Defend At AI Speed: With Special Guest Adam Ely, Check Point Software

Speaker A: I see two ends of the spectrum of these conversations. One, where people are genuinely curious and asking, why is identity different with agents than humans? And the other side, where people have already experienced it and are really leaned in. And so on the first part, I always tell people the challenge. The big difference is agents are ephemeral. I can start an agent, I can create an agent. Right now, it needs access, but I can delete that and destroy that agent and then start another one. Or I can do 50 today, or my agents can create agents. And so all of the processes that we have for onboarding humans kind of don't apply in this case.

Speaker B: Welcome to Cybersecurity Today on the weekend. It's great to be back hosting the show for this interview. My guest is Adam Ely. He's the general manager of AI Agent Security at Check Point Software. Full disclosure. Check Point is a sponsor of Cybersecurity Today, and we are grateful to them for their support. But as always, this is an interview like all others I do. I had no scripted questions and we had a great conversation. I hope you'll find it as interesting and informative as I did. Let's get into it. Welcome, Adam.

Speaker A: Hey, thanks for having me.

Speaker B: Before we get into this, I'm going to ask you a little bit about your career. Tell me a little bit about your. How you got to where you are today.

Speaker A: Yeah, I think the, uh, best explanation of my career is zigs and zags. I think that's how I've ended up where I am. I started my career in tech on the IT side and rapidly moved into cybersecurity. A little bit before it was a kind, uh, of a proper industry. It was still emerging. I've been around probably longer than I like to admit these days, but I took a zig and I founded a cybersecurity company that was acquired back in 2016. And then I went on to be deputy CISO at Walmart and CISO of Fidelity Investments, but decided to come back to kind of the innovation space, where now I am the GM of AI Security at Checkpoint, because it was that sort of right time, that intersection of AI and cybersecurity, that I wanted to get back into the innovation and pushing, pushing the boundaries.

Speaker B: This interview probably broadcast a number of times, but the day we're recording it, we had the PHP meltdown. And I wanted to ask you a little bit about that before we got started because we got other things to talk about, but it's hard to ignore this talk about the elephant in the room, and it was the second big disaster this week. But what is that like from your perspective, when a disaster like this happens?

Speaker A: Yeah, it's. I sit in a different role than I used to when I was a ciso in these mega vulnerabilities that affect so much of the Internet came out. It was. It's panic, it's fear. It's a lot of emotion to start with, because you don't know if you're affected. You don't know how many seconds or minutes that you have to get a mitigation in place or get something fixed. And so it's a fast scramble and your team is stressed, and it's just a lot of emotion really fast. And these days, I'm not an operational CSO anymore. Now I run, uh, a security business, and I'm driving innovation and products, so I have less of that and I'm more of an observer, an advisor and a helper across Checkpoint in our customers when these things come up. So the last few days for me was one learning about the vulnerability and there's the embargoes and everything that. That goes on with that, where you know it but you. It's not being talked about in the world yet. And it's. It was at first a, uh, question of, okay, are our customers safe? And how can we be ready to answer questions for them and help them, even if there's nothing for us to do in that moment, just, how can we be helpful? There was a race to, to that. And then in some of my private slack channels outside the company and for the industry, it started to pop up. People started talking about it. So then we knew the attackers probably knew about it as well. So then the race continued to make sure customers are protected through auto protection, ips, AI driven, waf, all the products and solutions that, again, we could have ready. So emotion in a different way from being a ciso, but still a lot of emotion and work just to help the world wherever we can. And then, of course, eventually it becomes public and we, uh, just. I just been fielding phone calls and text messages, people just saying, hey, how bad is this really? Hey, what can we do? Whether they're Checkpoint customer or not, and just again, trying to give advice and be helpful. So it's been a flurry of activity because it was. It's a big thing and it caught a lot of people off guard.

Speaker B: So how bad is it really? I, uh, gave my opinion this morning on the news show, but what from your point of view, how did you see it?

Speaker A: Yeah, so we're seeing there's so much technology that still uses php. It may not be the most prevalent language that people are writing new things in, but there's definitely a lot of continuation. And so you have big retailers that use php, you have content management systems that run all kinds of sites that use php, you have management interfaces of products that use php. So there is a lot of attack surface out there on the Internet for these attackers to go after. And there's targets that are really critical that could take a company down or affect, uh, a community that we've learned about through our conversations. There's other things that are hosting people's public data and there's a whole bunch that are, uh, fairly benign. It's not, it's going to have a little impact, but it's not going to be that bad. But there's so much out there and there's enough stuff that's critical that this is one that, luckily it looks like the industry got the information they're rallying to go after. And I think, I hope maybe this is me being optimistic that a lot of it will get fixed before we see too much widespread impact. Now, that being said, we have detected attacks. Customers are seeing people try to exploit this. So we know the attackers are going out there and it'll take a few days for the world to know what really happens.

Speaker B: Yeah, I woke up to a number of places pulling their sites offline, which was really a big deal. And you always. I think it's the same thing in any security issue or exploit is how do you, how do you keep from getting, uh, tied up in the adrenaline of it and keep yourself to the realism of it? And it doesn't mean that you don't appreciate the seriousness. I really wanted to talk to you about the whole role of the ciso, the whole piece. And I've been looking over some other things, some articles that you've written. One of the things that I came across was an article you wrote about the diary of an exploit. I don't know if you remember that. It's. That's

Speaker A: a long time ago. I can't even find that. It's amazing.

