Techstrong Gang – July 12, 2024

Hello, everybody. I'm your host, Mike Bazar. My usual co-host, Alan Shimmel is out on vacation, but we're gonna be talking about Gen AI bubbles, what it means to be a modern ciso, and all these botnets that the DOJ is suddenly taken out.

You're watching Textron Gang. We'll be back in a minute. All right, folks, we're back.

And let's get to our panel today because it's August. We're starting out with Chris Blas, who is in an undisclosed location north of the United States border, but he's our resident cybersecurity expert. Chris, how you doing?

Wonderful. Good to see you folks. And then we have Lisa Martin, who is our resident CMO advisor, and for the Futurum Group, of which if you have not heard by now, tech Strong and Futurum Group are coming together as one happy entity.

Lisa's out in California. Lisa, how you doing? Doing well, and excited for this conversation, Mike, with you in the panel.

All right. And then we have our very own Mitch Ashley, who's up in Denver somewhere these days still, I mean, have, have you been home for like a record five days in a row now? Am I getting this straight?

I'm, I'm cannot disclose what city I'm in, but this is a picture of my home studio. So, yes. There you go.

And finally, Corey Johnson is in San Francisco. He's our resident Wall Street market expert. And we'll be instrumental in this first block.

Corey, how you doing? Glad to be here. I'm younger than Joe Biden and raring to go.

There you go. But who is it? Alright, well, why, well, why we can still remember what we're talking about.

Um, there's a new report out from Goldman Sachs talking about how there just might be a bubble in all our expectations amount, the amount of revenue, at least the Gen AI is going to create in the short term. It is suggesting that perhaps we, uh, overestimated somewhere, I guess maybe somebody on Wall Street did, or as they say, there are lies, damn lies statistics in Wall Street projections. But Cory, what's your take on what's going on with this report?

I mean, did we all wake up one morning and discover this bubble? Or is this some sort of correction? Well, it, what's among the great ironies, uh, let's talk about what we're talking about.

The irony, of course, is that Goldman Sachs was one of the firms that was out there, uh, propagating the idea that AI was gonna change the world and lead to productivity increases and GDP increases. And yet this, uh, we, this great report, really a thought provoking report that has been quite the buzz on Wall Street for the last week, uh, which is, uh, uh, a lengthy report, uh, talking to a bunch of analysts, but principally, uh, uh, hanging on a conversation, uh, between the Goldman Sachs analyst who wrote the report, and, uh, an interview with, uh, MIT's Darren Ace Mag, who a professor at MIT as well as their own head of research, uh, Jim Covelo, talking about, um, skepticism about the value created by generative ai and specifically, um, really going through a lot of the assumptions that have been made about the places where productivity, great gains might lead to lot better sales and lead to more GDP and the things that are different about, uh, generative AI compared to other big new adv new issue or advances in technology that were new, such as mobile, such as internet. Um, and it was a thought provoking report, uh, uh, and I, I'm curious what you guys had to think about the thing as well.

I, let's jump in here because, you know, we're both a little more on the IT side rather than the finance side. So I will just tell you how shocked and appalled I was to discover that this is gonna take a while. You you mean expectations have been overinflated?

Overstated, yeah. Gosh, I'm kind of surprised. Why, why would ai I mean, you think it would be smart enough to know that that's happened before?

Mm-Hmm. It, it is, we get exuberant about technologies and, you know, it, it had, it did have such an effect coming onto the scene with generative ai. It kind of surprised a lot of us, right?

Look at what this can do. And so we're very excited about the possibilities and course that drives investments, and whether it's startups or Wall Street or all the above. And, you know, like every technology we go through the hype cycle and end up in the trough of disillusionment and then kind of back out into the plains of reality, I guess, you know, we're, we'll, we'll go through that with, and maybe we've overinvested in ai or at least overvalued AI in some of our companies, um, as well as, uh, as well as startups.

But, you know, we'll see, it's still early in the agenda of AI game. And so it's not surprising for somebody to say kind of, Hey, wait a minute, this is, you know, it's not easy to do. It takes some work to really kind of do this, right?

And what are the best applications? So when you talk to people that are practitioners implementing generative ai, they're still working on what are the right places to use it and what are those applications and, 'cause we don't wanna spend time going down the wrong road and wasting money and time and, and the, and kind of the company's direction. So it's, I think we're just seeing a little bit of a true up.

I'm not, I don't think this is the bottom, if you will. I think it's just part of the natural cycle that we're going through. Lisa, will there be a shift in what we're seeing in terms of the marketing and the positioning of Gen ai?

Because honestly, these days, genai, you can't even turn on the television without a gen AI ad showing up. So, um, will there be kind of a, a, a reassessment, You know, it, it's great that we're having this conversation because on my show, marketing, art and science, I talk to CMOs every other week about what they're using emerging technologies for, and I just had the CMO CrowdStrike on the show airs next week. And CrowdStrike big cyber security company is Krisna really leaning into generative ai because from a marketing perspective, blasting out a mass message to an a huge audience doesn't work anymore.

