0:00We're going back to the 90s and 2000s again. We're going to see breaches popping out all the time again. Now, it's going to look very different than the last 15 years of security.
0:08AI attackers that are actually going after companies, startups in scale and speed that we've never seen.
0:13Elon Musk tweeted that recently. Every day is zero day. What is AI doing to make this [music] happen?
0:19Moders are good enough now to find and exploit complex vulnerabilities. And the other is that the open source models, that's the scary bit. A few months ago, we said we have a few months until open source models catch [music] up. So now they're catching up.
0:32The security game has just changed. You need to be thinking about how you can automate so much of both the blue side and the red side. Right now most of what security teams do is not security. We should stop doing [music] most of what we do and focus on finding critical risk, figuring out how we mitigate it or at least put detections in and also response readiness for it.
0:50What do you think the next several years looks like? AI attacks are prevalent, easy, but also better than any human. That's the problem. The only companies that will be able to survive are companies that are Ammy, thank you so much for joining us.
1:06Security professionals are calling October Black October and um it's clear that we're entering a new era of agentic attacks. Um, can you just to start off walk us through what the heck is going on right now and how do we get through this critical moment?
1:27Yes. So, uh, first of all, great to be here. Um, we are calling this Black October uh since uh it's a in my view like a black swan event. H we've never seen never ever seen so many um security incidents happen in a single month. Um and we are talking about multiple different types of security incidents uh both uh the number of vulnerabilities
1:54that has been found in October and the severity of those vulnerabilities including the PHP vulnerability probably the most severe vulnerability ever found by AI right so vulnerabilities coming in a rate that we've never seen but on the other hand even worse we're seeing the the rise of AI attacks right so AI attackers that are using completely new speed expertise that we've never seen before. Actually going after um
2:22companies, startups, refrigerators in in in scale and speed that we've never seen.
2:31Yeah. And I I mean the the scary thing about that to your point is um and you guys cover some of this in your in your blog as well the the speed and um you know I think you've even said definitely to us privately but probably publicly as well that every day is zero day right um Elon Musk tweeted that recently um just say more what is AI doing to make this happen like what is the mechanism that um it's able to speed um writing
3:01exploits Uh I think you guys actually did some work around this um where you found it collapsed the timing from months to weeks. Um say more about how that works and um you know I think your point on uh the the audience for for this podcast right what should founders be thinking about and doing.
3:20So if we think how we got here right so there two major moments until October.
3:26fun was the the Mitos moment where Mitos came out and said, "Oh my god, we can find vulnerabilities." Okay, that was one moment. But again, nothing happened, you know, like we said, "Oh my god, it's coming." But we still had a like like people say, "Okay, h okay, what still the world, you know, the sun is still rising." The other big moment that we had was the hacking face incident with OpenAI, right? So these are that was another major incident that we saw the
3:56risk of AI attacks but again it was accidental attacks.
4:00Y what happened now in black October is that all of those potential theories the the things that we said are coming they all came and crashed upon us and it's happening right now. Right. So one is that the models are good enough now to find and exploit complex vulnerabilities. Right? So, and that means that this is not a theory anymore.
4:23It's it's happening. It's an explosion of vulnerabilities. And the other is that the open source models, right?
4:29That's the scary bit. And we said it when we spoke about Mitos a few months ago, we said we have a few months, a few months until open source models catch up. Okay? So, now they're catching up.
4:41They're catching up. It means that now it's not just about vulnerabilities.
4:45They're able to find ways to run code on your environment. doesn't have to be a complex PHP for a bit. It can be just a mistake in your API, right? They can find and utilize those zero days in your code, right? And basically run an entire attack that usually took for the best attackers weeks or months in again around 20 minutes. That's what we're seeing now. So,
5:14how far behind have you seen the uh the open source models? I mean, like when we're chatting with folks on the on like the offensive capability side, it tends to be about like six to nine months or so, but that's close enough uh now at this point. But I'm I'm curious what you've seen.
