AI is changing the cybersecurity threat landscape

kind of perspectives because I actually didn't know that Ismail, who I've worked with for many years now, even at different companies before BlackBerry, I didn't know that you were, you started on the offensive side and then switched to the defensive side. I am very much the opposite, well, except for the switch. I started on the offensive side, and I remain on the offensive side.

The part that I am most intrigued by and always have been is what I call well, what's called vic attacker ontology. So I've always wanted to understand what makes the attacker behave like an attacker so I can better defend. But my primary areas of research and areas of work and my primary focus has always been trying to anticipate what the attacker is going to do, you know, so that I can help our clients strategize, etcetera, etcetera.

It's always been like even before. And just from an AI perspective, cybersecurity has been using AI for well over twenty years. I'd say probably thirty years almost.

So it's not as novel as it is to, you know, the average layperson. But even before the popularization or the democratization of AI that we've seen in the last two, three, four years with companies like OpenAI, etcetera, Even before, you know, AI was so much in the forefront. I've been very intrigued with how we can build strategies that help customers, organizations, governments anticipate earlier what they need to be protecting against.

And that's kind of where my perspective comes. So my I didn't contribute to to the blog, I believe was primarily Ismail's blog and maybe Ismail and his team. But my perspective on the blog was very much how can we use AI to also help level the fields a little bit more?

It's a constant, you know, battle with the fields going back and forth and kinda who's winning the race between attackers, you know, cybercriminals, and defenders.

longer than most. I'm like your age, Chris, So I'm approaching 60 years old. Yep.

Exactly. Old curmudgeonly. Get off my lawn.

That's right. So I'm approaching that age, that, you know, scary age of 60, at least is scary to me. So I remember a lot of things historically about the cyber security industry that give me perspective.

One was I want to say it was around twenty ten, eleven or '12, somewhere around there. It was the first time that I noticed in the FBI's threat intelligence report that they used to release every year in that report around twenty ten, eleven, twelve was the first time that they reported, the FBI reported that profits derived from cybercrime surpassed globally, surpassed profits from heroin, cocaine, marijuana sales combined.

And for me that and I'm talking this was, you know, 2010, like I said, that to me was a tipping point. That's in my mind, I've built the narrative that right around then or maybe a year or two, year or three before then or after then, that's when a criminal organizations focused in on cybercrime. And it switched from being, you know, the harmless hacker in the grandma's basement.

You know, I'm thinking like a Kevin Mitnick type of a guy who who who kind of started off that for those who are in the cyberspace. They know the name. You know, he was kind of like a quote unquote harmless hacker.

He was arrested. I think he might have been one of the first cases of of a full fledged arrest and conviction for cybercrime. But, you know, his his cybercrime was always focused on what can I learn?

You know, what can I gain from these things that I'm illegally getting access into? It was less if at all, it was not about, you know, what can I financially gain? Now it is largely financially motivated.

I'll let Ismail deal with this a little bit more because, you know, this is his forte. He runs our threat organization. But from my perspective, it is largely based on what can we monetize.

off of one of the branches. The side of BlackBerry that I'm maniacally focused on is really just, I wanna say, purely the cybersecurity part. So obviously, BlackBerry does a lot of other things.

We have our automotive and IoT, section segment that that's very, very, very large, probably a billion dollar business in and of itself with, you know, operating systems that run-in any car that has anything digital in it, etcetera. The part that I'm focused on though, is pretty much purely my area of expertise, which is cybersecurity. So, what we've been doing from my side of the house is helping customers build their defenses in a way that allows them to do something that I call preemptive security.

If you remember in my earlier preamble, referred to, you know, we need to be able to predict what the attackers are going to do so that we can defend against it. I help my customers strategize around building those platforms, those tools, those combination of different tools to do exactly that. The nuance of it with cybersecurity is just because of organically how the industry has grown and VC investment and a million other reasons, we've sprawled very much into, there's thousands of tools to get the job done.

And there's probably thousands, if not tens of thousands, of different little aspects that need to be protected in the average organization. You might have endpoints, computers. You might have servers, you might have a network, you might have stuff up in the cloud, you might have operational technology or IoT technology, all different aspects, that all need to be protected, that all require completely different tool sets.

