Intro/Outro 0:01

This is AI Native Cybersecurity. Field notes from security teams defending against and operating like AI adversaries. Because the best defense is a good offense.

Shahar Peled 0:16

Welcome everyone to the AI Native Cybersecurity Podcast. My name is Shahar Peled, your host and the co-founder and CEO of TerraSecurity. With me today, a very special guest, uh Ryan Hebert, head on information security assurance at ICE, the print company of the New York Stock Exchange. Ryan, welcome to the show. Thanks, Shahar. It's a pleasure to be here. Thanks perhaps for uh for joining me. Maybe take a few seconds to introduce yourself to those who who are not familiar with you and with ICE, and we'll take it from there.

Ryan Hebert 0:44

Thank you so much. So um Intercontinental Exchange is the parent company of the New York Stock Exchange. But uh we've been in the derivatives and exchange market space for a very long time. Our founder started our company in around 2000 with uh derivatives exchanges, spread those across the world, and then we acquired the New York Stock Exchange in 2012. We've been really focused on providing transparency in the market space, and then we've also built up and spun up a data services company that is world-renowned as well. And now we're getting our hands into the mortgage space to provide more transparency there as well. So we also have an ice mortgage technology arm as well. We have about 80 business units, three major business units that overpin those. But uh I represent the assurance arm to the cybersecurity team. So I oversee GRC, AppSec, and Red Team for all of those businesses. Um, and I've been with the company for about 17 years. It's an excellent place to work. The cybersecurity team gets all the support they need, and I've been happy to serve this company for as long as I have.

Shahar Peled 1:37

17 years. We'll talk about that as well. Um super impressive journey. Um, very happy to be here. And I think it's gonna be a very interesting conversation. So let's dive right in. Um The podcast is AI Native Cybersecurity. So obviously, today we're gonna talk about you know your view of AI innovation, cybersecurity, how you see the world, the past, present, the future, how you're implementing some of these strategies and vision into the i security program. But let's start with I think one of the best questions we can start. So Gen AI went mainstream a couple years ago. Um, you've been at ICE for 17 years and are a cybersecurity veteran. What's the biggest change you've actually seen since Gen AI went mainstream? Is it the scale? Is it the pace? Is it just marketing noise? What's the actual change on the ground for those security leaders and practitioners listening to us?

Ryan Hebert 2:29

Yeah, I think it's a pretty big amalgamation of all of those things, um, frankly. Um, I think from a cybersecurity perspective, it is definitely a force multiplier. It has given us a lot more things to focus on and think about. But with that also brings and leads to a lot more work, right? Um, I think the fact that we're critical infrastructure was a huge boon for our ability to get understanding into what these offensive-minded agentic pen testing tools can do. But with that, brought a whole lot of triage and a whole lot of work that came with it, right? So I think the hype is real, but I think there's still a huge need for human touch. I think agentic pen testing is very much so in the forefront of getting really deep-down critical understanding of these attack vectors, being able to chain together those typically seen as low or very low CVEs. But using that with the context, you're able to provide your company a better lens as to how a bad actor could go through your infrastructure using multiple different vulnerabilities at once. So on the whole, I think it is a force multiplier, but it's also given me more need for human touch. And we can go about uh talk about that more in the in future questions. But I think MCP approvals have to go through cybersecurity. I think if your company wants to use open source models that they're getting from outside sources outside of enterprise connectivity, I think that has to get approved by an app sec team and probably possibly even a red team. I think if you're gonna have a user interface served up for your employee base, you should have a red teamer attacking that with the knowledge of understanding of how to force hallucinations, try to get to other pieces of data that it shouldn't have access to. And that drives those remedial activities for using your vulnerability management program, but specifically on how to improve the use of these generative AI use cases and workflows.

Shahar Peled 4:23

That's that's a super interesting point. Um, and if I can double-click on one thing that you said, you you mentioned that yeah, everything is is on scale now. It touches everything in cybersecurity, which obviously makes a lot of sense. But you also mentioned that yeah, this scale or exponential scale also creates more work for humans, which means the triage and we might even need more humans than before. You mentioned specifically offensive security or pen testing. Do you think this is defect in in the rest of your cybersecurity portfolio, or is it just this specific domain?

