Speaker 1: Hello, Hello, Welcome to Smart Talks with IBM, a podcast
Speaker 1: from Pushkin Industries, iHeart Radio and IBM. I'm Malcolm Glapwell.
Speaker 1: This season, we're diving back into the world of artificial intelligence,
Speaker 1: but with a focus on the powerful concept of open
Speaker 1: its possibilities, implications, and misconceptions. We'll look at openness from
Speaker 1: a variety of angles and explore how the concept is
Speaker 1: already reshaping industries, ways of doing business and our very
Speaker 1: notion of what's possible. On today's episode, I'm joined by
Speaker 1: Jason Kelly, the global Managing Partner for IBM Strategic Partners
Speaker 1: and Ecosystems, and by Christy Fredericks, the Senior Vice president
Speaker 1: and Chief Partnership Officer at Palo Alto Networks. We discussed
Speaker 1: how their partnership in the cybersecurity space helps strengthen enterprises
Speaker 1: by focusing on seamless cybersecurity solutions tailored to meet the
Speaker 1: evolving threat landscape. By leveraging AI and automation, this collaboration
Speaker 1: aims to modernize security programs, improve response times, and produce risks.
Speaker 1: Jason and Christie both bring a tremendous amount of experience
Speaker 1: and expertise to the subject I think you're really going
Speaker 1: to enjoy this one. Jason Christy, Welcome to Smart Talks
Speaker 1: with IBM. Thank you for joining me.
Speaker 2: Thank you.
Speaker 3: It's great to be here.
Speaker 1: We are here to discuss cybersecurity and the partnership between
Speaker 1: IBM and Palo Alto Networks. But before we get there,
Speaker 1: I wanted you guys to tell me a little bit
Speaker 1: about yourself. Jason, start with you. I see on your
Speaker 1: resume west Point, which makes we think there's some interesting
Speaker 1: things going on. How did you get to west Point?
Speaker 2: West Point? West Point was the decision. First, it was
Speaker 2: it was affordable back in the day. But I had
Speaker 2: a sense of service. My father was a World War
Speaker 2: Two vet, so I grew up on the weekends watching
Speaker 2: World War two video. You know he's army as well. Yeah,
Speaker 2: and so I thought, oh that'd be exciting, and I
Speaker 2: thought I do some type of service. Went there and
Speaker 2: now I have the biggest family, extended family I could
Speaker 2: ever have. So it was very exciting. Played football lucked out,
Speaker 2: meaning I wasn't recruited. I walked on and that kept
Speaker 2: me there because it gave me something and out left
Speaker 2: with all the other pressures defensive back, I was I
Speaker 2: was great at knocking the ball down, not the best
Speaker 2: at catching it.
Speaker 1: Yeah, and then you were a ranger.
Speaker 2: I was. I was privileged to be a US Army
Speaker 2: airborne ranger station, but did most of my time in
Speaker 2: northern Italy. We're part of the it's eighty second airbarnship post.
Speaker 2: Oh yeah, people say seriously, like, you know, you were,
Speaker 2: you were, you were drinking wine and having bred you know.
Speaker 2: But it was a part of a NATO force there
Speaker 2: at the time. Yeah, so exciting.
Speaker 1: How did you get from there to IBM?
Speaker 2: A long path. As I came out of the military,
Speaker 2: I started manufacturing retail housing and did a quick stint,
Speaker 2: took a leave of absence from industry, and did a
Speaker 2: stint of yet again public service in the state of
Speaker 2: Tennessee with economic development, and got a whiff of how
Speaker 2: fun it could be to do things around data and media.
Speaker 2: Started a small media firm what we would now call
Speaker 2: a digital firm, sold it and said I wanted to
Speaker 2: go do it again somewhere, but I wanted to go
Speaker 2: to a big company. And the family at IBM brought
Speaker 2: me in and yet to let me go.
Speaker 1: That was how many years ago?
Speaker 2: Two decades?
Speaker 3: Oh wow?
Speaker 2: Yeah, so, I know I look amazingly young on but yes,
Speaker 2: you must have. And IBM was my fifth career and
Speaker 2: and and I've enjoyed a since and that's what I
Speaker 2: what I do. They build teams, grow new parts of
Speaker 2: the company and get to work with some of the
Speaker 2: most brilliant people on the face of the planet, as
Speaker 2: well as partners like Christy that just keep it exciting.
Speaker 1: Christy, you're I was delighted to learn that you are Canadian.
Speaker 1: Yes here, Yeah, but you so you were a consultant
Speaker 1: for a long time at Bane.
Speaker 3: Yes, yeah. I joined Bain Consulting intending to spend a
Speaker 3: couple of years there learn the ropes and then go
Speaker 3: get my first real job. But the value personally to
Speaker 3: my growth and development, and then that we were able
Speaker 3: to bring our clients. I ended up there for sixteen years,
Speaker 3: and then post Bain went on to another my first
Speaker 3: product company, a new relic, and then it's come full
Speaker 3: circle at Powlta Networks. But at Bain it was all
Speaker 3: about bringing expertise across different industries to help our clients
Speaker 3: improve whatever they needed to improve and bringing that expertise
Speaker 3: to bear and then you have the product lens and
Speaker 3: you think, Okay, we're going to build the absolute best
Speaker 3: product to help our customers do what they need to
Speaker 3: get done. And then I joined pal Alto about six
Speaker 3: seven months ago in a partnership's role and I'm delighted
Speaker 3: to be able to work with amazing consulting companies like
Speaker 3: IBM where we bring both to bear.