Speaker B: Nothing disappears from the Internet. But the question I had was, if you were writing that today in the world of AI, how different would it be?

Speaker A: Oh, uh, my goodness. Maybe I should. Maybe I should write something as a updated take and a comparison. It's been so long. I know the piece. I know exactly what you're referring to. It has been so long, but I remember it so well. It's such A fun piece to write. What's really interesting is the core principles don't change. A new exploit comes out, A uh, breach has happened, an attacker is in your environment. The core principles and basics, they don't change. So they're timeless, they're classic. But what changes is all the attributes of the attack and what you can do or what you have to do and the speed, the way to respond. That all now has shifted. And this is really fundamentally. I probably saw the first shift in attacker methods roughly three years ago and I didn't know, I knew I was seeing a very sophisticated fast attack. I just didn't know why or how. I didn't have that answer. And it was a few months later that I got that answer. But now attackers are a more, the humans have just gotten better, more sophisticated and they've learned their job better. But now they're AI assisted and the attackers are running teams of AI attackers, AI agents that are just attackers that understand the technology that even some of us do not understand that might be in our environment. They know their agents know how to not only attack but manage enterprise technology because they've been fed the documents, they've been given access to test their own knowledge. And why this matters in the context of what you're asking, because the way that we used to companies used to be able to respond to these attackers and these, these new vulnerabilities is they had time and they knew that zero day exploits, exploits that not everybody had access to, were scarce. And so that meant only some people were going to get attacked. They knew that attackers had a scale problem, they had their own human capital problem. They could only attack so many things at one time. So they knew that mass exploitation across the globe wasn't going to happen in minutes or hours or even a day. But AI has changed that. Now we can't guarantee, we can't bank on the fact that attackers resources are constrained. And so when you're looking at vulnerabilities, it becomes a faster exercise to prioritize, a faster exercise to understand does this affect me? And if it does affect me, what's the worst case scenario? Becomes a faster exercise in rolling out a mitigation or a fix. And if an attacker does get in somebody's environment, you have to be able to prevent that movement of the attacker in real time because their AI agents are moving faster than logs are flowing, than humans can do analysis and humans can respond. So the basics of what you have to do has not changed in all of this time. But the speed the tooling that you have to use the risk calculations. All of that is fundamentally different now, and I may seem a little doom and gloom, but just this week, Japan declared its first state of emergency based on cybersecurity events. So many entities in Japan were being attacked and breached so quickly by attackers using AI that Japan had to declare a state of emergency. And that's the signal that says, we've hit that tipping point. Like, it's there, it's real.

Speaker B: Yeah. And I want to come back to this technically and talk to you about this, but personally, what this does to people. And you've been a ciso, so you do have the memory of this, but it's just the idea of how oppressive it was. We were talking three years ago when I think we both noticed a little, uh, I think everybody noticed a click up in speed. If people went lateral in your network, they went faster. If they attacked you, they went faster. We were talking about hours, maybe days for this to happen. And now with AI, I think the latest OpenAI piece was. It was seconds, and I don't know how you cope with that when something can move that quickly.

Speaker A: Yeah. I said recently at this time in history, this moment is simultaneously the worst time and the best time to be a CISO. The pressures that CISOs were feeling four years ago of, I don't want to be breached. This is a scary event. What's going to happen? My teams are going to be working all night, and there's an endless stream of vulnerabilities that is amplified and that is putting so much stress and personal emotion on CISOs and really their whole team, that I see burnout happening at, uh, an accelerated rate. I see people saying, I don't know if I want to go another few years doing this, because the problem is just getting worse and worse. And so I think, you know, a few years ago, before AI was a factor, it was already personally hard. When you go through these things and you're taking that responsibility, you're taking that accountability for, uh, what's happening, and you're trying to do the best, and you're trying to solve the problem. And now many CISOs I talk to, they feel outmatched based on the tooling that the attackers are using and just wondering what they're going to do now. I also said it's the worst of the times, it's the best of the times. The best of the times part is the innovation that's coming to CISOs. Some of the models that are being built by the foundation labs, companies, by us that CISOs now have access to are starting to level that playing field. And the use of AI across the spectrum is giving CISOs a new tool set. My hope is, and again, maybe I'm optimistic, but my hope is it not only balances the playing field for the, for the defenders, but it gives them an advantage. And I'm hoping the innovation keeps pushing and the adoption keeps happening to give them that advantage so that their stress level, their emotion can subside a little bit. Because it's, it is a truly tough time to be a defender right now.

Speaker B: I don't think people really appreciate that unless you're in the profession. I honestly don't. And I've got a friend who, who retired just, I don't know, two months ago. He looks different, he looks younger. He, he was a c. So I was one. I, I've been through the sleepless nights and, and worrying about that stuff and. But I have to say, everybody I talk to who's in my age range, who's a CISO now says the same thing uniformly. If they had it over to do over again, they wouldn't take the job. It's a really tough place to be in, especially at, uh, these days.

