Building an AI-native security stack

In this episode

• Attackers now run at AI speed while defenders still write rules
• Securing code when most of it is written by AI
• Why tools must share data: integrations and MCP
• AI-native versus AI bolted on, from a CISO's point of view
• Contain first, investigate after
• Advice for a new CISO

Speakers

Cy Khormaee, CEO and co-founder, AegisAI
Nick Bruno, CISO and SVP of IT, SHL
Michael [surname unclear], co-founder and CEO, Prime Security

Transcript

Machine transcript from Riverside, lightly corrected. Unclear words are marked [unclear].

0:00 Cy Khormaee: All right, well, welcome everyone to another Security Monday. Appreciate you all ending your weekend with us as we like to think about this. I'm joined today by my friends Michael [unclear] and Nick Bruno. Do you guys want to do a quick introduction for yourselves?

0:12 Michael: Nick, you go first. You're the man of the hour.

0:13 Nick Bruno: Michael. Hi all. Nick Bruno. I'm the CISO and SVP of IT at SHL, which is an HR SaaS company focused on talent assessment and talent management.

0:25 Michael: Hey everybody, Michael here. I'm co-founder and CEO of Prime Security, building an AI native product security platform from design to deployment.

0:35 Cy Khormaee: Excellent. Hopefully most of you know me. I'm Cy, CEO and founder of AegisAI Email Security. But we're really here today, and thank you, Nick, for joining us so much. And of course, we love to partner with Prime Security, and Nick and SHL are customers of ours, and we appreciate them spending the time with us to talk through some of the new areas. One of the reasons we all love working with Nick is, Nick, you have such an incredible view of the future of security. From the moment we met, God, almost like a year ago, you always had this clear idea of what a fully AI-native security stack should look like. And it feels like you're just fitting in the pieces. And

1:13 Cy Khormaee: I think a year ago I found this was kind of like a very unique perspective. Now it sounds like everyone is scrambling to figure out what that is. So as someone who's been thinking about it for a year, we're excited to kind of have you on and share some of your thoughts on this topic.

1:28 Nick Bruno: Glad to be here. I think probably more than a year, where I think I started talking to both of you guys actually in a couple different capacities. And I think when you take a look at just where innovation sits, sometimes it's not with the big players. And that's where it gets interesting, because that's where the fun can be sometimes. And it's always learning something new. It's a different idea, it's just different ways of addressing

1:57 Nick Bruno: issues. I'm not gonna say risk yet, just issues. And it allows us to get creative. So that's why I kind of enjoy it so much and yeah, this can be a fun discussion.

2:08 Cy Khormaee: No, we love it. Yeah. And I think issues always create risk is maybe the way we think about it. Like, you know, you never know until it happens. And so maybe just for some framing for the group on kind of the thinking that, Nick, you've obviously been thinking about even longer than we've been talking about it, because you had really fully formed ideas a year plus ago, is just thinking about this as a security stack. I think every practitioner kind of knows that.

2:30 Cy Khormaee: You think about a set of tools you need to bring together in order to solve your problems and at the end of the day reduce risk. And you know, our view is each one of those probably needs to be reinvented for the AI era. And even the way they work together needs to be reinvented. And a lot of the driving force of this is that attackers are really running at the speed of AI, right? The attacks have gotten faster across the areas of code security, across the areas of email and security risk. It's just gotten faster. And humans are still really stuck in this world of see an attack, write a detection rule, investigate in the SIEM. And when you have full automation running against things that run at human speeds, the human will always fall behind. So I think that's what's really behind what people are seeing in

3:17 Cy Khormaee: the market, where again, I think a year or so ago, this was kind of a theoretical risk. I think now it's present, and our customers see it in every area of the market. You know, just like we're all getting up to speed with things like ChatGPT and Claude, adversaries are too, and they're accelerating their usage. And

3:39 Cy Khormaee: if you look at that on the other side, you know, on our side, certainly we see twenty-six percent plus of email attacks using AI spear phishing, and that's up from less than one percent a year ago. And I don't know, Michael, if you can talk a little bit to what you see in the code generation space. That's even harder.

3:51 Michael: Yeah. Well, the code generation space went crazy in the last year. I think this stat of seventy-five percent of new code at Google being generated by AI was a few months ago. I know organizations where the data is close to a hundred percent of the code. It's rare now to see organizations where the majority of code is not generated by AI, and I'll call those now the laggards. If we talk about the innovation cycle, we've crossed the chasm.

4:02 Cy Khormaee: Ha ha.

