Speaker 1: All right, folks, we want to get to some news today.
Speaker 1: DP World. It's one of the world's largest port operators,
Speaker 1: struggling to work through a backlog of thirty thousand shipping
Speaker 1: containers piled up at ports across Australia as the company
Speaker 1: resumes operations after a cyber attack. This is definitely our world.
Speaker 1: And on top of that, something like AI, artificial intelligence,
Speaker 1: which by twenty twenty five, according to some research, lack
Speaker 1: of talent or human failure, will be responsible for over
Speaker 1: half of significant cyber incidents that will be AI.
Speaker 2: Well, we are living in difficult times. We've got a
Speaker 2: perfect voice on all of this. Our next guest participated
Speaker 2: with you, Carol in the recent nine to eleven Memorial
Speaker 2: and Museum Summit on Security. A conversation with you on
Speaker 2: cyber threats and understanding the impact that they can have
Speaker 2: on organizations.
Speaker 1: And we do want to point out the museum supported
Speaker 1: by Michael our Bloomberg of course, founder of Bloomberg LP
Speaker 1: and Bloomberg Philanthropies. Great to be talking once again with
Speaker 1: Wendy Thomas. She's CEO at Secure Work. She's on Zoom
Speaker 1: from Atlanta, Georgia. Wendy, it is good to have you
Speaker 1: back with us. It does feel like, you know, we
Speaker 1: were prepping this morning and talking about you coming on,
Speaker 1: and it's like every day there's something in terms of
Speaker 1: cyber attacks set the landscape. It's become kind of part
Speaker 1: of the norm of our world. But talk to us
Speaker 1: about cyber threats, the kind of trends we are seeing,
Speaker 1: where they're coming from, the typical kinds of incidents, if
Speaker 1: you will, And welcome back, by.
Speaker 3: The way, thank you, glad to be here. Look, I mean,
Speaker 3: the average cost of a breach for a business in
Speaker 3: the US here to date this year is nearly ten
Speaker 3: million dollars apiece, and the global cost of cybercrime it's
Speaker 3: expected to be three x what it was just a
Speaker 3: decade ago. We're talking about a transfer of wealth in
Speaker 3: the wrong direction that's probably the greatest in our history.
Speaker 3: So when we look across the landscape, to your point,
Speaker 3: it is happening every single day. We're tracking about one
Speaker 3: hundred and thirty five active threat groups and their activities
Speaker 3: are bucketed primarily into traditional cybercrime right just looking to
Speaker 3: extract profits. Nation state activity, which is clearly up in
Speaker 3: the wake of geopolitical events, and then activists who are
Speaker 3: concerned about those events and making their voice heard through
Speaker 3: a variety of cyber attacks. So we see those activities continuing,
Speaker 3: and as those three sets of actors continue to leverage
Speaker 3: tried and true techniques scanning for software vulnerabilities and exploiting those,
Speaker 3: stealing credentials to log in and parade as someone else,
Speaker 3: and then sending those fishing emails which we've all received
Speaker 3: around certain topics. You click on those and then you've
Speaker 3: given them access to the castle. So we just see
Speaker 3: the same actors using the same attack vectors and continuing
Speaker 3: to be successful.
Speaker 2: Wendy, is there some sort of geographical profile of these
Speaker 2: different state and non state actors, I mean, is there
Speaker 2: a part of the world that they tend to come
Speaker 2: from or is it truly global?
Speaker 3: Well, we certainly see them sourcing talent around the globe,
Speaker 3: but in terms of state actors and cybercrime groups, we
Speaker 3: see those coming out of China and Russia primarily respectively,
Speaker 3: but certainly Aroan, North Korea and others are active on
Speaker 3: the cyber stage. But cyber criminal groups, which are purely
Speaker 3: profit motivated, they do source talent, and unfortunately they use
Speaker 3: some of the same business models that our businesses do
Speaker 3: ransomware as a service, where different groups specialize in either
Speaker 3: stealing those credentials, writing the malware, or other pieces of
Speaker 3: the supplied attack chain. They are able to specialize and
Speaker 3: then create business models for easy access for less sophisticated
Speaker 3: criminals to smash and grab and extract those rents.
Speaker 1: And they're moving more quickly right the time that they
Speaker 1: breach into your network and then the time they do
Speaker 1: some kind of attack. I remember a statistic when we talked.
Speaker 1: It's now I think something like less than a day,
Speaker 1: less than twenty four hours.
Speaker 3: It is on average this past year. It's from the
Speaker 3: time of intrusion to the time of breach, it's less
Speaker 3: than twenty four hours. It was about five days a
Speaker 3: year ago. And what we see, unfortunately, is that in
Speaker 3: about ten percent of those cases it's less than five hours.
