Fighting Machines with Machines: AI and the Future of Cyber Defence | EP 86 | Steve Meckl, Cyderes

Speaker A: Welcome to the Cybersecurity Matters podcast. Your hosts today are, uh, me, Harry Baldwin and Matt Rose, two members of the NewCo cybersecurity team. And we're delighted to be joined today by Dr. Steve Meckel. Steve has built a fascinating career across cybersecurity, spanning software engineering, incident response and security operations. He spent more than half a decade with the FBI, ultimately becoming unit chief within the Cyber Division, where he led the Cyber Action Team and created its Cyber Denial and Disaster Inception program. Since then, his career has taken him through senior roles at Symantec, Norton Lifelock, Accenture and Google Cloud. Today he is SVP of the AI center of Excellence at Sideras, where he leads the company's application of AI to large scale security operations. It's quite the introduction. Steve, uh, it's great to have you here today.

Speaker B: Yeah, thanks for having me. It's my pleasure.

Speaker A: Awesome. Fantastic. Um, and for all our listeners today, we're going to be talking about Steve's career journey. It's time with the FBI leadership talent and how AI is changing security operations and the wider threat landscape. Um, Steve, we always ask our guests the same first question. Um, and that is, how did you first get into the cyber security industry?

Speaker B: I came into it actually through cryptography. So my first career was software engineer. And I was, remember working for a company in Michigan in about 1996, had nothing to do with security, but they needed to be able to digitally sign their software, install packages. Part of this larger, um, remote device, uh, configuration product we were selling. And no one understood encryption. And, you know, all these more senior people on the team were talking about how hard it is. And I was like, oh, hard problem, I'll go, I'll go solve that. So I got a copy of Applied Cryptography, um, which I read from COVID to cover, um, dove into the Microsoft documentation and figured it out. That was really the first security thing I did was building this, you know, this way of digitally signing, encrypting software installs and kind of made a little career in a couple different startup companies, uh, after I moved to Los Angeles, just being the guy that understood crypto. Um, and what really solidified it was I read Bruce Schneier's novel, or, uh, sorry, Neil Stevenson's novel Cryptonomicon, when it came out in 1999. Ish. And I remember finishing that book and just thinking, this is what I want to do with my life. You know, I've been doing software, but I wanted to be in the security realm because it seemed so much more Interesting than just shipping, you know, business applications year in and year out.

Speaker A: Yeah, fascinating. Did you, did you have technology driven parents or was it, were you the first in the family to go into something like this?

Speaker B: Um, first in the family as far as I know. Um, my dad was an accountant, uh, by training, and then went into sales. Um, my mom, you know, worked in the home. My grandfather though, he was a mechanical draftsman in Detroit. Um, you know, he, he immigrated from Germany in the 1930s and pick up a job basically just, you know, drawing mechanical drawings for, you know, engine parts and buildings and bridges. So he was very technically minded, really strong in math. Um, but I think one of the things that influenced me for my parents was my dad always had a bookshelf full of science fiction novels. And so as soon as I could read I was picking up Isaac Asimov and all those old classic sci fi writers and just I think that had a big influence on how I thought about the world and my love for technology.

Speaker A: Fantastic. That's a great answer. Um, and I know Matt's, uh, got some questions for you about your career so far, so I'll, over to Matt.

Speaker C: Thanks Harry. And yeah, just on that, that last, uh, answer, uh, Steve, um, you mentioned that, you know, when you, when you were, when you're an engineer, you were drawn to these kind of complex problems and trying to solve them. Um, is that something that has always been there prior to your professional experience? And how much of that is solely professional? Does it translate into your kind of personal life too?

Speaker B: And I think it's just part of my personality. I think whenever I hear of something that people are either afraid to try or they think it's too hard to do, I'm just naturally drawn to those things. You know. I started reading Stephen King when I was 11 because my sister was telling me how she was staying up all she couldn't sleep because she was so scared reading Pet Sematary. Um, in my early late teens, early 20s, um, I was a sports skydiver. Um, had a little over 330 skydives before I packed that up and decided to play golf instead. Um, but whether it's personal or professional career, I've always sort of been drawn to the unique thing or the more difficult problem. I played soccer all the way through halfway through college, um, competitively I was the goalie because that was the unique position I wanted to be the one that stood out. So it's always been kind of part of my personality, um, where if other people think it's hard or Scary or difficult. That's really where I'm drawn to.

Speaker C: Wow, really interesting. And you mentioned, or we mentioned in your intro actually that you worked for the FBI for quite a considerable amount of time over um, a decade actually. What was it that attracted you to that side of security and that world and how has it approached or has changed your approach to cybersecurity today?