5:28There's two different questions. One is um okay, on the offensive side, right, to find a vulnerability is are we better than the open source models? Yeah, maybe we have like three months of it's not more than three months, right? The problem is that the the is the offensive side on attacking. Okay, because I I'm a company. It doesn't matter. Let's say it's a startup. Okay, and again we are talking about a wave of attacks. If we just look at AI development providers,
5:58right? We had a blog about like we've seen initially the blog had nine companies attacked in October and the list is growing every day like we're now on 15. Wow. So like a it's just an example of one market, right? Like AI development platforms. Okay, these are getting targeted specifically now because they have AI keys, right? Uh the fact that an attacker, it doesn't have to be a sophisticated attacker, can use AI, open source models are good enough
6:26to find problems in your code and and the big problem is to also use them in a matter of 20 minutes. So think about it which startup is ready for detecting those attacks I don't know and then actually finding them and responding them like in time right like it's a you need a 247 sock in every small startup right let why don't we talk for a second on PHP to shell as a as an example of
6:55just a case study of one of the many that came out during uh black october here um can you talk a little bit about just how prevalent you saw this across your customer base. But then now that we're actually a couple weeks out, uh really curious your take on how has patching actually been across the customer case uh across the customer base, excuse me, and what are kind of the state of things a few weeks out now that we've had a few weeks of seeing uh it be out there.
7:20So PHP is a maybe one of the most prevalent technologies as an external facing technology, right? Oh, yeah. A former CISO of a PHP uh e-commerce company. Yes.
7:34Are they saying it's like 70% of the internet or something?
7:38Exactly. So you know you know the the impact is basically almost 100% of our customers had the some some PHP running right. We so we saw a major drop very quickly. So customers are now um I wouldn't say they have automated patching yet but they're very very aware of the importance of of um of patching. So I'm talking about 50% patching within the first 2 three days, right? So like Mhm.
8:09almost immediate reduction but still the problem is that this is 70% of the internet. So exactly this even just this single vulnerability is going to take years okay until it's resolved. And there is many many many cases that we see both on the internet and also customer environments that they don't have any way to pitch. Okay. uh uh because older versions of PHP are not even getting a pitch. Yeah.
8:36Um can I ask a just a a meta question here? Um and uh one of our two of our partners wrote this great piece on um time for writing exploits versus patching. Um and you know there's a lot of dialogue out there about how AI has made it just cheaper, easier to turn a patch diff um you know into a working exploit.
8:57Um and there's sort of some data on just sort of that time falling. Um on the other hand, it seems actually that the data showing um time to patch actually hasn't gone down. Um in fact, it's gone up if you look at the data over the last 20 25 years. Um can AI help with that side as well, Ammy, or is it still early days?
9:20So first of all, you're right. the the time to h to to to get an exploit dramatically went down. It's even worse um because many times the information leaks before the CV even is out. Okay.
9:36Many times even the CV is out the patch is not out. Okay. Uh in the PHP case we worked for months with PHP to get the entire industry ready and it leaked before a time right. So the customer doesn't have anything to do h the patch is not ready in Linux right now even if there is a vulnerability reported to Linux kernel it might take weeks or even months until it reaches all of the uh distros right so the industry in general
10:04is not ready for like there even if you can patch internally quickly sometimes until a patch gets to your distribution okay it's not ready for for AI right AI can exploit things in in in minutes. So the answer is that the world is not ready. The world is not ready for this.
10:22Like it's a it's a problem. In terms of pedaging, you're right. Like uh we don't yet exactly know how to automatically patch and I honestly um I don't see a path towards that. Uh it's easy to say yes, let's automate everything. In reality, if you are building now a new company, you can do it, right? If you're building a new company and you have automated engineering and automated CI/CD and automated testing, right? You can basically be at a position where I tell you patch this and your entire
10:52system can automatically do it. And I think for new companies, you should design your system to be able to auto patch, right? But in order to do that, you need an entire anentic pipeline for everything, right? You have automated dev. So you need the ability to take a ticket and have an automated dev to create the patch. Fine. Then you need automated testing, automated CI/CD and automated DevOps. There's not a lot of legacy companies that have all of that and it's not even realistic for
11:20most of their code. But for startups, maybe it's possible and I would consider this a an a a task for startups if you start or plan this, you know.
11:32Yeah, absolutely. I I'm curious to just dive in real quick on the a little bit deeper on the offensive side. Um so going through kind of the discovery of this, it was funny a little bit of a footnote here, but um this was a vulnerability that was independently discovered by two groups, Whiz and Califf, uh around kind of the details of the the PHP to shell van, which is a thing that used to happen a bunch back in the day. I'm curious though for your
12:00research team, how were they really leveraging AI in terms of discovering this and and just going a little bit deeper on how it's really unlocking vulnerability research teams?
