Maximizing Opportunities, Minimizing Risks: Ways to Leverage AI for Security

Hey everyone, it's Alan Shimel, founder editor-in-chief of Techron Group. Welcome to our second video in a series we've done with our good friends at Adobe. Looking at the influence, the impact of AI and security.

I've spoken to five different Adobe security professionals. In this next video series, you're gonna watch about how Adobe themselves are using AI to make their security more effective, to make the Adobe products you use more secure. The beauty of this, it's not just about making Adobe more secure, but there are lessons here for everyone in how to use and leverage AI to make security more secure.

And my first guest in in this series is Bryan Payne, whose Adobe's VP of product and software security, and he's gonna give us a little bit more of an overview of the work his teams are doing in AI and security. And welcome back to our continuing series, discussing software and security with our good friends at Adobe. My guest for this episode is Bryan Payne.

Brian is the VP of product and software security at Adobe, and let's welcome him. Hey, Brian, how are you? Doing well, thank you.

Thanks for coming on here. Brian, VP product and software security. Sounds like an awesome job, but tell us a little bit about kind of your journey and how you view your role.

Sure, absolutely. So my role here at Adobe is to oversee the security of all the software we produce, and that's our products and all of our in-house software tools as well. Um, and I'd say, you know, I got here throughout my career just focusing on security and software over the years, um, I've been with the government, I've been in academia doing research, and, uh, spent the last 15 years or so in the private sector here, Brian, of of course, we've, you know, we've entered into the age of ai.

Sounds like a, an old song. It's not Aquarius though. Um, and it, you know, whether you buy into the whole AI hype or not, it certainly is changing the way things are being done here, being, you know, from, in every aspect.

It, it promises all kinds of disruptions. Um, and, and ai, quite frankly, to those of us in the security world, it, it's kind of a shield and a sword, if you will. Right.

Unfortunately, it is for the bad guys too, you know, that's always the case in security. Um, so, but you know, the topic of our short discussion today is maximizing opportunities as well as minimizing risk ways to leverage AI for security. If you wouldn't mind, again, without giving up trade secrets, or let's not get us ourselves in trouble, talk to us about, you know, lessons learned at Adobe, some of the things you're doing, some of the things you're trying, some of the things you're thinking about along these lines.

Yeah, so you're absolutely right that AI can be used by, by anyone. Uh, it's a tool and you can use tools for, for good and for bad. And I think, you know, in the security world, we're keenly aware of that, that history, that's always been the case with tools.

And so, um, one of the things that I see is that it's important for us to, uh, be able to understand how to use them and stay ahead of the curve so that, uh, the, the attackers are not getting the edge right. Um, at the end of the day, we find that it's very useful to help us scale. Um, I've rarely run into a security person who just feels like they have so much extra time in the day.

Um, and so, so the ability to, um, take care of some contextual generation, uh, help us learn faster, help us get to the key points faster, and then let people do what they're best at, right, using their brains to solve those security problems, um, that's really the key for us. And, uh, and it comes out in many, many ways throughout our work. So if you don't mind, Brian, let's, if we could dive, peel that onion back a layer or two, how, how does this manifest itself?

What are some of the ways you're leveraging ai? You know, we look at different code bases all the time. If you think about the number of software projects happening at Adobe, it's a common thing where a security engineer needs to look at a code base that they've never seen before, and then come up with an assessment of what security work might need to happen around that code base to make it even stronger.

And, um, that can be a challenging pro process to wrap your head around this, but AI has proven very useful. Um, you can just ask at things like, what end points are gonna stand up when I start this code base, right? Uh, which functions receive untrusted user input?

Um, it can help you navigate the code in a way that gets you to a destination much more quickly, um, which is fantastic. It doesn't mean that it's, it's necessarily replacing the human in these things, but it augments them and helps them work much faster, which is really wonderful for, for our threat modeling work especially. Um, some other examples of things that we've done, um, think about network scanners.

Uh, you often need to stay up to date on the latest CVEs, the latest, um, proof of concept code to be able to make those scan templates and to know, you know, which systems on your edge might be vulnerable to the latest vulnerabilities. Um, so we have found that AI is especially effective if you can point it at, um, you know, public information about these things. Um, it can turn around and create the scan til puts rapidly for you, allowing you to more rapidly find those places in your ecosystem and ultimately more rapidly solve the problems of fixing them.