Speaker B: Um, the thing that really drew me to it was um, I think you'll hear this from a lot of people that work in um, law enforcement, counterintelligence, military. I had a moment where I had that thought of why doesn't somebody do something? Um, I remember working at Symantec on the Norton Products in 2003 ish. And I was researching all this malware to try to figure out how we were going to detect it by adding new features to Norton Antivirus or Norton personally Firewall. And in that research I kind of realized that security had gone from, or like the hacking world had gone from nuisance. Like hacktivist people just causing nuisance, trying to almost like the equivalent of, you know, graffiti artists, you know, it was almost like tagging. It was kind of that level of uh, attacks. In the span of a couple years it turned into a multi billion dollar international criminal market. And um, I had like a feeling of despair because like we're spending all year like crunching for six months out of the year building the software. And then you know, in a week or 2 Some 16 year old kid from Scandinavia cracks our software and gets around it. It was like very um, demoralizing for a period of time there. And I started to think why doesn't somebody do something? And then my next thought was, well, who does do something about this? And I started doing research and realized the big three were nsa, CIA, FBI. And I'd had a, like, you know, really loved crime, um, shows and FBI dramas growing up. Um, my wife, that's one of the things my wife and I have in common is we would get just sucked into the Law and Order marathons on TV on the weekends. And I thought, oh well if I'm going to do something about it, that's, that's where I want to go make that difference. Right. As opposed to um, the other two big agencies at the time. And so, you know, uh, and I was, I was not fit for FBI duty at the time. I was, you know, like many engineers, I wasn't eating well, wasn't exercising, excuse me, was out of shape. And so I put in the application, uh, during the Super Bowl I think it was in 23. Um, it was not a good game. I remember I was bored, so I just filled out the application. Next day I started dieting and exercising. Um, and within a year I had lost a bunch of weight, got in shape, made it through the process miraculously, um, and was sitting in a classroom at Quantico. So it was kind of that quick from having that thought of I want to do something to impact the problem and serve my country to actually being in the organization, um, working as an agent.

Speaker C: And then you eventually work your way up to leading, uh, the FBI's Cyber Action Team. Um, what did that experience specifically teach you about instant response?

Speaker B: Uh, it's funny. Um, it taught me how fast you can get used to a crisis. So most, if you talk to most people who are working in corporate security today, they might have been through a breach once in their career and they hope it never, ever happens. In the end, when it happens every week for three years, you just kind of get used to, that's the way things are. You know, I had, I was fortunate enough to, to be leader of a really talented group of folks at FBI headquarters. And they did the hard work. They were, they were getting on a plane and flying to all over the country, um, helping organizations that were being, um, broken into. My job was, was handling the administrative part, giving them air cover, funding, tooling and the stuff. But you know, I spent all my time in dark rooms, insecure facilities, talking with our partners at other agencies and other governments, uh, how we're going to handle these problems. But it was, it just became the normal that, you know, Friday at 4:00', clock, I'm wanting to go and end the week and go out for, and spend some time with the family and get sucked back to the office and deal with an emergency and learned that, you know, for me, what it learned is it's not my special skill. There was. So I learned kind of where I fit into this. Like, I'm not the, I'm not the, the smoke jumper who you want to send on site. Um, I might do that occasionally, but that's just not the, the skill I bring, the technical skill. Um, there are people that are very bad that were much better at that. Where I fit in was actually being able to keep the temperature down, explain the situation without, ah, getting everyone spun up and then focusing on the problem. Um, and I learned that if I can do that, I have a much bigger impact than just doing the technical work. Because in an emergency a lot of people panic, they get decision paralysis, they start Thinking about all the different ways it could go wrong. And where I fit into the equation is I keep people focused on what are the things we're trying to accomplish, what do we need to get out of this, what are the different pieces that need to happen to either build this investigation, um, protect the victim and get them through this, or, you know, what operations do we have to conduct so that we can leverage a situation to benefit the, you know, our government, the victim, or whoever, whoever is involved, whatever the interests are involved. Um, and it really learned that in a team, you don't have to be the best at everything, but you have to bring your specific strengths to the table, um, and leverage, leverage them, and that's how you get things done. Um, you can't just. I, I had to put my ego at the door and realize that even though I have a lot of technical skills, even though I have, you know, I'm highly educated in the field, there were other people that had the specialty specialties that I didn't. And if you put them on in the field, they're going to be much more productive. And I had a different set of skills that I could leverage to help in the way that I can. And so, um, understanding where I can contribute and focusing on that was. And really, I think checking my ego was really, I learned that as a big lesson for me as a leader was that I didn't have to be the best at everything. I just had to be the best at what I'm good at.

Speaker C: I think it's really interesting, particularly to hear, you know, the kind of normalization of that emergency or incident and how value valuable that must have been as an experience and also finding out, you know, where your specialism lies as well. Ah, in action too. Um, but, you know, you've worked across a variety of different spaces, whether that be government, big tech, cyber security startups and vendors. Um, but what are some of the core kind of things, differences or lessons that you've learned from those different spaces that have kind of carried through to today as well?