4:21 Michael: Most of the organizations are generating code by AI, but they're still, as Cy mentioned before, operating at human speed from a security standpoint. It's the same old rule maintenance at the SAST level.

4:40 Nick Bruno: Yeah, so it's funny, when I saw the slide that you kind of put up, the first thing that kinda went into my mind was kind of the rapid fire Nerf gun from the attacker's perspective. And the defenders, traditionally and probably some today, got basically the small Nerf gun that just goes about twenty feet and you have a shield. And I know it's an over exaggeration, but ultimately, and we are getting better,

5:10 Nick Bruno: but right now, without the assistance of AI within our toolkit, we're gonna be playing catch up constantly and we're gonna fall farther behind if we don't actually start leveraging some of the tools out there that are driven by AI first. So the power and the magnitude of what some of the solutions can help us with is actually gonna get us closer. We're still gonna be behind to a certain extent, but we're not gonna be that far behind.

5:39 Cy Khormaee: Yeah, I love the analogy. It's almost like the semi-auto versus auto. Maybe that should be one of our next conference giveaways, Nerf guns.

5:46 Nick Bruno: Sign me up on that one. I'm good.

5:46 Michael: You know, I heard a new level of analogy for this, which is the difference between automated and autonomous. And I think we're starting to move from automated work and automating rules, it's still automation, it's still human, to autonomous, where the human is the orchestrator, governor, versus the doer and the operator.

5:55 Cy Khormaee: Mm-hmm. Yeah, Michael, I think that's right. Actually, let's segue from there into talking a little bit about code, because I think that's one of the areas where it's probably most apparent to teams today where, you know, look, even I'll say in our org, you're right, Mike, we're going from this process where we're writing code, and then we're checking it in, and then we're reviewing it, to a world where long running agents are just continuously writing code and they are the CI/CD system. They're not just participating in it anymore. I mean, how do you see that kind of evolve across your customer base?

6:43 Michael: It's in different stages with different customers. I don't think we can say that the SDLC became standardized anywhere. There's so many different approaches that are hitting the AppSec teams at the same time. You can see in the same organization different teams operating, some with long-running agents, long horizon agents. Some are still vibe coding with shorter, smaller tasks.

7:11 Michael: Some are still doing manual development, much more rare, but it still happens. And the job became harder because you're now trying to secure it across the board. You're trying to secure it both. Sorry, screaming in the background. You're trying to secure it both. Yeah, nobody's being harmed, it's just young kids going crazy.

7:29 Cy Khormaee: Young kids, I promise no one's being harmed.

7:36 Michael: You're trying to secure it both for long horizon agents, for vibe-coded applications, for traditional applications, and you're trying to embed security across the entire stack. From the design, through the code generation, PR review, to reviewing the final output when it all ties together, and you can try to truly identify what's exploitable.

7:57 Cy Khormaee: Yeah, I think that's right. You know, we actually look at it from the other side, of email, where Michael can kind of see, hey, what are development teams doing and how do we protect them as their SDLCs change? We're actually looking at the SDLC of the adversary. And we're looking at how they're starting to use, we can get some really loud typing here, there's, we can see some really kind of significant changes in how the adversaries are using this and

8:22 Cy Khormaee: all of the different attack patterns and things you can imagine that you saw in your traditional training environments, you now start to really see as live attacks. So when they say, hey, like look for irrelevant emails, look for things that are misspelled, look for things that are from people you don't know. All of those are being exploited as an attack pattern. So you can see, hey, the attacks are going to come from someone you trust, they're going to be highly relevant to your business, and they're going to be maybe even from compromised vendors you've worked with before. And so all of the traditional training mechanisms are failing, and all the traditional mechanisms where we set up detection rules to detect these threats

9:01 Cy Khormaee: are being easily bypassed. And we saw that rate go from something like 26% bypassed to 50% plus in just the last six months. So it's really the same theme, one side on the developer side, one side on the adversarial side, which kind of leads us to, you know, Nick, your original comment where, hey, like we've got to get the defenders a better set of Nerf guns. They've got to go from, you know, the first one maybe I ever had. I had the first like Nerf bow and arrow, if anyone remembers that,

9:27 Cy Khormaee: all the way to, you know, what I see kids have today, which are these battery powered, you know, full auto compressed air stacks.

9:36 Nick Bruno: So I think it's funny, and just kinda going off the last comment about the ways attacks are changing, especially from the email standpoint, and that the awareness and training that used to work isn't working. The attackers know what we're training on. They're not dumb. They know where we hit. They know the standards. They know everything that's there. And it's not to say that security is managed by a compliance standard or that it's a checkbox or anything like that. A lot of the training is very effective, especially professionally and personally. Like a lot of this bleeds into both worlds.

