Techstrong TV June 5, 2025

Hey, everybody. Do you have AI Coding Envy? You're watching Textron Game.

Hey everybody, and welcome back to the Techron Gang. We have our usual lineup of folks talking about three of the most compelling topics of the day. Let me start with our friends from Futurum.

Mitch Ashley is back. It's been a while. It's been a minute since you've been on the show, Mitch, how you doing?

It's been a minute. You know, I, I tackled that guy running outta the seven 11, you know, stealing some stuff and I injured my shoulder. No, I didn't really, it's just, you know, my shoulder and some shoulder surgery.

Nobody believes that story when I tell it anyway, so I'm gonna have to stop telling it, but doing well, doing here. Well, here in Colorado. So are you going in for Tommy John's surgery?

And, you know, when will you be back on the mound? Well, you know, it's supposed to be out there throwing some balls next week, so we'll see. We'll see what my recovery looks like.

I wouldn't count on me up on the mound anytime soon though. Uh, warming up. Also, guy Courier from Futurum joins us once again, guys still in Austin, I believe.

Is this the longest you've been in Austin for a continuous stretch now? It almost feels like it's been like 10 days. Uh, it's, I think it's been over 10 days.

Um, I was actually slated to go, uh, uh, go to a, uh, a vendor conference, uh, this week, and thankfully I was able to cancel that. Um, so yeah, it's, uh, it's, it's been maybe two weeks since I had to go anywhere. And I looked at my June schedule and it looked pretty good, so I'm pretty happy about that.

All right, guy courier breaking vendor hearts once again. So who knows, man. All right.

Usually I break their hearts by working for them, but anyway, There you have it. And also still north of the border. Chris Blas, how you doing?

I'm loving life, Mike. How are you? I'm well, no issues.

I'm also down here in Boca Raton in the studio for one more day. I'll be heading back to New York after this, so tomorrow when you see me, I'll be back at my usual New York environments. But let's start jumping into the topics of the day.

Mitch Ashley, I swear a year ago I was amazed and aw by all this AI coding stuff. Now I wake up every morning and there's another tool, it's just like one right after the other. And I'm trying to figure out if these new tools, these, uh, players and startups are gonna take over this whole app dev DevOps conversation, or will the incumbents win this argument and win the day?

And you have a report that kind of talks about the level of investments that folks are starting to make in agen AI already as far as ab dev is concerned. Anyway, um, walk us through what's going on here, because, um, I also have a third possibility, but let's just go through the report a little bit. Okay, great.

Yeah, no, it's, it's an interesting, actually a fascinating space to cover because I can't write something and have it be current by the time I publish it. It, there's three new announcements that I don't, I should have talked about if I would've waited. But then again, there'd be three more after that.

So it, it, it's, it's pretty fascinating. I mean, you have some very new players, you know, the folks like, um, the code now cursor, uh, products, uh, the windsurf that's gonna be acquired by Open ai, but you have, you know, existing players, Microsoft GitHub of course, combination of that. So it, it's, and then you have no code, low code players.

There's a lot of things happening in this market, but as I looked at it, what I'm telling people right now, telling vendors, if you aren't engaged in figuring out more than just what your AI strategy is, but putting to work and figuring out how you can make it useful, beneficial, maybe improve the work that's being done by whatever your constituent, uh, personas are, whether they're testers or software engineering people, or people doing software security, operations, platform engineer, you name it. Now's the time to engage. Because what I see is the, the level of engagement, especially on the development end where things obviously start, uh, in terms of creating software, is pretty phenomenal.

It, the, the, the iteration cycle from vendors is very short. Kinda like DevOps cycles, you know, they shorten their product cycles so much and they're also doing essentially alpha betas, but they're doing, even earlier they call 'em public previews or research previews. And, you know, even at Microsoft Build a couple weeks ago, you know, they were very upfront and say, we've got, we just GAed this, but we've got these other things that are out there now in public preview.

We wanna hear what you like, we wanna hear what you don't like, tell us. 'cause we'll fix it. There's a lot of in, in-field learning that's happening both by practitioners and vendors at once.

So, number one, get engaged and, and you have to learn by doing this is not, let's lay out a strategy and just kind of, uh, carve the course, you know, keep the situation normal and we'll add this into our product in the next release. Six months from now, there may not be an opportunity for you. I'm not saying panic, but I don't think passively waiting from the vendor standpoint.

Now, the practitioners, not everybody's jumping off the deep end in vibe coding, right? It, there are definitely people on the front end on the leading edge that are leveraging these tools, but there's a lot of people that are benefiting from even just within BS code and code completion and doing some early code generation kind of capabilities. But as more things get automated, especially with agents in the development process and, and expanding down the SDLC, that's when I think we're gonna see the big improvements in productivity.

I'm kind of caught in a couple of different thoughts on this whole thing. So in my mind, every coding tool is gonna have ai, I mean, at some point it's just standard operating procedure becomes a, a core capability. If you don't have it, probably won't exist.

The part I'm trying to figure out is, so will my existing DevOps platforms get these AI agents and then that will become the mechanism that I use to manage all that. Or will there be some sort of like higher level of abstraction of AI agents that leverage across all these different platforms? And that becomes the thing that I'm gonna standardize on.

And I don't know, maybe that thing talks to various AI agents that are made available by the CICD vendor or whoever happens to have a particular agent, but trying to figure out where is that orchestration of the DevOps workflow gonna be? Do you have any thoughts? Yeah, yeah, definitely.

It, it's, you know, that's a big challenging problem to solve, especially across vendor, how you orchestrate agents and how you share data and information. Even with MCP is a, as an open standard that's evolved. Definitely what's happening is every vendor is adding AI agents automation capabilities to their own product, which I think makes sense right now.

It's a little tough for one person to step in and say, we're gonna orchestrate all those things. I think that will happen at some point. But the thing that's also not happening is you don't see the big players saying, if you're gonna be in our ecosystem, say a Microsoft ecosystem or a Google or AWS, you have to use all our stuff, right?

We're gonna, we're, we'll, we'll integrate with other people, but not, not with the same fidelity as our own. No, they're pretty much leaving it very open knowing that they've gotta work in a cross vendor, cross technology world. Whether it's the models that you're using to generate code, the models that are now coming out for automation around what they're calling agentic dev DevOps, you'll see that agentic tied to everything here in product names, um, as well as just AI capabilities with their own tools.

I think the big difference is, you know, the chat bot and the natural language querying stuff and giving some basic instruction to, is kinda the entry level of AI today. We'll see interfaces start to change as you're managing more work that bots are doing, rather than you taking their output and putting it to work yourself. You know, Mitch, your call to vendors to, you know, it's kind of like adopt or die, but maybe even ratchet it up a little bit.

Um, you, you say it in that silky voice of yours, but it really is a, uh, quite a, um, a call to arms. Um, but the other half of it, and you've written about this, you just didn't mention in a moment ago, the other part of it is, you know, don't do it without forethought understanding of how, how, how AI helps and potentially harms. And most importantly, with thoughtful expert human supervision of the whole thing.

That's a key corollary to the, that's, and it's getting Chris all agitated, uh, for those listening. He is been nodding vigorously as I say that. Um, so, you know, that's the, what a, a really interesting twist here is the, the vendors are practitioners as well.

So you, you talked about practitioners, you're talking about, you know, what I would think of as enterprise practitioners, um, although they go, you know, down to like partners and, and even, you know, medium sized businesses or, or the, the, the, uh, service organizations that do development for them, um, that would be pure practitioner, but the vendors are practitioners themselves. There's, there's a lot of, yeah, there's a lot. This, this, this, this has a huge landing zone, not landing zone, what damaged circle or whatever you wanna call It.

Blast radius. Yes. See, blast Radius.

Radius. Thank you. Let's let Chris jump in.

Good. Go ahead. I, I wanna respond to what you're saying, guy, but I wanna hear what Chris is thinking too.

Well, thank you, Mitch, because as guy said, you do in fact to have a silky voice. And I think the thing that, my comment is, I can hear in all of you, you know, there's this confusion, this, you know, this narrative space where we're talking about how we're using AI to develop tools, and with three of the world's leading experts, there's a, how do we actually get there, right? And I think you all touched on points of it, you know, that this isn't just a tooling race, it's a trust war.

And the winners aren't those who ship the most ai. They're the ones who make it safe, visible, and native to the developer's psyche. Right?

Now, these tools will do wonderful things, but if you're not comfortable with doing them, it doesn't really matter. Yeah. I'm actually preparing a piece right now, um, based on, uh, what I've observed of the, the, the, uh, data analytics vendor click over the last year or so.

They created a trust council. I, I'm not, you know, gonna, you know, flog their, their particular strategy. But it was a nice jumping off point for exactly what you're talking about, Chris, uh, which is this visibility side, this transparency side of things, um, critically important.

So Mitch, how long does it take? How long does it take a DevOps team to bring in a new tool and adjust their workflows? 'cause it seems to me it takes a good year to kind of wrap your head around that.

It's not like I go out and buy a tool and just slam it in. At least I don't think so. So, um, what's the curve of actual usage in DevOps workflows, especially with a lot of tools that are quote unquote available in preview?

Well, uh, the way I would think of the progression, Mike, is individual tools. Things that aid you in your IDE that you use as a developer or whatever tool is a, as a tester. So AI is introduced within the tools that you use.

And now we see, um, agents and automations, some agent capabilities that automate more processes than just generating code, generating code's. Actually a small part of developing software, believe it or not, uh, that's probably, I don't know, less than 25%, maybe, maybe even 10 or 15% of the work. So what's happening now is some of those individual tasks are being automated.

The next step is automating workflows across different teams. Um, PL cloud, cloud, for example, uh, and a DevOps automation platform just came up with their, their AI announcement. So you're starting to see more DevOps products introducing it, not just development tool products.

And I think the third step is really true. Pipelines workflows across an entire SS SDLC process. Everything from security to generating code, to testing to scaling and performance, and all those things that go into it, that, that's sort of the nirvana where I think we wanna reach.

We're, we're far, far from that, maybe far six months, no, it's not gonna be six months, but we're, we're not there yet. We're still at the individual tool kind of bumping into the doing automation for individuals and starting to do automation for teams. So to your question, it's really a personal endeavor.

Not to say you don't get support from your management or your company or a team for doing it, but it's, it's a learning curve. It's like, oh, there's this new thing called relational database. How does that work?

Let's figure out how we should use that. As opposed to the other structures of databases we use, oh, there's no code. Now, how do we use that?

It's kind of that process, that kind of adoption curve, but for all of how you create software. So whether you lean into it and do vibe coding, or you kind of just gradually take it on a little bit more and more. Yeah.

And I would say that, uh, that, that, you know, at least from the practitioner slash enterprise side, you know, this is, we're gonna see 80 to 90%, maybe you already had 80%, and I don't remember off from, from the research you've done, um, using these, using ai, but if you think about the application estate, it might only be 5% of it. I mean, this is a whole new, we need a new word for it. It was the digital transformation refactor or reto or whatever.

Um, that's been well underway. And we might have 20% of applications now that are cloud native or cloud native ish in a typical way. And that's a made up number.

But it's, it's, it's the really the minority. So the part of this that, uh, leaves me scratching my head is, so there's a bunch of these startups and historically, you know, venture capitalist port money and startups, and if they made it to an IPO, that was the exception, generally speaking, they got acquired and rolled up and put into some other incumbent vendor. However, when I talk to the incumbent vendors in this space, they're all pretty far along on their own development efforts.

And I have to wonder if a lot of these startups are gonna have the wherewithal to make it long term or even get acquired because the incumbents are moving faster in the age of AI than they have historically. And I think they're not suffering as much of that innovative dilemma. But guy, what's your take?

Well, I'm glad you turned to me because I wanna compliment Mitch on another thing before I attack him. I'll attack him in a minute. Um, the, the listen, um, you have provided, um, a really helpful framework for AI adoption and coding, which is, uh, or in applications, really, which is the AI enhanced app, the, uh, AI driven app and the AI native app.

And when we are talking about development platforms, there are some that are being enhanced. There are some that are agentic relatively new, that's AI driven. That's, that would be maybe the vibe coding concept.

Correct me if I'm wrong. And then lastly, this, uh, this AI native. Um, so Mike, to answer your question, um, to what degree do these incumbents, um, intend to essentially recode all the way down to to, to the silicon actually, um, in order to create something that's AI native, the AI enhanced stuff has, has serious limitations.

They're partially security related, but mostly have to do with scale and volume of data. They run on infrastructure that's not necessarily built, or let alone the size, just the, the data usage patterns that come with ai. Um, so they tend to incorporate services a lot of the times.

