19:14.480 --> 00:19:26.640 So this is this is a a long-standing thing that you guys have you guys have both said in different, probably going back 30 years, but the idea here is to make ratchet up the expense for the adversary. 00:19:26.799 --> 00:19:41.599 We have been doing a terrible job at that because you know it's it's widely been known, and I think it's now accepted that just because some exotic new vulnerability got announced yesterday doesn't mean anybody's gonna go try to do that. 00:19:41.680 --> 00:19:56.480 And adversaries very rarely go spend their own money to go buy a zero day that nobody else knows, likely because the target they're trying to exploit has so many much easier targets, right? 00:19:56.640 --> 00:19:59.599 That they can just simply hit that don't cost them anything. 00:19:59.839 --> 00:20:01.599 It might even be simpler than that. 00:20:01.759 --> 00:20:05.279 What they're doing is working, they don't even pay attention to the other stuff. 00:20:05.440 --> 00:20:07.519 When it stops working, they'll buy another tool. 00:20:07.599 --> 00:20:08.079 That's it. 00:20:08.160 --> 00:20:10.400 There's there's no more calculus than that. 00:20:11.599 --> 00:20:12.079 Yeah. 00:20:12.960 --> 00:20:18.319 So if we ratch up, so okay, we we we we you said 617. 00:20:18.400 --> 00:20:18.880 Is that the number? 00:20:18.960 --> 00:20:20.880 Is that the number you use 619? 00:20:21.680 --> 00:20:23.119 619, fine, six nineteen. 00:20:23.519 --> 00:20:26.640 I as a as a as a company fix all 619. 00:20:26.880 --> 00:20:28.880 All my peers start to get towards that. 00:20:29.200 --> 00:20:31.839 Does the then the adversary then shift to another? 00:20:32.079 --> 00:20:35.920 Does that now do we keep playing the um we don't we don't know? 00:20:36.079 --> 00:20:44.960 I mean they they could shift to other vulnerabilities, uh, they could shift to entirely new forms of attack that we've never seen before. 00:20:45.119 --> 00:20:49.920 They could you start utilizing AI, which they are actually not doing right now. 00:20:50.160 --> 00:21:04.160 They could switch to other areas like uh Web AppSec, for instance, which they've kind of ignored for a while, um, or entirely new areas or double down on places that are very successful already, like phishing or drive-by downloads, that kind of thing. 00:21:04.319 --> 00:21:06.160 So there's a lot of options. 00:21:06.640 --> 00:21:10.799 But we haven't made them shift from CVEs at all. 00:21:11.119 --> 00:21:15.519 I mean, they're they're still running rampant there, so why would they shift? 00:21:16.480 --> 00:21:20.960 Yeah, why would anybody shift if if what they're doing is cheap and working? 00:21:21.440 --> 00:21:23.759 Right and and isn't getting them caught, right? 00:21:23.839 --> 00:21:25.599 They're not go, they're not getting busted. 00:21:26.640 --> 00:21:29.359 Very small half-oR, but most of them are not. 00:21:29.759 --> 00:21:35.920 So, in our view, in the case of voe management, scan everything for at least the bones that matter every single day. 00:21:36.240 --> 00:21:37.279 Force the shift. 00:21:37.359 --> 00:21:42.960 And since we're only talking about 619, use your excess patch capacity and make some guesses. 00:21:43.359 --> 00:21:49.119 Uh, vulnerabilities are exploited do cluster around a few characteristics by particular vendor, by class of attack. 00:21:49.200 --> 00:21:51.119 They do uh concentrate. 00:21:51.279 --> 00:21:54.480 You can make a guess with the patch capacity that you have. 00:21:54.720 --> 00:21:59.759 After that point, then you're gonna get a lot more bang from the buck after with canaries and networking. 00:22:00.160 --> 00:22:02.799 segmentation and MDR and things like that. 00:22:03.359 --> 00:22:07.279 But back to patching everything immediately. 00:22:07.680 --> 00:22:08.000 No. 00:22:08.319 --> 00:22:09.200 No, no, no, no. 00:22:10.640 --> 00:22:13.599 Go talk to it in a retailer around Christmas about that. 00:22:13.680 --> 00:22:14.480 Like, yeah, right. 