10:22 Nick Bruno: But they know what we're training against. They're taking the same training from, you name the vendor, whatever it is. How we actually adapt to going beyond that basic training, to be able to do the simulation, to get a little bit more creative on how we approach this, using the same attacks that we get attacked by in the personal space as well. So not just leaving it to, hey, you're gonna see something that's coming from your CFO or whatever it is. No, no, actually hit them with a LinkedIn attack.

10:52 Nick Bruno: Do it the exact same way we're getting hit every single day. So I think as we started taking a look at how we wanted to change our approach to email security, to AppSec, to you name it, we're thinking about not just where our weaknesses are today, or maybe weakness isn't the best way of looking at it. I'll say inefficiencies around identifying risk. But really trying to see how

11:20 Nick Bruno: the other side is looking at us. And we get pen tests constantly. We go through and do all the different types of security assessments from a coding standpoint as well. There's always gonna be a something. How do you get ahead of that something? And how do you actually continuously look for these somethings, where you're not caught off guard? You know what's there, you know what the fix is. Now it's just actually going to fix it.

11:24 Michael: Yeah.

11:50 Michael: But that something was so much harder to access historically because you could never aggregate so much context. We saw that continuously. We do pen tests on ourselves, even at Prime. I'm sure Cy does at Aegis as well. And historically it was much harder to bring the entire context of what you're looking at, of the product, to truly evaluate the risk. You used to look at PR by PR by PR. It's not helpful anymore. The attacker is not gonna look at the PR.

12:20 Michael: We have to start taking the attacker perspective. Cy, you mentioned that, like trying to emulate what they think. Like they're taking the same trainings. Well, they're not going to look at your PRs from a security perspective. They're looking at the product. They're trying to find a way in. Try to emulate that when defending.

12:37 Cy Khormaee: Yeah, I think that's right. And look, the attack price has gone to zero. One big change we've seen is that state actors have moved from these targeted attacks where, like, if I want to figure out a way to, you know, compromise Nick's email, I'm gonna like focus on him and then draw a ring fence around him and kind of find a path in. Instead, they're doing what we call dynamite phishing. They're just sending mass amounts of AI spear phishing out in the market.

12:59 Cy Khormaee: They're gonna compromise n number of people and then figure out where it leads them. It's a dramatic change in the approach because its costs come all the way down to zero. And it's, Michael, to your point, breaking a lot of assumptions we had where, even in the code world, yeah, it's hard enough to examine PR by PR, but the adversary is gonna exploit CVEs across all of the available surface. They don't have to test CVE by CVE by CVE. So rather than iterate, they're able

13:26 Cy Khormaee: to spread it all the way across, which kind of brings us to some of the things and really what we're here to talk about, which is, if there is this idea that all of the adversarial context and the attack paths are open simultaneously, in parallel, all at once, what are the different areas to cover? And then how do you think about strapping that together? And Nick, maybe this is where I'd love to kick it over to you to kind of talk through,

13:51 Cy Khormaee: you know, what's your vision for the new AI native stack in security? Because clearly we outlined a bunch of problems, but you know, I'm sure all the practitioners here are like, okay, great, we know we have problems. This is not news to us. What would be helpful and news is, like, what do we do about it?

14:07 Nick Bruno: It's a world where everything is better together, and this isn't new. We've always, from a security world standpoint, been trying to figure out how to get our key platforms to talk to each other and share information and whatnot. And eventually it came down to having a SIEM, a log manager, a SOAR. There's a lot of different things that came out on how we actually could integrate and get to a state where there was

14:36 Nick Bruno: automation of different types of attacks, alerts, so on and so on. And none of that from a theory standpoint changes. However, now it's where do you start to send the information? How do you start to focus in on the best of the suites that you have, the tools that you have, and yes there's connectors, there's ways to get them to work together, but then there's also the data that they collect.

15:06 Nick Bruno: And it's the data that they're producing, it's the data that they're sending. And I think ultimately you want to be able to have each system tap into that information. So it's the better together world of sharing what you actually find, and how do you leverage it, and how do you get it to a state where it actually is useful. And by useful is, how do you actually ultimately identify what the risk is, what the action is to take against that risk, and to mitigate that risk to the best of your ability.