We also use it, um, internally for developers. Uh, we like to give them as much information as we can around the security problems that we find in code and help them to fix them quickly. And, um, we have found that it's much better to provide some context around this is how we think it should be fixed.

Um, this is the best practices around fixing it and those things as opposed to just saying, here's the problem. And in those situations, um, uh, gen AI is actually pretty powerful at being able to, um, put together some of those recommendations so it can actually go into our Jira tickets and augment them, um, so that people can get additional context around the best practices for their fixes and, um, and ultimately get to a, a faster conclusion on them. Excellent.

Brian, everyone today is talking about agent AI and AI agents. We're, we're definitely looking at, um, different ways that this can play out. Um, we have, uh, been exploring code generation, um, using some agentic AI systems.

And one of the interesting things in this space is that, uh, you, you can ask it to help you make code, um, and sometimes it does it in a way that's very secure and sometimes it will miss a few things like, um, like path reversal vulnerabilities or SQL injection. Maybe it doesn't quite do the right filtering on that input. Um, but what you can do then is you can actually tell those systems, here's some additional guardrails I'd like for you to consider before you generate that code.

And then all of a sudden the code that it generates, it's the bar is raised in terms of the security quality of the output, um, and a world where more and more code is likely to be generated by a AI year over year. If we can get ahead of that curve, and if we can actually, um, ensure that that code is more securely written than what a human would've done, then we can actually move the needle on security over time. So I'm very excited about, about that space and where that's heading.

Um, we're also using it in, um, more of a chat bot situation, right? So, um, someone can come into our team and ask questions around, Hey, what's the best way to protect my password? Right?

Or, um, you know, any sort of question they might have. And a lot of these things are actually written up as internal policy here at Adobe. And so it's pretty straightforward for AI to be familiar with all those policies, look at the question, match it, and then respond for them.

And, um, that allows us to get answers back to the workforce much more rapidly than, uh, than having a human in the channel all the time. And we can go back and, of course, double check, do we think it gave the right answer and then kind of train it over time in the cases where maybe it missed. Brian, thank you so much for, for, uh, coming on here today for people who maybe just wanna find out a little bit more about Adobe security in general and maybe about how Adobe's using ai, uh, you know, for security, where, where can they get more information?

So I would say definitely, uh, you know, enjoy these episodes where we're gonna talk a little bit more in depth about our work. Um, we also do often speak at conferences, uh, in the, you know, the technical conferences throughout the community. Um, probably too numerous to list, but I would just say keep an eye out for, for Adobe at your favorite security conference.

We are quite often there, so Absolutely. Bryan Payne, VP product and software security of Adobe here. Thank you for joining us, Brian, and keep up the great work.

Thank you, Alan. It's been great. I want to introduce you to our next guest in this series.

His name is Alex Stan. Alex is the senior pro product security engineer at Adobe, and he's responsible for triaging and validating bug bounty reports, planning, life hacking events, developing security automation for scale and, uh, to scale the program's activities, and as well as collaborating with the various stakeholders, both internally and externally to improve security workflows. Alex, that's a mouthful, but welcome and it's great to have you here on Techstar tv.

Thank you, and very glad to be here. It's obvious. What are the, what are the benefits to a company like let's say, Adobe, um, with having a bug bounty program?

Well, you're gonna find out, hopefully your software becomes more secure as a result because there are people who are not, you know, who are on the outside looking in, let's say, or who are, you know, beyond the team who are letting you know about, uh, potential bugs and defects in your software or maybe their features, right? That's not a bug, it's a feature, but what's in it, what's in it for the security researcher who discovers this? Yes, for sure.

And, uh, of course that I, I cannot, uh, you know, it, it's just financial. Uh, it's definitely one of the main reasons. Uh, but they do have some advantages.

Like I I think internal flexibility. They get to choose their targets. They can hack whichever company they, they want, like if they're specialized maybe in desktop testing or web application testing or mobile testing or cloud large language models, they, they, they can try to test everything they want.

And also there is, uh, an, an important part to this, which is the reputational aspect. Um, they get recognized by the companies. They maybe, um, have CVS on their day name, you know, they report the vulnerabilities in the program, which is a CV numbering authority issues, the cvs they get sign a cv.

So, uh, it's, it's a great aspect on the reputational part as well. Absolutely. And, and that in many times, many ways, it's even more, that's more of a, of a, a carrot, more of a, of a reason to do this than, than some of the financial rewards.

