1 00:00:00,130 --> 00:00:02,670 Speaker 1: Hey everyone, it's Robert and Joe here. Today, we're bringing 2 00:00:02,710 --> 00:00:05,290 Speaker 1: you a new episode of Smart Talks with IBM. 3 00:00:05,830 --> 00:00:08,990 Speaker 2: This season, Malcolm Gladwell talks to leaders using AI and 4 00:00:09,050 --> 00:00:12,220 Speaker 2: emerging technology to change the game in their industries. 5 00:00:12,700 --> 00:00:16,480 Speaker 1: From Heineken using AI to become the world's best connected brewer, 6 00:00:16,760 --> 00:00:20,440 Speaker 1: to UFC using data to turn chaos into clarity for 7 00:00:20,520 --> 00:00:21,620 Speaker 1: fans and commentators. 8 00:00:22,020 --> 00:00:25,660 Speaker 2: To Cleveland Clinic using AI and quantum computing to accelerate 9 00:00:25,700 --> 00:00:27,480 Speaker 2: discovery in biomedical research. 10 00:00:28,060 --> 00:00:32,000 Speaker 1: Smart Talks with IBM explores how organizations are applying technology 11 00:00:32,080 --> 00:00:34,740 Speaker 1: in unexpected and transformative ways. 12 00:00:35,400 --> 00:00:38,360 Speaker 2: New episodes drop every month wherever you get your podcasts. 13 00:00:38,540 --> 00:00:41,500 Speaker 2: Learn more at ibm.com slash smart talks. 14 00:00:41,909 --> 00:00:43,919 Speaker 1: This is a paid advertisement from IBM. 15 00:00:45,090 --> 00:00:47,949 Speaker 3: Hey, stuff to blow your mind listener. Thanks for tuning 16 00:00:47,990 --> 00:00:51,530 Speaker 3: into this episode of Smart Talks with IBM. If this 17 00:00:51,610 --> 00:00:54,370 Speaker 3: episode sparked a question you'd like to ask an IBM 18 00:00:54,430 --> 00:01:00,700 Speaker 3: technical expert, Submit your question at ibm.com slash smarttalks. We're 19 00:01:00,720 --> 00:01:03,580 Speaker 3: exploring ways to bring your questions directly to the experts, 20 00:01:03,960 --> 00:01:08,500 Speaker 3: and we'd love to hear what's on your mind. Big 21 00:01:08,560 --> 00:01:12,130 Speaker 3: companies inform insiders and investors of their comings and goings 22 00:01:12,190 --> 00:01:15,770 Speaker 3: through a steady stream of press releases. Written in plain language, 23 00:01:16,290 --> 00:01:19,050 Speaker 3: press releases typically serve as a chronicle of the prosaic 24 00:01:19,090 --> 00:01:22,310 Speaker 3: details of corporate life. If you were to scroll through 25 00:01:22,330 --> 00:01:25,010 Speaker 3: the news releases from IBM from last May, you would 26 00:01:25,050 --> 00:01:28,780 Speaker 3: see news of an AI collaboration, updates to the IBM 27 00:01:28,800 --> 00:01:33,000 Speaker 3: Consulting Service, a sports tech startup challenge, a new quantum 28 00:01:33,040 --> 00:01:36,920 Speaker 3: chip manufacturing facility, you get the picture. But keep scrolling 29 00:01:37,459 --> 00:01:41,360 Speaker 3: until you reach May 28th, a press release that dwarfs 30 00:01:41,420 --> 00:01:46,340 Speaker 3: nearly everything else. IBM and Red Hat today announced Project Lightwell, 31 00:01:46,840 --> 00:01:51,180 Speaker 3: a $ 5 billion commitment backed by new frontier AI capabilities 32 00:01:51,700 --> 00:01:55,590 Speaker 3: and a global force of more than 20,000 engineers. to 33 00:01:55,650 --> 00:02:00,380 Speaker 3: help enterprises secure open-source software. IBM and Red Hat, the 34 00:02:00,440 --> 00:02:04,720 Speaker 3: open-source software leader that IBM acquired in 2019, are committing 35 00:02:04,720 --> 00:02:12,459 Speaker 3: $ 5 billion and 20,000 engineers to a cybersecurity project. Even 36 00:02:12,520 --> 00:02:14,620 Speaker 3: in an age when we have become inured to very 37 00:02:14,660 --> 00:02:20,549 Speaker 3: large numbers, these are very large numbers. Keep reading. Paragraph four. 38 00:02:21,250 --> 00:02:23,590 Speaker 3: The press release then lists just some of the company's 39 00:02:23,930 --> 00:02:27,730 Speaker 3: that have already agreed to collaborate as early adopters. Bank 40 00:02:27,770 --> 00:02:32,790 Speaker 3: of America, Bank of New York, Citicorp, Goldman Sachs, JPMorgan Chase, MasterCard, 41 00:02:32,910 --> 00:02:36,720 Speaker 3: Morgan Stanley, Royal Bank of Canada, State Street, Visa, and 42 00:02:36,780 --> 00:02:40,200 Speaker 3: Wells Fargo. Four of the biggest banks in the U.S., 43 00:02:40,419 --> 00:02:43,040 Speaker 3: the biggest bank in Canada, two of the biggest investment 44 00:02:43,080 --> 00:02:45,640 Speaker 3: banks on Wall Street, two of the world's biggest credit 45 00:02:45,660 --> 00:02:49,690 Speaker 3: card networks, the firm that probably holds your 401k, just 46 00:02:50,290 --> 00:02:55,380 Speaker 3: for starters. Press releases do not normally require explanations. This 47 00:02:55,500 --> 00:03:01,320 Speaker 3: one does. I'm Malcolm Gladwell. You're listening to Smart Talks 48 00:03:01,360 --> 00:03:05,060 Speaker 3: with IBM, a podcast where we explore how AI and 49 00:03:05,120 --> 00:03:10,359 Speaker 3: emerging technologies are reshaping the way businesses and industries operate. 50 00:03:11,120 --> 00:03:14,170 Speaker 3: In this episode, I want to explain why one of 51 00:03:14,250 --> 00:03:18,510 Speaker 3: the world's largest technology companies felt compelled this past spring 52 00:03:18,850 --> 00:03:22,280 Speaker 3: to launch one of the largest dedicated commitments to to 53 00:03:22,440 --> 00:03:26,460 Speaker 3: open source security to date, and why the minute they did, 54 00:03:27,220 --> 00:03:30,540 Speaker 3: much of the financial services industry raised their hand and said, 55 00:03:31,070 --> 00:03:37,410 Speaker 3: count me in. You are the head of information security 56 00:03:37,490 --> 00:03:42,490 Speaker 3: for a large, very large multinational bank. I put the 57 00:03:42,530 --> 00:03:46,840 Speaker 3: question to Manish Sharma, the chief information security officer for 58 00:03:46,880 --> 00:03:50,830 Speaker 3: Wells Fargo, one of the early adopters on Lightwell. Why 59 00:03:50,870 --> 00:03:52,370 Speaker 3: did Wells Fargo participate? 60 00:03:52,850 --> 00:03:57,630 Speaker 4: You know, what we've seen with the progress in AI 61 00:03:58,220 --> 00:04:03,200 Speaker 4: has created an element of urgency about everything from maintenance 62 00:04:03,360 --> 00:04:07,540 Speaker 4: to lifecycle management to operational stability, every aspect of it. 63 00:04:07,560 --> 00:04:11,880 Speaker 4: So it's really in the past few quarters that we've 64 00:04:11,900 --> 00:04:13,800 Speaker 4: started to look at things differently. 