Good Guys Also Use AI

Kumar, welcome to Security Breach.

So usually we take some time before we start hitting people over the head with artificial intelligence talk.

But I think that's really gonna be the focus of a lot of what we discuss here today, along with detection and response.

So let's kind of jump right into it a little bit in setting up some of the things that, that you and AirMD are really about.

Um, let...

How is...

We know how AI has evolved for the bad guys.

We know how they're using it.

We know how they're, they're getting better at attacking us.

But could you talk a little bit about the evolution for the good guys? How can the good guys use AI a little bit more in their defenses?

So I think the same kind of tools, especially the AI capabilities that attackers have, um, defenders have as well, right? That's the good news part of it.

Uh, two capabilities in particular, right? Uh, coding has become really easy, right? And what that means is you can just tell Claude, I use Claude every week multiple times a day, right? So I got trained up as a software engineer.

I used to write code.

Um, now I just tell Claude to write code, and it writes the code for me.

That same capability is available for the bad guys.

The question is, are the blue teams using that capability to do things that used to take over an hour in under three minutes? Because if you're not doing that, the attacks are gonna get that sophisticated and gonna get that fast, right? 30-minute breakout window is very normal these days, and it is only gonna shrink.

So that's a, that's a capability that I've seen that many...

A- and the, that's one, the coding ability.

The other part of it is the knowledge about the systems is actually becoming ubiquitous.

For example, you can take a log line that I have spent 25 years in this space.

I might not know what this is.

You type that into Claude.

It will tell you exactly what it is, what other things you need, you want to go chase around.

Now, this power can be used by attackers to figure out more things on your network, what is going on, what else can they compromise.

But the same, uh, thing can also, the same capability, the same power can also be used by the blue teams, the good, the good guys on the cyber, uh, defense side of things to figure out, okay, w- this activity looks weird.