How AI, Automation, and Advanced Threat Intelligence Tools Can Help Mitigate Risks Across Sectors

00:14Welcome to Nasdaq trade talks,

00:16where we meet with the top thought leaders and strategists in emerging technologies,

00:19digital assets and regulatory landscape, and capital markets.

00:22I'm your host, Jill Malandrino,

00:23and joining me on the desk at the Nasdaq market site,

00:25we have Adam Jackson,

00:26CEO of 360 privacy.

00:28Eric Newton, CEO of Cyber Sheath.

00:30And Jeff Schwartz, VP of Americas engineering at Nasdaq listed Check Point.

00:34We're here to discuss how A.I.

00:36automation and advanced threat intelligence tools can

00:39help mitigate risks and support compliance across sectors and,

00:42of course, managing the ever evolving cybersecurity landscape.

00:46It is great to have everyone back with us.

00:48I believe just about everyone has been with us before.

00:51As a quick reminder though, Adam,

00:53where does 360 privacy sit within the cyber ecosystem?

00:57Yeah, so we really we largely focus on

00:59the executives and principals at companies and making sure their digital footprint

01:02doesn't make them vulnerable to either AI or not AI attacks from attack groups.

01:08Yeah, I mean, that's an interesting space to see how that is

01:11evolving and the implications of some of those,

01:14um, what the bad actors are leveraging cyber sheath.

01:17Say that fast.

01:19So we're we're a managed service provider,

01:21putting together the three puzzle pieces of managed it,

01:24managed cybersecurity and then governance risk and compliance and

01:27putting them all together in one service for critical infrastructure providers.

01:30All right. And checkpoint. Good to have you back.

01:31Yeah. Great. Thanks for having me, Jill.

01:34Yeah. We provide best in class security solutions through

01:37our hybrid mesh platform that allows users and

01:40devices to connect securely over any diversity of infrastructure.

01:44I would say with Jeff,

01:46with with the environment evolving as quick as it has,

01:49you can even argue perhaps out of all industries,

01:51cyber is just moving really quick.

01:53Um, part of that is the sophistication of the attacks and how good actors,

01:58bad actors are leveraging a lot of the same technology.

02:01Yeah, the sophistication of the threat landscape has increased

02:04precipitously with the advent of AI tools.

02:07And what that's effectively done is lowered the cost of attack.

02:11And by effect, it's put a lot of pressure on organizations to

02:15close an operational gap that lives between their day to day,

02:20business as usual environment and mitigating these very,

02:23very both advanced attacks in terms of sophistication,

02:27but also increased volume of attacks that we see across every vertical.

02:30Yeah. And, you know, Eric,

02:32part of it is nation states as an example,

02:34are very well funded.

02:35They're highly sophisticated and they are looking

02:38at vulnerabilities such as infrastructure, national security.

02:40That's right. And they're not constrained by any of the regulatory requirements we have.

02:44So where we can't make some offensive moves unless it's done at the government level,

02:49those attacks can be done.

02:50They can be outsourced by nation states to private companies within those states,

02:54or they can be state funded attacks.

02:55And on the defender side,

02:57we're kind of subject to all comers and have to defend against all of them.

03:01Yeah, and I would imagine part of the challenge to

03:03Adam is the more technology that's integrated,

03:05whether it's legacy systems or new technology that you're bringing on

03:08the attack surface just continues to expand.

03:12So there's more vulnerabilities, whether it's through third,

03:14fourth, fifth vendors and so forth.

03:16It just continues to expand.

03:18Yeah. So with the amount of data that's freely flowing right now

03:21across a whole bunch of different environments,

03:25it's just almost impossible for there not to be

03:27vulnerabilities either open source or closed source for nation state actors.

03:31Yeah. Are you hearing anything from clients or advising over one consistent subject?

03:36Are they bringing up one area that keeps them up at night, if you will?

03:40The biggest is is training the end user.

03:43Right. So you can have all the tools in the world.

03:45But the old saying is true of the person at the keyboard is your biggest vulnerability.

03:49It used to be, hey,

03:50look for broken English for phishing emails or look for

03:54like ridiculous domains pretending to be your CEO.

03:57Now, language isn't really a barrier.

04:00You run your script through ChatGPT and it comes out and

04:03the target language of the person you're trying to attack.

04:07So really getting the user integrated or getting training

04:11integrated at the user level in the age of AI is is the biggest,

04:16um, biggest block or stumbling block for a lot of our clients.

04:21And Jeffrey, I'm sorry.

04:22It's a great point. I think that the the attack sophistication

04:25has increased and then the attack surface has increased in parallel.

04:28And so one of the things we're seeing is just the supply chain.

04:32And so if we look at our customers who generally are

04:34defense contractors serving the Department of Defense,

04:37the sun never sets on the DoD supply chain.