15:36 Nick Bruno: That is where a lot of these solutions, one of the reasons why I enjoy kind of working with the two of you guys and your teams, is you guys see the better together world. You guys want to leverage the information that can be identified, generated, but then also from a usability standpoint, if I say, hey, we gotta figure out how to get this going for this specific reason, it's not, well, we don't know if we can. It's

16:05 Nick Bruno: well, let's do it. Let's figure out how we can leverage it, and then kind of get better from a power standpoint and kind of make the products better and the combined ecosystem better. When you take a look at any of the domains up there, everybody's doing the exact same thing, trying to get the information there faster, share it better, so you can actually mitigate risk from a security practice standpoint, which from a CISO perspective is not making my job easier, but

16:35 Nick Bruno: I'm not in it alone. And I think go back ten years, a lot of security teams were in it on their own. And yes, there were some big partnerships that you'd established. You do all these different things. It's a lot easier now. A lot more fun now.

16:54 Michael: I actually have a question for you here. How do you think about vendors building native integrations with other vendors versus you leveraging MCPs now, which are extremely easy to use to build that layer, instead of Cy and I building native integrations?

17:18 Nick Bruno: Whatever's faster for me to get the information that I can actually take action on, it doesn't matter. I think the scalability of the MCP compared to just a one to one kind of integration speaks volumes.

17:40 Nick Bruno: You'll be able to do what you need to do to play better with the rest of the environment, compared to only being able to play better with Cy. And I think you can learn from doing the direct integration, but it doesn't scale. I mean, and I think this is where kind of the platforms of yesterday

18:08 Nick Bruno: are also catching up as well and doing the exact same thing. But they're not doing it just for the platform. They're doing it for every single service in the platform. Because it's all different. Everything's kind of glued together at the end of the day. And I like the ability to be able to pick and choose based on what's available, but also say, hey, this isn't available. Can we add this? And the team on the other side's like, yep, easy, done. It's not trying to figure out how to do it for

18:35 Michael: All right.

18:38 Nick Bruno: Prime, then do it for X, then do it for Y. It's like, done once. Go have fun. And I think the scalability of a request now is allowing teams to get better, faster, smarter.

18:56 Cy Khormaee: Yeah, I love it. And it also allows the information and integration to deepen over time. And Nick, this is something even we found, we love working with your team, where initially we just look at some small part of email. And then we can expand to look at your SIEM logs and then SASE. And then, you know, as our teams build trust and work deeper together, we just start looking at more and more data. I can almost imagine, it's not just the MCP connections, but also the breadth of data shared across them

19:24 Cy Khormaee: can either expand or compress over time, right?

19:27 Nick Bruno: Mm-hmm. Yeah, and I think this also comes down to the different types of capabilities that you and the team are gonna be coming up with. I mean, again, we talked a year plus ago, night and day, based on the features and the functionality released. And then we talked, what, two months ago, and something's already in product and I'm using it. So

19:49 Cy Khormaee: So you ask for it, man, and it appears. That's also the beauty, I think, of AI coding, is we can be so much more responsive to, you know, the practitioners' needs, where you ask for something. I know with DLP it was just a couple of days where we were like, hey, we really need this, great, let's turn it on and get it rolling. And then it leads into exactly what Michael does, because as we're deploying things at an SDLC cadence of days, then we need an AppSec provider that can look on top of that and continually secure us as well. So it all fits together in a beautiful ecosystem.

20:22 Nick Bruno: Yeah, and it's kinda cool because we're doing the exact same thing with Michael that we did with you and the team, where we started off. It's like there's an ask. A few days later, here's what we can do, then it's released. So there's being very nimble and flexible based on a requirement, based on what can be put together today, but it's not stopping there. The continuous iteration of that initial ask, which is cool because it's not just my ideas or the team's ideas that's saying, hey, this is missing. Now you're able to say, all right, well this is great, we start here. Now we can ten times this and whatnot. So

21:04 Cy Khormaee: Yeah, I think one of the great powers we've seen too is just the ability to skip the configuration step. I mean, I think, you know, Mike, I'm sure you've seen this too, where, I mean, all the way back, I think Splunk was one of my first customers way back in the day for a prior business. And you know, the installation, tuning, configuration cycle was definitely a longer thing. Whereas a lot of these AI native tools, we discover, because the LLMs are so flexible, you can just plug them in and let them go. That's why you can get, you know, DLP out of the box in a day. I'm sure AppSec out of the box in a day. Like the standard for these detections now is turn it on and it just works. There's no configuration.

21:42 Cy Khormaee: There's no pipelines. There's none of this other stuff. So it kind of goes, Nick, to your point around how much more nimble we need to be. I mean, the scarier part is also how much more nimble we'll need to be, because the adversaries are moving fast too. I don't know, Nick or Michael, if you guys see anything else on just how fast you're seeing the adversarial threat evolve alongside the practitioners' defensive tools, going back to the Nerf analogy of everyone's getting better technology and bigger guns all the time.