So we're seeing companies like CrowdStrike leaning into generative AI to really customize the messaging because as we know, as customers and consumers, we all have this expectation that the, the messages, the contents, uh, the ads, what's cir up is going to be personalized and relevant to us as individuals. So I think what we're seeing in the CML landscape is organizations really leaning into it, and also not just that, using it to overhaul websites, seeing conversions from prospect to opportunity faster. So there's that almost tied to revenue, which is gonna be key for organizations to be able to share.

And I think marketing organizations have the experience now dipping their toes in to be able to really help the narrative. And in terms of really kind of refining what are the key use cases in which we're seeing gen AI really play a role in that customer journey that leads to revenue. So I, I'm excited about it.

I think there's a lot of potential and we're seeing a lot of really senior leaders lean in. Chris, I don't know if you want to jump in here because theoretically at least one of the great use cases for Gen AI is in the realm of cybersecurity. But have you actually seen anything that people are actually using, or is it all maybe theoretical still?

Yeah, people are already using it. And, uh, you know, to paraphrase Mitch's point, you know, I'm shocked, shocked to find that there's gambling going on in here. Um, but there are, there are trends and there are trends.

And in the end, some of them are speed bumps and some of them are, some of them are on ramps. And this is an on-ramp. Yeah, we all remember you, the I ot, uh, uh, big bump was maybe 15 years ago.

You know, that's an on-ramp that's maybe 30 years long. I think we're sort of halfway down that, and AI ties into that. So yes, it's being, you know, as Lisa mentioned, you know, it's being used in, uh, in, uh, uh, cybersecurity now.

Um, you know, CrowdStrike bug crowds, another good example. You know, where you take crowdsourced, um, hacking, uh, skills, human skills and tie that with AI that has a practical value today. Corey, all joking aside, though, I think it was Bill Gates who said something to the effect that we tend to overestimate the impact of technology in the short term and underestimate it in the long term.

So from where you sit, what, what is our time horizon on this? Well, I think, so I am reminded of the era of, uh, brochureware, right? When, when the first uses of webpage, the first creation of, of most webpages, not the best webpage to, in fact, quite the opposite, was recreating what a brochure was and then putting it on the internet.

And that seemed like the best thing to do with what are we gonna do with this worldwide web? We're supposed to have a webpage. And I, and, and what I read through in this report that was very thoughtful, uh, from some smart people, was looking at the things that we do now and how they might be done differently using AI done more quickly, um, uh, really about sort of speed and process about the things that we're already doing.

And it did make, uh, mention of things like Uber, which were inconceivable, um, or barely to most of us when we first got our mobile phones, uh, saying, oh, wait, actually we, uh, well, the report sort of says, we did see this, we talked a lot about what's gonna happen when you get GPS on these mobile phones and how it's gonna create new services. But I think it was hard to imagine the multi-billion dollar companies created, uh, from the uses of mobile phones when they first came out. And I think it's hard to imagine the multi-billion dollar companies that would be based on things that only AI can do.

Uh, this week I was at the semi Semicon West, um, uh, conference in San Francisco. And I, I sat in, in some, as I often do, random sessions, to just try to listen to what people were talking about. Um, and these, uh, a couple of these sessions were about using AI to change the way that semiconductor fabrication facilities are running.

And they talked about things, uh, like, uh, predictive maintenance on parts. So you could have certain parts working up until the failure of the actual device was predictable through the data that these devices have put off over the years, the kind of thing they just could, they would just, what they used to do was set up a schedule saying, on average, these things gotta be replaced every three years, so we'll replace 'em every three, three years. But what they could actually do is figure out tiny little pieces that are more likely to fail based on massive volumes of data as the data's being created, uh, and manage these replacements in ways that were not even possible at all.

Now, that's not as sexy as, or as, as relatable as, um, writing your homework assignment on chat GPT, right? That's something we can imagine. We know what homework assignments look like.

We know how to cheat, we know how to put the two things together with chat GPT, but the completely new use cases that we can't imagine right now, I believe are going to create multi-billion dollar businesses. But they're hard to measure at this point. And Goldman Sachs puts some, some, uh, real, um, uh, brain power to work in this report, sort of saying, what can we measure and what's different?

I'm always interested in what's different this time, not what's the same. And what's different this time is that, um, a lot of the processes in early internet and even early mobile devices were cheaper than the processes were out there. Whereas right now we're looking at things like the power consumption, the, the electrical power consumption, and, and the, the semiconductors themselves are 10 x more expensive than what they're replacing right now.

So you've gotta find new uses to make the 10 x value worth something. And I was glad to see this report sort of shine a light on that, but I think they really missed the boat on imagining, uh, a bigger future. Mitch, did we underestimate the data management challenge here?

And I'm asking the question because, um, theoretically if I want to use this in an enterprise setting, I have to either customize the LLM and I gotta expose that to some relevant data. And maybe we're not all being honest about it, but it seems to me data management in a lot of these enterprises is nothing short of an arrow full blown mess. Kinda reminds me of the nineties election cycle.