00:22:14.640 --> 00:22:14.880 Yeah. 00:22:15.200 --> 00:22:15.359 Yeah. 00:22:15.440 --> 00:22:19.759 Anytime, anytime between the week before Thanksgiving to two weeks, two weeks after New Year's. 00:22:20.000 --> 00:22:25.440 And it it boggles the brain because this is this is a our reputation on the line here. 00:22:25.519 --> 00:22:32.079 When cybersecurity is telling the head of IT to patch everything at all times, that's a reputational hit. 00:22:32.319 --> 00:22:34.400 Everybody knows you can't do that. 00:22:34.880 --> 00:22:35.839 It's not worth the risk. 00:22:36.000 --> 00:22:39.359 You will risk the hack rather than risk a self-inflicted harm. 00:22:39.519 --> 00:22:41.359 Which one do you want to go to the board with? 00:22:41.839 --> 00:22:42.079 Yeah. 00:22:42.319 --> 00:22:42.640 Yeah. 00:22:42.799 --> 00:22:50.640 Well there there's two there's two possibilities here when you when you say that we must do this or bad things will happen. 00:22:50.880 --> 00:22:55.119 You do it and bad things still happen or you don't do it and nothing happens. 00:22:55.279 --> 00:22:58.640 Both of those are equally terrible for us from a reputational perspective. 00:22:58.960 --> 00:23:05.839 Well you know the in the case the business doesn't really care about so much the reputation of the cybersecurity professional. 00:23:05.920 --> 00:23:06.960 They care about downtime. 00:23:07.119 --> 00:23:08.880 They care about financial loss. 00:23:09.119 --> 00:23:18.640 And let's can we do can we if we're going to talk about Vaughns and patchy and whatever

else we're going to spend on let's talk about it in terms of financial loss. 00:23:18.799 --> 00:23:25.519 Like you know if we want to cover a little bit different topic here, this is the the thought exercise I run everybody through these days. 00:23:25.680 --> 00:23:36.720 If you go to RSA and Black Hat, you stand on the show floor, you look at every single product and service out there, what percentage of them if they work perfectly as advertised lower financial loss? 00:23:38.240 --> 00:23:42.960 The highest answer, you know, the average answer that I get amongst security pros is 20%. 00:23:43.839 --> 00:23:46.400 Yeah I'm degenerate similar answers. 00:23:46.720 --> 00:24:00.240 And and then if you ask them when products when you when you invest money in developing a cybersecurity product does most of your dollars go towards feature parity with the competition or disrupting the bad guy? 00:24:00.559 --> 00:24:02.880 Everybody says feature parity. 00:24:03.200 --> 00:24:10.640 So all of a sudden we have an entire industry of malinvestment because we haven't focused on the one thing that matters financial loss. 00:24:14.640 --> 00:24:39.119 I tell you guys like this is this is something that has bothered me for a long time in that the entire industry as it has exploded over the last 15 years like it it feels like every year something new comes out and there's 15x of it more than there should be they are all playing catch up with each other. 00:24:39.359 --> 00:25:14.559 So whoever is the standard bearer whoever gets to market first with something they can convince an analyst is important some new thing everybody tries to copy them and catch and do a feature parody or a one up on them like I have yet to see a true analysis by an analyst firm that would tell me not which of these is better but which of these is relevant this goes to what's called the what I call the lack of negative feedback loop. 00:25:16.319 --> 00:25:41.839 What analyst would tell the enterprises that buying this entire category let alone a particular product is a complete waste of money well that's part of the like the terrible incentive structure this whole industry is built on the we're we're pharmaceuticals again right like forget curing you buy more vitamins and and and pain meds like you'll feel better it it'll make you make you feel better. 00:25:42.000 --> 00:25:43.119 Never mind that you're dying. 00:25:43.359 --> 00:26:00.799 And and that's the issue right there our industry for the moment for the moment lacks a negative feedback loop for for wasteful spending if you if you spend money you didn't need to spend and nothing happens you could say the product worked or it could be that the product wasn't going to do anything anyway. 00:26:01.200 --> 00:26:08.240 Well I I this is also a particular soapbox of mine but like the measurements behind it suck. 00:26:08.319 --> 00:26:22.480 How do you tell if any of this stuff works you can the feedback loop from the DFIR guys and the reinsurers and insurers gives us a really good sense of what does and doesn't work with a couple of caveats. 