Ryan Hebert 4:55

I think it hits the full suite of the cybersecurity program uh domain. To start with where you guys are so strong in your agentic offensive pen testing. I think continuous use is important. I think training it on your source code really gives you that context. But then it gives the internal team that's tasked with owning that relationship the need to really hone in on harnesses and really hone in on those microagents that are doing the use cases for trying to chain together those attack vectors, right? So I think you can place heavy reliance on the autonomy of the models themselves when you find the good ones. But I think it's important to have a human in the loop, and we can and we can go further on that if we need to. But I think having those base intellectual property and knowing app sec folks and red team folks, part of that process, and then giving that context to your GRC team so that you can do the true residual risk scoring of what those findings are, and then you can use some automation folks in your team to be able to chain together those findings to be able to see this is what a real threat vector could be based on the way that this application is served up to our customers by using all of the context and using those humans to help build those harnesses so that those microagents are doing the right things for you.

Shahar Peled 6:10

I couldn't agree more, to be honest. And especially your critical infrastructure, as you said, the cost of a mistake on a production environment is catastrophic. We can't allow it. And I I haven't met many security leaders that will be okay with a fully autonomous swarm of offensive agents running on these environments. We also can't allow ourselves to be manual. This is where we have to work on yes, scale, yes, accuracy, but we can't compensate or get close to risking the safety of the environment and the stability, which is which is binary in my opinion. Um let's let's move to the next one and talk about ICE's threat landscape. You've been there for 17 years, you've seen every part of the company's uh security organizations growth in multiple positions. What change in your specific threat landscape? Because I mean ICE and your stock exchange is some of the other um companies in their portfolio, you protect some of the most sophisticated and complicated organizations in the world. Millions, billions of transactions uh on a regular basis. What changed specifically for you as you protect some of the most important systems on planet Earth?

Ryan Hebert 7:19

Yeah, so I'm gonna be a little selfish with the response on this one, me overseeing assurance, which is Red Team, AppSec, and GRC, as we said. Um, it's the open source package world. I was seeing all of this frontier model concerns and scares that are coming out, and all of these um these agents are getting so much better at put chaining together the threat vectors. I didn't imagine that the focus right now would be so heavy on open source software libraries. But you see all these uh take account takeovers for Maven and PyPy and NPM, it's just been a constant slog. So leveraging our understanding of how we're getting the developers with as as little touch as possible to a safe base point to be able to so they can create applications for our customers. It's been a really tough slog in the last couple of months seeing all these different open source software packages becoming uh getting takeover. So we've done a whole lot of work in terms of curation, but we're also leveraging our existing controls and our the best Cyber Threat Intel team in the world. I stand by that. We have the best one in the world. But these guys have worked together from the first line of defense and the second line of defense to take all the feeds that they have, and then they've built using AI a tool that will, based upon identifiers of compromise or how long the uh the package has been available and other indicators, they can proactively determine if they want to let that into our enterprise artifactory, and they can also alert our apps application security team to start looking for instances of those source code uh packages, those libraries. So that has really saved the big one for us. Um we've seen 12 to 15 different instances of companies getting hit by this, and we've been knock on wood. Safe to say we've been really quick to the punch on that. On the other side of it, just from a general ICE standpoint, what's been really surprising to me is the scattered spider success. Like going from strong technology driven to old school tech tech techniques and tactics, right? Like the fact that they're able to curate this uh list of young individuals that are have clear English speaking um activity and be able to call help desks and be so successful has really made us take a step back and not necessarily focus on the technical and focus on the cybersecurity, the preventative and detective controls that we've been so reliant on. And we've worked closely with our help desk and our finance group. We've actually socially engineered ourselves using the red team with some of the similar tactics. So, you know, using our same playbook, but going old school and analog to see can we convince them to give up credentials? Can we convince them that we are the actual person that's reporting to try and get a man in the middle? And that's really helped us round out the business controls of doing smart safe reliance on known internal indicators of the individual instead of just using a conversation on a phone to trust that individual on the other end of it. And that's been really helpful as well. So it's actually a really good combination of you know frontier model usage with old school business controls.