But now we, of course, Alex, we're in a new world, right? We've got AI and we've got, well, even before ai, I remember when fuzzing came out, right? All of a sudden that made, you know, doing scanning with a fuzzer.

May you, you could do a lot more with that than you, than you did with the old wave of doing it. But talk to us a little, talk to us a little about how bug bounties are changing in this new AI world we live in. Definitely, I, uh, believe the bug bounty hunters are using AI and large language models to, you know, help, uh, discover more exploitable opportunities.

But we, on our end, in the programs we need to scale as well. So we're trying to definitely leverage ai, um, to reduce our, you know, our manual tasks and focus on the more important tasks. So I can give a little examples if that's okay.

Sure, please do. Cool. So, um, we definitely from time to time, you know, as, as, uh, backbone to program owners have a lot of reports.

So we do want to ensure, uh, we are doing report validation, very efficient. So, uh, one of the manuals tasks we, we have to do is maybe identify duplicate reports. It's, uh, mostly unfortunate, but, uh, bug monte hunters are, uh, can find duplicate reports of one another on our end is, is pretty tricky to, to, uh, lead the pieces together.

Um, and we try to use LMS to maybe identify, uh, duplicate reports and also maybe the LLM can assist on the reproduct reproducible aspects. Like if there are unclear steps to reproduce, like for example, I'm not sure from step three to step four, um, how I can actually reproduce the finding, but maybe the NLLM can already do an, an analysis for us before we actually jump into the report and, and provide the extra steps or, uh, make, uh, you know, some, some distinctions maybe BLM telling you, you can go back to the researcher, ask more information about this or, uh, it isn't enough security impact illustrated. Can you, can you show us, um, so it actually help us, uh, reproducing.

So yeah, uh, this is, uh, usually how, uh, LMS can, can help with a report validation. There are others application as well. Absolutely.

Alex, I want to hit on two things. Number one, you mentioned you as, you know, the a person at Adobe who goes through all of these bug bounty reports that you receive. Give us an idea how, how big a job is that in, in like sifting through all these reports, eliminating duplicates, finding out which ones are, are in fact valid, which ones are critical, which ones are not deciding how much money a particular bounty should be paid on a particular thing, if you wouldn't mind, you know, 'cause that sounds like a huge job.

And then, you know, now in the age of ai, is the aim to replace the external researcher with the internal ai, or is it really you want, you want both? I think my answer is we want both. Uh, especially since, you know, the external researchers are very creative.

So an AI definitely cannot, uh, cannot get to that level. Um, and regarding the volume and, uh, let's say the technical, uh, technicality of the findings, uh, yeah, it, it, it's, it is challenging and yeah, we, we need to handle, uh, the, the payout. So we need to assess each finding correctly.

So, uh, in the world of ai, uh, actually another application is to auto enrich reports. So we have pretty much a lot of findings, right? So, uh, we can use an LLM, for example, to predict CVSS score based on similar reported findings.

So we don't have to each time, uh, need to check those and see we, uh, we aligned with, you know, with previous submissions. And, you know, of course there will be many bugs and many products reported against. We can also use the LLM to identify the product that is reported against and pre-populated, uh, in, in a ticket and actually categorize the findings.

So in order to track the findings, you, you need to, to know like certain information and what's the vulnerability? Like, is it cross scripting, is it injection? What's the proposed CBSS score?

Because, because of, on the CBSS score, where you pay the bounties was the reported product. So, um, yeah, uh, the LMS can can be used for that as well. So it sounds Alex, like the, the, the LLMV ai, right?

Because the LLM is just sort of the, the data from which the AI is drawing apart, but we could use the ai AI to, to actually manage the Bug Bounty program itself, right? So in addition to finding particular bugs using an AI and LLM, we could use the AI LLM to manage our Bug bounty program, contact the researchers immediately see is this particular report or duplicate of one we've already received, as you mentioned, uh, uh, take a, a, a shot at predicting what the CVSS score would be for this book. I mean, it really, it sounds like it makes your job a lot easier.

No, Yes, it is. Uh, but yeah, that comes with, uh, a limitation actually because, uh, uh, it's, uh, providing a lot of extra value, but it needs to be verified. So, uh, we have all the information there, but, uh, in the end, uh, human touches is required for these.

So, uh, and we really want to give the, you know, the researchers a chance to, uh, like we want to understand them. We don't want them to be blocked by, you know, an AI decision. So that, that's definitely a limitation.