12:10So a few things first of all I think this will actually happen much much much more now because every time there is a new model there's new capabilities.
12:21Yeah. Again I I look at it like Bitcoin mining. Okay. like [laughter] number of vulnerabilities uh will go down but because it's like Bitcoin there's always more and the new models can uncover uh more uh vulnerabilities right so it's not surprising that there is a there's a new model okay and there multiple teams find new vulnerabilities right exactly because and and by the right now we are getting
12:50ready for ZDC the the zero day con competition of wiz and And we're we are seeing we we're getting multiple multiple reports on a very very critical vulnerability that is also I believe is going to be a major impact on the internet and this vulnerability is being reported by multiple teams.
13:09Yeah. Right. [laughter] It's a it's amazing how it brings everything old is kind of new again in the security industry [laughter] right now.
13:17Yes, you're right. Internally our vulnerability team we built basically also for the wheels product we built a what we call atlas which is a harness for vulnerability detection right h so we're using that with different models all the time because every model has its own uh unique capabilities from from from openai or or google or carbon like each of them has its own capabilities we're trying to use all of them and and find whatever we can but the point is
13:46that everyone are doing it so you would expect a lot of teams to find vulnerabilities at the same time and we and that's the important thing we have to focus on infrastructure that is critical using the models of the frontier AI that have a few months right of advantage and we have to continuously do that do that on those areas to make sure that we find it before attackers but there's so much code in the world that it doesn't help because there will still be vulnerabilities that attackers
14:15find on on a motor that we you know an error that we they looking to I don't want to take us down a a frontier model rabbit hole too too much but um just to probe a little bit on what you said about um using multiple models and um each one being good at different things um to the extent you can share on me I'm curious um about two points there one is um what are different models better at um at a high level and then two how do you see I mean
14:44you know obviously uh whiz um is a part of the Google family now. Um, and so you have uh the DeepMind team and and their models at your fingertips, but it sounds like you are using multiple models. Um, how do you think about the sort of relationship between Frontier Labs and independent cyber companies um in this day and age?
15:02So I I I think that every model and also every version of every model, right? And now it's getting complicated because you have the frontier models and you have the cyber versions of those models and each of them [laughter] has [gasps] It's a complicated matrix, right? But the point is that each of them does behave differently and has a different um speed and cost, right? So there is no single answer that like that's my point.
15:29Like if you want to um do a task, it's for cyber, but it's true for other stuff as well. The only thing you can do as an independent company is to try all the models all the time and to find the best combination. Right?
15:43The way I see it is that you know people say oh now it's easy to develop using AI it's not true for most founders right now the the key is going to be uh the cost the cost of the service right and the only way to create a scalable service is by creating a very very intelligent pipeline there where you do some of the tasks with specific models and some of the more complicated tasks with other models and you mesh all of them together in a very very efficient way otherwise
16:13you're you're you're going to lose money on on your sales, right? So, as an example, right, on the we have what we call the blue agent which investigates attacks, right? I cannot run the most a advanced expensive model on every event, right? But I can create a pipeline where you start from a deterministic detection, then you go through a a cheap model detection, then you go through a more advanced model. And if I if I if all of them think it's malicious, I will say to the most advanced model to
16:42determine is it really malicious before I tell the customer. You see like so you need multiple models, multiple types of models and you have to design pipelines and I think that is really the new engineering challenge for for for founders for companies building AI systems at scale.
16:59Yeah, absolutely. And and just um on this cost point, you talk about in I think a blog post that you guys wrote, but maybe summarize a little bit here this paradigm shift that needs to happen around continuous testing, right? So sort of the the focus being on the word continuous versus um static uh and cost obviously plays a big role in um you know sort of the democratization of uh every company being able to do that, not just the sort of most profitable and
17:26sophisticated. um how far are we from getting there on a cost uh from a cost perspective and what what else I guess needs to happen maybe it's also cultural shift etc like you know tooling shift um but how how far are we from I think I guess where do we where do you think companies need to go and how far are we today so I mean first of all it's a it's it's it's a big question like let's take security for example go back to the
17:56bentos moment Right? So people say, "Oh my god, there's Mitos. I have to scan all of my code." Okay, fine. Let's say you did it. Let's say you did it in in April. Okay, you might have wasted $5 million. Okay, [laughter] these are real numbers that you could you've wasted a lot of. It's very expensive now. Okay, now there's meters 1.2. You do it again.