Speaker B: Um, I think I learned different things from different categories of work. So in big tech, um, you can really fall through the cracks. Um, I think some of these companies are so big that your expected contribution isn't as much as you think it is. Um, and I found this across multiple. Whether it was Accenture or Google or Symantec, you can fall into a trap where you just punch the clock and get your work done and no one really pays attention. But if you want to make an impact, you really have to go the extra mile and try and find ways where you can have an impact above and beyond. Like punching above your weight, I guess, would be a good metaphor. Um, in the government, though, that can be sticking your neck out, um, can get, can cause some trouble, right, because there's a chain of command. You can very easily, uh, step in other people's toes or cross lines into somebody else's mission. And so in the government, you still want to do that because everyone's mission, everyone there wants to, is focused on the mission. You don't take that job for the fame and the money. You take that job because you believe in the mission and you want to make a difference. Um, but you run into politics because everyone's still fighting for resources because they want to accomplish their part of the mission. And there's a finite amount of money, um, you know, taxpayer money to spend on these missions. And so you run into politics a lot. And I had to get really good at working with other people and having empathy for their side. You know, I had my fair share of interdepartmental conflict or inner field office conflict. And, um, I had to learn to approach it from a perspective like, what is their view on this? Like, I feel like I'm right. But how would they, how would the other side, what's their perspective? What are they trying to solve and how can I come to an agreement? So that ability to build a consensus, to have empathy and to approach problems as an honest broker really, um, and not have an agenda, like, really approach the problem is trying to help everyone solve it, not just doing it because I'm getting something out of it, um, is really sort of was beneficial for me because people would come to me for problems and it helped me accomplish my mission, uh, better. But that wasn't necessarily the approach that I take in the cybersecurity business today. I still, I still approach things on, you know, without a lot of agenda. But the mission, believe it or not, in the private security business, the mission severity, like, so the stress that people are under when you're defending your, you have an existential crisis, defending your organization, your company, that stress level is so much higher that, um, you can't add. You almost have to approach it with a lot more energy and less, uh, you know, my calming effect almost, uh, makes. If you're stressed and if you're really stressed and I'm not stressed, it's not a good fit. So I have to amplify more energy to the table because people just, you end up looking, um, apathetic um, and people that are stressed out hate nothing more than somebody who's just like, calm down. Uh, and then having to lead with more energy, I think is a new one. Because when people are in a crisis in the government, everybody knows that nation states are hacking into other nation states. We have lots of terms for like cyber network exploitation. We've built government agencies around it. It's just expected that that's going to happen. And when it happens, you react. And it's, it's not something to panic over. You work the mission, you try and win the mission. But in, in the commercial sector, if you're, if you get compromised your network, especially things like crypto ransomware, it's an existential crisis. I mean, I've worked with companies that, uh, literally if they didn't recover their data, they were going to go out of business. And if you're the CISO or the security director in the hot seat, when that happens, there's nothing I can do to calm you down other than to solve the problem for you. And so approaching it from having to approach it from that angle where you've got a very stressed out, um, victim organization and having to kind of match their energy a little bit, um, and work through that, it's like a, it's a different psychological problem. Um, it really was kind of, I would say it was shocking to me going straight from government working incident response for the FBI to working leading incident response at Symantec, how much more stressed out I was working at Symantec and incident response because every problem was like life or death for that company. And so, you know, the, the just working with people under that kind of stress all the time is to. Takes a toll on you.

Speaker C: Yeah, no, you've answered my next question there. I think on that, which was kind of how you found that transition from government to the kind of commercial space. Um, but also before Sideras, I mean we mentioned big tech before, but you headed up, uh, Google Cloud's, uh, autonomic security operations practice as well. Um, was that kind of where you kind of really come into exploring automation within security operations?

Speaker B: It was, I think, what the idea of autonomic security operations, this was a term, I wish I had coined it because I think it's a great term. Um, it was a term coined by Phil Venables, who's the CISO at Google. And there's this really talented, uh, guy that brought me over to Google named Iman Ganezada, who kind of built us out as originally at a program at Google. I was hired to help them operationalize and scale it. That's my background and the core of it is security alerts. Handling security alerts or incidents isn't really much different in nature than what site reliability engineers do in managing cloud apps. Things go wrong, people are logged in that shouldn't, or people can't log in that should, or things are running that shouldn't. The biggest differences in SRE world, the it doesn't matter if, if it was user error or if it was the system breaking or a configuration problem. Your job is to get it back up and running. And when we, when we moved applications from the data center or the like, the local data center, the cloud, they scaled to the point where engineers uh, couldn't do anything manually. So SRE came about to figure out, okay, let's, if you see the same problem more than once, let's automate it that way. The knowledge scales, it's persistent and you're working on new problems. And we can scale better with the amount of like outages and stuff. And they introduce things like error budget that were very clever. In the security space you're having those same kinds of alerts happening. Um, the main two differences is one, it's very one sided, the observability. So no one's ever alerting you to say, hey, everything's great. You know, it's always there's bad activity or potential bad activity. So there's a lot of bias in the signal. And then the problem you're trying to solve actually does matter if it was a malicious user, a careless user, known benign activity, or an actual attacker. The why the thing's going wrong matters more than just fixing it. But the techniques to address it are largely the same. And so the real light bulb moment I had was um, why are we trying to reinvent the wheel in SecOps when SRE solved this 20 years ago? All we have to do is adopt the parts of SRE and DevOps that apply and then we can have that same level of scaling that um, like the engineering world does. And it was pretty revolutionary at the time and I think um, and it was backed by you know, um, large, large security operations centers like Google's and like many of the big financials, they're already doing this. They've been, they figured this out a long time ago. If you're at a big, big bank and you're dealing with fraud, like you have to automate all that. You can't just have operators watching transactions and making judgment. You have to build analytics that Handle that stuff automatically. And so, you know, I think that's the only way that you can scale with the problem without blowing out your costs, you know, because today we're seeing an exponential growth in alert volume and incident volume. Um, even at the same level of, you know, I'm fortunate to work at a large global MBR provider. Um, we're seeing an exponential growth. I, I talked to my, my friends in my professional network that are working in other MSSPs. They're saying the exact same thing. The, the attack volume is always getting bigger. And if your only way to scale is with people, then you're going to. You can't afford it at a certain point, because if an analyst can only handle 10 to 20 cases a day, and if your volume grows by 10 to 20 cases a day, you got to hire another analyst. But if you build code to do that, then you're only. You're paying a much lower compute cost. And you focus your analyst on the problems that you. The new novel problems that aren't well known and require their sort of their education, their expertise and their experience to deal with.