65 00:04:14,700 --> 00:04:19,360 Speaker 3: Anthropic released Mythos in preview mode just six weeks ago. 66 00:04:19,810 --> 00:04:23,270 Speaker 3: before the launch of Lightwell. A frontier AI model so 67 00:04:23,330 --> 00:04:27,550 Speaker 3: powerful that Anthropic, its developer, said that it would, quote, 68 00:04:27,850 --> 00:04:31,590 Speaker 3: surpass all but the most skilled humans at finding and 69 00:04:31,630 --> 00:04:36,230 Speaker 3: exploiting software vulnerabilities. It's right there in the press release. 70 00:04:36,910 --> 00:04:41,430 Speaker 3: Paragraph three, Anthropic recently reported that its mythos preview model 71 00:04:41,529 --> 00:04:47,750 Speaker 3: identified nearly 3,900 high or critical severity vulnerabilities in open 72 00:04:47,810 --> 00:04:55,890 Speaker 3: source software alone. Thousands and thousands of critical vulnerabilities. But 73 00:04:55,930 --> 00:04:59,010 Speaker 3: there was a moment where you're like, oh, yeah. Give 74 00:04:59,029 --> 00:05:01,750 Speaker 3: me a kind of more specific understanding of that. So 75 00:05:01,790 --> 00:05:04,290 Speaker 3: when you say the pace has changed, it's gone from 76 00:05:04,810 --> 00:05:05,450 Speaker 3: what to what? 77 00:05:05,870 --> 00:05:10,060 Speaker 4: Potentially from days and weeks to minutes. 78 00:05:11,140 --> 00:05:14,700 Speaker 3: To understand the urgency behind Lightwell, you have to understand 79 00:05:14,779 --> 00:05:20,050 Speaker 3: something about software that most people never think about. Open source. 80 00:05:21,010 --> 00:05:26,229 Speaker 3: Unlike proprietary code, open source software isn't controlled exclusively by 81 00:05:26,390 --> 00:05:30,150 Speaker 3: one company or person. In a hypothetical universe where there 82 00:05:30,310 --> 00:05:34,390 Speaker 3: is no open source, where code is written the way 83 00:05:35,830 --> 00:05:38,729 Speaker 3: music lyrics are written or books are written, where they're 84 00:05:38,850 --> 00:05:42,229 Speaker 3: owned exclusively by the person, by the creator, how does 85 00:05:42,250 --> 00:05:45,250 Speaker 3: that affect the shape of the digital revolution? 86 00:05:45,710 --> 00:05:47,610 Speaker 5: Well, so actually I'm going to correct you. 87 00:05:47,970 --> 00:05:51,070 Speaker 3: I'm talking to Gunnar Hellickson. who runs the Lightwell Initiative 88 00:05:51,350 --> 00:05:52,690 Speaker 3: for IBM and Red Hat. 89 00:05:53,529 --> 00:05:56,950 Speaker 5: In fact, open source only works because of copyright. So 90 00:05:56,970 --> 00:05:59,570 Speaker 5: what happens is I write a piece of software, I 91 00:05:59,589 --> 00:06:02,680 Speaker 5: have a copyright to it, and I use that copyright 92 00:06:02,860 --> 00:06:06,320 Speaker 5: not to say all rights reserved and restrict access to it. 93 00:06:06,400 --> 00:06:08,360 Speaker 5: I use those same rights to then, I can now 94 00:06:08,440 --> 00:06:11,960 Speaker 5: ascribe those rights to other people. So it's actually what 95 00:06:12,000 --> 00:06:14,190 Speaker 5: was most clever about open source is it kind of 96 00:06:14,589 --> 00:06:17,370 Speaker 5: inverts the intent of the copyright law and makes it 97 00:06:17,720 --> 00:06:19,280 Speaker 5: it turns it into a tool for sharing as opposed 98 00:06:19,300 --> 00:06:20,260 Speaker 5: to a tool for restriction. 99 00:06:20,300 --> 00:06:20,500 Speaker 1: Yeah. 100 00:06:20,660 --> 00:06:22,820 Speaker 3: But books and music are not written as tools for sharing. 101 00:06:22,960 --> 00:06:23,300 Speaker 1: No, that's true. 102 00:06:23,320 --> 00:06:25,280 Speaker 3: There's a million books I've read where I've said I 103 00:06:25,320 --> 00:06:27,589 Speaker 3: could make this better and I'm not allowed to. 104 00:06:27,710 --> 00:06:28,350 Speaker 4: Yeah, that's right. 105 00:06:28,370 --> 00:06:28,650 Speaker 2: That's right. 106 00:06:29,010 --> 00:06:33,790 Speaker 5: And so the mechanics of sharing become important because using 107 00:06:33,830 --> 00:06:36,010 Speaker 5: the copyright law, you can actually ensure that things are 108 00:06:36,570 --> 00:06:39,560 Speaker 5: shared over time and consistently. So if I write a 109 00:06:39,580 --> 00:06:41,200 Speaker 5: piece of software and I give it to you, you 110 00:06:41,240 --> 00:06:45,039 Speaker 5: can improve it, but the license stipulates that you then 111 00:06:45,120 --> 00:06:47,219 Speaker 5: also have to share any improvements that you made, right? 112 00:06:47,260 --> 00:06:48,900 Speaker 5: And so in this way, it kind of folds in 113 00:06:48,960 --> 00:06:49,820 Speaker 5: on itself, right? 114 00:06:49,900 --> 00:06:50,080 Speaker 1: Yeah. 115 00:06:50,560 --> 00:06:53,979 Speaker 3: Open source software often works in tandem with proprietary code. 116 00:06:54,580 --> 00:06:57,870 Speaker 3: Imagine a pyramid. At the top of the pyramid is 117 00:06:57,930 --> 00:07:01,990 Speaker 3: the specific, carefully tailored code that an individual company might 118 00:07:02,110 --> 00:07:06,029 Speaker 3: use to solve a specific problem. That code is typically 119 00:07:06,070 --> 00:07:09,450 Speaker 3: written in-house or purchased from a software company. 120 00:07:10,190 --> 00:07:10,990 Speaker 1: It's curated. 121 00:07:11,530 --> 00:07:17,010 Speaker 3: It's controlled. systematically. Someone's in charge of it. But beneath 122 00:07:17,070 --> 00:07:21,210 Speaker 3: that sits something much larger. Billions of lines of open 123 00:07:21,230 --> 00:07:26,380 Speaker 3: source code. Shared software components or packages built collectively by 124 00:07:26,440 --> 00:07:30,720 Speaker 3: developers all over the world over decades. Anyone can use them. 125 00:07:31,420 --> 00:07:35,160 Speaker 3: Anyone can improve them. Someone fixes a bug, submits the 126 00:07:35,200 --> 00:07:38,060 Speaker 3: update to the volunteer running that particular package, and the 127 00:07:38,100 --> 00:07:48,250 Speaker 3: project evolves. A famous essay in the technology world refers 128 00:07:48,310 --> 00:07:51,850 Speaker 3: to these two models of software production as the cathedral 129 00:07:52,290 --> 00:07:56,950 Speaker 3: and the bazaar. The cathedral is quiet and composed and hierarchical. 130 00:07:57,870 --> 00:08:02,290 Speaker 3: The bazaar is sprawling and noisy and chaotic. And the 131 00:08:02,330 --> 00:08:05,990 Speaker 3: argument in the essay was that the bazaar, against all expectations, 132 00:08:06,410 --> 00:08:08,950 Speaker 3: was far better suited for the kind of creative work 133 00:08:09,330 --> 00:08:13,230 Speaker 3: that produces innovative software. Here's an excerpt from the essay. 