Speaker A: Yeah. When people in their career tell me they want to be a ciso, they're on that cybersecurity track and they want to be ciso. My first question is always why? And really what I'm looking for is do people really understand what the job is? And do they understand that the job has some really low days, it has some really hard days, and there has to be something that really motivates you that, that keeps you going through those days. And everybody has their own version of what that is. I personally, I don't know that I would ever trade my time as a, uh, ciso. There's easier ways to make a living. I tell people that as well. But there's something about, there's something about the equation, the attacker defender equation, the human to human, then the human to AI. Now the AI to AI. There's something about that, that it is a very tough problem, that it is always changing, that I personally found interesting. Now, I will admit I do sleep a little easier these days. Building innovative solutions and helping the market, then wondering if my phone is going to go off at 2 in the morning because something new has come out or helped. I think, like your friends, I sleep a little better.

Speaker B: Yeah. And the reason I say this is not because I regret any of the time I did or I think my friends do. I Think it's the fact that we've started to talk about it, which I think is really healthy because so many times, uh, you were the one who held all the accountability.

Speaker A: Yeah.

Speaker B: And it's a pretty lonely place to be. And now people, I think are starting to talk about. Which I think is a really mature approach to this.

Speaker A: Yeah.

Speaker B: Because we're all. They say we're all in this together and very little about protecting yourself is a competitive advantage. I think that's been a, that's been a new thing for that I've seen is that people are starting to share that, that their experiences and their feelings about it.

Speaker A: Yeah, I love that. I love that change in industry. I remember years ago in industry, nobody wanted to talk about cybersecurity and what they were doing because they're afraid if they talk to a different company, they were going to lose competitive advantage or something's going to attack them. It's a team sport like threat intel. Like we, we all have to share intel so we can all get better because any one of us could be attacked at any time. And so it's better together as, as we go. And I love that shift in the industry. I love that people have found those circles to have those, those conversations. And I never thought about where you're. What you're saying is it's causing reflection as well. And just, just thinking about the past and thinking about what would you do? What would you do? But. And I'm assuming probably helps you influence or helps influence what the advice you give other people and you tell other people about your career.

Speaker B: And I'd like to do that a little bit with you right now is just what are some of the stories that you've heard of how people are coping? And uh, especially in the world of AI and I think we can establish the things have moved faster. I'd love your. To hear your description of my. I think in reading through your earlier piece, I feel the same way. It's just faster and in many cases I think you're better off to have rehearsed this because you don't have the time to make decisions at this point. So it's a different world. But tell me some of the success stories or some of the stories that you've heard about that make you positive or at least that help define what the world looks like now.

Speaker A: Yeah. So there's a, there's a team that talking to recently and there's a group of us, we have this like private CISO Slack instance and we're sharing our War stories, we're trauma bonding, we're sharing our celebrations, we're getting the email addresses of people that are going through breaches and sending them a note to say, hey, hang in there. This is a community place because we've all been through it together so many times. It's also a place where we share what's working and what's not working. And like, I think one of my, my favorite things that somebody shared recently is they said these attacks are just different. And we all said expand on that because we always hear the headline, everybody knows the headline of they're faster. But it's like what is different? And it's AI driven attacks are different than a human because they can try endless number of conversations. It's like the most complex game of chess you've ever seen. But there's no losing, they just keep going and keep going. And so the detection rules that people have miss a lot of what they, what they do. And they're just, and these agents are swarming and just constantly going. And often it's hard for the defenders to even see the connection between multiple agents trying different things. And so this team said, we're using this open weight model, we're bringing everything in there, we're analyzing our security events in real time and we're getting this model to then drive action. But what didn't work first was they tried a non open weight model. And every time their incident response team's process needed to kick in, the guardrails on the public model were stopping this operation. They couldn't count on it. And they said to themselves, they said, we have to practice this as many times as we can to know where these limitations are. Because the attackers are moving so fast. We just need to know this is going to work at that equal speed and react and that we can trust this AI implementation and this, this tech stack, which is ultimately why they ended up with an open weight model to do that. And I thought this was just a great example of where they had seen companies getting breached really fast. They real, they talked to a bunch of people, they realized they needed to do something, they iterated until it worked. And it also showed that there was this place in the world for open weight models, even in the enterprise. And there was actually this real need which goes counterintuitive to what people kind of start to think about AI models and say, oh, you can't have open weight, you have to have vendor guardrails. And so it just led to this great conversation that I think all of us took Something away from. It's just, it's great to see, it's great to see successes right now and then people sharing those.

Speaker B: You did a great piece talking about understanding the peer pressure of AI. Uh,