Speaker 1: How long have IBM and Paulo Alto Network's been partners?
Speaker 2: So we've been We've been working together for quite quite
Speaker 2: a long time, but we made it official, meaning we
Speaker 2: got married as strategic partners last year.
Speaker 1: Oh I see. So what is it that each of
Speaker 1: you bring to the table? What's each side special?
Speaker 2: So it's great that you asked that because about a
Speaker 2: decade ago, are now CEO Arvin Christ says, you know,
Speaker 2: it wouldn't be great if we just had this one
Speaker 2: focus with this what does IBM do? And you have
Speaker 2: this whole list, and he says, let's make it simple.
Speaker 2: We are a multi cloud, hybrid cloud AIIC company. And
Speaker 2: so when you say that, it sounds very simple, but
Speaker 2: then people, what the hell is that? What your hybrid cloud? Well,
Speaker 2: both of those two things have a lot of data
Speaker 2: involved and a lot of those mean that that data
Speaker 2: is going to sit in multiple places and distributed environments. Well,
Speaker 2: if you're able to tie those things together with multiple partners,
Speaker 2: you also have to make sure that it's secure because
Speaker 2: in the direction that we're going, where data is now
Speaker 2: being consumed in many different places and it is the
Speaker 2: fuel behind AI as we know, then you say, ah, well,
Speaker 2: who does that well and who does it in a
Speaker 2: way that's getting rid of seams, the seams that could
Speaker 2: be across multiple products, multiple product SATs even And that's
Speaker 2: where Powell comes in.
Speaker 3: I think the conventional wisdom and cybersecurity was always you
Speaker 3: need all the new tools, right, you need it every threat.
Speaker 3: It's like, whack them all. Every threat that pops up,
Speaker 3: you get the tool that's purpose built for that specific thing. Well,
Speaker 3: fast forward to you know, the RSA conference this year,
Speaker 3: there were four thousand vendors on the floor. You look
Speaker 3: at an average company, there's hundreds of cybersecurity tools. It
Speaker 3: introduces a level of complexity that is really hard to
Speaker 3: manage you as a user. Query and application, right, that
Speaker 3: query can go through a bunch of different pings from
Speaker 3: one cloud to the next. It goes into and out
Speaker 3: of assaas application. It maybe running along a network. You
Speaker 3: may be accessing it from your phone, which is an
Speaker 3: unmanaged device. It's got to go in and out. And
Speaker 3: if you say, okay, I've got to secure that phone,
Speaker 3: I've got to secure the network, I've got it. And
Speaker 3: then all of a sudden you've got sort of firewalls,
Speaker 3: software and hardwelfiles popping up everywhere. You've got cloud security,
Speaker 3: and it's you've probably heard of this concept of zero trust,
Speaker 3: which is every time you have to check and say
Speaker 3: are you allowed in here? Are you allowed in here?
Speaker 3: The number of places that can fall down it just
Speaker 3: becomes overwhelming. So you end up with either alerts firing,
Speaker 3: you know, every two seconds that you have to then
Speaker 3: go invest again, most of which are false positives or
Speaker 3: you miss something right. And so that was the conventionalism
Speaker 3: was we've got to buy all these tools, and now
Speaker 3: you've got overwhelmed CIOs and CSOs with hundreds of tools,
Speaker 3: and Palo Alto strategy has been, look, we're going to
Speaker 3: create a platform where everything can be stitched together, everything
Speaker 3: can speak the same language, and we can sort of
Speaker 3: manage throughout the architecture and watch, you know, this call
Speaker 3: as as it's passing through all these different checkpoints, and
Speaker 3: we can do it in a way that you still
Speaker 3: have the confidence that it's best to breed right, so
Speaker 3: you're not making any trade offs. But it's not so
Speaker 3: simple just to get from the spaghetti to the seamless architecture.
Speaker 3: You need, oftentimes to re engineer your business processes. You
Speaker 3: have to re architect your digital environment. And so that's
Speaker 3: where we partner with a company like IBM to bring
Speaker 3: that expertise and say we're going to help you not
Speaker 3: just deploy the best cybersecurity architecture, but really get your
Speaker 3: environment ready to have this zero testomer.
Speaker 2: As well as all of those players that cross at spaghetti.
Speaker 2: Because when you start thinking about all the other partners
Speaker 2: that you work with, if you're you think of an
Speaker 2: industry perspective, you're going to have an ERP. It could
Speaker 2: be an Oracle, it could be an SAP. You're not
Speaker 2: going to have one cloud, as I mentioned, it's gonna
Speaker 2: be possibly multiple clouds. You'll have some AWS maybe Microsoft Azure,
Speaker 2: and then even even some Google in there, and then
Speaker 2: your own that you've built in your private over there, uh,
Speaker 2: some an IBM cloud. You'll have those multiple clouds, and
Speaker 2: then you also will have you know, fit for purpose.