Speaker C: And moving to today, uh, you're now with the team at Siderez. What was it that specifically drew you to, uh, this step in your personal career and their presence in cyber security kind of space?

Speaker B: I would love to have an altruistic reason for this, but it's actually a little bit selfish. I had gotten promoted, uh, to the global leader for the NDR service at Symantec right before, like, it was two months before we got acquired by Broadcom, and then we got acquired by Accenture. And so I had never gotten a chance to, um, implement the program that I wanted to implement. And then, um, I'd spent time at Google and gotten to know Sideris because they were the big delivery partner for our Autonomic Security Operations Program program. Um, so we built a good relationship with them. And then, um, you know, after some time at Google, I had the opportunity to go to Sideras and actually do all the things that I wanted to do before, you know, my, my plans got interrupted at Symantec. And so it's sort of selfish to be able to take that opportunity, um, go run another large global team, implement all the things I had learned from aso, um, and make an impact, uh, on the business there. Um, and it was really lucky because we had such a good relationship at Sideras. We would get a client really bought into the methodology. Um, they want to sign a deal, and we'd say, okay, let's Introduce you to Sideras. They know this stuff really, really well. They're going to take care of you, um, and then to be able to jump over the fence and be the one taking care of them, um, was an opportunity I just couldn't pass up.

Speaker C: Moving on to the talent section of the podcast, I'm keen to understand, you know, what makes a really strong security team from your, your prior experience leading teams across government, big tech and cyber security businesses.

Speaker B: Oh, that's a, that's a big question. Especially because it's changing so much right now. Um, if you asked me in the pre, sort of pre AI, um, I would tell you it takes a couple things. One is you need to have a bedrock of technical skill, um, and really knowing the environment. I think if you don't know the environment you're trying to protect, you can't protect it. You know, it's like if you tried to protect uh, you know, your physical security and you're trying to protect a building but you didn't know what walls and doors and windows were, it'd be really difficult to do. And so I see, where I see a lot of teams fail is they hire people that have that trained on security analysis but they don't know how networks work, they don't know how, they don't know what happens when you double click on an executable in Windows. They don't know how Linux works, they have no idea how the cloud works. So starting with a, like sort of a baseline foundation of technical knowledge about how the environment works is really important. Um, because then you know what to watch, you know what normal looks like. You know what happens when you install an application legitimately versus you know, you, you, you do it using any number of attacker techniques. And um, that gives you sort of that, that foundation. Um, then I think you need to, you need diverse ways of thinking. Um, I've seen a lot of one dimensional teams where everyone's, everyone's the creative thinker that wants to innovate. No one knows how to run a process, right, that's going to fail. So you want to. There's kind of four categories of thinking that um, I think you need to have a balance of. One is the process people, the ops, people who build and run processes. If you don't have good documentation, you don't have runbooks, you don't have playbooks, then you don't really know what you're doing and you end up with really inconsistent results across the board. Um, then you need some, what are called deep thinkers or Innovators, these are the folks that are going to see a problem and want to solve it. So they're going to, they don't like to run the process or build the process because it doesn't excite them. They can do it, but it's not their main focus. But they want to go solve the problems of tomorrow and help you innovate and move the forward. Um, then you need some folks that are very goal oriented, think project manager types who are like, I know you want to go solve every part of this new space but we need a result by the end of the quarter. So focusing on getting things done. And then you need your relationship folks that are really focused on. These are your champions who, if you're in like a, if you're an internal security organization, um, you hear a lot about having champions that will go interface with it, interface with finance, interface with hr, interface with all the business units and be the champion for security to help make sure that the security organization is meeting the needs of the business as opposed to just being the place you go to be told no. If you can get all those kinds of things together and working cohesively, you can have a really high functioning team. Um, and um, that's changing though. I guess I'll answer the next question which is like how's that changing in the world of AI and automation? And I think what's changing is the, the bedrock skill is going to have to include engineering. I don't see in 10 years we'll have a lot less people manually doing analysis. We'll have people teaching, writing prompts, building context and creating agentic loops that will, that'll encode what they know into the system so that the system can form that activity. And we'll have people spending more of their time understanding the environment, distilling it into context, distilling it into either automations, whether it's deterministic code, playbooks or prompts, um, and working the problem in that way because I think that's what the attackers are going to be doing. If you look at where we're trending with you know, high volume, multi, multi point, um, attacks, you can't scale to that with people. If, if you're fighting machines, you know, I've seen Terminator, it doesn't work right. You got to fight machines with machines, um, at some point. But having people driving those, you know, people guide the machine, not the other way around I think is where we're going. And so the skill that's really going to be important is like that bedrock is just be, get an engineering degree, get a STEM degree, whether it's physics, math, computer science, I t and really understand the environment. But then like, know how the tools of tomorrow are going to work and start to master them now. Because if you, if, if they don't, your team's going to fall behind because you're not going to be able to fight. Um, the coming, the coming level of automation is not sustainable to fight against with just, you know, manual ClickUp.