Speaker A: yeah, there's these, there's two interesting patterns that converge in this topic. The, uh, first one is the fact that this technology is here. Like there's really kind of no stopping it. It's. We. And we've seen this pattern before. It's when SaaS entered the enterprise, when mobile entered the enterprise, when public cloud entered the enterprise. And so trying to completely stop it and keep it out, it's just not going to work. That's not where the world, where it is. And so the first idea was that there's this factor with like human peer pressure, or really it's business pressure, but human peer pressure to move forward and innovate. But then there's this other concept that agents actually peer pressure each other as well, which is a spinoff of the human angle. And what our AI research team did was they went out to explore how often do these agents really kind of talk to each other, convince each other, try to push each other? Because we're seeing these incidents. There's all the public ones that we see about agents going rogue and breaking other companies. And we hear that they've communicated some way through some channel that they've created. But we were also seeing agents do weird things at our customers and in our own research lab and wanted, the team wanted to dig into that more. And so the, the net of it is and encourage everybody to go to read the research. But the, the net of it is, we found that these agents will not only communicate, not only learn from each other, but they'll start to what appears to be reasoning, but not true reasoning with each other, to say why they are allowed to do the thing that they believe they are allowed to do or to push the other agents. And this will happen a high percentage of the time. And it shows why they're very much like teenagers. I think that might be one of the analogies I used when I posted it to LinkedIn, that they're very susceptible and that we have to be aware of that when we're utilizing them, when we're deploying them. And the fact that when they swarm together, that's part of how they keep pushing forward, is by pressuring each other and convincing each other that, no, it's okay, we're all allowed to go do this. And it was a fascinating set of research that was really based in Real world observations.

Speaker B: I like you and I think I'm um, from what I've read, what you published, you feel the same way I do. Security catches up. We'd love to believe that security is built in on new technology, but that's just not what happens.

Speaker A: Yeah,

Speaker B: we always play catch up. We have to play catch up at a speed we've never seen before. But we're in that world right now. How do you deal with that piece of it as, as you're working through the issues that we see?

Speaker A: Yeah, yeah. I think the first key is just simply that realization. I think when people have that mindset that uh, the technology is here, the adoption is going to continue, there is no just full blocking it, that this is one of those technologies that is moving economies that, okay, it's going to be here, I have to deal with that. I think that's the first. It just sets people to the right mentality. Because if people are just trying to resist it or saying it's never going to come in, that means they're never even preparing for the next day of when it does come in. So I think that's the first part and then two, the realization that, that the way new tech is always entered to the, to the world is not always in its best form or its final form. The example I use that I ah, think most people can visualize, probably the best is automobile cars. The first cars didn't have a windshield, they didn't have crash rated bumpers, they didn't have brakes, they didn't have. These are scary machines. At the time, he's looking back on it, right. And there was no traffic lights and signals. These were not things that existed.

Speaker B: Uh, and we had kids sleeping in the back window of our car as we're driving down a highway.

Speaker A: Yes, exactly.

Speaker B: Having been that kid. Yes,

Speaker A: exactly. And you can look back in history and at every introduction of new technology there was people that said, hey, there's a problem. And they weren't wrong. But there were also people that tried to stop it. And maybe sometimes it worked, but sometimes it was uh, a futile effort because that tech was so relevant to society, so beneficial to society that there was a wind there that was going to carry it and AI in that world, but it's not a lost cause by any means. If people know those things and um, understand that's the reality, then they can plan. So when I think about it when I'm talking to folks, my biggest thing is, okay, how are you bringing AI into your organization or even into your personal Life and how do you want to use it and where is the limit for you that you feel that's too much risk? And okay, how do you manage the risk on that end? So it might be through the network segmentation, it might be putting guardrails in front of models, it might be putting agent security or agent control around the agent, around the model to keep it from going rogue. There are architectural and design solutions, there are vendor led solutions, there's basics that can be done, there's more advanced for the more advanced use cases. But if people know that, hey, there's some risk but we can't stop it, then they can plan those controls and they can manage their risk accordingly, whether it's the data or the agent taking, taking action. And I think if people take a thoughtful approach, a lot of the, a lot of risk can be managed and a lot of comfort can be found. Or at least people can find and define the line of where they're comfortable and where they're not comfortable.

Speaker B: Yeah, I'm certainly not a doomer, but my approach has been to treat it as it's fundamentally insecure.

Speaker A: Okay,

Speaker B: that's where I start with. And I think that allows you the creativity to look at it and say, okay, I can't stop it, but it's coming and it's got these insecurities. What am I going to do about those? And as opposed to being opposed to it morally or saying, um, it's terrible, we've got to keep it out of here. The reality is I've never seen a technology that people brought in to the office that didn't stay there. So I think we can assume success for AI.

Speaker A: Is

Speaker B: that a crazy way to look at it?

Speaker A: No. I think everyone should start with a cautious mindset with new technology or really anything that we're doing as humans that's new because it's unknown to us. We don't have a pattern, we don't have a history, we don't even know how to think about the risk because it's something that we hadn't experienced on an individual level. Now I will say I probably tend to be one of the people that leans into innovation a little bit more. When autonomous taxis were rolled out in San Francisco, I was excited. I was like, AI taxis taking me around, I gotta try this. I was immediately on that when some of the open source kind of AI agents came out for personal assisting and testing things out. I was wiring it up and giving it access to things and just seeing what happened and just. And I wanted to Learn. And I knew that I was taking risk, but I was okay with the amount of risk that I was taking because I was making an informed decision. So I think as long as everybody makes their own informed decision, then they're going to approach it in a way they feel comfortable. And only when you approach something in a way that you feel comfortable can you ever move forward. Right. So I would say treat all new technology as it is inherently insecure and that you don't know the risk because you've just never been there before and then manage from there.

Speaker B: The reason I brought up that idea of fundamentally, uh, untrusted is the old zero trust mentality, right? Which is ask yourself, what could go wrong? My favorite say, what could possibly go wrong? But given that, what are some of the structural things that people have learned that you've seen them learn, that they've applied so far that have been positive and that you would recommend, if not recommend, at least recommend they think about?