00:26:22.960 --> 00:26:30.079 But I don't hear that out there in the industry with it because there's they have no interest in telling the market when they're wasting money. 00:26:30.240 --> 00:26:44.319 They have the data but they why should they carry or tell their customers when they're wasting money I mean I think why would the analyst jeopardize future revenue to say that this product definitely doesn't solve any problems. 00:26:44.720 --> 00:26:49.839 We believe there's a way around this to give me a way around this chair. 00:26:50.240 --> 00:27:06.480 Well warranties come up yeah okay so talk to me about warranties because warranties in cyber are always interesting to me because you're saying you're basically saying I'm I think I know the solution and I'm willing to put real dollars behind it. 00:27:07.200 --> 00:27:22.480 So let's say you go to the business and you say because if I don't have to invest money developing a product for feature parity that has no relevance to the adversary whatsoever, my focus is purely on disrupting the bad guy, purely on lowering your financial loss. 00:27:22.640 --> 00:27:29.200 I can make a very laser focused product that just does one thing incredibly well protecting you from the adversary. 00:27:29.359 --> 00:27:37.599 It'll cost less it'll be faster low impact and should anything happen I will cover the first$5 million on your breach costs. 00:27:37.759 --> 00:27:39.839 We've built that we've done that. 00:27:40.000 --> 00:27:42.960 And it's not like the insurance carriers are agreeing with us. 00:27:43.119 --> 00:27:44.079 We're agreeing with them. 00:27:44.240 --> 00:27:46.880 We're just scanning for the things that they already know. 00:27:47.119 --> 00:27:49.039 That's how we're going to get there. 00:27:49.440 --> 00:27:58.640 If the business still wants to spend double triple or whatever on something else cause themselves a lot of pain with no financial downside protection that's on them. 00:27:58.960 --> 00:28:20.640 But we have something different so how do you backstop that because that's like if you're wrong that's that's a lot of million times five it's this that's it's for the very same reason that you can get every company is buried in volunteers we know this right and every company can get cyber insurance today. 00:28:21.599 --> 00:28:23.039 How does this work? 00:28:23.359 --> 00:28:35.119 Like so what we're finding is that these are the vones that matter we'll cover the financial loss because we know if you fix those you're not going to have a loss statistically unprobable. 00:28:35.279 --> 00:28:42.799 And our liability is transferred to the insurance carriers we're not holding the bag bag here we we're we're not betting the farm on here. 00:28:42.880 --> 00:28:47.920 This is the same model we've been using for the last decade or more they know we're right because it's

their data. 00:28:48.160 --> 00:28:49.119 It's their data. 00:28:49.359 --> 00:28:50.480 Oh that's interesting. 00:28:50.640 --> 00:28:50.960 Okay. 00:28:51.279 --> 00:29:01.200 I hear you because here here's here's the challenge with the cyber insurance carriers and they'll tell you straight out they can't tell their customers what to do because what they call is a soft market. 00:29:01.440 --> 00:29:09.759 If the their carrier tells you what to do you'll go use another carrier because that carrier will write a policy that's not the same for us. 00:29:12.960 --> 00:29:14.000 That makes sense. 00:29:14.240 --> 00:29:22.799 Okay so this is this is a little bit different than where what I was thinking that would that was going to be interesting. 