Speaker 1: Hey everyone, it's Robert and Joe here. Today we've got
Speaker 1: something a little different to share with you. It's a
Speaker 1: new season of the Smart Talks with IBM podcast series.
Speaker 2: This season, on smart Talks, Malcolm Gladwell and team are
Speaker 2: diving into the transformative world of artificial intelligence with a
Speaker 2: fresh perspective on the concept of open What does open
Speaker 2: really mean in the context of AI. It can mean
Speaker 2: open source code or open data, but it also encompasses
Speaker 2: fostering an ecosystem of ideas, ensuring diverse perspectives are heard,
Speaker 2: and enabling new levels of transparency.
Speaker 1: Join hosts from your favorite pushkin podcasts as they explore
Speaker 1: how openness in AI is reshaping industries, driving innovation, and
Speaker 1: redefining what's possible. You'll hear from industry experts and leaders
Speaker 1: about the implication and possibilities of open AI, and of course,
Speaker 1: Malcolm Gladwell will be there to guide you through the
Speaker 1: season with his unique insights.
Speaker 2: Look out for new episodes of Smart Talks every other
Speaker 2: week on the iHeartRadio app, Apple Podcasts, or wherever you
Speaker 2: get your podcast and learn more at IBM dot com
Speaker 2: slash smart Talks.
Speaker 3: Hello, Hello, Welcome to smart Talks with IBM, a podcast
Speaker 3: from Pushkin Industries, iHeartRadio and IBM. I'm Malcolm Glappwell. This season,
Speaker 3: we're diving back into the world of artificial intelligence, but
Speaker 3: with a focus on the powerful concept of open its possibilities, implications,
Speaker 3: and misconceptions. We'll look at openness from a variety of
Speaker 3: angles and explore how the concept is already reshaping industries,
Speaker 3: ways of doing business and our very notion of what's possible.
Speaker 3: On today's episode, I'm joined by Jason Kelly, the global
Speaker 3: Managing Partner for IBM Strategic Partners and Ecosystems, and by
Speaker 3: Christy Fredericks, the Senior Vice President and Chief Partnership Officer
Speaker 3: at Palo Alto Networks. We discussed how their partnership in
Speaker 3: the cybersecurity space helps strengthen enterprises by focusing on seamless
Speaker 3: cybersecurity solutions tailored to meet the evolving threat landscape. By
Speaker 3: leveraging AI and automation, this collaboration aims to modernize security programs,
Speaker 3: improve response times, and produce risks. Jason and Christie both
Speaker 3: bring a tremendous amount of experience and expertise to the subject.
Speaker 3: I think you're really going to enjoy this one. Jason Christy,
Speaker 3: Welcome to Smart Talks with IBM. Thank you for joining me.
Speaker 4: Thank you, it's great to be here.
Speaker 3: We are here to discuss cybersecurity and the partnership between
Speaker 3: IBM and Polo Alter Networks. But before we get there,
Speaker 3: I wanted you guys to tell me a little bit
Speaker 3: about yourself. Jason's start with you. I see on your
Speaker 3: resume west Point, which makes we think there's some interesting
Speaker 3: things going on there. How did you get to west Point?
Speaker 4: West Point? West Point was the decision. First, it was
Speaker 4: it was affordable back in the day. But I had
Speaker 4: a sense of service. My father was a World War
Speaker 4: Two vet, so I grew up on the weekends watching
Speaker 4: World War two video. You know he's army as well. Yeah,
Speaker 4: and so I thought, oh, that'd be exciting, and I
Speaker 4: thought I do some type of service. Went there and
Speaker 4: now I have the biggest family, extended family I could
Speaker 4: ever have. So it was very exciting. Played football lucked out,
Speaker 4: meaning I wasn't recruited. I walked on and that kept
Speaker 4: me there because it gave me something and out left
Speaker 4: with all the other pressures that a defensive back I was.
Speaker 4: I was great at knocking the ball down, not the
Speaker 4: best at catching it.
Speaker 3: Yeah, and then you were a ranger.
Speaker 4: I was. I was privileged to be a US Army
Speaker 4: airborne ranger station, but did most of my time in
Speaker 4: northern Italy. Were part of the It's eighty second.
Speaker 3: Air barnship post.
Speaker 4: Oh yeah, that's what people say, seriously, like, you know,
Speaker 4: you were you were nor You're drinking wine and having
Speaker 4: bred you know. But it was a part of a
Speaker 4: NATO force there at the time. Yeah, so exciting.
Speaker 3: How did you get from there to IBM?
Speaker 4: A long path. As I came out of the military,
Speaker 4: I started manufacturing retail housing and did a quick stint,
Speaker 4: took a leave of absence from industry, and did a
Speaker 4: stint of yet again public service in the state of
Speaker 4: Tennessee with economic development, and got a whiff of how
Speaker 4: fun it could be to do things around data and media.