Shahar Peled 10:19

I love that actually. And there are new things that I'm learning here that I didn't know. And seeing from the outside, yes, you guys have some of the best of the best. Um, and your security is very robust, which is very impressive considering the the scale of what you guys need to secure on a day-to-day basis and how public your attack surface is because everyone wants money, right? Um so so being in that seat is at least someone from the outside, it's really good to see that there is so much more um than what we see from the outside, and it's really impressive. But if I have to to be a skeptic for a second, not about I specifically, about AI and cybersecurity, um there've been lots of overpromises, in my opinion. A lot of hype, some of it is is real, some of it is not. Um, you probably see a different end of the spectrum than I see um as a cybersecurity leader. Um what's one thing that in AI and cybersecurity that you think is just overhyped? That's you from your seed, from a threat landscape you're protecting against say this is not justified.

Ryan Hebert 11:26

I I think having companies come to you with a solution set that's based purely on a model that they've utilized to create that solution set is misguided and short-sighted. I think it takes a lot of context and a lot of interpersonal understanding of what the customer base is looking for to be able to solve those problems. There is no one-stop fix-all. I think a lot of companies are touting, not only will we be able to find all of these vulnerabilities for you, but we'll be able to suggest the fix. I have not seen anything in this space that's really good at cracking that nut, that endpoint of it, that's so good. And that's why I've harped several times in this short conversation already alone, that the human aspect is still very important. Now, are we trying to get to a point where we can create these automatic remediations based on the findings? Yes. But I think it's still a lot of a hype machine that folks are purporting that they're able to not only identify the findings, but give you the remedial fix. I think um what wins the day is having that internal context of where all your source repos are, knowing what your developer's application's use case is, getting the application context nailed down, meeting your configuration requirements of what you inflict upon them as an application security practitioner, and then helping them along the way with eventually getting to those automatic PRs, right? But I don't think we're there yet. I think it's going to take a lot of training of models on your source code, continuous testing with agentic pen testing, for it to understand that context. And then you can build those side harnesses that say, now that you've identified the issue, what's the easiest way to fix it without breaking the application? So I still feel like we need a developer and an app sec person in some capacity in that loop to do a validation check because I think you're going to see a lot of folks trying to run to this zero vulnerability chain, and they're going to break their applications and cause a production outage for their customers.

Shahar Peled 13:25

I couldn't agree more. Saying it as a vendor that does offer auto-mediation and prevention with context and with code and we do it pretty well, but I think it's a problem of two-set problem. One, the technology. Agents and AI models need so much context that not necessarily is available to them in order to build a fix that is 100% fit to your environment and will not break anything else with millions of dependencies. That's super challenging. But the second set of problems here is you and your team need to agree that you're going to let an AI system actually merge fixes to production with knowing that one bad letter line of code can break the entire environment, and then people maybe can't trade today, or worse.

Ryan Hebert 14:13

Yeah. I mean it's fairly important that we are not the reason why the operational effectiveness of the New York Stock Exchange transpires, right? It's pretty important to me as the cybersecurity representative that the reason the stock market is down is not us, right? So whether it be from a outside actor or if we have a self-inflicted wound, either way it's falling on us, right? And I I do want to take a step back and say we're not perfect, right? And whoever tells you they have the perfect asset management inventory or CMDB is a liar. Whoever tells you that everything that they have in production use is of the finest code base, is up to date, and is using all the right infrastructure. So that's the context I'm talking about, right? Everyone has tech debt, everyone has glam ons from acquisitions, disparate different OS systems or kernel languages that are kernel instances that aren't in the right state. That's the context that we're talking about, right? So maybe you do utilize that to get to a point where the remedial state isn't, let's give you 15 JIRA tickets to fix all these things. Maybe it's well, let's utilize the processing power that we have at our disposal with these models and rewrite the application itself. Start from ground zero on a configuration base and infrastructure base that we know and trust. So that's kind of where I'm at is I'm open to seeing the progress as it relates to automatic remedial activity, but I'm also hesitant to be fully reliant on an external automated source. So we're starting to build ourselves. We'll look into partners like like you in this face to help with that as well.

Shahar Peled 15:45

So excited about the future. Me too. I know a lot of people who are listening to what you just said and are nodding, saying yes, 100%. Let's stop with the flap for a second and say what the reality is actually. Um yeah, we'd love to help with that. But it's a very, very challenging uh you know problem to solve. Doable, but technology plus education.

Ryan Hebert 16:06

I have faith. I have faith in this uh this industry and the folks that are within it, such as yourself. So I'm I'm interested and excited for the future of it, but it's gonna take some time and some sweat equity, and we're here for it.