00:29:24.880 --> 00:29:38.799 So where do you get the data on like real working data on what's actually being exploited are the carriers tracking this yeah they they have to track it it's in their financial interest to track it. 00:29:39.039 --> 00:31:05.680 So a claim a breach happens a claim comes in their DFIR teams internally externally get deployed they do a root cause analysis in the cases that say remotely exploitable vulnerability was the initial point here's the here's the CVE number and they send it to us okay okay is this is this a consortium of carriers is this a universally accepted practice among the carriers to share this data no it's a it's it's all brand new yeah we're we're definitely breaking breaking ground on this one um okay we we've been working on this for two or three years collecting all this data from them we were the first ones to ever ask you know you can't get the right answer unless you ask this is interesting because you're now giving focus to something that has been chaotic best effort chaotic before up until I mean still is right up until now largely focusing chaotic what's the best possible outcome for you guys that you from an industry perspective we've we've gone through this a many times we were we you know we did whitehead security together and at some point we pushed AppSec so high that the adversary shifted and they went to ransomware you know they they shifted tactics I did Sentinel one and helped them and helped them out. 00:31:05.759 --> 00:31:10.880 I didn't found the company obviously but I helped them out with ransomware before ransomware was a thing. 00:31:11.119 --> 00:31:35.440 And if you notice those companies they still they have issues like no product is perfect but the adversary from there got pushed to CDEs where we land now we do have the ability with the right solutions to chase the bad guy from attack type to attack type and we believe very strongly we know how to go after the right vulnerabilities that forces a shift forces the their cost to go up. 00:31:35.920 --> 00:31:40.720 We're actually optimists believe it or not uh we have enough data now we know what we're doing. 00:31:40.960 --> 00:32:42.160 Yeah like once we figured out you don't have to

patch everything at all times you're like wow this is this is doable that feels like that that feels like to me there are going to be some very hurt feelings in in in in and around this space because this is the this is the I don't want to say snake oil but I'll say snake oil that they've been selling their customers for 15 to 20 years and suddenly somebody new shows up and goes that's bullshit only one percent of this I've been having this conversation with Jar on and off for the last two years like we're going to make a lot of enemies well they didn't know at the time they they did their best guess they didn't know I don't know now we know now we know more like the carriers didn't have the data five years ago they didn't now they do like we yeah the industry made its best guess it just unfortunately was wrong and now it's the actuario era let's let's let's chase it I'm looking forward to we're not we're not we're not we're not we're not exclusive over this data. 00:32:42.480 --> 00:32:44.799 Okay actually everybody else can go to go do it. 00:32:45.039 --> 00:33:04.000 Well I think this dovetails into the to the webinar we did earlier but there are things our industry are doing that is absolutely their fault like calling O days other things other than O days I mean that there's some real big things out there saying that the adversaries are speeding up with no data to back any of those statements up. 00:33:04.559 --> 00:34:07.839 Yeah well you've got to the hype train has to listen this is this is the classic problem right it's it's it's the same in politics as it is in cyber as it is in in the news you have to keep ratchet up the the the the rhetoric the the you know it today it's you know it's bullets tomorrow it's nuclear weapons and after that it's bio thermo nuclear warfare because that's what's coming to sell you the next thing I have to scare you with something bigger and worse than yesterday but the problem continues to be the stuff that worked 20 years ago actually saw a so total sidebar but actually very recently saw evidence at a past employer where we had access to this of a vulnerability being scanned for that was older than my kids yeah I believe it yeah there are vones there are bones that are being utilized that are 20 years old now by the which like are you serious? 00:34:09.039 --> 00:35:03.760 And the question was like we all sat around table sort of looked at the data and we're like are they kidding me like and somebody asked the question like well are they wrong and the and the answer I think quite quite honestly is no because why would somebody spend their time scanning for something that didn't work like somewhere out there there are enough systems that that are 20 years old that still have a missed that have a patch that's not applied that makes this attacker's time to go scan for them worthwhile and that is a brain breaking thing right because whether you're talking about like all the all the municipal water systems that

