S1: Unsupervised Learning is a podcast about trends and ideas in cybersecurity,
S1: national security, AI, technology and society, and how best to
S1: upgrade ourselves to be ready for what's coming.
S2: All right, welcome to Unsupervised Learning. This is Daniel Miessler,
S2: and I'm happy to have Matt Mueller here from tines.
S3: It's a pleasure to be here Daniel.
S2: Awesome. Yeah. Looking forward to this conversation. Um, I've heard
S2: so much about the company and, uh, happy to hear
S2: more about, uh, what it's actually about what problem you're
S2: trying to solve. Um, I really like to start there with, uh,
S2: the problem. What do you see as being the problem around,
S2: I would say security in general, but also, how are
S2: security problems being magnified by AI stuff?
S3: Yeah. So I'll maybe start with the original problem, uh,
S3: that our founders were trying to solve. They, uh, were
S3: security operations Professionals who had, you know, done security work
S3: at companies like DocuSign and at eBay and some other
S3: large places. And they were extraordinarily frustrated by the just
S3: a sheer amount of manual labor involved in actually responding
S3: to security incidents. Right. Like if you think about what
S3: a traditional security operations center or SOC does, they receive
S3: an alert. They have to go research that alert in
S3: a whole bunch of different places. Uh, and, you know,
S3: take a number of manual steps just to decide if
S3: that's a true positive, right. They have to do work
S3: just to decide if they have to do work. Um,
S3: which is an enormously frustrating place to be. And so
S3: they were looking out on the market for some kind
S3: of automation tool, uh, that could help them ease that
S3: burden and not seeing one that they wanted. They ended
S3: up building Tynes. Uh, and, you know, starting out sort
S3: of first and foremost as this tool to solve a
S3: lot of the SoC, uh, problems around, you know, inefficient, uh,
S3: you know, alert management and, you know, burnout and all
S3: those sorts of things. And what we've discovered over time,
S3: which I think has been really cool, is that the
S3: SOC is not the only team in cybersecurity that needs automation, right?
S3: Turns out there's inefficiencies everywhere. Um, another really fascinating thing
S3: that we've that we've learned over the years, uh, is that, uh,
S3: automation is actually a lot easier than I think a
S3: lot of people give it credit. Right? Like a lot
S3: of traditional automation tools, required learning Python, learning coding languages,
S3: having very, very deep systems knowledge in order to be
S3: able to get automation done. Um, and so with the
S3: rise of AI, what we're seeing is, you know, people
S3: that have automation ideas, right? Like, I think if you
S3: ask almost anyone, they have ideas about how they can
S3: make their job easier, right? They just haven't in the
S3: past necessarily been able to express that. Um, and now with,
S3: with tools like, I like no code. Uh, no code.
S3: Workflow builders, these folks are able to, you know, build
S3: those automations like like they haven't before. Um, so, yeah,
S3: I would say the pain point that that Tignes has
S3: been trying to solve is, you know, everybody who has
S3: ever had to, you know, push a file from point
S3: A to point B manually has a pain that Tignes is,
S3: is trying to solve.
S2: Yeah. Interesting. Yeah. One way I've been thinking about this
S2: is like, what would you do with five times more staff?
S3: Right.
S2: Right. So it's like we know what we want to do.
S2: We're constrained by how many eyes and hands that we
S2: actually have and brains. Right? So I mean, all these
S2: things could be done manually. The question is, you know,
S2: do you have the people to do it? Do you
S2: have the people to create the automations to do it?
S2: And it just seems like, um, I'm a big fan
S2: of Theory of Constraints, and the constraint is usually people
S2: in time that they have to focus on these problems.
S3: Absolutely. And I think, you know, one of the things
S3: that we're also learning as well. And this is where
S3: AI has been such a such a fascinating new addition
S3: is that it's constraint around, uh, knowledge as well. And like,
S3: even if you have, uh, all the people that you want,
S3: security teams have just such a fractured ecosystem that they're
S3: responsible for protecting, and it's virtually impossible to become an
S3: expert in every single system that you're responsible for. Right?
S3: And so, you know, again, what we see is, you know,
S3: these these people that are experts, they free up all
S3: this time. Great. Maybe I know exactly what I want
S3: to do in AWS, but we just acquired a company
S3: that has a GCP environment. Um, and now I have
S3: to learn an entirely new, different cloud provider. Right. And
S3: I'm just not going to be as good in that. Yeah. Um,
S3: and that's where I think AI tooling has been really,
S3: really helpful, uh, to make that context switching less of
S3: a cognitive load for people.
S2: Mhm. Yeah. One thing I'm worried about is this addition
S2: of staff to uh attacker teams.
S3: Mhm.
