文字稿 🔗
WEBVTT
00:00:29.600 --> 00:00:32.240
Hello and welcome to Full Tech Ahead.
00:00:32.399 --> 00:00:35.679
I'm your host, Amanda Razzani, and I'm doing something new today.
00:00:35.840 --> 00:00:38.000
I'm here at the Tech Conference.
00:00:38.079 --> 00:00:41.359
I'm at Qualis Rock on 2026 Americas.
00:00:41.439 --> 00:00:43.520
And I'm here with Sumed Takar.
00:00:43.920 --> 00:00:47.119
And I am so excited to have him with me here today.
00:00:47.359 --> 00:00:49.200
He was our keynote speaker.
00:00:49.280 --> 00:00:53.359
And with that, I'm going to let you introduce yourself and your background and a little bit about Qualas.
00:00:53.759 --> 00:00:53.920
Okay.
00:00:54.079 --> 00:00:55.439
Well, thank you very much for having me.
00:00:55.600 --> 00:00:57.280
And uh I'm Sumed Takar.
00:00:57.439 --> 00:00:58.399
I'm the CEO of Qualest.
00:00:58.479 --> 00:01:06.480
I've been at Qualas for 23 years, started as an engineer back in the day and had the privilege of leading the company as CEO the last six years.
00:01:06.560 --> 00:01:24.879
And Qualis is a company we are very well known in the field of cybersecurity, primarily around managing proactive risk from coming from cyber and helping organizations essentially think of risk management in the way that they look at losses to businesses.
00:01:24.959 --> 00:01:26.480
And that's really our focus.
00:01:26.879 --> 00:01:27.680
Wonderful.
00:01:27.920 --> 00:01:30.640
Well, there were some big announcements, but let's start.
00:01:30.799 --> 00:01:35.359
What was the overarching message at this conference that you wanted to really drive home?
00:01:35.680 --> 00:01:42.799
Look, I think the big message for the conference has been that AI is something that is prevalent now everywhere.
00:01:42.959 --> 00:01:50.000
And as your businesses are looking to leverage AI, attackers are also leveraging AI for their business, which is to get into your business.
00:01:50.079 --> 00:02:05.439
And so I think what we're seeing is a sort of a new acceleration in the way that attackers are creating attacks by leveraging AI to get into your organization and a high explosion in the number of vulnerabilities being detected in the software that we are using on a daily basis.
00:02:05.519 --> 00:02:15.199
And you know, just uh yesterday, the Pack Tuesday from Microsoft had uh almost 1400 CVE findings, which is quite different from what it used to be in the past.
00:02:15.280 --> 00:02:23.039
And so, as business leaders, teams are looking to figure out how do we deal with this big number of findings that are coming out.
00:02:23.199 --> 00:02:34.800
And really the big message from the conference has been that you just cannot fix everything, and you need to be able to figure out what actually causes risk to your organization and then focus on fixing that risk.
00:02:34.960 --> 00:02:37.919
But that then that risk needs to be fixed pretty quickly.
00:02:38.080 --> 00:02:59.439
And so the only way you could do that to fight the AI exploitation is with some form of AI-based uh remediation to fight back, and that's pretty much everything we're talking at the conference, is really about how do we get to the point where we are successfully and confidently able to leverage AI to do autonomous remediation at the speed at which AI attackers are coming at us.
00:02:59.759 --> 00:03:00.960
Yes, absolutely.
00:03:01.199 --> 00:03:10.240
And you spoke a lot about so many companies are in reactive fight or flight mode and wanting to be proactive.
00:03:10.400 --> 00:03:21.599
Can you share a little bit more about your advice to business leaders when it comes to being proactive, especially in this age of AI with the increased, large amount increased vulnerabilities?
00:03:21.919 --> 00:03:25.840
Yeah, see, the at the end of the day, why should you fix a vulnerability?
00:03:26.080 --> 00:03:28.879
That's because it could potentially cause a business loss.
00:03:29.039 --> 00:03:43.680
And so, where the focus for everybody needs to be not about the volume and the counts, is about how do we get to the point where we can quickly identify, and and we talked about this at the conference that typically less than 1% of the vulnerability findings actually create risk to the organization.
00:03:43.759 --> 00:03:46.879
So, how do we get to that risk quicker, faster?
00:03:47.039 --> 00:03:55.280
And then how do we leverage AI to uh be able to uh affect that remediation at the speed at which attackers are coming at us?
00:03:55.360 --> 00:04:11.919
And so I think the focus for enterprises really need to be how can they create a framework that allows them to very quickly and continuously look at these new threats that are continuously coming or the new risks that are coming and then figure out that 1% quickly and then fix that fast.