Shahar Peled 16:17

I appreciate it. And it's mutual. We're here for it as well. Moving on to one of the biggest questions in cyber defensive and reactive, offensive and proactive. Most of cybersecurity historically was defensive, right? More and more competency controls that their goal is to slow down or block an adversary. I think what we see today with the adversary is that slowing them down is just not realistic anymore because the pace, the velocity is so high. You either stop them or not. And that's one of the reasons I see a lot of organizations moving from more defensive and reactive to offensive and proactive, more red teaming, pen testing, adversary emulation, and you know, you lead red teaming as well as AppSec. Um and you also made a very, very courageous move and very visionary and innovative in AI to move from more point in time to continuous, more black box and less context to white box and more context, because at least I believe that some of the last advantages we have over our adversaries are context and access. Um and you're one of the earliest leaders of the large financial institutions that have made this move. And I think that everyone listening today agrees that this is the right way to go. But what led you to make this move?

Ryan Hebert 17:31

Yeah, so frankly, it's just more of the same with us, and that's again why I've been here for 17 years and why I'm so proud of this program. So you look at some of the companies of our size and our scale and what they're you know doing as it relates to critical infrastructure, you see a heavy brick and mortar, old school approach. We have large-scale cybersecurity programs. That's not how we operate. We're a really small shop. We have less than 200 people in the entire cybersecurity program for the entire company. I'm really proud of that. But the reason that we're so successful running so light is because we don't have a former end-user computer IT person that's been tasked with being your CISO and is in that reactionary front, right? Budget leads to project, project leads to fix. That's not how we operate. From the institution start, when we went from an a physical commodities exchange in California and our founder bought it because they were going bankrupt, and he can't remember, he either bought it for a dollar or a thousand dollars, and turning that into an online juggernaut of bringing everything technology forward, that's been the credo of the company from its jump. And that doesn't stop with cybersecurity, right? So the first CISO that we had going into our CISO that we have now, they're very much so security-minded and offensive-minded. And I mean that in everything, given that our cybersecurity strategy, which has been around since the inception of the company, is a red team first approach. It says it in there, it's in our governance, it's in what we put out to our regulators, and it's what we do every day in practice. We have a quarterly meeting with the president, the CTO, and the operations lead where we show them what our threat objectives are. These threat objectives are not just a risk calculus, it's not just a list of all the problems in the company. It's the opposite of that. It's what are the bad actors trying to do to us? And how possible and success in their success could they be, right? So it's based on likelihood and impact, much like anything else in a risk breaker. But it's basically can they conduct sabotage effectively? Can they conduct extortion successfully? Can they get information about the New York Stock Exchange before a trade transpires? And can they use that to their own advantage? So instead of going, we've got all these problems, we're looking at it from an approach of what is the bad actor's end goal and how do we stop that? So then all of those land onto a heat map, right? Residual and inherent, without controls and with controls. Everything above our risk appetite on that heat map, we get agreement from the entire executive committee. That's what we're hitting with our red team. So whatever the bad actors are going to try to do to us, and whatever we change from a business standpoint, when we get into mortgage or when we have i stated services or when we change to a clearinghouse that has a guarantee fund, that would be asset theft, right? So it's it's just dependent upon what the bad actors are doing, drives what our red team campaigns are. And we have a continuous testing program that we've had for several years. The only thing that changes is we're going along with the technology, as we always have. So we're using continuous pen testing through a Gentic and we're using autonomous models to help us with that process. I have a really strong red team, but it's eight people in a cloud of dust, right? We're doing a hundred plus red team campaigns a year. So why not supplement that with something that can learn on our source code, be continuous in nature, and help supplement what they're doing on a day-to-day basis? That automatically adds that context, and that automatically supplements our bug body campaign, and that automatically reinforces what the strategy is of our team. Threat objectives, set of residual risk, hit it before the bad guys do, find the things that are wrong, fix it before the bad guys can use it. Lather, rinse, repeat.

