AI has to take over the detect-and-respond loop

Transcript

Transcribed by machine (Whisper) from the episode’s audio, so a word may be off here and there.

1. 21:22

   And I think you joked that your old days, your 30 years of experience is out the window or relevant or something like that. What is the future of the SOC? And then how do the categories within cyber blend together or change? You know, if I'm a CISO, I do believe my true north is effective autonomous security. You want to keep your best people engaged. You want to automate the processes that work for your organization. But you are absolutely saying what survives in the AI age and what doesn't.

2. 21:54

   And I think we're still working through that process. I think there's whole processes in the SOC that'll just go away. And for whatever reason, we're automating them right now. You know, over time, I can tell you this, if you have humans in the detect and respond loop, you're going to be too slow. Yes. You know what I mean? It's just not going to work well. So you have prevent, detect, respond. Prevent's going to be governed by AI and detect and respond is going to be done by AI.

3. 22:21

   And the goal in cybersecurity has always been And if you have, you know, you want to prevent, you don't want to detect and respond. So I just see the constant narrowing of the window of every phase to the point where, you know, we're really not doing a lot of detection and response because the window to do it, it all happens too fast. You got it. It's a little bit too fast. So, but you still got to have that onion peel to some extent of systems backing up systems and assuming failure somewhere.

4. 22:48

   Right. You know, like even arm it in creating in the force field, sooner or later, somebody's going to get around it. Someone's going to create an exploit before we find it somehow, someway on a platform or an app that we just haven't assessed yet. It hasn't been in production at a customer site. And so we haven't looked at it. And someone else finds it. And when they do that, you will want to have a trap behind saying we've got unauthorized access or unlawful access to a system.

5. 23:15

   Those traps are that you just can't have a human there. Yeah. I mean, it's just going to, because we've already done it at Armand, and when we break in and have a gentic, aware, internal command and control, it proliferates at a speed that is shocking. You know, like, I remember as a human, you're, like, typing on your keyboard, I want to go laterally move with this passphrase from here to here, and you're so slow, and you're doing one thing at a time.

6. 23:40

   This thing just does a thousand things at once. It's just everywhere, and you're like, whoa, okay. Done, got the effort. Yeah, so each one of those steps of the process has to be automated, can't be a human in the loop. Yeah, it's as bad as this. I mean, I don't have great analogies. It's like the balloon popped, you know, so when it gets in, it's just like, they're gone. Your whole defense apparatus just popped.

7. 24:01

   So you got to get prevention right, and then an immediate lockdown on detect and respond, however you want, and there's always gray areas between those phases, because people say, if you detect and respond automatically and fast, that is prevention. Yep. So all of it's going to change. Every CISO is examining it. Every vendor is examining their role in changing into the AI shift. And so it's going to all change now, but I can't tell you if anyone's positive on how it changes.

8. 24:28

   They're examining their workforce. They're examining their head count. They're examining their processes, meaning the CISOs are. And they're saying, what do I need to look like in the modern era? But it's too soon to tell where it lands. Yep.