people are kind of losing their minds over right now right that's like I've seen NT4 in those environments because it works and nobody has the time or or money there's no you know there's no profit in in running a municipal water treatment facility. 00:35:04.159 --> 00:35:43.119 Well to your earlier point there will you know the data that we're bringing up the concepts that we're voicing we're we're used to it we will hurt feelings but we're we're in it to protect our customers that's why we're we're in this and here's the thing what's wrong with cybersecurity vendors sharing financial risk with their customers who is really going to speak against that let's find out what's what's the problem with this you're asking them to pay a bunch of money and then spend a bunch more money doing the stuff you believe you don't know you believe is wrong with no evidence to back it up. 00:35:43.280 --> 00:36:29.519 This is wrong we have to do better it's amazing what kind of behaviors can be driven from empirical evidence that stands on its own, from data that doesn't need interpretation right and I think that's been the hard part is we've had we'll say selective data that's been largely open to interpretation but I think as this as we mature this is a this is a this is I think long time coming as we mature as a as a practice right as cybersecurity because we are the youngest part of IT I think at this point right like we we as a practice you know cyber has is is not I think AI might might be a bit younger well okay fine but that's that's a separate thing. 00:36:29.679 --> 00:37:26.239 Okay fine AI but cyber is relatively new in the in the expanse of technology right and we were inevitably going to have to go through that like awkward teenage phase where we don't quite fit in like we look at the you know where we've come from we go wow glad I'm not that anymore and we look at where we're going to I feel like this is going to be a a relatively difficult transition because there's going to be security programs in the enterprise that are fundamentally going to have to change and if you're not there as a CISO or as a director or whoever runs this program if you're not able to articulate correctly why the change is happening it is going to be scary and it's going to feel like you're going to go tell your boss that you've been screwing around for the last 20 years and now it's a you know oh I I need to go do something different. 00:37:26.320 --> 00:37:32.719 Well why I think Jerry you said it best right the and the data is now available it wasn't available earlier. 00:37:33.119 --> 00:37:41.360 But now is the time to make that change because if you don't then this starts to sound like that net word that rhymes with negligence. 00:37:43.599 --> 00:37:50.159 I mean yeah I mean it's just there's a big opportunity here to where we can actually make an impact as an industry. 00:37:50.320 --> 00:38:04.079 We can figure out what works we can figure out what doesn't work the data is there we can share risk with our customers this whole market is disruptible there's 200 billion spent every year and it's up for grabs now because all of it was based upon a guess and we know the guesses were wrong. 00:38:04.320 --> 00:38:32.719 So for for anybody out there for startups or the or the big uh the big security vendors the game is on now we we can do this I mean we're we're supposed to be reducing financial loss here if you read the metrics in the industry if they're to be believed are we spending 200 billion a year to lose a trillion is that is that what we're doing here and are we you know we we just said a moment ago that you know everybody thinks mo about 20% of our products work. 00:38:32.880 --> 00:39:44.239 That means if you're pitching your product to your peers four out of five of them think you're it's worthless I mean come on we we could do a lot better than this I I hope we do I I really hope we we