The Dual Role of AI in Cybersecurity: Shield or Weapon?

Hey everyone. Welcome back here to Techstrong tv. So I, I want to introduce you all to Guy or Ozzy.

Uh, guy is someone who has deep expertise in the security cyberspace, as we call it now. I still call it security, but, uh, in the cyberspace guy is also the co-founder and CEO of a, of a cybersecurity startup that's in stealth right now. So we won't necessarily be talking about that company.

We're gonna talk more with Guy and around, uh, a well, what else do we talk about? AI and adversaries in ai, AI and security. Hey guy, welcome to Techstrong tv.

It's nice to meet you and it's nice to have you on here. Thank you for having me. Appreciate It.

Pleasure. So, guy, why don't we start off maybe kinda giving our audience a sense of who you are, where you've been, what you do, what you've done, right. Establishing that.

Yeah. So if you wouldn't mind share with us. Sure.

Um, first of all, as you said, I'm Guy Arazi. I was born and raised in Israel, started off security very early on in my life, even before I had something that's called career. Um, I guess I was very interested, uh, in security and the way you can bypass security boundaries, uh, of software.

So I was doing some cybersecurity, let's say, stuff in the intel, like in the intelligence for the intelligence in the Army. Um, and basically my first official role was a ciso. I was kind of high level, uh, doing audits and running penetration test reports, but then I wanted to go even more hands-on, uh, because I wanted to go back and, and be on the offensive side.

Uh, kind of like in between the blue team and the red team. Mm-hmm. So I joined Banca Paul.

I was leading the application security deal. I was also a few months in doing some research, and then I spent the next seven years in Microsoft. Started off as a security researcher for Microsoft Defender, EDL, where it was basically, uh, founded the ransomware detection vertical.

Um, when I go to Microsoft, they only detected the issues on a single machine, and I had some crazy vision on how to connect the machines, uh, in, in an enterprise. So you can detect network infections and stop ransomware from compromising entire network. And then, uh, I was a vulnerability researcher for Azure.

And in my last, uh, year at Microsoft, right before I left my to do the startup, uh, was, uh, uh, at M-S-R-C-M, SRC is basically the Microsoft Response Center, uh, was in a security research team called mitigations and Vulnerabilities. We basically got like all the reports from, uh, externally search, uh, externally search sales, like all the vulnerability disclosure, ty program, anything that basically comes to Microsoft and get out of Microsoft, uh, in, in terms of security. Very interesting.

A lot of issues, but good issues as well. And you have to come up with brilliant ideas on how to mitigate them. And I also spent two wheel in Palo Alto networks in between.

Really? So you went Microsoft, Palo Alto and then back to Microsoft? Yeah.

Interesting, interesting. Of course, Palo Alto just bought last week announced, uh, Chronosphere Yeah. With three and a half billion dollars for, uh, observability.

Yeah. But Guy, you know, you know, there's this old, they call it an Irish proverb, and you live in interesting times. We certainly are living in, in interesting times.

Not to say that security wasn't always an interesting place, let's say, right? But with the advent of ai, the, the mission, well, attack surfaces have expanded. The mission has changed in many ways.

You know what they say, God gives and takes away. God gives one thing and takes away another with ai, it, it could truly be a gift to security in, in helping us to do security better, but it's also a gift to our adversaries, right? Who are also not stupid and are very well organized and well financed.

And they understand. And so, you know, at the, it, it's both a weapon and a shield, if you will. It could be used as, as a, as a offensive and defensive.

Um, and, and the thing is, is it's fairly new, right? When all those years ago when you were in, I, I'm gonna assume it was 8,200 or, you know, within the IDF, they weren't really, this wasn't really something you guys were using back then, or, and if you were, don't say you were, but, um, you know, it, it's in in many ways changed the game. It did.

Talk to us how it's changed the game and what kinda what's you, what, when you look at this landscape now, what do you see and what do you think? Well, like companies produce code in an insane way right now, right? It gets a more business.

Um, they can hire less people and they can just ship features and products. It's, it's very appealing. Um, but on the other hand, even even before AI was introduced, product security teams and application security teams couldn't even handle the, the, the burden, right?

They had like yeah, had backlog, a huge backlog of issues that they had to fix and they were trying to chase off their developers to fix it. And nothing was really moving the needle. When AI was uh, introduced, then there were many startups and many companies that just used AI to deal with that backlog.

But developers still don't want to fix those issues because in most cases there are either false positive or it's might, it might take them too long to fix it, and it's not part of their KPI, like, no one measures them on like, how well are you doing security in our company, right? They measure them by how quick can you ship it and if the feature is actually working well. And I think that probably the biggest issue is when, when ai uh, when AI is being leveraged all across big enterprises, it copied different antipas.