It's about the data stupid, right? I mean, all of this, that's just the fuel that runs AI as well as the technology, but without the data, it, it's not something that does a lot. And, and generative AI in particular brings some new challenges for data management, whereas machine learning has its own kind of workflow cycle about how you groom data, how you prepare it, you write your algorithms, you kind of tune all of that, eventually put that into your models and releases.

Generative AI has similar kinds of capability or similar processes, but you also have this whole protection of your own data. Um, and do you, if you're using a public model or public service, uh, like an open AI or something from, uh, you know, Azure or somebody, the, uh, that you still have to go through those processes. And I think many development teams are not in the business or used to being in the business of managing that data process as part of their software release cycle.

Um, we do it with databases and we do all the different forms that data is stored in. But this has got its own kind of process. You think about it, you've gotta release the data with the code, with the application, and it may have its own sort of gravity and life cycle that it goes through.

So AI is you, the reason why we talk about AI ops is because we have a data management, uh, process challenge that we have to address. So did we underestimate it? Us as end users kind of don't think about that.

'cause we type in a prompt into a whatever, uh, chat or bot or tool that we use or something that's, you know, augmenting our latest word processor or application that we're using in the backend. It's all about the data. Lisa, how do we have this conversation?

I'm gonna ask the question this way. No one really kind of wants to listen to a marketing campaign that kind of tells them what they already know, that they're doing something poorly. And it's very difficult to position it that way because we have been telling people how heroic it folks have been for the last two or three decades.

So how do we kind of put a marketing campaign that says, you know, you need to really get your data management house in order before you take advantage of ai. Is there a way to, um, have that conversation that doesn't feel awkward? Absolutely.

I think you bring up such a great point there. The data quality has to be outstanding. It has to be managed well.

It has to be accessible for emerging technologies like Gen NI to be able to extract those insights to deliver on this expectation of personalized messaging that I talked about. I think marketing as an integral part of the c-suite at organizations has the opportunity to understand the implications, the use cases, help refine those, and ensure that from a messaging perspective, it makes sense that the data management piece is critical. It's really foundational to tools like genai, being able to deliver personalized messaging, segmented campaigns that ultimately target revenue.

So I think marketing and I see this regularly, marketing being an integral part of the c-suite, really understanding all the business components from cybersecurity to the CEO's level, et cetera, has the opportunity to create the narrative that really defines the integration between data management, quality gen, ai, and ultimately revenue. I think they're the right folks to do that. Hey, Mike, can I ask, can I ask Lisa a question?

I'm excited that you're here. 'cause I have this question of we're in the era of marketing that we have a, we have AI in our product, and so everybody, you see the commercials on TV and everybody's, you know, saying that, talking about how do you break through in this era where, okay, so what everybody now has AI in their product. How do you differentiate in that kind of a, this this part of this adoption cycle?

Love to hear your thoughts on that. That is a huge challenge for organization. You're absolutely right.

The differentiation, which is critical for organizations. Those that I talk to, we, we often have the conversation about the infusion and integration of AI into the technologies as well as the integration of ai, generative AI into practices, functions like finance, like marketing, et cetera. I think that it's imperative for organizations to really start watching the data.

How are they able to move the needle? And by that I'm talking about influencing revenue, um, helping organizations make decisions faster, integrate technologies faster, that will bubble up the differentiation. But marketers need to be really keen on that because it is a level, it seems like from a, from a messaging perspective out there on tv, radio, et cetera, social, it's a level playing field, but organizations need to lean into it and adopt use cases that show value to their customers from a product functionality standpoint as well as a messaging perspective.

So I think we are on the earliest innings of organizations really leaning into what their differentiation is that really makes sense. And it's an aha for customers to go, I'm gonna choose your product because I understand clearly, well, Maybe they don't know yet. It's actually, and probably they probably don't.

I think it's early innings, we're seeing some use cases, but that differentiation piece, to your point, is critical for organizations. And I, I hope in the next six to 12 months we start seeing some of those bubble up. Corey, I wanna give you the last word on this because to the point about use cases, it seems to me at least that we're not understanding the difference between probabilistic and deterministic and gen AI is probabilistic, as in it's gonna surface something that is a best guess based on the available data and most of the business processes that we're using or deterministic, and that they gotta be done the same way a hundred percent of the time.

So is there just a disconnect between what we're trying to figure out how to use this stuff for? No, I, and I think, uh, you're asking a couple questions there, uh, Uh, wonderfully, um, um, I think that one of the things that one of the most wonderful things that AI is, is going to give us is the ability to be differentiated is, is a way to, uh, uh, a deterministic, uh, for every use case, not for most use cases, right? The way we do things, uh, in our lives and in our, and and in certainly in business is figure out what's gonna work most of the time and, and create a cookie cutter and try to jam everything through that.

And I think what AI's gonna let us do is treat individual problems individually because we've got the ability to do mo so much more processing, and I mean that in a more metaphoric way than just a specific way. We're able to really look at everything for what it is and figure out a solution just for that thing and treat every problem as its own problem. And indeed, isn't that a wonderful thing?

Treat every person as the person. They are not the person we need them to be. Um, and so I think that the, the potential is there to do some wonderful things that are as hard for us to imagine right now.