18:17Like like this is not like this is I'm not talking about small budgets. I'm talking about I I'm some customers are spending now tens of millions of dollars on like scanning code like you like you have to think about a scalable system right continuous system that scans but is intelligent you can't just so because there's going to be new models new capabilities new code right so we see this as a major challenge for the industry we're trying to figure it out I'm not going to tell you that we solved
18:46it right but the challenge is how do I use the budget wisely in in a way scans from the inside, from the outside. We have active attacks, we have passive attacks, we have code analysis, we can scan, we on the on the disk itself, we can look at the runtime. How do I use all of the budget in a in the most efficient way for the customer, not as a single scan, but as a continuous scan, right? And that is the challenge of security scanning right now. If I tell you, oh yeah, just run mess on your
19:15code. Great. You're right. You can do that. But does that does that actually solve your problem continuously? No, it's just going to get you like a big hole in the in the budget.
19:23I I know it feels like a lifetime ago that we uh all used to talk about uh just cloud security, preAI security, but I'm curious, you know, look for for security teams and practitioners, CISOs, security engineers, all all of this.
19:36Just because new problems appear doesn't mean old problems go away. And so for a lot of, you know, Fortune 500, global 2000, they're still dealing with a lot of cloud security challenges. I'm curious if we for the first part of this question, let's just kind of set AI aside and can you talk about kind of the state of cloud adoption and security in 2026 and then for the second part of the question, let's layer AI in there and talk about how uh how it's really changing cloud security specifically.
20:05Yeah. So, I mean in my first of all, cloud security um when we talk about I have an application that's running, it's always in the cloud, right? When we talk about AI AI attackers coming after my application, they will always start from the the the the the same vulnerabilities and and and problems and mistakes that you could have done before, right? So like nothing changes in the fact that as in in cloud security, you have you have to make sure that you focused on critical risk and
20:35then you fixed it, right? Yeah. If you have a a a PHP vulnerability you didn't fix, yeah, attackers are going to come from there, right? So like we we just added more vulnerabilities and more types of attacks [laughter] that mean you don't have to fix the old ways of attacks right. So in terms of cloud security what we're seeing is that first of all everyone understand that the you need this um system of record that understands and gives you visibility into everything right um what
21:03we are so I I would say what we are starting to see change is of course that companies are trying to create more um agentic workflows and also expect more from whiz, right? So for example, if before we would provide a a vulnerability with prioritization, now they would expect us to go back to the code, find the code, create the fix, create the pull request, you know, so basically help automate more of the
21:31processes that take time. And that's also true for detections, right? They don't want just a detection. They expect also to get a full investigation, forensics, find the root cause, find tell me how the attacker got in and push them out, you know. So the way I see it is that what what AI is doing right now is basically every step that we had that we didn't solve with with automatically.
21:53Companies are trying to do it their automatically on their own and they also expect us to get better. Right? So as an example, we are we are not finding threats anymore. We have to do a full investigation. We also need to do forensics. And I I think the next step for us now that we see AI attackers, we need to start thinking about automating response which is very scary but I don't think we have any.
22:17Absolutely. Yeah. Yeah. Completely agree.
22:18Yeah. Maybe on the topic of things that you guys are automating and just how whiz has has evolved. Um you talked about blue agent. Um can you share a little bit more about red agent? Um because I think that's where you know you're really simulating an advers adversarial point of view. Um, and you know, is your response is is Whizz's response to AI shifting risk um, you know, are essentially are you giving your customers going back to this um,
22:48sort of speed thing like speed of the defender, speed of the attacker? Um, are you are you sort of thinking of ways to give machine speed to your customers if you will?
22:57Exactly. So there's eventually there's two forces here, the the red and the blue. The blue tries to to find attacks and and and and and stop them. What the red is trying to say is the best defense is attack, right? So you have to attack yourself with AI continuously because um unlike what we had before where the we had static defenses now defenses has to be they have to be dynamic because every new model has new capabilities,
23:26right? So maybe your application was considered secure yesterday, but it's not secure today. Like think about it.
