What is Autonomous Endpoint Management(AEM)? | The Six Five Summit

Hi, this is Shera Rubinoff. I'm president of Cybers Sphere, a Futurum group company. We're on the road with six five media here at Broadcast Alley at RSA 2024 coming at you live.

I'm here with Harman Carr, vice president of AI at Tanium Harman. What a pleasure to be with you here Today. Thank you so much for having me.

So Harman, could you please introduce yourself to our audience? Tell them a little bit about who you are, your background, and what you do for Tanium. Absolutely.

So my name is Harman Carr. I lead all things AI and automation for Tanium, which is the endpoint management company based here in uh, Seattle, uh, Seattle, Washington. My background is actually in the military, so I've spent about a decade in the military in various different roles and seven years in Tanium and field engineering strategy roles, product roles, and now leading all things AI and automation.

Well, that's quite a background and thank you for your service to our country. Thank you so much. Thank you for your support.

Thank you. So Harman, can you describe a EM and how it leverages AI to address the macro forces that continue to challenge IT and security operations? Yeah, I think a common thing we get asked today is I can't hire the right skills at the right pace to address all the things that I wanna address.

So how do I automate processes? And I think we've been hearing about automation for a long time and with autonomous endpoint management with a EM, what we're focused on is giving you intelligence to be deliberate about which things that you should automate. And what that means is we have access to so much data, we wanna take that data and tell you here's automations that have the highest probability of having positive change in your environment and actually remediating vulnerabilities in real time.

I think that's so important. I think a lot of organizations are saying Automate it. Yes, just automate it.

Yep. I don't have time for that. I don't wanna hire people.

Automate it. And having that insight into understanding Mm-hmm, what you can automate, what you shouldn't automate. It is integral for organization, both on, both on the operational side, but also on security.

So that's quite important. Yeah, absolutely. And Tanium a EM scales IT operations and security execution with data-driven insights.

Please talk to that point for a moment. We'd love to hear just your thoughts around that because I think that's an important topic also that I know the organizations do struggle with. Yeah, absolutely.

So organizations often talk about auditing, automating processes. One of the hesitation is that's going to impact my entire enterprise all at once. Yes.

And I don't want that to happen, obviously. I want that change to go out in a responsible way. So part of our autonomous endpoint management strategy is rolling out changes through a ring progression.

So what that means is we can dynamically first send a change out to a small percentage of your endpoints and monitor that change. And if it's successful, then we progress to the next kind of phase and the next and the next before that change goes out to your entire enterprise. But Tanium also has the intelligence to stop anytime you realize, hey, this change is having a negative impact, right?

It's impacting users in a negative way. Those changes will stop from impacting your enterprise. Well that's certainly another area that organizations struggle with.

And there's always that question, should we do this change? Should we not do this change If we do it, what are the consequences of it? Mm-Hmm.

And I think there's a lot of time delay, which actually could yield to an attack, but also could delay the movement of an organization and understanding that even if you're going down that road and it's not right for you, you could pause. Yes. I think that adds massive value to organizations.

So that's great to hear. Yeah, absolutely. And you can define what those progressions are.

You can say, I care if 90% of my endpoints have succeeded, maybe there's a change. You care, 95% have succeeded before you go out into the next phase. Oh, that's great.

Yes. And also Tanium Automate is providing the AI that helps organization improve their operational health and cyber hygiene. So I talk a tremendous amount about cyber hygiene.

You know, I kind of wrote a book about that, the human factors of it, the pieces and the parts that organizations need to look at. The people, the process and the technology have the best technology out there. Yeah.

Have the greatest people there, but the glue in the middle is the process. And that would yield and talk about, we could talk about cyber hydrating out late, we'll get to that another time. Yeah.

But can you talk to these points for a moment as well? Yeah, Absolutely. I always think security's done a little backwards where we have all these tools that we invest in Yeah.

To, I'm gonna block an attack or here's all these fancy tools. If attacking occurs here, I can use this to collect this piece of data. Yep.

But people forget the proactive side, which is a hygiene side, which you're referring to. Yes. So how do you simplify that hygiene side?

Because it is, it is very laborious and it can be very, very hard and complex. So that's what Tanium Automate solves for. It's to simplify those workflows, help you automate as many of those workflows as possible.

So if you have a workflow that's very complex and it takes three peoples to do, three people to do, you can build a simple playbook to say, here's my 18 steps that need to occur for this workflow. And Tanium Automate will do that for you. Stop and check in at any point that you want to check in before I complete the rec to the work.

So Let's like break that down just to the minutiae level. Yeah. And just give an example about something that somebody might take for granted with an organization of what they could break down, what they could automate.

Just something that everybody could really resonate with our audience here. Yeah, So, so a, a really common one is licensed software, expensive software that's out there that's licensed, no one's using it, right? That takes someone to go and figure out where it exists, who's been using it, when was the last time it was used, should I uninstall it?

Should I not uninstall it? You can just create a playbook to say, Hey Tanium monitor for this license to see if it's been used in the last 90 days. If it hasn't, just double check it's not been used right now.