Um, but I think that this report, uh, uh, raises some wonderful questions. And indeed, when it comes to valuations of these stocks, you know, that it's, it's the age old problem of, of the market, which is, uh, Ben Graham, uh, put it this way a hundred years ago, saying in the short term, it's a, a weighing a voting machine in the long term. It's a weighing machine, uh, the, the stock market is, but, uh, in another sense, um, it's about direction.

And if the direction is towards AI or away from AI towards AI is sort of not measured for now, it's just go in that direction, buy those stocks, figure out who's gonna get some impact and, and, and throw that thing in your portfolio. Um, and I think that this report was saying, well, let's do some weighing here. Maybe this is a moment.

Uh, I don't think this is the big moment for weighing the value of ai, but it was the first, I think the market's first significant moment, uh, in that regard. All right, folks. I am not a Wall Street person, but sounds like if you're a day trade or sell, if you're a long-term investor, buy low.

We'll be back with our next block in a minute. com is the leading resource for news analysis and education on challenges facing the cybersecurity industry. com covers all aspects of cybersecurity, including data security, DevSecOps, cloud security, application security, network security, security threats, and more.

com has the largest selection of security content featuring breaking news, blog posts, podcasts, and more. com to learn more. com.

Home of security bloggers network. Alright, folks, we're back and we're talking about our next major topic, which is, well, what exactly is a modern ciso? There's a new report out from Netskope talking about how the level of risk that the modern CISO is willing to accept seems to be a lot higher than the previous generation, at least.

And, and even seems like in some cases, they're more willing to accept risk than some of the CEOs are these days. So Chris, what's your take on what is the modern CISO like compared to what we used to think of as CISO in our minds? Well, the modern CISO is an evolving creature, right?

You know, we've discussed this before, but this is a multi-decade issue, right? You know, since that acronym is coined, you know, it's gone through a phase, you know, that I think it's out of now where the inside joke was if a friend of yours has been a CISO for more than two years, you ask them, you know, what job they're looking at next. Um, but at the end of the day, anybody who thinks about security, you know, in core, you know, you have securities, the actual financial side of things, it realizes that it has to come from the board.

The board has to take responsibility. And we've been talking about AI in the previous segment, you know, these emerging areas. Um, the internet isn't emerging anymore, right?

CISOs need to actually be, you know, linked properly be actual c-suite members and, and linked. Uh, so I think this to your, to your question, I wasn't really surprised. I think that the, the, the, the herd of CSOs that are currently in the roles, um, are building on top of the experience, you know, a phase of, you know, it's just a title to, it's just a, a, a, a fuse that, that allows the actual c-suite to get outta trouble to people who are saying, no, this is my career and I'm the expert and this is how we manage risk.

And our community tends to be really good at this. We do this stuff for a living. Mitch, you do Seeso talk, and let me ask you a blunt question.

Sometimes, uh, when you see somebody running for office, they run as, uh, you know, we're gonna clean up the town and we're gonna be here for the people, and we're gonna protect their interests. And about nine months into the job, they start rubbing elbows with developers and realtors and all kinds of people. And the next thing you know, the zoning laws are changing.

Um, are CISOs getting too close to the business folks that they're supposed to be quote unquote protecting and kind of picking up some bad habits. Um, I, I wouldn't describe it that way. I think that's the desires to get closer to the business.

I think it's really driven by not just a career advancement, but wanting to understand where the business is headed. So you, it's a kinda like, like it being sort of a back office function to now every company's a technology or a software company, right? It's a, it's a critical part of the business strategy.

So I think it's driven by, in the, for the most part, you know, good, good reasons. But to your point about getting too close to the business, I look at the modern CISO as someone who is getting very close to the software teams, to the cloud teams, to people who are implementing the technologies, and particularly technologies that may not understand. Um, when I was at the AWS, uh, reinforce, uh, conference, Chris Bests, who's the, uh, CSO for AWS got up, first thing he talked about was hardware security and talking about the chips and the, the enclaves and how they manage data and transferring between elements of the hardware architecture.

Then you start talking about programming language. It's talking about rust and how it's memory safe and strongly typed. And, you know, things that I don't normally hear CISOs talking about, you might say, well, that's 'cause they have hardware.

Well, also, you know, I just interviewed a, a, a VP of, uh, software supply chain security from Schneider Electric, who also deals in hardware too, who has a new book out on supply chain security, but it's about firmware, hardware and software. So I think the modern CISO has to understand the entire ecosystem that we're implementing technologies in and holistically address what does data security look like across all that plane, not just the storage of data and protection of it when it's at rest in some, you know, database or cloud system or whatever it might be. So the modern CISO has really expanded their, the horizon of what they're looking at and what they need to understand in the business, not just business, but technically, Lisa, the other day, I'm watching the Yankee game as I am prone to do, and an ad comes on, and much to my surprise, it's Keanu Reeves chilling for a security company.

And I was just like amazed. And it was pretty, you know, high production value, let's say the least. Is the whole conversation around cybersecurity and marketing and who's involved in this conversation changing?