134 00:08:13,580 --> 00:08:17,880 Speaker 3: describing the emergence of the most famous of all open-source projects, Linux, 135 00:08:18,580 --> 00:08:22,660 Speaker 3: started by Linus Torvald in the early 1990s, the operating 136 00:08:22,720 --> 00:08:28,290 Speaker 3: system that would become the backbone of modern computing. I 137 00:08:28,350 --> 00:08:31,810 Speaker 3: believed that the most important software needed to be built 138 00:08:31,990 --> 00:08:37,030 Speaker 3: like cathedrals, carefully crafted by individual wizards or small bands 139 00:08:37,070 --> 00:08:40,510 Speaker 3: of mages working in splendid isolation with no beta to 140 00:08:40,570 --> 00:08:44,940 Speaker 3: be released before its time. Linus Torvald's style of development, 141 00:08:45,420 --> 00:08:49,120 Speaker 3: release early and often, delegate everything you can, be open 142 00:08:49,179 --> 00:08:53,680 Speaker 3: to the point of promiscuity, came as a surprise. No quiet, 143 00:08:54,100 --> 00:08:57,960 Speaker 3: reverent cathedral building here. Rather, the Linux community seemed to 144 00:08:58,000 --> 00:09:02,440 Speaker 3: resemble a giant babbling bazaar of differing agendas and approaches, 145 00:09:03,360 --> 00:09:07,450 Speaker 3: aptly symbolized by the Linux archive sites who take submissions 146 00:09:07,490 --> 00:09:10,870 Speaker 3: from anyone, out of which a coherent and stable system 147 00:09:11,190 --> 00:09:15,650 Speaker 3: could seemingly emerge only by a succession of miracles. The 148 00:09:15,690 --> 00:09:19,270 Speaker 3: fact that this bizarre style seemed to work, and work well, 149 00:09:20,120 --> 00:09:29,280 Speaker 3: came as a distinct shock. Could we have gotten to 150 00:09:29,300 --> 00:09:34,860 Speaker 3: the level of technological sophistication that we have today without 151 00:09:34,920 --> 00:09:35,400 Speaker 3: open source? 152 00:09:35,620 --> 00:09:36,600 Speaker 6: No, no, no. 153 00:09:36,820 --> 00:09:37,620 Speaker 3: Here's Gunner again. 154 00:09:38,140 --> 00:09:44,230 Speaker 5: Open source is so widespread right now. Aircraft in the sky, waterworks, electricity, roads, governments, 155 00:09:45,530 --> 00:09:49,530 Speaker 5: they all rely on software that was largely developed by 156 00:09:49,630 --> 00:09:55,750 Speaker 5: volunteers who were just scratching their own itch. And no 157 00:09:55,830 --> 00:09:59,440 Speaker 5: single firm could capture all of that work, couldn't afford 158 00:09:59,460 --> 00:10:04,330 Speaker 5: to pay them. And even if it could, the innovation 159 00:10:04,390 --> 00:10:06,950 Speaker 5: loops that happen in all of the sharing would be 160 00:10:06,970 --> 00:10:09,270 Speaker 5: confined to that one firm. It would be very, very 161 00:10:09,309 --> 00:10:12,150 Speaker 5: difficult for three or four of these firms to share 162 00:10:12,170 --> 00:10:14,670 Speaker 5: the information as easily as they can with open source. 163 00:10:15,000 --> 00:10:17,540 Speaker 3: To give you a sense of the scale of open source, 164 00:10:18,100 --> 00:10:23,280 Speaker 3: GitHub the largest archive of open-source code, has over 420 165 00:10:23,280 --> 00:10:28,800 Speaker 3: million software packages in its library. 230 new repositories were 166 00:10:28,860 --> 00:10:34,350 Speaker 3: created every minute in 2025. That year, software developers around 167 00:10:34,390 --> 00:10:37,750 Speaker 3: the world made just under a billion commits to that archive. 168 00:10:38,410 --> 00:10:42,469 Speaker 3: This year, in 2026, GitHub is seeing over 2 billion 169 00:10:42,510 --> 00:10:46,090 Speaker 3: commits a month due to an explosion in AI-assisted coding. 170 00:10:46,890 --> 00:10:51,060 Speaker 3: Open-source is is massive. But the very thing that makes 171 00:10:51,220 --> 00:10:54,620 Speaker 3: open source so dynamic, the fact that there is no 172 00:10:54,710 --> 00:10:58,910 Speaker 3: central controlling authority, is also what makes it so fragile. 173 00:11:00,309 --> 00:11:03,510 Speaker 3: So who actually worries about the security of open source code? 174 00:11:04,130 --> 00:11:08,970 Speaker 5: So as the software graduates and moves into commercialization, it's 175 00:11:09,690 --> 00:11:11,950 Speaker 5: real clear, right? There's not just one, but probably several 176 00:11:12,010 --> 00:11:14,010 Speaker 5: companies who are interested in making sure that that software 177 00:11:14,070 --> 00:11:16,290 Speaker 5: is secure, right? So things work really well at that point. 178 00:11:16,929 --> 00:11:18,890 Speaker 5: So really what we're talking about is the software that 179 00:11:19,030 --> 00:11:21,710 Speaker 5: doesn't quite get swept up in the commercialization process, but 180 00:11:21,750 --> 00:11:25,449 Speaker 5: it's still essential. And the way I just described it 181 00:11:25,470 --> 00:11:27,710 Speaker 5: makes it sound like that's like 5% of the problem, 182 00:11:28,190 --> 00:11:32,380 Speaker 5: but across all of IT, it's about 60 to 70% 183 00:11:32,380 --> 00:11:34,660 Speaker 5: of the software that we're running falls in that chasm 184 00:11:35,400 --> 00:11:39,400 Speaker 5: between it's not actually commercially supported and it's not software 185 00:11:39,440 --> 00:11:43,150 Speaker 5: that the Company has written itself. It's these are dip. 186 00:11:43,170 --> 00:11:46,110 Speaker 5: We call them dependencies, right? These are software that we 187 00:11:46,150 --> 00:11:51,660 Speaker 5: need to go write other software, right? and that's To 188 00:11:51,720 --> 00:11:56,280 Speaker 5: date We have not tended not to think very hard 189 00:11:56,440 --> 00:11:59,120 Speaker 5: about the security of those dependencies. 190 00:11:58,960 --> 00:12:02,320 Speaker 3: Much of the software underneath modern life doesn't belong to 191 00:12:02,420 --> 00:12:06,679 Speaker 3: anyone in particular Which raises an obvious question if everyone 192 00:12:06,720 --> 00:12:10,459 Speaker 3: depends on it who's responsible for maintaining it? 193 00:12:11,330 --> 00:12:14,949 Speaker 6: Well, this is the whole thing about open source software 194 00:12:15,610 --> 00:12:21,370 Speaker 6: is it's incredibly important and it is maintained by a 195 00:12:21,890 --> 00:12:27,010 Speaker 6: relatively small number of people. And so you can think 196 00:12:27,070 --> 00:12:31,220 Speaker 6: about these enormously consequential projects that we all rely upon, 197 00:12:31,780 --> 00:12:35,500 Speaker 6: basically maintained by a handful of people. And that's been 198 00:12:35,540 --> 00:12:38,360 Speaker 6: the biggest issue of it, sort of industrial use and 199 00:12:38,400 --> 00:12:44,250 Speaker 6: then artisanal scale maintenance. And because of where we're at 200 00:12:44,290 --> 00:12:49,200 Speaker 6: right now with respect to infrastructure and software being under 201 00:12:49,260 --> 00:12:54,740 Speaker 6: increasing threat, given these very powerful AI capabilities, there's now 202 00:12:54,820 --> 00:12:58,160 Speaker 6: been a big flashlight on, wow, we depend on this 203 00:12:58,240 --> 00:13:01,880 Speaker 6: open source software, but it is maintained by, in a 204 00:13:01,920 --> 00:13:03,360 Speaker 6: lot of cases, volunteers. 