Why is that a problem?

First, we're at the very beginning of AI.

I know it's been out for a few years and it feels like a massive acceleration, and it is.

It's moving faster than anything else, but it's not improving as fast as it's changing.

Right? And there are fundamental problems with AI.

One I just discovered the other day, like I'd been hinting around it, but I started a project and because I've been working with AI for a while and I'm noticing that I get some different results and I'm working with AI my way and you can never see inside someone else's head.

So I asked AI to write an article about working with me from its perspective.

that applies here very much.

I'm going to assume, Howard, you've talked to many businesses, and they've said many of these lines as their selling point, and you're like, "All right, guys, we gotta right the ship here." Has that happened? Yes?

Almost every call.

Almost every call that I have, even one where I'm there to advise, and they know what the setup is, and they're familiar with me, and I have yelled at them before, they still lean into a trope, or two, or three, or four.

Although, I have to say, I take issue with some of the comments.

Compliance is not security.

I'm sorry.

There are pieces of compliance that absolutely are, but compliance is the assurance that you are following the required regulations that apply to your organization.

Is it just people resisting to change, you think?

They're necessary, but not sufficient.

I like that question.

I think that's a good question.

But as to the last one, it can't both behave as a proper process and be malicious at the same time.

The question has a logical fallacy contained within it on that last question.

And so there's a problem there.

If I've authorized a host to communicate to this service over this port, which is what I want to do with microsegmentation, then it's an authorized service acting over that port and communicating with that service.

So secure by design was like the term, Howard, that first came to my mind when I saw that question.

Mm-hmm.

And it is the wink wink, nudge nudge subtext.

Well, okay, cool, but understand that as a CISO, I have a budget, so cool.

It's helpful to have more employees, but also as a CISO, I'm an, an executive in a company that's political, 'cause most companies are political.

My political power is derived directly from the number of people in the org that report to me.

I'm not going to get more influence in the organization by cutting my headcount from 80 to eight.

It's never gonna happen.

Yeah.

Are you still hearing? Oh, I'm

still hearing that.

Really? Okay.

Yeah, especially when you talk to like the words that are actually being said.

There's the thing we say and then the subtext contained within it.

And it is the wink, wink, nudge, nudge subtext.

Well, okay, cool.

And I think that's always a good angle, but rather than trying to be all things for all things, because then you're nothing for anybody.

Or is it

AI, AI, AI? Well, it's AI, AI, AI, no doubt.

There was nothing else at Black Hat we're talking about.

I'm sorry.

I know we're all exhausted by AI, but the AI governance conversation at Black Hat was insane.

Like the AI SOC thing, you could almost measure that as like a heartbeat because it was constant and it was just like thrum.

It was subtle, but it was everywhere.

We can start to slow it down.

Are you still hearing? Oh, I'm

still hearing that.

Really? Okay.

Yeah, especially when you talk to like the words that are actually being said.

There's the thing we say and then the subtext contained within it.

And it is the wink, wink, nudge, nudge subtext.

Well, okay, cool.

And I think that's always a good angle, but rather than trying to be all things for all things, because then you're nothing for anybody.

So a resume-generating event rather than... [laughs]

It's a, it's absolutely an RGE.

I, I've been through it a few times, where we think everything is good, we go to reco- restore after some sort of failure, only to find all of our assumptions were wrong.

And they're not necessarily 100% wrong, but we didn't have a clue what we were doing in recovery, and I've never had a board more interested in what I'm doing as a CIO or a CTO or a CISO than when I'm in recovery.

The problem is it's really expensive.

It, it's effectively an all-hands-on-deck type of situation, and the fewer people I involve, the less thorough I am, the less everyone knows what their job is, the less I'm able to actually certify that this works, if I don't have people to contest, if I don't have proper procedures, if I don't have any of this stuff done.

And you really kinda have to do it a lot more than once, otherwise it's never a muscle, right? And we don't need to do it 10,000 times or do a Malcolm Gladwell 10,000 hours sorta thing, but we do need to do it enough that everybody knows what their role is, everybody knows what the goals are, and we can actually certify that this stuff works.