That sprawl has made it difficult for customers to have a homogenous approach to how do we defend against it all. Ismail can probably talk more about one of the things that attackers do, I want to say very, very, very well, is attack the gaps between our tools. So if they detect that you have a great tool that, you know, is the foremost tool on protecting computers, your endpoints, but your network stack is a little bit weak, they're gonna attack right in the middle of that network stack and gain access to the endpoints.

Vice versa, if they see your network and your endpoint rock solid, but you have a weakness over in the cloud, you're gonna start seeing cloud attacks. What the industry has not been very good at that BlackBerry is trying to help resolve is how do we help customers pull all of that telemetry in to be able to get, as I said, a homogenous view of everything that's attacking them and everything they're doing about defenses across all those little silos. That's what I help my customers strategize on.

And my customers vary from governments. I met with the government of Morocco a couple of weeks ago, two large corporations, the biggest banks in the world, the biggest airlines in the world, etcetera, etcetera. And it just spans the range, but all of them have that problem.

The most mature organizations have well developed tools that are unintegrated, and the least, like the SMBs, which are also our targets, our customers, have six oftentimes less developed security stacks, but the problem is the same. Even if they say, well, know, we can make an investment in this one little tool, then they have their gaps and they're not being able to ingest all of that intelligence that they have. It says something about the industry, and I'm going to kind of shoot at my own job now.

It says something about the industry that a strategist at that level focused on those types of problems is even needed. Like you don't have that in the medical industry, as far as I know. You definitely don't have that in, for example, the automotive industry.

Like there aren't integrators that need to help you with how to integrate, you know, your car to work properly. You go to Ford, you say, I want a SUV. They give you the whole SUV.

They don't say, buy the motor here and then go down the street and get four tires and go across the way and get a transmission. You glue it together and you make it work. They give you the whole thing.

Cybersecurity doesn't do that. We don't give you the whole thing. So that necessitates a cross section of strategists like myself and the team that supports me to go out and actually help customers parse through this web of tools that they've built.

If I, you probably don't go to cybersecurity industry events. I do, Ismail does as well. Ismail speaks at many of them.

The amount of vendors on the expo floor, I remember going to RSA thirteen years ago or so, handful of vendors. It was a small convention. Now, it's early thousands, three, four, 5,000 vendors.

40,000 people last year. That's a lot. And, dude, I I thought it was blig.

I went to a conference called Jitex. Holy spook. Almost a million people at Jitex at a conference talking about techno it was crazy insane.

The amount of boots, I think it was 40,000 vendor, like insane that there's an appetite for all of these tools and customers are bubbling them up. And it makes their environment more complex and that's where we oftentimes come in. And noisy too.

There's a lot of noise in this industry.

Yeah. I'll comment on that if I may, Chris. Sure.

Absolutely. Ismail touched a little bit. He's kind of grazed over LLMs.

And I'm glad you only grazed over it because of what I'm about to say. We think LLMs, as good as they are and they have some excellent use cases and value, I think they contribute to a lot of the noise and the hype machines that we hear in the industry right now. I'll speak specifically for cybersecurity.

I am not yet convinced of the utility, the usefulness of an LLM, particularly for its natural language, ability ability to process things via natural language. I'm not sure that that was the problem we had. I speak to SOC analysts and chief information security officers literally on a daily basis.

That's my job. I've I can't remember in the last thirty years doing this that a group of operators, SOC analysts, etcetera, have told me, you know what would be great, Greg? We don't know how to extract the data from our tools.

If we could only say that in natural language, that would really help. That's not the problem. The people that are doing these jobs in the socks, etcetera, etcetera, very adept at their tools.

They don't have the problem communicating with the tools and writing a a a parsing command or a a query or whatever to extract the data. That's not the issue. There's other things that AI and machine learning can help with.

Classification is a big one. Ismail has already referred to prediction. I think that's a very, very big one that is underutilized today.

But classification, how do we classify not only files and hashes, but behaviors, indicators of attack, indicators of compromise? How are we able to classify, you know, these three things that are connected together or in the case of a cyber attack, these 50 things, these 50 behaviors or indicators we find, how can we pull them all together and say, listen, this is leading up these all belong together. These 10 things that we found on your network and these 15 things that we found on your endpoint and these 12 other things that we found simultaneously in the same temporal window in your cloud environment, they all belong together and they're all part of one attack.