23:34If I try to give you a like an analogy, think about you have a door, okay, and you put you hide maybe you hide your key under the mitt, okay? And that's considered secure, right? But your attackers are getting superpowers every every week, right? So maybe next week they're going to be able to get into your door. So whatever was considered secure last week, if every AI model can get into the door, it's not secure anymore. So the watermark keeps going
24:02up, right? So the only way to to know you have a problem is to continuously attack yourself with the latest models.
24:08So before the attackers can open the door, you figure it out, you fix it, and you don't have a lot of time. And that's the speed where we talk about speed of defense, right? It's crucial. So the red agent tries to do that. tries to do an offensive AI attack against your applications from the outside using the context we have from the inside to try to find the problems before the attackers actually use them.
24:30Are you doing a similar pipeline on the the red team side? So my my question is coming from the angle of teams who this all makes sense to them. They want to get started with it. Uh let's help them avoid a bunch of the mistakes that everyone else has had to learn. On the blue team side, uh you start this with kind of deterministic approaches and then you layer in cheap models and and the time the pipeline that you talked about are progressively getting more expensive. Are you doing similar approaches on the red team side as well where it's you're starting deterministic
24:59and then you're layering cheap models or are you layering just a whole bunch of different models all starting from scratch and all running simultaneously?
25:09Yeah, exactly. [laughter] So yes, I mean first of all let's compare this to like if you have a budget you can just give it to meters and run on code that's not very efficient. So more efficient is that you analyze all the exposure, right? That's what we do it deterministically with, right? Then we layer on top of that what we call the exposure rate agent that just looks at everything that is unauthenticated, exposed on the internet from your environment. Right? So that's an immediate analysis for everything,
25:38every exposure you have. That is the most urgent thing to do. It's even more important than scanning your code. Okay?
25:44Who cares about your code? I'm talking about the actual unauthenticated exposed um attack surface that you have more urgent right next step is to start doing deeper pentest analysis and deeper code analysis right so there's definitely layers here and also in terms of models and investigation time the from the outside what we call exposure agent maybe will take a few minutes for every endpoint because you have a million endpoints when there's a critical application I might take 10 hours to try
26:13and hack it right so it's H it's all a pipeline. Everything is going to be a pipeline now, right? It's a you cannot throw money on code scanning and think it's you're done. No, it's it's all about managing the budget. This is the whole point, right? And they they're all connected because if I find a problem and the engineering says, "Oh my god, this is too expensive to fix."
26:33Okay, you know what? Let me tell the blue agent to put some detections there.
26:37You see, like the this is all working together, right? Right. Um, I I was going to ask and it's um really interesting to hear your point of view on this because we had an internal discussion um with Rick the other day about how it feels like state-of-the-art is essentially what Red Agent is doing. You know, you have agent swarms constantly attacking your own systems that so so so you know how to protect against them, right? Um you're you're working with some of the top enterprise customers, right? Over 50% of
27:05the Fortune 100 and then you also have bleeding edge startups in your customer base. How many people are actually doing this?
27:12So in majority of customers are already using the the red agent. I think across the industry not enough. I I think everyone should do it right now. Like there's nothing more important than to scan your environment continuously from the outside. Like there's nothing more important than that. Like it's the best defense is attack. When they come it might be too late. Okay. So the really the the the best thing you can do
27:39is continuously attack your environment.
27:42So in my view like again on the on the W customer side it's it's like we are getting very quickly to almost full coverage right like everyone understands it and it's really one of the fastest growing features that we've ever released. Um in the world I don't think people understand. I think there's sometimes you know Mitos got a lot of PR good okay but the PR went to the wrong place. I I actually don't think the scanning code is the most efficient thing you can do. Okay? And it's important to understand that because
28:12people can say, "Oh, yeah, I invested so much in scanning code." Really, that's not what you should do. You should focus on your scanning your external exposure before because like we had a there was a big incident just two days ago a a a key hardcoded in a mobile application that exposed a lot of people's data, right? That's where attackers get their attacks, unauthenticated surfaces. That's what you have to run scans for and you have to do it continuously. So that's I think
28:40that's the that's the gap and the world needs to know that.
