Knowing all the stuff you know, like you're living in that space, right? How do you deal with that stuff? How do you make sense of it?

Yeah, I mean, I think that's the problem that teams face, right? I mean, because attackers have unlimited resources just as always, right? They have the time and traditional vulnerability management has largely become a reactive exercise now, right? I mean, it's because the time to patch is definitely a lot further out than the time to develop that exploit and start weaponizing it.

Teams do have to be in a constant state of what are the most important things to focus on right now? And can I identify and fix those things in an as automated way as possible? So I do think that we're headed towards a human in the loop automated remediation process, right? And visibility into that.

So I think that the most important topics around that particularly are understanding the context of the environment so well that you really can start to approve an automated remediation process under certain circumstances.

I think where we'll see people start doing more automated remediation is against like low value assets, like just to make sure things are working, right? To build that trust.

So I think that's one area that people will need to get to.

And then just continuing to fight AI with AI, right? So being able to use AI on your proactive red teaming, your proactive pen testing services, to be able to try and stay at least up to speed and pace with what the attackers are doing.

And, you know, being a cybersecurity person, you look at it and go, Is it ever going to stop? Does it just keep going? How do we bring this into a manageable pod? Is it leveraging pen testing more often? Is it getting humans better up to speed? What's your take?

... lightning in a bottle, or is this norm?

No, I think, I think it's becoming, it's gonna become the norm.

I mean, I think you need some kind of policy, and especially, you know, as part of your disaster recovery and, and incident response policy of, hey, you, it, what you would normally detect as like an initial attack is probably just like, hey, how do you distinguish between AI versus, you know, some other kind of attack? And like, I think that's where you're gonna have to discern for your organization, you know, hey, this is much more au- this clearly is more, more automated.

It's happening at like lightning speed, therefore it's probably an AI generated attack of some sort.

But I, I think it would be nerve-wracking too, because you'd, you know, now after the fact, they know it was like OpenAI, you know, it was something related to OpenAI.

But you just don't, I think in the, in the moment, you don't know who it could be or, like, what the source or origin could be.

So I think you do have to have, I think all organizations are gonna have to have some kind of policies on like, hey, what happens when we detect this kind of activity? And it's probably pro- pro- prioritized based on the type of systems that it is, whether it's your external facing website or, you know, your internal repositories for, for code-

I'm curious.