Speaker C: And when you're personally hiring cyber security talent, is there a, uh, common denominator or something that specifically stands out across all areas of the security team that you think people, people should have or the people you want to hire all have?

Speaker B: Yeah, there's a, there's a type of reasoning that I think isn't as common as most of the other. Uh, and I learned about this when I was in grad school. It's called abductive reasoning. So everyone knows about deduction. You know, it's the, it's the elementary, dear Watson, Sherlock Holmes, title of logic where you know, you, you just break everything down into, you know, if a, if A happens and B and C must be true and you just break that down into a logical structure. That's kind of what we get taught in school. Um, outside of the core topics, you know, inductive reasoning is pretty common. It's your ability to weigh the, you know, how good evidence is based on its reliability and relevance. But where people. It's really special in security industry particularly is we call abductive reasoning, which is the ability to imagine all of the possible reasons something that you observe in the environment happened. So a good example would be the old saying, where there's smoke, there's fire. Well, fire is usually the reason, but it's not the only reason. So a bad analyst will always see smoke and go, oh, there must be fire. They're not going to look and say, well, is this an engine? And it's just friction with the belt or the bearing. Whatever system doesn't have enough lubrication so it's generating too much heat. Am I cooking? And you just have the oil is passed at smoke point. They're unlikely situations, but they're plausible explanations for why the thing you observed happened. Bad analysts will automatically go to the most obvious thing they think of because, uh, good analysts will imagine all of the possible reasons for that observation and then they will look for evidence that helps them distinguish between and identify the most likely explanation. And you would think that that's common, but I Found that that's really the separator between, you know, mediocre and great analysts. The great ones will observe something like, you know, a user's added to an admin group. And they won't just go, oh, it's. It's just a normal operation. I'll ignore it. They'll look at who did it. Is that person supposed to be doing those operations? Um, if it was a bad actor activity, what would I look like? What else would I look for that would lead me down the path to think it's malicious activity? And we'll kind of work that sort of graph of information in their head and get really good at identifying what's the, what's the evidence I would need to collect, like to make that distinction. That's a skill, you know, whether you're, I think in any industry, it's, it's useful. Um, it's especially. I was just reading an article about how it's really relevant in scientific discovery. And it's one of the reasons why AI is, is less likely to have new scientific discoveries on the, the order of, like gravity and, and relativity. Relativity. Um, because good scientists can do this as well. They, you know, they see an apple fall and imagine, why did that happen? Like, what are the possible explanations? How would I create an experiment or set of experiments to determine why that happened? It's the same thing in security, right? We see a lot of observations and the good security analysts are really exploring the space of, like, if I'm a bad guy, what would I have done to lead to this and what would I be trying to accomplish by doing it? If I'm a legitimate user, how, you know, is this, is this in my work hours? Is this my job? Should the person I gave privileged access to, should they have had it? You know, you explore all those possibilities so that you don't, you know, end up crying wolf or, you know, screaming, the sky's falling all the time. Um, because those false positives are costly. We see the, the reporting on that all the time. False negatives are deadly. Right. If you, if you say it's legitimate, it's not, you know, that's a bad day for everyone. So that's where I see that skill is something I look for. And it's super rare. And we don't, we very rarely find it. Um, but if you can, if you can find a way to suss that out in the interview process and identify that, you're going to have much better. Um, whether it's engineers, analysts, scientists, I think that's something I look for because it makes a really big difference on the success or failure of any of the teams I've been on.

Speaker C: I mean, absolutely fascinating answer. Thank you so much, Steve. Uh, I shall hand over to Harry for the Cyber that Matters topic that matters part of the podcast.

Speaker A: Thanks very much Matt. Thanks for your answer, Steve. Um, starting off with some questions about Siderez and your role there today. Um, for anyone who's unfamiliar with Siderez, tell us about what you guys do and also your work specifically within the AI center of Excellence.