Speaker 2: Oh I need a I need a salesforce in there
Speaker 2: for my customer focusing. I need I'm doing some graphics,
Speaker 2: so I have Adobe, so I just as I can
Speaker 2: name name name, all of those then have to be
Speaker 2: re engineered. Seriously. I mean, come on, Malcolm, You're gonna
Speaker 2: sit there. You think how long that would take. So
Speaker 2: if you haven't done that before, you're going to have
Speaker 2: to go to each one of those individually, or you
Speaker 2: can work with a company that can tie those things together,
Speaker 2: because we are also strategic partners with them. So that's
Speaker 2: where you start to say, Okay, I see how this
Speaker 2: comes together. You have to make sure that your ecosystem
Speaker 2: is going to be stronger than your competitor's ecosystem, and
Speaker 2: you have to be secure in what you're doing because
Speaker 2: as you add more players or products, you create seams,
Speaker 2: and you want to make sure there's fewer seams and
Speaker 2: that there's zero trust across that capability you're building. And
Speaker 2: that's why the compliment between the two companies.
Speaker 1: We'll take a step back from a moment before we
Speaker 1: sort of launch. Once get into the specifics of what
Speaker 1: you guys are doing. I'm curious at this moment in
Speaker 1: twenty twenty four, how nervous should we be about cybersecurity?
Speaker 1: So compared it to five years ago or ten years ago,
Speaker 1: are we are you less nervous than you were five
Speaker 1: years ago or more nervous or all of changes going
Speaker 1: on right now increasing vulnerability or decreasing it?
Speaker 2: I would say Chris, also, I think we share the
Speaker 2: point of views that it's not necessarily being more nervous.
Speaker 2: I think you should be more prepared. Yeah, because the
Speaker 2: amounts of threat is increasing based on our dependence upon data.
Speaker 2: And that's that's where I think the attention should be placed.
Speaker 2: Is that more and more, especially with the importance of
Speaker 2: AI that you say, okay, then what's under all that?
Speaker 2: And it's the data? As I said, so knowing that
Speaker 2: you should be more concerned.
Speaker 1: Does the advent of AI and it's rapid evolution help
Speaker 1: defense more or offense more?
Speaker 3: I think it's I think it's like any mega trend
Speaker 3: that we've witnessed both. Right, So you think about AI,
Speaker 3: it's ninety nine percent great right in terms of what
Speaker 3: it's going to unlock for productivity for humanity, But it
Speaker 3: also makes it a whole lot easier to build ransomware.
Speaker 3: It's a whole lot easier to take different ways into
Speaker 3: a system, right. But I think that's true if you
Speaker 3: think about like the rise of the Internet, right, all
Speaker 3: of a sudden, everyone was putting their data online and
Speaker 3: you had to think of new ways to stay ahead
Speaker 3: and keep that secure. And I don't think AI is
Speaker 3: any different. You've got companies like Palta, partnerships like Powell
Speaker 3: and IBM that are constantly scanning the landscape for not
Speaker 3: only the current threats, but what's next, what's coming around
Speaker 3: the corner, what's after AI? And so I think taking
Speaker 3: it seriously and being prepared is probably the right way
Speaker 3: of looking at it, as opposed to because if you
Speaker 3: think about it too hard, you'll just want to crawl
Speaker 3: into a corner and stuff everything under the mattress.
Speaker 1: I am the CEO of a regional hospital chain, big
Speaker 1: distribute healthcare system, so a ton of data. The consequences
Speaker 1: of being hacked and help for ransom are life and death.
Speaker 1: Life and death. When you come so you you come down,
Speaker 1: You sit down with me, and you chat with me.
Speaker 1: Walk me through the kinds of things you would tell
Speaker 1: me about what I need to get safer. For example,
Speaker 1: let's start with one. Is it likely that I'm spending
Speaker 1: too little or am I spending money in the wrong place?
Speaker 3: Great question, It depends how you've broken it out. If
Speaker 3: you are distributing all of your dollars across a whole
Speaker 3: bunch of different tools, it's likely you're just spending the
Speaker 3: wrong money. And in fact, you know, putting it all
Speaker 3: in one place is a way of potentially saving money
Speaker 3: but keeping your security actually higher. And I'd love to
Speaker 3: hear Jason, how you would approach it. How we would
Speaker 3: approach it, of course, is by saying, you know what,
Speaker 3: what does your environment look like? You know, do you
Speaker 3: have the connected medical devices into your EMR? Are your
Speaker 3: respirators and ventilators all online? Right? And so we would
Speaker 3: talk about, okay, here's how you get coverage, and how
Speaker 3: the coverage of both the firewalls as well as the
Speaker 3: detectors all feedback into your security operation center and you
Speaker 3: can manage it and and do your learning with AI
Speaker 3: and keep yourself securing.
Speaker 2: So yeah, and I would say Christy and I would
Speaker 2: go to the same point because if you get under
Speaker 2: what she was just asking it is your data on
Speaker 2: prem and when it's on prem, how active is it
Speaker 2: across the enterprise? And so that begins the basis for
Speaker 2: the start. And then often you're going to say, well,
Speaker 2: we actually take in data from outside and then we
Speaker 2: also have the circumstances. There's a lot of PII and
Speaker 2: so that personal is the personal information, right, Yeah, And
Speaker 2: so now you're saying, okay, now, how are we securing
Speaker 2: that and where are we securing it? And so you
Speaker 2: have to start really thinking about the different areas within
Speaker 2: that hospital chain. Are you sharing that amongst your hospitals?