we get to a point where that what we do on a daily basis whether it's vulnerabilities ai whatever is is much more data driven than it's been in the past i i i'm glad you guys are doing this i i want to come back in in any you know six months a year and figure out like all right how are you getting on because uh adoption is going to I think adoption is going to be interesting we're we're we're we're a month we're a month we're we've spent a year building the product we raised money a year ago our one year anniversary or our GA was a month ago and we are already crushing it people want this it would seem a little insane of somebody to say I know what's going to you know I I know the safety features that I should be using because there's data for it but you know what YOLO I want to keep doing the thing that I've been doing like this that that seems like the definition of insan insanity that Einstein said. 00:39:44.559 --> 00:39:56.159 Well just real quick on that we we in Vole management we found two different religions and there's they they kind of are religions there's the ones that really want to there's the security departments that want to tell IT to fix all volans at all times. 00:39:56.400 --> 00:39:58.320 There's really they want that to happen. 00:39:58.559 --> 00:40:09.519 And then there's the other ones that know that all these volunteers there have they're not patched they haven't been patched but it's on their dashboards and they have to report to the board why 100 million vulnerabilities aren't fixed. 00:40:09.679 --> 00:40:18.159 They want a valid reason why these don't have to be fixed a way to say those can wait forever if necessary. 00:40:20.400 --> 00:40:32.000 Well actually well there's one kind of negative incentive that's worth calling out here if you're a CISO and you're in a position where you have to make that decision, are you playing with your chips or are you playing company chips? 00:40:32.159 --> 00:40:39.360 Because if you're playing with your chips you're going to go, hmm, I really do

not want to get fired, but I also have a limited budget. 00:40:39.519 --> 00:40:44.559 I'm gonna work within the constraints I'm working for the betterment of the company and the upside of the company et cetera, et cetera. 00:40:44.639 --> 00:40:55.679 If you're playing with the company's chips, you'll say fix everything because any risk at all I'm not going to expose myself and I don't care how much the company loses to have to get there. 00:40:55.920 --> 00:41:22.800 And so I think I think that there isn't a negative feedback loop unfortunately to to weed out that behavior uh which is why you're saying spend in the billions of dollars literally for things like mythos but I think over time eventually the CFO is going to say what do we get for spending two billion a year on this like I think that I think that that's our I think that that's start that's been happening for a while. 00:41:22.960 --> 00:41:34.159 I think we've the the hand wavy smoking mirrors don't look over here look at how bad this is stuff right the jazz hands has has worked and then has been losing its luster and fade over time. 00:41:34.320 --> 00:42:34.639 I think the biggest risk if I'm totally honest right now to a CISO is that they've gone and created this must patch like you said Jared must patch everything all the time they have they now have this mandate that they've been driving and to go back to those people and say I was wrong the the the shift there's a shift now we're gonna go do this small sub section I think a lot of that has it feels like it feel it isn't but it feels like I was wrong I have to accept defeat it's not we're pivoting based on available data and like in new intelligence but there's this is this is going to be a shift I think for a lot of people and it could be very difficult because again you're telling your board you know you've been fighting that that battle of like here we got to fix these 500 and they've got this scorecard that says there's 5,000 there's 4000 there's three thousand there's nine thousand there's two thousand and now you're like 12 well like wait a minute. 00:42:34.960 --> 00:42:43.360 At some point the conversation's gonna be had because the CFO will ask the CISO why isn't our insurance carrier making us fix all this stuff? 