Speaker B: Yeah, so Sideras is a cybersecurity services and technology company. Um, we do a few things really well. One is identity. Um, I'm not an expert in the identity space so I won't try and go into depth of what they do there. But we um, do implementation of identity tools. We do manage uh, identity. Our customers love it. Um, we get really great feedback and it's growing really fast. Um, I really want to learn more about it, but that's not where I've been focused. We have a consulting business that does um, a few things. We do offensive security, pen testing, um, tabletop exercises and the like. Um, we have a defer, uh, digital forensics and IR business, cyber threat intelligence. They all kind of go together like they're kind of a very close knit family that work together. Um, our sort of flagship, uh, where I spend most of my time is the managed detection response which is as you can imagine, we monitor signals in our client environments, identify and stop threats. Um, what sets us apart is we are a co managed mdr so we don't force customers to use our technology. We build systems to be able to integrate whatever their tech stack is and do security monitoring using the client's existing technical investment. It makes the job way harder for us but it's way easier to adopt. So it's become very popular because, um, we make it easy to use our service and then um, our fourth thing is what we call is Meridian. It's our cybersecurity mesh technology. Um, one of the things we have discovered, um, and part of this is in my role um, at the company where uh, I run the AI center of Excellence, we built our own agentic pipeline to do a lot of our tier one, uh, triage work. And we discovered a long time ago that context is the only thing that matters. Like the LLMs are smart enough, we never have to train a model to do the smart stuff. Gemini Claude, ChatGpt they're all very, very good at security. But what they need is context and security data is hostile to AI. It's noisy, it has all kinds of semantic issues in it has panic words that cause AI to freak out. And so having very, very uh, enough context about what's going on and having it prepared in the right way to feed an LLM is the number one thing you can do to make your AI program successful. Um, without it, um, you have a very expensive system that hallucinates a lot. And so Meridian is um, a tool that allows us to bring identity and asset information together into a cybersecurity mesh architecture, um, that is designed to feed um, human and AI analysts, to give them the context they need, uh, to perform high confidence, highly accurate analysis. That's kind of the overall of what we do as a company.

Speaker A: Yeah, fantastic. And I think one thing I'm really excited to ask you is about the AI powered SoC. You know, I think we were at uh, we were at Black Hat and RSA this year and there was so much conversation about AI soc, agentix soc, AI powered security operations. How much genuine change have you seen there and how much is more just industry and marketing hype?

Speaker B: I think it's a little bit of both. Um, I've written a little bit about this. There's this term, uh, another one I wish I'd coined called semantic diffusion. But it's like as soon as there's a new word in the industry, um, every company tries to make it mean what they do. And so with the gentic SOC or AI driven soc, everybody's created their own interpretation of it and is basically trying to sell what they have under the guise of agentic soc. And it means ends up meaning, you know, if you ask five different people what agentic means, they'll give you ten different answers. Um, where we focus is where we think we're strong, is on the analysis side. So we've, we've been able to use agents to automate the overwhelming majority of our L1 triage. Which means our analysts don't spend time doing repetitive, boring toil based analytical work. We get them started with a fully developed case. In many case, many, many instances the ah, the case write ups are already done for them and our people then can start halfway to the finish line and they can focus on the parts that the machine can't do. Um, I think, you know, and we're just getting started. So to answer the second part of your question is, is it's moving so fast, you know, what, what we built two years ago we're already rethinking because the technology has, is four generations past where it was when we built our system. Um, and so part of the problem is it is moving so fast that we're constantly adapting. I mean, um, the term agentic didn't exist, was it nine months ago? May have been last December is when that started kind of getting coined. And so before I remember trying to coin this term brainlit, before agentic came up, I had this idea of like little brains that had very specialized skill. They do a query and then they would create some output. Um, agentic caught um, fire and now we're using that. Um, but we see. So what we see most companies doing is not really agentic, they're just calling it agentic. Um, where we're moving to, and I think where the industry is moving to is full on agentic loops where you give the agent the context and you give it the tools to go gather its own evidence and you give it a goal and it figures out with the available tools how to go accomplish that goal. Um, I think agentic in that form, where it sees and senses the environment and makes its own decisions is going to have a place, um, in many different areas. But I think security, it still scares me to death. Um, if you've read the articles about, you know, uh, OpenAI had that experiment, that hacked hugging face, I just saw an article over the weekend that Gemini broke out and, and did some, I don't know the details. Agentic loops are unpredictable and so it's, it's you know, being unpredictables I guess. Okay, if you're trying to book dinner reservations, but when you're trying to secure your environment, that unpredictability is really frightening, especially if you enable it to take response actions. So if you tell it to, you know, secure your environment or if you don't give it enough detailed instructions, you say when, when you see a user, potential user, compromise, um, block that user, you don't know what it's going to, you know what it's going to do. Unless you're very specific about like what that means. We focus on a mix. So I think, I think in the near term um, what you will see is a mix of deterministic decision making, um, with some, with some AI. Oh, sorry. We'll see a lot of deterministic work going into building context to feed the LLMs. We can use LLMs to do some decision making but then it'll kick back to deterministic playbooks or Python code or whatever to take actions with human in a loop, you know, because um, even today we measure accuracy of all of our uh, agentic outputs. It's well into the high 90s in terms of accuracy and uh, that's pretty good for making decisions about whether something's a true positive or false positive. But I wouldn't trust that and none of my clients would trust that to then say okay, I'm going to go isolate this machine or I'm going to go re image somebody's laptop or I'm going to take out a computer container or a cluster in my Kubernetes environment. No one's going to trust AI to do that I think for a while. And so I think that's going to stall some of the agentic loop implementations within security. We'll use it to do the decision making stuff and triage better I think. But in terms of taking the actions, we're going to slow that down. I talked to dozens of CISOs and security professionals on a monthly basis and one of the questions I ask is how accurate would one of these systems have to be before you trust it with your security? Uh, no one has ever given me a number. They're always like never. Um, maybe in the future we'd allow it if you had these certain guardrails in place. But nobody's willing to trust giving it the keys to protect their environment without heavy guardrails kill switches, um, and humans in the loop doing the most critical task tasks. Um, and you see that reflected in some of the upcoming European laws that's coming out later this year about you know, um, making sure that AI is only doing the least impactful with low blast radius kind of decisions. Um, I think that's where we'll, I think that the appetite of the market right now is kind of in that space. I know we have a lot of company, I have a lot of competitors and there's a lot of companies out there wanting to get to this full agentic SOC environment. I think that's, it's great that people are pursuing it, but I just don't know that the market wants that right now. I think they want to know it's possible. But when you, when you actually say are you going to put your job on the line for this software? Um, people start to get cold feet.