Speaker 3: And so when we talk to CEOs and CIOs about
Speaker 3: protecting their organization, it really is all about time, time
Speaker 3: to detect, time to respond, and that's where the power
Speaker 3: of artificial intelligence really comes into play to turn that
Speaker 3: back against the adversary.
Speaker 2: How does the AI? How does that work? When it
Speaker 2: comes to AI? I mean, take us through the process here.
Speaker 3: Sure. So when you think about a technology like secure
Speaker 3: works has where we're using artificial intelligence to really model
Speaker 3: and amplify what we see in terms of adversary behavior
Speaker 3: inside of a network. So it's one thing to use
Speaker 3: ware to detect when they're deploying malware in an organization,
Speaker 3: but it's another thing to know that the CEO's behavior
Speaker 3: online or accessing certain information is unusual or anomalists. AI
Speaker 3: can help you not only understand what's anomalists, but put
Speaker 3: together much more data more quickly to say that it
Speaker 3: is both anomalists and malicious. And the ability to detect
Speaker 3: that quickly, to prioritize that, to raise it up to attention,
Speaker 3: and then for the system to orchestrate the response to
Speaker 3: protect the network is incredibly important. Speed security has to
Speaker 3: move the speed of business, Wendy.
Speaker 1: When you guys have either a new client or existing client,
Speaker 1: I mean tell us are most are a lot of organizations.
Speaker 1: It could be nonprofits as well as publicly held companies
Speaker 1: or small companies, midsized companies. Are they? I guess I'm
Speaker 1: asking are most institutions unprepared under prepared?
Speaker 3: Unfortunately, most organizations are more vulnerable than they and it
Speaker 3: may be that they've done a great job of protecting
Speaker 3: their own assets, but they are inextricably linked with other vendors,
Speaker 3: other suppliers, and thinking about your security as having to
Speaker 3: secure those who are interoperating with your organization and your
Speaker 3: systems as much as you secure your own castle is
Speaker 3: probably the most important. But the good news is that
Speaker 3: most cyber attacks, especially from cyber criminals, are absolutely opportunistic
Speaker 3: and so just creating some degree of friction that makes
Speaker 3: it more difficult for them to find that on locked
Speaker 3: back door goes a long way in terms of, if
Speaker 3: not preventing breaches, absolutely mitigating the impact to the business. No.
Speaker 1: I remember when we talked and I came in kind
Speaker 1: of hot and heavy into our studio on the Monday,
Speaker 1: was after sixty Minutes had aired a report. It was
Speaker 1: about the Five Eyes and this was the five security
Speaker 1: service heads or spy chiefs the US, UK, Canada, Australia,
Speaker 1: New Zealand, New Zealand and they had taken a trip
Speaker 1: to Silicon Valley and they were talking about the greatest
Speaker 1: threat to innovation in the countries of the Five Eyes,
Speaker 1: and that was the threat and specifically Chinese industrial espionage,
Speaker 1: which I think is kind of timely considering this week
Speaker 1: we've got the meeting of President g and President President Biden. Frontemies.
Speaker 1: If you will need each other but also are very
Speaker 1: wary of each other, I think is a safe way
Speaker 1: of saying. But this idea of digital attacks, cyber attacks
Speaker 1: about getting into an organization industrial espionage, whether it's IP,
Speaker 1: you know, strategy at a company. I mean, is this
Speaker 1: happening more and more.
Speaker 3: So? China is absolutely the most active nation state that
Speaker 3: we see from a cyber perspective, and we watched them
Speaker 3: evolve over time. So in the past, those threat groups
Speaker 3: have had a reputation for sort of smash and grab,
Speaker 3: so steal that intellectual property around something that's important of
Speaker 3: electric battery development or even agricultural innovation and scale, and
Speaker 3: so that emphasis was really about just achieving the objective
Speaker 3: as quickly as possible. But what we've seen more recently
Speaker 3: is that a growing number of Chinese threat groups have
Speaker 3: demonstrated an increasing focus on stealth and operational security and
Speaker 3: their intrusions, and so it is often difficult for organizations
Speaker 3: to know that the Chinese are in fact inside of
Speaker 3: their networks and able to over a sustained period of
Speaker 3: time not only collect information, but determine what information is
Speaker 3: most valuable and important to them, and do so leaving
Speaker 3: a minimal intrusion footprint by leveraging a set of defense
Speaker 3: evasion techniques that we've seen increasingly in place.
Speaker 2: Hey, one thing, Wendy, I always like to ask people
Speaker 2: in your positions are just how you conduct yourself as
Speaker 2: a normal consumer online. You know what is possible, you
Speaker 2: know what to watch out for, of course, but you
Speaker 2: also probably do online banking, and you probably have many,
Speaker 2: many passwords for consumer facing websites. How do you do it?