205 00:13:03,640 --> 00:13:07,929 Speaker 3: That's Jen Easterly. She has spent her career thinking about risk. First, 206 00:13:08,270 --> 00:13:13,069 Speaker 3: as a soldier and intelligence officer, later inside the cybersecurity establishment, 207 00:13:13,500 --> 00:13:15,880 Speaker 3: and now as the head of RSAC, one of the 208 00:13:15,920 --> 00:13:20,520 Speaker 3: world's leading cybersecurity conferences and communities. Talk a little bit 209 00:13:20,540 --> 00:13:24,500 Speaker 3: about your own path to worrying about this problem. How 210 00:13:24,520 --> 00:13:25,219 Speaker 3: did you get into this? 211 00:13:26,280 --> 00:13:30,240 Speaker 6: Yeah, I mean, a pretty circuitous path, to be honest. 212 00:13:31,360 --> 00:13:34,590 Speaker 6: It sort of started out right after my 18th birthday, 213 00:13:34,710 --> 00:13:37,370 Speaker 6: where I entered the gates of the United States Military 214 00:13:37,410 --> 00:13:38,370 Speaker 6: Academy at West Point. 215 00:13:38,800 --> 00:13:40,959 Speaker 3: Easterly was in the military for the fall of the 216 00:13:40,980 --> 00:13:46,380 Speaker 3: Berlin Wall. She served on the ground in Haiti, Bosnia, Kosovo, Somalia. 217 00:13:46,900 --> 00:13:49,070 Speaker 3: She returned to West Point to teach economics. 218 00:13:49,590 --> 00:13:52,350 Speaker 6: And I was there during 9-11 where the world changed again. 219 00:13:52,750 --> 00:13:56,030 Speaker 6: And the next decade became all about terrorism. I was 220 00:13:56,070 --> 00:13:58,350 Speaker 6: at the White House working for Condi Rice as her 221 00:13:58,370 --> 00:14:01,910 Speaker 6: executive assistant and then went off to the National Security Agency, 222 00:14:01,950 --> 00:14:05,910 Speaker 6: of course, the world's largest and most powerful intelligence agency. 223 00:14:05,950 --> 00:14:07,870 Speaker 6: And I was there for over a decade in Iraq. 224 00:14:08,540 --> 00:14:12,350 Speaker 6: in Afghanistan, and that's where I got into cyber. Stood 225 00:14:12,390 --> 00:14:15,410 Speaker 6: up the Army's first cyber operations battalion, went to stand 226 00:14:15,490 --> 00:14:18,550 Speaker 6: up US Cyber Command, and then ended up in the 227 00:14:18,590 --> 00:14:21,850 Speaker 6: private sector at Morgan Stanley, and then at CISA, which 228 00:14:21,930 --> 00:14:25,410 Speaker 6: is America's Cyber Defense Agency, and now I run the 229 00:14:25,450 --> 00:14:30,130 Speaker 6: largest platform for cybersecurity. And so a very circuitous path, 230 00:14:30,250 --> 00:14:33,350 Speaker 6: which all kinds of different threats, but right now a 231 00:14:33,430 --> 00:14:35,170 Speaker 6: huge focus on cyber. 232 00:14:35,190 --> 00:14:36,720 Speaker 1: The craziest career path I've ever heard. 233 00:14:37,000 --> 00:14:37,820 Speaker 6: It is a little crazy. 234 00:14:38,520 --> 00:14:42,010 Speaker 3: Easterly is, in the world of cybersecurity, a unique figure. 235 00:14:43,210 --> 00:14:46,730 Speaker 3: She's a soldier and a strategist, not a coder. She 236 00:14:46,770 --> 00:14:49,869 Speaker 3: spent her career moving between the military government and the 237 00:14:49,910 --> 00:14:53,410 Speaker 3: private sector, not growing up in Silicon Valley. And most 238 00:14:53,450 --> 00:14:55,630 Speaker 3: of all, she's someone who has spent her career looking 239 00:14:55,670 --> 00:14:58,660 Speaker 3: at problems through the lens of national security and resilience. 240 00:14:59,420 --> 00:15:03,220 Speaker 3: Who threatens us? Where are we vulnerable? How do we 241 00:15:03,280 --> 00:15:05,800 Speaker 3: reduce risk? And how do we make the systems we 242 00:15:05,840 --> 00:15:08,930 Speaker 3: depend on harder to break, and faster to recover when 243 00:15:08,950 --> 00:15:13,030 Speaker 3: they do. That combination has given her an unusual and 244 00:15:13,190 --> 00:15:18,030 Speaker 3: influential voice on cybersecurity. And one of Easterly's mantras is, 245 00:15:18,570 --> 00:15:21,510 Speaker 3: the world does not have a cybersecurity problem. It has, 246 00:15:21,530 --> 00:15:25,500 Speaker 3: and to her mind, this distinction is crucial, a software 247 00:15:25,600 --> 00:15:26,460 Speaker 3: quality problem. 248 00:15:26,940 --> 00:15:30,820 Speaker 6: So security has always been a bolt-on, right? That's arguably 249 00:15:30,860 --> 00:15:34,660 Speaker 6: what created the multi-billion dollar cybersecurity aftermarket. 250 00:15:34,820 --> 00:15:37,410 Speaker 3: What she means is that cybersecurity is is thought of 251 00:15:37,590 --> 00:15:41,600 Speaker 3: as a layer added to software after the fact, often 252 00:15:41,700 --> 00:15:45,200 Speaker 3: by someone other than the original software developer to keep 253 00:15:45,300 --> 00:15:50,260 Speaker 3: the software secure. Her question is, why isn't the security 254 00:15:50,400 --> 00:15:55,850 Speaker 3: baked into the software itself? Answer, because the incentive structure 255 00:15:56,150 --> 00:15:58,310 Speaker 3: around writing software is all wrong. 256 00:15:58,960 --> 00:16:02,440 Speaker 6: I mean, it comes down to without getting too geeky or, 257 00:16:02,680 --> 00:16:02,940 Speaker 6: you know. 258 00:16:03,320 --> 00:16:04,240 Speaker 1: No, you can get geeky. 259 00:16:04,260 --> 00:16:08,520 Speaker 3: This is IBM smart talks. You can be geeky as 260 00:16:08,540 --> 00:16:08,860 Speaker 3: you want. 261 00:16:08,880 --> 00:16:13,570 Speaker 6: All right. We're going to do a quick econ 101. 262 00:16:14,910 --> 00:16:18,130 Speaker 6: So it all comes down to like basic economics, right? Goods, right? So, 263 00:16:18,530 --> 00:16:21,690 Speaker 6: you know, you have search goods where you can tell 264 00:16:21,730 --> 00:16:23,710 Speaker 6: the quality of a good before you buy it. Pair 265 00:16:23,750 --> 00:16:26,840 Speaker 6: of shoes, nice shirt. And then you have experienced goods. 266 00:16:26,880 --> 00:16:29,120 Speaker 6: You tell the quality after you buy it, like a 267 00:16:29,160 --> 00:16:33,070 Speaker 6: meal in a restaurant or a nice, you know, trip, right? 