AI’s Impact in Cybersecurity with Karthik Swarnam at RSA Conference 2024

This is Textron tv. Hey, good morning everyone. We're live here in San Francisco at the RSA Conference.

I'm Alan Scheel, CEO of Techron. And uh, you know what? I missed first time.

I missed the first day of RSA in maybe 20 years, but my youngest son graduated college, and I wasn't gonna miss that for this. So congratulations to you. Rad.

But I'm back here and I'm really happy to kick things off today with Karthik Swin. Sworn sworn them. Yeah.

Karthik is with our friends at Armor Code, and if you don't know about Armor Code, don't worry. We're gonna tell you all about it. Let's first, welcome Karthik.

Karthik. Welcome. Thanks for having you here.

Thanks. Thanks for having me. Yeah, Karthik, you and I were just chatting here and it's, you know, six degrees of separation in the security world, right?

Yeah, yeah. Excuse me. Turns out we have some friends in, in common.

That's things in common. Yeah. Uh, it's a small world out there and you've been in security a long time, Almost 30 years.

Yeah, Same here. Yeah, it's a long, that's of back on it, right? Yeah.

But, um, before we jump into armor code and announcements here, let's talk a little bit about your 30 years in security. Yeah. I mean, in the 30 years I've seen a lot change a little bit.

You know, one of the things is, you know, a few hundred people doing cybersecurity and they're title to a few million people. Exactly. It says exploded, I think rightfully so.

Right. So my experience is, you know, right now I'm at Armor Code, which is, uh, we're a product security product company as security company. We'll talk in a minute.

Prior to that, I was running security chief security officer roles for multiple companies, large enterprises, uh, in the us uh, all global enterprises. Right. Prior to that, I spent about a dozen years in, uh, big five consulting environment as well.

So I've kind of seen it, you know, how security has kind of evolved from one or two components that you need to worry about to multitude of things. And, and on top of that, now we have, uh, AI coming into the world, right? So, I had a panel yesterday, which was fantastic, which is, you know, how does the, how does security change as the world embraces ai?

Right? And the AI is definitely bringing in a lot of good things, but also for a security practitioners a little bit more challenges to deal with, right? Absolutely.

Abso I mean, think back to what, look, 30 years, 25 years ago for me anyway, security was really network security Absolutely. For the most part, right? And that moat and Castle defense and so forth.

And now, you know, the, there's so many different aspects and attack surfaces and everything else. It's just Yes. Who would've thought back then that we'd be sitting here now and, and I have this conversation with friends of mine who like us, have been in this Yeah.

You know, has, have we gotten better at security? Absolutely, yes. Right.

You think back to the budgets then, and what we had then and what we knew that we're so much more sophisticated now. But the fact of the matter is so has the bad guys. Yeah, Absolutely.

You know, that a lot of digital transformation. Yeah. You know, embracing everything is digital.

Everything is on your mobile. Right? So that's adding to that complexity.

Um, yes, we make it easier for companies to do, but that again, know, compute is cheap. Network is easier to access. Yeah.

It goes to the good and the bad, right? So Absolutely. So, you know, software drives everything today.

Um, so complication, I mean, complicated, uh, enterprises that we today live in. Uh, Absolutely. You know, you say software drives everything.

It's been that way for most of the last 30 years for us, right? You had a platform, you know, the Intel platform, where an interesting thing we're seeing with this whole AI thing is hardware makes a difference. Everyone wants their Nvidia, right?

Every, yeah. Everybody wants to make the next Nvidia chip, and all of a sudden we're starting to see people care about hardware again. And I got a feeling caring about hardware security.

It'll be closely behind that as well. Right? Right.

So product security is a big area now, right? Sure. All companies talking about products, right?

It doesn't matter if you're healthcare, you're, you're a financial services, you are a manufacturer, you're in the services business, you're in the retail business, right? So product, uh, application software comes in Absolutely As well. So Software, let's talk.