Speaker 2: And now you start to think of if I'm saying
Speaker 2: no to a lot of that, it's like, well, then
Speaker 2: are you as efficient as you want to be? So
Speaker 2: there is that trade off of you know, am I
Speaker 2: so tightly walled that I'm not productive? And so that's
Speaker 2: where we would start to say, what's the outcome that
Speaker 2: you're trying to get to? All Right, maybe you're good,
Speaker 2: Maybe you're you're good with your five locations and you
Speaker 2: don't need to go any further, but maybe you want
Speaker 2: to expand to fifty and by the way, you're going
Speaker 2: to go crossport or you're going to be in Toronto
Speaker 2: and in New York. Okay, well then how do you
Speaker 2: do that? And so I think that it's very easy
Speaker 2: to start jumping into any of the typical situations. But
Speaker 2: the first question that you have to ask you, as
Speaker 2: the hospital CEOs, what's your objective? What are you what
Speaker 2: are you trying to do? Because too often what we
Speaker 2: see is that there's some bright, new, shiny thing that
Speaker 2: everybody wants to put in play. You know, it's a
Speaker 2: sandwich looking for lunch, and you go, but what is
Speaker 2: it that you want to do as this Are you
Speaker 2: doing research? Are your research hospital? Are you more consumer oriented?
Speaker 2: So those are the questions you start to ask because
Speaker 2: they start to then tell a story in line with
Speaker 2: what Christy questions. And I think that that's where the again,
Speaker 2: the complement is that instead of just saying, oh, well,
Speaker 2: that's thanks for telling me all this, Malcolm, here's your
Speaker 2: ten page strategy, go find somebody. We have the benefit
Speaker 2: in IBM, and is probably why I'm still there is
Speaker 2: you know, we're very unique. We're the only company on
Speaker 2: the planet that has a consulting business at scale inside
Speaker 2: of a technology company, and so we have you know,
Speaker 2: the left brain right brain. We're able to do that,
Speaker 2: and then we're able to say, okay, now which partners
Speaker 2: are going to be most valuable for our clients. What's
Speaker 2: going to work for you? Isn't going to work for
Speaker 2: the manufacturer down the road, isn't going to work for
Speaker 2: the consumer or CpG company across the river. Those things
Speaker 2: are very specific. The threats and the scenes that I
Speaker 2: was talking about are very specific. So that's where it
Speaker 2: becomes very valuable to make sure that I'm not just
Speaker 2: giving you some strategy that's generic.
Speaker 1: But everything as a healthcare CEO, everything I have done,
Speaker 1: almost everything I've done over the last ten years, hasn't
Speaker 1: it had the effect of increasing my vulnerability. I want
Speaker 1: to digitize data within the hospital used to be on
Speaker 1: pieces of paper. I want doctors to go home and
Speaker 1: to be able to seamlessly hook into stuff at work
Speaker 1: because they got to do all their paperwork. I want
Speaker 1: to make sure the diabetes people are speaking to the
Speaker 1: organ transplant people. And so isn't that everything I have
Speaker 1: done to kind of keep up with the revolution in healthcare?
Speaker 1: Isn't that also making me more and more vulnerable to
Speaker 1: a bad actor.
Speaker 3: It's such a great question because think about the quality
Speaker 3: of healthcare delivery. Right. So now doctors aren't filling out forms,
Speaker 3: they're spending time with patients, and so the quality of
Speaker 3: care is improving and the vulnerability is improving, right, And
Speaker 3: so I think that's where having a strong cybersecurity strategy
Speaker 3: actually enables all of that. One of our products is
Speaker 3: our sas product, and we tested it with some business
Speaker 3: application and oftentimes the wrap is, oh, security is going
Speaker 3: to slow you down, like you have to add a firewall,
Speaker 3: you have to checkpoints. Our product actually increases the velocity
Speaker 3: of your ability to use that application because of the
Speaker 3: way that it is queried through our system as opposed
Speaker 3: to just through the regular network. So it doesn't slow
Speaker 3: it down and in fact, it makes it run more efficiently.
Speaker 3: That's just one minor example. But back to the healthcare question. I,
Speaker 3: as a patient want my doctors accessing all the technology
Speaker 3: and talking to each other and connecting the dots behind
Speaker 3: the scenes. I also want my data to stay private,
Speaker 3: and so having both a consulting partner who understands how
Speaker 3: to ask questions of the environment and of the applications
Speaker 3: you're using, and who understands the industry inside and out
Speaker 3: and a technology partner that builds and stays ahead of
Speaker 3: all of the different threats, come together and advise you.
Speaker 3: I think is super important. When you bring in a
Speaker 3: partner like IBM, with a platform like Palalta that covers
Speaker 3: all the different parts of your environment, you're able to say, look,
Speaker 3: where where are the vulnerabilities in the system, Where are
Speaker 3: the different endpoints that we need to have covered, and
Speaker 3: then just make sure you get that breadth of coverage,
Speaker 3: and then you're better able to so, yes, you've increased
Speaker 3: the risk, but then you've mitigated it.
Speaker 1: So to give so before I retire my healthcare analogy,
Speaker 1: because I was thinking about just trying to understand the
Speaker 1: importance of this idea of having a single platform. So
Speaker 1: if this muddle healthcare network is typical, I've acquired a
Speaker 1: whole series of over the last ten years. I bought
Speaker 1: a hospital over here, some I got some physicians, things
Speaker 1: that I snapped up over here about a diagnostics company,
Speaker 1: and so I have all of these legacy systems, and
Speaker 1: I had, like you said, maybe I got some stuff
Speaker 1: in the cloud with one company, some stuff with the cloud.
Speaker 1: And what you're saying is the first step is to
Speaker 1: kind of rationalize that put it on a single platform,
Speaker 1: so you understand where your points of weakness are as
Speaker 1: opposed to being blind to your points of weakness.