00:04:12.080 --> 00:04:24.160
And typically, this process of reactive risk management has been people build different dashboards and they send that those dashboards and tickets to people and that take time to fix, and there's a committee and approval.
00:04:24.319 --> 00:04:30.160
When we are talking about fixing the vulnerability in 24 hours, you don't have time for something like that.
00:04:30.240 --> 00:04:47.199
And so that's where the risk operations center that we talked about, which is the idea of creating a framework that allows you to repeatly and confidently figure out what matters to your business and then actually make sure that it gets fixed, is the focus that most business leaders need to have.
00:04:47.439 --> 00:05:01.519
Less about trying to figure out the counts and stuff, more about how can I operationalize my risk uh operations process in a proactive way instead of just waiting and reacting uh after the fact when something has has come out and has become a challenge for you?
00:05:01.839 --> 00:05:02.720
Yes, absolutely.
00:05:02.800 --> 00:05:12.800
And you mentioned, you know, focusing in on those 20 or 30 big ones and how there's
Load full transcript
just a never-ending, it seems a never-ending chain of attacks now with AI.
00:05:12.959 --> 00:05:13.120
Yeah.
00:05:13.360 --> 00:05:17.439
So how can people get in front of that and break that chain?
00:05:17.839 --> 00:05:22.240
Um, you know, sometimes the minor stuff gets overlooked, but how do they just break that chain?
00:05:22.480 --> 00:05:23.199
That's a great question.
00:05:23.360 --> 00:05:31.199
And I think that uh a breach is always a series of steps that the attacker has to take to have a breach, right?
00:05:31.279 --> 00:05:33.759
Just be an exploitation may not necessarily become a breach.
00:05:33.920 --> 00:05:44.160
And so what has changed really with AI is the volume of findings, but I'm not as concerned about that relative to the speed at which uh attackers are able to change these things.
00:05:44.319 --> 00:05:54.800
And so as an organization, if you want to be able to keep pace, we have to be able to do the similar strategies that attackers are doing, but do those safely in our own environment.
00:05:54.959 --> 00:06:08.959
So part of that really is uh setting up proactive processes that allow you to figure out which of your assets are important, which of them lead to business losses, which types of software is very important to you, and set up those rules.
00:06:09.040 --> 00:06:22.160
But then ultimately, after that, being able to kind of normalize all of your findings and then be able to get to the point where you kind of get them remediated and build the confidence in that remediation is kind of the focus that everybody needs to have.
00:06:22.319 --> 00:06:28.879
Again, doing that in the context of the business, I think that's that's really where I think that people need to focus on right now.
00:06:29.199 --> 00:06:31.600
And then you mentioned savings factor.
00:06:31.839 --> 00:06:39.279
How much will a business save if they do this with that new strategy, approach it from that new strategy?
00:06:39.839 --> 00:06:44.639
Look, I think uh automation always helps uh bring costs down, typically, right?
00:06:44.800 --> 00:06:50.800
And so building the confidence in the automation is gonna help you achieve broader scale at a lower cost, right?
00:06:50.959 --> 00:07:07.279
And I think that's where organizations uh, if you know, cybersecurity, especially in the vulnerability management side, you could fix 10,000 findings and make no impact to your risk of a breach, or you could fix like 30 and that could actually be a major uh impact.
00:07:07.439 --> 00:07:15.199
And so you can see the cost difference trying to fix 10,000 as an emergency patches versus 30 is a big difference, and the outcome is very different.
00:07:15.279 --> 00:07:33.519
So I think overall I believe that organizations can really tighten their spend into more measurable outcomes if they approach take the approach of the risk operation center versus you know it's it's a it's very disruptive for dev teams and IT teams when they have to keep dropping
what they're doing and keep applying security patches.
00:07:33.680 --> 00:07:53.120
So I think an approach that says, look, the less than 1% vulnerabilities high risk if we can get those fixed in a bit of an emergency, which is a much smaller number, but then the rest of the issues can be upgraded software or updated software in the next update cycle that IT or dev has already planned is a big saving.
00:07:53.199 --> 00:07:57.120
So now you're not having to go out of your way and disrupt a bunch of people.
00:07:57.279 --> 00:08:01.279
And the less vulnerabilities that you have to fix, that's a big saving for the organization.
00:08:01.439 --> 00:08:08.720
So I think taking a proactive risk operations approach is going to help you overall manage uh your spend.