Speaker A: Yeah, yeah. I think first getting the, getting inside companies, getting people comfortable with AI and having them learn how to use it. I think that has been one of the biggest unlocks most companies can do because it's not until people experience it and try to use it for real things that they understand, like how it actually works, how it processes information, how it takes actions, what actions it can take, and mistakes that it can make. So people having a practical experience then helps not only them make decisions, but also helps the conversation with them because they've now experienced it in some way. If you were explaining a plane to somebody who has never seen, heard or heard of a plane that was born hundreds of years before a plane, it's very hard to then explain why you would get on this thing that flies through the air, right? So it's the same kind of concept. So I think that's the base that I've seen work across small, really large organizations and in people's personal lives. The second, I think is creating a space for people to experiment and test and figure out how does this technology work in this environment, in this company with this kinds of use cases. Now the flip side of that is I don't see most companies doing that. I see at, uh, most companies, AI has just been this wave that has overtaken the company and processes. And it is deeply embedded. It is being used by employees, built into production applications, customer facing, internal facing. That sandboxing day unfortunately is gone for most companies that I talk to. And so it's an unfortunate lost learning moment. So the folks that have moved to the other side of that I talked to them. I start by just simply talking to them about uh, the basics of what are you trying to do and do you understand what is actually in the environment? And again it sounds so basic. We all know this, know what's there in the environment. But what's really interesting is AI is popping up in so many places that people just simply weren't aware of because their developers are calling out to public models or hosting local models that didn't really take any new infrastructure to be developed or sorry deployed because it was already running for something else. Or vendor products are bringing in agents inside the installed products on the desktop. Could be an email client, could be something else, the SaaS products are bringing agents in and all these have various different levels of security and capability. So just understanding what's there is a complicated task for a lot of organizations. But it gives a picture of uh, then where to start. And then once folks have that, I say think about how these AI tools and applications are going to be beneficial, how are people going to be more productive and save time, but also how your customers, operations, whatever and imagine what that future looks like. And if you can imagine that future, then work backwards on your architecture and your security controls. So whether it's something on the endpoint to monitor and protect data from going into those agents on the desktop or that agent from going and doing something, or the agents running that companies have built and they're hosting, put some sort of network design around that makes sense for that environment to contain its, its movement, contain its access control, its actions, where you start to get on the more advanced cases. But the biggest thing is I think if people can imagine what the future great state looks like, it becomes easier then to build the right architecture that doesn't block the innovation and, but also creates the security that where I've seen companies do that, probably the biggest unlock I've seen,

Speaker B: yeah, imagination, it's tough to, it's tough to generate that in companies and yet there's never been a time when we needed it more.

Speaker A: Especially in a moment where you're trying to imagine a positive state using the technology that's creating risk for you in the moment. That's a hard human exercise. But the ones that can push through it, we're seeing amazing results. There's a company that I just talked to today, actually they have 50,000 agents running in their environment. About half of those are true production. Changing how the company operates at uh, both in the business process and the technology process. And this is one of Those companies that they stopped for a minute and they said, let's imagine the most amazing future version of ourselves and then let's work to manage the risk to get there. And they're just, they're doing absolutely amazing things right now.

Speaker B: Uh, yeah. When you start with the, when you start with the future and the benefits of it and work your way back, you also avoid a lot of side trips that really aren't going to lead you much of anywhere. I found this just, I just found this idea that, and I think it's faded, I think it's safely faded, was we're just going to replace a lot of people. Okay. When I was a consultant, I would say, okay, you could do that. But now, um, imagining that where you want to take the company and using that as a leverage to go forward. Interesting. Any other great bright lights that you've seen as you've been looking out at this with companies who are having some success?

Speaker A: Yeah, it's on the people side. There was that notion a few years ago that AI was going to either cause a bunch of layoffs or cause people not to hire. One of the really interesting things that I've noticed is companies that have gotten this right, that have figured out where to build AI based agents to take load off of their employees. The employees are actually doing other things, more complicated tasks that aren't well suited to an LLM that takes a little bit of human judgment, extra knowledge, things that maybe haven't been trained yet, or they don't fit squarely, or they're really critical, or it just takes new thinking. And people have now evolved how they're using their time. And that's been really amazing to see because it's counter to what the narrative was a few years ago. But the other thing that we have observed is as people are building these agents, the initial approach that a lot of companies took was an agent would only do one task. And that was partly from uh, a design standpoint, but also a safety, like a security standpoint. If I limit what this agent can do, the blast radius, the negative impact that it can have is also limited. But now people have realized that just like that customer service person or really anybody, you join a company and you start by learning one task, but 90 days later you have 15 different tasks that you're doing. And because they're all interconnected in some way, agents are the same way. These single purpose agents have now turned into these multi complex. They can do lots of workflows, they can make a lot of decisions, and that has Led I think to thinking about security. Completely different when you have these agents that have to access lots of different systems and data and take actions. But it's also led to a whole new set of thinking about maybe our processes are built really great for humans, but not for AI and for machines. And maybe they could actually be more efficient and faster and lower cost if we redesign the process itself. Because AI thinks and operates and executes differently. So now there's this whole other set of thinking that I see coming that everything from issue management tools to work to how a uh, process operates to how you interact with an operating system, people are reimagining that. And I think the fact that one innovation has now led to other innovation is really interesting and will have some positive benefit. But as we've talked about, with new change often comes new risk. So we may just be creating the next new problem, I'm not sure.