Absolutely. I, well, it's not just in this particular instance, I think that's good lesson for everyone who's using AI chat bots for customer support and, and service and so forth, is people do get fussed. I, I'm, I'm the first to admit it.

I'm the guy yelling representative. Representative, you know, I want to get a real person to talk to. Uh, and, and I think it's, it's true in bug bounty programs too, Alex, we're almost outta time for, we have a huge security audience here for security folks out there who say, you know what, I'd like to be involved in the Adobe Bug Bty program.

Where, how can they, how can they get involved? For sure. com/adobe and read the policy, the assets in scope, and start there.

com/adobe. Alex, Hey, keep up the great work. You know, everyone, every, all software has bugs and vulnerability, right?

Vulnerabilities. I, and it can happen to anyone. I, I've learned a long time ago, don't point fingers, but Adobe's done a great job, I think, and the Bug Bounty program is one of the ways that you guys have done a great job in ensuring your software is the most secure and safest it could be.

So keep up the great work and keep us posted. Thank you very much, diam. Thank you.

We'll be back with more information and insight into Adobe security. I want to introduce you to Omkar ni Bakar, and hopefully I pronounced it right, but, um, this gentleman's too nice to correct me, I'm afraid, but I, I hope it's the right, uh, pronunciation. Omkar is the senior manager cyber threat research and intelligence at Adobe Mcar.

Welcome to Tech Drunk tv. It's great to have you on here. Yep.

It's my pleasure to be here. And you pronounced my name absolutely right. So it is, um, thank you for that.

Thank you. Thank you. I try.

So, um, Kara, yeah, I gave them your title. What, what does it, what does it mean when you, uh, you know, when we talk about threat research and intelligence? Sure.

Uh, I can definitely talk a little bit about that. Um, so I lead a team of cyber threat researchers responsible for proactively identifying and analyzing adversaries, tactics, techniques and procedures, gtps, um, and which who are also responsible for providing actionable intelligence to enhance Adobe security posture and support overall incident response efforts. So that's what the team does, but at the core, it is really about threat intelligence.

And if you look at the whole, uh, idea of threat intelligence, threat intelligence at the core is practice of gathering, analyzing, and disseminating intelligence on current and emerging threats so that you can strengthen your overall defenses. So the threat graph really focuses on gaining deep insight into understanding who your adversaries are, understanding their tactic, tactics and targeting strategies so that you can generate actionable intelligence to proactively defend against their attacks. Uh, the goal here is really to get insights into adversaries intense capabilities and opportunities so that you can inform risk-based decisions to enhance defense posture.

And when I say enhance defense posture, there are multiple ways to do this that threat intelligence really helps with. Uh, like, for example, threat intelligence is kind of an input loop into threat hunting exercise. So that based on adversaries threat intelligence team is tracking, threat hunting team can go and look for specific behaviors of that tactic, techniques and procedures into the organization's environment.

Threat intelligence also informs detections engineering, so that detections engineering can actually instrument a lot of detections for the adversaries that would be interested in your organization or would've actually targeted your organization in the past. So the overall goal of threat intelligence is to make it more actionable and timely in order to, um, improve overall defense posture in multiple ways. Makes sense, makes sense.

Um, now, like, like almost everything else, AI has the potential to change the game here, right? And not only to future tense, but is in many cases, is today. Talk to us about how, how AI is, is changing how Adobe does threat in research and intel.

Yep, absolutely. Uh, and you're absolutely right, like AI is changing like our lives every day, uh, and from work perspective, like as we think about technology, so when I think about ai, like it is so much evolving, and similarly when I think about like overall threat landscape, uh, for industry that is also always ever evolving. So these two things, uh, connecting together are really helping solve like a lot of problem space in threat intelligence world.

So by leveraging ai, uh, threat, digital teams can really automate and augment like threat analysis performed by a human threat. Intelligence teams can move from reactive threat signals triage to more strategic proactive defense. And I, I can give like a couple of examples in the way we are doing this here at Adobe.

So what we call it as AI powered threat analysis. So large language models, LLMs are able to digest and understand vast volume of unstructured data from various threat intelligence reports, block articles, research papers that are talking about specific attack campaigns. They have specific context around adversaries, what their tactic techniques and procedures look like, what their indicators of compromise are.