04:39So that means that attack surface is kind of always

04:41available for these very sophisticated adversaries.

04:44And we're going to get back to contractors in just a moment here.

04:46But when we think about some of the gaps within the system,

04:49is are there enough skilled people that are able to,

04:53you know, keep up with the evolving cyber landscape.

04:56Yeah, like like any other space.

04:58There's, you know, people process and technologies.

05:00And the challenge is that many organizations have adopted

05:04what they perceive to be commoditized technologies,

05:08and they're trying to implement them in a way

05:10that operationally does not keep them secure.

05:13And what's really important for organizations to focus

05:16on is what is the capabilities of the technologies,

05:20and what is the best in class nature of the the vendors that they partner with.

05:25Because at the end of the day,

05:27this false sense of this false sense of security around the perception of

05:33commoditization has allowed organizations to assume

05:35that every vendor is like for like in certain areas.

05:38And that has led to huge gaps in operational exposure.

05:42And of course, if there is an incident with a vendor,

05:46you're still responsible for that because it's integrated into your system,

05:50it could potentially impact your clients, the business and so forth.

05:53Yeah. And that's that's part of the challenge that it's

05:55really important to focus on best in class,

05:58but also partner with organizations that can monitor

06:00and manage your environment when when you're not there.

06:04Yeah. You know, Eric,

06:05you brought up an interesting point in your notes here specific to defense contractors,

06:09because they have a number of

06:10other requirements to be able to operate within their infrastructure as well.

06:15So there's all different types of parameters and security clearance.

06:18And it's not an even playing field,

06:21if you will, in terms of who has access.

06:22And I'm sure that's by design,

06:24but it does add another layer of complexity.

06:26Yeah, it's very interesting. I think most Americans would be

06:28shocked to know that commercial defense contractors,

06:31until very recently, until December 16th of last year,

06:34didn't have to meet mandatory minimum cybersecurity requirements.

06:37So it was kind of a don't ask,

06:39don't tell environment for many years where you took the contract,

06:42it was assumed you were implementing security,

06:44but there was no audit mechanism.

06:45That audit mechanism is only a couple months in coming online.

06:50So now going forward,

06:51all defense contractors have to meet these requirements.

06:54But it could take many years before that rolls through the system.

06:57It's just mind blowing to me because on a federal level,

07:00they're the ones who should be providing the framework and enforcing it, I feel.

07:04Out of all the issues and uncertainties

07:05that we have in the economy and the market right now,

07:07national security and cybersecurity, you know, detection,

07:11mitigation and response is really up there as far as I'm concerned.

07:14Without a doubt, with nation states like China, Russia,

07:17North Korea all attacking

07:19our defense contractors and our other critical infrastructure partners,

07:22you would think that they would be one of the most well regulated,

07:26well audited set of industries,

07:27but it's actually much the contrary.

07:30Yeah. Which to me is interesting.

07:32Adam, when we think about the evolution of threats,

07:35any trends that you can discern from what you're seeing?

07:38Yeah. So we're seeing personal data used in threats or in attacks.

07:42More and more, we're seeing data that winds up on the dark web through a vendor breach,

07:47like you guys talked about before being made available, and,

07:51and more people being able to access that kind of data than ever before,

07:55and that data is being used more effectively in either targeted spear phishing attacks,

08:00brute force password cracking, things like that.

08:03Much more than we did even like 24 months ago.

08:05Right. And that's part of the gap because you can have all the software,

08:08the hardware, you know,

08:09the best vendors in the world,

08:11but you still have people that are the front line and not intentional.

08:14But, you know, some of these scams are really hard to discern these days.

08:18Right. I think the other thing we're doing,

08:20going back to are there enough, you know,

08:22are there enough skilled people in the cybersecurity industry looking at like long term?

08:28Right now, it's really hard for

08:30a junior cyber cybersecurity person to get a job because AI is doing their job.

08:34And you you're really looking.

08:35Most most organizations are really looking for senior people.

08:39Well, in 15 years,

08:40when those senior people retire,

08:42there's not going to be the large cohort of

08:44junior people that have been gaining experience for the last 15 years.

08:47I think that's another thing that we're grappling with as an industry a lot right now.

08:51Yeah. Well, and part of the challenge too is Jeff.

08:53The role of the CISO and senior cybersecurity leadership

08:56has really evolved along with the landscape.

08:59The responsibility is whether you're thinking about it from

09:02the financial perspective and communicating the needs with the board,

09:05with senior leadership, risk management,

09:07being able to have a bird's eye view and operate in a silo.

09:10That's another challenge. So it's evolving as quick as the landscape.

09:13Yeah, for sure. And the the old days of security was somewhat well defined,

09:18where you control what goes in and out of your data center.

