AI cybersecurity is a cat and mouse game

Ryan Donovan (0:08)

Hello, and welcome to The Stack Overflow Podcast, a place to talk all things software and technology. I'm your host, Ryan Donovan, and today we are recording live from Ai4.

We are talking right now about the new security landscape with Ai. And my guest for that is a rogue player coming over from Blackhat, the CISO for Zscaler, Sam Curry. So welcome to the show, Sam.

Sam Curry (0:32)

Thanks for having me.

Ryan Donovan (0:33)

Yeah, my pleasure.

Sam Curry (0:34)

I like the label rogue player, especially in the context of Blackhat, so that's kind of fun.

Ryan Donovan (0:39)

You know, everybody is getting into the Ai, Ai coding, integrating it into whatever products they have. It's everywhere, for good or ill. And one of the big issues people have talked about, I get pitches about it every day, is the AI security issue.

From your perspective, what are the sort of button issues we're going to talk about AI? I mean, broad topic, right?

Sam Curry (1:02)

Yeah, there's a ton of them, as with, I think, all of engineering and with many jobs. The question is, so what does it do to our job? What does it do to the need for us?

Ryan Donovan (1:11)

Yeah.

Sam Curry (1:11)

And I would say some jobs are compressible, meaning efficiencies, meaning we don't need people doing those tasks anymore. And others are what Jeffrey Hinton calls elastic, meaning we actually need more people in some cases. Right. In some cases, the job of engineers in DevOps is no longer as coders, primarily, it's to produce high quality code at scale.

Ryan Donovan (1:33)

Right.

Sam Curry (1:33)

Which is more of a computer science function. And it's about architecture, infrastructure, supportability, deep conversations. And nobody yet has shown me a product where they said, oh, you know, all the enhancement requests are done.

And the competition has given up. And we finally reach the end of what's needed. And then I think, especially with code assist use cases, we're going to wind up in a world where we have to produce much higher quality faster. And so if we understand that distinction, I think it means that being AI enabled may mean we need more carbon intelligence to go with the silicon.

And so then you get to security. And we have a further dimension. I think we may get a SecOps revolution like the DevOps revolution. We have a further dimension of the opponent is asymmetric. It is not as it is, say, in engineering where you have other engineers building competitive products. They're actually using it asymmetrically, and they're creating more noise for us to sift through, and they're also creating more signal for us to find. So where before we would find a signal in security operations, every four or five hours, we're finding every four or five minutes and it's harder to find it. With more investigation, more consequences, more accountability issues. So that's a lot for any job to absorb. But having said that, given that engineering is now using these intermediaries and code assist, we have the opportunity to start, I think, embedding security more natively in applications as part of that expanded demand on engineering. Say, let's get the signal closer to applications. Let's not just to be over in the security land, we worry about logs, where correlation monkeys who pour through logs, oceans and oceans of them. Instead, we can get better logs out of the systems. That's the first. What does it do to the job, what does it do to the process? Then there's, what is it doing to the code integrity issue? Mythos, I think, in this project last week, people have heard about, has really changed how people think about frontier models and some of the upcoming open weight models, and how they're going to be used for things like vulnerability operations and weakness detection, but also then you get the SSDLC, and how do we change the trade-offs we've taken for granted with our peers over the years? So how do we use it in making more robust and resilient code infrastructure? Then we get how do we use it in offense, how do we use it for things like what's called continuous red teaming?

Then how do we actually perhaps, given that it's still non-deterministic, and that means it doesn't always produce the same result for the same prompts, how do we actually use it to do better security? Does the potential exist to improve what we've been using machine learning for, or what we've been doing with algorithmically, but maybe even some entirely new functions that we never considered? So there's a huge array, which is more than you probably asked.