Speaker 3: I do have a little extra vigilance around my online
Speaker 3: activities and persona as you might imagine. First and foremost,
Speaker 3: I do use separate devices for doing things like online banking.
Speaker 3: One of the most important things you can do is
Speaker 3: absolutely difficult and unique passwords for your online activity. I'm
Speaker 3: sure all of you have received emails where your password
Speaker 3: has been stolen, and therefore if it is able to
Speaker 3: access any other application online that you're using, it's really
Speaker 3: important that you have a diversity of passwords and that
Speaker 3: you have secured the location of those passwords. No putting
Speaker 3: those in your phone notes or that type of thing
Speaker 3: when they're accessible. So for me, it's those things plus
Speaker 3: just vigilance being very thoughtful around the emails that I get.
Speaker 3: I rarely click on links even though they appear to
Speaker 3: be from family members or others. But it's just about
Speaker 3: a heightened awareness and carefulness in terms of your digital.
Speaker 2: Foot two factor authentication always.
Speaker 3: Always, there are very inexpensive ways for you to be
Speaker 3: able to do that that aren't just necessarily your your
Speaker 3: phone versus your iPad, but things like ub keys and
Speaker 3: others are are a great way to just provide that
Speaker 3: extra layer of friction. As I said, lock that back
Speaker 3: door and that cyber criminal will move to a much easier,
Speaker 3: easier target.
Speaker 2: What about like you mentioned, strong and unique passwords, I will,
Speaker 2: I will. I've used for a decade a password manager.
Speaker 2: It is the most painful process. I will tell you
Speaker 2: that do you use a password It's the only way
Speaker 2: to It's the only way to have strong and unique passwords.
Speaker 2: I mean, do you do is that? Do you agree?
Speaker 2: Is that the only way to do it?
Speaker 3: It is a great way is to use a password manager,
Speaker 3: but even those are not full proof. So again, as
Speaker 3: you think about defense and layers of your environment, so
Speaker 3: that physical multi factor authentication in addition to the password managers.
Speaker 3: It's just that diversification of multiple steps in the process,
Speaker 3: which to your point is not very fun, but it
Speaker 3: is a way to prevent your identity or or your
Speaker 3: financial access to be stolen.
Speaker 2: You know how much fun I am, Carol. I once
Speaker 2: got password managers form my parents for Christmas one year.
Speaker 2: That's how much fun I am.
Speaker 3: You are a good son, That's really Oh my god.
Speaker 1: We do a lot of talking about passwords and protecting,
Speaker 1: certainly at home. What are there you know, it's interesting
Speaker 1: a lot of your businesses in the US, but your
Speaker 1: global and I'm just curious. You know, in terms of
Speaker 1: the growth of your company you're publicly held, you know
Speaker 1: where is you know where is the business side growing
Speaker 1: the most for you guys.
Speaker 3: So you're right. So cure Works is about forty percent
Speaker 3: outside of the US, and we definitely see the fastest
Speaker 3: growth outside of the US in terms of security maturity.
Speaker 3: A lot of US organizations, especially financial institutions, were early
Speaker 3: adopters of cybersecurity defenses for both reasons of protecting their
Speaker 3: business as well as for compliance reasons, and we see
Speaker 3: that adoption accelerating pretty rapidly outside of the US, not
Speaker 3: just as new laws are put in place around requiring
Speaker 3: certain cybersecurity elements and data protection elements, but also just
Speaker 3: as those organizations come under attack and realize how important
Speaker 3: it is to make the investment, and that making the
Speaker 3: investment and prevention is much less expensive than a breach.
Speaker 1: And I am curious too. We talked a little bit
Speaker 1: about AI, you know, and I know when we first talked,
Speaker 1: we got into this, you know, and I kicked off
Speaker 1: our conversation about Gartner. And by twenty twenty five, lack
Speaker 1: of talent or human failure will be responsible for over
Speaker 1: half of significant cyber incidents. By twenty twenty five, the
Speaker 1: consumerization of AI enabled fraud will fundamentally change enterprise attack service,
Speaker 1: driving more outsourcing of enterprise trust and focus on security
Speaker 1: education and awareness. So AI, the good, the bad, and ugly,
Speaker 1: Like we all like to talk about, how is AI
Speaker 1: being helpful for you guys as you move forward, how
Speaker 1: is it also the preventing or presenting new challenges in
Speaker 1: terms of digital attack cyber attacks?
Speaker 3: Well, as you and I have discussed, I absolutely view
Speaker 3: AI in the lens of the power and the peril.
Speaker 3: And when I think about the power, it absolutely has
Speaker 3: enabled us to process protections for organizations faster. You can
Speaker 3: collect more data, filter through more quickly, translate chat on
Speaker 3: the dark web more quickly, and understand context around planned attacks.