Yes, it is. And it needs to, um, I, I, I think that one of the most important things that the modern CISO has to deliver is great communication skills. I agree with what Mitch is saying.

I talked to a modern CISO yesterday and said, talk to me about some of the, the alignment and challenges or where alignment is key, but we're seeing that things like cybersecurity are are front and center conversations because it affects everybody in every industry and every walk of life. So it interesting. I haven't seen that together.

It's commercial, but I'm gonna have to Google it. One we wrap here today because I think what what organizations are trying to do is really kind of bring in compelling people to start, not start, continue the conversation of awareness, which is absolutely critical. It cannot be a one and done thing, it has to be continuous.

Um, but I think from a cybersecurity perspective, the communication is key. That's why I think CISOs and and CMOs are greatly aligned, or should be because the CISO needs to be able to communicate cybersecurity issues, threats, regulatory landscape, how things are emerging, evolving to non-technical people. You know, God, for the forbid there's a breach, nobody wants to become the next, um, press release headline.

But that communications piece is key. And so it's interesting, uh, and I'm gonna keep my eye out for this now that you brought that up, to see what companies are using, um, celebrities to be able to start making sure that that awareness piece is fundamental. When I talked to CrowdStrike, um, last week, they talked about the Super Bowl commercial that they did because they wanted to be associated CrowdStrike equals cybersecurity.

So going out to the, the mainstream when one of the most watched events in the world with the right message, is something that the general population needs to hear consistently. So go Keana Reeves, I'm gonna look into that for sure. 'cause it sounds interesting, Chris, is Keanu Ree somebody you're gonna identify with?

Does this kind of make you feel warm and fuzzy, or does it kind of feel maybe silly? I dunno. No, I I think it's wonderful, right?

Because, you know, all this is evolving, right? And you know, Mitch mentioned Cassie cross leader Schneider, right? And, and you know, focusing on the supply chain and so forth.

And, and I think it's interesting in the context, you know what we're talking about, my last comment on, on CSOs, we're evolving, right? It has to all come together in the end. And one of the things that Cassie's been focusing on is the hardware, as you said, the hardware, firmware software, it's all combined.

And you know, the FCC, interestingly, you know, one of the tiger teams in si in the CSA world that that Cassie's uh, firing up is focusing on an FFC FCC requirement. That device manufacturer is giving a QR code that will effectively tell the, the, the end user everything they need to know. So what is that?

What is everything you need to know? So we can map that, you know, that requirement as a security person, I could have said 30 years ago, you should do that, but we couldn't. But as we can, we have to.

Similarly, in the CISO space, you know, today's topic, you know, we all, I think, knew a long time ago the responsibilities a sea show should have generally speaking. Um, but we had to go through the practical realities of trying to develop those roles and, and maintain them and, and mature them. And we're getting to that point again, where if you're going to put on, if you're going to part of this community and take security really seriously and take on a CISO role in any organization, particularly these, you know, these mega organizations, um, you have to understand and find a way to communicate the fact that it's all connected.

All right, well, if it's all connected, then let me throw this next question to Mitch. We have seen, uh, CISOs become CIOs recently, and I'm wondering if you think that's gonna be a long-term trend, and does that ciso, when they become a CIO, need to hire another ciso, or does the CISO and CIO function become one and the same? Well, there, there's the, uh, separation of duties idea, right?

Well, one person has to keep watch on the other person or the other group, which has been where we've come from, and a lot of organizations have recognized that we have to go beyond that. Yes, there are the places where we need to do those kinds of checks and balances. Oftentimes, CSO have evolved into a CIO role of infrastructure, meaning, 'cause it's so critical of the security, so much of it is implemented that way, but not all of it.

So it's not, uh, you know, unnatural to become a CISO CIO combination. You also see CISOs and CTOs, uh, being combined. So I think it's really driven as much by the skills of the person.

You're not gonna put a CISO in charge of, you know, a software development organization unless they understand software or they're on that path to understand that better. Is that where everyone is going? No, I don't, I don't think everybody is, is gifted in all those areas.

Some will and some don't. I think it's more driven by the organization, the kinds of security issues that they're challenged with or that they need to meet. If I'm in a company where the agility of my software, the, uh, the resilience and, and, uh, ability of my organization to respond to market conditions, but I need to make sure I'm really doing that securely, I'm gonna have a CISO tied into that process, whether they're in charge of it or not.

Tied into working with the development, the cloud, the infrastructure teams to know that when we pivot, we're pivoting, uh, not off the cliff into some security issue, but we're pivoting to the next point. We wanna move from Corey. Not too long ago, there was a company, a public company, I believe we got called out for having a CISO that was, um, at least assessed by some folks as not having the level of expertise required.

Is Wall Street looking and evaluating the cybersecurity strategies of the companies they follow? Will they punish them for breaches or has it just become a cost of doing business? I thought you were gonna say, speaking of underqualified Corey, um, that's the, the great toss.