So there is some code that is being used. Then agents may assume that this code is already valid and it's uh, uh, like it can reuse it. And then it's, you reuse it in 50, a hundred different places and basically create something that might be a more of like a systematic issue without anyone understanding.

Now the product security team or the application security team are the same size, right? They never grow and they never grow more than, uh, the developers. And on the other hand, they're still using the same traditional tools that they had in the last decade.

Maybe they are, some of them are branded with ai, but they have the same approach, the same architecture. And in, in my opinion, it's a double edged sword because no one know right now what are the actual vulnerabilities that are laying in their software. And, and, and, and that's probably the biggest danger.

They're trying to kind of walk in a land of minds without realizing where should they step. Now it's either it's a false positive or they're either getting compromised, but they need to decide like, what is the next thing, next thing I need to tackle? And in many cases, our biggest advantage as human is to use humans, uh, to find human issues or agent issues.

So you can see things like, especially in Microsoft, it was, um, it was something that went really well. We use external researchers to help us validate features and products that are already in production in case we, we miss something in the threat modeling or the scanner maybe didn't pick up, uh, a, a specific issue. And then we kind of under trying to understand if it's part of a biggest bigger issue, if it's a systematic issue.

Because AI cannot say if an AI is wrong, right? You need some human to label that specific issue and say, this is wrong. This is right.

At the end of the day, it's like, it's statistics, right? This is how AI works. If you wouldn't tell him, uh, or you wouldn't guide it in a way that fits you.

And again, enterprise are different. Everyone mitigate different issues in a different way. It's gonna be very, very hard to uh, overcome these issues.

And I think this is probably the biggest way that, uh, I see is the double-edged sword because we're still using the technology, but we have no idea how to defend against it. And adversaries are, you know, they're just out there using the same thing. But, you know, guy, I, I've been around a long time in this space and, and this and this, and it's not just insecurity.

I think this is very common. When you're dealing with an adversarial kind of thing, you, you tend to over, uh, you you, you give them more credit than they do. You know what I mean?

You, you think, boy, everything I do where the, we're the am we're the apple dumpling gang, we can't shoot straight and the other guys are marksman, right? They're fantastic shots. Do you really think, I mean, look, AppSec has been always playing catch up for a long time.

And, and, and I wanna say it's almost not their fault, but it is, right? Uh, we don't put the budget and resources necessary, but it always seems we're playing catch up there. Do you really think though that the adversaries are this sharp on ai but they're not going through sort of the same growing pains learning cycles that we are?

They do, but their KPI is pretty straightforward. Uh, it's either the compromise or they don't. Now they might compromise, um, a year ago, and you might know in five years from now, if an attack is executed properly, you would never know it existed maybe in, in the next few years or in the long term, like in the long future.

Got it. And that is part of it too, right? That these guys play the long game where, I mean, quite frankly, look, most budgets for AppSec enterprise companies are, you know, quarter to quarter.

You know, and if you didn't get attacked this quarter, that means that nothing happened this quarter, would it very well might have something happened, but you won't see it till next year. So it's a different, it's almost like you're playing by different rules, by different time parameters, if you will. Um, so, but I guess this begs the question though, guy, of what's a poor company to do?

What's a poor enterprise? What's the security team to do? What can we, you know, it's, it reminds me of the old story about you take like a, a, a glide person and put them in a round room and tell 'em to find the corners.

You know what I mean? It's not fair. So what, what can we do here as we kind of fumble in the dark to prevent these kinds of things from taking place Just to make sure that we're aligning our prioritization?

Uh, the most volatile and dangerous, uh, indicator that we have in the product security realm is probably there is some idea, some insight, some report that claims that they can compromise your company. Okay? Now researchers, they like trophies.

I also like trophies. What we all do now, sometimes we might share it with a friend, we might share it with the social media and adversaries are just listening for that. Now, you might fix this specific issue, uh, from that specific feature, but it, if it exists in other features, they take this specific issue and try to expand it into attacking all your features and other products with the same technique.

Now, you might think that you found everything and, and you might not. And that's the race. Like how long, how fast can you detect it?

And, and especially when it's already like a public insight or, or something that is already out there, you need to make sure that you're prioritizing this insight out of, because that's exactly what adversaries see, right? They're not assuming that they might breach you through this technique. They know that someone managed to get into your systems using some approach.

And if this approach might cost them, I dunno, $10 to attack all your infrastructure right now, it's probably gonna be more what, more than just guessing. Maybe they're using this tech stack, maybe they're using this specific library in this specific way. Um, they don't need to assume they know something real happened and then they take that, by the way, it's same with ai.