S2: Right. So if you have an entire team, let's say
S2: it's 100 people. And five of the people are like really,
S2: really good and really dangerous. What happens when AI tooling
S2: or automation or agents or whatever it is turns that
S2: into like 30 or 50 of the best people and
S2: it turns the other like 80 into like 800. And
S2: this is what I think the agents are actually going
S2: to do for both us as defenders, but more importantly, attackers.
S2: So the time that it would have taken them to
S2: find our mistake goes from like days or hours to
S2: like maybe minutes. And so we have to be doing
S2: something on the defense side to counter that.
S3: Absolutely. And for me, it's it's been interesting watching how
S3: attackers have been thinking about AI. Um, Sophos actually just
S3: published a report recently with some analysis around how attackers
S3: are using AI. And if you look back a couple
S3: of years, there were a lot of headlines that I think, uh,
S3: you know, they were valid at the time, right? We
S3: just didn't know what generative AI was, was truly capable of.
S3: And so there was a lot of concern that I
S3: was going to invent all these brand new kinds of attacks.
S3: And that really hasn't happened. Right. Instead, what we're seeing
S3: is attackers are using AI much the same way defenders are. Hey,
S3: make my email sound a little better, right? Um, you know, uh,
S3: make my phishing page, uh, you know, generate 14 different
S3: varieties of landing page for me. Um, and so where
S3: we're seeing attackers start to use AI a lot more
S3: to your point, is increasing their velocity, right? Um, and
S3: so to my mind, you know, again, as defenders, you know,
S3: there's only so much time and attention that you can
S3: that you can afford to put into problems. Um, let's
S3: not worry about, you know, types of attacks that haven't
S3: been invented yet, right? Let's worry about the ones that
S3: are occurring today and how those are evolving. Um, you know,
S3: our our security teams, uh, can really build defenses against
S3: attacks that don't exist yet. Um, but we can sort
S3: of see how those attacks are becoming faster. Right? How, uh,
S3: the the, you know, the translations are becoming better and better. Uh,
S3: and so the bar for fooling our employees is, is
S3: getting lower. Um, it means we need to be able
S3: to react faster. Uh, we need to be able to react, uh,
S3: in a more, uh, you know, we need to be
S3: able to adapt a little bit better, right? Like, we
S3: can't just apply rigid playbooks to every single security scenario. Um,
S3: and so, you know, to me, it's a little bit
S3: of an AI arms race. Um, and, you know, I
S3: think for us as, as defenders, in my view, applying
S3: AI in the places where attackers are also applying it,
S3: that seems to make, you know, make the most sense,
S3: at least today, right, with today's models. And that that
S3: answer could change in, you know, three days, right, when
S3: some new foundation model gets released that, uh, that changes
S3: the game. But at least with today's models, I think
S3: that's that's where I sort of see things evolving right now.
S2: Yeah. I really love this point that you're making because
S2: the the reality is and it actually goes to pre
S2: AI as well. It's like, are you going to hire
S2: this super hacker person who's going to like all these
S2: new techniques and new ideas and advanced attacks and like
S2: the day to day job of like a CISO or
S2: the day to day job of a defender is so
S2: nuts and bolts, it's like we okay, is a log
S2: being generated for step one.
S3: Right?
S2: Can we even like if you take like a bunch
S2: of minor attacks, can we even know if this attack
S2: is being waged against us? Do we have any sort
S2: of detection capability? Right. That's one question. And then the
S2: question is like, is that log going anywhere where someone
S2: could potentially see it, a system or a person or
S2: anything like that? Okay. That's cool. That's a nice second level.
S2: Is anyone actually looking at it? Okay, that's three. And
S2: three doesn't even guarantee what you need. Which is are
S2: they going to do something about it. And like these
S2: basic workflows are like everything. And if you look at
S2: like a ciso's job, it's managing the budget. It's managing
S2: this basic workflow of like logs and processing and, you know, uh,
S2: workflows coming through the security operations. Um, and it's politics
S2: and stuff like that. And it's like, it's not hacker movies.
S2: It's really just these fundamentals that we have to do
S2: more consistently and at scale. Um, so I really like
S2: that point. What do you see as like the, the
S2: biggest challenges for CISOs right now?
S3: Yeah, I mean, for CISOs right now, I think there
S3: are there are two halves to the challenge. The first
S3: is securing AI for their enterprises. Uh, and the second
S3: one is how to apply AI for security. Um, you know,
S3: if you look at the first problem, um, it's been
S3: really interesting to see the CISO role evolve from sort
S3: of a self-acknowledged the team of no, uh, to, you know,
S3: really trying to enable the business. Um, we definitely saw,
S3: you know, when when, you know, for like ChatGPT first launched,
S3: for example, there was some team of no, uh, mentality there, right?