00:08:08.879 --> 00:08:28.959
And uh, more than the spend, I think if you can give you know four hours back to your dev teams uh every week or four hours back to your IT teams, they can actually spend that and doing things that will actually help your organization get ahead in in a competing world rather than having to sit down and fix all these findings, which ultimately may or may not even have an impact for you from a security perspective.
00:08:29.279 --> 00:08:30.079
Absolutely.
00:08:30.240 --> 00:08:33.759
Well, as we can see, AI is advancing so rapidly.
00:08:33.919 --> 00:08:35.759
Now you have quantum looming.
00:08:35.919 --> 00:08:40.320
What is your advice to business leaders to be prepared for the future?
00:08:40.720 --> 00:08:45.279
Look, I think technology has been there and technology will come and technology will go.
00:08:45.679 --> 00:08:52.159
I don't think it really ever goes because we can we're still 70% of our airline reservation systems are still running mainframes.
00:08:52.320 --> 00:09:00.799
But I do think that the no matter what technology comes, that technology is used to advance the business in a competitive environment ultimately, right?
00:09:00.879 --> 00:09:04.080
Whether moving to the cloud or AI, uh when AI came.
00:09:04.240 --> 00:09:08.960
And I think quantum is gonna be another risk that is going to come because encryption is super important.
00:09:09.120 --> 00:09:11.200
The questions are always the same though, right?
00:09:11.279 --> 00:09:15.840
When you have a new risk come up, first question is well, how what does that mean to my business?
00:09:16.000 --> 00:09:18.320
How much loss could I have if this happens?
00:09:18.559 --> 00:09:25.440
And then the follow-up questions are always the same, whether it's AI, whether it's cloud, whether it's uh quantum, where do I have it?
00:09:25.600 --> 00:09:28.879
How do I assess that it's uh correctly implemented or not?
00:09:29.039 --> 00:09:31.600
How do I prioritize the ones that actually matter to me?
00:09:31.679 --> 00:09:33.279
And then how do I get it remained to it?
00:09:33.519 --> 00:09:37.039
And that framework doesn't change no matter what new technology comes in.
00:09:37.200 --> 00:09:53.039
So I think in my mind, creating that risk operations framework allows you to ingest any new risk in the same overall formula that you have and be able to make those decisions quicker and faster because also it's also about shifting the budget accordingly, right?
00:09:53.120 --> 00:10:04.399
So if the quantum risk is significantly more than the risk of something else, you know, you as a leader might want to look at how do you how do you move some of that budget to the right area where the risk is higher.
00:10:04.480 --> 00:10:13.440
However, on the other hand, you know, as amazing and as uh cool the new technology might be, if it doesn't bring the kind of risk to your business, well, you don't need to really be spending.
00:10:13.519 --> 00:10:19.759
I mean, you know, we've seen some of these technologies like bring your own device, etc., come become like a big thing, people are worried.
00:10:19.840 --> 00:10:23.919
And then now, how many people actually really focus on that security as much as it used to?
00:10:24.080 --> 00:10:31.840
So I think that as the threat vector changes, you you are gonna keep moving your risk, and and the risk is moved, you're gonna move your spend as well accordingly.
00:10:32.000 --> 00:10:39.120
So I think uh building a risk operation center really helps you make sure that you're future-proof your overall security program.
00:10:39.679 --> 00:10:40.080
All right.
00:10:40.320 --> 00:10:44.480
Well, if there was one key takeaway you could leave our audience with today, what would that be?
00:10:44.720 --> 00:10:47.039
You cannot fight AI without using AI.
00:10:47.279 --> 00:10:50.320
I know it feels like you know, something we could do.
00:10:50.399 --> 00:10:58.879
So, you know, the key takeaway is really gonna be now that you know you have to do it, the question is what's the economic equation in which you're gonna use AI to fight AI?
00:10:58.960 --> 00:11:10.799
Is it something you're gonna build yourself or is it something you're gonna trust your partners and your vendors who have uh capabilities built around that to help you achieve the outcomes that you need to use AI to be able to fight back the attackers?
00:11:10.879 --> 00:11:14.480
So that's something that I would ask people to think about from more of a business perspective.
00:11:14.799 --> 00:11:15.360
Wonderful.
00:11:15.519 --> 00:11:21.679
Well, thank you so much for sitting down with me and doing my first live podcast show, Qualis.
00:11:22.000 --> 00:11:22.480
Thank you very much.
00:11:22.559 --> 00:11:23.600
It was a pleasure talking to you.
00:11:23.840 --> 00:11:24.159
Yes.
00:11:24.320 --> 00:11:30.480
And to our audience, if you have any questions or comments, please leave them in the comments below, and I'll get back as soon as possible.
00:11:30.720 --> 00:11:32.080
Have a great day.