268 00:16:33,530 --> 00:16:37,470 Speaker 6: But software security is a quintessential credence good. What does 269 00:16:37,490 --> 00:16:40,910 Speaker 6: that mean? It means that a person can't actually tell 270 00:16:40,930 --> 00:16:43,380 Speaker 6: the quality of a good before you purchase it or 271 00:16:43,460 --> 00:16:46,280 Speaker 6: even after you purchase it. So the average human is 272 00:16:46,320 --> 00:16:48,560 Speaker 6: not going to look at a piece of software and say, 273 00:16:48,580 --> 00:16:52,140 Speaker 6: that is the most secure software. That is the best, 274 00:16:52,240 --> 00:16:55,960 Speaker 6: most resilient code ever. Or I am definitely going to 275 00:16:56,000 --> 00:16:58,260 Speaker 6: get hacked and all my money is going to get stolen. 276 00:16:58,760 --> 00:17:02,380 Speaker 6: You can't look at that, right? And so because of that, 277 00:17:03,300 --> 00:17:06,830 Speaker 6: consumers don't really know what to ask for. And so 278 00:17:06,910 --> 00:17:11,409 Speaker 6: the makers of the software were never incentivized to prioritize it. 279 00:17:11,470 --> 00:17:14,590 Speaker 6: They were incentivized to prioritize getting that product to market 280 00:17:14,630 --> 00:17:17,910 Speaker 6: first or driving down the cost. And so you have 281 00:17:17,970 --> 00:17:21,760 Speaker 6: basically a classic market failure situation. where the market is 282 00:17:21,800 --> 00:17:24,899 Speaker 6: not going to reward something that consumers don't actually care about. 283 00:17:25,619 --> 00:17:28,179 Speaker 6: And then the further problem is, what happens, you know, 284 00:17:28,220 --> 00:17:30,420 Speaker 6: how do you fix a market failure? Well, the government 285 00:17:30,480 --> 00:17:35,030 Speaker 6: steps in with regulation to protect consumers. But in this case, 286 00:17:35,550 --> 00:17:38,530 Speaker 6: the technology vendors who make this stuff have said, you know, 287 00:17:38,550 --> 00:17:41,869 Speaker 6: at the end of the day, these flaws, these defects, 288 00:17:41,910 --> 00:17:45,940 Speaker 6: these vulnerabilities, they're just the cost of doing business. We'll 289 00:17:46,000 --> 00:17:48,850 Speaker 6: tell customers that there's a flaw and you need to 290 00:17:48,880 --> 00:17:51,270 Speaker 6: patch it and just take care of it after the fact. 291 00:17:51,970 --> 00:17:55,250 Speaker 6: And so there's never been any sort of technology regulation. 292 00:17:55,310 --> 00:17:58,050 Speaker 6: There's never been any sort of a software liability. So 293 00:17:58,330 --> 00:18:01,270 Speaker 6: anybody who buys software, I challenge you, whether you're a 294 00:18:01,310 --> 00:18:05,480 Speaker 6: corporation or an individual, look at that contract that you sign. 295 00:18:06,020 --> 00:18:09,680 Speaker 6: And somewhere on that contract, it will say, you buy 296 00:18:09,720 --> 00:18:14,780 Speaker 6: this product entirely at your own I guarantee you it 297 00:18:14,820 --> 00:18:17,220 Speaker 6: will say that. And of course, we all check that box. 298 00:18:17,869 --> 00:18:21,889 Speaker 6: But essentially, we've set up a world where software quality 299 00:18:22,090 --> 00:18:27,110 Speaker 6: is not prized. And so that's where developers have never been, 300 00:18:27,130 --> 00:18:29,630 Speaker 6: you know, security has never been the number one thing 301 00:18:29,690 --> 00:18:33,500 Speaker 6: that developers have focused on. It's certainly not a malicious thing. 302 00:18:33,680 --> 00:18:37,120 Speaker 6: It's just they're writing code and they are moving out 303 00:18:37,180 --> 00:18:41,500 Speaker 6: products and there's not been this incentive to write secure code. 304 00:18:41,740 --> 00:18:45,540 Speaker 3: With open source software, This misalignment of incentives is in 305 00:18:45,600 --> 00:18:49,119 Speaker 3: some ways even more pronounced because you have this far-flung 306 00:18:49,140 --> 00:18:53,860 Speaker 3: group of developers working independently on a single project, improving, 307 00:18:54,180 --> 00:18:57,640 Speaker 3: evolving in fits and starts. Some things just fall through 308 00:18:57,660 --> 00:19:02,230 Speaker 3: the cracks. Here's Gunnar again. Why isn't the open source 309 00:19:02,270 --> 00:19:07,250 Speaker 3: innovator in the beginning motivated to make the code as 310 00:19:07,290 --> 00:19:10,520 Speaker 3: secure as possible? are they indifferent to it or do 311 00:19:11,240 --> 00:19:13,600 Speaker 3: other things take priority or what's the kind. 312 00:19:13,440 --> 00:19:17,720 Speaker 5: Of, yeah, well, it's a, it's a combination of things. It's, uh, uh, well, 313 00:19:17,880 --> 00:19:18,870 Speaker 5: do you brush your teeth every day? 314 00:19:19,890 --> 00:19:20,150 Speaker 4: I do. 315 00:19:20,830 --> 00:19:22,770 Speaker 1: Oh, okay. That's a bad example then. 316 00:19:23,369 --> 00:19:26,810 Speaker 5: My children, maybe you could use my kids. So do 317 00:19:26,850 --> 00:19:28,490 Speaker 5: they know that they need to brush their teeth every day? 318 00:19:28,609 --> 00:19:28,830 Speaker 1: Yes. 319 00:19:29,030 --> 00:19:31,070 Speaker 5: Will they actually brush their teeth every day? No, we're 320 00:19:31,090 --> 00:19:33,760 Speaker 5: all human. We all have reasons. And an open source 321 00:19:34,020 --> 00:19:38,410 Speaker 5: project maintainer may, uh, They may not have the skills 322 00:19:38,450 --> 00:19:40,910 Speaker 5: or the wherewithal to actually make the software secure. That's 323 00:19:40,970 --> 00:19:43,840 Speaker 5: very common because making software secure is a dark art, right? 324 00:19:44,060 --> 00:19:48,169 Speaker 5: It's very complicated. And it could be also that they 325 00:19:48,210 --> 00:19:50,600 Speaker 5: were distracted, right? They could be that they started a 326 00:19:50,619 --> 00:19:54,000 Speaker 5: project that was very, very promising, but then they got married, 327 00:19:54,600 --> 00:19:56,580 Speaker 5: they got a dog, and they got distracted, they got 328 00:19:56,619 --> 00:19:59,300 Speaker 5: a new job, and now that software got picked up 329 00:19:59,320 --> 00:20:01,820 Speaker 5: by somebody else who didn't go back and check the code. 330 00:20:01,840 --> 00:20:02,940 Speaker 5: You know, there's lots of reasons why. 331 00:20:03,260 --> 00:20:07,080 Speaker 3: Historically, that kind of messiness was manageable. The bazaar would 332 00:20:07,200 --> 00:20:10,670 Speaker 3: inevitably get around to identifying and fixing the most serious 333 00:20:10,730 --> 00:20:15,390 Speaker 3: of vulnerabilities. Before AI comes along, developers have an intuition 334 00:20:15,410 --> 00:20:19,030 Speaker 3: about how safe a piece of software is. And what 335 00:20:19,090 --> 00:20:22,450 Speaker 3: AI does is it says those intuitions tended to radically 336 00:20:22,530 --> 00:20:25,129 Speaker 3: underestimate the number of vulnerabilities. 