So LLMs can easily digest this information, identify patterns in a much, much better way with more contextual insight to extract indicators of compromise so that organizations can actually go and, um, look for those indicators across your environment. And what this really helps with is automating threat analysis for emerging threats by reducing manual bandwidth. Like if you look at the news, like there are so many threats every day that are evolving, like the landscape has been rapidly changing.

So for humans to, for the analyst or researchers to actually sit down and analyze that every threat, it's a very manual type bandwidth consuming task. So AI is really helping us to do that faster and better by reducing noise overall from threat feeds, prioritizing relevant indicators of compromise based on organization's context, which ultimately helps with faster dissemination of intel, uh, where the goal of intelligence is really to make it pioneer and also actionable. So that is one example.

Uh, the other example that I can give is threat landscape report generation. So I'm sure like, like Adobe, every organization would be interested in understanding what their threat landscape looks like. This is where AI can really help by analyzing both external threat data, uh, through multiple sources, both public, there might be some vendors providing threat intelligence data.

So AI can actually help analyze external data as well as internal organizations signals to generate more tailored threat landscape reports for executives, for security teams, uh, for various engineering teams, which can be, uh, created at regular cadence. Uh, so that all those teams are informed about evolving threats specific to their organizations or specific for their team. Um, so the benefit here is really, uh, rapid and relevant threat landscape reporting with minimal manual effort.

And the best part about this is that ai, due to the contextual understanding, um, AI is able to generate tailored threat intelligence for specific organizational needs so that it is more tailored for your use case and not generalized. I love it. So mka, I'm gonna ask you an important question important to our audience too.

We're all hearing how AI might replace people, you know, that we're calling some of these agentic AI things, digital workers, right? As you sit here and, and how Adobe is using it. Is it, is it replacing anyone on the cyber threat intelligence research and intelligence team?

Or is it augmenting and, and making you more effective? That's a really good question. So I don't believe like AI will is replacing threat intelligence analyst as of today.

As I think about AI, technology definitely helps augment human analysis and it helps us be better and faster at what we do as threat researchers compared to like replacing. So it's a little bit away from replacing. And, and the reason I see this is because, um, AI is better, but it is still not at the point where it would really replace, uh, like we still keep seeing false positive based on what AI generates because it really depends on what the quality of data that you are training your model on.

Um, it also has like a lot of contextual awareness, but it still requires human oversight for decision making in some cases because AI might miss the nuances that a seasoned security professional would catch it immediately. So it is definitely a game changer to augment and make us faster at what we do, but I don't believe it is at a point where it'll replace us right now. But it definitely augments and makes you more effective, and I think that's the important thing.

Yep, absolutely. It is definitely a game changer in that way. Excellent.

Omkar, thank you for coming on and talking to us about threat research and intelligence, which, you know, was such an important arrow in the quiver for our cyber teams today and about how you're using ai. Again, another really great example of how AI is making us more effective in our cyber jobs and making our security better. Thank you.

Awesome. Thank you for having me. Uh, it was pleasure talking with you.

I'm happy to introduce you to our next guest. His name is Ping Ssh. I hope I've got that right, but if not, please correct me.

P Poin is a, a senior application security engineer. Poin, welcome to Techstrong tv. It's great to have you on.

Hi Alan. Uh, great to be here as well. Pawan as a senior application security engineer at Adobe.

Talk to us about how you are harnessing the power of ai, and not just you, but Adobe and your team and teammates. How are you guys harnessing the power of AI to define the future of security? Right, yeah, Uh, great question.

So, uh, I'm essentially part of like the tech modeling team. So we handle like the threat modeling efforts across, uh, the board for Adobe. So, uh, one of the ways that we are exploring to leverage AI in the threat modeling space is to make sure that we can, um, essentially have like better faster feedback to product teams.

Because as a small team, scalability is one of the, our primary issues, right? So, uh, the way we're thinking about this is making sure that we can leverage AI at the early stages of like the SELC process where teams can come and provide us a little bit of information and in return we provide them with potential threats and potential mitigation strategies that they can leverage. And from there, if we see any critical issues or areas that we want to manually focus on, that's where we would like go ahead and do a manual threat model or like the traditional threat model, if I may.

So that's how we're currently thinking about leveraging AI in the, in the threat modeling space. You know, you think about it, it would seem like threat modeling is probably a, uh, a great area to harness the power, the positives that AI brings to it, that AI brings to a, you know, an issue like that. Can you dive in maybe a little deeper about why AI is a, is a great technology for threat modeling specifically?