Speaker 4: Started a small media firm what we would now call
Speaker 4: a digital firm, sold it and said I wanted to
Speaker 4: go do it again somewhere, but I wanted to go
Speaker 4: to a big company. And the family at IBM brought
Speaker 4: me in and yet to let me go.
Speaker 3: That was how many years ago?
Speaker 4: Two decades?
Speaker 3: Oh wow?
Speaker 4: Yeah, so, I know I look amazingly young on but yes,
Speaker 4: IBM was my fifth career and and and I've enjoyed
Speaker 4: a since. And that's what I what I do. They
Speaker 4: build teams, grow new parts of the company and get
Speaker 4: to work with some of the most brilliant people on
Speaker 4: the face of the planet, as well as partners like
Speaker 4: like Christy that just keep it exciting.
Speaker 3: Christy, you're I was delighted to learn that you are Canadian.
Speaker 3: Yes here, Yeah, but you so you were a consultant
Speaker 3: for a long time at Bane.
Speaker 5: Yes. Yeah. I joined Bain Consulting intending to spend a
Speaker 5: couple of years there learn the ropes and then go
Speaker 5: get my first real job. But the value personally to
Speaker 5: my growth and development, and then that we were able
Speaker 5: to bring our clients. I ended up there for sixteen years,
Speaker 5: and then post Bain went on to another my first
Speaker 5: product company, a new relic, and then it's come full
Speaker 5: circle at Polluta Networks. But at Bain it was all
Speaker 5: about bringing expertise across different industries to help our clients
Speaker 5: improve whatever they needed to improve and bringing that expertise
Speaker 5: to bear. And then you have the product lens and
Speaker 5: you think Okay, we're going to build the absolute best
Speaker 5: product to help our customers do what they need to
Speaker 5: get done. And then I joined pal Alto about six
Speaker 5: seven months ago in a partnerships role and I'm delighted
Speaker 5: to be able to work with amazing consulting companies like
Speaker 5: IBM where we bring both to bear.
Speaker 3: How long have IBM and Polo Alto Network's been partners?
Speaker 4: So we've been We've been working together for quite quite
Speaker 4: a long time. But we made it official, meaning we
Speaker 4: got married as strategic partners last year.
Speaker 3: Oh I see. So what is it that each of
Speaker 3: you bring to the table? What's each side special?
Speaker 4: So it's great that you asked that because about a
Speaker 4: decade ago, are now CEO Arvin Christ says, you know,
Speaker 4: it wouldn't be great if we just had this one
Speaker 4: focus with this what does IBM do? And you have
Speaker 4: this whole list, and he says, let's make it simple.
Speaker 4: We are a multi cloud, hybrid cloud AI company. And
Speaker 4: so when you say that, it sounds very simple, but
Speaker 4: then people, what the hell is that? What your hybrid cloud? Well,
Speaker 4: both of those two things have a lot of data involved,
Speaker 4: and a lot of those mean that that data is
Speaker 4: going to sit in multiple places and distributed environments. Well,
Speaker 4: if you're able to tie those things together with multiple partners,
Speaker 4: you also have to make sure that it's secure because
Speaker 4: in the direction that we're going, where data is now
Speaker 4: being consumed in many different places and it is the
Speaker 4: fuel behind AI as we know, then you say, ah, well,
Speaker 4: who does that well and who does it in a
Speaker 4: way that's getting rid of seams, the seams that could
Speaker 4: be across multiple products, multiple product SATs even And that's
Speaker 4: where Powell comes in.
Speaker 5: I think the conventional wisdom and cybersecurity was always you
Speaker 5: need all the new tools, right, you need it every threat.
Speaker 5: It's like, whack them all. Every threat that pops up,
Speaker 5: you get the tool that's purpose built for that specific thing. Well,
Speaker 5: fast forward to the RSA conference this year. There were
Speaker 5: four thousand vendors on the floor. You look at an
Speaker 5: average company, there's hundreds of cybersecurity tools. It introduces a
Speaker 5: level of complexity that is really hard to manage you
Speaker 5: as a user, query and application, right, that query can
Speaker 5: go through a bunch of different pings from one cloud
Speaker 5: to the next, It goes into and out of assaas application,
Speaker 5: it maybe running along a network. You may be accessing
Speaker 5: it from your phone, which is an unmanaged device. It's
Speaker 5: got to go in and out. And if you say, okay,
Speaker 5: I've got to secure that phone, I've got to secure
Speaker 5: the network. I've got it, then all of a sudden,
Speaker 5: you've got sort of firewalls, software and hardwelfowles popping up everywhere.