28:43Yeah. Maybe on this thread of uh what founders should be doing. Um so Zayn and our colleague Joel actually um wrote a note in the midst of Black October um you know to our founders talking about spending more on security uh potentially considering delaying product releases.
29:00Um, so I want, this is a question for both of you, maybe Zayn to say a little bit more about that, but say I'm a founder with a release coming up. I have a backlog of security issues. How should I think about what needs to happen before I ship? So question for both of you, I guess.
29:16Yeah, sure. I mean, I'll I can kick off.
29:17I mean, I mean, I think I think you and I are are very aligned on this, which is the security game has just changed, right? And you need to be thinking about uh how you can automate so much of both the blue side and the red side right now and really leveraging a variety of agents for those automations. And so I think historically in the the old models it was you know the you had a release and then you kind of delayed that for security and all of that. I think that the new model that you're thinking about is how can you be doing all these things
29:46in parallel? How can you be really leveraging a variety of agents to be continuously testing and if you're building a new company today really doing patching from the beginning and building in so much automation into your uh your software development and your infrastructure development.
30:04Yes. Yes. Again I want to I don't want to care but I let's let's just I work with the CEOs of startups that are getting attacked. Let's just be in their shoes. Okay. You wake up and your security team says something bad happened overnight. Uh we tried to stop it, but um they got in uh we woke up after an hour and that's in the good like situation where Yeah, you're being very nice there of of an hour. Yeah, [laughter]
30:33they they even have a security team.
30:35Okay. After like a round, I don't even know if they have someone that is dedicated, right? And and the attacker Yeah. And we found out that the attacker got in and they the entire attack again takes 20 minutes until from the time they get in until they take all of the secrets, all of the AI keys of all of the customers, right?
30:55And now you have to figure out what are you going to say to all of the customers and what you're going to do. And this is what is going through companies right now is like and so the point is that AI attacks, we've never seen that before. We have to understand it's a new threat, right? It's it's a threat to everyone.
31:12But if I'm a startup, especially if I have anything attackers want again, especially like if I have AI keys or anything related to um um something they can use, right? I am on their target. It doesn't have to be a big company. Okay?
31:29Startups are actually their key target now for for LLM checking, right? What do you need to do if you have keys?
31:36probably better to put a limit on them because if they h steal them, you don't want to get a lot of charges, which we see happen a lot and it's really really sad. But also make sure that if you have a target on your back, you do need to put a lot of focus on security. This was never the case, but it's now true that if they want to get in, they they it will happen fast. So, you do have to invest in this. That's there's just there's no other way to put it.
32:02Yeah, I think that's exactly correct.
32:03the the level of security investment whether that is dollars, time, uh any of these things just needs to go up the next several years as we're going into this new era of security.
32:15Yeah. So on that topic, um a CISO recently told um you know, one of the partners our team that he expects his security budget to go up 80% next year, which is, you know, we we we all anticipated that it would go up, but that that's probably on the higher end.
32:30Um, I'm curious what uh, you know, what are you seeing folks spend more money on? Um, and on the flip side, what should CESOS be spending less money on?
32:41Right. And, um, you know, you've you've kind of written publicly about a class of security products that may become somewhat obsolete. Um, but maybe talk through that uh, in terms of what you know, where budgets should go up, but also where they should come down.
32:54Okay. So, first of all, again, I let's assume you have a house, okay? And you know that an elite group of the most trained hackers are going to hack your house. Okay, they might not come through the door. They might come through the window or the roof, right? Honestly, how many houses are even ready for that?
33:14Like most houses would say fine, they I'm not going to secure the roof.
33:18Obviously, there's no way for me to I mean it's impossible, right? So the point is that like we are really most of the companies are not ready for attackers that have the the speed and expertise of the best attackers in the world. And this is why it's a hard problem. So even before we talk about budgets, I don't even know if budgets are going to solve the problem. Okay?
33:40Like it's not about security budgets. It's it's it is about focus. But to be honest, like it's about security architecture, security design. Like it's budget is not even going to solve anything to like it's it's like it's not like you there's a security tool in the world you can buy and everything is fine.
33:57Dang it. [laughter] I'm not just you know would have made a lot of our jobs a lot easier if that [laughter] was true. But yeah I'm not I don't think it's true. Obviously most of the legacy security tools are not even relevant anymore.