These are cloud-based services, which has their, have their own sources of latency or unavailability and all that other sort of thing. Um, my sense is that Microsoft is, is trying to do this with GitHub co copilot, that they're essentially re re both recoding and refactoring that entire platform to turn it into something that's AI native. But my point, Mike, is that not everybody is Microsoft.

There's lots of players here. Maybe Oracle can do it, Microsoft is doing. Um, but otherwise, um, there actually is a fair amount of, of space for like the tab nines of the world or whatever, these more recent, um, AI native code platform companies to follow the exact path you are like, like you laid out sort of classic path.

Um, and also in general in this, you know, hyper capitalistic environment that we are in. Um, which by the way is not an insult. I support this.

Um, we have a great deal of difficulty predicting such things as a change in these models because there are so many, you know, there's plenty of VCs out there, you know, willing to invest. And still in these sort of platforms, you put AI on it, they're willing to invest. So I, I think I see your point, but my guess is that we don't know what we don't know there, and there's gonna be plenty of the same model going on.

Right. Mitch, last word, last Mitch, last word on this subject. Uh, you know, I think there is plenty of room for acquisitions, even though the big guys, well, you know, everybody is starting to address it at different paces.

Um, I think part of that is, you know, fomo, fear being left behind also. But there, there's, so, I mean, take open ai, right? Acquiring windsurf, right?

They had their own Kodaks that they created for developing software, but recognize that, you know, for them to go and, and build a new kind of vibe coding IDE as opposed to a traditional IDE, uh, or AI native IDE, which is kinda where, where the ides are headed. Um, that would be a big lift. So when just by somebody, just bring them into the fold.

Microsoft has required people along the way. So I don't, I don't know that there's any less opportunity. I, I think this normal thing will happen, Mike, of early people into the market.

People are in the top three, you know, as Alan and, and Lex to quote Brad Feld often. Um, but it's the people that come much later that is, is really questionable. Whether what the opportunity to get acquired or go public then is, you know, the, the third generation of startups that kind of solving the same problem, but unique twist on it in some little weight.

Maybe it's interesting. Maybe it's not. All right, ladies and gentlemen, place your bets.

'cause we're about to find out how well this is gonna play out. We'll be back in a minute. Hey folks, we're moving on to the next block in our little trio, and we're talking about a report from our friends over the Futurum group that kind of shows what people are thinking about.

A the level of spending of on cybersecurity is roughly on average, 11% of the IT budget. I think that's pretty standard. I hope that's standard.

Um, but it also finds that about half of the folks are trying to some degree to reduce the number of vendors they have a quarter or however our adding vendors in the s seem to be just standing pat. Chris, we've been talking a lot about the platformization of cybersecurity and this battle between best of breed tools and the centralized platforms and the arguments that go on back and forth in this thing. It would appear that, um, folks kind of at least prefer some centralization, but it doesn't look to me like it was a massive wave.

But what's your take on what's going on here? Or is this just an argument we have every three or four years? Uh, fully start with that one.

I think, yes, this is an argument we have every three or four years. Yeah, let me refer back to what I said in the last segment. You know, this isn't a tooling race, it's a trust race.

And people seek, you know, we like centralized platforms when it can say little confusing because we only turned to one spot. Um, but particularly in this space, as we go on the go, continue on the path of tying, weaving, cybersecurity and and AI together, you know, the, the trust of the human part of it has to be the point. You know, can you, can any of these vendors make the tools?

Yes. In fact, with a $20 a month Chad, TPT license, if you train your engine properly, you know, to to the last segment, you might be able to make the tools. So early movers platform, you know, uh, uh, range anxiety.

Sure. Um, but at the end of the day, the, the vendors or the constellation of providers that will hold the ground are the ones who understand, you know, to actually implement the trust. Mitch, what's your take on the trust factor?

Because to me, part of that trust has been, well, there isn't a lot of trust in these platforms. 'cause everybody complains about the number of false positives and the volume of alerts that they get. So, you know, when I talk to a lot of folks, they have like two of everything just to double check one or the other and see which one they believe in.

It's sort of like the money python, holy grail search for the holy grail of single point of truth or single glass of pain, as I like to say. You know, seeking that sort of nirvana of having one thing, that one ring that rules 'em all that will solve, make it easier. And, and what it's really is, is it's a reflection of the complexity of how difficult it is to bring all those different data sources together.

Um, I was mentioning in the last segment about the development tools of the vendors being much more open to a, a broader ecosystem than just trying to own the customer all on their own platform and their own tools. Even saw this, uh, similar kind of announcement at R-S-A-A-C with, uh, Splunk talking about, you know, we realized we can't put all the, all the data in in our product as much as we, this is my words, like to do that and charge you for it. Um, where they're adding capabilities to go access data, where it is and how it's located.

You can see that in MCP servers and software development. So I think it's all about trying to, first stage is just getting the information you need to understand to triage what's happening, understanding what's the problem is and how to, how to start addressing it. If, if AI is gonna be a part of this role, I think it's, it's gotta take us out of the giving us better and, uh, more, more accurate information to actually helping us do it, do the work.

And, uh, that's I think probably more than the benefit we wanna seek next than just trying to have one thing that's gonna tell us all the, the right answers about everything. I kind of felt like the, um, the, the, the research on both revealed and hid what's going or re revealed the hidden nature of what's going on. That there is investment spending, let's say spending in time.

Uh, people's time is ultimately money. Um, that's that whole, you know, DevSecOps side of things. Take, take, take the software bill of materials.

Um, I, I, I, I applaud, um, the, you know, return of the SBO m and uh, the ability right now of AI to help build SBOs, um, human validated, but to help build them, that's a real step forward. But would you call that a cyber, uh, investment? Not normally.

Yeah. I think part of that is, yeah, or compliance, maybe investment. I don't know.

So it kind of goes both ways. But Chris, I want to get at something. We had, um, Keith Townsend on the show yesterday talking about cybersecurity as it related to a tech field day event.

And one of the things that was posited was, is the future of security. Maybe this whole conversation might be rendered moot because AI is gonna create this kind of chat interface in front of all these cybersecurity engines. So I'm not really gonna care about the centralized platform as much as I'm just gonna have kind of a single interface that plugs and plays with different engines as I see fit.

It may be a little over simplified to put it up that way, but I think that's kind of effectively, right. You know, what you said is that, you know, we're not gonna have to dig around into all the details anymore, so much as have this single, you know, AI interface that's gonna tell us how it all works. Um, I think on an individual level, as you're a stakeholder, a a technologist, an engineer, a decision maker, that may kind of be effectively true, but we're still early in figuring this out, right?

And I think we look at the size and scope of the infrastructures that we're responsible for, whether it's a single server and you have all, all day to do it, you know, we're physically past a point where a human being can read it all a know all anyways. And we haven't yet come to the trust layer where we trust our tools, AI or not to represent it to us. And if we are in the path that we are on of increasing complexity, and we are, then we have to get to that trust layer so that, you know, while it may sound a little silly in 2025, you know, at the beginning of June to say that executives and operators will be literally making decisions and, and, and taking actions based on what some AI told them, um, in the right context.

I think that's essentially exactly right. Mm-hmm. So guy, going back to the previous block, I'm gonna ask you the same question.

What is the level of disruption where we should expect to see among the cybersecurity vendors per se? Will there be a wave of consolidation in the age of ai? And is this gonna be kind of a recurring theme?

That's a really good question. Um, I find cybersecurity, um, and let's put compliance, you know, compliance risk into it, um, to be one of the, the, the most resistant areas of the market to consolidation. Um, the single platform idea, single pane of single, single glass of pane, which I love, is that what it was, Mitch, um, is, you know, I mean, it it remains a unicorn, or not a unicorn, sorry, a, uh, an unreachable a a a windmill to tilt that.

Um, I, I do think though that AI has the opportunity here brings the opportunity for, um, consolidation from a vendor standpoint. Um, there's a lot being done like an observe observability platforms, um, and, uh, certain, you know, um, partnerships like, like, like the one Mitch mentioned at our sac, um, that, you know, help the operators, um, manage this, you know, crazy spaghetti diagram of, um, interdependent, uh, monitors and Asians and so forth. It's just that security does not keep pace with, or doesn't go in lockstep with technological development.

So we were just talking about how, you know, in one sense, we are still at early days with AI and AI based development, very early days. Mitch was very eloquent on that point. Um, as that, that tends to advance first, there is not a security centric development because security is always the punch bowl taker, you know, cup away or whatever.

You know, it's always the one that has to come and say, now, hang on just a second. And it always has to do that in reaction. It, it, it should not be, it should be a driver of innovation, but it does not tend to be looked at that way.

Um, nonetheless, the simpl the, the simplification that properly used AI can provide in taking very huge, uh, messes, spaghetti diagrams and providing clarity into them could be the opportunity you're talking about. Yeah, I gotta jump into that one because the, the, the, that term, I love that I hadn't heard that before this. I'm surprised it took that long, you know, a class of pane, but this pane of glass, you know, this platform, you we're gonna have to finally solve our, our thing.

I think it's a different way to look at it. And this might be a good context to help us think about it because we're talking about a ai, we're talking about large language models that are for our purposes, effectively holo graphic storage systems a narrative, right? So it's not so much a pane of glass that a company's gonna use, but each stakeholder in different roles has different facets to look into it, right?

And to your point guy, you know, like when you're a security person looking into this, into this, this data space, and you're looking at it from a security perspective, you should be able to see that interwoven and everything else that's going on, not as a separate box that's bolted onto by wires and a conduit process to some other Box called engineering. It also, I think, will enable the, the, you know, really correct approach of two for two, for two of everything, two tools. Um, because now adding things does not actually necessarily change your user experience.

Um, you could have two different agents doing the same thing, two AI interfaces doing the same thing. Um, but the, the, the view of the analyst, the IT analyst expands, um, without having to also expand the number of dials to twiddle or any of that other sort of thing. We just always, of course, have to remember human supervise.

You know, you still need to be an expert in these sort of things. You can't just, you know, put, you know, a newbie or a novice on a complex system on because AI is there. You can't do that.

Mitch, last word on this, but, you know, I seem to remember talking to lots of IT and cybersecurity people and nothing warms their hearts quite so much as waking up one morning to discover that this tool or platform that they really love just got acquired by some stranger. So, Or they gonna ruin it when they acquire it, right? Yeah.

Well first of all, just a shout out to Krista case. Um, and, uh, Fernando Montenegro, who, who did this research at FU futurum, it, it's a really good, a really good point. I think that's a fair in any, anything that we really enjoy using, right?

Whether it's a great desktop tool or, you know, uh, something on our phones or security, I, I think there's a real possibility we may have and, uh, something of an inflection point happen in security of, let me overstate it this way. We, we, we essentially kind of passively wait for attacks to happen and either block them or respond to them, or we're, we're waiting for someone to, you know, cross the line and then we're gonna do something about it. Super, super oversimplification.

But it's, it's a defensive and response posture, um, to draw an analog to the software world where software developers, product managers are going, or they're pro, they're gonna be prototyping, they're gonna be using AI to generate new ideas and test concepts without ever deploying it into production as a real app, but maybe deploying it into production as a, you know, as a AB test or something like that. Or maybe even just pursuing ideas. Think of the same thing in the security world.

Um, what if I change my security architecture this way, take the last, um, two years of attacks and analyze that against this approach? And if I add vendor B into it instead of vendor A, how would that change my defense, my response, whatever. Um, I wanna change the way we structured our identity architecture and now to be able to com accommodate visual voice, natural language, you know, the new, the new modalities of interface.

Alright, well let me use AI to investigate and really prototype, maybe even try out some of those ideas. So instead of we're, we're kind of building it and then trying to keep, keep the fences, you know, secure. So nothing breaks through until we upgrade 'em to the next level for the next product or, or release is really on the proactive end, be able to, to try ideas and test ideas and test new, new options.

And I can imagine that's a world where, you know, I think Chris blast head would explode 'cause he'd had so much fun, but because he's that kind of guy. But I can just imagine that would be like your nirvana, Chris, I I'm having exactly that kind of fun right now, right? And, and just, and this, we'll get into this more over the coming weeks and so forth, but this is what some of us are working out on, out in the world.

You know, a civic AI node is a AI and a human being, you know, so that you have a certain form of trust and you build networks of these and, you know, for, for more discourse in the future, in theory, you can build a trust these this reliable enough to do things with. So I think we're, you know, to our point here about individual companies writing codes and so forth, I, I hate to be this cliche, but yeah, I think things are gonna change an awful lot. I've already changed for some.

