Amazon (AMZN) CSO on AI Shaping Cyber Threats, Safety Tools & Frontier Models

Nicole (0:00)

So happy to be joined now by Stephen Schmidt, Chief Security Officer of AMZN.

Let's talk about AMZN's vision, AI cybersecurity sort of colliding now at scale. You noted that the volume velocity of threats are on the rise, 750 million threats daily. Can we talk about what's going on here?

Stephen Schmidt (0:25)

Sure, Nicole, AI is really accelerating both sides of the cybersecurity question equally. It's giving the attackers and defenders both speed and scale. But one thing that's really important, AI has not created superhuman adversaries. What it has done is made every actor with access to these tools capable of operating at a scale that used to require nation state resources.

For example, the time window between something being disclosed as a vulnerability to when it can be exploited by an actor, it's compressing towards single digit hours. The volume, the velocity of threats, they're both increasing. In the old world that we used to live in, it used to be that we had days or weeks or months to fix vulnerable systems. It's not the case anymore. We're now down to minutes and hours.

More importantly, AI is also lowering the skill level needed to launch sophisticated attacks and automating more of each step, which as a result increases both volume of attacks and the speed at which attackers can adapt.

Nicole (1:25)

So what is AMZN doing internally since everything is picking for the attackers and the defenders, the speed is faster, AI is making it happen more often. It's even making it more simplistic for attackers to have a high advanced sort of attack.

What are you doing internally at the company?

Stephen Schmidt (1:47)

So the first thing that we do internally is we make sure we've got visibility into everything we have. Sounds deceptively simple, but for any large company, and we qualify as a large company, I think, you've got IT that's everywhere. In many cases, a lot of people don't even know what they have. So getting that good inventory to begin with is a critical foundation. The second thing, got to measure what you do have. How quickly can you fix something? How quickly can you patch something?

Third, we've got to change the way we think about building applications. They have to be reviewed from a security perspective at the time they're written. Rather than going back to the old way, where we used to review them once a year or one time and then let things sit, you've got to constantly review because the models that drive the AI engines are changing about every three to four months. Their capability is rising. So we have to go back and look again, is there something new that we haven't seen before?

Nicole (2:44)

I don't know how much regulatory programs can actually slow this down to a certain extent because it's moving faster than, we're going to talk about the Accord today. But overall, there's regulation, but all of this is moving so much faster. So in the meantime, you talked about engineering, product development.

Where does Amazon stand in that competitively to have cybersecurity as it evolves and have that stronghold and keep pace with AI at the same time?

Stephen Schmidt (3:19)

Well, from our perspective, we as defenders have to adopt AI rapidly because it fundamentally is required for us to be able to beat the attackers at the game that we have to play. And it's a situation where a lot of people talk about, well, should we slow down development or is this something that we should be more careful about? We don't see this as a choice really between progress and safety. Models should be released when they're ready and safe to use, which comes really from rigorous testing and strong safeguards. And there are risks that if this doesn't happen collectively, meaning the industry working with the government, working with all of our collective customers, we believe as an industry in partnership with the government, we're going to get the right protection that way.

AI is already developing and delivering real value to customers, so getting this tension right really matters.

Nicole (4:12)

And it's interesting too because now people are, we're now having the adoption of AI. It's no longer something for governments or, you know, war fighters or things like that in those special control rooms. Now everybody's starting to use AI in their businesses and daily life. What did you think of the meeting that happened in Washington? What are the takeaways? Because a week ago, we were worried about catastrophic existential risk to humanity.

Overall, and now it seems like some of the language from the likes of Jensen Wong and even Sam Altman, that they can control this, that it's not as scary or dangerous as it may have seemed a week ago. What did you think about the accord that they signed or how you feel about the big picture on this?