22:10 Michael: I'll jump in with two comments here. One, from an adversarial perspective, you know, a few years ago, a zero day was a big deal. Tell me that a zero day is a big deal now. If you follow different accounts on X and just read their reports, you get tens of reports a day in critical infrastructure. It's not more humans trying to find them, it's humans deploying AI, and the models are getting so much better by the day. If Mythos was the talk of the town six months ago and everybody was

22:51 Michael: praising it for its detection capabilities, I think GLM 5.3 is almost as good now. And that is an open weight model that everybody has access to. So that's number one. Number two, I actually want to comment on this slide. I think, Cy, when we were making it, I now think that we had a small oversight here. The connect to detect is great, but you have after that a context engineering that is continuous. And it's done as you go by the platform.

23:19 Michael: We can detect, we both know that you and I can detect great and provide great output on day one. But there's a continuous improvement curve that is not done by a human. It's done by the machine that continues to learn the environment as it evolves and provide even better detection over time.

23:44 Cy Khormaee: Yeah, I think that's totally right. If we fast forward a little bit, maybe we can go to, you know, Nick had some amazing ideas. I think what I love also about working with you is you don't have just a vision about how to build it, but you have a vision about how it should be felt by your end user. You have such high empathy for the people in your organization dealing with the technologies. You've got a particularly challenging problem because SHL is such a large organization. You guys have people all over the world and you have customers all over the world and infrastructure all over the world.

24:12 Cy Khormaee: It's one of the most interesting, I'm sure, corporate environments as well as technical environments out there. Yeah, tell us how you want your engineers and your employees feeling about security as this all changes.

24:28 Nick Bruno: The experience and the outcome matters on anything that we, from a security standpoint, even just overall from a technology standpoint, throw out there. So I can lock down everything. No work gets done. Plain and simple. So the experience sucks. Actually understanding what is needed from an outcome perspective for the end users matters.

24:57 Nick Bruno: Even the business in general, what is the overall outcome we're looking for? And then having a program and an infrastructure and a security that can support it and adapt as the business changes. The experience is going to change day in and day out, as we bring on new or different types of solutions.

25:25 Nick Bruno: Whatever it's gonna be. We rolled out Claude four or five months ago. The experience on day one compared to today is night and day. There's so many other things that the business wants to do with Claude that they had no clue they wanted to do on day one. I couldn't take the same approach then that I have today, because nothing would work.

25:51 Nick Bruno: So being able to adapt, be flexible, but also listen to what they're trying to do and what outcomes they're going for, allows me to have a better and more secure program, because they're not trying to get around it. And I think that's the key aspect of the experience in talking to the business in general. Once you actually understand what they're trying to do, you want to help them, enable them to do it faster, just in a secure fashion.

26:18 Nick Bruno: And that goes at every single layer. We're talking about the data that they're interacting with. And yes, they might have legitimate use or legitimate access to that data that is in the CRM. Great. But when you download it, you try to do something else with it. What are you trying to do with it? Why? So you start to ask these questions, and it's not to interrogate them. What are you driving towards? How does this help the business? Let me help, let me partner with you.

26:47 Nick Bruno: And I think those are some of the things, when you take a look at the outcomes, the experience, how do you make sure that you're able to support and enable. Those are key things that security teams have learned over time.

27:02 Cy Khormaee: Yeah, it's a cool opportunity. You can even help people get protected. We hear this with, you know, DLP. We always like to say, you know, a lot of times we imagine someone's nefariously trying to send stuff out of the org. But most data leaks are just someone sending the right thing to the wrong email. It's that simple. Like I send it to Nick Billings versus Nick Bruno, and that's your data breach. And users don't want that. So they really want those guardrails to be safe. So I love that approach. I think, Nick, it makes a ton of sense. As you think about

27:31 Cy Khormaee: evaluating AI native vendors, and Nick, I think about you as one of the best at going really deep with, you know, early stage vendors like us and really understanding the technology, what are the key questions you like to ask and kind of dig into here?

27:50 Nick Bruno: I mean, I always ask if the team gets more time to do other stuff. The answer is no, usually. And so, to be completely fair, yes, there's always more time to do more stuff, especially when you have a solution that's taking the brunt of manual efforts and whatnot. But the team is spending more quality time on the things that matter. And some of it might be around the solutions to get

28:19 Nick Bruno: deeper into what the risks are and addressing those risks. Could be some gaps that we had previously we weren't able to do anything with. It's not that the workload went down. We're able to address more risk and spend more quality time on it. The other thing is, are you gonna be able to reduce your headcount? No, don't plan on it. Because we wanna focus on other things that we haven't been able to do before. And yes, there's always gonna be that question that comes up. And I think from a security team's perspective, it's making sure that we're always focused on the business risks that matter and we're able to show how we're mitigating them to the best of our ability. I think, yeah.