And the next year is gonna see dramatic changes for many. Well guys, hey, the quote that great American philosopher, the times are a changing. So stay tuned 'cause it's just gonna be all kinds of fun in the next weeks, months and years ahead.

We'll be back in a minute. Discover Techron group, the epicenter of tech innovation. We are your go-to for reaching IT leaders and practitioners worldwide.

Our secret impactful content that sparks awareness, engagement, and top quality leads with us. You'll access editorial websites, streaming videos, virtual events, custom content analyst research, and more. Join our satisfied clients.

Let's revolutionize your tech journey. Contact us today and tell your story to the world in the most powerful way with Textron Group. Hey folks, we're back.

And guess what? VMware is back in the news and it seems like this company just cannot get out from underneath this move that they made. And for better or worse, it's a topic of discussion.

Now there's a EU watchdog that is saying, well, basically the VMware changes to their licensing policies have resulted in 800 to 1500% hikes. And, um, you know, they're basically not saying it's illegal, but they're questioning the morality of this guy. Um, at some point, do we just kind of have to sit back and go, look, Broadcom made a decision, it's their decision to make and everybody else has to make their own decision as a result from that.

And maybe it's, I don't know, time to just get on with it. Well, it's definitely time to just get on with it. When you hear EU and organization, you have a tendency to think that there's something governmental about it or quasi-governmental about it.

So I want really be clear here that, um, sis b um, which is the, the governing body, so to speak for this, this, uh, um, echo institution that I hadn't heard of before, uh, that came out with the statement. This is, this is C stands for cloud and asset for service s sp for service provider in spy. Um, that this is a coalition of European cloud service providers.

Private right there, there's nothing quite, you know, I, I so rarely use baseball metaphors, Mike, but I'm gonna try to use one here. I I know baseball, but I just don't follow it as closely as you do. Um, this is like the players association complaining about the contract negotiation with the owners.

Um, uh, and I just don't know the name of the players association for baseball. It really is, they have, um, banded together. I mean, cspi was created because of a judgment against Microsoft, if I remember right.

Uh, that Microsoft start. And so they just, I think it might have been Microsoft that said, look, I don't want, we don't want to deal with, you know, one of you at a time. You're in all different countries, even if you're all in the eu.

That's years ago. Um, now it's Broadcom's turn. And um, my sense is that they are just publicizing a whole lot of plausible numbers, like 600% higher costs, so on and so forth to try to get Broadcom to come to the table.

Um, who doesn't like perpetual licenses? Well, those are essentially dead. They're a thing of the past forever and ever.

And the ones that are left are legacy. And that's not Broadcom, that's the market. Um, Broadcom probably wants all of these cloud companies to remain profitable and to, to, to, you know, renew after three years.

And yeah, well, okay, maybe Broadcom wants to empty the exit the market and, and make as much money, you know, along the way as it can. That, that, that could be the situation as well. These are cloud providers.

These are folks whose core job, unlike your typical enterprise core job, is to build resilient infrastructure and serve it to customers. They want to keep their costs down, but they need the infrastructure to be performant and to work and do all these things that VMware has been doing for years and years and years. However, Broadcom strategic moves with VMware have made alternatives like Nutanix with, with a DH or with, uh, KVM, OpenStack, um, God help us, maybe even zen real alternatives to virtualized platforms look way more attractive.

And, uh, Nutanix in particular is going quite aggressively at existing Broadcom business, doing things like allowing, uh, try before buy experiences and building up a pretty robust, um, migration practice, um, to try to take as much cost as possible out of the switch. And there's no reason cloud providers can't go in that direction. A HP is based on KDM, it's based on open source.

Um, the real question is, uh, I think it comes down to your, your favorite topic, Mike, which is all the personnel, all the people who are actually running all this stuff who have built their reputations and their careers on VMware. And this, if anything, this news is, uh, about the players. It's about those players.

Not the cloud folks, but all the people in Europe who have been running VMware forever and are crying out for relief at, uh, suddenly seeing their whole life work style threatened. I mean, I will grant you that. It has unfortunate consequences, but, uh, you know, when I look over at Broadcom, they're not sitting there going, oh, please don't leave me.

Please don't leave me. They're basically saying, you know, pay up or get out. It's, it's, it's, it's, you know, it is not quite an eviction notice, but it's pretty damn close.

So Mitch, is this just, uh, something we need to factor into our thinking? I mean, did we get overly attached to a single vendor in somehow or other thought that they would be with us forever? And I'll go back and, you know, point to some of the things that Keith Townsend's been writing.

It's like pretty clear that VMware is business model is unsustainable, otherwise it wouldn't have been acquired three or four times in the last two decades, right? Well, I think you, I think you nailed it pretty well. They're a business, they're not, they're not an altruistic organization.

They're there to serve their stockholders and make money for the company and return on investment. And they've got a captured market with VMware and very, very solid, big market. And they didn't raise pro prices because it was easy to move off VMware.

They raise prices. 'cause it's very hard to move off of that platform and onto another one. Not impossible can be done, but you don't say, let's schedule, you know, the weekend after Memorial Day to, you know, we'll move off of VMware and move on to the next thing.

It's, it's a migration, it's an effort. It's, it's, uh, it know kin to moving to the cloud, but maybe twice as complex in some ways. 'cause you've gotta unwind all the way down to what do you leave behind?

What do you take onto the new platform? Uh, the, the new platform doesn't do things the way a really mature product like VMware does, but do you still need it done that way? So there's a lot of things to, to consider in moving it.

You know, it's, there are a lot of options for moving, but you're not gonna do it solely on the pricing of VMware. 'cause there's a lot more cost into it to moving your infrastructure. Mm-hmm.

I do believe it's getting easier to move that infrastructure. And I'm not just talking about the VMs, but the stack that sits above that. And as time goes on, that may get even easier.

So maybe Broadcom might have miscalculated how long or how hard it is to make that migration, but ultimately they still do the math and it comes out with a, this is our new price point and this is what it's gonna be. So, um, I don't know, Chris, you haven't jumped in on this one, but is this just the world we live in? You know, I'm probably the least qualified to give a, a pointillistic, you know, state of the market one on this one.

But I'll tell you what I Yeah, I, in the first segment, Mike, you talked about the big players having a advantages and so forth, and there's a flip side of that as well, when you look at where VM is in the entire space, and yeah, they're huge, but they're also sort of fossilized built in, tied in. And this, this is a good topic, you know, how with the ransom oak, so sometimes being big and filling the space isn't an, an an advantage, you know, and yeah, and again, I'm not commenting on them, you know, their, their activities, you know, they, but they're, we all know lots of folks that work there, great company. However, you know, without knowing the details that, that you guys probably know exactly where they're right now, I think that's a fair risk comment for them.

I think they're, they're not in a, in a spot because they're so huge. They have, they have all the advantages, probably more the opposite, probably need to think more flexibility than, than than legacy. Here's what I wonder is, is how important to Broadcom, uh, is the cloud provider community?

Now, outside hyperscalers, there are tons and tons of, especially in Europe, but you know, it's true around the world. Tons of cloud providers that are true cloud providers on demand pay as you go, et cetera, et cetera. But for more traditional, let's say, enterprises applications, this coalition in Europe is a great example of it.

Um, and a lot of them are regionally based, you know, serving their countries or a few countries or, you know, language groups really, really well. Um, and they have relied on VMware, VMware's initial play into the cloud going back like 10, 12 years was to try and be a new hyperscale platform that failed utterly. But that's because it just wasn't the smooth move for something like a VMware, um, a closed, highly performant, highly capable and secure proprietary, you know, resource allocation platform resource pooling and allocation platform.

But for these cloud providers, it has been terrific. And, um, I just wonder, seems to me that Broadcom should be most interested in this customer set and least interested in the enterprise customer set. Strateg speaking strategically, not uninterested, especially for large enterprise, but strategically speaking across the broad, when you're gonna try and find the so-called synergies and all that other sort of stuff, I'm gonna add two words to this guy.

Two words to this. One is mainframe and the other one is tariffs. We still have mainframes around, right?

We'll still have VMware running in people's data centers forever. But I'm, I'm gonna draw an a loosely coupled analogy to tariffs. It's the same problem of do we, do we pass on the price increases as a cloud provider to the underlying cost of the infrastructure software VMware that we run in the cloud so that customers can run their VMware in the cloud instead of their own data center?

Or do we eat that cost that they don't wanna eat that cost? So that, that's what's driving this behavior is they're saying, look, our costs are going up. You have a gun to our head.

We don't have a choice. We don't wanna raise prices on our customers. Maybe we're locked in on price for some period of time, and we weren't as, uh, as, uh, you know, as savvy about our contracts with VMware.

I'm just, I'm just surmising that That's another analogy to tariffs too. Yeah. Yeah.

So it, it is kind of, it's not a tariff, but it's the same effect where those costs go up that aren't in your control and you've gotta pass 'em on to customers. So guess who the next group that's not happy is, is your customers. I would, I would take this as a public negotiation over licensing.

That's just like, as like the sport analogy, you know, the players association negotiating with the owners, and ultimately through maybe a high stakes, you know, or a very mellow dramatic communications war. They will come to an agreement Or they could just go to the great mediator area in Mar-a-Lago and he'll help them sort this all out, right? He'll, he'll fix it in, he'll fix it on, on day one.

There You go, on day one, it'll be fixed. All right, I'm going to, I'm gonna leave this here, but I would just point out one thing. Um, decisions that are made in anger usually don't turn out as well as you hope.

So take a minute, take a breath and think about it long and hard before you decide what you're gonna do. There's no right answer, but just know that there's cost either way you look. Hey, I wanna thank everybody for being on the show today and sharing their insights as always.

And I want to thank you all for spending some time with us. Once again, please stay tuned. There's some awesome content coming up right behind us on the text drawing TV lineup as always.

Until then, we'll see you tomorrow. Hey guys, thanks for the throw. We're here with Nick Mistry, who's the CSO for Lineage, and we're talking about a survey they did at the recent RSAC conference and it talks about well, software supply chains and whether or not they're secure and maybe to what degree.

Nick, welcome to the show. Thank you for having me. So as you conducted this survey during the event, um, what happened in here that surprised you?

Or was there, was there something that's going on? Because I feel like we've been talking about this issue for a long, long time now, and it's not clear to me that we're making enough progress and or for that matter whether people actually understand what the issues are. No, that's a, that's a very good point.

You know, some things that, uh, definitely, uh, surprise me, but uh, shouldn't be surprising is there seems to be, um, a lot of confidence in AI's role to enhance software supply chain security, which, which I think illustrates the promise of, of AI in terms of what it can do. And then on the flip side, what was really interesting, um, was the fact that, you know, when it comes to understanding software supply chains, you know, with simple capabilities like software build materials or SBOs or ability to really, you know, drive vulnerabilities out of the supply chain, there, there seems to be a lot, a pretty big gap. Um, so I think there's a, a lot of, uh, I guess expectations on ai.

At the same time, it, it does seem to validate that we haven't made as much progress in understanding and grappling with the software supply chain risks. So we've been having these conversations for a long time now, and I feel like the process is fundamentally flawed. I mean, a bunch of security people run around, create a list of vulnerabilities, throw it over the wall to a bunch of developers who go, well, a I may not have time for that, and B I'm pretty sure most of these vulnerabilities don't even exist.

You know, you're exactly right. The process is definitely broken, right, in terms of dealing with vulnerabilities, as you mentioned, one group's scanning it, and then the other group and that group is sending it over the wall to the other group. And there's a lot of contention, right?

What's really needed is in the, in this era where the software development velocity is, is increasing faster than people can actually prioritize and patch and maintain software is, uh, a capability where both organizations can see the risks in a unified view. And equally important, understand what to do, right? What is the appropriate fix.

Not every remediation, uh, is equal in terms for its, uh, the bang for your buck, if you will, right? And a lot of that, you know, can be driven centrally in a way that both groups can agree on. What are the right risks to resolve and what are actually the right remediation steps to, uh, remediate the most risks out of software.

So I think there's a huge opportunity absolutely. Given all that, I mean, what's the cure for this? What's the remedy that we should be putting together?

Because I mean, I can't really put cybersecurity people in every app dev team and maybe I can train the app dev people that'd be better at security, but you know, the, the spirit has to be willing, right? No, a hundred percent, right. And I think the, the challenge as I mentioned before is that, uh, the speed at which software is changing, plus the risks are pretty dynamic.