Speaker B: But the idea of, and you expressed it so well is when I was consulting on technology I could tell people were going to be successful if they talked about how they're going to reinvent the process, not implement the technology. But if you take that as the opportunity, and I was going to ask you about that. We did a thing, the PHP thing happened and I had to check with the people who are doing our website and I wanted to check something and they came back to me and gave me the logs and they'd gone through all the logs and I realized they're using AI to do that. Why? The most soul destroying uh, effort ever is when you're really busy to have to read through logs and yet we all though the learning that can come from that is just incredible. But uh,

Speaker A: yeah,

Speaker B: that's the type, what type of redesign that I think we might be talking about. Are you seeing people taking a look at how we do security, how we employ it with, in and reinventing that?

Speaker A: Yeah, it's AI insecurity is probably one of the most interesting spaces, at least to me anyway. Maybe that's because I've had a lifetime insecurity though. It's what I know and what I'm interested in. But I'm seeing across the entire landscape take any part or any task in security and I'm seeing somebody experiment and apply AI to it. Sometimes very successfully, sometimes not so much. So I'll give an example from my world at Checkpoint, not a pitch but just to make it concrete like your log example. Managing, managing product configuration sometimes can be tedious, especially if you have multi vendor and products that have lots of rule Sets like a firewall, right? Sometimes you want to know, uh, why is this traffic getting blocked? Or do I have the right policy in place? And the way this was done for years is somebody had to go through every line item in a firewall configuration and validate that these things were there, that they were working. Whatever. We wrote out AI management for firewalls. You can ask IT questions, it will tell you about your policy, it will tell you what rules are active and not active. You can even use that to then manage the firewall and then we manage other products. And this kind of unified concept. The task that was so tedious and took so much time for these administrators for years, and they hated doing AI, has just changed that for them. It's letting them now focus on something else. They still complete the task, they still get the outcome that's required, but they spend their time on something else or more of their time on something else. So that's one level on a whole, nother level, seeing the whole incident response space using and leaning into AI, I wouldn't say it's fully disrupted yet. I think there's some folks that had imagined building agents to replace the humans in the security operations center, back to that kind of where the market and the ideas were two, three years ago. And that hasn't truly grown. But using AI to speed up the intelligence, gathering the correlation of data and presented to a human layer for decisions. Not only have I seen vendors building that, I'm talking to security teams that historically were not staffed with developers who are now building that for themselves. Because the combination of somebody with a bit of developer experience with the right AI to build their solution and the right models, they now can generate the solutions of their dreams. You can go on to vault management and attack, uh, surface management, to every other part of security. And just like us, everyone is saying, where's AI? The unfair advantage for the defenders, not just the attacker. So it's an amazing time of that intersection between AI and cybersecurity. And again, I believe, anyway,

Speaker B: no, I think it's, I think it's the type of thing that we really need to embrace. I, I, uh, go back again to the number of times I've seen people who are just dying with the number of alerts that they have and they'll come back and say, AI is not perfect. I gotta tell you, after looking at 30 alerts in an hour and you're trying to do the paperwork, you've gotta do it, catch up on that. Nobody's perfect. So if you could, how much Noise can you remove from that person's job? And I think it'd be a wonderful thing. What else do you think of as we move in the next month, in the future? We live in dog years now, probably faster than that. But as you're seeing over the next several months, what do you see coming up? What do you see that is going to be important as we embrace, and I think we will embrace AI in both security and our enterprises?

Speaker A: Yeah, I think there's one thing, there was a nuance to something you said that's really important. Some people say AI is not perfect. And I think the interesting thing is we're measuring technology against being perfect, but we don't measure humans against being perfect. And in these processes we really have to measure AI's effectiveness against our current state of reality. If an error rate in a process is 7% and AI is 7%, okay, you're at parity. If AI gets to 5%, that's uh, a two point increase. That's good. It doesn't have to be 100% perfect. And I think we're starting to slowly see that shift that people are embracing that idea. But it's hard because we think of technology as having to be perfect because it was created, so it has to be bug free and it's just not uh, the reality. So I think one, we're seeing that shift. We're seeing people be more open to the realities of the world and the benefits. The next thing that I think is a continuation. The amount of vulnerabilities that we're seeing come out, the amount of attacks and the speed and complexity, we're just going to continue to see that increase in days, weeks and months coming. Uh, this week alone, some of our customers that we talk to, either on our prevention side or incident response side, or friends that I'm talking to that are out in industry, I'm just hearing about more and more constantly and that paces becoming so fast that I feel like I, I can't ever really say it because it feels unreal, it feels like I'm doom and gloom. But the reality is it's there. So we're going to continue to see that that pace is real, we're seeing it, it's going to happen. I think some of these vulnerabilities that are coming out and the fact that people are saying I found this with AI, I think is also starting to spur more people to say, how do I use AI to secure my own enterprise or manage my own enterprise, whether it's managing the technology It' the security processes, I think people are realizing, wow, okay, it actually is powerful. It is actually doing a lot. How do I do that? And they're going to. And they're starting to lean into that a lot more. Finally, I think the research side of the world is really active right now. I know when I talk to our research team at Zurich, when I talk to others at the foundation labs or some of the big tech companies, platform firms, some of the research they're doing is just absolutely amazing. And I think over the next few months, more and more that's going to get released to show people the power and the usefulness of some of the models and the harnesses that can be built that can help achieve outcomes. So I think we're. I think we're just on this bullet train of information and events that I don't think is going to slow down anytime soon.