Um, I think that, um, it, you know, you mentioned Keanu Res and, and, and the ads they, for Palo Alto Networks. And I think that that one of the most interesting things here is the evolving nature of, of the, of, of the attitude of CISOs towards their, their workers, if you will, the people that work in their environment and, and the responsibility that they have to either build firewalls, which has been the Palo Alto Networks approach, uh, or to turn towards zero trust, which was sort of the, the Okta, you know, maybe Zscaler approach, which has been much more successful. And here you have, uh, Palo Alto Networks turning to the soon to be 60-year-old Keanu Reeves thinking that that's a way to kind of seem younger, hipper and more relevant here.

And so I think that fundamentally what Wall Street wants to see is whatever wants to see is increasing sales, um, uh, at scale and the growth that they're going to, uh, get from that, that might turn into actual, you know, stock market, uh, reflection of the, on those growth numbers, um, and having the right product's, the most important thing. And, uh, Palo Alto, uh, might have a keto reuse of their ads, but I dunno if they've got the right product because of the changing nature of that role. Because the idea of giving employees sort of a level of trust that a zero trust network implies, right, which is sort of a disbursement of, of the risk, is a modern approach that not every CISO is up to.

And I think that you can see it in really the, the attitude of the CISO is whether they can truly adopt that approach, approach or they don't trust anyone. They want to build firewall upon firewall. Chris, is there a disconnect between the CISOs in the rank and file?

And ultimately, what's your best advice to somebody who just became a ciso? Well, in reverse order, my best advice to someone taking a, a job as a CISO is take your career more seriously than the job. You know, you know, you have to, I don't believe that you can do security at all, much less lead security teams unless you really, really mean it.

You know, you have to actually do your best to actually get the best result. And beyond that, it's, it's a matter of detail. You know, as I said in previous comments, you know, this is a moving landscape.

You know, if I was gonna advise someone, you know, moving into the CISO space, I'd say talk to a lot of the CISOs, watch Mitch's show, you know, find out what is practically pragmatically important and achievable, right? You know, having, you know, lofty goals is a, is a lovely thing, but in taking that kinda role, you're, you're assuming the responsibility to get things done. So find out what's pragmatically possible and then push the limits of that to get the best result.

All right. Hey, Mitch, who do you want to play you in the movie? Well, since Kenos taken, let's see.

Um, I don't know. I could pick a lot of people, but it wouldn't be me, I'll tell you that. All right, guys, we're gonna end this conversation here and move on to our next block, and we'll be back in a minute.

All right. And we're back with our final block. The DOJ announced that it has taken down yet another botnet.

This one was allegedly run by somebody outta Russia to launch disinformation campaigns. Chris, um, it seems like almost every other month now, the DOJ is kind of rolling out an announcement talking about how they knocked out a botnet. What is the, is something changed here?

Do we have more visibility into these botnets and what's going on? Well, you know, in every adversarial environment, you know, the first move goes to, to the attacker, right? You know, some new opportunities is identified, you know, that, uh, is the way that works in, in cybersecurity and business in biology, right?

You know, however, over time it, you know, that advantage goes away. And I think the, I think in the whole influence campaign, disinformation, uh, call it what you will space, um, we're pretty far down the path. You know, there is not anybody in the, in the, the report cited for today's talk.

We find that a change more than half of people are aware of at our second tired up and so forth. And so it's not a, it is, it is not a one side versus the other, even believing this is going on. And, you know, on the, on the, the response side, you know, there have been a lot of people for a lot of years now working on this really, really hard.

And I, I wanna go all the way back to the first segment and, and to one of Corey's comments, you know, the value of AI and this, this is, uh, I'm sure in these specific cases, I would bet dollars of donuts that, that there are AI tools that were used. Kind of come to your question, but AI does two things, right? It saves you time for things you're already doing, but it gives you time to do things you wouldn't have imagined, right?

And this, this area is fraught with those sorts of things. You know, how could we possibly ever look at the volume of, you know, fake social media, uh, posts or how could we possibly ever, so we don't even think about it. Well, you know, those kind of things are actually getting possible now, um, with, you know, again, I'll use the, the acronym AI to just cover that broad range of, of, of things we're talking about.

So like a lot of other things, this is not news anymore, now it's mechanics and just being able to, you know, spam the world with a whole bunch of bots outta St. Petersburg. Um, it is, you know, that's not winning you any games anymore, Right?

Mitch, to Chris's point, um, we saw the lock bit. Folks I think got knocked off for maybe a couple of weeks. Um, it almost seems like to me that the bad guys have assumed that they're gonna get knocked off and they have a backup infrastructure almost ready to go, and it's become part of their business model.

So, I mean, hats off to the DOJ for knocking out a botnet, but is this kinda, you know, not gonna make a much of a difference at the end of the day? Well, it's extremely easy for, you know, adversaries to spin up whatever they need, infrastructure, tools, technology, and not rely on people to scale it and be able to run those. Matter of fact, it's kind of like the old boiler room, right?

By the time the, the, the police showed up that's already been torn down and they're at some other place and have new phone numbers, right? It's, this is the modern equivalent of that. Uh, when it comes to, when it comes to fake information, I think one of the things that's, that's, I don't know, it's new, but we're seeing more of is yes, it's the bots, but it's also the social accounts and people creating online personas that aren't really people, uh, to start to build a following, build trust with the community and then putting out this disinformation or propaganda or both.