And then you get these two groups that are working in silos. Uh, it just exasperates the situation. So, uh, one, you know, one of the solutions have been very effective for, for us at least in terms of what we're seeing is starting with the, you know, you know, everybody talks about software build materials and SBOs as a static view as a laundry list or ingredients list of software.

It's actually much more important than that. So software bill of materials can be operationalized to, uh, identify all of the risks. But equally important is the fact that now that you have a software bill of materials, you also know which remediations will be able to drive the, the largest number of fixes in your vulnerability.

You can even determine with the right intelligence around, you know, operationalizing a software build material, um, you know, which, which ones actually have a fix available. Not all patches are available for most of these vulnerabilities. And you can centrally start making some decisions, um, you know, together versus, you know, having a, a separate scan and a separate result.

We can see things also in real time if we instrument this within the CICD pipeline. So both groups are seeing the same thing, uh, and analyzing and coming up with, uh, you know, what are the right steps to reduce risk. Things too that comes up is that not everything that needs to be fixed is something I have control over as a developer.

'cause it may have been created by some third party open source maintainer who I may or may not be able to reach. Yeah, no, that's exactly correct. And you, you most likely won't be able to reach at all, right?

And so tho those vulnerabilities won't get fixed. So what are the options right? There are, you know, obviously, you know, replacing that open source with, with another one is an option, very painful option and almost impossible.

The other one is compensating controls. Like what can you do to mitigate the risks that we see in that vulnerability? Uh, and then, you know, the, the third is one of the things that we launched is gold open source.

So this would be pre-vetted vulnerability free open source. And what we'll do is we'll actually create, uh, a fix if there's no fix, and then contribute it back to gold open source. One of the things that has kind of come up in recent months, and it's been an issue for a while to be honest, but people are afraid to patch something 'cause they're worried that the application will break and that they might possibly, um, lose some revenue or there'll be some disruption to the business.

And yet, I wonder if we reached a point now where the potential losses generated by some vulnerability that gets exploited, it might be even higher than the application being down. Uh, well, I, I think that's a tough one, right? Absolutely.

The risks of the vulnerability being exploited, um, you know, could lead to application being down and then you don't wanna self-inflict a wound by taking down an application or, or, you know, just as bad extending how long it takes to, uh, you know, do the maintenance around that application by introducing breaking changes, going back to the testing cycle, et cetera. Um, you know, so, you know, that is a big concern. However, you know, throw into the fact that, um, we're seeing AI tools now.

So, so, you know, the conventional wisdom was, oh, let's let's look at things like, you know, exploits. Is there a valid exploit already? And use that in prioritization and other mechanisms to prioritize, to avoid exactly what you're saying, introducing a breaking change.

However, we're starting to see that, you know, individuals with, with little expertise, right? A little bit of expertise can actually start creating exploits for these vulnerabilities using a lot of these code AI gen tools, right? They're actually sophisticated enough now to, you know, drive, uh, and build exploits against vulnerabilities.

So, you know, the long, long, long story short around this is I don't think we have a choice. I I think we do have to remediate vulnerabilities. So one of the things we're looking at is a compatibility analysis.

What are the fixes you can make that are compatible with your software that won't break your software? And then equally important, and I think, you know, we've made a lot of strides with, with ai and AI has the ability to then also rebuild your source code, rebuild your container, which is what we're working on in a way that it won't break your software and remediate that vulnerability. And so we fundamentally believe that's kind of the, uh, advantages of AI and where AI can really help is take that detailed analysis, uh, and ability to, uh, rebuild a container or rebuild from source code in a manner that won't break your software.

I, I think is um, is a huge opportunity. You can't walk down the street these days without somebody telling you about their great new AI thing and we're seeing more AI code than ever. Um, is that code better than it used to be worse, or are we roughly about the same?

The all indications point that, you know, AI generated code i is about the same or worse, right? And worse from many perspective, not only from a risk perspective, but being able to understand, um, you know, what, what is happening with that code? Especially we're seeing instances of, of AI generated code hallucinating packages, open source packages that it's pointing to, and then adversaries are, you know, understanding that what, what are, what are these package names that are being hallucinated and then create it, and now they've created a malicious package that people are are downloading.

So definitely, you know, AI gen code is, is the future and it's just gonna get better over time. But I think we need to, you know, make sure we're aware of what are the risks and being able to detect and manage those risks, you know, uh, within, uh, AI generated code. So given where we are, I mean, how do I kind of bring these cultures together?

Do I take, take, just take them mill and throw 'em in a room and lock the door until somebody sees sense, or is there something I can do as a leader to kind of gently push people in the right direction? Yeah, no, definitely. You know, there's, there's gotta be a coming together and whether where they merge or they meet, if you will, is this combination of understanding software, which is, you know, I would say most AppSec teams under science software, they're very focused on vulnerabilities.

And then on the other side, you have the dev teams. Obviously they're focused on building great capabilities and, uh, and velocity of terms in terms of, you know, you know, getting to market quickly with new capabilities that add to their business. Having one central view of that.

And we've seen when that happens, when there's a joint view of not only identifying risks, but then also being able to understand, uh, what are the fixes that are going to actually reduce the most risk understanding compatibility. So, uh, really is bringing together the challenges the dev teams face in, in real life challenges of making these fixes. Whether it's compatibility issues that will break their software, whether it's things like, you know, there isn't a fix because it's a deep transitive dependency within a direct package or other things.

And then also at the same time, having the view from the AppSec perspective that's understanding, okay, what is the critical, how critical is this vulnerability? You know, what is the dependency tree analysis? And, and really having a unified view.

So collectively decisions can be made that optimize for reducing risk and driving efficiency. And then obviously using tools, uh, you know, such as, you know, some of the AI capabilities we've launched to automate the remediation process, uh, in order to alleviate, you know, the manual effort, uh, around, uh, that, that remediation. Well, folks, you heard it here, empathy goes a long way even in the age of ai.

And all we gotta do is kind of agree to a common set of goals, and you'd be amazed at how much progress can be made. Hey, Nick, thanks for being on the show. Thank you.

Appreciate it. All right. And back to you guys in the studio.

This is Textron tv. Hello, my name is Chris Blak, and welcome to yet another episode of the Inevitability Curve, where we take interesting topics, hopefully we take interesting folks. Definitely.

And we try to see how we got to where we are, take a look at what, where we are actually looks like, and with that, see what we can in tour about where we may or may not be going. So with me as a good friend and the first, second time, uh, uh, guest on the show, because we recorded the first episode a year ago at RSA, um, that's not on the channel, you know, so we're, we're, uh, revisiting again, Casey. How are you Doing?

Well, Chris? Doing well. Yeah.

It's, uh, it was inevitable that I was, uh, gonna come back and speak again and, you know, excuse kicking it off with a terrible pun. Uh, but yeah, it's, it's good to be here. Well, you, you, you're, you're right in, uh, you have any shot?

Yeah, yeah. Bad puns and, uh, and dad jokes and, uh, and maybe some wisdom. So last year, alright, so, so anybody doesn't know, you know, shame on you.

Um, but, so you are co-founder and chief strategy officer for Bugcrowd, which has taken, um, access to, uh, cybersecurity human resources and scaled it basically in an open source sort of way. Right. And last year we were talking about, and, and the company's done quite well.

It's been around 10, 12 years, can I say, at this point, 12 Years now. Yeah. Yep.

And, and, and that taking that, uh, successful platform and adding what we call artificial intelligence today and working that out. So last year we were talking about that, and as we were talking about in the green room, it's that, it's RSA time again. You know, we have not just been talking about AI and I promise I won't say what we are calling ai, um, today, but, uh, we've been talking about it for a long time.

It's, it's seeping its way into everything. So where do you wanna start, you know, looking back to, Wow. Yeah.

Um, yeah. So, uh, yeah, it's, uh, thank you for, thank you for having me on. And yeah, my name's, my name's Casey.

I'm the, uh, founder of Bugcrowd and also co-founder of a thing called the Disclosure Project, which is all about basically normalizing vulnerability disclosure, uh, and changing the operating environment for hackers that operate in, in who are, who do their work in good faith. So that's kind of my background. But, um, yeah, it's been, it's been interesting 'cause, you know, just thinking about kind of where we're up to last year when it comes to AI security and how the crowd sort of fits into that.

I think, um, one of my favorite quotes, uh, at the early onset of generative ai, so look, we're talking late 22, early 23 I think it was, um, was that, you know, know AI in, in 2023 was kind of like having a website in 1997. So there was just this enormous, like stratospheric like hype cycle, peak in the hype cycle, um, and a whole bunch of things get kind of decided on, and, and, you know, people start building and people start to freak out and whatever else through that period. Um, but then we drop off that we get into the trough of, of despair, um, and then it kind of goes on to being kind of, you know, what it's gonna be in, in terms of a status quo into the future.

And, and the interesting thing about it is that I thought that was exactly right, like AI hit and became very obviously a very powerful and therefore inherently dual use technology. Um, but then the other side of it is the inherent accessibility built into generative AI in particular made it an issue of retail politics pretty much overnight. So like, everyone just panicked all at once.

Um, and yeah, I think we're at a point now where, you know, we actually are starting to get some idea of what we're gonna use it for. Like I was getting asked by a lot of folk, um, you know, in the, in the venture community and in the sort of CISO community, all sorts of other places, you know, where I, I saw the AI security and AI kind of risk management industry going, and my answer even a year ago was like, we don't even know what we use AI for yet. So, you know, I, I can sort of be somewhat predictive around where it could go.

But in terms of what actually ends up being important, um, I don't really feel like anyone's got a good answer to that yet. So that's when we cooked out the, um, or cooked up a taxonomy, basically talking about like AI as a tool, um, AI as a target and AI as a threat and, and sort of having that as the top level things to be thinking about that, you know, start to allow you to create an overall risk taxonomy when it comes to AI security and risk management. AI as a tool is basically anything that reduces time to success for attackers or defenders.

Um, AI as a target is basically the net new attack surface. Um, so, you know, pickle file to serial, uh, pickle file to serialization with like reverse callback shells out of, you know, data models. That's not really a thing that we were dealing with three or four years ago.

And it is now, like stuff like that as well as jailbreaking and all those kind of things. And then AI as a threat to me is all of the unintended consequences that you get when you jam new technology into existing systems, um, with all this kind of competitive pressure and, and hype around it. And I think that third category is actually the one that scares me the most, to be quite fair, Frank.

Yeah. The emergent property side of things, right? And the, yeah.

When we first talked, uh, uh, a year ago right after that, I came home and if I'm not mistaken, yeah, there it is. Right above my head, I took a, an old electric RSE car, put a raspberry pie in it, you know, found something called donkey car, an open source ai, um, project, and got it running. So I built my own little AI robot and we had it running around in the yard.

That's awesome. And, and, uh, you know, so which, so I got to understand how we, 'cause you, you mentioned taxonomy. I think that's really, really important because the more, particularly these public facing things I do, I find myself saying, and I don't find a way around it what we are today, you know, saying what we are calling today artificial intelligence, right?

Because taxonomy's really important, it shapes how we think about things a hundred percent. And just, just this morning on another Textron gang thing that's gonna air the, the, the first day of RSA, uh, next Monday is you, you know, talking, talking this through. It's, it's basically, you know, what, what we are currently calling artificial intelligence.

I said in that segment, and maybe you can correct me on this one, but I really see as pattern matching at scale, right? You know, then it's, 'cause it's, it can do large language models because it can take just an enormous, that enormous quantity of combinations of words and make sense out of 'em and turn it into binary ones and zeros. And they act on it as a computer system.

And, but it can't do all sorts of other things. I mean, those two words, artificial and intelligence, are wrong to start with and always have been for decades, for Eliza and everything else. 'cause it's neither artificial nor intelligence.

Yeah. Well, yeah, actually, and, and agree on, I agree on the first one. I think where we're at now with things like mixture of experts, models and, and just some of the ways that you can hook, um, different, you know, ai, machine learning, whatever you wanna call them, models together to, to, you know, basically mimic intelligence within a certain domain.

I think that that's, that's approaching, you know, something that I would just over a beer in a pub thinking it through, through, through that lens would, you know, consider to be kind of artificially intelligent in terms of its capability. It's trained by human data, it's, it's programmed by people, all those different things, but it's operating in a way that is starting to approach it, it kind of being able to make novel decisions, if that makes sense. Um, but for the better part, yeah, it's just like it's machine learning on steroids.

I think the reason that we, we called it, we called it artificial intelligence, um, you know, partly like marketers like that term and, and VCs and, and the street like that term. So there was definitely, I think, uh, you know, a market pull in that direction. Um, but when you look at some of the definitions of what artificial intelligence means historically, it's, it's, you know, the ability to interact with a computer as though it's a human.