00:42:43.440 --> 00:42:45.440 They're giving us a policy anyway. 00:42:45.679 --> 00:42:49.760 I mean that's gonna be a really uncomfortable conversation if you don't have a good answer. 00:42:50.000 --> 00:42:54.400 Like you know that these policies are getting into multi-billions and they're cheap. 00:42:54.559 --> 00:42:57.360 It's like 5% premium for the liability limit. 00:42:57.440 --> 00:42:59.119 I mean it's it's cheap. 00:42:59.360 --> 00:43:16.559 So why why do you want me to spend another hundred million dollars patching when our downside is protected explain this to me or or a billion yeah like seriously we're talking to companies who are spending a billion or more a year on SAST. 00:43:16.800 -->

00:43:17.840 Like what are you doing? 00:43:18.159 --> 00:43:41.599 Are you are we removing a billion dollars of liability because otherwise you're wasting company money well did you make a billion and more sales because of this this strategy I don't think so when you're when you're playing with house money and and what's happening in security is so far disconnected what's happening with the company's bottom line we've become sort of numb to this that it's acceptable that these things are out of whack. 00:43:41.760 --> 00:43:59.599 Now what you're saying is I now have evidence for what parody like what we should start spending and and working on like this is gonna hurt this is going to hurt people and they're gonna be mad that you're you know you're giving them an alternative and why why would they like this is going to shift some some we're we're excited about 00:44:00.159 --> 00:44:03.440 By it really, because we get to spend more efficiently. 00:44:03.519 --> 00:44:11.920 We have a really interesting story to tell, a really interesting perspective with data behind it that we can tell it's different from everybody else out there. 00:44:12.400 --> 00:44:14.000 Yeah, that that's the key there. 00:44:14.159 --> 00:44:16.079 We have data, we have receipts for all this. 00:44:16.159 --> 00:44:19.039 So it's not like we're just we have an opinion. 00:44:19.199 --> 00:44:23.519 This is like what this is what we're getting from people who actually have to pay out. 00:44:23.840 --> 00:44:25.679 Yeah, that that's the that's the catch here. 00:44:25.920 --> 00:44:38.079 This isn't just another company with an idea to make money, although it is, but you but this is based you guys are basing this on like real this is the problem according to insurance companies. 00:44:38.239 --> 00:44:41.440 This is the problem we're going to solve, and those circles overlap. 00:44:41.920 --> 00:44:46.800 Not a little bit, not like we think they overlap, but you could actually show how they overlap. 00:44:48.000 --> 00:44:48.719 I'm excited. 00:44:48.800 --> 00:44:49.280 All right, cool. 00:44:49.440 --> 00:44:50.639 You guys are always doing some cool shit. 00:44:50.719 --> 00:44:53.519 That's that's really and thank you. 00:44:53.679 --> 00:45:01.199 And we're also not in the position, we're not telling you you don't you can if you want to keep spending money over there, you can. 00:45:01.840 --> 00:45:04.800 We're saying right here, do this. 00:45:05.199 --> 00:45:09.679 Yeah, you you can keep doing the stuff, but this is the part that matters, yeah. 00:45:09.920 --> 00:45:10.320 Right? 00:45:10.719 --> 00:45:12.079 So, all right, well, cool guys. 00:45:12.159 --> 00:45:13.840 I I'm out of time, but this has been fun. 00:45:14.000 --> 00:45:15.840 I appreciate the uh the insight. 00:45:16.159 --> 00:45:35.199 This is so let me ask, do you guys do you guys actually believe that that uh in like 30 seconds or less that as these crazy new what seems to be overhyped and overmarketed AI models keep getting released by vendor by these two big vendors that try to keep one-upping each other? 00:45:35.440 --> 00:45:48.159 Are we gonna drive are we ever actually gonna get it get to a point where we're gonna drive the vulnerability the cost of identifying new vulnerabilities that'll actually blow some of this model that you guys are having up away? 00:45:48.800 --> 00:45:50.800 There's no data to indicate that. 00:45:51.119 --> 00:45:53.199 Tools are already in the hundreds of dollars. 00:45:53.360 --> 00:45:56.159 Make what is making it cheaper matter. 