We, we could talk about, it's 30 long years all day long, I'm sure, but we gotta move it along. Let's talk a little bit about Armor Code. For folks out here who maybe don't know Armor Code, how would you describe it to them?

Yeah, so I mean, currently I'm the chief security and trust officer for Armor Code and Armor Code. We are an AI powered A SPM platform, you know, application security, posture management, right? Yep.

Today, everything is about posture management. And so we're able to collect all of the, you know, findings and, and one of the things that we're also doing is we're trying to shift the mindset from talking about vulnerabilities and weaknesses and findings and shifting that mindset to talk about risk, right? So when you talk about risk, you need to bring that risk element to a manageable, uh, fact, right?

So it's, you cannot be swimming in millions and millions of vulnerabilities and weaknesses, right? So what we do is we're a governance layer that powered by our AI capabilities, which actually then brings all of your vulnerability data, right? Where you're able to compliment and enrich that with threat intelligence, right?

We can talk about business impact of that critical assets that you have. Then it funnels you down to, you know, what you really need to focus on. So we're really in the business of let's fix what matters.

Yep. Right? And, uh, which actually then brings it to a manageable problem for very large enterprises.

So we provide that governance layer and a platform that helps you facilitate that journey and organizations to be able to manage that capabilities. Love it. Excellent.

Karthik, I think that was a great thing. Just before we jump into RSA kind of news Yeah, yeah. com.

Yeah. io doo Io. Yeah, absolutely.

And, um, yeah, absolutely. And, uh, you can go and then, um, you know, I'm available. My, all of our names are on the have website as well.

No, hit it. Absolutely. No.

Find us on LinkedIn. Find us on websites. Yeah.

For someone who'd spent their career on the private side, right. Protecting Yep. Individual companies making the move to a product company.

Sure. It's probably a little bit of a culture shock there. Like, Hey, you know, customers you, 'cause you now you're dealing rather than the vendors coming to you and making you crazy, right?

Yeah, yeah, yeah, yeah. You're now trying to help multiple companies Abs. Absolutely.

Right. You know, being So different mindset, You know, that's the other, the reason I moved over was how can I bring in the practitioner's point of view, this technology is, building technology is one thing, but from a practitioner's point of view, how do you bring that at Armor code so that we can create technology and solution that matters to the practitioners? Mm-Hmm.

Right. And that's, that's, that's my drive number one. Number two is, I mean, you're at a private environment.

At any given time, you're solving one enterprise's problem. Now, if we can create a platform, you can solve multiple enterprises challenges, right? So those are, uh, really motivating elements, right?

Of course, there is, uh, there's a learning experience when you, when you move on, uh, from a, from an enterprise or an organization to a product, a solution provider side of the house, which is an happy journey so far. Yeah. Good for you.

Let's talk a little bit about, we're here at RSA. People can see that, oh, that, those are the K nine dogs here. Yeah, absolutely.

Security's important. Security's been tied. Well, we had Anthony Blink in the, uh, Absolutely yesterday, Secretary of State here yesterday, so I'm sure they turned it up for that.

Yeah. But you guys made some announcements, made some news here this week. Why don't you, if you don't mind, share with the audience.

Yeah, So absolutely. You know, uh, we are moving from a generic platform perspective to an AI powered capability from a platform and a governance layer. So it's about AI powered A SPM, right?

We have, uh, uh, enormous volume of data that we have seen through our experience from a lot of the fortune companies that we have worked with, right? So we're now trying to take that and see how can we generate intelligence as a result of that, right? So, uh, it's about AI powered as well as a unification layer from a governance management and a gov creating a governance layer, uh, from all of your source data perspective.

So it's, everything revolves around AI capabilities for us now. So You're not alone. Absolutely.

So I, you know, let me ask you the hard question. Yeah. Are we, are we overdoing the ai?

How much of it is real today? How much of it is hype? How much of it is promise of what it could do going forward?