And go ahead and uninstall that and send a user notification to say, Hey, we've removed this license. If you need it, you can go ahead and install it again. But you're saving a lot of cost there.

Sure. Right. As well as keeping that uh, piece of software updated all the time.

That's super important. And it's almost automation at its simplest form. Yeah.

Yet it's so valuable to organizations when you think about it. Yeah. Not just cost savings, but efficiency within the organization.

Not having to piggyback and think about what HR has to deal with. Yeah. Think about operations, think about security.

It goes across the entire organization. That's quite important. Mm-Hmm.

And we talk about tan's real time data access and actionability enables AI to provide automation to identify immediate issues happening in your customer's threat landscape. Yeah. So when we talk about that, that's certainly something that every organization thinks about and even more so worries about.

Yes. How would you describe what you do there and what you do to help your customers? Yeah, absolutely.

So we have a Tanium guardian. What Tanium Guardian does is any zero day vulnerability that occurs, what we do is we send you a notification to say, here's a zero day vulnerability. Mm-Hmm.

That's currently out in the wild and here's your exposure to it. Since we have that real time data, we can actually go ahead and query your end endpoints proactively for you and tell you what your exposure is. And then we can also give you a remediation path if one is available.

So here's a remediation path of how we think you should address this. And that is all automated into what we refer to as a simple smart action that you can go ahead and quickly deploy. And again, it'll deploy in that responsible ring based approach where we'll start testing it and propagating it throughout your environment.

But you have that all in one place now. So going from a notification all the way to action, And again in the security industry we talk about there's no one size fits all. No.

And certainly this is no one size fits all. No. What would you say to a customer who is saying, you know what?

We're very different. Mm-Hmm. Than everyone else out there.

We really don't need all the capabilities, but here are some specific ones we meet need. What would you do? Or what would you say to that customer themselves?

Yeah, no, that's a really good point. And it, and that point is even more important with the adoption of ai, right? Every organization's at a different place in adopting ai, which is why with autonomous endpoint management, we're very careful in making sure we still keep a level of human control in there so that you can interact and stop or engage or edit or change anything that we recommend to you at any point to make sure if fits your organization's need.

And Tanium is also getting smarter and providing more context based recommendations of what's applicable to you and your environment At every given moment. Or is that something they set up specifically for their needs? So over time we're sort of learning and kind of adopting our approach to say, here's recommendations that are particular to your environment and what we're assessing in your environment.

Yeah. Very interesting. It sounds like something that's quite needed.

Yes. Uh, we talk about Tanium cyber hygiene as we touched upon a moment before, and recommendations and automation are coupled with AI powered confidence scores. Mm-Hmm.

A type of risk and impact assessments. The organizations can assess the benefits, the risks and impact before making a choice for the environment. So certainly just what we spoke about.

Yeah. But on a larger notice or more, can you expand on that? Yeah.

You know, when they're really, they wanna get to the nitty gritty and certainly when they're making these choices and these decisions Mm-Hmm. They really need to make a calculated decision that's best for their organization at that moment in time. Yeah, Absolutely.

So a confidence score gives you, is we're monitoring every single change that's happening on an endpoint to seeing what type of performance impact it had. Was it successful? Was it failing?

Was it failing? Or even what are users or operators saying about this change? Did they have a positive experience?

And we're calculating that into a confidence score that they customers can then leverage to drive automation to say, here's a change that has a really high confidence score. 'cause it doesn't cause any performance impact. We wanna automate this process so it can actually happen on its own because we have high confidence now.

And that data of our confidence score is data. We've aggregated across hundreds of customers, millions of endpoints that are also making that change. Well that's super important.

And again, making the right decision with confidence is the only way to do that. Yes, absolutely. Norman, thank you.

And, and I always ask my, uh, my, uh, interviewees mm-hmm. For a cybersecurity tidbit or helpful hint or a business tip, whether it's personal or an organization that they could give to the audience from their own personal use cases or their own personal experiments or whatever it is that they've encountered along their business journey or life journey Mm-Hmm. That they'd like to share with the audience.

So I know our audience would love to hear your business tip or cybersecurity helpful end. Yeah. I think for me it's, I always talk about that cybersecurity is everyone's problem in an organization.

I think we sometimes often, and I say this is it's issue, you know, it needs to worry about that. Um, I think every, regardless if your role is you're in HR or your recruiter, whatever it is, I think everyone should be informed of cybersecurity to some extent in your organization. So they can be a great ally, they can help you with the cyber hygiene when an update does go up, they're more proactive to say, I should apply that update 'cause there's consequences if I don't Listen.

That's very well said. That's not just cyber hygiene. That's cyber culture.

Yeah. And I think our audience would agree with you on that. Our men, thank you very much for your time and I know our, our audience really enjoyed hearing from you.

And we are here offer six five Media on the road with six five Media Live and broadcast ally at RSA 2024. Thank you for joining us and we'll be back soon.