29:02 Michael: Nick, let me push you on a little bit here. You get pitched by a lot of vendors all day long, new, existing, emerging, and so on. Everybody is an AI company. How do you delineate? You know, marketing told me to say that. But how do you delineate when it's AI native versus AI bolted on? Do you care?

29:17 Nick Bruno: You don't say.

29:21 Cy Khormaee: Yeah.

29:35 Nick Bruno: Do I care? When it's bolted on, you find out that there's limitations down the road. It just takes time to find out what those limitations are. It may be as you're POCing it, maybe as you get into specific use cases. So many reasons why and when you find that out. Sometimes it may be too late. And I think going through and focusing on what the actual, and this is kind of where I spend a lot of time, just doing a vet and

30:10 Nick Bruno: the team does the POC, and trying to understand where there could be some limitations. As we start to pull on these use cases and say, here's our secure development lifecycle that we're trying to improve with this. This is what we currently do. How do you approach this? What about this scenario? What about that scenario? And when the answer comes up of, well, we're not sure yet, we haven't figured that part out, and it takes a week to kind of figure out what a vision looks like, that's when I get concerned.

30:40 Nick Bruno: 'Cause you should at least be able to have a discussion on a problem. This is where the better together, our partnership, an extension of the family, matters. You don't bring on suppliers and set it and forget it. That doesn't work nowadays at all. You have to be invested, you have to understand what the overall vision looks like. And the vision doesn't have to be years down the road, but understanding where is it heading? What are you gonna be good at when you grow up?

31:09 Nick Bruno: What are your core competencies and what are you not gonna be when you grow up? I am tongue twisted completely today. But I mean, I think understanding where the boundaries are gonna be is important. And the flexibility, and that's key. Like, again, as we started talking months ago, I had some key problems I wanted to solve then. Those problems didn't just stop there. We talked through what the problems were and we had an idea of what the vision looks like and how we can

31:39 Nick Bruno: work on that together. That is the partnership. That's kind of when you take a look at some of the innovation around the AI native or AI first entities that are doing this. The bolt ons are still good, they still get there. It takes a little while to get there. That's just an experience that I've seen. Now everybody will have their own differences on how they approach that and whatnot.

32:08 Nick Bruno: And it's not to say that every AI native company is going to approach it always the same way. So far, that's what the experience has been.

32:21 Cy Khormaee: Yeah, that makes a lot of sense. Sorry, go ahead, Michael.

32:21 Michael: No, I said thank you for sharing. You know, on our end it's been a blast. Even working with your team, it started off from one use case and expanded to more use cases during the POC process.

32:34 Nick Bruno: There's many more coming, so

32:40 Cy Khormaee: By the way, that's also great, you know, just part of the partnership. I mean, Nick, you mentioned earlier, like, hey, there's always more work to be done. It's funny, people also ask me about what's the future of [unclear] in security. I'm like, look, there's probably like 30 times more work to be done than any team can actually handle. And if AI takes that down by half, there's still probably 10x more work to be done than any security team can do. I just feel like maybe the anxiety level comes down by 50%, but the workload still is a hundred percent.

33:13 Cy Khormaee: So with that, let's say there's a CISO who's starting tomorrow. You know, fresh environment. What's that? Yeah, okay. Step zero. Rethinking. It is an incredibly difficult job. But let's say for whatever crazy reason you're like, hey, I want to go do this job, as Nick has for many years, you know, what's your advice to someone coming in, and maybe let's frame this towards someone who's a relatively new CISO.

33:17 Nick Bruno: Don't. Please stop. Rethink your career.

33:24 Michael: Don't be a CISO.

33:41 Cy Khormaee: I think there's a new crop coming up. They don't even know what they're getting themselves into, but they've got an opportunity to kind of rethink things in the AI native way. What's your advice to them?

33:53 Nick Bruno: So it's funny. So at RSA, Larry Whiteside Jr. had a panel, myself and two others, and it was on: is the CISO role doomed? And I think most of us opened up saying, yes, stop. But when we start to dig into it, it's not doomed, we evolve constantly. If you think about what the CISO was a decade ago, it is not what it is today.