00:45:56.880 --> 00:45:57.679 Yeah, fair enough. 00:45:57.920 --> 00:46:02.880 You go into the block, you go on the dark web right now and buy a few hacking tools for a few hundred couple of grand. 00:46:03.599 --> 00:46:04.960 Drive it down to what? 00:46:05.360 --> 00:46:05.920 Yeah, yeah. 00:46:07.039 --> 00:46:07.920 We're not seeing anything. 00:46:08.079 --> 00:46:11.519 In fact, uh Robert, tell them what you've asked, been asking the carriers. 00:46:12.559 --> 00:46:18.719 I asked eight different carriers how many losses they saw that have been at all attributed in any way to AI. 00:46:18.880 --> 00:46:24.239 And if you exclude phishing, because that's that's a that's a real thing, yeah, the answer is zero. 00:46:26.159 --> 00:46:27.199 All eight of them is a lot of things. 00:46:27.360 --> 00:46:32.079 Oh, that's a that's an entire podcast entirely on its own, because I've got some thoughts on that. 00:46:33.119 --> 00:46:37.519 I mean, there's holes in the data, but but still, like they're not seeing anything. 00:46:37.679 --> 00:46:40.000 No, no increase to anything. 00:46:40.159 --> 00:46:41.519 Not not one. 00:46:41.760 --> 00:46:49.679 In fact, the the closest thing that anyone could come up with was well, sometimes the frontier models get sued because they're scraping too much. 00:46:49.840 --> 00:46:52.960 I'm like, that doesn't, that's not what we're talking about here. 00:46:56.159 --> 00:47:03.039 The interesting thing, the follow-up to that is, and we can just keep going with this, but I think we'll stop here, is like, how would we even know at this point? 00:47:04.320 --> 00:47:05.199 There's there's signals. 00:47:05.360 --> 00:47:06.079 There's signals. 00:47:06.960 --> 00:47:15.440 But you're but you're but you're you're right to be skeptical and there's holes in the data because DFIR can't do as good a job as we'd all like them to do. 00:47:15.840 --> 00:47:25.199 Part of the next conversation, Robert has a great theory, and I'm on board with it, is that the use of AI for the adversaries, unless they're very careful during the attack, it's an evolutionary dead end. 00:47:25.440 --> 00:47:28.800 Using AI will get you caught, which is all of what we've been seeing. 00:47:30.880 --> 00:47:32.480 That's an interesting thought to end on. 00:47:32.559 --> 00:47:33.440 Gentlemen, thanks for your time. 00:47:33.519 --> 00:47:34.079 I appreciate you. 00:47:34.159 --> 00:47:36.000 This has been an interesting conversation. 00:47:36.159 --> 00:47:39.840 All right, tell me, tell me the uh web uh company people to go what website to go check out. 00:47:40.079 --> 00:47:41.360 Rootevidence.com. 00:47:41.760 --> 00:47:42.400 Roote evidence. 00:47:42.800 --> 00:47:43.840 Not dot AI. 00:47:44.800 --> 00:47:45.599 Negative. 00:47:48.079 --> 00:47:48.719 I love it. 00:47:48.800 --> 00:47:49.360 All right, guys. 00:47:49.519 --> 00:47:51.679 Rob German, thank you so much for joining us. 00:47:51.920 --> 00:47:53.760 This has been a lot of fun and educational. 00:47:53.920 --> 00:47:57.360 We'll definitely have you guys back because I want to I want to hear as this data evolves. 00:47:57.519 --> 00:48:00.880 Let's let's uh let's let's wait six, nine months and see what happens. 00:48:01.039 --> 00:48:02.480 I want to I want to see where this goes. 00:48:02.719 --> 00:48:03.199 Happy to. 00:48:03.840 --> 00:48:04.800 Gentlemen, thank you so much. 00:48:04.880 --> 00:48:05.440 Have a good one. 00:48:05.519 --> 00:48:06.400 Thanks, folks. 00:48:06.480 --> 00:48:07.360 Thanks for listening. 00:48:07.519 --> 00:48:11.519 This has been yet another episode of the Downtown Security Rabbit Hole Podcast. 00:48:11.599 --> 00:48:12.320 I hope you've enjoyed it. 00:48:12.400 --> 00:48:13.519 I hope you've learned something. 00:48:13.760 --> 00:48:18.400 Give these guys a listen and a follow, and I obviously go check out what they're doing. 00:48:18.800 --> 00:48:25.840 Evidence should lead the way, and we'll catch you guys another time, another place on another Downtown Security Rabbit Hole Podcast. 00:48:29.679 --> 00:48:30.320 This is Bella. 00:48:30.800 --> 00:48:31.440 Thanks for listening. 00:48:31.519 --> 00:48:34.719 Don't forget to leave my dad a review and share this with your friends. 00:48:34.960 --> 00:48:35.599 Bye.