Ditching Traffic-Light Risk Models - Jon Villanti - Cyber Smokehouse - Episode #32

So talk to us.

I mean, you got a lot going on.

You know, every smokehouse runs on a different fuel.

So, like, what are the burning things for you right now? Like, what are the big topics in cyber that are eating at you?

Well, personally, my fuel is caffeine.

But what's really been top of my mind, as I think it is for many people, digital transformation.

There's so much going on, and you can't talk about digital transformation without talking about AI.

And my particular interest in AI, I use it every single day.

I think it's a fantastic tool when used properly.

Not everything is a nail, so we can't only carry a hammer.

But I really woke up a little bit when the OpenAI agents attacked Hugging Face.

And Hugging Face was trying to engage an incident response and use a hosted model to help them recreate the attack.

And the model couldn't determine if it was actually playing defense or if the intention of the prompt was to create an attack.

So they had to shift to an open-weight internally hosted model And that really made me wonder about model availability, especially when Anthropic pulled Fable off because of those broken guardrails that Google researchers found.

So I'm kind of wondering about internally hosted open weight models for banks.

You know, it definitely takes care of some data privacy and governance concerns.

So that's kind of a top of mind thing, Ernie and Graham.

And I think secondly, one of the things I think about race, right, because cyber is risk and everything we do is about uncertainty.

You know, are we going to get hacked? What is it going to look like? Will it be successful? If they get their foot in the door, are they going to find little cracks and crevices? Are they going to move laterally, escalate privilege, maintain persistence, steal things, deploy ransomware? You know, all the things an adversary wants to do.

And we kind of quantify risk these days with a traffic light protocol or maybe like, is it green? Is it yellow? Is it red? or maybe it's a one to five scale, low, low-medium, medium, medium-high, high, those types of things.

I'm really interested in doing some research on quantification of risk.

So if I've got a $50,000 problem, I need to make sure I'm not spending $100,000 to fix it.

And if I can walk into my board and talk about a $50,000 problem, they understand that as opposed to, I think we're low-medium.

So that's kind of one of the areas.

And, you know, I typically end up being a little bit contrarian.

So talk to us.

I mean, you got a lot going on.

You know, every smokehouse runs on a different fuel.

So, like, what are the burning things for you right now? Like, what are the big topics in cyber that are eating at you?

Well, personally, my fuel is caffeine.

But what's really been top of my mind, as I think it is for many people, digital transformation.

There's so much going on, and you can't talk about digital transformation without talking about AI.

And my particular interest in AI, I use it every single day.

I think it's a fantastic tool when used properly.

Not everything is a nail, so we can't only carry a hammer.

But I really woke up a little bit when the OpenAI agents attacked Hugging Face.

And Hugging Face was trying to engage an incident response and use a hosted model to help them recreate the attack.

And the model couldn't determine if it was actually playing defense or if the intention of the prompt was to create an attack.

So they had to shift to an open-weight internally hosted model And that really made me wonder about model availability, especially when Anthropic pulled Fable off because of those broken guardrails that Google researchers found.

So I'm kind of wondering about internally hosted open weight models for banks.

You know, it definitely takes care of some data privacy and governance concerns.

So that's kind of a top of mind thing, Ernie and Graham.

And I think secondly, one of the things I think about race, right, because cyber is risk and everything we do is about uncertainty.

You know, are we going to get hacked? What is it going to look like? Will it be successful? If they get their foot in the door, are they going to find little cracks and crevices? Are they going to move laterally, escalate privilege, maintain persistence, steal things, deploy ransomware? You know, all the things an adversary wants to do.

And we kind of quantify risk these days with a traffic light protocol or maybe like, is it green? Is it yellow? Is it red? or maybe it's a one to five scale, low, low-medium, medium, medium-high, high, those types of things.

I'm really interested in doing some research on quantification of risk.

So if I've got a $50,000 problem, I need to make sure I'm not spending $100,000 to fix it.

And if I can walk into my board and talk about a $50,000 problem, they understand that as opposed to, I think we're low-medium.

So that's kind of one of the areas.

And, you know, I typically end up being a little bit contrarian.