34:20 Nick Bruno: I probably should have said this in my intro, but I didn't: I have global responsibility for security, IT, business systems, as well as DevOps and FinOps. I have a very expanded role. It's not because I want that; it's because I manage and evaluate risk and help the business try to mitigate risk to the best of our ability. The CISO of tomorrow, the CISO of today, our job is to manage risk.

34:49 Nick Bruno: Our job is to help identify and help the business manage risk overall, and get it down to where the business can still operate and do what they need to do, because that's why we're here. But we need to enable them to move faster, but also account for what's going to hurt us. We don't want to just let everything go run wild. We need to kind of have that balance. And when you take a look at how CISOs approach things today: what is the business trying to do?

35:17 Nick Bruno: What is your outcome? What is the experience you're looking for? Now let's take it a step back and figure out what's the inputs, how do we get there? I mean, even taking a look at it from a product development lifecycle standpoint. We start off with the design reviews, what the requirements are. Start to break this down and then say, all right, well, if you want to do that, here's some things to account for. We're not saying no. How do we account for this? How do we make sure that we're doing this in a secure fashion, and not just stop there but iterate on this as things change? So

35:45 Nick Bruno: basically what it comes down to is that the CISO role, and I said this back at RSA, I'll keep saying this, we're not doomed. We just need to evolve constantly to figure out how do we help the business move faster, identify that risk, put a plan in to manage that risk, move on. That's pretty much the biggest thing that it comes down to. Now, it's probably not answering the question, what's the first move? I would still say rethink your career. But I do think

36:16 Nick Bruno: understand where the business wants to go, how you can help them get there, meet the outcomes, but also elevate the risks that matter, focus on that risk together as a cross-functional team from a business standpoint, and just don't stop there. Keep the discussion going. Rely on the ecosystem and the extension of the families that you create from a security stack perspective, also from a technology stack. Those

36:44 Nick Bruno: solutions that might be IT driven have security elements; leverage them. This isn't where you just have your own toys in your toy box and that's it. There's many different things to rely on, and I think that's kind of a key thing in general. Focus on what is available to you, without even going beyond that, but then create the partnerships in the areas that you need help in, which is what we've done here at SHL, and we'll continue to do as we find

37:14 Nick Bruno: the need and a gap that we have to close. But I also rely on my technology partners that are already there. If they have something from a security standpoint, I wanna be looking at it. I wanna see what it can do. If it can't do it, I will find something that will.

37:28 Michael: Nick, a question from me. You know, Pat Grady, a partner at Sequoia, just published a long post about the future of AI and mentioned that AI native companies have to reinvent themselves every four months in one way or the other. To what extent do you feel as a CISO that you need to rethink your stack? Did that velocity increase on your end?

37:59 Nick Bruno: Yes. So the right answer is yes. Being able to kind of go into the reasons why and all that stuff is definitely a much longer discussion. But I do think that as threats are changing, the things that we've done traditionally just don't scale the way we want them to. And

38:29 Nick Bruno: look, I have solutions that have released AI modules and things that can help. But they're add ons. Some are good, some are not. I do feel that you have to take a look at a lot of different things as you take a look at a stack, and you have to constantly do this. Yes, you might have long term deals with whatever vendors you have. Doesn't mean you have to stop talking and understanding what's out there, and trying to figure out if there's a feature in an innovative company that you think's cool. Is this on a roadmap somewhere? Great. And then also, is there a partnership?

39:09 Nick Bruno: Can you make an introduction where there could be a better together world? There's so many different options there, but I do feel that you have to constantly think about what you have in your stack. Try to figure out, is it effective or not? If it's not effective, you need to have discussions with your vendors and find out what's going on. Why are we not focused on this? And it could just be a limitation. And if it's a limitation, accept the limitation, but then if it's a real risk you need to manage,

39:38 Nick Bruno: find something that's gonna help you manage it.

39:41 Cy Khormaee: Yeah, that makes sense. There's a continual world of reinvention for CISOs, and probably even more so for vendors, where all the threats are evolving. So we all gotta evolve with it. So the last piece of content before we go to Q&A, and I can already see stuff coming into the queue, so keep adding it in, great questions already, happy to take more in the last 10 minutes. But just, Nick, you know, one quick sentence each for each of these categories. Maybe starting with, you know, what's one legacy tool category that won't exist in five years?

40:17 Cy Khormaee: Sorry, this is the lightning round.

40:19 Nick Bruno: So I don't really know the category yet that I don't think is gonna be around in five years. I think each category is gonna morph into something different. There's gonna be blending of categories. I think

40:27 Cy Khormaee: Mm-hmm.