09:21But now there's so many more modern application

09:23and infrastructure asset classes in the cloud,

09:26AI tools that you don't know how the information is being manipulated,

09:30shared or modified or distributed to people that would otherwise not have access to it.

09:36So providing security in this footprint where there's so much more modern

09:40and the velocity of the business is so much higher that the rate of change,

09:45it's difficult for organizations to maintain a very high level of

09:49both visibility and enforceable controls across these very, very modern assets.

09:55Think about it over the past five years. So what?

09:56March 13th, 2020 was the official start

09:58for Covid in the city when everybody started working from home.

10:01Not only was that transition to the cloud environment starting,

10:04all of a sudden we went from a physical world to

10:07a world that operated remote and virtually.

10:10So you had this confluence just in the span of five years.

10:14Yeah. And even now,

10:15the concept of agentic AI, which is just, you know,

10:18fancy language for autonomous AI agents

10:22executing commands without necessarily human intervention.

10:26When you when you follow that forward,

10:29the art of the possible is very,

10:32very compelling from a from a business outcome perspective.

10:36But from a cybersecurity perspective,

10:37it's also very, very dangerous environment.

10:39Yeah. Um, Eric, do you think boards and senior leadership that they

10:43are thinking about cybersecurity in a way,

10:47when it comes to allocating resources, you know,

10:49being able to communicate those needs to the board to

10:51to leadership because they're always thinking about ROI, right?

10:54What does this look like? And this isn't necessarily I mean, the cost.

10:57It's intangible. Should you have an incident which,

11:00you know, becomes a breach, right.

11:01I think the one of the ways I try and tell

11:04our partners the way to think about it is from a compliance perspective,

11:08you can always kind of sell investment to the board because you have to

11:11do certain compliance things to stay in business and to to comply with the law.

11:15Boards understand compliance all day long.

11:18If you can take the cybersecurity,

11:20the operational side and tie that back to your compliance efforts,

11:23I see a lot more chance of having success and a lot shorter levels of conversations.

11:28In trying to help the board understand why these investments need to be made,

11:32and then you can kind of measure once comply,

11:34many solve the compliance problem and parallel to the operational.

11:37I think what also concerns me is there's

11:39such a rush because the landscapes are so competitive,

11:41whether it's internal or external facing, you know,

11:43new type of AI products and so forth.

11:46Did do you think businesses have gone too fast and perhaps risk management.

11:51And the cyber part of the equation was an afterthought.

11:54Or is there enough to even bench that on yet?

11:56It is often an afterthought.

11:58Cyber is a cost and for most industries.

12:01And so they think about meeting the regulatory requirements first.

12:04So again going back to defense contractors,

12:06they're now prohibited in many cases from

12:08winning new contracts until they meet these minimum requirements.

12:11So now we're going to make the investment because we

12:13want to continue to kind of benefit from that revenue.

12:16So I think the carrot instead of the stick has helped solve that problem.

12:19And I think we need to take that model across other industries.

12:22And let's talk about that, Adam, for a moment here,

12:24looking forward and how emerging technologies are shaping the future of cyber resilience.

12:29Yeah. So going back to the previous question,

12:32I think in 2025,

12:34it's borderline malpractice not to have

12:35a true cybersecurity expert sitting on your board,

12:38not a board observer not advising the board,

12:40but actually sitting in a board director's seat.

12:44But to your question before of,

12:47you know, looking at the resilience piece of things right now,

12:51I think there's so much effort being put into the idea of

12:54preventing the attack and getting the right tools in place to make sure that,

12:58like, the environment stays secure when in 2025 there isn't one environment anymore.

13:03There are 15 different environments that every company is operating, operating out of,

13:08and I don't think companies have fully

13:10built policies around this new environment that we live in.

13:13And the thing is, it has to be sustainable and it has to

13:15be able to evolve along with the environment. You just don't set it and forget it.

13:18When it comes to cyber, it's almost like when you have

13:20fire drills in the building or in school,

13:22um, has to be practiced.

13:24You have to kind of always anticipate what

13:27the vulnerabilities are and what that mitigation and response is like.

13:30It's not fun responding to a cyber incident.

13:33Well, the other hard part,

13:34I think getting down to the user level is

13:36cybersecurity annoys the end user like there is.

13:39There's not a good way to do cybersecurity without creating friction for the end user.

13:44And I think the end users are starting to understand that,

13:47especially at technology driven companies.

13:49But in legacy industries,

13:50we're going to have to learn to adapt cyber policy and

13:54cyber practice to not create

13:57so much friction that the end user just finds a workaround for it.

13:59Jeff, it's not fun having to do the automatic updates when

14:02you're when you're in the middle of a massive presentation or a report.

14:06It's, you know, the most important thing that you're doing all day long,

14:08or changing the passwords to all these different scenarios and so forth.

