Securing AI-Driven Development With Qualys with Kunal Modasiya

Hey everyone. Good morning. Well, maybe it's afternoon where you are, or evening.

Evening, but good day. Anyway, uh, we're back here Day two, Qualys Rock on coverage. I'm really happy to welcome back to our interview desk, Kunal Modia.

Kunal. We usually talk every year You're here when I'm here, of course, probably three, four years already. Um, but Kunal, not everyone remembers why don't, so why don't we start off, give them an idea of what you do and at Qualys and your role here.

Yeah, for sure. So first of all, thank you for inviting me, Alan. My pleasure.

It's been a pleasure talking to you for last three years in a row, Uhhuh. Uh, the thing is, every year I'm talking, there is a gap of a one year, and then I'm taking on additional ownership, additional responsibility. So now, beginning of this year, I have been promoted to senior vice president of product management, where I'm leading majority of the policies product that includes our on-prem BMDR, then the cloud application security, eliminate product, AI, security.

All of this portfolio now is under me. So it's been a very exciting time and I'm with s for the last seven years, and I'm, uh, co ang I was here first time from 2018 to 2021. Then I took a 10 months break, and then I came back to the quali.

So it's been a very exciting ride and, uh, firsthand experience of seeing through how the cybersecurity industry is evolving and being a part of that journey is extremely I'm, I'm proud of. And I will tell you, you know, I've been in cybersecurity 25 plus years. Just being in tech right now is so exciting, right?

There's so much, this AI stuff has so much potential, potential for bad and good, but that's the way of it, right? But it's such an exciting time as we're seeing so much more code being developed, so much more innovation disruption. But it, it's challenging too.

And, and, and like everything else, security, like every other technical innovation we've seen, security is sometimes the last thing that catches up, so to speak, that, you know, they go full speed ahead and then say, what about the security? Right? Totally.

So if you don't mind, I look, the, the, the, the Qualys, uh, portfolio is broadened of course. Yeah. But I wanna focus first on ai, of course, the challenges as well as the benefits that you're seeing in the Qualys product, uh, line up as a result of it.

So why don't we go there, Kal? Totally. So let, let's first understand from the customer or organization perspective that why they are embracing the ai, right?

So with ai, as you rightly said, with the ai, now you can write the code faster. There is a concept of a vibe coding. I'm sure you are hearing that.

Sure. Everyone's Got very even non-technical user like you and me even can perhaps write the code with the AI tools, and it generates the code at unprecedented speed and scale. What does that mean?

Now that means that more lineup code will be written, more number of applications generated with the AI code will be deployed, maybe running in the production environment. What does that mean? That means that now you are living more and more and more holes in your system, in your code, in your applications for the attacker to exploit.

In other word, as organizations are adopting the AI technology, be it a generative AI LLM model for their own training purpose and, and embedding that with their core business application. Now, with the more usage of the ai, you have a same issue of vulnerabilities. You have same issue of a malware, you have a same issue of a data leakage.

All of this new set of challenges Are coming in for the ai, and we call it as AI attack surface. So now as organizations are embarrassing, the AI attackers are now looking at how do I attack the ai? Sure.

Right? And that's where then the AI attack surface is constantly evolving, right? Organizations are either looking for the AI model from the cloud service provider like AWS Azure, or they're looking into the third party, like, uh, open source, like a hugging face and other places, or they're building their own, which is very rare, right?

But still, you see that the AI sources are everywhere. And as organizations are embracing, you are definitely bringing in good and bad, both, as you said, while it is helping you with the agility, business agility to meet your end user need faster. But then as you rightly said, the good is also bringing bad, right?

So that's where we are seeing challenges. That's where we see the curiosity from our customer. Yeah.

Uh, about, Hey, how do I even know that? Where is the AI running in my environment? Yeah.

Yeah. I mean, so look, I'll put some numbers to this. The stats we're seeing is about 90% of developers are using AI to help generate codes A hundred percent Since nine.

I mean, totally Critical man. Uh, 40%, 36% don't trust it. 65% thinks think that it in introduces instability, if not insecurity, instability into the code base, but yet 90% is still using it.

Totally. So from a security provider's point of view, what are you supposed to do? They're absolutely going to use it.

We know it's probably not. There's going to be some, you know, vulnerabilities instabilities that it, it, there's gonna be problem with code on it. But do we wait until after it's deployed to find out, oh yeah, do we put in some testing or, and, and we gotta make that automated?

So we're using AI to check the ai. I mean, how do you feel about that? Yeah, no, this is a great question.

A right, and the very short answer is a proactive versus reactive. Yes. Right?

Now, so far the, with the security operation center that organization have put together the approach is more about a post attack, which is more of a reactive, right? Right. Where hey, organizations are using ai and then security team is always late in the game in figuring out, right?

And then when something becomes incident in your soc, then they are starting to investigate and doing the firefight. The approach that quality and the vision that Quas has come up with, and which is resonating very, very well with our customer base, is the proactive approach to the risk management. Not only just the ai, but with IS cloud, or whether it is on-prem or whether it is application security.

You need a proactive approach. Right? Now, let's drill down this proactive approach.

The risk operation center is what Quais, uh, has coined the term. And this is the vision that we have for our company and for our customer, is to do the proactive risk management using the risk operation center so that even before, uh, in, before the threat become the incident in your soc, you actually want to proactively look at the threat and fix it, remediate it, right? So now let's drill down this from the AI perspective.

What should organization do? Because look, believe it or not, your engineering team is going to use the AI to build and ship and, and sell the customer Absolutely. Right?