34:10Okay. Well, that's like that's but even if you get security to the AI native that understands how to attack attacks in AI world work and cloud attacks and so on. Even then to be honest it's about security design even more than just security budget. Okay. So is security budget going up?
34:31Maybe is should we review their existing tech that we have?
34:35Yes. Okay. But more than that, it's about having a dev team that is focused on scanning the code and applications all the time. It's about thinking about um sandboxes and isolation and like secure design and and and and network lockdown and process lockdown and image lockdown. Like it's just like if you're building stuff now, get ready for a nation state attacker. You see like get ready for that. Imagine there's going to be a vulnerability. Like don't assume ah let's run everything in a Kubernetes
35:04cluster. No, like it's there's zero day vulnerabilities in in Linux all the time. Anyone can get out of a container.
35:12So you see like secure design is much more than just a budget. Obviously security budgets that's great but it's one [laughter] totally yeah I mean a great point to to that point it definitely feels a lot like cloud in the sense of this is a real stairst step where I'm seeing so many CISOs take a look at their existing vendor stack and really reboot that to see what are the AI native ones because you need AI native technologies as you
35:41are really focused on secure architectures exactly what you're talking about of like really thinking about the problem through and understanding there are vulnerabilities at every stage of the stack there simultaneously. This is the the old uh you know CISO saying of like don't let a good crisis go to waste. Uh which is absolutely happening here of rebooting so much of your security product landscape to actually be AI native to help you go into this new era that you already are are in whether you want to be or not.
36:10Yeah. Well, maybe just to get explicit, not not to dunk on any particular company, but what's a type of, you know, software security, let's say, um, security software that you have in place that CISOs have in place now that they just don't no longer need.
36:26Um, so [laughter] if you, okay, most I've always been against, again, it might be a a hard sentence, okay? Most of what security teams do is not security. Okay, there maybe small small subset of their time is actually security and the way to check it is this and that's why I always believe in just attack yourself like how much time are you spending with red teams and how much time you spending with compliance
36:54and and and creating reports right to be honest most of the security teams are not focused on security and security in my view is getting either what you're doing is either getting ready for the attacker attacking yourself or putting guard rails for the attack when it comes. Okay, so the point is that we do have to be much more much more efficient now on security team. We should stop doing most of what we do and focus on finding critical risk, figuring out how we mitigate it or at least put detections in and and and also response
37:23readiness for it. We have to be good. So we don't have time to spend on on on on on everything that is not focused on that. So if you do a task, you say, is this report really helping us? You know, and that was always my point against like classic what we call CSPM in cloud which was just the way you did cloud security before just the list of yeah configuration checks. I don't care about that. You have to care about where is the attacker going to come from. Am I doing everything I can to to stop them?
37:52Can I can I if there's a a a strategic barrier I can build, let's build it. you know like focus on on understanding the actual real risk in the environment creating sustainable long-term isolation strategy these are the things you should do.
38:12Yeah. And and actually on this point of t time management um and maybe flipping a little bit to how AI is actually helping security teams, right? So as as agents maybe take on more of the routine investigations and testing, how do you think and you you've answered this a little bit but maybe deep dive into it. Um some of the most experienced security professionals should be spending their time.
38:36Much easier for a security team starting from now from scratch. Okay? Like obviously if you're building a company right now you're lucky and you should try to build everything fully automated security views automated pet process automated investigation automated if you have enough context and knowledge base about your environment there is a there is definitely a way for you to build everything completely automated. The problem is that for most security teams it's just not the case. Okay, not the case. You have a lot of legacy software,
39:05thousands of developers, you don't even know who owns what. It's like it's it's it's not like everything is changing in a because there's an AI agent. Okay.
39:14It's goes still goes back to find the context of who actually owns every resource. How do I get them to patch stuff? It's it's complicated. So, it's going to take time for most of the security team in the industry to figure out how to start really really getting to efficiency. It's not it it's not as easy and simple as it sounds because a lot of the knowledge of the organization is a bit you know obscure. It's it's not anywhere that is actually uh written h but it is the challenge of all security
39:42teams. If I cannot respond in minutes, what can I am I relevant? Right.