14:11But again, it has to be clear,

14:14and it has to be a policy that continues to evolve.

14:17That's the first step, even before you think about

14:19how emerging technologies are helping to.

14:21Yeah, I mean, how we look at it is that we want to provide a paved road, right?

14:25That, you know, end users will always find their own way.

14:28And, you know, but they may be taking a dirt road on the side,

14:32and they're not going to be able to run as fast.

14:34They're not going to be able to go as quickly.

14:35They're not going to be able to go as safely.

14:37But if we can provide the infrastructure to

14:39provide that paved road where they can go as fast as they can,

14:43you know, the the concept is that breaks allow you to go faster, not slower.

14:46So, you know, that's the that's the model that we're trying to emulate.

14:51Well it's interesting. So again Eric,

14:54when you think about how emerging technologies are shaping cyber resilience,

14:57and if you employ some of these AI or predictive measures,

15:00it should in theory help to detect,

15:02mitigate and respond more effectively to.

15:05Yeah, that's absolutely right.

15:06It as much as the attackers can use it to their advantage,

15:09we have the same opportunity to use it to our advantage and resilience.

15:13I think you used the word is that's the key really.

15:16There is no perfect defense.

15:18Everybody accepts that.

15:19You have to spend more time on resilience.

15:21I think that's an area most companies don't spend enough time on.

15:24I also think having a more constructive regulatory framework,

15:28as with any evolving space.

15:30Something that's measurable and there's outcomes that that tie back to kind of

15:34the compliance framework and everyone can agree

15:36delivers compliance and security. I agree 100%.

15:39Yeah. I mean it's interesting,

15:40Adam, you know who's doing the reporting.

15:42Is it the compliance responsibility.

15:43Is it security teams responsibility?

15:45Does it come down to the CFO vertical because it's risk management?

15:48To me at this point,

15:49the idea that, like the CFO,

15:51the CSO and the CSO are separate and living in different silos,

15:54that's so outmoded at this point.

15:56Like, to me, like that line kind of meets the CEO

16:00and like that's where the end responsibility lies at the CEO and board level,

16:05not necessarily the CFO line or the CSO line anymore.

16:08Yeah. Which is interesting because I feel like we are constantly

16:11covering cyber and data governance panels here.

16:15And the one thing that always comes back to is operating in silos,

16:18and it seems to be one of the most obvious things,

16:21is that's the one obvious challenge that consistently comes up.

16:24When if you look at,

16:25like most high profile attack,

16:28most high profile physical attacks on an executive or on an asset

16:31of a business typically start off with Osint research, open source intelligence,

16:36resource research, or some sort of cyber attack,

16:39giving the attacker some level of knowledge before executing the physical attack.

16:44That's something that's really started in

16:47the last ten years and really ramped up in the last five.

16:49Yeah. It's interesting. I think, Jeff,

16:51another thing that I've been questioning throughout the coverage here,

16:54the CTO and CSO or CSO role,

16:57I mean, they essentially would be separated out at this point.

17:01Yeah. So so CISO ultimately is part of risk,

17:05which in many organizations is a CEO or CFO.

17:08But really it comes down to the culture of the institution that organizationally,

17:13how fast is that organization willing to run and potentially break things as they go,

17:19but move quick and adapt and innovate in every vertical we support,

17:23there's organizations that are on the cutting edge and you know that they were

17:28cloud first and very modern infrastructure asset investment.

17:33And there are others in that same vertical that are still,

17:36you know, very, very legacy minded.

17:39So I think it really comes down to the culture of

17:40the institution to move quickly and innovate quickly.

17:43And that's what will ultimately determine how they're successful.

17:47Which is interesting because another trend that I'm hearing about too,

17:49is almost reverting back to hybrid solutions.

17:51So it's not we're 100% in the cloud.

17:53We're 100% on prem.

17:54This way at least we have some redundancies and we're building our policy around that.

17:58It's interesting to see how the pendulum has swung back.

18:01100%. I mean, security used to be kind of the Department of no,

18:04you can't do that.

18:05And now it's very quickly evolved into how can we do this in a safe,

18:09secure way that adds value to the business?

18:11Are you seeing the same thing too, Eric,

18:13when it comes to more hybrid or adding more redundancy to the policy?

18:16Without a doubt, there's no real definition anymore of what is the edge.

18:20And so everything is kind of hybrid now.

18:22I think a company that's in a good place

18:24is one that can even define what they are anymore,

18:27because just knowing where your assets are and what they are is half the battle.

18:31Yeah, it certainly is.

18:32I appreciate everyone's insight.

18:33Thanks for joining us on trade talks.

18:34And thanks for joining me for Marketsite.

18:36I'm Joe Malandrino, global markets reporter at Nasdaq.