337 00:20:25,290 --> 00:20:25,470 Speaker 4: Yeah. 338 00:20:25,670 --> 00:20:26,310 Speaker 3: How radically? 339 00:20:27,950 --> 00:20:28,490 Speaker 1: Quite radically. 340 00:20:28,600 --> 00:20:32,020 Speaker 5: The number of vulnerabilities that we joke internally that a 341 00:20:32,100 --> 00:20:34,720 Speaker 5: lot of the vulnerabilities that we've discovered are old enough 342 00:20:34,740 --> 00:20:38,490 Speaker 5: to vote. They have been in software for 18, 20 years. 343 00:20:38,810 --> 00:20:42,130 Speaker 5: These people just never, yeah, just never looked or never 344 00:20:42,170 --> 00:20:44,510 Speaker 5: had an AI that had the patience to look, right? 345 00:20:44,710 --> 00:20:44,890 Speaker 1: Yeah. 346 00:20:45,250 --> 00:20:48,460 Speaker 3: In the world of cybersecurity, vulnerabilities are given a grade 347 00:20:48,820 --> 00:20:52,700 Speaker 3: on the common vulnerability scoring system, more commonly referred to 348 00:20:53,000 --> 00:20:58,040 Speaker 3: as a CVSS score. The CVSS scale measures how serious 349 00:20:58,119 --> 00:20:58,960 Speaker 3: a vulnerability is. 350 00:20:59,540 --> 00:21:01,659 Speaker 5: So if you say that my piece of software has 351 00:21:01,680 --> 00:21:04,500 Speaker 5: a critical vulnerability, cool, I'll go fix the critical vulnerability 352 00:21:04,520 --> 00:21:08,510 Speaker 5: and then work it. Um, But to date, we've said, well, 353 00:21:08,530 --> 00:21:11,120 Speaker 5: if you've got 10 low vulnerabilities, it's kind of like, well, 354 00:21:11,130 --> 00:21:13,160 Speaker 5: I could go fix it. But it's actually probably even 355 00:21:13,220 --> 00:21:14,959 Speaker 5: more disruptive and risky to fix it than it is 356 00:21:15,020 --> 00:21:16,580 Speaker 5: to just leave it alone. So we're just going to 357 00:21:16,619 --> 00:21:18,600 Speaker 5: let it be. And we kind of, as an industry, 358 00:21:18,619 --> 00:21:20,800 Speaker 5: we kind of collectively decided over the last 25 years, 359 00:21:20,859 --> 00:21:24,080 Speaker 5: like when we get these low impact vulnerabilities, let's just 360 00:21:24,119 --> 00:21:24,580 Speaker 5: leave them be. 361 00:21:24,619 --> 00:21:25,100 Speaker 1: It's riskier. 362 00:21:25,180 --> 00:21:28,480 Speaker 5: It's too risky to fix them. So any one of 363 00:21:28,530 --> 00:21:31,030 Speaker 5: these things is not very important. But when you chain them, 364 00:21:31,310 --> 00:21:33,149 Speaker 5: when you chain five or six of them together in 365 00:21:33,190 --> 00:21:36,270 Speaker 5: a very specific way, now suddenly they become critical. That 366 00:21:36,310 --> 00:21:38,889 Speaker 5: is one of the consequences of, now that we've pointed 367 00:21:38,990 --> 00:21:41,150 Speaker 5: AI at this problem, that's one of the things that 368 00:21:41,190 --> 00:21:43,070 Speaker 5: we've collectively come to this realization. 369 00:21:43,109 --> 00:21:46,850 Speaker 3: We're talking about not just second-order effects, but third, fourth, 370 00:21:47,170 --> 00:21:50,810 Speaker 3: fifth order. It's like chess. This one move doesn't appear 371 00:21:50,850 --> 00:21:52,730 Speaker 3: to put me in any peril, but what I've done 372 00:21:52,770 --> 00:21:54,620 Speaker 3: in the first round will come back to haunt me 373 00:21:54,930 --> 00:21:58,420 Speaker 3: five rounds in, and by then, I've lost. There's a 374 00:21:58,560 --> 00:22:01,440 Speaker 3: flip side to this, though, and that's where the story 375 00:22:01,480 --> 00:22:04,679 Speaker 3: turns optimistic. If AI has made it much easier for 376 00:22:04,720 --> 00:22:08,470 Speaker 3: bad actors to find vulnerabilities, it has also made it 377 00:22:08,730 --> 00:22:12,130 Speaker 3: easier for the good guys to fix them. Here's Manish 378 00:22:12,170 --> 00:22:16,290 Speaker 3: Sharma again, who has the massive responsibility of ensuring digital 379 00:22:16,330 --> 00:22:19,429 Speaker 3: security for a major institution, Wells Fargo. 380 00:22:20,330 --> 00:22:23,100 Speaker 4: We've quite literally used AI to sort of combat the 381 00:22:23,119 --> 00:22:24,649 Speaker 4: risk of AI. And what I mean by that is 382 00:22:24,690 --> 00:22:29,100 Speaker 4: we've developed automated capabilities using AI to be able to 383 00:22:29,180 --> 00:22:31,580 Speaker 4: fix what we detect in our software. 384 00:22:32,390 --> 00:22:35,940 Speaker 3: Like any competitive struggle, from a sporting match to human warfare, 385 00:22:36,359 --> 00:22:40,899 Speaker 3: competition involves a constant back and forth between defense and offense, 386 00:22:41,380 --> 00:22:44,460 Speaker 3: with each side having a momentary advantage. And while the 387 00:22:44,500 --> 00:22:47,740 Speaker 3: advantage in software is to the attacker right now, that 388 00:22:47,900 --> 00:22:52,080 Speaker 3: shouldn't always be the case. Manish says he's also seeing 389 00:22:52,100 --> 00:22:54,859 Speaker 3: the balance shift with some of the new AI tools. 390 00:22:55,980 --> 00:23:00,880 Speaker 4: Done the right way, architected the right way. I don't 391 00:23:00,920 --> 00:23:06,850 Speaker 4: think it's easier or faster for AI to identify than 392 00:23:07,540 --> 00:23:10,190 Speaker 4: to mitigate. Obviously, there is going to be a little 393 00:23:10,230 --> 00:23:12,500 Speaker 4: bit of a lag between those two, but it's not 394 00:23:12,780 --> 00:23:14,760 Speaker 4: orders of magnitude, meaning it's not as if you can 395 00:23:14,840 --> 00:23:18,939 Speaker 4: find things in a day and it takes you months 396 00:23:20,680 --> 00:23:23,399 Speaker 4: to patch them or to mitigate them. If that's where 397 00:23:25,280 --> 00:23:28,520 Speaker 4: an institution is, I'd be a little concerned. So your 398 00:23:28,560 --> 00:23:33,080 Speaker 4: ability to respond to things has gotten a lot faster 399 00:23:33,580 --> 00:23:37,810 Speaker 4: as well. It's not one-to-one mapping between finding and resolving. 400 00:23:37,990 --> 00:23:44,850 Speaker 4: Usually it's one-to-many. But using AI, you can very efficiently 401 00:23:45,350 --> 00:23:48,250 Speaker 4: create an architecture where you're able to respond to those 402 00:23:48,290 --> 00:23:50,510 Speaker 4: threats way, way faster. That's our area of focus. 403 00:23:50,670 --> 00:23:53,610 Speaker 3: Can you give me a rough sense of how much 404 00:23:53,650 --> 00:23:56,530 Speaker 3: that gap has closed in recent months? 405 00:23:56,830 --> 00:24:00,639 Speaker 4: It's closing pretty fast. And it's closing pretty fast at 406 00:24:01,080 --> 00:24:03,810 Speaker 4: at most institutions that I talk to. And let me 407 00:24:03,850 --> 00:24:07,109 Speaker 4: give you an example. In terms of scale, you are 408 00:24:07,150 --> 00:24:11,410 Speaker 4: now seeing not a factor of two times or three 409 00:24:11,450 --> 00:24:15,429 Speaker 4: times the number of fixes to critical and high vulnerabilities. 