S3: And what happened? Every single employee just worked around the
S3: constraints that the security team tried to throw up. Um,
S3: and so now what we see are CISOs starting to,
S3: you know, I think the CISOs that are that I
S3: see that are least stressed about AI are the ones
S3: that have, you know, started to adopt frameworks around usage, right? Helping,
S3: you know, not just setting barriers for their organization, um,
S3: but working with them to understand, like, hey, what are
S3: the risks that we're taking on, right? And like, honestly,
S3: even just showing where AI doesn't necessarily succeed as well today. Right?
S3: It's not saying no, you can't use it. It's actually
S3: working to demonstrate. Okay, this use case seems interesting, but
S3: may not actually be the most helpful output, right? We're actually,
S3: you know, if we have a chatbot, can it be
S3: fooled into giving away free airline tickets, for example? Right. Um, yeah. Uh,
S3: and will that be held up in court? Answer is yes. Uh, so,
S3: you know, I think when it comes to securing AI
S3: for the business, um, you know, it's it's been actually
S3: almost a little bit refreshing to see CISOs adapting more quickly,
S3: I think, than they have to to other technology stacks. Um,
S3: and sort of saying like, hey, this is our this
S3: is our next big frontier chance to serve as a
S3: trusted advisor to the business, right? Like, we can reset
S3: a little bit on, on some of the other, you know,
S3: technology shifts and and just say like, right, we're we're
S3: now helping the business, uh, and helping the business understand
S3: what and when and where it wants to take on risk. Um,
S3: when it comes to applying security within or applying AI
S3: within the security organization. That's where I think there's going
S3: to be a very interesting balance. One of the things
S3: that we're starting to hear now is that boards are
S3: mandating that teams within an organization figure out how to
S3: use AI. And, you know, when it comes to cybersecurity defense,
S3: AI is useful for a lot of different scenarios, but
S3: not necessarily every scenario. Right. You have to balance the
S3: fact it's, you know, I sort of, you know, if
S3: you're if you're building the plane while flying it, you
S3: have to make sure a wing doesn't fall off when
S3: you're adding, adding a different technology. Right. And so I
S3: think for CISOs who are, who are adapting AI for
S3: cybersecurity defense, I think that's going to be a really
S3: interesting sort of balance to strike of saying, yes, we
S3: need to go experiment with AI. We need to go
S3: figure out where it's useful for us, but also recognize
S3: that the consequences if you know, if AI fails for defense,
S3: it may be a little higher stakes, right? Because now
S3: we're talking about actual like, you know, data protection, right.
S3: And potential data breach issues. Um, and so I do
S3: think that CISOs have their work cut out for them, uh,
S3: you know, in that regard, uh, when they when they
S3: have to go be the ones that are applying and
S3: using AI versus setting guidelines for other teams.
S2: Sure. Absolutely. So why why do you think boards are
S2: pushing companies to adopt AI?
S3: I think it's, uh, you know, sort of the in
S3: a lot of ways, boards have always pushed companies to
S3: be more efficient. Right. To to make sure that they're
S3: they're maximizing the effectiveness of their team. Um, no board
S3: of directors is going to say, you know, it looks
S3: like you have a pretty, uh, bloated workforce that really
S3: isn't doing much. That's fine. Right. Um, and, you know,
S3: now there's a new tool at hand, right? Which has
S3: a lot of promise, uh, to, you know, uh, displace
S3: some of the grunt work that teams have to do. Um,
S3: you know, again, I don't think most people at this
S3: point are seriously contemplating replacing the bulk of their staff
S3: with AI. You know, it's it's, you know, it's a
S3: fear that certainly has been heard and talked about a lot.
S3: But I think the reality is the focus now is, hey,
S3: give your, your team access to these tools. Um, see
S3: what they can do. Right. See if they can increase their,
S3: their own efficiency here. Um, and so to me, what
S3: this translates to is we will ultimately be more effective
S3: as a business, not necessarily by replacing our staff, but
S3: by making it so that, you know, their individual productivity, uh,
S3: extends a little bit further. Right. Um, or, um, you know,
S3: another lens of this is we know that the business
S3: of doing business inherently involves a lot of toil. What
S3: would our designers what would our security professionals? What would
S3: our HR people be doing, uh, if they weren't just,
S3: you know, sort of doing daily, daily document processing tasks, right?
S3: Like what creativity could we unlock for the organization? Um,
S3: so I think it's it's fair, honestly, for boards to,
S3: for boards to push companies on these things. Um, yeah.
S3: I think the only failure mode is if they say
S3: you must adopt AI. No exceptions. Uh, even if you
S3: find a use case that models today's models aren't necessarily
S3: ready for yet, right? Like that could be the the
S3: only danger there.