Which in reality, like we've been doing that with Google through an LP for a long time now. There's different variations of that that you could argue already exists. This was just like a, it's designed to be human and it's interacting with whoever wants to talk to it in a way that mimics a human his reaction.

I think that was the, the user experience shift. And I think that kind of prompted some of the, some of the blur in the taxonomy. Um, but yeah, I totally agree.

Like words mean things like this is a real, this is actually a major problem in the policy space, um, kind of globally at the moment. Um, because you talk about issues of like policy harmonization between, you know, different western countries trying to figure out what, you know, the, the sharp edges might be between western policy and, and you know, adversarial policy, all those different things. Um, this whole thing of like, when we talk about ai, like forget about tool target threat when we talk about AI security, like what do we mean when we say ai?

Like how do we actually, how do we actually like, for the sake of writing policy that's gonna end up forming law, um, or end up forming regulation that people like operate their businesses off and get fines based on and go to jail based on, and all those other things, you know, at some point in the future, like that matters a lot. Um, so yeah, there's a lot of very, I mean, I think we should probably just feed that question into, uh, into, you know, grok deep Sea and chat GPT and then, you know, sort of sum the answers up and figure out where we go from there. Perhaps Wh whi which, which I think is a steering point is, uh, is, is interestingly probably fruit, right?

You know, and, and again, since last year, you know, I'm, I just tend not to be an early adopter anymore. If I ever was sure I've watched things move along and when I think they get to a certain point, I start using them mm-hmm. For my own purpose, just to see how it works, right?

Yeah. And I hadn't, you know, I hadn't, I think a year ago maybe I played with chat T-P-T-P-T-A little bit or whatnot. Um, but now I have it on my phone.

I use it all the time and actually go into Google and finding the three words that maybe come close as opposed to just speaking to this bloody thing, you know, inaccurately and, and you know, and so it's on the, the two sides of this usefulness is fantastic. Just saves me bloody time to the point that that, that I recommended to, you know, to multiple friends that I know who are, you know, having extreme hard times at homelessness. Right.

You know, if you're out on the street, what do you need? You need to talk to somebody now, a person's advice, it's gonna be accurate and very good, but it's something to start with. Yep.

And it gives you that much that fast and, you know, so it's, so it's gotten just practical in everyday uses in, in, just in replacing Google and things that we're used to, you know, looking for information. And, and on the, the, the second part of that though is get your thoughts on this because I love looking for this. Where are the errors?

Where are it messing up? 'cause you can feel the Oh yeah. You know, the, the system behind it by what it gets wrong and why it gets wrong in those patterns.

Yeah, no, yeah, yeah. No, a hundred percent. And, and I mean, I think that's, that's the part where this, you know, I, I got pretty involved in some of the safety.

It's a really interesting space. 'cause there was, you know, when, when AI first dropped, there was a, a stop the training until we figured out how to regulate this stuff. Kind of letter that went out and, and I got asked to sign it and I said, I actually said no because it's like, listen, this is actually great power technology.

So if you abstract back up to, to like a international relations level with this stuff, um, there is gonna be effectively an arms race on supremacy when it comes to, to AI and to put the brakes on advancement based on safety. Like, it was a hard thing to do because as a, you know, as a dad, as a husband, as a human, that side of me is like, yeah, we should probably think about stuff like that 'cause it seems like a good idea. But then thinking about it at the system level, the international relations level, it's like, that's actually not gonna work.

Um, that's gonna put us at a tremendous disadvantage in the west if we, if we do that. And, um, yeah, that turned out to be pretty accurate when you look at, you know, some of the, um, some of the, like the timing of some of the moves with deep seek and, and some of the, um, like ways that I think that was, you know, potentially intended to have more of an impact on the American Stock Exchange than it was on the technology environment at the time. And, and in terms of how it was released, right?

So there's all of these different system level issues that are popping up. You know, going back to like the integrity of the system that you're working with. I feel like that sort of got lost in the process a lot.

Like PE-people, you know, I think folks that have been using, or that start using, um, large language models as their replacement Google, um, or their replacement search engine de jo, right? Um, not to get too vendor friendly with the thing, but you get what I mean. Um, there is a suspension of, like, to me there was a suspension of critical thinking already in progress, kind of prompted by social media tied to machine learning that, you know, you can look back and sort of see starting to show up in like 2010 to through 2012.

And it kind of went from there that I think AI is sort of accelerating this idea of like, you know what the computers know, I'll just ask them and trust the answer based on whatever I get back. Um, I think you've gotta be really deliberate as a human at this point in history to care about backchecking, um, and, and, and to care about like where things are coming from. Like what is the system that's generating this?

Like if I, I actually did this at home. If you load up deep seek, um, you know, an EU trained model and an American trained model in, in like a home lab, and then ask them all questions about what they see as the future of, of global order, um, you know, 1, 2, 5, 10, 20 years, they'll all give you answers. And if you sort of start to dig into that, you can see that there's incredible bias in each of those models that's very different, which makes sense.

'cause they're from different parts of the world, right? So like, yeah, there's all of this stuff where it's just, we're just kind of consuming it as a population. Um, that, again, it's one of those things where I don't necessarily have a good answer for how to, how to slow that down or prevent it, but I do, I do worry about the suspension of critical thinking.

I, I do worry about kind of the delegation of creativity, um, you know, just different sort of impacts on, on how we think as a species going forward. And, you know, we'll see how that sort of sort of thing plays out. But I think we've seen some evidence of that over the past 12, 24 months even.

Right. And I can't, you know, I can't, uh, can't and have no, uh, uh, interest in denying any of that. Right.

You know, I, but there's a, however, right, and this sort of comes down to the theme of this, this show, right? And, and that this iterative thing I keep looking at in life is when there's, you know, quite often you see some commonly held, uh, belief of a future that's like 99% likely. Like we all, everybody agrees 90, that's pretty well gonna happen.

Yeah. And some bad thing, you know, from, you know, my early childhood, you know, they, you know, I, I grew up expecting to be, you know, growing up among the, the, the rubble and leading a, a radioactive survivor group and so forth. Um, and who's to say that wasn't most likely, you know, maybe, you know, that really was 70% likely, but 30% unlikely sometimes happens.

Yeah. Sometimes 1% unlikely happens. Right?

And that's the, the, in my experience, that's the thing to at least shoot for if you can see, you know, looming problems, you know, keep looking at the gap where, where they might not be. Hmm. And so going down that path, I put perhaps an un unwanted amount of, of faith and trust and practical application of theory and, and science and so forth.

And there's nothing like running our lives, running our businesses, you know, running security systems that makes us actually implement things and argue them out and put them in place and see, see them work and down the paths of cybersecurity, the things we need, you know, to have supply chain 30 years from now, maybe three years from now, you know, where my thing even works at all, you know, means that at some point in the future we have to have reliable systems that can move in, you know, information in near real time across many individual organizational and jurisdictional boundaries. And all of the policies along the way need to be interpreted accurately enough Yeah. For the use of that information.

Yep. I can see that spot, you know, coming in, in the future. And it's not 300 years from now, I said 30, maybe it's 30, it's not quite three, except maybe in some sectors, maybe it really is three depending on the condition we're living in, in three year.

And I think we could build that. Yeah. Which will, you know, look at the, you know, the, the position of our future selves, you know, 10 years from now when we're standing here with the answer, we know 'cause we've already built it or at what, whatever point it is, what is it we are going to have already known?

What is it we are going to have already figured out? Yeah. And I think, you know, wrapping this into some sort, sort of form of a question, I guess looking forward, I think the practical application of these things in, for example, security, you know, where I can take this A-I-L-L-M thing and process the massive amount of information that I could never consider before and get to a reasonably workable, mostly correct.

Professionally handled to your, to your point about critical thinking, not something that anybody's gonna read and say, oh, I'll act on that. But he reasonably pared down a thing that a human being can use. Yeah.

It almost has to be not Yeah, no, I like, I, I definitely agree with that, especially when you're talking about, you know, scaled systems. I, I, I think some of the concern stuff I was, I was calling out before is, is more in terms of like the individual and, and, and how they kind of interact with the world, right? If you scale that out or if you build out the need to scale out actually ingesting and interpreting the rest of the world, then it becomes a thing that's almost like an, an a non option at this point in time.

Because as, as you know, your average customer, your average consumer in cybersecurity, your average adversary is now using AI to basically reduce their time to success. Um, that's gonna create an asymmetry in your ability to process that and figure out what you're gonna do in response. And that's just on the detection and response side of things.

I think it actually goes to how, how we think about getting proactive and, and trying to protect ourselves as well. 'cause we, we know that we can't get around to all of it. You know, I think, I think at this point in history, in the security industry, um, there's like two groups of people.

There's, there's those that know that we're not gonna get around to fixing everything and, and therefore prioritization becomes the most important thing. And then there's those that are basically still in like ostrich risk management, where it's like, if we just ignore the problem at all, it'll hopefully go away, which we know doesn't work, but good luck to them. Um, so this idea of being able to get to that prioritized answer as quickly as possible, no matter what you're doing, uh, I think AI is a tool to, to distill the grunt work and get you to the things that you can actually apply yourself uniquely to as a creative human being.

Um, that's what it's good at to me. Like, like anything that sort of satisfies that pattern, to me, those are the things that AI bested is best at doing just in general. Um, so yeah.

Right. And it, and it's, and this, and I think, you know, I think, you know, I make this, make this statement even more firmly. I firmly believe, right.

You know, that cybersecurity is, is a good model of the, the philosophical angst we go through. Right. You know, because it's easy to say, well, nothing's gonna gonna change.

It's always going to be, it's just the next round. It's just, you know, and if you're in this industry, you know, have been for any time you've been through several, you know, you know, trends and fads and it's all about this, and it's all about that. And it's easy to get cynical to say it's always going to be the next thing.

It's always gonna be this way. Right. But that begs the question, you know, that, that there's only, you know, binary conditions for things, right?

The things can't get better or worse, they can only be good or bad, and I don't believe that's the case. Yeah, yeah, Yeah. Yeah.

I fully agree. I look at cybersecurity, you know, as relatively well baked. I think we're 80%, 70, 80% along the way of, of building the tools we need to build secure cyber systems, right.

And they're mostly generally applied in reasonable, you know, everything from firewalls to encryption and all the basic tools are generally out there. So if you're a a adversary, you've gotta be relatively good these days. And you know, the old days of just being able to have a connection to any host and just spamming with passwords until it cracks, those are pretty, pretty well over we've raised that bar.

Yeah. I think I, I think for the, I think for the better part, I do think I'd, I'd sort of disagree with that a little bit in the, the adversary is adapting and they're changing their techniques to kind of match that because to, to me, that sort of sums up the nature of what we do. I, I'm not a pessimist in terms of like, oh, nothing's gonna change.

It's all, all staying the same. But I am, I I think a, a kind of a realist in the sense that like, you know, someone leaving their front door open and then someone else coming along and exploiting that, um, is a, is a phenomena that predates the internet by a couple of thousand years. Right?

Um, 'cause like bad guys gotta do, they gotta, they gotta eat. And you know, folks, no matter how security conscious or well-intentioned or other, otherwise they are, are gonna occasionally do the equivalent of leaving the front door open when they shouldn't. So like this combination of, of human behaviors and human incentives, I think, you know, for as long as that exists, there'll be, there'll be crime and there'll be a need for us to find our way into the middle to be able to kind of mitigate that.

Right. Um, and you know, you, you look at sort of what's happened over the past, really five years, but we've started talking about it in the past too. You've got nation states that are opportunistically hosing everything they possibly can to get shells to, to save for later.

So you, you know, you flex typhoons, you sell typhoons, your, your initial access brokers out of like Eastern Europe and other parts of the world, um, because it's still possible. They're, they're out there just going and getting whatever they can. The thing that's interesting to me on the back end of that is that attackers are, are becoming more adaptive with how they make use of that stuff for their end game.

So it's not just I need to, you know, break into this network, like bypass this firewall, access this database base exfiltrate the data, like a simple sort of hack like that, or a straightforward hack like that. It's, you know, how do I leverage cloud? How do I leverage like data dependencies, third party dependencies issues in the supply chain, like the supply chain connection graph.

Like all of these different things that are available to an attacker to get their job done. Um, and they're getting better at that. Like they, they understand that like, figuring out how to traverse the ecosystem that we've collectively built as an, an internet at this point in time is kind of their job as the bad guy.