Speaker 3: There's yes, although anyone who's done any kind of M
Speaker 3: and A knows that that's a long journey, right. So
Speaker 3: I think the first step is just understanding where everything is.
Speaker 3: And then you get on a path and you say,
Speaker 3: where's the biggest risk. Let's let's neutralize or mitigate that
Speaker 3: risk one at a time. The thing about open end secure,
Speaker 3: you know Palo Alto. We keep touting the benefits of
Speaker 3: the platform. Everything on Palo Alto, your risk is going
Speaker 3: to be mitigated and you're going to have the full visibility.
Speaker 3: But you can't get there overnight. And so we've got
Speaker 3: you know, thousands of integrations with other technology companies, including
Speaker 3: our partners, to make sure that we can capture and
Speaker 3: have visibility into those those endpoints in those systems as well.
Speaker 3: And so I think step one is just figure out
Speaker 3: where everything is. Just get the scan. So Polta has
Speaker 3: a couple of products where you can kind of deploy
Speaker 3: and get a view of your attack surface. I love
Speaker 3: the analogy. Just like a digital environment is a house right,
Speaker 3: and so like you have your front lock, of course,
Speaker 3: because probably they're going to try the front door first.
Speaker 3: But that's not all you're going to do, right, You're
Speaker 3: going to make sure the whole you know, the windows
Speaker 3: are locked and there's an alarm system and all of that.
Speaker 3: And I think that's how you have to think about it,
Speaker 3: is just how do we cover the whole service?
Speaker 1: So everyone laid, people like me have been bombarded over
Speaker 1: it seems like over the last year with one thing
Speaker 1: another about how quickly AI is moving forward and how
Speaker 1: big of a deal it is suddenly is going to
Speaker 1: be in the economy. What is the impact of that
Speaker 1: dramatic change in AI's capabilities on this cybersecurity question? So
Speaker 1: what does it mean if you're defending somebody that you
Speaker 1: now have these sophisticated AI tools you just suppose.
Speaker 2: I think that AI becomes the force multiplier for cyber
Speaker 2: To think about cyber Before it was just locking your doors,
Speaker 2: locking the windows, and if you were really good, you
Speaker 2: had an alarm system. You know, Now with AI, you
Speaker 2: can say, well, I can predict what's going to happen,
Speaker 2: I can see around the corner. I know, I can
Speaker 2: leave my windows open upstairs and it's fine and it's okay.
Speaker 1: I mean because why because the AI is running a
Speaker 1: million simulations.
Speaker 2: It can And that's exactly it. It becomes the intelligent
Speaker 2: part of that AI. It's not artificial, it's augmented. So
Speaker 2: you now have this new capability to see around corners
Speaker 2: and so you're able to do the jobs of yesterday
Speaker 2: more effectively. And the queries that you were doing and
Speaker 2: that's all you're really doing, now you're doing them, you know, faster,
Speaker 2: You're able to access even more data and you're able
Speaker 2: to then make it more secure. So that's why AI
Speaker 2: becomes a force multiplier.
Speaker 1: Yeah, and just talk about the faster part. What does
Speaker 1: faster mean in practical terms? If you're trying to defend
Speaker 1: an enterprise against a cyber attack, what does speed matter
Speaker 1: in that environment?
Speaker 2: You're always trying to find a place through I go
Speaker 2: back to you. We brought up the army. You always
Speaker 2: how do you break the line? How do you find
Speaker 2: a penetration point? And when you think about you know,
Speaker 2: pin testing, penetration testing, where are those? So if you're
Speaker 2: able to do that faster than the bad guys, and
Speaker 2: not only faster, but you're picking more probable points. This
Speaker 2: is back to the intelligence. I could waste time doing
Speaker 2: penetration testing someplace where. That's why I mentioned leave. If
Speaker 2: they can't get in the second story windows, why are
Speaker 2: you spending time trying it? So that becomes more effective.
Speaker 2: So that's when I think of speed. That's what I
Speaker 2: think of because with not just speed, I think it's
Speaker 2: also what's effective.
Speaker 3: Just to put a put a fine point on it.
Speaker 3: So I found a way in. Okay, Now what I
Speaker 3: don't know where the jewelry is, so I have to
Speaker 3: look around and see if there's any hidden gems and
Speaker 3: try to find my way. That used to take a week,
Speaker 3: two weeks or of seven to fourteen days. Now it's
Speaker 3: hours right so there in and they can actually expltrate
Speaker 3: data within less than a day. The metric we use
Speaker 3: in the security operation center is meantime to detect, so
Speaker 3: to see anyone's there, meantime to respond and remediate to
Speaker 3: get them out. Right. That used to be also you know,
Speaker 3: seven eight, nine, ten days. Now it needs to be
Speaker 3: less than an hour. And with our AI based security
Speaker 3: operations platform, it is. Now you've got one tool that
Speaker 3: whether it's all Peloton networks or whether it's just you know,
Speaker 3: hoofringing data from other places. Then you're able to see
Speaker 3: it all together, so you actually get fewer alerts. So
Speaker 3: you get from thousands of alerts down to one hundred alerts, right,
Speaker 3: and you can investigate them, and you investigate them using
Speaker 3: AI too. And AI is today it's today's threat, but
Speaker 3: it's you know, you think about threat and opportunity to
Speaker 3: think about what's next. You always have to be kind
Speaker 3: of evolving and you have to think.