And, you know, as they're, as they're taking these things down, they're taking down social accounts as well as domains and servers and things like that. But again, the infrastructure to do this is, is very easily to acquire the tools to do it. And while one is being successful, they're working on the next five or six deployments, whatever number you wanna say.

But it, it is that kind of a cat and mouse game where I'm, you can chase me, but I'm already working on the next race. Mm-Hmm. So Lisa, let's shift the gear here for a second.

'cause most of this disinformation stuff is, eh, it's political in nature or, and, but let me ask you this. What's to stop somebody from deciding that they're gonna launch a disinformation campaign against a vendor and use this technology to kind of create an anti-marketing campaign that designed to either reduce sales or, uh, take their stock price down? It seems like the tech is getting to the point now where we might be seeing some new use cases here.

That's a great point, and, and it's a scary point. Mitch mentioned kind of the magic word that, that comes to my mind when I think about, uh, this farm and others is trust. I think one of the, the biggest ri trust is currency these days between vendors and their customers and partners and the, the whole ecosystem.

I don't think there's anything right now stopping the, the malicious behavior that you talked about. I think that once the trust is broken, it's really hard for organizations to rebuild that. So it's, it's one of those imperatives that whether a company is, you know, using who's not using chat bots these days for customer service, contact center, et cetera, they need to be really working with other technologies to understand what's being said on those other channels.

They need to really have the visibility that the technologies there for, I think today, to really understand what's being said, to whom how far the message is spreading. And this is kind of that balance of, we talked about earlier some of the, the great gen ai ai use cases for companies in marketing and some of the bad ones that are out there. It's, it's a balance and it's shifting consistently, but organizations need to get their eyes, ears around what's being said about them out there in the, in the ether so that they can help from a brand reputation perspective to manage it.

And I don't think it's control it, I think it's manage it because it's so dynamic. It may come as a surprise to you, but, um, having grown up in the Bronx, I have some friends that operate in the gray area, especially around Wall Street, and it kind of looks like this, is this a Bronx tale you have for us? Yes, exactly.

Um, there's a Wait, we In the Bronx? Yeah. Well, actually nowadays, he, he lives in, uh, rye, one of the most expensive neighborhoods in Westchester County.

But, um, I used to Live in the table in the back of the restaurant. You Cognize. Yeah.

But, but, uh, without naming names, um, they have set up what amounts to is, uh, an email chain and a, and a thing that they blast out to. And the content in there is deliberately created sometimes to short a stock. Sometimes it's, uh, to echo some, uh, national trend that allows them to kinda reinforce a, a position that they are taking.

And a lot of that material is suspect, and it's definitely chosen with a, a goal in mind. Is this been going on for a long time? It seems like, to me, and it's a form of disinformation is, but you know, is the way we think about how stocks are bought and sold gonna change because of disinformation.

Um, you don't know this about me, but I spent many years, um, running a, a fairly large portfolio of short only, uh, names. So I was, uh, a hedge fund manager at a, at a, the, the second largest short only hedge fund in the world. Uh, and I ran a big chunk of that, uh, money.

And, um, one of the things that, that engenders is a study of the history of financial fraud and, and market fraud and market fraud, um, of a certain type has always relied on the ability to get to people where they are. And the regulators are always backwards looking and always looking, uh, at things that used to happen, not things, uh, specific things that used to happen, not trying to stop them from happening in the first place. It, it is a, it is a long time complaint, uh, for many of us with the Securities Exchange Commission, that they only look for things that already happened, not trying to prevent things that are about to happen.

And so whatever the most modern form of communication is, and the, and the rails upon which those communications rely is where stock fraud is gonna happen. Um, you know, probably half of all internet traffic is bots. And, uh, by some studies, two thirds of that are, are, uh, malicious bots, uh, to be used in some way or another, whether or not they're actually being used in a malicious way or set up to, for essentially the rental out to the people who are gonna do, use those networks, uh, to do bad things.

Um, that's where the traffic is, that's what's happening on the internet. Again, half of all internet traffic is probably bots, and sure enough, uh, we're gonna see a lot of that used, um, for, um, malicious intent at least, of which to get people to buy crummy securities. There you go.

So Lisa, walk this through with me a little bit. So the, uh, people with an agenda, shall we say, are using tech to drive, uh, a, an outcome that's probably not in the best interest of some of the vendors and the marketers. Do companies need to have what amounts to now like a political war room that responds to this stuff when it, as it happens in real time, because it seems like the game is shifting?

That's a great point. Uh, I, I like the concept of the war room, and I think it's absolutely essential for organizations in every industry, given the volume of malicious activity that's out there, as much as the good guys have access to great technology and emerging technologies like we've been talking about. So do the bad guys.

It's a race organizations need to have that visibility that we talked about earlier to understanding what's being said about them, by whom to whom, what messages and how do they respond to it, and as near real time as possible. I think that could be an interesting application of the evolution of the CISO role that we talked about earlier. Um, and the marketing folks need to be on it from a messaging perspective because brand reputation is linked to revenue and success.