S2: Yeah, that's what I was going to say is there's
S2: probably some push as well that says just get it
S2: into product so we can market it because everyone else
S2: is talking about it. But I think it's probably like,
S2: I don't know, 75, 25 in the direction of like
S2: find efficiencies, like you said.
S3: Yeah, absolutely. And you know, definitely the the early days
S3: of AI adoption, I think was a lot more, you know,
S3: this model of and now we have AI, right. Like,
S3: well for what you just kind of added a wrapper
S3: around around a chatbot. Right. Um, and you know, for us,
S3: at times as we were thinking about adding AI into
S3: our product, I mean, we started out as a as
S3: a no code workflow builder. Um, we took a look
S3: at some of the early AI pushes, and we ended
S3: up with something like 50 failed experiments, uh, to integrate
S3: AI into our platform because we didn't just want it
S3: to be yet another chatbot, right? That looks cool as demoware,
S3: but doesn't actually add any value for anybody. Um, it
S3: requires some thoughtfulness to make sure that, you know, you
S3: can't just slap AI on something and say, oh, great,
S3: this is now a better product, right? Like, it actually
S3: requires deep thought and integration to make AI useful.
S2: Yeah, and that's a great transition. We've set a pretty good, uh,
S2: baseline here for what's happening in industry. So for the
S2: problems that we talked about, uh, difficulty of automation, basically
S2: a constraints on, you know, work that could be done
S2: by security teams because of just the size of the
S2: team and the stuff they're working on. So how is
S2: time specifically addressing these?
S3: Yeah, we're addressing it through a couple different layers. The
S3: first is, uh, recognizing that just about every single security
S3: team has a different, uh, adoption maturity level when it
S3: comes to AI and also different constraints. Um, and so
S3: our number one design principle was, you know, don't be
S3: prescriptive in how people use AI within your platform. Um,
S3: a very. And so, you know, one of the very first, uh,
S3: integrations we built was, uh, we called it an automatic transform. Um,
S3: and basically what this was, is, you know, a lot
S3: of what people use times workflows for is to, you know,
S3: take data from one system, transform or manipulate it in
S3: some way, and then move it into another system automatically. Um, and,
S3: you know, if you don't want to learn the necessary,
S3: like all the ins and outs of some arcane like
S3: JSON schema. It turns out AI is actually really good
S3: to understand. You know, given a JSON input you tell AI.
S3: I would like to extract these four fields, transform the
S3: data in this way, and then output it in this format. Um,
S3: and so the first, you know, so one of the
S3: first integrations we built was this was this automatic transform
S3: where I would actually, uh, generate Python. Um, and uh,
S3: you know, so now your workflow, it still looks like
S3: the same, you know, deterministic workflow that you built by
S3: hand before. But now you've got one additional piece here
S3: that you didn't have to build by hand. Um, you're
S3: still having you know, Python is deterministic, right? If you
S3: give the same input to a function, it'll produce the
S3: same output. Um, and, you know, so we, we balanced
S3: the kind of what we saw as the best of
S3: both worlds there where, yes, you don't have to write
S3: that Python. You don't even have to know, like what
S3: Python does. You just need to validate that when you
S3: put out, you put the input in, you get the
S3: output that you expect. And so, you know, for teams
S3: that are sort of nervous about integrating AI or uh,
S3: maybe really early in their their maturity journey, we wanted
S3: to give them a first step. Right. Something that had
S3: a lot of guardrails on it that was safe to
S3: play around with. Um, we also have the ability to
S3: just integrate, uh, a straight up AI prompt, uh, into
S3: into your workflows as well, um, where, you know, if
S3: you're maybe more comfortable with, you know, prompt engineering or
S3: using those sorts of things, um, you could actually then go, uh,
S3: you know, give it almost any input you wanted and
S3: get any output you wanted structured, unstructured and so on
S3: and so forth. And then more recently we launched a
S3: tool called workbench. Uh, and workbench is basically our way
S3: of addressing the fact that most chat tools are their
S3: best when they have access to your data. Right. Um,
S3: there's this inherent tension between, uh, sending your most sensitive
S3: business contextual information, uh, to a third party vendor, um,
S3: and also making sure that AI is useful for you.
S3: So when we launched workbench, uh, we made sure that
S3: the AI models that we were using were actually completely private, uh,
S3: to the, you know, the tenant that was running them, right?
S3: There was no logging of the data. There was no
S3: sending the data across the internet. Um, and it enabled
S3: teams that had previously had constraints around sending data to
S3: third parties be able to say, oh, right now I
S3: can actually connect my uh, my AI models to the
S3: tools that I use, uh, in a way that's safe
S3: in a way that complies with my policies. Um, and
S3: now we can finally take advantage of that true combination
S3: like that, that that ideal combination of large language models
S3: that have the context, that have the business data and
S3: feel good about it.