Oh, yeah, for sure. So, um, over the last year or so, we've started leveraging like, uh, an LLM to essentially analyze like architecture diagrams, the user flow diagrams, as well as like any documentation that the team provides us. And based off the documentation itself, we, uh, would be able to like look into, uh, and understand the context, the LM would be able to understand the context and then provide back potential threats and mitigations.

And right now we're exploring the concept of using agent pipelines. So, uh, one is essentially figuring out, uh, one agent will be figuring out what the content looks like, and if there is not enough content that the, that the product team has provided, then getting back to them saying, Hey, can you give us more details about your authentication, your authorization, maybe how you see, uh, how you store your secrets, and so on and so forth. And then from there, we have another threat detection engine.

So this is where like the meat of it happens, right? So, um, this essentially takes all the context that, um, the product team has provided along with like a prompt that we've created that would then like provide us with a list of like the top end number of threats that might affect the product itself. And that is where we go into the interesting phase.

So we are currently leveraging what we call like a, a retrieval augmented generation system or a rag system for us to like provide the mitigation strategies. Before what we were doing was more so just leveraging the base or the foundational knowledge of the LLM to provide mitigation strategies. And that wasn't working as well because like, um, it would just be a little generic in terms of like the medications, uh, in, in terms of what it, uh, gave us back in terms of the mitigations.

But, um, right now the way we're doing it is, uh, hey, these are the documents that we have curated over the last few years that are very Adobe specific, that, uh, talk about like the products that we use at Adobe, the solutions that we use at Adobe, and then that is leveraged by the LLM to provide very specific or pointed, uh, medication strategies to the team. And we're hoping that this would make it more actionable for product teams to leverage and, uh, at the same time make sure that they don't see, or like, it doesn't make it too generic to a point where they don't leverage the medication strategies altogether. So that's essentially the path that we're moving towards right now.

Love it. I love it. You know, I, I'm just realizing and listening to your talk, I I've been in security a long time.

I, I of course understand everything you're saying about what you do in threat modeling, but you know, Adobe does threat, not just Adobe, but a modern cybersecurity strategy today includes threat intelligence, threat modeling. If you wouldn't mind take just a quick minute talk about how these, these things, you know, how they go together, but yet they're each their own sort of independent, uh, discipline, if you will. Oh yeah, for sure.

So, uh, threat modeling is sort of moed over the last few years, but essentially it is a very systematic way of like detecting potential issues and like providing mitigation strategies for teams very early on in the development life cycle. So you can think of it as like a shift left strategy. And, uh, the way we would approach it is essentially understanding like, uh, the components that are being part of like a particular workflow, the way they interact with each other, uh, how data flows from like the entry point all the way to the exit point.

And, uh, if there are trust boundaries, how those trust boundaries interact with each other as well. So, uh, essentially understanding the complete picture of how a product works and then figuring out where there are weak points or like potential areas where new risk or, uh, potential threats can be introduced. And once we identify those, we share that with the product team along with like a curated list of, Hey, if you do this, this potential risk can be mitigated, and so on and so forth.

So, uh, this, uh, threat modeling essentially becomes like a part of the early, uh, se early part of the development lifecycle, but we essentially try to like keep that flowing from like the ideation phase all the way to production so that we help teams like secure their workflow, uh, from from to shift left to right. And the earlier we do threat modeling, the better it is purely because it reduces the kind of double work that teams need to do to like prevent these risks from happening after they go to production itself. So, uh, that's where, uh, threat modeling as a concept comes into play and that's why it's so important in the industry right now.

Love it. This next question is the most important question you're going to get asked here, so give me a good answer. Well, on, we hear so much about AI taking people's jobs.

We hear also about AI helping people with their jobs. When it comes to using threat to using AI and threat modeling, maybe even with ag agentic ai, is it replacing security engineers or is it making you more effective in your job? Oh, great question.

And the answer is resoundingly, uh, to say that it is making us a lot more efficient. I don't think, uh, AgTech pipelines or however complex these AI systems become, it would, uh, replace our jobs altogether purely because there is that human factor that comes into threat modeling. We understand like the, the nuances between how companies interact with each other, uh, the, uh, the business impact of like a potential threat that could, uh, affect a particular product.