Speaker 3: All of those things are really powerful to again, as
Speaker 3: I said, to text something quickly and respond in an
Speaker 3: automated way so that that dwell time of twenty four
Speaker 3: hours or five hours it doesn't translate into a breach
Speaker 3: for you. The paral side of that is we certainly
Speaker 3: see the ability for adversaries to leverage AI to attack,
Speaker 3: and whether it's the use of things like deep fakes
Speaker 3: or even just making those phishing emails more believable, more
Speaker 3: visually accurate. The language is exactly the way that your
Speaker 3: institution would speak to you. They might have a little
Speaker 3: bit of personalized information in there. And so when we
Speaker 3: think about the thread actor community sharing learnings around how
Speaker 3: to use AI, answering questions and forums with each other
Speaker 3: about how to best leverage this new technology to attack,
Speaker 3: we absolutely have to as a as a set of individuals, citizens, companies,
Speaker 3: security companies, and as governments think about collaborating together as
Speaker 3: a community to advance both AI and our protections against
Speaker 3: its use against those of us who are trying to
Speaker 3: use it in the right way.
Speaker 2: We're speaking right now with Wendy Thomas. She is the
Speaker 2: CEO at Secure Works, joining us on zoom from Atlanta. Wendy,
Speaker 2: before we let you go, give me an idea of
Speaker 2: the way that budgets have shifted around IT spending or
Speaker 2: security spending such as this just in your time at
Speaker 2: Secure Works, you know in terms of percentages, like when
Speaker 2: the c suite is planning out the next year, next
Speaker 2: five years, how much of that funding now, how much
Speaker 2: of their spend is going to keeping their own systems safe.
Speaker 3: So we think about it in terms of IT spend
Speaker 3: as a percent of revenue, and then security spend as
Speaker 3: a relative percentage of that it spend. And in the
Speaker 3: times of everyone digitizing their business, and particularly when we
Speaker 3: went through remote work during COVID, that digitization spend accelerated.
Speaker 3: But what we've seen particularly is that the security portion
Speaker 3: of that it spend, it can now be as much
Speaker 3: as forty or fifty percent of that which is just
Speaker 3: a function right now of where the investment needs to
Speaker 3: go relative to the threat in the landscape. That will
Speaker 3: normalize over time, but it is definitely growing as a
Speaker 3: as a percent of revenue. Just given the environment in
Speaker 3: which all these organizations are operating.
Speaker 2: It's interesting to see the way that it's shifted.
Speaker 1: Yeah.
Speaker 2: Absolutely, I mean anecdotally, Carol. I mean, I don't know
Speaker 2: what it's it's gone from like front and center in
Speaker 2: terms of the way that we're trained to think about
Speaker 2: incoming emails, the way we're training to stay safe online.
Speaker 2: I mean, it's such a big part of what companies
Speaker 2: do these days, because, as you mentioned, the risks are
Speaker 2: so huge.
Speaker 1: Yeah, I think about it. You know, it's just everything
Speaker 1: is digital, everything is you know, it's so easy. There's
Speaker 1: probably so many entry points. And you're right, Danma mean,
Speaker 1: our security is pretty extreme, but you understand why, hey,
Speaker 1: in terms of the nitty gritty of your business. And
Speaker 1: you and I talked about this before, but since we've
Speaker 1: got you back again, we're in this. It was a
Speaker 1: funny market day, it was kind of quiet. We're waiting
Speaker 1: for a lot of things. When you look at the
Speaker 1: outlook six to twelve months, how does the economy feel
Speaker 1: for you guys? And you obviously have a lot of
Speaker 1: clients that play into so many different sectors of the economy.
Speaker 1: So how does it look or what are you hearing
Speaker 1: from them?
Speaker 3: We have seen pretty similar behavior, i'd say, throughout this year,
Speaker 3: so nothing has changed in recent weeks per se. But
Speaker 3: what we see is a general level of optimistic caution.
Speaker 3: So it's not that businesses are not investing. They absolutely are,
Speaker 3: whether it's in security or digital transformation or other expansions
Speaker 3: of their business, but they are just doing so with
Speaker 3: a level of scrutiny around that spend to ensure that
Speaker 3: one they have the right partner and they do a
Speaker 3: lot of that through referenceable other customers. Two that they
Speaker 3: can measure the return on that investment, and three they
Speaker 3: have flexibility over time for that investment to remain valuable
Speaker 3: to their business as it can evolve with their changes
Speaker 3: and strategy and approach.
Speaker 1: All right, well, good stuff is always. Thank you so much.
Speaker 1: I'm so glad we were able to check in with
Speaker 1: you again and really appreciate all the time. Wendy be well.
Speaker 1: Wendy Thomas. She's the CEO of Secure Works, joining us
Speaker 1: on Zoom from Atlanta, Georgia,