So, um, I'm gonna actually start asking why CMOs, now that you bring that up, about just that of what they're doing to be able to respond to things in, in at least near real time to protect the brand reputation and the, and the revenue, uh, generation, the a RR that the company is capable of. Chris, what do you think we're gonna embed security people in the, in the marketing department to defend against disinformation? How does that work in your mind?

Lisa does have personal security. It's worth noting. Well, he, It's Corey, by the way.

Well, I, I think, I think when you look at the disinformation landscape, you know, the, the soil is saturated, right? To, to Corey's point, you know, we can't really support more disinformation, you know, we can't get 110% with 99% of nothing would work, you know, so we pretty well maxed that on how much, uh, we can have out there. But the, uh, the, the, the next step, you know, it's, it is the next step is really more leases world than mine, right?

And, and it's interesting that, uh, uh, we wrote a a 25 year infrastructure security plan for a US ally nation states, and we had a seven year mark in there where we're about there now, where our point was that if you don't deal with this issue, you won't be able to keep the lights on anymore. It's not about, you know, influencing political or demographics. It's about can I make decisions as a business, as a utility?

And I think we're at that point, because until then, the only funding source for any sort of defenses tends to be political, you know, nation states and whatnot, who not surprisingly, are then targeted, uh, by these same actors to keep them, you know, from being able to spend the, the, that money. But when Lisa and Corey and their, you know, the world, they represent, when I can't run my business, I can't communicate anymore, and I can't trade stocks. There's a lot of money for solutions.

And I think a lot of the mechanics of the solutions are, are laying around the shop. Mitch, should we just assume that everything is untrue until proven otherwise? 'cause it seems that's where we are.

I, I think we kind of already do to some extent, or we believe what we wanna believe is, is another way of saying that. Um, because you can't control the message anymore. The, the new cycle's not, you know, 12 hours or, you know, happens at four to 6:00 PM when, when, uh, you know, the, the news cycle starts again.

It, it, we live in a world where if you want to dominate a, a message and get it out in front of people, you can do that digitally very easily. Now we can do it with AI and, and deep fakes and things like that too. So I think people have, are increasingly creating a genuine distrust of, of things that they don't regularly follow, and not knowing whether that's true or not.

I mean, I don't wanna go into politics, but there's a whole conversation going on about, you know, no matter what happens between Biden and Trump, they stay neck and neck, right? Nothing kind of moves the needle, uh, very significantly. I think that's a good example of just people are gonna fall into a category of what they wanna believe in, um, or what validates their beliefs, things like that.

And I think that's just a natural human response. You know, I'm no psycho psychologist, but it, it makes sense to me. So I, I think the challenge is if you wanna get a message out there, you can, if you wanna do it in an offensive way, you can.

If you wanna do it in a highly pervasive and sustained way, you certainly can. And that's kind of what builds up that, you know, frog in the water is the temperature increases to not realizing what I'm, what I now believe in or what I've seen, I don't believe. So you're gonna go to the quarries and the Chrises and the leases of the world, and that's who you're, you're gonna have some trusted sources.

You're gonna say, you know, is this what this Mike Guy Baard? Dude, you know, what's, what he saying is that, Lisa, what do you think of that? Are you, are you good with that?

Do you follow his his jam or, or we, we talking some funny business here. All right, Lisa, I'm gonna give you the last word on this 'cause it is trust. I, Yeah.

And so the question is how do we establish trust and maintain it? Because I mean, to the point where I trust Mitch and I trust Corey, I trust you and I trust Chris. 'cause we're vetted and I know you guys, but how does that work out at scale?

That's a great question. It's so challenging. I, I think the control word is out of the realm of possibilities.

Now, I think it's management, and I think it's the consistency with which organizations deliver messages that are then validated by customers consistently over and over again. Um, as, as an extension of the trust, um, relationship that organizations have. I think that once customers are able to verify what the company's saying is true and demonstrated and from an impact perspective that propagates throughout communities, and that the power of the community is incredibly important here.

Because trust as currency, as I mentioned, is incredibly challenged to, incredibly challenging to manage, let alone control. But I do think from a marketing messaging perspective, the more customer voices that can support messages of truth and verity, um, are big allies to, uh, organizations and vendors in every industry these days. All right, folks, you heard it here.

Hey, uh, tech Strong and Vitor, we're working every day to gain your trust and hopefully you keep us honest and we'll keep that trust as long as we can. Guys, thanks for being on the show. Thanks.

Thanks, Mike. Thank you. Pleasure.

All right, and thank you all for watching the latest episode. We have a whole raft of material coming up right after this, so stay tuned, and once again, we'll see you tomorrow. I'm Bonnie Schneider, sustainability contributor to the Techstrong Group.

I'm excited to introduce you to a groundbreaking new initiative from Techstrong Research, the sustainability pulse meter. The pulse meter offers valuable insights into how environmental responsibility factors into tech purchasing decisions for key players in the industry. Position your company as a leader in the industry and differentiate from your competitors with the sustainability Pulse meter offered exclusively from Techstrong research.