S2: Nice. And what were the types of operations that they
S2: were doing with those, uh, prompts and Llms was that
S2: data transforms? Was that analysis, um, benign or malicious, that
S2: type of stuff?
S3: Yeah, I think one of the big use cases that people, uh,
S3: often start out with is around, uh, phishing analysis. Um, the, the,
S3: the phishing ecosystem, if you will, has evolved a lot
S3: over the years where you used to be able to
S3: check for things like a suspicious link or suspicious IP
S3: address or, you know, malicious attachment in an email and
S3: that told you whether or not it was phishing. Nowadays, uh,
S3: business email compromise is one of the biggest attack vectors
S3: that we see. And often it's simply, you know, somebody
S3: impersonating your CEO or impersonating somebody at your organization. And,
S3: you know, I mean, I get these all the time
S3: from from the times CEO, allegedly. Right. Saying, hey, Matt. Right.
S3: It is me, your CEO. Uh, please provide your phone
S3: number to me. Right. And they're they're looking for for
S3: additional context there. Um, and it turns out that's a
S3: really hard problem for traditional tools to be able to solve.
S3: A human can look at that message and sort of
S3: instinctively understand that this is phishing, right? Your tier one
S3: SoC analyst can look at that and be like, oh, right.
S3: That's that's obviously not the CEO. But how do you
S3: explain that to code? Right. How do you explain that
S3: to a very strict workflow tool? Because asking for a
S3: phone number is something people do all the time, right?
S3: It's the context of this conversation, uh, that results in
S3: that not being, you know, it results in it being
S3: malicious versus versus benign. And large language models, of course,
S3: are pretty darn good at understanding intent, understanding, you know,
S3: the nuances of some of those things. Um, and so
S3: for security operations teams that would get, you know, reports
S3: of phishing that they would have to go analyze. Um,
S3: you know, there was a certain bulk of them that
S3: had to be done by humans just because, like, the
S3: rules that they set just couldn't catch them, particularly in
S3: the Bec case. And so now what we're seeing is,
S3: you know, these AI analysis tools are being able to,
S3: you know, you can use them for a verdict. Um,
S3: or you can just say, hey, I actually want you
S3: to extract the intent of this message, and I'll combine
S3: that with some other signals that I have, right? Like
S3: mix and match AI and, you know, maybe a threat
S3: research or a threat intelligence database that I have to say, oh,
S3: this sender is actually in our database, as you know,
S3: being potentially risky. Uh, combine that with, uh, you know,
S3: the intent of this message being asking for contact information
S3: and now you instantly have not just a yes, this
S3: is malicious verdict. You also have insight into the intent
S3: of the threat actor. Right. And um, with workbench in particular,
S3: This is where analysts can now iterate on that. Right. And,
S3: you know, going back to like what would you do
S3: with the additional time that you can that you can
S3: save now they're able to, you know, pivot into additional investigation, right.
S3: And say, okay, if I know this was the attacker's intent,
S3: what else can I learn about the attacker? What else?
S3: You know, what else would this attack look like? Right. Maybe,
S3: you know, maybe we received this one report. What would
S3: it look like if it had succeeded with a different user? Right.
S3: And can I go investigate that now? So, so much
S3: less time spent on triage, more time actually spent asking
S3: the questions of like, who is attacking me? What can
S3: I do about it? How do we know that we're safe, right?
S3: And moving beyond to the things that actually require some
S3: some human thought and creativity?
S2: Yeah, that makes sense. Yeah. Something you said earlier was
S2: really interesting. You're talking about data transforms. And like, I
S2: spent a lot of time, uh, different companies dealing with this.
S2: It seems like it's not just, um, augmenting augmentation with
S2: stuff that humans were doing that times could help with,
S2: but also things that, um, like, um, data pipelines. Um,
S2: and I was also thinking about, uh, and you probably
S2: aren't I you got to focus when you're a product,
S2: you got to focus. But, um, quality checks and security checks,
S2: you kind of have the same sort of vibe. You
S2: have things coming in and you're moving through a set
S2: of steps for checking, for validation, for quality, for whatever
S2: you could do. And if you add AI to that,
S2: you could have like judgment in there at any of
S2: those steps. So, I mean, um, it seems like you're
S2: very much focused on security. Um, but are you seeing
S2: people use it for, um, more like broad use cases,
S2: like quality and stuff like that, because, I mean, this
S2: is everywhere in it. It's everywhere in business. This is
S2: just business in general needs these sort of workflows at scale?