And there are other human aspects that cannot be like taught to an ai. But at the same time, having said that, it does make our lives a lot more efficient with the introduction of AI itself because, um, we call it the low hanging fruits, but essentially, uh, AI is able to cover our base when it comes to like, uh, the lower risk areas or like, uh, some of the gotchas that are easy to detect. And that is where it helps us, like cover our bases.

And from there, if there are any critical components, we go in and still continue to do like a manual threat model. So, um, essentially think of it this way, right? Instead of doing like, um, 20 threat models, we are able to focus on the top five highest risk threat models, and the rest of it is sort of handled by ai.

So we are able to focus our time and energy towards the, towards the critical workflows that matter for Adobe and that have like, uh, like dire consequences if there is like an issue with that workflow. So I would say that it is not replacing our job, but like making our lives a lot better and our work a lot more efficient. Got it.

I think a lot of, a lot of, uh, security engineers are breathing, breathing a sigh of relief. Ha hearing you say that. Um, one last question.

This, this AI stuff is evolving so quickly, it, it seems like every day it's like a generation ahead. How is Adobe and yourself, how are you, how are you staying ahead here? How are you continuing to kind of ride the crest of that wave?

Oh, a great question again. So, uh, what we do at, within our team is spend a lot of time doing open-ended research on like topics, essentially making sure that we do a lot of research in the areas and trying to keep up with the trends. Just yeah, open-ended research, making sure that teams reach out to us, uh, early on in the development life cycle so that we can like, learn with them as they're like experimenting with the new LMS or the new workflows so that they're doing it in a secure manner.

So yeah. I love it. Wan I wish we had more time to talk 'cause this is such an interesting area, but thank you for coming here on techstrong TV and, and talking to us about threat modeling and AI and how Adobe is harnessing AI to stay ahead here and, uh, keep us all more secure.

Thank you. Have a great day. Our next guest in this series is Trudy Gupta.

Trudy is the product security, AI and data engineer at Adobe. Trudy, welcome to Techstrong tv. It's great to have you on here.

Thank you so much, Aden, it's great to be here as well. So Trudy, let's, before we dive into topic at hand, let's talk a little bit about yourself. Give us an idea of your journey and how you came to have this role at Adobe.

Yeah. Um, yes. So I am a product security, AI and data engineer.

Uh, I've been at Adobe for four years now. Started as an application security engineer, and then my role evolved into what it is right now. So basically my background is at the intersection of cybersecurity and, uh, machine learning and ai.

So I've always been curious about how do we apply AI to solve cybersecurity challenges. And, uh, that's at the heart of what I do right now at Adobe. So I, uh, research and develop AI capabilities that can enhance product security.

And, um, in addition to my engineering role, I'm also the product lead for my team. And in that function, like in that capability, um, I am responsible for understanding developer needs, translating that into what we are building, um, communicating and collaborating with stakeholders and also setting the long-term vision for what we are building. That's a great role.

What an interesting role because in some ways shady, you are the conduit, the translator, if you will, of what business is asking for, what the developers, the non-security folks are asking for and dealing with the security team as well. And then fashioning what really is new technology when it comes to AI and agent AI to kinda meet, meet those needs, what are, what an interesting intersection to be at at this moment in time. Absolutely.

Let's talk a little bit about kind of things you're doing. And I, when, I mean you, I don't mean just you personally, I mean your team, things, you, you guys are building, deploying, using, along these lines that are helping to define how, how AI is being utilized in security by Adobe. Yeah, absolutely.

So we, my team are basically building a suite of AI capabilities that are designed to reduce product security toil. Um, and the way we want to achieve this is by making security guidance, security knowledge, security expertise more available, more accessible to product teams whenever and wherever they need it. Um, and those services that we are building, we are, uh, we are making them available as, um, API endpoints.

Basically they should, anybody at Adobe should be able to use them in a self-serve manner, and you can integrate our services seamlessly into existing developer workflows. So think, uh, messaging platforms, ticketing platform IDs, web widgets, et cetera, right? So be where developers are, uh, provide security guidance as in when they need it.

And for this, we are using ai. Um, so fundamentally we think of all the stuff that we are building, uh, we kind of categorize it into two large buckets, I would say. The first is, um, AI security assistance.

Um, you can also call it ask security. So anybody at Adobe can come to the assistant, ask their security question and get an answer. And now we are doing this by leveraging Adobe's internal policies, uh, standards developer product and platform documentations so that, you know, when a developer is coming with a question, the AI assistant can answer that question in a way that is as close as possible to how a human security expert at Adobe would answer that question.