Speaker A: Yeah, We've heard conflicting things from teams and businesses about the impact and about what it means for hiring and, and generally what the experience is like for customers as well. So um, I'm going to ask you one more question after this one about where you think it's going to be in a Few years time. But I think my penultimate question on AI is probably more on the other side, um, at attackers. Specifically, how are you seeing uh, AI changing what attackers are capable of doing today?

Speaker B: This is the most. I'm on the fence of being terrified and not so. We're in a similar situation of when we went into E commerce back in the late 90s, early 2000s. People have been exploiting systems since we've had systems and um, I don't think we've really invented new crimes in the last couple thousand years. We just keep porting those same crimes to the new technology. So I don't, what I don't think is we're going to see like net new ways of committing crime. Like it's always going to be fraud, blackmail, um, destructive attacks, um, that kind of stuff, scams, con games, that what's going to change, right? What's changing right now with AI is that the scale and the speed. So when the Internet we had Internet right Enabled, um, action at a distance. This is a something, um, in. Bruce Schneier, who's one of my favorite security writers, talked about this in one of his book Think Secrets and Lies back in a long time ago, talking about action at a distance. So if you wanted to scam somebody with a phone line before the Internet, you had to make a long distance call, which cost you money. There's records for it. It was really hard to do with the Internet. You could hack somebody into their system from 10,000 miles away for free. And like legally there's no recourse because the jurisdictional jumps makes it really difficult for law enforcement. So that made so attacks at a distance. And then we had the speed of attack. So you could automate the same attack a million times for a very low cost. That's why we see phishing like those mass phishing emails. So that's not changing with AI. Uh, what is changing is latency, um, a couple things. Latency meaning, um, if I'm a sophisticated attacker and I want to break into a complicated network, I would have to, you know, do my first level of phishing or whatever, or try and find an external vulnerability and get a landing spot. Then I would have to add my next level of malware or I have to break an identity so I can use living off the land techniques. But every time something happens, there's, there's latency between gathering some information about the environment and coming back, me having to make a decision making, then take the next action. The malware we're seeing like the frontier um, Frontier, the leading edge malware we're seeing today, some of it has small ah, language models built into the malware so they encode their M methodology and decision making into the small language model. It's forward deployed so it's gathering and doing those decisions on its own in the environment without the latency of having to go back to the operator. So all of our, our assumptions about how long the dwell time has to be or how long we can take to respond to something, that number is going to go from like now people think days to it used to be weeks to months, now we're thinking like hours to days. It's going to go down to minutes to seconds in the next five to ten years because uh, the, the models will get smarter. And because they're using techniques like distilling from larger models, you can pack a lot of really localized, specialized intelligence into a very small model. It'll be able to make those decisions and take action and accomplish the mission in some cases on its own. Which means we can't take 20 minutes to two hours to do an investigation, respond. We have to speed up how fast we are making decisions in the SOC and taking definitive action much faster. Um, it's going to change the risk calculus. So today if you say, hey, when you get an attack, we're going to isolate a machine or we're going to take a machine offline. Most businesses will say well I'm going to lose 10,000, 100,000 million dollars an hour if I take that system offline. So I'm just going to absorb the risk for now until you see if we can contain this thing. I think in the future that risk is going to flip where they'll see if I don't take the activity and it's going to cost me a million dollars an hour if I take the machine offline. But if I don't take it offline immediately, it's going to cost me $100 million dollars. Um, and so that risk calculus is going to flip. So that's, that's the um, the speed of the attack. Um, and then the other thing that's changing is with mal, like malware, um, allow, like malware is a service, right? If you go back a ways, it allowed you to spread your tooling and capability. Remember when I grew up in the 80s and 90s there was all this talk about, you know, getting special cable boxes so you could get cable channels for free. There's a lot of risk in there. You had to build hardware, you had to make a material investment in this technology and then you had to ship it. So there was easy to find if somebody wanted to catch you and prosecute you. Malware made it so that you could share those techniques pretty freely and anonymously. Um, but now with AI, you can share your expertise freely. So you can encode your expertise and experience into the model and share the model. Um, and that can. And so your expertise is going to scale much faster, which is, you know, I don't think we've gone much beyond realizing that was a possibility. I don't know how we, we don't know yet how we're going to deal with that, but that's kind of the way I see the next level, um, of impact here. Um, and then lastly, uh, a thing I call Sci Fi level impersonation. So, um, I've already, my family, we've established passphrases like, so, you know, you see those scams where somebody gets called and it's an AI voice impersonating somebody or family or somebody, you know, that um, is asking for money, they're in an emergency, whatever it is. Um, that used to be pretty easy to suss out because AI voice, it has the uncanny valley. But we're getting to the levels where even on video it's very hard to distinguish is that a real person or not? Um, I follow like a lot of channels that are like, is this AI? And six months ago, super easy. Now I'm looking at images and video. I'm like, is that, is that real? Is it the lighting? Is this. You know, it's, it's very good. And if it's just voice, it'll be nearly impossible to distinguish between a real person, AI and video is getting even better. So I think the science fiction level impersonation is going to make these fraud scams more effective. It's going to make SMS impersonation, um, or like you're calling into the call center and saying, I'm locked out of my account. It. Can you reset my password? It's going to make those so much more difficult to determine that. I, uh, you know, we're going to have to come up with new operational techniques for vetting people so that we can ensure that I'm talking to the right person instead of just an AI, like AI video stream. That's what's really changing with AI from the attacker's perspective. And that's just scratching the surface. I mean, um, one of the things I. Going back to one of your first questions, one of the things I learned in the government is that with national level assets they're able to do stuff 10 years ahead of the private before the private sector discovers the same things. Um, it was pretty eye opening to me when I was, when I did the transition, I would see things happen in an open attack by criminal actors. I'm like, oh wow, we knew about that a decade ago. And so it only stands to reason that those same nation states have capabilities that are much better than anything we're aware of, but they're just not, uh, they're leveraging them carefully because they're expensive investments. So we'll, we'll find out about some of these things in a decade when the, the commercial sector figures them out. But um, just because we don't know about it doesn't mean it's not a threat. And so like, that's one of the things that keeps me up at night is knowing that there are well resourced attack organizations out there. This whole job is breaking into systems and inventing next level science fiction techniques to break into systems. And we won't really know about it unless we have an instant response, uh, client, or it eventually gets published. So I mean, and we're moving so fast that um, I think it's just going to accelerate, you know, um, you know, the only upside is my, my, my son who's in his second year of college getting a computer science degree that wants to go into security. I think he will have security for at least the, his, his whole career. Um, I just, the, the, we're in this sort of arms race that just keeps accelerating and the attackers are learning this stuff ahead of the defenders in many cases. So it's