Speaker 2: We talk about threat and risk, and you know, we
Speaker 2: didn't tell you know, what is the cost of cyber
Speaker 2: some type of penetration. It's typical cost is for four
Speaker 2: and a half million dollars and that's just in labor
Speaker 2: and remediation. If you think about reputational risk as well,
Speaker 2: our Institute for Business Value to the study and found
Speaker 2: it in twenty twenty three and they were thirty nine
Speaker 2: banks that we watched that suffered a reputational risk market
Speaker 2: value of one hundred and thirty billion dollars. And so
Speaker 2: you start to think, wow, that's just reputational risk. So
Speaker 2: that's what's at stake here, and it's only that is
Speaker 2: only going to get bigger.
Speaker 3: So one of the piece we haven't talked about about
Speaker 3: AI that I find super interesting because we've been talking
Speaker 3: essentially about like the terminator, the robots fighting robots, right,
Speaker 3: Like whose robots are quicker? Like I'm designing a tax
Speaker 3: and I'm defending against tax and I think that's that's
Speaker 3: super important. But we recently launch and our working at
Speaker 3: IBM on our AI security product to actually secure the
Speaker 3: use of AILA because it also opens up another set
Speaker 3: of threat factors. I'll give you an exampimple. I'm a
Speaker 3: marketing executive now for your hospital. So I work for you,
Speaker 3: and you want to announce the launch of a new center,
Speaker 3: and so I upload all the information about all the
Speaker 3: patients and our you know how we do things into
Speaker 3: chat GPT to write the PR for me. Well, I've
Speaker 3: also just uploaded to chat GPT a whole bunch of secrets, right.
Speaker 3: So it's it's how employees are using AI, because I think,
Speaker 3: you know, some companies are sort of building their own
Speaker 3: language models and their own AI applications that they want
Speaker 3: to keep secure. Others are just curious about how their
Speaker 3: employees are using AI applications on the shelf. And so
Speaker 3: we announced in May a product where you can actually
Speaker 3: scan and see how AI is being used in your
Speaker 3: enterprise and within We made the announcement with the GA
Speaker 3: was last month, but we made the announcement in May,
Speaker 3: and we had immediately thousands of CIOs signing up because
Speaker 3: just understanding you know who's using what it's another open
Speaker 3: question because you know, we talk about AI enhancing productivity
Speaker 3: and all the benefits it's going to bring, but it
Speaker 3: brings it brings risks, not just in how it's being
Speaker 3: used by the threat actors, but also you know what
Speaker 3: other vulnerabilities that.
Speaker 1: Excuse is the eye that you does that system tell
Speaker 1: you what's a problematic use?
Speaker 3: It does, so what what it does, and you've got
Speaker 3: to train it right. But what it does is say
Speaker 3: this is this is outside of your policy. So CIOs
Speaker 3: will set policies on here's what is acceptable and not
Speaker 3: acceptable use. So we'll be able to scan and say
Speaker 3: these these falling uses are outside of policy, and then
Speaker 3: it'll punt and say I think this is too restrictive,
Speaker 3: I think this is too permissive, and then you can
Speaker 3: sort of update your policies from there. That's just sort
Speaker 3: of the visibility piece, and then there's the run time piece,
Speaker 3: which will actually stop you from using it. So you
Speaker 3: go and say, Okay, here's all my patient's social security numbers.
Speaker 3: I'm going to upload them to chat GPT to you know,
Speaker 3: get an understanding of like where they all live. I
Speaker 3: don't know what why you would possibly do that, but
Speaker 3: let's say you were, and then you know, it'll note
Speaker 3: that looks like a social security number. You can't upload
Speaker 3: that into your prompt, so it.
Speaker 1: Will stop before you Yeah, thoughtful voice over your shoulder,
Speaker 1: just to remind you not to do something silly exactly.
Speaker 1: But this is just talk a little bit more about
Speaker 1: adding AI into this mix. You say it's a force multiplier.
Speaker 1: It's a really interesting dig into that. What other instances
Speaker 1: of what that means?
Speaker 3: Well?
Speaker 1: How does the balance between AI and human expertise work
Speaker 1: in the kind of next generation of cybersecurity?
Speaker 2: I think the common way to look at as it
Speaker 2: back to the force multipliers, It's not going to be
Speaker 2: is your AI better? But can you use it better?
Speaker 2: Can you ask your AI the right questions? Are you
Speaker 2: well trained? So the competition really becomes your use of AI?
Speaker 2: And are you pointed it in the right direction? You
Speaker 2: have fifty people can they do the work of two
Speaker 2: hundred and fifty and can they do it in a
Speaker 2: safe and secure manner, So you're not opening up more
Speaker 2: risk based on or too much risk is your risk
Speaker 2: tolerance in order to get the outcome. So that's why
Speaker 2: I think there's the opportunity. And so you see this
Speaker 2: truly as a force multiplier because the first thing people go, oh,
Speaker 2: you're going to get rid of people, Oh, the people
Speaker 2: portion is still still going to be just as important
Speaker 2: because they're doing that other piece of work.