That classification process, I think that's somewhere where AI can help because that's where the gap is. Taking the ton of data that comes in that swamps our security operation centers with alert fatigue, parsing through that to quote unquote make sense of it and kind of narrow it down to a few cases. And when I say few, though, that few may be thousands still, but it's a order of magnitude or more drop from the tens or hundreds of thousands of events that you get.

If you can drop that down to a significantly smaller amount of cases and then tackle those cases, that's one of the problems that I see AI solving in cybersecurity extremely well. It's really interesting to hear you say that.

again, I've been in this industry for almost forty years. So it's pretty much the only thing I've done professionally, you know, since I came out of college. So I'm very passionate about it in case that's not extremely evident to your audience yet.

Therefore, also, I also tend to look at myself and my industry with a really, sometimes a bit of a harsh lens. And so I'm gonna say something now that might be applicable outside of cyber, but I see it from inside of cyber. And we gut ourselves.

We do legit harm to ourselves by feed and when I say we, the vendors primarily, by feeding into the hype cycles and selling stuff that we know good and gosh darn well are absolute smoke and mirrors or have limited usefulness, but they sell well. You know, the the notion of we're gonna have an AI powered SOC and you're not gonna need SOC operators anymore. You know, you you you all these analysts, you you won't need them.

You're gonna get just less analysts because the AI is gonna do all of that for you. The more we hype that up, the more you get that the Gartner flip cycle where people try it and they go, oh, god. This is doesn't work this way at all.

I still need the humans. The humans add, as Ismail said, context and awareness and situational strategy, not to mention things like morality, which AI is terrible at. Now, can the AI do bulk volume of data processing?

It absolutely can. And that's where that's one of the places we should lead into. It's been touched on things like vision and, you know, some of the more esoteric parts of AI that we don't speak about every single day.

So I'm not limiting it to prediction classification and large language models, but I'm just saying large language models are amazing. I use them regularly for processing anything having to do with language, whether that's, code language, indicator language, or spoken read language. One of my very practical things that I do with almost every piece of content I'm attempting to digest now is I I try to get the audio and I run a transcript.

Send it to Whisper. Send it to whatever API. Give me a transcript of it.

Analyze the transcript for me. Give me some key talking points. What are the things that I said, what are what are some tweetable lines that I wanna broadcast out, what are some key quotes that I that I said.

And I build my brand on social media, and I flavor my other talks with that content that I've said already. I'm going to do it with the talk that I'm doing right now. That's why I'm in addition to as a backup, I'm also recording my own audio here so that I can extract that.

And so that I use LLMs. They have utility. But it's, they're not the end all panacea, you know, oh my God, they're great.

We should throw everything at an LLM. It's the more we do that, I think the more we do intrinsic harm to the industry and most importantly to our customers' ability to defend themselves because the threat actors are not, at least I don't see the threat actors out there building a hype cycle. I see them out there efficiently sharing threat intelligence and leveraging it to build new novel attacks that there's unique ways that they can get their objective, which is, you know, monetize weaknesses in our environment.

We are not as maniacally focused on our task at hand as that yet.

It's interesting that Ismail referred to updating our threat model, and he drew that analogy back to, you know, like the weather. You know, like like you look at the clouds and based based on what you see in the clouds, you react accordingly. You might pack an umbrella or something along those lines.

I think that's such a a propelled analogy because interestingly, as it killed in the seventies, growing up in The Caribbean in a hurricane zone, I remember sitting around the big box TV in the living room. I think it was even black and white at one point because I'm old and permudgeonly, as I said earlier, and watching the predicted hurricane track for some storm that left the the the Western Coast Of Africa that's barreling towards the Caribbean Islands. My island is a small five mile by seven mile island.

We could get and routinely got decimated by hurricane. If a hurricane's coming, you need to know. Those predictive tracks with the little circles and saying the storm looks like it's gonna go there, those in the seventies already were drawn and calculated by AI.

It was one of the first very widely, used use cases for predictive AI. So it's interesting that Ismail uses that as an analogy because that is exactly what we're doing. We're taking a use case that was well developed with weather prediction, and that's what we're applying to attacker prediction.