Um, and then whatever we throw up as a, as an impediment to them is, is, you know, that's, it's an opportunity to differentiate. It's an opportunity to, to sort of compete with their, their bad guy peers, so to speak. It's an opportunity to actually, um, step out in front as much as it is a pain in the butt for them.

I'm sure. So, like, there, to me, that's the nature of it, right? And, and you throw AI in on top of that, what you end up with is these, this acceleration of like the oodle loop, you know, the, the, like defender does thing, attacker responds to thing, and innovates Defender recognizes that innovation and figures out how to defend against that.

And it just sort of does that, there's a cycle time to that that I think, um, AI accelerates on both sides. Um, it's definitely accelerating on the, on the attacker side of things and, and, you know, thinking about like the future state where that OODA loop gets kind of too tight for, for us to fit inside in terms of how we think about what we should prioritize defensively. Uh, I can see that coming up as a thing that we need to really have as serious think about over the next couple of years.

That kind of point, right? Yeah. Yeah.

And then that's a, you know, a lot of the current day in there, you, I, I basically agree across the board, you know, these are these times, you know, and, and yeah. You know, I'm trying to say, find a way to say this one thing that I'm making outright pro, you know, plug for your company out this, but the bug crowd thing, I like that, you know, in our conversation a year ago, there's this evolution, you know, this idea that like, I'm going to have on, I, I'm, I'm big company A, B, C, and I'm gonna have my security team and I'm gonna have and build walls, and it'll all be fine. And you build a business off of connecting people with a bunch of lots of folks.

So, and you know, now, you know, enabling with AI and going down that path. Yeah. And, and I think that's always a thing, right?

And this, you know, AI is gonna replace us, eh, maybe, maybe not. I think it'll enable a lot of people. I mean, I could see everybody working in cybersecurity right now, still not getting bored, but being able to do their jobs better.

But I think the point that, try this analogy, you know, it, you know, I know the evolutionary analogy is could use way too much in this, but I just can't help myself. Sure. And one of the, you know, the dinosaurs versus the mammals is sort of a almost two cartoonish one I like is saber tooth, uh, mammals and apparently involved eight or nine times, you know, completely unrelated, not genetically related.

This just when conditions are so conducive to, you know, success being for like, being really, really big and having really, really big teeth. Yeah. That's the winning solution.

So if you're alive at that point, you say, that must be the best solution You win. Yeah. But, you know, over time, conditions change at all.

Turns out those really fragile, you know, species, they, they die off and they're replaced by smaller and more resilient, more redundant, uh, systems. And I think so much of what we're used to in information security and cybersecurity as a subset of that, you know, is is is perhaps in a sort of saber-tooth era where the adversary you are always a monstrous things. And we assume that's the, the, the, the stable model that we're still in a very early ages, right?

Yeah. I spend a lot of time thinking about that. I like, I think that's, like, that thesis is a hundred percent right.

Um, like I, I, I think about that a lot, you know, partly as, as someone who is like in an, at this point in time, an older generation in the industry, right? Like, you think about technology generations, like I've, you know, been around for a long time doing this at this point in time, and it's, I mean, honestly, just you're To crap it, let's face it. Yeah.

Just The acceptance of that thought is confronting enough, but then it's like, okay, well what, what are the things that I've, that I have as like baseline assumptions around how this works that are maybe aging out? Um, but then the other side of it to me is like, you know, the, the, like Gen x gen, sorry, gen, um, Z and gen alpha, like they're gonna inherit this problem. And everything I've seen from, from like hacking with people and then with watching folks interact on, on the platform and in kind of a collaborative, you know, crowdsource, tacking context is you've got, you know, I like my generation's gonna understand infrastructure and the network layer and, and some of these kind of fundamental plumbing aspects of, of how networks still work today in a way that, um, someone from Gen Alpha or Gen Z probably won't, mostly because they're just not native to it, right?

Like, that's not, that's not their, their kind of technological home gra uh, hometown where they grew up, like they grew up. And the flip side of that is that they've grown up in the interface, they've grown up looking at business logic, all those different things because everything's so abstracted in terms of their, how they work with technology, therefore, they're more conversant and more native with how to manipulate and how to exploit that stuff than I'll ever be. And we can both learn, you know, the specialty of the other side in some ways.

But I've, I've got a theory that like the stuff that you're na you're natively dropped into, like you can have a native command of that because it's just in your DNA at that point, right? Um, so to me it's sort of, you know, the whole evolutionary thing, all of that. It's like, where does this go?

I do think there are primitives, um, that are, that, that basically survive that. Um, and I mean, I'm talking about like core primitives, um, you know, the idea that like, Like cyber crime, um, or, or, you know, like adversarial cyber behavior is an inherently human problem. Like humans catalyze that problem.

Humans are ultimately, if you, you dig through the root causes responsible for the, the flaws and the vulnerabilities and the design antipas that enable that. So therefore there's this aspect of human creativity that is sort of necessitated to feed into that gap, because that's just gonna be completely novel every time, right? Um, yeah.

And then, you know, just, just some of the ideas around like, security should be all about, like, it's an economics problem in a lot of ways. Like, we should make security easy, make secure easy, and make insecure obvious. Um, because folks don't wanna spend money on the thing that they're trying not to do, which is ultimately what getting hacked is, right?

They're trying to spend money and spend their time and deploy the resource on getting the thing done that they want to do. That's like this whole idea of like the economic balance between investing in resilience and defense. It's like businesses don't want to do that, and capitalism sort of doesn't tell them that they should.

Um, we're not actually structured to reward this stuff. So therefore, as like cybersecurity solution is in a capitalist environment, our job becomes to make as secure as easy as possible for them from an execution and as rational from a cost standpoint. And then to make insecure as obvious as possible so they can figure out, you know, what the priority is, right?

Like that to me is still, you know, I'm talking like an old fart when I go through all that stuff, but to me like that, that those are things that I think were true 40 years ago and are still true today, no matter what generation or what part of the stack you happen to be focused on. Right? Well, there's something you said there that really makes me think about this, you know, then we're nearing the end of our time, right?

So this is that future part. And I think, you know, in as much as anything I said about saber tooth eras, you know, has any bearing on this, you know, put, put the deposit, right? I think, I think we're, we're approaching the end of, I think the fact that, you know, as you say, you know, working generationally, cross generationally, you know, that's a more mature statement than again, old folks like you.

And I heard and said in the beginning of our careers, which was that old people don't know anything and, you know, right. And those board members are so stupid. I mean, I can't believe they got their jobs.

I told 'em how wrong they were and they didn't gimme the budget. And, and, and so that we're, we're, this entire practice is maturing itself along with the infrastructure we're building and, and we're responsible for securing. And the, and the, I see, you know, there's, you know, it, when I talk about inevitability curves, what I picture in my head is more of a half pipe, like, you know, a a a snowboarding thing.

It's not a straight line. This is a realm of possibility that gets less likely up on the sides, but you get up on the side, now you have a whole new future outta you, right? So, yeah, don't get my optimism wrong.

I may be wrong about this. Maybe the French revolution didn't work out. Maybe, maybe.

I think you're right. There's like, you know, that truism, like there's two types of fool, the one that says that this is old and therefore good, and the one that says this is new and therefore better. Like, that's a, that's a old, old truism.

And, and like, to me, that's another one of those kind of primitives, right? It's like, no, like neither are true. Like the truth is actually somewhere in the middle.

If you can get those two points of view together to collaborate on the problem that they're actually trying to solve, as opposed to like, I'm right. Which is not the problem. I think we can fuse making sure that people believe that I'm right, um, you know, as individuals as the primary problem to solve, as opposed to like, no, like, why are we even doing this in the first place?

It's to make life difficult for the bad guys, and it's to make it easier for people that are trying to do the right thing and trying to do good, you know, in what they're building and all of that stuff. Right? Well, I, I think, you know, I I, I like, I have always liked the economic, uh, um, drivers in cybersecurity, right?

You know, much to the consternation all my friends and peers, right? Because I see it as literally an evolutionary thing, a nutrient gradient, right? This, these are the energy molecules that these, that this, you know, project, this life form, this biome, this ecology, this ecosystem we're creating uses to build the things we want to build.

So we can be distasteful about the source of money, but unless where, where it has money that's, you know, it's a Petri dish. Yeah. Yeah, exactly.

And, and the you, and, and I think, I think I hope, you know, the economic drivers, you know, ahead of us, you know, in the relatively near term in the next five years and during this decade, will continue to drive us towards more positive outcomes and, and, and easing some of the consistent, whether the, you know, hack our infrastructure problems or hack our brains problems. Um, Yeah. Yeah.

I, I mean, I, I know we're bumping up on time, but with, with the inevitability curve side of it and, and, you know, throwing the ball out 10 years time, I, I do think some of the fundamental assumptions that we apply to, to a flat global internet, uh, probably gonna get challenged fairly heavily over the next period of time. And at that point, you know, the role of networking, the role of the interface and, and kind of the nature of those abstractions becomes pretty important from a security, confidentiality, integrity standpoint going back to where we started. Right?

Um, you know, I do think that, um, I, I, I, it's one of the things I love most about cybersecurity entrepreneurs. Like we can sort of look at things and realize how deeply broken a lot of the infrastructure that the world relies on is, and how much of a miracle it is that anything works at all to begin with. Um, and still have this sense of optimism around a brighter future.

And like being able to actually look at, take some of those problems and turn them into things that are more resilient, that are, you know, better just in general. So, you know, I, I, I refuse to budge from that overall point of view, but I do think that, you know, there, there's some, there's a lot of black swans circling the lake, um, at the moment. And I think there's, there's some starting to land in various places and just thinking about like, what that does in terms of accelerating shifts in, in how the internet works, how we think about like our overall cyber space, um, and, and then what we're doing around securing it.

I think that's a really good thing for people to put their futurist cap on and think about a bit and not get too gloomy about it. 'cause some of it gets scary when you, when you think it's through, but if you sort of come back to this idea of no, as a species we're resilient, we go forward, we've got solutions, and we've got this shared sense of ownership and wanting to, you know, work for the good of the collective as well as for ourselves. Um, you throw the hacker spirit on top of that, I think we can come up with some pretty cool solutions as we go forward.

But yeah, it's, um, it's a good one to think through and actually game out a little bit. I think. Well, I, I can't think of a better way to end it, uh, than that, you know, throwing the hacker, uh, spirit on top of it.

'cause I think we, we have to, and we do. It's a human thing to do. It is not just you and I, you know, all of you out there.

You don't think you're hackers, you're hackers. Yeah. You know, think about how you got through last week and that, that thing you did that wasn't supposed to work that way, but you figured it out and you did It.

Yep. You tipped it upside down, you saw it fall out, fell out, and then you reassembled it into what you wanted and needed. Like that to me is the hacker spirit.

Yeah. Yeah. Well, thank you for your hacker spirit.

Thanks for your friendship, all the work you've done over the years for your Wayne today. Absolutely. Good to check.

Thank you. Appreciate It. See you too.

And everyone else out there, thank you very much. Uh, take care of yourselves. We'll see you again on another episode of the Inevitability Curve.

This is Textron tv. Hey, everyone. We're live back here, live at RSA conference today, closing out our Wednesday coverage, uh, day three of RSA.

Um, our next guest is from Qualys, a company you all are familiar with. I assume all of you are familiar. We covered them enough here.

Um, her name is April Lenhart. And April, first of all, welcome to Tech Drunk tv. I know it's your first time here with us.

It's great to have you on. Great to be here. You certainly look very different than most other Qualys executives we've, we've interviewed over the years, so it's fantastic to see you.

Um, April, why don't we start with what your present position is at Qualys, and if you wouldn't mind, tell us a kinda little bit of your career path, you know, what your story is. Yeah, Absolutely. So I'm a principal product manager at Qualys, and my, the main thing I focus on is cyber threat intelligence.

So at Qualys, I'm going to be working on really bringing cyber threat intelligence to, to the fore, working across all of our different products, seeing where we already have cyber threat intelligence and really bringing that out into a new product. In my past, I've worked as an Intel analyst and from there moved into cybersecurity, working as a product manager at all different companies each time, really working on kind of nation state level actors and looking at how to bring out cyber threat intelligence across the industry. When you were an Intel analyst, I assume it was for the government, some sort of agency or something, or private Company as a contractor, really.

Yeah. And doing kind of the same thing, uh, geopolitical threat analysis. Um, I was the person who would walk into a metro and say, what is a physical threat vulnerability analysis look like?

So when I then transitioned over to cybersecurity, it was like, oh, hey, this is what red teaming is. Right? So I knew it from the physical side and then got to do it on the cyber side.