Speaker A: going

Speaker B: to be the endless cycle of catch up, catch up, catch up. Um, but uh, yeah, it's really getting to the point where it is, it is frightening. And my normal ability to go, that's not a big deal is, is getting challenged more and more every day.

Speaker A: It's a really interesting time. And thank you for sharing your thoughts there. I mean my final question, Steve, is uh, a good one actually it's our final one, um, which is always about uh, advice for someone coming into the industry. So yeah. Steve, what one piece of advice would you give to someone entering the security industry today?

Speaker B: Um, embrace change. So I, I, I hire a lot of folks right out of college and I think there's still a lot of people kind of have this unrealistic hope that they're going to go out of college, they've learned all their stuff, they're going to get a job, they're going to do their job for 20 or 30 years and retire and they get really, uh, upset, stressed, um, anxious when there's change. But this is an industry that changes every single day. And you can't just accept change, but you really need to embrace it and use it to your advantage. One of the sayings, um, I learned in the government was chaos is a ladder. Um, if you learn to just embrace that, things are going to change constantly. Stay, um, on top of the chain, uh, be a constant learner. Spend your time, you know, nights and weekends if you have to, learning as much as you can, um, and learning how you can use this change to help your organization get ahead, to help yourself get ahead. Um, it's really a special skill that is more rare than you would think. And so if you're the person that's out there, um, just comfortable with the chaos, right when the building's burning, you want to run in to save people, or when you're running towards the emergency instead of running away from it. It's gonna help you really not just be great at your job, but it's gonna help you distinguish yourself from all the other people that are, that are doing the same job, that just wanna punch the clock and go home. Um, this is an industry that, you know, even when I started back in the late 90s, it was changing pretty frequently. But every time there's been a technology like a shift in computing paradigm, we went from, you know, fit clients on desktops, client server to the web to mobile to web 2.0 and now we're in the cloud. Every time that shifts, the rate of change is getting faster. And the people that are comfortable with that change and are using it to, to, to make themselves smarter, more capable, uh, more educated, more able to operate in these new environments, they're the ones that really make a difference in the world. The people that kind of get this decision paralysis and are overwhelmed by it, fall behind. I've seen this happen in engineering, I've seen it happen in law enforcement, I've seen it happen in academia. And seeing it happen in the security industry now, it's like it's uh, the other than, you know, talking about the abductive reasoning, having that skill. Just get, love change, you know, if you love, if you love change and you learn how to operate in it, you're going to have a happy career. If you hate change, you're gonna, it's just gonna be a struggle. So just learn to love it, learn to embrace it. Uh, it'll pay you a lot of dividends down the road.

Speaker A: Fantastic advice for all listeners, regardless of entering the space. Right. Or, or just generally, I think that's applicable in lots of situations. So, Steve, thank you so much for joining us. Really interesting learning about your career, your thoughts on the space and, yeah, all things cyber security. So thank you very much for joining us.

Speaker B: Thank you for having me. It was a lot of fun.

Speaker C: Thanks, Stephen.