So we're looking at the actual recovery time frames compared to your business targets, defining the action plans for those applications, and enabling you to proactively prepare for that event, as opposed to orchestrating the recovery from the event itself.

The exploitability in the open source supply chain, why is all of a sudden this the topic of the day?

So I think there's probably three things at work here, right? The first is open source is public.

And that doesn't necessarily mean they're slower to remediate.

What it means is it's more public when anything happens and anyone can fork an open source project, inject malicious code.

And if you're not paying attention, it's really, really easy to kind of get compromised.

Second, there's a tremendous amount of increased velocity due to AI.

And the velocity is on both sides, right? The velocity is the velocity of the malicious attacker or the malintentioned to compromise open source projects, but also the velocity within software development has increased.

So we'll just add those components for you.

Oh, yeah.

Transparency can be, you know, this thing occurred on May 27th, right? There's a f- there was a 14-day 12- dwell period where 300 PeopleSoft instances at 100-plus organizations were compromised, right? At that point, this is effectively public.

It's another...

It's, it's June 10th before Oracle issues the emergency out-of-band patch, which is 14 days after the exploitation began, right? On the 11th, Google Mandiant published the attribution.

That's a long time, right? May 27th to June 11th is a long time.

During that period, right, um, the University of Nottingham published on June 5th that they were compromised a- and the records were published as proof from, um, from ShinyHunters on June 5th, right? What is that, roughly 10 days after the, after the hack began? Um, that's a very long time, during which time t- organizations continue to get compromised and Oracle's not acting as a partner.

That's my biggest problem, right? It's okay to go, for Oracle to go, "We're gonna notify everyone that could be affected by this.

That, that is fair.

Is that just massively increasing the signal and, and causing even more overload?

Ooh, so first, we've always had this problem.

It will always be a problem.

It will never be solved.

While I appreciate the potential that AI brings, AI brings the infinite problem to both sides of the equation, right? As long as whatever tool you're using to speed up your own efficiency is able to be used by the attackers, it ends up being kind of an infinite game.

That's not a good thing or a bad thing.

That's just kind of the reality of the situation.

What other questions do you have for Grant and about Profit Security?

Selling features is easy.

Uh, I mean, I, I spend...

So, so one of the reasons I became an analyst was I used to spend a lot of time talking to sales teams about how to sell me, because they'd come into my office and they'd be like, "All right, Howard, we got this great C-level presentation for you.

We know C- CIOs don't wanna hear about speeds and feeds, so we're gonna mix it up for you.

We're gonna be really CEO-focused, and we're gonna give you, you know, feeds and speeds instead." No speeds and feeds, it's just feeds and speeds, right? And I'd go, "Guys, like I don't care about any of the things you talked about.

I pay people to care about those things.

I have to assume if you got into my office, your feature set is liked by my analysts, is liked by my engineers, is liked by my architects.

Mm.

I'm not gonna go spend money on something new that does just that." Does that make sense?

Y- yeah, I mean, we- w- we're, as an industry we are all about the white space.

Like the entire tech industry is about the white space, right? Can I find enough elbow room between the vendor to the left and the vendor to the right of this problem that I can wedge myself in there? A- and, and that is a fine strategy, again, when the acquisition cycle is high.

M- the problem I think comes back to, you know, I was having a conversation with somebody.

I really liked their tech, and I was like, "Cool, so what are you displacing?" And they're like, "No, no, we're net new." Okay, cool.

I...

Like no one's gonna buy that.Right? I don't have enough money to solve the problems that I have today.

[laughs]

Far more.

Yeah.

Right, right.

Convert it to Freedom Dollars.

That's like no money.

That's like a Coke.

I mean, sure, Cokes are $18 now.

is on you.

Someone on their staff asked someone to read the manual and they used AI to tell them.

Yeah, no, they stumbled into some dark place in AI, and AI went, hey, by the way, your buses can be remotely detonated.

And they went, I don't understand, we have buses? And then lost the whole investigative committee.

So it kind of reminds me of the...

The story of a friend of mine who was a pilot in Vietnam, and they were initially using sensors attached to their planes that would smell for the presence of Viet Cong.

I'm not going to tell you what they smell.

It doesn't matter.

Hope more schools pick it up.