Excellent. What a great story. And then you're also an adjunct professor at George Washington.

Is it Georgetown or Georgetown? George Georgetown. Georgetown George.

Yeah, Georgetown. George Washington has a great pre-law program. George Washington University, but so does Georgetown too, actually.

Uh, but that's fantastic. And what do you teach there? It's at the, uh, security studies program, and it's called Cyber Threat Intelligence and National Security.

The goal is for students who don't have a really technical software engineering background or computer security background who want to know more about, again, those nation state level actors, those apps, they get to dive into the world of cyber threat intelligence. I love that. April, I, if you don't mind, I want to, as I said, most of our audience knows Qualis, worldwide leaders started really out in vulnerability management and vulnerability detection, and now vulnerability remediation, uh, threat intelligence.

Uh, there's, there's many facets to the Quali, Qualys product line at this point. But let's, let's talk a little bit about cyber threat intelligence. Now, Qualys, I think they had a research team, a cyber research team for a bunch of years.

Yes. But in the last two, three years, they really tried to turn up the threat intelligence knob because they want to integrate it into the, the dashboard view right? Of, of Quas QBR and everything.

Um, as part of your mission, what are you gonna do to the existing offering that raises that bar? So I love that you brought up the analyst team. The threat research unit at Qualys is over a hundred analysts.

It's a very, very big team, and my goal is to really accentuate the work that they're already doing and really just bring it to the forefront so people can really get a better sense of what our analysts are doing on a day-to-day basis and really contextualize that information. So we're going to be able to see really quickly with any vulnerability or with any misconfiguration, um, what are the industries involved? What are the threat actors involved?

What are the locations, uh, both from the victimology side and from the attacker side, really bringing all of that information so it's really quickly and easily, uh, easily accessible. Absolutely. And I think that is the mission for Qualys, right?

It's 'cause I, I remember speaking to them, whether it's Qualys own cyber risk, uh, threat intelligence feed, or even harnessing and plugging in the third party feeds. It's, um, it's a valuable addition to the kinda risk dashboard, if you will, that they're, they're, um, developing. The other thing I wanted to mention is, you know, we were at the Quas QSC, I wanna say it was in Austin this summer, maybe it was right before summer.

And, um, they, you know, they introduced this whole rock Yes. Like, concept of a rock. Yeah.

Not a sock. A rock. Yeah.

And again, that's another area where the thread intel tell, right? That's, that's how you know, it, it, it makes its way to, to operators, right? Yeah.

Who can use and act on that. Absolutely. So the risk operations center of rock is the idea that big enterprise threat management, you take all of your intelligence, you take all of your unified asset management, and now on top of that, you're also going to bring in essentially the probability of how does it affect me?

How does it affect my business? How does it affect not just kind of overall the industry, but how does it take my business into account? So you're looking at across all of the different assets that you have as a company, and you're then saying, how does that specific, how does those specific assets that I have, how do those relate to the major CVEs that we're seeing?

Um, so you can really stack rank and identify what's important to me, what do I need to patch if I don't, what are the major consequences? And you can even associate it by, you know, specific industries or, sorry, uh, specific, um, parts of your business. And then within those parts of the business say, okay, if I don't take this specific CVE into consideration, how much is that going to potentially cost me?

So it's really think of a risk operations center as not just saying, this is asset management, but also here is how I contextualize it for my own business, which is really taking it a step forward. Got it. Um, now I, I realize you, you've only been on a few months and there's a lot of things, a lot of plans, a lot of offerings that are still coming together, right, for sure.

That aren't public yet. Um, but what do you think to date has been your biggest kind of impact on this, you know, cyber risk intelligence or threat management for, for the Qualys product? I like to think that right now it's bringing in that contextualization piece.

Yeah. So again, just coming in as a, a subject matter expert, being able to lend the lens of this is what, as an analyst, this is what I would want to see. So very similar to how a rock, uh, brings in that extra layer of contextualization, I also want to come in and to say, this is how it would be relevant to the greater industry.

Got it. If you don't mind, I want to turn to RSA this week. Uh, you know, as usual, RSA is chock full of security people, right?

And a lot of security, 600 plus sessions, all kinds of things going on. You are on a panel I hear Monday. Yes.

Tell us about that if you can. Well, honestly, the best part was that since we were the very first session of the very first day, we had first mover advantage. So anything we talked about was just going to be repeated by everyone else the rest of the week.

Um, That's how these things go. And that was ideal. So our panel was on AI and GRC governing risk compliance, and it talked about everything from kind of our outlook on AI as a whole to getting a little bit more into GRC where the industry is now, and where we see it going in the future.

Um, so tell us about it. I mean, 'cause I mean, look, certainly AI is the talk of this conference as it is the talk of everything in tech today, you know, but one of the things we've been talking about here for the last two, three days is no doubt it has the potential to be huge, but how real is it, how much of an impact is it making today in, in the field of, of, of governance risk and compliance GRC? How big is AI today?

Not what it could be, but today For sure, there are a lot of ways that it's already made a major impact in terms of being able to scale up way past what otherwise a human would be able to do, right? So there's a lot that AI has already been able to contribute to as far as adding in metrics, again, adding in contextualization. However, there are definite, uh, limits to what humans are comfortable with and what companies are comfortable with deploying.

For example, we still haven't gotten to the point where you can have age agentic ai. That is where we're completely comfortable saying, you know, set all of these rules and, um, completely act on your own free will to determine if you see any new threats, block everything essentially. Like think of like a, a completely automated SOAR where there is no human involved in the process.

We have not yet gotten to the stage where we're comfortable with a human completely being removed. We still want there to be that emergency stop button. So it's fair to say that AI has really significantly contributed to having us grow in this industry, but we aren't completely there.

We haven't reached that pinnacle of saying, yeah, we can just set it and forget it now. Right. Um, Well, and, and I don't know if that's a worthy goal, to tell you the truth, maybe may just maybe the, the future of ai, at least near term, short term, is just to enhance the human, not to replace the human right.

And I, I, you know, I think that's a good lesson for all of us to look at. You know, a lot of CEOs and, you know, executives get up there and say, we could cut head count. I could get rid of all my intern junior coders, I could get less security professionals.

No, that's not really what it's about. I think not today anyway. I, I think today it's more about how can I make more my people more effective?

Sure. How can I enhance our security posture that, and it's, and it's AI in conjunction with a human helping a human. I heard someone say it at an event we put on Monday, and it really struck me at this point in the day, game AI is a co-pilot, not a pilot.

Yes. I think that's a very apt way to put it. Yep.

Uh, AI is a really great tool for augmenting what you already have as a way for thinking of unique solutions to a problem if you are able to then correct it. Yeah. It's not a great way of teaching new solutions to a problem when you don't already see pathways to get there.

So in the same way, um, within GRC, it is a very good way of saying, you know, I already know how to get to the end. Show me different ways to get to that same end. It's not a good way of saying, show me, show me brand new things where I don't already know what to do.

So, Got it. Very similar. April, I want to wish you success in this new role, fairly new role at Qualys.

We'll be watching to see what comes out on threat intelligence. I actually, I'll say it here, we're actually gonna be at the next, uh, QSE Qualis Security Conference, which I think is in Houston. And we'll be, you know, shooting live there.

And we'll catch up there. Thank you so much for having me on today. I really appreciate it.

Nice meeting you. Okay. Great to meet you.

April, Len Hand, uh, Qualis, I, I forgot your title. I apologize. Principal Product manager, Principal product manager, Qualis here on Techstrong tv.

We're gonna take a break. We'll be back. We've got a few more interviews to do today before we wrap up.

Day three, you're watching Textron tv. Is the cloud costing you too much? Have you put too much in the cloud?

Do you know what you've put in the cloud? What data, what applications is it the right place? Our cloud economics and scaling smarter in the age of data abundance vital to your organization?

Join the Tech Field Day podcast and we'll find out. Welcome to the Tech Field Day podcast, where we bring together a group of IT technical experts to Discuss a single idea about key concepts in the industry. This podcast features a variety of perspectives from members of the Tech Field Day delegate community.

It's often recorded in association with one of our events. Tech Field Day is part of the RUM group, and this podcast is also published on our sister company's website, tech Strong tv. On this cloud Field Day episode, we'll be discussing cloud economics and scaling smarter in the age of data abundance.

But before the discussion, let's meet who's on the panel today. Hi everyone. I'm Ruthie McGee, a technology consultant specializing in enterprise architecture, particularly with cloud AI and security intersect.

Hi, I'm Mitch Lewis. Uh, I'm a analyst with Signal 65, which is, uh, part of the FU arm group. Um, we do all sorts of, uh, performance benchmarking, um, and, uh, third party product testing and validation.

And I'm Alistair Cook, an event lead here at Tick Field Day, and the event lead for Cloud Field Day. This week we're talking about cloud economics, and I've always said that the wonderful thing about the cloud is you pay only for the resources that you use and that the terrible thing about the cloud is that you pay for all of the resources that you use. And so we want to think about scaling smarter in the, the age of data abundance where we've generated huge amounts of data, we've stored that data.

We've often not really known the value of the data we've stored, but we've had to store it because unknown value is supposedly infinite value. And yet, when are we gonna extract that value? Every day we keep this huge amounts of data on our, um, cloud storage.

We have to spend more money on it, more and more and more money as we accumulate more and more data. Where's the value coming back out of that? Mitch, are you seeing anything happening along this space about either making storing data more intelligent or extracting data intelligently?

Yeah, I mean, I think, you know, you, you kind of hit the nail on the head of, um, you're gonna pay for what you use. So, um, I think it's important to, uh, understand what you are using and why. Right?

So I think it's still a challenge. I think there's been, uh, a handful of solutions, you know, trying to get at this in terms of, uh, data visibility, you know, data insights, um, and then automating some of those actions of, you know, can you tear this off to, um, you know, S3 or, or something, uh, you know, glacier or something that's gonna be cheaper. Um, if you know what it is, can you actually delete it?

Uh, which is a, a concept no one wants to talk about. Um, and then other tools too that are, uh, you know, kind of more in the finops space that actually look at, um, trying to understand your spending. Um, but I think it's still a big challenge because people just wanna store everything.

Um, and there's this, you know, kind of concept of the, the data iceberg where, um, you know, you have all this data and you kind of know a very small amount of, you know, what it is that's actually useful. And then there's this much larger amount of data that's kind of under the water, um, and you're storing it. Uh, you don't know what it is, you don't know if it's even useful.

Um, and then you get these planning cloud costs. Ti is your designing solutions that actually get deployed out on public cloud. Is data volume an accumulation of data a a big consideration as you're designing these things?

Absolutely, and, um, you know, in my work with strategy, it's quite interesting when you're talking to CIOs about cloud economics, it's, it's almost have has the cloud. It's not that the clouds failed to deliver, but the value stories become harder and, and to defend when costs scale faster than the impact. And we're not in those early days of the lift and shift days anymore.

And so the real pressure really is on optimization, right? Sizing instances, managing those egress fees, consolidating storage tiers, automating policy based controls. So it's no longer nice to have it's baseline expectations.

That idea of cloud ops seems to be, be very much stronger than I, I certainly saw it probably three, four years ago. The idea that, uh, that there is a, a corporate level requirement to look at how we are spending money on cloud, we aren't just pouring more and more money into the cloud. We're actually looking for, uh, getting value back to business from it, understanding where there's waste, um, where there is resources that isn't delivering the value we want for it.

And also where there is insufficient value because we're not actually buying enough resources, and this is a double-sided thing, we can always reduce our cost by using less, but then we maybe get less value, um, the idea and synopses to get that attachment between value and cost so that we are getting value for the money that we spend. That's right. And I personally am an advocate for not just, you know, we're not just dealing with a technology change.

It's, it's a strategic reset and, um, and a mindset shift. Uh, so not just kinda of trying to juggle through the tooling that we've got and, and, you know, the obvious pressures of budgets and the fragmentation of data and, um, also major shifts in the vendor landscapes, like the VMwares, uh, transition from under Broadcom. So that's had a ripple effect through the market, and interesting to see, uh, the broader decisions that are made around that.

I think there's also, you know, opportunity for organizations to kind of stop and, and, and puzzle a bit and think, you know, actually ask, does this belong in the cloud? Um, right. I know, I know this is the, the cloud podcast, so maybe I shouldn't say that, but, um, you know, the, the cloud costs money as you use it.