Shahar Peled 21:05

Well, that's that's a lot in a very, very impressive way, because we're talking about the AI Native Cybersecurity Podcast, and I feel like what you just shared, which again I didn't know, honestly, is one of the most future-looking security organizations and processes I've heard about. And coming from such a large organization, the sensitivity that you have to run and secure, that's really, really impressive. And I love what you said about the red team. So you have eight people on your red team and they secure everything and they run 100 campaigns. Let's not replace them. Let's just make sure every second of their time deals with the mission critical stuff that we can't yet leverage with AI. And then we can actually scale their very, very unique capabilities rather than just replace them when the world and the tech's not ready for that.

Ryan Hebert 21:50

I mean, how many times have you heard I would love to start using autonomous pen testing, but my board just wants a point in time report to get the regulators happy, to get them on Our back and to close the findings that are critical and high so our customers leave us alone. That doesn't sound like a company that's cyber first or technology first. That sounds like a company that's checking a box. And that's a large portion of the reason why I've stayed at this company for so long is that is not how we look, that is not how we look at risk, that is not how we approach a cybersecurity program.

Shahar Peled 22:18

So that's why we hit it off from the get-go. And you know, I speak to many security leaders, and when when I share my vision, and my vision is very relates to what you said, not talking about the inverse of reactive, is had adversaries attack me today, what can they actually achieve? And that's pretty much what you said. This is how you see the world. And I believe that now, with AI, is the actually first time in history you have the ability to do it at scale. Um, because otherwise we're just blind to the scale of vulnerabilities. And now with AI we can actually do it. But it's even more important than ever because adversaries are also using AI. So everything is on steroids, and this the ability to answer this question at scale is now more important than ever. And scale and accuracy, of course. Um but something that really caught my attention that you said is that you are actually involving senior leadership, not just cybersecurity. Like they're a part of the they understand the importance of this, and not just because they're scared, but because this is how you operate as a business. And that is very, very, very impressive. Um I speak to a lot of cybersecurity leaders, and when I share the vision, I very rarely hear no, I disagree with that. Sometimes it's I don't have uh the ability to give storage access, or it's dangerous, or or maybe it's gonna go through some hoops, or maybe it's budget, maybe it's it's always a priority. It's always something they believe in, which is incredible because this is where I think the world should go. But not everyone has the political power and the capability within the organizational chart or structure to go ahead and actually implement such a future-looking um program, especially in offensive security, that it has been historically point in time, black box, check a box. Um, and you guys have done it.

Ryan Hebert 24:05

That I think that's indicative of the program and the faith between the technology arm and the cyber arm, right? So I still to this day only have 30 app sec books, and we've got 3,000 developers. That's a 100-to-one ratio, right? So I have to be very measured in what I raise a flag for as critical, right? So the residual risk scoring, whether it be from a web application pen test from an app sec analyst or from an autonomous agent, there better be strong understanding of the controls in place that could mitigate that risk. And if there are any, sure. Let's go ahead and raise it as a critical, let's get all hands on deck. But you have to agree with me. If you're constantly lobbying raw CVE scores as critical over the fence to development, you lose the room. So I think it's just it's been a long-tailed trust relationship between our CTO and our CISO. That everything that we're putting on your plate to fix, along with all the customer asks, is real. It's been thought about, it's been curated, and it's been scored. And that comes with that long-tailed understanding with the intellectual property of the team, keeping your team happy and making sure they understand what the mission is, and then giving them the supplemental technology support that they need through that autonomous testing piece and that continuous testing piece. So it's not just on them to test every single application every single year. They can leverage some autonomy, but they also have the rights to be able to, you know, be that person in the loop that can validate the scoring. And all that does is help build their skills to help build the harness to make the model better anyway.

Shahar Peled 25:39

Exactly. I really couldn't agree more. When we when when organizations just send everything to developers, every theoretical vulnerability, they lose trust, they lose resources, and it's really unnecessary. The vast, vast, vast majority of vulnerabilities are theoretical. They're not exploitable today. And offensive security and what you guys do allows you to really pinpoint those that are exploitable, meaningful, with business impact. And then what we talked about before, get to some or the most automated we can get for mediation. This is, I believe, the holy grail. And and I'd love you know to see more and more organizations go down that path. I know we don't have so much time, so I wanted to jump forward to a very important topic. Um, a few months ago, the world of technology or the world has shaken because of the Mythos launch. Um, ever since we've seen a few more Mythos-like models being launched, and they're very specific in who can access them. More and more organizations join this. Um I work with a lot of them, and some things are true. Some is hype. Um, it is a very capable model, but I I haven't seen the world collapse on itself. I haven't seen insanely one in a in a century, zero days that have taken companies down. What do you think? How do you read this mythos hype or mythos-like models? Um, their premise versus their reality. Um, and and you know, how how do you read the room?