S3: Yeah, absolutely. Um, and, you know, I at the end
S3: of the day, it feels like almost every problem boils
S3: down to either case management or data management. Right? And so, um,
S3: you know, especially in the data management world, um, you're
S3: you're exactly right. This is where, you know, uh, we
S3: can use tie ins, and we see customers using tie ins, uh,
S3: to remove some of the toil and burden off of,
S3: you know, just managing those, those pipelines, everything from, um. Hey,
S3: what do we expect this log source, uh, to be,
S3: you know, like, producing, right? Like, do we actually, you know, uh, AWS, uh,
S3: loves to subtly change the shape of CloudTrail logs.
S2: Totally.
S3: You know. Right. And there's no there's no big announcement.
S3: It's just one of these days, I've noticed that a
S3: fewer of my logs are getting classified correctly. Right? And, like,
S3: why is that? Um, and so that's where, you know,
S3: tines and, you know, AI implementation within tines can, can
S3: serve as that sanity check. Um, we also see customers
S3: using tie ins to integrate with, uh, you know, some
S3: of their, some of their other data management platforms, particularly
S3: around hot and cold. Uh, you know, data stacks. Right.
S3: And like, you know, in the context, you know, of doing,
S3: for example, a security investigation, um, you know, you may
S3: only have 30 days worth of logs that are that
S3: are like hot, hot, right? And, like, actively accessible. And,
S3: you know, you have all the rest in Amazon S3. And, um,
S3: you know, you need to be able to pull them.
S3: This is something where tines can help make that retrieval process, uh,
S3: and rehydration process a lot more, a lot more simple. Um,
S3: and so yeah, we're absolutely seeing people using tines as
S3: sort of, you know, the meta orchestration and monitoring layer
S3: on top of these data pipelines that they're building because, uh, yeah,
S3: at the end of the day, you know, there's the
S3: number of people that have data pipelines that don't have
S3: a data engineering team is a lot larger than, uh, yeah,
S3: the teams that do, unfortunately. Right.
S2: Yeah, that makes sense. And as far as like AI
S2: and security wise, what are the main use cases that
S2: you're seeing?
S3: Yeah, I mean, AI is, uh, you know, what we're seeing, uh,
S3: used a lot is again, sort of, uh, either, you know,
S3: extracting context. Um, you know, we're we see threat intelligence
S3: teams are using AI in a couple of different, really
S3: interesting ways around reporting. The first is, you know, when
S3: you consume, uh, threat intelligence reporting that has been produced
S3: by another organization being able to extract indicators and all
S3: that sort of stuff. Um, but then when you are
S3: actually producing, reporting, uh, there's a lot of different consumers
S3: of that, some of whom are human and want a
S3: PDF and some of whom are computers and can't read
S3: a PDF, right. Uh, and so being able to use
S3: these capabilities to produce multiple different kinds of, you know,
S3: intelligence distribution, I think has been a really to me,
S3: that was sort of an unexpected but really fascinating use
S3: case to see, um, of like, oh, right. It's not
S3: just about reading data, right? It's about producing the data
S3: that our, you know, translation of data. Really, uh, for
S3: for the right audience. Um, so.
S2: You have, like, a little piece of useful intelligence and
S2: you have, um, yeah. I did a lot of work
S2: on this, uh, at Apple, actually, with the threat Intel team,
S2: they have this little nugget of intelligence, and their customers
S2: are like, whatever, 19 different customers, including, like, global security,
S2: which is physical security. And then you have all these
S2: different product teams and software teams, and they all care
S2: about something different.
S3: Right?
S2: And that's a workflow combined with AI that you could
S2: just produce those 19 different artifacts.
S3: Right? Exactly right. The CISO just wants to know, basically,
S3: are we vulnerable? Have we been hit right. And that's
S3: that's about it. Um, and the SoC may want to
S3: know a little bit more technical detail and so on
S3: and so forth. Um, so yeah, that to me, that
S3: has been a really fascinating use case of, you know,
S3: it's it's avoiding toil, but not in the way that
S3: everyone thinks, right? Like you still, as the human, are
S3: putting your creativity into this report and developing the nuance
S3: and understanding, and then AI is helping you translate that
S3: into a different context.
S2: Yeah, that makes sense. So is workbench the main the
S2: main thing that you guys are working on and talking
S2: about right now? Tell us more about that.
S3: Yeah. Workbench uh, is definitely something that has really taken off, uh,
S3: in our customer base. Uh, and again, I think a
S3: lot of that is the fact that, you know, uh,
S3: a chat tool is a chat tool, right? There's a
S3: lot of those out there in the world. Um, but
S3: what tines provides is that private and secure access and
S3: the context and integration, uh, with all of your other
S3: data and most importantly, your other tines, workflows. Um, and
S3: so the way we're seeing people now start to use workbench, uh, is,
S3: you know, sort of almost like dipping in and out
S3: of using deterministic automation and also using a chat interface
S3: for their, for their analyst. So in an incident, um,
S3: you know, an analyst may go into workbench and say,
S3: I received this alert, please analyze it, recommend some next
S3: steps for me. Right. And one of those next steps
S3: might be, you know, this account looks like it's been compromised.
