Armadin maps networks and attacks when they change

Transcript

Transcribed by machine (Whisper) from the episode’s audio, so a word may be off here and there.

1. 10:20

   needs to be a great offense, right? Yes. Like best defense. Got to train your defense with something. Yeah, of course. You got to train your defense with something and then it needs to be continuous. Right. Right? So how does the product work, and then how do you get a level of sophistication such that you can identify and remediate these vulnerabilities, like what you're describing, that are more sophisticated than a basic prompt?

2. 10:43

   Okay, a lot there. I could talk for 45 minutes on it, but first I can tell you this. You don't have a defense unless you have a great offense to go up against. You know what I mean? So even think in sports terms, if you want to be the Baltimore Ravens defense at 2,000, you kind of want to have your practice offense really push you. You know what I mean? So you know how good you are. And that's what Arminen's going to do.

3. 11:03

   We're going to be the all-star team on offense coming at you so you can train your defense with what we're doing. And that's going to be important. And you can't really have a human in the loop in the AIH for tactical autonomous defense. You've got to do something fast. You know, you got to tourniquet the wounds as fast as you can. So thinking back to our, like, you want to be able to do it continuously, and that's the complexity.

4. 11:28

   So we do a thing called a hyperattack. And David, that's just a fancy word for we throw a drone swarm of agents at you, and we map your network. Every service, every route, every system, all assets. We may end up with terabytes of metadata on your network from this hyperattack. Done super fast. It lights you up. so that that way we can now, it's almost like a metadata twin of what we can see. If we're on the inside, do the same thing.

5. 11:55

   Let's just map everything. This is the attacker's view of your network. But with that metadata, we now just pull you almost like a heartbeat. What's changed? What's changed? That's continually looking for, did an app change? Did a route change? Did a service get updated? Did a new machine get presented into the target area so that we can pull cheaply for change and then attack the change. What you really want in the future in the AI age is you want the constant pressure of models attacking you, but you can't do it all the time because A, it's cost prohibitive, but B, it's unnecessary.

6. 12:30

   You do it when either the threat changes, hey, new models come out, new intelligence is available, or B, your network changes, so you want to test whether that happens. And then C, you probably just want to test, we have a board meeting tomorrow, let's see how we do. Yeah, exactly, yeah. Let's audit ourselves and see where we're at. And that's what we had over the weekend. There was a zero day and a popular product.

7. 12:51

   And immediately, we've already got the heartbeat. We just polled who's got the problem. And our goal at Arm it in is to go from, you know, common vulnerability or CVE to we can find if it's exploitable or not before bad guys can. You know, and not all bugs allow for human access to your system in a stable way. So not all bugs are created equal, right? And so we want to make sure, hey, this one's one you really need to worry about or which ones don't give remote command execution.

8. 13:24

   So long story made short, that hyper attack, that metadata that we get allows us to kind of pull for change and attack you when your network changes. And that's the best you can do for continual. And we'll get better and better at it. And the cost for the polling will go down. You know, it's on small networks, it doesn't cost much. But on a network that changes all the time and is very large, you'd be pulling it quite a bit to make sure you don't have an exposure window yeah of course yeah