410 00:24:15,470 --> 00:24:22,050 Speaker 4: You're seeing a magnitude of 10x, 20x within the same 411 00:24:22,630 --> 00:24:27,879 Speaker 4: window of time. So if an organization was mitigating, let's say, 412 00:24:27,880 --> 00:24:31,570 Speaker 4: 100 vulnerabilities, critical or high in a month, Our ability 413 00:24:31,590 --> 00:24:35,190 Speaker 4: to patch that is an order of magnitude faster now 414 00:24:35,890 --> 00:24:37,130 Speaker 4: than it was in the past. 415 00:24:37,390 --> 00:24:39,390 Speaker 3: If you are someone sitting on a mountain of open 416 00:24:39,430 --> 00:24:45,790 Speaker 3: source code, of uncertain integrity, all is not lost. The 417 00:24:45,830 --> 00:24:49,429 Speaker 3: same technology that threatens you can also help save you. 418 00:24:50,090 --> 00:24:52,690 Speaker 3: But you have to be organized. You need a strategy. 419 00:24:53,570 --> 00:24:58,369 Speaker 3: And you need a partner. The AI company Anthropic released 420 00:24:58,390 --> 00:25:01,510 Speaker 3: a preview of Mytho's On April 7th of this year, 421 00:25:02,070 --> 00:25:05,180 Speaker 3: the model was so good at finding vulnerabilities in software, 422 00:25:05,440 --> 00:25:08,600 Speaker 3: Anthropic said, that it would give a select group of partners, 423 00:25:09,000 --> 00:25:14,720 Speaker 3: mostly tech, cybersecurity, and critical infrastructure organizations, two months of 424 00:25:14,780 --> 00:25:19,980 Speaker 3: early access, so they could prepare themselves for Mythos's extraordinary abilities. 425 00:25:21,010 --> 00:25:24,530 Speaker 3: The same day, Treasury Secretary Scott Besant and the chair 426 00:25:24,609 --> 00:25:28,169 Speaker 3: of the Federal Reserve, Jerome Powell, summoned the CEOs of 427 00:25:28,210 --> 00:25:31,600 Speaker 3: the country's top banks to a closed-door meeting in Washington 428 00:25:32,300 --> 00:25:36,100 Speaker 3: to warn them that AI was posing an unprecedented threat 429 00:25:36,380 --> 00:25:40,520 Speaker 3: to the banking community. Financial firms have always been high 430 00:25:40,560 --> 00:25:43,740 Speaker 3: on the hackers' list of preferred targets. As the notorious 431 00:25:43,800 --> 00:25:47,080 Speaker 3: bank robber Willie Sutton famously said in response to a 432 00:25:47,100 --> 00:25:50,119 Speaker 3: question about why he robbed banks, that's where the money is. 433 00:25:50,980 --> 00:25:55,729 Speaker 3: The digital world isn't any different. Lightwell was the logical 434 00:25:55,790 --> 00:25:58,970 Speaker 3: next step. IBM's Red Hat was already in this game, 435 00:25:59,480 --> 00:26:02,369 Speaker 3: Their flagship business is aimed at bridging the gap between 436 00:26:02,390 --> 00:26:07,510 Speaker 3: the open-source software systems and corporate users. Gunnar Hellickson said 437 00:26:07,790 --> 00:26:10,090 Speaker 3: they had talked about doing a wider effort, but had 438 00:26:10,150 --> 00:26:13,889 Speaker 3: always dismissed the idea because it seemed too ambitious, too 439 00:26:13,910 --> 00:26:17,330 Speaker 3: much code to manage, too many people to hire. But, 440 00:26:17,390 --> 00:26:21,540 Speaker 3: he says, once Mythos was announced, we realized the urgency 441 00:26:21,560 --> 00:26:23,840 Speaker 3: of the problem and that we finally had the tools 442 00:26:23,859 --> 00:26:27,120 Speaker 3: we needed to solve it. By the end of May, 443 00:26:27,400 --> 00:26:30,490 Speaker 3: Lightwell was up and running. And one by one, the banks, 444 00:26:30,930 --> 00:26:32,750 Speaker 3: many of whom had been at that April meeting at 445 00:26:32,790 --> 00:26:36,750 Speaker 3: the Treasury Department, signed up. The problem was so large, 446 00:26:36,990 --> 00:26:40,439 Speaker 3: they realized, they couldn't tackle it on their own. This 447 00:26:40,520 --> 00:26:43,359 Speaker 3: is Munish Sharma again, on the scale of the task 448 00:26:43,400 --> 00:26:44,960 Speaker 3: of securing open source code. 449 00:26:46,820 --> 00:26:50,050 Speaker 4: So it is large. It is humongous in terms of 450 00:26:50,950 --> 00:26:56,139 Speaker 4: how integrated it is in the overall software stack. In 451 00:26:56,200 --> 00:26:59,280 Speaker 4: our ability to manage it, that's where the various institutions 452 00:26:59,320 --> 00:27:03,980 Speaker 4: are coming together. And we are taking a systematic stance 453 00:27:04,340 --> 00:27:07,359 Speaker 4: on it instead of trying to focus and starting to 454 00:27:07,400 --> 00:27:10,020 Speaker 4: manage the packages ourselves, which is one way of doing things. 455 00:27:10,550 --> 00:27:13,630 Speaker 4: Another is to partner with the industry and really come 456 00:27:13,650 --> 00:27:15,830 Speaker 4: at it together. So I think there has been a 457 00:27:15,910 --> 00:27:18,869 Speaker 4: lot of focus on this in the past few months 458 00:27:18,930 --> 00:27:23,929 Speaker 4: and through various institutions, including Lightwell, where we are focused 459 00:27:23,990 --> 00:27:29,960 Speaker 4: on making sure that we extensively scan and understand the 460 00:27:30,020 --> 00:27:33,520 Speaker 4: security risks within the open source packages that have been consumed. 461 00:27:33,560 --> 00:27:36,949 Speaker 3: You talked about partnerships. What are you looking for in 462 00:27:36,970 --> 00:27:39,270 Speaker 3: a partner? What is it you need when you look 463 00:27:39,330 --> 00:27:40,609 Speaker 3: outside your own organization? 464 00:27:41,609 --> 00:27:45,929 Speaker 4: So first and foremost, the first thing I'd look at 465 00:27:46,100 --> 00:27:52,340 Speaker 4: is their ability to scale. And followed by... a mindset 466 00:27:52,380 --> 00:27:56,350 Speaker 4: that is security first. This has to be a sustainable, 467 00:27:56,640 --> 00:28:00,909 Speaker 4: at-scale solution. We're not talking dozens of packages. We're not 468 00:28:00,930 --> 00:28:05,570 Speaker 4: talking hundreds of packages. We're talking tens of thousands of packages. 469 00:28:06,270 --> 00:28:13,540 Speaker 3: So, Lightwell. 20,000 people and $ 5 billion. Big because it 470 00:28:13,600 --> 00:28:17,320 Speaker 3: has to be big. It offers a repository or network 471 00:28:17,720 --> 00:28:19,139 Speaker 3: of fixes and components. 