To gain the, gain the competitive advantage and speed to the market. Without ai, you cannot do it, right? That's the fact.

So now what, what we have come up with is the AI security posture management product where, ah, you know, we have a first thing is the visibility into everything. Ai, meaning where the customers are running ai, whether they are coding with the AI tools or they have LLM model in their environment, whether it is on-prem or they are basically integrating with a third party, like a hugging face and other Yeah. Or they're relying on the AWS Azure, like a bedrock service or Azure AI service where the LLM model, the service providers are giving them.

Yeah. So these are the different, different sources where oration are basically getting the LLM model or the generative ai. So with what we do is visibility first is the discovery and visibility into all of the ai, right?

Second, it's not just about the model. AI model is the one part. But if the organizations are running the AI model in their environment, in their own data center, that means there is Nvidia GPU, that is A-M-D-G-P-U.

So we also look and profile and discover all of those AI infrastructure. It's just on the AI model. What about, what about Gentech ai?

There you go. The third point that I was coming to is that this days is now organizations are looking at deploying the agentic ai, AI agents, right? Right.

To automate and to do many of the tasks that, that are like a mundane task that they want to outsource, right? This is where the discovering the agent T-K-I-M-C-P server, right? Because organizations are now building the MCP server, which has become a new protocol or a new standard for the communication between the AI powered application, right?

So with our product approach is that, hey, we are going to discover all of your MCP server, ah, all of your AI agents, wherever they are running, whether it is OnPrem or in the cloud, we are going to discover all of your AI agents. And then discovery is the first part. You need to know first all of that before you even defend it, right?

So that's a discovery. Second thing, what we do is a risk assessment. Let's scan those model for vulnerabilities.

Let's scan those, uh, models or the agent take AI for the prompt injection, right? For example, if you ask the chat GPT or the AI agent and assign them a task to say, make a bomb recipe, then how are they going to respond? So we do all of those gel break prompt testing to see that the AI model is behaving properly, right?

And then all the issues that we find it, then we help them fix it, right? So that's where, uh, we see that the AI security is heading, and that's how we call as a vision to help secure our customer who are adopting now AI everywhere, right? Including the agent PKI and the MCP server.

Love it. That's fantastic. Right.

Let me ask you a que for people at home, this camera here, where, where can they go get the information on this? 'cause this is something everyone is dealing with right now. Totally, totally.

No, great question. Look, uh, we have a many customers who are using our AI security solution. It's there already on our website.

Mm-hmm. com and they can see the total AI is the product name. So it's total ai.

Total AI is Total ai. Total AI is the product, which is where they can discover, get the visibility into everything. AI includes your LLM model, gen ai, your AI infrastructure agent, TKI, your MCP server, everything together, and then secure them, scan them, test per the, uh, prompt injection attack and other things.

So that's where they can go. And this fits into very well into policies, vision of the risk operation center, and I call it as a AI rock, right? And where customer can proactively remember Alan, it, it's more about like, like you rightly said, organizations are going to adopt the ai, whether you, how much security you try to enforce, they're going to adopt.

Okay? The way to do it is that be with them and not after them be productive, right? So that's the mantra.

One last question for you. Yes. Please.

Spoken to people who say you must use AI to secure AI to combat ai. What is the AI Qualys is using? Well, we, so If you could talk about it.

Yeah, Yeah, I will. I will talk whatever I can, right? Huh?

Obviously, but look over last one year or so, the space, the AI space has evolved so fast. Honestly, the whatever we were doing last year versus what we are doing today has changed. We are constantly adopting the new technology.

First we started with our own in-house on-prem, taking the model, uh, from one of the bigger provider and then training it. Now we realize is that, hey, it's investing this and building an on-prem thing is not gonna work. So now we are actually relying on some of the cloud service provider taking the out of the shelf, basically the, uh, model that is available.

And then that's how we are bringing in the agility in our own system, right? So obviously we have not built our own model per se. No.

We use, uh, one of, from the top one, and then we train this to our need, and then we use it for our own internal, uh, all of the products that we have for turbocharging and bringing the AI workflows and other thing. We use those model. And on top of that, we have built something called a judge service judge, LLM, that's our proprietary thing that Coly has developed on top of the existing model that we have taken on how to interpret the response.

That's AI model is giving In inference. Inference, right. So, because sometimes the AI model, you ask same question twice, both the time.

It could give you the different answer Though. That's what it's designed to do, right? So that's where never draws the same picture twice.

Exactly. Right? But for some of the define attitude answers, the answer is yes, only it cannot be known next time.

Right? Right. So, so that's where, uh, we have built some proprietary tech on the top of the existing, something we call the judge.

LLM Judge, LLM, judge, LLM is what we have built our own. So I think that is what I can disclose, but look good enough. The space is evolving so fast.

Very exciting. It is, and attackers are always ahead of us, as you know, they will figure it out a way. But you have to be always try to do, embrace the new technology.

And I firmly believe when there is a mega trend, like ai, you want to use as a tailwind and not the headway. Good point. Right?

Right. And AI, to me is a mega trend. The the biggest one I've seen, I think.

com and was here for a lot. Good. Now congratulations on the, the promotion.

Oh, thank you so much, Alan. Keep Up the great work. Maybe we'll see you before next year.

I see. Yes. I hope so.

Looking forward to seeing you. Alright, thank you. Always a pleasure.

Thank you guys. Have a good One. We're here at Qualis Rock on.

We'll be back with more in a moment. You're watching Textron tv.