S3: You should probably lock this account. And you say okay, great. Uh,
S3: workbench allows you to trigger other workflows that have been
S3: built within tines. And so I don't have to worry
S3: about I maybe hallucinating the endpoint, uh, of our identity provider. Right. Or, uh, mistaking,
S3: you know, like, if, you know, there's a bunch of
S3: other people in tines named Matt, I don't have to
S3: worry that it's going to grab the wrong Matt. Right?
S3: Like I can actually delegate that task to a deterministic workflow,
S3: and then it comes back to workbench.
S2: That's great.
S3: That's great. And workbench says, uh, you know, great. We've
S3: done that part. Here's, you know, would you like me
S3: to write up an incident summary? Right. And you can
S3: close out this case. Um, and so really giving people,
S3: you know, a much more explicit way of working through
S3: common tasks, delegating to automation where necessary. Um, but, you know,
S3: this is still very much, you know, a sort of
S3: a co-pilot sort of use case. Um, one of the
S3: things we're really excited right now is excited about right
S3: now is, uh, you know, some of the agentic AI
S3: capabilities that, um, you know, we're we're starting to see some, uh,
S3: people using tines for sort of basic agentic AI stuff. Um, and,
S3: you know, in the same way that we didn't necessarily
S3: want to rush and be the first people to integrate
S3: a chat interface just to say we had AI Agentic AI,
S3: I think has had, uh, maybe an evolution, uh, in
S3: terms of our understanding of what an AI agent actually is, right?
S3: And what constitutes agentic AI and so on and so forth. Um,
S3: and now that these have more stable definitions, uh, we're
S3: investing in figuring out what agentic AI looks like when
S3: it comes to tines as well. So that's something that, uh, I,
S3: you know, we're, we're starting to get some internal sneak
S3: peeks on, uh, and it's, uh, it's pretty exciting.
S2: All right. Could you possibly, uh, show us a demo
S2: of workbench?
S3: Yeah, absolutely. I'd be delighted to, um. Let's see. Hopefully
S3: I have the correct screen pulled up here. Um, but
S3: this is the the workbench interface, and you can see here, uh,
S3: you know, it's a fairly classic chat interface. Um, and
S3: if you treat it just like any other chat bot, uh,
S3: you'll get fairly generic. Lem answers. Um, so in my
S3: in my previous role, I worked in security operations, uh,
S3: at Coinbase. Um, and we dealt with phishing all the time.
S3: We dealt with incidents, um, you know, and, uh, you know,
S3: got got attacked all the time. So, um, let's imagine
S3: here that I, you know, have received reports that the
S3: domain Coinbase is, is phishing. And I'm looking to learn more. Um,
S3: can you tell me if Coinbase So.com is phishing. And
S3: it'll think for a second. But you'll notice here that
S3: because we are only talking to the LLM, it gives
S3: us a fairly generic answer, right? I don't have any
S3: specific information. Um, and so because.
S2: This has got a training cut off date, right. This
S2: is like it only knows so much. It's not an
S2: expert on domains.
S3: Exactly, exactly. And you know, this is good generic advice, right?
S3: Like you should always check to see if it's an
S3: official Coinbase domain. Um, but as I start connecting tools, uh,
S3: things can get a little bit more interesting. So now
S3: if I ask it the same question, if Coinbase is
S3: so.com is phishing. It's going to look a little bit different, right?
S3: It knows that one of the tools available to it
S3: is URL scan. Um, and so now, rather than just
S3: giving me a generic answer, it's actually going to use, uh,
S3: URL scan. Um, and because it's searched for URL scan
S3: and found a result, it actually knows to then retrieve
S3: that result as well. It's kicking these things off automatically
S3: because these are read only actions, right? Like no system
S3: is going to change because, uh, you know, because it
S3: called these tools. Um, we also have the ability, you know,
S3: if there's a, you know, a write action or a,
S3: you know, potentially destructive action, it'll ask you to confirm, uh,
S3: before before it takes that action. But these are read only, right?
S3: And so now that we've pulled back, uh, some URL
S3: scan results, we can officially confirm that this is a
S3: phishing site, right? With the most up to date data. Um, and,
S3: you know, if you've been on URL, scan, com, you
S3: know that there's a lot of data that they pull back. Um,
S3: and this sort of provides this very quick, uh, insight
S3: into URL scan. Um, and so, you know, this is
S3: this is something where, you know, security teams, uh, in
S3: the past, if they wanted to use all of these
S3: different tools, uh, they had kind of one of two choices.