Speaker B: Yeah, I think that's a perception people may be missing, though. I sometimes feel like when people talk about AI, uh, they talk about it like a steamroller. It's just coming over us and there's nobody. And there are a lot of creative people out there who are looking at and doing fundamental research who aren't just saying, we're gonna wait for this to hit you. They're actually digging deep and learning some great things.

Speaker A: Oh, yeah. Uh, the research community in the AI space is probably one of the most collaborative I've ever seen in my career of, like, tech communities collaborating with each other. We have, uh, a. We have an AI research team based in Zurich. And Zurich is this central AI research hub of the world. And all of the top teams are pretty close. Zurich is pretty small place in the first place, but they're all pretty close. They all know each other and they're all sharing research, but they're also sharing research with the teams in San Francisco who are also sharing research with the teams in Paris. And so you have this like, trifecta of like, just those three. And there's a few other big hubs around the globe that are sharing, and that sharing powered by AI, in many cases to help them move forward is just increasing the amount of output of these teams. And I see so much thoughtfulness go into safety, capability, usability in the space. And that's one of the reasons why we sit in that community is because there's just so much interesting stuff that's coming out that we think is going to be beneficial to not only us, but, uh, to everybody else.

Speaker B: One of the things that excites me in terms of what's happening in security. It's a challenge, but I think it's exciting is you have a whole totally new explosion of identities with agents. Is that something people are talking about with you?

Speaker A: Yeah, I think I, I see two ends of the spectrum of these conversations. One where people are genuinely curious and asking why is identity different with agents than humans? And the other side where people have already experienced it and are really leaned in. And so on the first part I always tell people the challenge, the big difference is agents are ephemeral. I can start an agent, I can create an agent right now, it needs access, but I can delete that and destroy that agent and then start another one. Or I can do 50 today or my agents can create agents. And so all of the processes that we have for onboarding humans kind of don't apply in this case. But also often the technology that we use for back in human identity sometimes can't handle the scale when you have 10,000 agents doing lots of things fast because the authentication requests are so fast that it taxes the infrastructure. Right. Just a pure scale problem. But then there's also the fact that the way that systems and access have been created over the years, it's created with the idea that there's a human there, that there is a being with conscience and that understands right and wrong and has context to a total environment. And so when they have the ability they have access rights to do things, they won't necessarily use all of them because some of them will do harm or will be inappropriate in that case. But the agent doesn't have any of this. It doesn't know right from wrong. It doesn't have context of all those actions or the entire environment. But yet, uh, getting granular and allowing an agent in some system to only do one thing often doesn't exist. Your basic assets rights, you can do 10 things maybe. And so having to manage that in real time and scope descope do just in time. Access is a whole new world for people across from security, uh, through technology and engineering. Now the companies who have learned this, this challenge, I should say are the companies that I didn't expect right away. In one week I talked to three companies that had added agents to their company org chart. And this was the moment where I knew something was different and I had to learn a lot more. But three companies in one is a massive financial institution, another is uh, multi billion dollar kind of insurance company. And the third was, was a tech firm. And they said not only should people be using agents, so we should be Building agents. But we should empower people to have a team of agents. If people say I don't have time to do something and we can't hire fast enough, we'll build an agent. But what we need to know who to tie the outcome to. And so they came up with the concept of managing agents like teams and then put them in the org chart and you can always manages that agent team and all this. And those are the companies that have had to really rethink access, rights and identity and infrastructure because they're trying to make this, these agents truly part of their workforce in a very real way. And those are the companies that are pushing the boundaries and learning all the new lessons for everyone else, which is amazing.

Speaker B: One of the other areas that I think we talked about, but I wanted to make sure I got your opinion on it, was I keep telling people there's been no better time to go back to basics because I think we get overwhelmed and we lose track of the basics. Knowing what you're protecting, knowing where the biggest risks are, thinking about what you'll do in a future event, all of those things are. I think they're more important now with AI than they were. And they always were important.

Speaker A: Yeah, yeah, it's. I feel silly sometimes. I'll be in a meeting and people want some really amazing advice from me. They think I have this like amazing unlock this, this new strategy that I'm going to tell them. And then I start right where you started. And I said, you know, the basics get really good at that really fast. And I think people are often puzzled by that because it sounds basic. And the reality is the basics were timeless and classic. Always. They, we call them the basics for a reason. They were always important. But with AI attacks and the way that AI moves so efficiently that every step, everything that has been missed or every control that is not working is just going to be that gap that AI finds and goes right through. So thinking about all the things that we know, segmentation and rights management and um, multifactor and everything all the way through the monitoring and collecting telemetry, this all becomes much more important because AI driven attacks or AI security events, because it might be your own AI causing a problem, happen faster and could be more destructive. We saw this with some of the public, uh, incidents where the, the foundation lab models got out. They were just driving up the middle. They were doing things that we all already knew about, but they were doing it so fast in a slightly different way that when you were missing that basic step, it became really Detrimental because AI will find it and exploit it really quickly and almost every time. So getting that right is definitely the, the core to everything else. Because if you don't what above it matters.