So you asked how we can apply this to the customer environment. One of the things that I am maniacally focused on right now is helping customers, as I said earlier, draw this all together. So I'm not gonna get into product names because this isn't a sales pitch, but we've just developed something in the category called a managed, extended, detect and response toolset.

And what's unique about our approach to that, that approach in that space is not unique at all. It's been existed. Just about every large cybersecurity vendor has something that plays in that space.

What's unique about our take on it, we are heavily focused on regardless to what your security stack consists of. That's what we're gonna ingest. Most of the other vendors use XDR type tool to say, listen, to get the maximum benefits out of our tool, you should really be using all of our stuff.

So you should get our firewall. You should get our endpoints. You should get our cloud stuff, and then it's gonna be maximized.

Our take is different. Our take is we understand that you, the customer, probably struggle with two things, a widely diverse, ecosystem of security tools. And the second thing, especially for medium to smaller companies, you're probably struggling with finding the human resources to do these jobs.

So we we have a managed solution where our threat analysts, our security analysts, our well trained human experts combined with predictive AI that, as Ismail said, has been well trained on sensors and sensor data and threat data that we've been receiving for the last, you know, ten, fifteen years. That's how we are able to not just ingest all of the data, classify and recognize that this is an attack that we've seen before, even if it's using novel and brand new unseen before malware and then provide you defense defensive strategies against it. That's how I believe BlackBerry can help the market, the customers the most.

I I mentioned that I started as on the the attacker side. I I was never an illegal attacker. I started as a pen tester.

And then, you know, so pivoted into reversing code and doing some other things like that. And, you know, I went from there. But most of my career was on the customer side.

I proactively switched or maybe was convinced to switch to the vendor side probably about ten years ago because I saw that gap. I saw that as a customer, I could buy all of these new widgets and toys, and it really wasn't making me more secure. So I came to the vendor side to try to influence the vendor defensive motion and product strategy to put out more products that legitimately can help customers solve those two problems.

The manpower problem, the diversity of toolset problem. The amount of times I am told by a customer, Greg, we'll rip everything out and put in whatever you tell us, that's infinitesimally it has happened. I have had a couple of greenfield customers that said, Listen, none of it's working.

Take it all out and help us replace it. But that's rare. Most of the customers either have financial constraints, time constraints, or some other constraint, so they need to make do with what they have.

Let's build a toolset that allows customers to use what they have and maximize the value they extract out of it.

vision about that. I'll chime in on that as well. The top five companies in the world by market capitalization right now are tech companies, all founded or co founded by individuals with heavy technical background.

This is very unique in this era that we find ourselves in now. This is changing leadership in a way that we, leadership, entrepreneurship and just vision and strategy in a way that we haven't seen before. I think we're at a unique precipice to where we can maximize some technological applications that ten, twenty years ago, we wouldn't have even been having the conversation.

The technology was there, was readily available like AI that was written in textbooks in the late 1950s. The technology has been there. It's being popped into the forefront now because of that seismic shift where the biggest companies are tech companies.

So my daughter who's 15 years old is very tech savvy. When I was 15 years old, I was an oddball because I was tech savvy. Like they looked at me like, you know, I had three heads.

So what do I predict? I predict we're going to see acceleration in how those types of use cases and opportunities and candidly, business opportunities are going to appear. But I also see so there's always the positive and the negative.

I see a risk, a huge risk of moral and character failures at the level of those leaders who have a unbalanced sense of high technical prowess, but potentially low morals, potentially low leadership acumen, potentially low spiritual acumen. There's an opportunity to balance that out as well. Personally, that's where my focus is.

That's how I met Daniel from this podcast because his, you know, we we've spoken at events or met each other at events where we're trying to talk about those types of topics. You know, how do you pull together technology and other things that are more from a moralistic perspective, and and, you know, help have the technology, but balance that out and vice versa. I think that's where we're going to have to be very cautious that we don't over rotate and, you know, end up accidentally.

And I'm not talking about politics now at all, but end up accidentally handing the reins over to people whose gifting got them to a place where their character potentially could not sustain them. And I think we're at very big risk of that. So those are the two things that I see kind of for the future, both opportunity and risk.

Fantastic insights from both of you. Gentlemen, thank you very, very much for coming on the show. It was a great conversation.

I learned a lot.