Speaker 3: One of my favorite statistics is that there are now
Speaker 3: more bank tellers in the US than there were in
Speaker 3: nineteen sixty before the ATM was invented. Right, So, but
Speaker 3: it used to be you would go to your bank
Speaker 3: because you had to. I remember doing this. You go,
Speaker 3: you fill out your deposit slip, you hand it to
Speaker 3: the teller, and they give you your cash. And then
Speaker 3: ATMs are invented, and it's like, oh, no, what's going
Speaker 3: to happen all these jobs and now there's more, Right,
Speaker 3: but you're not withdrawing money from a bank teller. You're
Speaker 3: now doing more sophisticated transactions. And so I think it's
Speaker 3: similar with AI, right, Like you want people doing things
Speaker 3: that only people can do.
Speaker 1: The human element remains absolutely central in all of this.
Speaker 1: How do you make sure that your cybersecurity folks are
Speaker 1: equipped to handle high value tasks, are ready for the
Speaker 1: this increasing responsibility.
Speaker 3: There's a couple of ways to answer this, but I
Speaker 3: think the more you're able to automate the routine and
Speaker 3: the mundane tasks. For example, the bulk of cybersecurity happens
Speaker 3: in the security operations center. There's analysts who are sitting
Speaker 3: in that center. If they're spending all day either configuring
Speaker 3: alerts or responding to alerts, they're not able to do
Speaker 3: the advanced sort of threat hunting and analysis work. And
Speaker 3: so I think a big chunk of it is just
Speaker 3: freeing up their time to be able to do the
Speaker 3: more advanced strategic work. And a lot of the automation
Speaker 3: tools based on AI, like our cortex XIM product, is
Speaker 3: it's designed to free up their time in order to
Speaker 3: be able.
Speaker 2: To do that. And from our perspective, is making sure
Speaker 2: that it's a requirement to make sure that you have
Speaker 2: the qualifications because people can easily get used to doing
Speaker 2: what they've always done. I know this, and that's what
Speaker 2: I do you say, Well, now, all the threat actors
Speaker 2: are learning on the fly. They're trying to always outsmart you.
Speaker 2: So it's in your best interest, our best interest, our
Speaker 2: client's best and partners best that you are on the
Speaker 2: front leaning edge of that learning capability.
Speaker 1: If you're talking to a client he wants to develop
Speaker 1: a kind of unified cybersecurity strategy, what's the best single
Speaker 1: piece of advice you can give them?
Speaker 3: You should have a single platform. It's hard not to
Speaker 3: answer that, but it is true. I mean all joking
Speaker 3: aside having you know the best of breed solutions that
Speaker 3: are all talking to each other and able to stitch
Speaker 3: together and identify threats before human might be able to.
Speaker 3: That's number one, and number two is making sure you
Speaker 3: have visibility on all elements so you're able to cover
Speaker 3: your whole environment and understand how people are accessing it.
Speaker 2: I'd say, think like a bad actor. Yeah, always think
Speaker 2: outside in because you get comfortable the other way around.
Speaker 1: You guys work together with a Push and five company,
Speaker 1: and I'd love for you to talk a little bit
Speaker 1: about use that as a kind of case study for
Speaker 1: what this collaboration between the two your two companies looks
Speaker 1: like when you work with a cloud.
Speaker 3: It really was you know, IBM leading on a digital
Speaker 3: transformation for this client that wanted to move their applications
Speaker 3: into the cloud. And so you're asking a lot of
Speaker 3: questions about how does AI increase the risk and the
Speaker 3: surface area. Those same questions ten years ago were asked
Speaker 3: about the cloud, and we're still on the journey where
Speaker 3: where companies are migrating into the cloud. We're not anywhere
Speaker 3: near finished that yet. And so there's two pieces to
Speaker 3: a cloud migration. One is just refactoring for the cloud
Speaker 3: to make sure the application works effectively in the cloud.
Speaker 3: And the second is security. And then you built in
Speaker 3: security by design using poll does prison of cloud products
Speaker 3: to make sure that not only did you have the
Speaker 3: visibility so our cloud product you can scan and see
Speaker 3: where the vulnerabilities are. And then there's also you know
Speaker 3: cloud firewalls essentially that will keep bad actors out and
Speaker 3: keep the cloud instance secure.
Speaker 1: If we sit down, I don't have this conversation five
Speaker 1: years from now, which I actually hope we do. Be fun.
Speaker 1: This pretend is twenty twenty nine. Tell me what are
Speaker 1: you happy about in twenty twenty nine.
Speaker 2: I think twenty twenty nine, quantum computing is mainstream. I
Speaker 2: think quantum computing is now quantum safe, where we're using
Speaker 2: quantum computing to make sure that those bad actors aren't
Speaker 2: as bad as they used to be back in twenty
Speaker 2: twenty four, and we're seeing around the corners and that
Speaker 2: we're empowering our palo alto relationship. That in twenty twenty
Speaker 2: nine is the premiere type of capability that people are
Speaker 2: looking at when they think of what used to be
Speaker 2: AI and now is quantum capability.
Speaker 1: Yeah.
Speaker 3: Yeah, I think for AI, everyone's just using it as
Speaker 3: part of their job. The way email was an innovation
Speaker 3: in the nineties, the way you know cloud was an
Speaker 3: innovation in the twenty tens, and we thought, how are
Speaker 3: we going to use this? What impact is it going
Speaker 3: to have on productivity? All these people who are spending
Speaker 3: their days typing up memos, like what are they going
Speaker 3: to do? We're going to be past that fear and
Speaker 3: we're all going to understand that it is this like
Speaker 3: truly positive force multiplier. For you know, every employee is
Speaker 3: able to do their best work and spend their time
Speaker 3: on the things that only they can do, and then
Speaker 3: the AI is doing the rest of that for them.