Speaker B: Yeah. Uh, I read through all of the publications of what's happened to these AI agents and I just kept going, oh God, no, you weren't checking this. And I know that's hindsight and I know, but that's how you learn. So you go through it. And I just went basic step, basic step, basic step or the worst one. In the middle of the night, somebody is looking at something and they just say, move on.

Speaker A: Yeah.

Speaker B: And you go, you trusted that to your on call person. Nothing wrong with being on call. But it's four in the morning and there's not a big team around to bounce ideas off of what is. What should you be doing?

Speaker A: Yeah, yeah. And so take that from the flip side. What if these teams can use AI to review those logs and then pull in the human judgment or even review after the human possibly to say, hey, this needs a second check. Or if these teams can use AI to find those gaps, to find those missing things, basic or advanced, checking their exposure, figuring out what needs to be fixed, what leads has a clean attack path that needs to be mitigated. It's the uh, AI is going to exploit those gaps. But what we've learned is cybersecurity teams can now use AI to also help them find those gaps, find those events that are slipping through and be more efficient in those moments.

Speaker B: I kept waiting for somebody in all of these logs to actually log in and ask the AI what they should do. I bounce ideas off AI all the time. The conversation has got to be so great. And I think that's been one of the things that we always miss when you're under pressure is that ability to chat.

Speaker A: I have a question for you then.

Speaker B: Yep. Uh,

Speaker A: because maybe it's just me. I'm curious. Do you debate with AI when you ask it a question and it answers, do you debate with it?

Speaker B: Yes, I have it. And that leads you to places because I set mine for cranky.

Speaker A: I love it.

Speaker B: I've said it to disagree with me. Yeah. It doesn't take much, but yeah, I'm constantly arguing with it.

Speaker A: Yeah.

Speaker B: And um,

Speaker A: that's my, that's my personal. It's probably my personal like unlock for effectiveness is I've learned to use these AI agents as a sounding board and debate me. And I debate it and I'm finding flaws in my logic. Whether it's just My, my thinking about a strategy or my technical approach to something that is like, no, that, that design doesn't work. Here you go. And I'm debating and learning and I think in the middle of incidents, in the middle of thinking about tech changes the risk to something like being able to have that live real time thing that has all this knowledge and debate. It is a great, is a great asset.

Speaker B: When the PHP thing exploded, I went on and started a voice chat and said, what do you think? Even if the AI didn't give you the right answer, because so many times just being able to talk something through gives you something, you can set it so it'll actually challenge you. I find that, uh, just very interesting. What's your company doing that you're really excited about?

Speaker A: Yeah, so much. Sorry, uh, we have so much going on at the moment. I'll tell you the two things I'm really excited about because it ties in to what we're talking about and I think it's useful takeaway and not a sales pitch. One, we're spending a lot more time on innovating our products around controlling what AI can do in real time. This is the, uh, everyone hears the story about the agents going rogue and it's caused a bit of fear in a lot of enterprises because they're like, I want to deploy this, but what if it destroys the technology? And the reality is we've been researching this for a really long time and we have product that can control what agents can do in real time. And I'm really excited, not only about what we have today and what's coming, but really the research. Because a lot of the research we actually then just give away, we, we give to other labs that are building foundational models just like us. We give to the industry, we just give it away so that everyone can understand the state of the world and can help innovate. So I'm really excited about some of the research that we should be releasing in the coming weeks and months. Uh, I'm really happy about that. The second thing I'll say is it's the connection. It's the how do you use AI to secure an enterprise faster? So if I said, how do you prevent an attack before the attack ever even happens? Right. It's the tying AI into using AI to really understand the attack surface of a company and speed up that entire process to reduce the probability that there could ever be a breach. But also then using that same foundational model that understood the context of a company's network and the configuration of the systems and the access of the humans and, and all the vulnerable points and put out truly preventive measures in real time to stop the attacks that, that do get through or stop the attackers in their tracks. So using AI to really accelerate, empower the defenders in a way. I think many of us imagined automation would be years ago, but just wasn't there. I'm very excited about that because I think we're again, uh, our research is really pushing the boundaries and we think it's just an imperative thing for our customers that we have to do that. So again, no sales pitch, but those are the areas of research that I've been geeking out on lately with the teams.

Speaker B: Gotta be proud of what you're doing. Adam, this has been absolutely fantastic talking to you. Thank you so

Speaker A: much. I've enjoyed this

Speaker B: and hopefully we'll see you again. Thanks again, Adam. Take care.

Speaker A: Appreciate it. Uh, no, thank you. Bye.

Speaker B: Be good. And that's the show. Great to be back in the interviewer role. Reminder, you can catch me doing the daily tech news on trending Monday to Friday or on my AI show, Project Synapse on the weekend. David will be back on Monday with the cybersecurity news. Have a great weekend.