So that's one. And then the second pillar is, uh, remediation recommendations. So, uh, we want to equip engineering teams with the right resources that they need to remediate to fix vulnerabilities.

And again, for that we are using Adobe specific information, Adobe specific product specific best practice guidance, trying to understand the context in which the vulnerability is, and then put all of that together to provide the guidance that can aid the developers, that can enable them to go fix the vulnerability. So these are kind of like the broad two categories, uh, of capabilities that we are building. So in, in hearing you describe them, they sound to me More Almost chatbot type of things where an engineer could say, Hey, how do I, what's this vulnerability?

What's the best way to patch it or remediate it? I know patch is a mm-hmm, mm-hmm. An old word.

And, you know, these are, it's great chatbot type of, uh, opportunity or description. So Go ahead. Yeah, No, no, go.

I think you know where I'm going. Go ahead. So, uh, chat bot is one way to get this guidance wherein yes, like you have a, you have a chat bot, the developer comes to the chat, bott asks a question and gets the guidance for the question, uh, be it generic guidance, or how do I do X, y, z, or how do I fix a bug, right?

Um, one of the other ways that we are doing this also is when we find, uh, security bugs, uh, we have a process for ticketing them. You've spoken, uh, with, uh, like Alex on the bug bounty side. So we, we create tickets and then we assign those tickets to the developers.

So another way that we are integrating in that existing workflow is, um, call our APIs that understand what the bug is and then provides remediation guidance in the ticket itself. So when the developer is assigned the security ticket, they don't just have, uh, a description of what the vulnerability is, but they also get a guidance as to how they can go about fixing the vulnerability. So, so that is how we are doing it today.

We also, of course, have the chatbot functionality. Another aspect is like right now, um, AI assisted IDs as the new thing, right? Like it's gaining a lot of popularity among developers.

So that's, that's another outlet. So as developers are writing code, how do we detect vulnerabilities? And instead of having the AI agent in the IDE provide like a generic guidance, how do we get that tailored to, uh, what Adobe recommends is the way to go about it?

So that's another way to kind of, um, address this and make this information available to developers. Let me ask you a big question. Sure.

When do you think we'll see agents that actually go out and just do this and kinda tell the human after the fact, if you will, or do a report, but they're actually doing the remediation in an autonomous type of, uh, setting like that? Yeah, that is a tough question, right? And I think, uh, it's, it's an ambitious goal as well, right?

Of course, that would make all of our lives so much easier. But it's also difficult goal to achieve with state of the art AI models and AI agents. The thing is, when you're talking about a single code file or like a small enough code repository, state-of-the-art models do okay-ish, they, they can be hits and misses.

But the thing is, like at Adobe, each product team is so different. Our code base are vast. So realistically I would say we are not there yet, uh, wherein we can have AI agents figure out what the fix is and go do it, uh, at the PR level themselves.

And I would say we don't necessarily want that. Also, um, in my team, since we've been developing these AI capabilities for what, almost one and a half to two years now, like we have learned along the way that human feedback, human in the loop is absolutely critical in these workflows. Um, like we don't think that the answer is to give the AI agents a hundred percent agency, uh, but there has to be a human oversight involved, right?

Like these agents are, uh, very useful when it comes to doing the manual laborious, tedious tasks, right? Like going through documentations, um, like finding the right resources, those kinds of things. But at the end of the day, uh, we do need, like, like our recommendation also is that there has to be human oversight involved.

Go take a look at what the AI agent has produced, what the AI agent has generated, right? Does it meet, meet your requirements? Does it meet the, the, your requirements, what you've asked for, what, what the right way to do things is, and then you kind of, for the lack of a better term, approve those changes.

So I would say that's, that is more realistic than, uh, like let agents go do whatever they want to. Uh, I don't think, um, even with the state of the art, we are not there yet. Yeah.

Trudi, I want to thank you for coming on and talking with us today. As I said, the time goes quick. Keep up the great work though.

And this is, as I said, an exciting place to be in this moment in time. So good luck to you. Absolutely.

Trudy, Dr. Gupta, product security, AI and data engineer at Adobe. I hope you've enjoyed this session of four or five actually segments of different areas of the Adobe security team using ai, leveraging AI to make their software more secure and makes your work more secure.

I hope you can take these lessons and apply them in your own organization as well. Thank you.