Speaker 2: Right, AI, it's fun to enable many things to work together,
Speaker 2: and it won't be just one language model. We won't
Speaker 2: even think about. It will be the difference between you know,
Speaker 2: Malcolm having a fax machine, stereo and a telephone and
Speaker 2: a memo board. Now it's in your pocket and it's
Speaker 2: all one thing and you don't even call that, you know.
Speaker 2: I said, walk them into my kids the other day
Speaker 2: and they're like, what's a walk man? So I do
Speaker 2: think it will. It'll be part of the past, and
Speaker 2: it will be the stock of the seamless connection. That is,
Speaker 2: secure seamless connection, of HR, of finance, of distribution, logistics,
Speaker 2: of billing, all of those will have a capability to
Speaker 2: work together.
Speaker 3: Yeah.
Speaker 1: I have to do some social quick fire questions you
Speaker 1: guys ready, all right? What's the number one thing that
Speaker 1: people misunderstand about AI?
Speaker 2: The reliance on data? What do you mean by that?
Speaker 2: I think that it's just assumed that it's happening and
Speaker 2: it can just go out and grab data anywhere.
Speaker 1: Yeah, you have.
Speaker 2: To have good data, reliable data, and access to the data.
Speaker 3: I think people are too afraid of it.
Speaker 1: Checkbox and image generators are the biggest things in consumer
Speaker 1: AI right now? What do you think is that next
Speaker 1: big business application, Jason.
Speaker 2: I think it's the tying together of multiple capabilities. I'm
Speaker 2: hinting towards this earlier is. I think tying together the
Speaker 2: disparate systems that sit in different parts of the organization,
Speaker 2: front all this back office, making it one office and
Speaker 2: tying together those different functions. That's it.
Speaker 3: I mean, it's workflow automation. I think back to your
Speaker 3: point on the reliance on data seems easy. It's a
Speaker 3: lot harder than you think because you have to have
Speaker 3: everything set up and exactly the right way to get
Speaker 3: all of your systems automated and the sort of the
Speaker 3: more boring jobs taken care of so that humans could
Speaker 3: do the strategic ones.
Speaker 1: How are you already using AI in your day to
Speaker 1: day life?
Speaker 3: I mean I use it at work all the time,
Speaker 3: and then I've found right now I go to chat
Speaker 3: GPT instead of Google to look things up. I like
Speaker 3: having a conversation.
Speaker 2: We have a wonderful capability in our consulting business called
Speaker 2: our consulting assistant and consulting advantage is the proper name
Speaker 2: for it. But I look at it as that assistant
Speaker 2: and it's a force multiplier for me. So if I
Speaker 2: need to pull together content proposals with the teams, we
Speaker 2: go straight to that.
Speaker 1: We are one more we Here's so many definitions of
Speaker 1: open related to technology. How do you define it and
Speaker 1: how does the concept help you innovate?
Speaker 3: By definition? In cybersecurity, you don't want to be too open, right,
Speaker 3: So I think we enable openness with this concept of
Speaker 3: zero trust and saying like everyone's invited in as long
Speaker 3: as you have the right credentials, right. So that's that's
Speaker 3: one way, and then the other way is just making
Speaker 3: sure you're connected to all the different systems in order
Speaker 3: to be able to have that visibility and see what's happening,
Speaker 3: because if you are blind, that's the minute you have
Speaker 3: that vulnerability.
Speaker 2: And I'd say it's moving quickly with security, it sounds
Speaker 2: contradictory open. Oh, then it means you're not safe. No,
Speaker 2: you are safe and you can move faster.
Speaker 1: Yeah, thank you so much. It's fun.
Speaker 3: Thanks a lot, Thank you great. We'll see you in
Speaker 3: five years.
Speaker 1: Five years, man, I'll be old in five years. Thank
Speaker 1: you to Jason Kelly at IBM and Christy Frederick's at
Speaker 1: POLO Alto Networks for that fascinating conversation about the threats
Speaker 1: and opportunities in cybersecurity today. As Jason and Christie stressed,
Speaker 1: AI can be a force multiplier for enterprise across industries.
Speaker 1: When you're working with multiple products and have your data
Speaker 1: in distributed environments, you need technology that will work across
Speaker 1: your organization, and with Palo Alto Networks platform, you can
Speaker 1: enhance cyber resiliency and simplify your operations. Through their collaboration,
Speaker 1: IBM and Palo Alto Networks are charting the future a
Speaker 1: fully integrated open end to end security solutions. Smart Talks
Speaker 1: with IBM is produced by Matt Romano, Joey Fishground, Amy
Speaker 1: Gaines McQuaid, and Jacob Goldstein. We're edited by Lydia Jane Kott.
Speaker 1: Our engineers are Sarah Bugaier and Ben Tolliday. Theme song
Speaker 1: by Gramoscope Special thanks to the eight Bar and IBM teams,
Speaker 1: as well as the Pushkin Marketing team. Smart Talks with
Speaker 1: IBM is a production of Pushkin Industries and Ruby Studio
Speaker 1: at iHeartMedia. To find more Pushkin podcasts, listen on the
Speaker 1: iHeartRadio app, Apple Podcasts, or wherever you listen to podcasts.
Speaker 1: I'm Malcolm Glaphom. This is a paid advertisement from IBM.
Speaker 1: The conversations on this podcast don't necessarily represent IBM's positions, strategies,
Speaker 1: or opinions.