Ryan Hebert 27:07

Um I'm not coining a phrase per se, but I just I can't help but keep going back to this thought loud and proud, right? The companies are touting how good the offensive security pieces to these models are. And frankly, they're right. It's finding a lot of things. I get that. But this all goes back to having that objective opinion on what the infrastructure of the application is, what the compensating controls are, and having strong residual risk scoring on the findings that come out. It's going to find a lot of things. All of these offensive uh security tools are. But you have to go back to using that power and the context on the source code that you're giving it to go back and run it again, but ask it for helping you with threat modeling and ask it for helping you with flow context and how it ties to the network, and then using that to build out your own mermaid chart to figure out can you chain these things together to be a real critical that you need to raise is all hands on deck and fix it, right? So I think it is a very loud space right now, and I think that's for the right reasons, and they are very proud of what their tools are, but I think you have to keep this um reasonable level of context and level of understanding that you're gonna go through a lot of raw findings that may be false positives. You may purposefully have to make little microagents that tell it, I only want you to do these five steps in the chain and just give me the results for that. Um I think they will get better about getting the chaining together the full situation, but I think it's important that if you're just gonna go, here's my source code repos, tell me what's vulnerable. You're gonna have to go through that one by one and figure out what actually could be chained together to turn into a real cyber asset.

Shahar Peled 28:51

I agree. I think it's a very important point that that our listeners will maybe send me questions afterwards so I can send those to you. But do you have a specific I don't know if it's uh it's a hot take, but again, we haven't yet seen the world collapse in itself. Do you think it's coming, or do you think we've adjusted to a world that has frontier models such as Mythos and others? Um, and organizations who have access have scanned and found a lot of vulnerabilities and fixed what they needed, um, and maybe they are somewhat protected against it today, maybe not again against the model of tomorrow. But do you think it's coming and there is a wave of mega breaches, or we're just going to see incremental improvement on both adversary side and defensive side?

Ryan Hebert 29:34

I think it goes back to the first question that sparked off this entire conversation. I think that the models are finding a lot of real findings. I think they're finding a lot of false positives. I think they're conflating and overflating the residual risk score and a lot of it. We were fortunate enough as critical infrastructure to get into Project Glasswing. We had 30 days to test. We tested all of our most critical applications. We got a lot of findings to pour through. But as we're going through this, we found nothing gave me pause for concern that we couldn't handle. Nothing gave me the, all right, push the red button, let's go up to the executive floor and say we have a huge problem here. We need to double our staff and pay for a million more tokens. Um, we found a lot of things that are very good to work on, that are going to make sense, that we can use for that threat modeling that we were talking about earlier. But it just gave us the idea of, okay, let's take all the findings, let's do some threat modeling using the same agents that we've utilized, let's turn that into application workflows, and then let's see of these findings which of those are real and defensible and need to be fixed tomorrow. We didn't find a whole lot yet. We're still working through all the information, frankly. But I think the doom and gloom is a little overstated at this point. What I think is the most important, if if anyone gets anything out of this from my perspective, is that core cybersecurity controls will still win the day if you are very strong in those avenues. I think a red team first strategy, whether it be person-led or agentic, with a bug bounty program, is the best thing you can do from a cybersecurity standpoint. If you're actively working with your operations teams to ensure MFA and SSO is in place, if you're whitelisting and using WAFs on your web applications, I think that helps a lot. Strong ingress and egress controls and monitoring and detecting on those controls, extremely important. And then continuing to build the detections within your already existing anomalous activity tools, such as your EDR and your EPP. So I think using the agents to identify the huge list of raw findings, but then building that into the context of how it could actually be exploited to supplant and build upon your already existing core cybersecurity controls, it means that we're in a safe state right now, in my opinion.

Shahar Peled 31:56

The last 90 seconds of this podcast are liquid gold. And I'm sure I think every cybersecurity leader needs to hear this, and I really appreciate you bringing it up on this show. One more thing I want to talk about before the closing question. You mentioned you've been at ICE for 17 years, which is a hell of a low time, a long time, and that's really, really impressive. Most people are not staying for 17 years in the same company. You told us what's behind that. Um what's the future for Ryan? Are you a career ICE? Um what's what's driving you towards the second half of your career?