39:52So to to that point, I'll kind of uh round us out with a a question here on kind of connecting the through line of what we've talked about, which is what do you think the next several years looks like? Like our next two to three years? Like I I I'll I'll start you off with my own prediction, which is that we're going back to the 90s and 2000s again. This is there's going to be full remotes uh unauthenticated full ODAS popping out all the time. Now we're going to see breaches popping out all
40:20the time again. Now it's going to look very different than the last 15 years of security. I think we are going back to a a era that looked very different in security. And I'll even throw one wild one out there that like I I wouldn't be surprised if we end up seeing worms again on the internet uh like we did in the Windows XP days. Uh we were chatting internally on this on the the infra team and uh Martin brought up a a a funny point of there was for all of us who
40:48were kind of in broader tech and it at the time there was a window of time where you couldn't install and update Windows XP fast enough because from when you installed it when you started the update a worm would hit your system and infect it during the time it took to actually update the system. And so you literally had to install all of this offline because if you installed it online, it would get compromised faster than you could patch it. And I think so much of this that feels so new with AI
41:16in a lot of ways is something plenty of us experienced 20 25 years ago in the kind of wild west days of the internet. And so building off of that, I'm curious what you think the the next few years look like.
41:28Uh Ammy, just add a quick uh question to tag on to Zay's. you you wrote um this great blog post in April that there was a Y2K moment coming in 12 to 18 months.
41:38Um to Zayn's point on the next two to three years, would you pull up that moment now given everything that's happened in the last six months?
41:46[laughter] Yeah. So f first of all I I I think black October might be the the beginning like again this we didn't want to scare too much and we were hoping more time but the open source models are catching much quicker than if we thought okay like the the hope was that open source models are a year behind but they're not so uh yeah it's I think it's happening like we've never seen this level of attacks across customers like it's happening and if you want to compare to
42:14the '9s the our dependency on technology is much much much higher than absolutely yeah and also what happened and it's important to understand this is almost the only area in humankind right now that AI is better than humans okay that's the problem it's it's not and that was not the problem in '90s like AI attacks now are prevalent easy but also better than any human okay like that's the problem okay I'm talking about attacks that are very very complex using
42:43zero days we had today an attack using a zero day on a kernel driver. My god, like that's very should be very rare. It's happening every day now.
42:51Human attackers cannot do it. So you see like we're at an era where AI is better than humans. And if I need to I cannot foresee two years ahead from now. I I think the only companies that will be able to survive are companies that are building now not just security automation, security design, security reviews. They're designing their systems that are exposed to the internet in a new way and whatever is not ready should
43:19take take off the internet okay quickly right so on the internet you need to be ready with everything that is like ready for the crazy attackers and and you have to design for this right like I think that's the that's the only way a lot of this podcast was um focused on you know enterprises tech companies etc um I want to bring up scan for good which is an initiative you guys launched um recently um but I want to talk about
43:48in the context of some of the attacks uh you know we're talking about um AI infrastructure companies and things like that um but you know if we look at the recent attacks on uh refrigeration units in Europe um which you know if you think about the the supply the food supply chain etc right like this on a mass scale has dire consequences for humanity um and I I don't want to I don't want to fear-monger um but you know I think there's also this appropriate line that
44:16you're walking amii of making sure people are prepared and are taking things seriously. Um so I guess two two questions. One is u how worried should we be about what's happening to public infrastructure and maybe these entities that don't have huge cyber budgets etc.
44:36Um and two maybe talk a little bit about scan for good and why you guys are doing that how you're you know helping nonprofits public services etc get really prepared for what is already h so I I I mean yeah I am worried I mean those exactly I mean the legacy uh software it can be refrigerators I mean that are actually in the real world it can be um h traffic I mean it can be anything it can be really anything that
45:05we know that is connected to the internet is at risk. That's exactly the reason we started Scan for Good. Scan for good is trying to help any any public service that wants help and we try to scan them and try to find problems. It's not going to solve all their issues but we're trying to give them a bit of a push. Our hope that if we find stuff then they will understand it's a bigger project and they will start doing red scanning on their own.
45:29Right. So it's a like this is more of getting them to push into that. This is awesome. Thank you so much. This was super fun, man. Incredible.
45:38Really great to see you both and Yeah. I mean, this is a crazy time.
45:43It's a crazy time. Thank you for what you're doing right now.
45:46Absolutely. Who would have thought from OAS conferences to here, buddy? Good to see you.
45:49Yes. Yes. I remember it was a fun one.