472 00:28:20,190 --> 00:28:27,760 Speaker 5: Lightwell is a clearinghouse for open source vulnerabilities. Companies join 473 00:28:27,780 --> 00:28:32,879 Speaker 5: the clearinghouse. They submit their vulnerabilities to Lightwell. Lightwell fixes 474 00:28:32,920 --> 00:28:37,270 Speaker 5: those vulnerabilities and then delivers them back to the customers 475 00:28:37,530 --> 00:28:39,390 Speaker 5: and to the open source communities they came from. 476 00:28:40,770 --> 00:28:43,670 Speaker 3: And you said, do you have 20,000 people or do 477 00:28:43,690 --> 00:28:44,530 Speaker 3: you want to have 20,000 people? 478 00:28:46,610 --> 00:28:50,270 Speaker 5: The aspiration is 20,000 people dedicated to the effort of 479 00:28:50,390 --> 00:28:52,130 Speaker 5: securing open source software. 480 00:28:52,470 --> 00:28:53,380 Speaker 3: It's an astonishing number. 481 00:28:53,390 --> 00:28:54,700 Speaker 5: It's an astonishing number. Yeah. 482 00:28:55,740 --> 00:28:57,340 Speaker 3: And are all these people going to be in one 483 00:28:57,400 --> 00:28:58,760 Speaker 3: place or scattered throughout the world? 484 00:28:58,780 --> 00:29:00,180 Speaker 5: No, necessarily they have to be scattered. 485 00:29:00,320 --> 00:29:01,800 Speaker 3: How busy have you been? 486 00:29:02,560 --> 00:29:07,140 Speaker 5: Extraordinarily. I've been at Red Hat for 20 years. And 487 00:29:07,160 --> 00:29:10,440 Speaker 5: I was talking to another old head at Red Hat. 488 00:29:10,800 --> 00:29:13,360 Speaker 5: And he and I had the same impression. It's like, 489 00:29:13,480 --> 00:29:17,730 Speaker 5: this is what Linux felt like. When we first caught 490 00:29:17,750 --> 00:29:22,000 Speaker 5: the wave of Linux adoption 20, 25 years ago, this 491 00:29:22,060 --> 00:29:25,800 Speaker 5: is what it felt like. Everyone understood what needed to happen. 492 00:29:25,860 --> 00:29:29,360 Speaker 5: Nobody really knew how it was supposed to work in 493 00:29:29,400 --> 00:29:32,350 Speaker 5: its entirety. But everyone was kind of rushing in to 494 00:29:32,380 --> 00:29:35,150 Speaker 5: figure it out. And that feels very much the same. 495 00:29:36,130 --> 00:29:38,610 Speaker 3: For Easterly, the moment we're in reminds her of the 496 00:29:38,750 --> 00:29:41,660 Speaker 3: early days of the Cold War. A super weapon arrived, 497 00:29:42,020 --> 00:29:46,660 Speaker 3: posing an existential threat. But what happened? The world responded, 498 00:29:47,180 --> 00:29:51,620 Speaker 3: built institutions, learned how to protect itself. She's an optimist 499 00:29:51,680 --> 00:29:52,120 Speaker 3: by nature. 500 00:29:52,700 --> 00:29:57,510 Speaker 6: And so we've actually created an environment where defenders are 501 00:29:58,080 --> 00:30:02,120 Speaker 6: are at a massive disadvantage because of the way that 502 00:30:02,180 --> 00:30:06,880 Speaker 6: technology was created with these flaws and defects. Now, the 503 00:30:06,960 --> 00:30:10,540 Speaker 6: great news is what we can see with these AI 504 00:30:10,580 --> 00:30:14,900 Speaker 6: tools as they become increasingly powerful, they can actually shift 505 00:30:15,080 --> 00:30:19,620 Speaker 6: the advantage to defenders by creating much more secure and 506 00:30:19,720 --> 00:30:24,610 Speaker 6: much more resilient code than we've ever had before. And importantly, 507 00:30:24,770 --> 00:30:28,870 Speaker 6: helping us to transform and refactor a lot of the 508 00:30:28,990 --> 00:30:33,130 Speaker 6: insecure legacy code that we've been dealing with for decades 509 00:30:33,210 --> 00:30:35,810 Speaker 6: and decades. And so I wrote a piece last year 510 00:30:36,430 --> 00:30:39,530 Speaker 6: that was called The End of Cybersecurity, an optimist's guide 511 00:30:39,610 --> 00:30:43,640 Speaker 6: to improving software quality. And it was all about how 512 00:30:43,700 --> 00:30:47,000 Speaker 6: we can look at AI as a cure for insecure code. 513 00:30:47,440 --> 00:30:50,460 Speaker 6: So I do believe in the next couple years, we 514 00:30:50,480 --> 00:30:53,800 Speaker 6: can actually see a significant reduction in cyber risk, a 515 00:30:53,860 --> 00:30:58,700 Speaker 6: significant improvement in software quality. But the path to get 516 00:30:58,780 --> 00:31:00,900 Speaker 6: from here to there, I think is going to be 517 00:31:00,980 --> 00:31:05,060 Speaker 6: pretty rocky. Because in the short term, attackers will have 518 00:31:05,100 --> 00:31:09,160 Speaker 6: an advantage by using these AI tools to more rapidly 519 00:31:09,640 --> 00:31:14,550 Speaker 6: find those flaws, those defects, those vulnerabilities, and potentially weaponize them. 520 00:31:15,170 --> 00:31:18,030 Speaker 6: So in the short term, the advantage goes to attackers. 521 00:31:18,290 --> 00:31:20,350 Speaker 6: In the long term, it goes to the defenders. 522 00:31:21,250 --> 00:31:23,850 Speaker 3: And in the end, maybe that's why this press release 523 00:31:23,890 --> 00:31:27,410 Speaker 3: felt so different. It wasn't a company attack. announcing a 524 00:31:27,430 --> 00:31:30,810 Speaker 3: new product. It signaled the arrival of a new era. 525 00:31:31,390 --> 00:31:34,530 Speaker 3: The recognition that some of the most important infrastructure in 526 00:31:34,550 --> 00:31:40,510 Speaker 3: the modern world is shared infrastructure. And shared infrastructure requires 527 00:31:41,030 --> 00:31:46,630 Speaker 3: shared defense. Before you go, we're trying something new. If 528 00:31:46,650 --> 00:31:48,610 Speaker 3: you have a question you'd like to ask an IBM 529 00:31:48,710 --> 00:31:54,090 Speaker 3: technical expert, submit it at ibm.com slash smart talks. We're 530 00:31:54,110 --> 00:31:57,320 Speaker 3: exploring ways to bring your questions online directly to the experts, 531 00:31:57,660 --> 00:32:02,020 Speaker 3: and we'd love to hear what's on your mind. Smart 532 00:32:02,060 --> 00:32:05,340 Speaker 3: Talks with IBM is produced by Matt Romano, Amy Gaines-McQuaid, 533 00:32:06,040 --> 00:32:10,120 Speaker 3: Trina Menino, and Jake Harper. Engineering by Nina Bird Lawrence. 534 00:32:10,590 --> 00:32:15,250 Speaker 3: Mastering by Sarah Bruguere. Music by Gramascope. Strategy by Cassidy 535 00:32:15,290 --> 00:32:19,610 Speaker 3: Meyer and Alina Choi. Smart Talks with IBM is a 536 00:32:19,630 --> 00:32:24,010 Speaker 3: production of Pushkin Industries and Ruby Studio at iHeartMedia. To 537 00:32:24,050 --> 00:32:28,330 Speaker 3: find more Pushkin podcasts, Listen on the iHeartRadio app, Apple Podcasts, 538 00:32:28,750 --> 00:32:33,170 Speaker 3: or wherever you listen to podcasts. I'm Malcolm Gladwell. This 539 00:32:33,210 --> 00:32:36,620 Speaker 3: is a paid advertisement from IBM. The conversations on this 540 00:32:36,680 --> 00:32:42,500 Speaker 3: podcast don't necessarily represent IBM's positions, strategies, or opinions.