Ryan Hebert 32:35

I I never imagined being in this seat would give me as much exposure to amazing thought leaders like yourself and others that are creating such amazing companies in the cybersecurity space. Um having the connectivity of the New York Stock Exchange has just opened up avenues for me that I never thought possible. I've gotten to meet such extremely important thought leaders in the cybersecurity space by having these four letters attached to my title. I've gotten the opportunity to run my program the way I want to, with trust and verification from my boss and my leaders. I don't really care to think about what's next in terms of outside of these walls because I haven't updated my resume since 2010. I guess I could get an agentic agent to help me with that, but I'm not looking anywhere. I've got an amazing GRC lead who's been with me for 12 years. I have a lead of AppSec and Red Team who beat the hell out of us on a pen test, frankly, about 10 years ago. And we went, how do we fix all these issues? Well, we hire the guy, and now he's ran our red team in AppSec ever since. Um, I've got the support from the team. I've got trust, I've got smart uh individuals that are here every day doing their best to ensure the infrastructure is safe and the critical infrastructure for our families is safe. Um I think continuing down the path of getting the resources at our disposal to be able to use tokens to build awesome applications that further help with these autumn remediations is my number one goal. But then on top of that, it's having the ability to leave today at five o'clock and go have a nice camping trip with my daughter on a church camping trip. So having a good, smart team that's small gives me the budget and freedom to be able to ask for and receive tokens to build awesome applications like this. But it also keeps them happy and supported so that they can go and live about their days and not worry about the gloom and doom of uh agentique pen testing as well, because we have thought leaders like you helping us, frankly.

Shahar Peled 34:25

I really appreciate it. And hearing you say that unrelated to me or to Tara, like I wish every I think every employer would love to hear someone on their team speaking about that that you know their job this way and the people they work with. And I wish that everyone in a seat like yours will say the same thing about how they, you know, how they operate professionally and personally, and that's that's really incredible. And uh I would say even mind-blowing in a good way. We don't really I don't really hear things like that after you know being in this interest for a while.

Ryan Hebert 34:57

So our people don't leave jobs, they leave leadership. And I try to be the best beacon of what my leadership provides for me to my staff. We've got a really great retention rate, and they've got me happy. And I our founder and our president to my CISO, all of them treat me well and keep me supported. So sky's the limit. We're gonna keep making amazing things and keep supporting the critical infrastructure for the United States and make sure all of you have confidence in the markets and have complete transparency across all those avenues, and that's what we're here for.

Shahar Peled 35:24

Amen. To that closing question, Ryan. Um 12 months out. What's one thing that uh you believe in, AI and cybersecurity, that your peers would disagree with today?

Ryan Hebert 35:37

I'm gonna go back to those core controls. I think they're still gonna win the day. I think we'll supplement some of those core controls that we talked about two questions ago with some autonomous workflows. And I think that is gonna win the day with that trust with the development group. If we can chain together the context from the continuous pen testing to the remedial source code that won't break the application, and the only human portion in the loop is to try is to do the verification before you push to PR. My goal is to get to zero vulnerability tracking in the next two years, and I think we can get there.

Shahar Peled 36:12

Wow. That is that is a hard take. And I I I truly believe in that. I think it's totally doable knowing you're on your team and knowing some of the vendors you work with and some of the processes and tools you built internally. That is doable. And I'd love to have you next year on the show and let's see if this came together in the in the next 12 months.

Ryan Hebert 36:31

Hey, reach for the stars. If we land on the moon, we'll still be able to track those things and get them fixed as fast as possible. And hey, it's been an honor and a pleasure to work with you uh in the day to day, and it's been really fun to join this podcast.

Shahar Peled 36:42

I really appreciate you thinking of me. Thank you, Ryan Hebert. Um super happy to have you. Thank you for joining me on the show. I really appreciate your time. This was a super interesting conversation. And uh thank you for your time.

Ryan Hebert 36:53

Been great. Thanks so much.

Intro/Outro 36:57

That's it for today's episode of AI Native Cybersecurity. Your attack service probably changed while you were listening. So take something from this conversation and go test it. We'll see you next time.