S3: They could either have a lot of different panes of
S3: glass open, uh, or they could, you know, sort of
S3: do like a one time enrichment into, you know, a
S3: case that came in. Right? Um, I may not know
S3: ahead of time what tool I want to use in
S3: order to investigate something. Uh, and so what workbench lets
S3: us do is say, okay, now, you know, we can
S3: pick some of the tools that are, you know, tools
S3: that are at our disposal, get the latest data. Um, and, uh,
S3: you know, ultimately, uh, you know, get that sort of
S3: much more dynamic, uh, you know, uh, interface without without
S3: ever having to leave workbench.
S2: Yeah. They just asked the question normal way. They don't
S2: think about the tools that would be required to answer
S2: it correctly.
S3: Exactly. Um, and, you know, let's imagine that, you know,
S3: we're not using URL scan. We're using a different, uh,
S3: Service provider to to analyze fishing. I don't have to
S3: know anything about that service provider. Right? Like, all I
S3: have to know is what information the AI has extracted
S3: in order to be able to make to make that determination. Um,
S3: and so for us, this is, you know, again, sort
S3: of feels like one of the best of both worlds
S3: when it comes to chat assistance, right? Like, you can
S3: get the, uh, validated data from the latest, uh, trusted
S3: data sources. Um, you don't have to know any of
S3: the technical details behind it. You remain in full control
S3: over what sources are connected, when actions are taken, and
S3: so on and so forth. Um, but ultimately, you know,
S3: it just sort of removes that cognitive burden of having to,
S3: you know, contact switch between a bunch of different systems.
S2: Yeah, that makes sense. I really liked what you were
S2: saying before when you were talking about building the workflows. Um,
S2: where you seamlessly pivoting between when you need intelligence and
S2: when you need the consistency of like a legacy or
S2: what did you call it? Um. Deterministic system.
S3: Yeah, exactly.
S2: Yeah, that's that's really, really important because when you talk
S2: about scale, you talk about processing terabytes of data. That's
S2: not an LMDh thing, right? Right. You got to you
S2: got to pivot to traditional tech there. Uh, I thought
S2: that was really interesting. Well, this is, um, this is awesome.
S2: What else is, uh, coming out? What else should people
S2: know about that? You're, um, either have out now or
S2: releasing soon.
S3: Yeah, some of the stuff coming out soon, we're, you know,
S3: we're adding, uh, a lot more into workbench. Uh, and,
S3: you know, right now, a lot of this, uh, interface is, uh,
S3: text based. Um, we've heard a lot of requests from
S3: our customers that they'd like to be able to do
S3: more with documents and images. Um, so that is, that
S3: is coming very, very soon here. Um, and then, you know,
S3: the other thing, uh, and, you know, if I look
S3: at here at this, uh, workbench builder or, excuse me,
S3: this story builder, uh, tab, um, right now we have
S3: an AI action that includes just a prompt right where
S3: I can maybe generate some some output. Um, as we
S3: start looking, uh, you know, over the next few months
S3: at how agentic, I, uh, you know, interfaces with, uh,
S3: both traditional workflows as well as, you know, uh, copilot
S3: chat workflows. Um, this is going to, uh, this is
S3: going to evolve, and, uh, I'll leave, uh, I'll leave
S3: the tease, uh, at, uh, you know, at, uh, you know,
S3: saying that there's going to be more than just workbench, uh,
S3: for sure, uh, over the next few months when it
S3: comes to AI.
S2: Fantastic. And where can people find out about you? Uh,
S2: the website and everything.
S3: Yeah. Folks, go to Tynes. T I n e s.com. Uh,
S3: they can find us there. Um, and if they want
S3: to get a taste of of all of this, uh,
S3: what we've shown today, what we've talked about, we have
S3: a free community edition. It's free for life. Uh, you know,
S3: comes with a whole bunch of different features. Um, and,
S3: you know, I have my own community edition tenant that
S3: I actually use for personal stuff outside of work as well. Um,
S3: we've had people use their, uh, tenants to actually, uh,
S3: build to do a fantasy football draft, which I thought
S3: was interesting. Um, and, uh, yeah, we want people to
S3: be able to experience, uh, you know, experience, uh, what's, uh,
S3: you know what? All we're building.
S2: Very cool. Well, Matt, I enjoy the conversation. I think
S2: this is, uh, super interesting. And, uh, look forward to
S2: talking to you in the future.
S3: Likewise. Thanks so much, Daniel. I really appreciate the conversation.
S2: All right. Take care.
S3: Cheers.
S1: Unsupervised learning is produced on Hindenburg Pro using an sm7 microphone.
S1: A video version of the podcast is available on the
S1: Unsupervised Learning YouTube channel, and the text version with full
S1: links and notes is available at Daniel Mysa.com newsletter. We'll
S1: see you next time.