Um, and it's great for some things, and I think, you know, a while ago there's the idea that we're gonna put everything in the cloud, it's perfect for everything, um, and then it gets expensive, so you need to pump the brakes on it, right? Um, I think one example of this that I love, I love to bring up whenever I can, um, but is ai, right? So, um, there's certainly some reasons to put AI in the cloud, and there's some reasons, you know, maybe not to, and cost is, uh, definitely one of them is it's gonna be, you know, be one of your most expensive potential AI applications because of, you know, a really, you know, big GPU compute instances, uh, potentially huge data volumes, things like that.

So, um, I think beyond just, you know, sizing instances and, and knowing what your data is and, and where it is in the cloud, um, another way to kind of manage your cloud spending is thinking about, you know, should I even put it in the cloud in the first place? And one of the things I, I think is, is vital in our cloud field events is the perspective of hybrid and multi-cloud. As you say, not everything belongs in the public cloud.

Some things really should be running on, on hardware that you own inside your data centers because it's more cost effective where you have a, a flat line load to place that somewhere where you, you don't have to, uh, pay for the possibility of near infinite scaling that you get on the cloud and you need enough scaling to accommodate your workload. You don't need, uh, if your workload isn't, isn't scaling by a factor of 10, well then you don't need a factor of 10 with headroom, and you don't need to be paying for it. Uh, of course, scalability isn't the only reason for going up onto the public cloud.

And I think, Mitch, you hit a really important one with ai. Uh, we saw in the AI infrastructure field day last month that there can be hugely expensive infrastructure to build foundation models and to do a lot of training, but when we get to maybe some fine tuning, maybe some retrieval, augmented generation, uh, this inference stage when we're actually getting the business value can often be run on a, a much smaller kind of device. Uh, we saw a couple of solutions of using SSD as a tier for the, the memory, uh, in A GPU, a much more cost effective way of running a large language model that you probably aren't, you only see in the cloud for a while, but you could possibly deploy even out to your edge locations right now.

So I think that there is a whole lot of other solutions for AI that are coming along. I've thought for a while that just more and more resources, larger and larger data centers isn't a, an infinitely scalable solution to the massive scaling we're seeing with ai. They need to be other solutions that assist us with that scaling.

And I think one of the central, uh, elements of our, our premise here was about the massive growth of data and Mitch, uh, that transition from storing your data on your EC2 instances or your, your virtual machines using block storage towards using object storage is, is an obvious one. But even then, that object storage, you're gonna be paying for your, your capacity consumed every month forever until you get rid of that storage or those, the items on the storage. Uh, I think there's, there's some real challenges about knowing what to retain, what you're allowed to delete.

Uh, and I think this is gonna be a really important part of cloud finops in the coming months and years. Some organizations are already there, uh, some are already facing huge costs for the S3 stories that they've just been bucketing away for years and years. I think there's some real challenges around data volumes.

Yeah, I think absolutely. And, and that's why you really need to know, you know, what the data is, um, you know, and how important it is, how likely are you to need it? Because, um, yes, there's S3 and then you get into, you know, your glaciers and your, your deep archive, um, things that can really help you, you know, on the economic side.

Um, but if you do need that data, it's going to cost you more to get it out. So if you're constantly, you know, uh, paying those fees, uh, then you have a problem. So it's, I think it goes a lot into, you know, knowing what your data is, um, and then even can you get rid of it, uh, which is something no one wants to do.

Uh, no one ever wants to delete anything. Um, but I, I think, you know, it gets to a point where may, maybe you should in some cases. Um, and it all goes back to, you know, what is data?

Well, you know, data is, is nothing but kind of your ones and zeros. Um, but where do you want it? Uh, you know, data can kind of turn into information that can be valuable.

So, um, you kind of need to think about it that way. Then you can understand where can you move it, uh, where can you place it that's gonna be, uh, cost effective. Um, silos is what comes to my mind first when I think of the word data and the challenge for, um, unifying our fragmented data and, uh, you know, we've built incredible cloud systems, but often we've just ended up with silos.

Everyone's get got their own little cloud, that they're cozy in different clouds, different stacks, limited visibility. And, um, you know, one way of looking at it is unified data doesn't mean everything in one bucket. It means consistency in the metadata, access control and governance, regardless of where the data lives.

And I think that consistency in that governance needs to be set up real early. I think this is one of the, the challenges of the early adopters of cloud that have poured lots of data into, um, maybe into, into a, a data lake or a data warehouse and otherwise have, have poured data into an S3 bucket without that good metadata, good, uh, governance around it without really knowing what's there. And this is gonna be a sign of maturity for people as they're designing solutions on public cloud and equally on, on private.

I mean, it's just as difficult to delete things off your on-premises, uh, storage as it is to delete things off, off the cloud. Uh, getting that data governance in early and understanding that the value and the retention requirements for the data you're storing, I don't think that's a, an entirely new, uh, story. It's just that it, the pace of innovation, the diversity of types of data that we have retained in the cloud has led to challenges because we were very fast to retain it, and not necessarily as fast to put the categorization and the governance around, but, uh, it's, it's really something that needs to be done up the front rather than being retroactively headed afterwards.

So maybe the best time to consider or reconsider how we treat data, not simply as a system output, but as a strategic asset in its own right. And find those data owners if you can. And then kind of the, the flip side to, to, you know, all this in terms of like, uh, you know, tearing your data off or, or deleting your data, it's not useful.

I think the other thing that now everyone wants to do is, uh, not only hold onto everything just because they do, but, um, hold onto everything just because what if it's helpful for AI training? Um, right. That's, that's the other thing, um, that people are really thinking about now with all this data.

So, um, kind of just causes a, a bigger headache, I guess. Um, but no one wants to get rid of anything because it could be useful, uh, for some AI training, uh, some AI model down the road. Uh, so kind of how do you, how do you reconcile that also?

Um, and the, um, one of the, the things that immediately comes to mind is that we'd often hold multiple duplicate copies. And this hits at some of Ty's point about the fact that we get siloed solutions. We get the right tool used to solve an individual problem, but not necessarily the right tool to, to provide good data governance and, uh, microservices architecture.

Each microservices responsible for its own persistence, if it requires any, that leads to that fragmentation of data, but also duplication of data, paying for multiple copies of the same data in, in multiple different places. I think, again, there's a, um, a data management asset management element of, uh, designing your applications around the idea that we should only be storing this piece of data once. And when we start looking at taking live data and copying it into our data warehouse at, at our lakehouse, then we're inherently creating additional copies of data.

Maybe that's gonna come back and bite us some more as well. Maybe we need to be working with a single unified copy of our data, which is used for both reporting as well as transactional basis to minimize that long-term cost of retaining everything, or multiple copies of everything over time. Used to be easier when we used to just store numeric data, and we used to be able to do things like summarization of numeric data, but as soon as we started storing large amounts of text and then images and then video and all of the messages that we have in our various chat-based tools, we use Slack extensively within the Futureum group.

Uh, those pieces of data have value, and they're much harder to summarize, much harder to condense these things into a smaller but usable unit. And Mitch hit another point that's really important around the cost of retrieval. If you have stored all of this data without good governance, and it's sitting out on Glacier Deep Archive and you now want to retrospectively add governance, well, you need to actually retrieve that information to know what it's, and that's really expensive when you're using deep archive compared to the cost of leaving it where it's, so there's quite a lot of barriers to retrospectively adding this governance to, to your solution.

You know, a lot of this conversation just comes back to the need for, um, you know, data management, and that sounds really, you know, straightforward and obvious, but I think, um, a lot of times it gets kind of pushed off to the side as, um, you know, there, there's certain things that it, organizations are gonna say, you know, they must have, uh, you know, certain performance metrics, maybe certain, uh, you know, recovery objectives and data management kind of gets put into this bucket of, well, that would be nice to have. Um, so it doesn't always get worked in. Uh, the other thing is I think data management is a really loose term, so it's hard to fully wrap your head around, you know, what does it mean?

There's a thousand different companies out there that say they're doing data management. Uh, some of them are, you know, more, uh, really more data protection, or some of them are more security, uh, some of them are more, uh, you know, govern governance there. There's all sorts of things, but I think there's a more encompassing, um, uh, superset maybe of, of data management that, you know, maybe it does do some of the data protection, but also does some of this, uh, you know, metadata ca cataloging, things like that, that help you, uh, understand what your data is.

It does some of the archival or, uh, data lifecycle things, um, maybe some of the, the finops stuff. Um, and, you know, I think with cloud, with, you know, hybrid cloud, multi-cloud, um, data management does become pretty important. Uh, and when you look at the, you know, the economics and the cost, um, I think it starts to move the data management piece from that kind of nice to have add-on feature to something that that really is a, an important kind of checklist, need to have item.

And I think that's probably where we are headed, right? Cloud economics as a capability, not just a cost center. So I'm thinking, um, a way to sharpen focus, improve our planning and building infrastructure that's not just scalable, but it's sustainable and it's, and it's honest, and we're held accountable for those, um, big decisions that we make.

We don't often hear the, the term honest attached to, um, to descriptions of architecture. And I think it's an interesting concept of the being clear about what it is we're doing, why we are doing it, and what we're expecting to happen as re as a result. Uh, that's a, a really interesting, uh, characteristic to, to want to have in, in your infrastructure design and, and your data handling it and your business in, in general, uh, think a yeah, vastly undervalued concept that I really haven't, haven't seen, hadn't thought of as, as being a vital part of designing infrastructure and designing, uh, uh, solutions.

Um, I think, you know, maybe, maybe one thing too that, um, can help with, you know, the, the cost issues, the data management issues, um, I'm gonna sound like a broken record here, but, uh, ai, right? So, um, if you can actually automate some of this away, um, with, you know, some, some intelligence that can actually look at your, your infrastructure, look at your, um, you know, data sprawl or data, data silos and, and kind of, uh, maybe help you figure out what's going on, um, you know, maybe that's a future path too, that can, that can actually, you know, help, um, create kind of like a intelligent data management solution. Yeah.

Just one last thought from me. Um, I think enterprises need to consider architecture that can pivot without rebuilding from scratch. So potentially that could mean favoring vendors with open ecosystems, walkability, and trusted transparent partnerships.

Um, you know, trust and honest complex words. Uh, we often put our KPIs first to progress our careers. Um, but yeah, I, I think that speaks to personal passions and, and, and, um, just getting the right people in the room often Understanding who was going to be the right person, who was the right stakeholder, who was, who was the right, uh, owner of data, owner of that, that, that long term.

And I think your point about being able, being in an open ecosystem and being able to then use that as part of a, a pivot mechanism, understanding where you are choosing to become more locked to one particular solution and consciously making the decision that the value of being locked in that solution suits our business, suits the compromise of being, being locked, and other times choosing not to, to get locked. Maybe ch choosing a higher cost to achieve an outcome, but to have flexibility in the future for changes. Uh, one of the things we do know is businesses will require change over time, and often that change will be unpredictable, that we will not know this year the changes that are gonna come in our business next year and require us to reevaluate our assessments.

Uh, one of the things that we talk about quite a lot is as you're designing a solution to document not just the outcome of your decision, but the logic of your decision, you know, the inputs, why do we make the decision to choose this particular vendor? 'cause if those inputs change, we might want to change the output. We might to want to change which vendor, but if we don't know which inputs led us to choose this vendor, we might not be able to move away, or we might move away in a way that's inappropriate because we've forgotten that there was one crucial factor that meant we needed this particular vendor solution.

Um, but uh, having that knowledge that that, uh, source of truth about how we made decisions is often really important. Yeah, I think just that whole idea of, you know, being intentional, um, is important both with, you know, selecting the vendor, but also, um, you know, we started this kind of talking about, you know, scaling, right? So are you scaling, um, really because you, you need to, it makes business sense, it makes economic sense.

Are you scaling, um, because you're in the cloud and, and you can, uh, because you don't wanna delete any of your data. Um, uh, so you know what, what you need to kind of like look at why you're scaling, um, and being intentional. So thank you all for joining us today on the Tech Field Day podcast.

Before we go, where can people connect with you and continue the conversation ti Well, I'm on X and my handle is Rich McGee, um, and LinkedIn. And, um, I'm really excited to share my thoughts as we move into dialogue with our special vendors. com.

Um, I'm also on, uh, Twitter, um, and on, uh, LinkedIn as well. And of course, I'm Alice De Cook, and you can find me as Demi Tess nz on a whole bunch of socials. com website.

So thanks for listening to this episode of the Tech Field Day podcast. If you enjoyed the discussion, please subscribe on YouTube or your favorite podcast application so you don't miss an episode. And do consider giving us a rating at a nice review.

This podcast was brought to you by Tech Field Day, a part of the FU group. com/podcast or view us on text on tv. Thanks for listening, and we will see you next week.