Intro/Outro 0:01

This is AI Native Cybersecurity. Field notes from security teams defending against and operating like AI adversaries because the best defense is a good offense.

Shahar Peled 0:15

Anna, welcome to the AI Native Cybersecurity Show.

Anna Sarnek 0:19

You're interviewing me now. I thought we were doing this together.

Shahar Peled 0:22

We are.

Anna Sarnek 0:22

All right. So AI is changing the technology landscape really quickly. We like to talk about AI for security, security for AI, but really what it's doing is the interconnectedness internally for the organizations to increase productivity. It's hyperscaling a lot of the traditional security problems that we tend to talk about. So, Shahar, what are you seeing that led you to want to talk about this problem more and more with the security leaders that you're engaging with?

Shahar Peled 0:53

Yeah, I speak to many security leaders and hear a lot of unique approaches and people talk about what's their approach to AI and cybersecurity. And I think when you look at the broader problem is cybersecurity has to be rethinked. We have to rethink cybersecurity versus just bolting on new AI capabilities on top of each cybersecurity category because the threat landscape has changed dramatically. If until two years ago our goal was to slow down or block an adversary, now the slow down part doesn't make sense anymore. The velocity is too high. Our goal here is to meet security leaders who and entrepreneurs who are innovative in their approach of how to rethink cybersecurity with AI. And to me, this is such a unique problem to solve. It's so fun because everyone has a different approach. Every security leader we talk to talks about how they bring AI into the organization. And no, we're not going to speak to those who say, oh, I'm just going to scale what I've done before with AI. They're actually rethinking the threat landscape, rethinking how they can fight back and secure the organization and how they can do it in a way that actually scales, rather than just adding more and more security tools on an existing security program.

Anna Sarnek 2:16

Yeah. That being said, I think that the unanimous consensus is that the core fundamentals still exist, right? We still need to understand from how the organization is making money, maybe where their core data is to who and what is accessing each component of it. Because I think at the end of the day, AI is just hyperscaling that problem. So this is why this show exists, right? We're here to talk about what are the gaps that are in the security organization. We're not having hypothetical conversations. We're trying to bring the honest conversation and have these debates out and open and have some thought share. So I know Shahar, you did some episodes already. What are some of the key highlights that you can share?

Shahar Peled 3:01

Yeah, I'm I'm really enjoying the conversations I'm having because you're right. Some of them talk about hyperscaling the existing program they have, right? They need network security and endpoint security and identity security and application security and cloud and data. But some of them totally go towards security for AI, which is another metric or another column of cybersecurity categories we now have to have. For example, AI in identity, who who is a user right now, right? Non-human identity in the realm of AI. And AI in offensive security, obviously, which is a key topic we talk about a lot. AI in cloud security. Who runs these procedures or processes on behalf of those organizations? And I think this is something I really like to say because you'll see that those leaders who we interview very often go to one of these two places. I don't think we've had many episodes that the problem set that was brought up was both the new vectors of attack because of AI, but also scaling the existing security program. So I think you're spot on. And it's a super interesting challenge. And I think at the end of the show, we're gonna have to do some uh some analytics on when we ask them what is the new challenge they face, is it the same thing at scale, or is it the new risks and vectors that AI now creates for those security leaders?

Anna Sarnek 4:22

Yeah, and I think for me, what's most exciting is back when I was building a cyber risk quantification product, one of the most interesting solutions that I saw actually mapped the attack path of how an attacker can get into what they're compromising, where you could truly figure out how to quantify the impact on your organization based on what critical information or data was stored in each system. And I feel like with AI native cybersecurity, right, we're finally there where some of the things that we weren't able to do before, like where remediation used to mean just more tickets and more automation and workflows. Now we're actually talking about being able to bridge the security team's expertise with the IT side of the house or the developer's expertise where everyone who's interacting with these tools around security, they're put in the position of expertise, right? So we say, you know, we have debates around human in the loop, on the loop, human-led expertise, things like that. But I think at the end of the day, the bot the bottom line for AI native security is that we're finally enabling people to be able to focus on what their actual superpower and expertise is to deliver that expertise more efficiently rather than being bogged down by checklist process. What do you think?

Shahar Peled 5:47

I agree. And then I want to add one more thing on top of it. I think everyone on this planet earth who is a security leader is an AI-powered security leader, right? Because every tool they use and everyone probably pretty much uses some sort of AI. AI native cybersecurity is different. And these are the people we're we're having here on the show. Um, AI native is different. AI native is, again, how do we rethink the program? What is an agent, what is a human? What is internal, what is external, what is an NFT, and what do I do outsource? And that is AI native. Some processes and some capabilities that used to be done by humans are now agentic. And some of the humans that we have now have to monitor agents, for example. Um, yes, there's still humans in cybersecurity, and that's critical. And I think this also is a topic that comes up a lot. But the difference between native and powered is super important. And every one of the people we've interviewed so far is AI native because they're rethinking how they build their organizations from um tools or agents, processes, and people. And every one of them has a different organization, different processes, different tool set that they had than they had two years ago. Knowing that even the tools they use have AI in them. And it doesn't mean they now use the same tools with AI, they're rethinking it. Different kinds of people, different kinds of processes. So I think this is a super important um differentiator between what everyone does and what those who are actually thinking AI natively.

Anna Sarnek 7:26

And I think also to your point about how we're rethinking security, it also comes down to how security, I think we used to talk about it in defensive terms. It's more reactive, right? Versus offensive security being thought of as maybe a bad thing, just because I think both in physical security and like warfare and cybersecurity, we think of words offense defense more from that combat origin perspective. So we used to think of I think offensive as not a negative thing, but something that creates a little bit of a friction in a conversation. Whereas I think now, because of the speed that you're mentioning, we're in a position where offensive mindset is a new defense, right? You want to safely be able to probe and crawl all of the different interconnectedness that you created within the organization. So you are visible in where you have gaps in security rather than observing for spikes or abnormal data, which I think is a lot more what we used to do when we started with log-based monitoring and whatnot.

Shahar Peled 8:35

I totally agree. And and although this uh this podcast is sponsored by Terra and AWS, and the hosts are from Terra, um it's not a Terra show. And I think in the first eight episodes or so that we we recorded, I don't think I brought Terra's name even once. Yes, some of the guests brought up the name, but we'll talk about offensive security. We'll talk about proactive security because we think this is a part of an AI native cybersecurity program. But this is not a Terra pitch or a product pitch or a vendor pitching a vendor. Um it's not. It's us having a genuine conversation with security leaders and entrepreneurs who have a different mindset. And we're not gonna use this as a as a pitching ground or or to just get more Terra brand out there. We'll use it as an actual stand or an actual stage. We can have an honest conversation about where this world is heading and maybe learn from each other and ask for best practices. And hopefully we can enrich and give great insights to other security leaders and entrepreneurs out there.

Anna Sarnek 9:41

Yeah, so what you can expect from this is some investors might come on. Shahar mentioned entrepreneurs, we might also have ecosystem leaders, maybe we'll get some government figures, who knows? And we hope that you'll come along to surride with us.

Shahar Peled 9:56

I'm super excited. Um Let's have an awesome show and give us feedback, you know? Give us questions. We might share the next near new the next few guests for joining us. But out of the roster we had so far, I'm super, super excited. I'm Shahar Pelad.

Anna Sarnek 10:11

And I'm Anna Sarnak, and we can't wait to see you next time.

Intro/Outro 10:17

That's it for today's episode of AI Native Cybersecurity. Your attack service probably changed while you were listening. So take something from this conversation and go test it. We'll see you next time.