That's a very interesting question. The way you put it, right? I think when you go back to a large, you know, like, you know, traditional enterprises, i, I, I think it is, it is still, you know, coming outta the hype cycle, in my opinion.

Okay? Sure. Uh, but, but that said, there are very valuable use cases, right?

If you wanna generate customer insights, if you want to be in a marketing business, right? There are, if you want to be in the services business, right? There's quite a bit of use cases that are there.

So I don't think so we're necessarily overdoing it, but the level of attention that it has got is probably maybe disproportionate to the value that is generating in the enterprises, right? But it is just a matter of time, right? Uh, where, you know, every technology adoption used to be, you know, decades, then it became years, then it became months, right?

So I think these are like in a months category that I would put it on. Um, and I think the, the, the blessing is, uh, as we start to adopt all the technology providers are also embracing it. So it's not like, you know, hey, let's catch up game, right?

Which we have seen for the last 30 years in security, right? You know, we, we, we put something out there and we try to go ahead and security. We always talk about how does security begin to the ideation state, right?

I think in the AI journey, I think a lot of the companies are talking about how do you bring in security into the ideation state, right? So for enterprises, as long as they have the right use cases and they're focused on the right things, I think security is, you know, quite along to be able to embrace, uh, and enable the businesses. So I think security is quite along, and I think the AI capabilities we have now Yeah.

Are already valuable. Will they be more valuable three years from now as this continues to evolve? Absolutely.

Yeah. But I don't think an enterprise out there Yeah. Wants to say, well, I'm gonna wait, I'm gonna wait for it to be a little bit more mature.

I'm gonna wait for it to be a little bit more full featured. Because, you know, there's a war out there. We were talking about how 30 years has security gotten better, worse, et cetera.

Yeah. The bad guys are using it today. Absolutely.

Yeah. And if, and if you don't take advantage of every tool that you can to try to, you know, manage your risk and protect yourself Yeah. Shame on you.

Yeah, yeah, absolutely. That's kindly Absolutely. That's kind of my take on it.

Absolutely. We look at it three ways, right? AI for security.

So you need to be secure, you need to use the ai, AI securing it right? Now, how do I, um, secure the AI capabilities that the companies have? And then at, at the underlaying layer, everything is software and everything is development, right?

So how do I dev, you know, provide the AI as I facilitate in a daily work in an environment, in a technology world, right? So, so we do break it down into three things, and we're part of a group called Purple Book Community. So we have authored a chapter as well in it, right?

To shake it, how do you practically take it and use it on a daily basis, right? So, so you can actually grow with it, right? It's gonna evolve even further, but there are, you know, you know, small steps, you know, could lead into big waste.

Okay. So day two here. Well, it's really day one.

It started yesterday, really, day One. Yeah. Impressions of RSA this year That your impression?

Yeah, absolutely. A lot of, uh, I haven't had a chance to go into the floor yet. Uh, but I think a lot of focus on, you know, AI and Wow.

Yeah. Software, supply chain, software supply chain. Yes.

There's a lot of, uh, you know, discussions about, you know, CISO and what are their regulatory obligations. And so, so this industry is, is really, you know, getting the attention. Yeah, we Are seeing, that's exactly it.

This isn't what it was in 2003. Yeah. Before four.

When, when I first started coming here. Yeah. Anything else you wanna share with the audience?

Karthik? Absolutely. If you, if you're dealing with millions and millions of challenges and risks and vulnerabilities, you're not alone, right?

But I think we are, we have capabilities and tools that we should start to leverage, right? And, uh, and you know, if you want to check out AI powered A SPM, which, which really makes a difference in the industry, we have seen it real life with our customers, right? So if you're, if you're interested in industry, you're able to check it out so you're not alone.

You have the tools and capabilities that can help you deal with the problem that we deal with today in security. Thank you. Thank You for coming In.

Thank you. It was a pleasure. io.

We're live here at RSA streaming from Moscone West at Broadcast Alley. You can see you behind us. We got a full day of coverage for you.

Hang out. We'll be right back.