They take this specific insight and they try to use, like, they try to leverage it as much as possible. Absolutely. Absolutely.

Um, so again, what, what can we do though? Like, uh, what steps do you think we could take? Yeah, anticipating this.

So I, I think that, um, any insights that basically, uh, compromise your systems, something like any, anything like higher critical that has a proof. So someone already shown you either from your vulnerability disclosure, your pen test reports, even if like, I dunno, like an internal engineer or developer found something that could be significant, you need to prioritize this over adult, especially when it's like a written insight. Take this specific report and see if you can find this issue, um, as a bigger, uh, systematic issue and try to carry re remediation for that specific thing.

Then probably the next thing would make sure that you are not repeating on the same issues, right? Because you might, you might remediate it, but the organization is still developing in the same way. Maybe one team is aware of it, but the other one isn't.

Now it's like a whack-a-mole game because there is no way right now to automate this unless the product security teams can be like one-to-one to every feature group or every department development. And I think that it would just be try to use AI as, as, as, as much as possible to make sure that these things are not happening over and over. It could be implementing local rules in your cursor.

It could be creating some designated prompts for co-pilot to pull, like to create the, uh, uh, pull request reviews to your changes that you're about to push the production there. There are many ways and, and it really depends on what is the specific issue, but I guess this is where I would start from. I love it.

Yeah, I agree with you. Let me ask you philosophically Do it. You know, I always say we're still kind of, almost at the beginning of the beginning when it comes to using AI and how we're going to integrate it not just in security, but in, in our daily lives, right?

And, you know, in our jobs across the board, do you think this is a problem that gets worse before it gets better? So in other words, is there gonna be a gap between solutions versus, unfortunately the, the adversaries, you know, doing these bad things and like we talked about before, it may be years before we realize these time bombs have been planted already. Interesting.

Yeah, I think there'll always be gap. Like as long as the technology enables you to do something, it goes either way. It has to go either way.

Uh, the the strange and, and the cool fact about adversaries that they're always, instead, they don't need to expose anything. No one knows like what they're basically doing. Some researchers and some analysts would assume what they're doing right now, but they can do many things and you never know what they're gonna do next.

So they're Literally assuming and you know what happens. Yeah. When you assume, right?

That's, it's, it's a guess. An educated guess maybe, but a guess nevertheless. Yeah.

And, and maybe there is another thing that I would add to your previous question around remediation is that there are a lot of companies that don't think defense in depth. So they would only fix something that is publicly available and only, like, you can only exploit it from the outside, but in some cases there's common practices that you have to apply even internally because you might have like a malicious user or maybe you could have, uh, another vulnerability that that might expose you to the internal networks and then you can use this type of vulnerability to access something. You would assume that it's not public, right?

But if this, I dunno, resource opens up all your financials, uh, and, and opens a, a gate that you don't think that there is open only because you didn't implement different mitigations around it, it's more than lacking, right? And, and by the way, these things are real, like SSFs and um, are, are extremely common. I think that they even went to the first in oas like in 2025, they went to the top, like the highly ranked attack, a part of broken access control.

So it's not something that, you know, I assume like we already see that that's what they're using in order to bypass boundaries from the outside. Like you might say, yeah, this is internal, like this is my internal, that nothing, nothing is going to reach hills. So why do I need to add those litigations or add this defense in depth?

And then you are getting a very straight and simple vulnerability that enables them to amplify their attack by a thousand x and both in impact and, and in in speed. Understood. Agreed guy, we're, we're about outta time.

No pressure, but as I said in the beginning, you are co-founder CEO to stealth cybersecurity startup timeframe on when we might find out more. Probably, probably very soon. You'll be prefer.

Yeah, you'll be the first person that I'll keep updated. Don't worry, I'm gonna hold you to that. Okay man, Don't worry.

Alright. Hey guy, thanks for coming here on Techstrong TV and talking to us about, you know, it's almost like, I call it like a shadow war going on right now, right? We're not quite sure, you know, what capabilities or what and who is who, but nevertheless, the, the, the, the sparring, the, the dance if you will, has started and, uh, it's going to be something that we, we need to watch closer and closer.

So thanks for coming on and talking to us. Good luck. And as I, you, you said it as soon as you launch, you gotta come back on.

Will Do. Thank you. I appreciate it.

All righty. Razzi, co-founder, CEO of a, a, a stealth security startup. We'll be talking about soon, but really here talking just more as an expert around the challenge of AI and security and apps.

Second, so forth. You're watching Text on Gang. We're gonna take a break.

We'll be back in a minute.