40:35 Nick Bruno: log management probably won't be something that truly exists in the same form that it is today. I think that's one thing. There'll be a data lake. A data lake that we send stuff to, whatever we call it, but I think the category won't be around. So

40:55 Cy Khormaee: That's right. My favorite new phrase is data swamp. So a lake, you have everything that's cleaned and prepared. A swamp is just everything thrown into one little area and it all gets figured out. Not yet, but it was from one of my students. I'll have to give them credit, but I love that term. It's very evocative. And then two, what do you feel is the most overrated AI security claim right now? Or just claim about AI by security companies. You can take either one.

40:58 Nick Bruno: Okay. Did you trademark that yet? My solution will do everything you need.

41:22 Cy Khormaee: Yes, the magic wand sadly does not yet exist. And then the last is, you know, what's the one metric that tells you as a CISO whether, I'll say, an AI tool is working or not?

41:37 Nick Bruno: The amount of risk that I'm able to identify that I can mitigate faster than I do now.

41:45 Cy Khormaee: I love it. It's really going back to the core areas of the business. That's amazing. Well, Nick, thank you so much. We've got maybe five or ten minutes. Let's try and take a couple questions. I see one from, and I apologize, I'm gonna butcher this name, but Edisola, thank you so much. You asked a really interesting point on AI native stacks that decide on their own. In phishing defense, this feels especially relevant. The attacks move too fast for static rules.

41:46 Michael: Spot on.

42:09 Cy Khormaee: Curious how you're thinking about autonomous decision layers specifically for email or identity threats. And so maybe it's like, how do you take action? Now that, say, we as vendors tell you an email is bad, how are you automating that across action and then your identity stack?

42:28 Nick Bruno: I should throw that back to you since you're doing it for us.

42:31 Cy Khormaee: Yeah, well, I can give you one take on maybe how you're thinking about it broadly. One thing we've observed is that whenever you see a human take an action, so let's say we see a phishing threat and we see something get through, or we see something that maybe has other fingerprints that we believe we can find, we'll investigate it in the SIEM. We'll say, hey, there's other fingerprints of this within your infrastructure. We'll identify the users attacked.

42:34 Nick Bruno: Huh.

42:59 Cy Khormaee: And then we'll take action. It could be rotating a password, it could be reducing permissions, it could be triggering an investigation, and then investigate in the back end. The broader theme that we really love, Nick, working with your team on, is to get your users from a risky state to a safe state in the case of an emergency, have that happen automatically, and then have the investigation follow that, versus investigate and then take action. I think that's been the key motion, and I'm sure the same is true on the AppSec side, where humans investigate

43:29 Cy Khormaee: almost after the fact, or to confirm the AI actions, where the AI actions happen in real time. So you're not waiting those precious 15 to 30 minutes at risk. Maybe your user is blocked for 15 to 30 minutes in a safe state. And then you investigate to unblock versus investigate to block.

43:46 Nick Bruno: Yeah, I mean, you take a look at just incident response principles. You wanna contain. Stop the bleeding. Focus on that, and then yes, there could be an impact. That impact is something you can justify for the short term, as long as it's not a wider problem that you have to focus on. And I think this also comes into educating the business too. How are you gonna respond to an incident? If I see something, I'm gonna stop it.

44:10 Nick Bruno: Then we'll figure out what happened, and then if we have to put any additional mitigations in place, even communicate to the executive team: yeah, unfortunately we had something going on on our production system. We stopped it. We figured out what it was, we've resolved the issue, or it wasn't an issue, it was something that was actually supposed to happen. But don't wait to figure it out. Don't wait before it becomes a bigger issue.

44:37 Cy Khormaee: That's awesome. I think we're at time here. So maybe those are the best possible words to end on: just don't wait. Let's get rolling in this new world of AI today, because it's moving faster than ever. Michael and Nick, thank you both so much for joining us. This is an amazing conversation and one that has sparked a bunch of other ideas in my head. Maybe we'll talk about the future of data warehousing and log management and data swamps in the future. So I just want to thank you both again for joining.

45:04 Michael: Yeah, absolutely. And I think we'll continue some of the conversation in Orlando next week at InfoSec World. So for those of us that are going to InfoSec World, reach out, as we're gonna be hosting a dinner together to continue exactly this conversation.

45:05 Nick Bruno: Thank you. It was fun.

45:11 Cy Khormaee: That's right, we'll continue.

45:23 Nick Bruno: Yeah, looking forward to it. It'll be fun.

45:25 Cy Khormaee: All the better to have it in person. So hope to see you all there. Thank you all for joining us for yet another security talk on a lovely Monday. And hope you have a wonderful week, everyone. Thanks for joining.

45:35 Michael: Thank you, everybody.