Speaker 5: You've got cloud security, and it's you've probably heard of
Speaker 5: this concept of zero trust, which is every time you
Speaker 5: have to check and say are you allowed in here?
Speaker 5: Are you allowed in here? The number of places that
Speaker 5: can fall down it just becomes overwhelming. So you end
Speaker 5: up with either alerts firing every two seconds that you
Speaker 5: have to then go investigate in most of which are
Speaker 5: false positives or you miss something right. And so that
Speaker 5: was the conventionalism was we've got to buy all these tools,
Speaker 5: and now you've got overwhelmed CIOs and CSOs with hundreds
Speaker 5: of tools, and Palo Alto strategy has been, look, we're
Speaker 5: going to create a platform where everything can be stitched together,
Speaker 5: everything can speak the same language, and we can sort
Speaker 5: of manage throughout the architecture and watch this call as
Speaker 5: as it's passing through all these different checkpoints, and we
Speaker 5: can do it in a way that you still have
Speaker 5: the confidence that it's best to breed right, so you're
Speaker 5: not making any trade offs. But it's not so simple
Speaker 5: just to get from the spaghetti to the seamless architecture.
Speaker 5: You need, oftentimes to re engineer your business processes. You
Speaker 5: have to re architect your digital environment. And so that's
Speaker 5: where we partner with a company like IBM to bring
Speaker 5: that expertise and say we're going to help you not
Speaker 5: just deploy the best cybersecurity architecture, but really get your
Speaker 5: environment ready to have this ar as.
Speaker 4: Well as all of those players that cross that spaghetti.
Speaker 4: Because when you start thinking about all the other partners
Speaker 4: that you work with, if you're you think of an
Speaker 4: industry perspective, you're gonna have an e ERP. It could
Speaker 4: be an Oracle, it could be an SAP. You're not
Speaker 4: going to have one cloud, as I mentioned, it's gonna
Speaker 4: be possibly multiple clouds. You'll have some aws maybe Microsoft
Speaker 4: Azure and then even even some Google in there, and
Speaker 4: then your own that you've built in your private over there, uh,
Speaker 4: some an IBM cloud. You'll have those multiple clouds, and
Speaker 4: then you also will have you know, fit for purpose Oh, well,
Speaker 4: I need a I need a salesforce in there for
Speaker 4: my customer focusing. I need I'm doing some graphics, so
Speaker 4: I have Adobe. So I just as I can name
Speaker 4: name name, all of those then have to be re engineered. Seriously.
Speaker 4: I mean, come on, Malcolm, You're gonna sit there. You
Speaker 4: think how long that would take. So if you haven't
Speaker 4: done that before, you're gonna have to go to each
Speaker 4: one of those individually, or you can work with a
Speaker 4: company that can tie those things together, because we are
Speaker 4: also strategic partners with them. So that's where you start
Speaker 4: to say, Okay, I see how this comes together. You
Speaker 4: have to make sure that your ecosystem is going to
Speaker 4: be stronger than your competitor's ecosystem, and you have to
Speaker 4: be secure in what you're doing because as you add
Speaker 4: more players or products, you create seams, and you want
Speaker 4: to make sure there's fewer seams and that there's zero
Speaker 4: trust across that capability you're building. And that's why the
Speaker 4: compliment between the two companies.
Speaker 3: Well, take a step back from a moment before we
Speaker 3: sort of launch, once get into the specifics of what
Speaker 3: you guys are doing. I'm curious at this moment in
Speaker 3: twenty twenty four. How nervous should we be about cybersecurity?
Speaker 3: So compared it to five years ago or ten years ago,
Speaker 3: are we are you less nervous than you were five
Speaker 3: years ago or more nervous or all of changes going
Speaker 3: on right now increasing vulnerability or decreasing it?
Speaker 4: I would say Christie, also, I think we share the
Speaker 4: point of view is that it's not necessarily being more nervous.
Speaker 4: I think you should be more prepared because the amounts
Speaker 4: of threat is increasing based on our dependence upon data.
Speaker 4: And that's that's where I think the attention should be placed.
Speaker 4: Is that more and more, especially with the importance of AI,
Speaker 4: that you say, okay, then what's under all that? And
Speaker 4: it's the data? As I said, So knowing that you
Speaker 4: should be more concerned.
Speaker 3: Does the advent of AI and its rapid evolution help
Speaker 3: defense more or offense more?
Speaker 5: I think it's I think it's like any mega trend
Speaker 5: that we've witnessed both. Right, So you think about AI,
Speaker 5: it's it's ninety nine percent great, right in terms of
Speaker 5: what it's going to unlock for productivity, for humanity, But
Speaker 5: it also makes it a whole lot easier to build
Speaker 5: ransomware it's a whole lot easier to test different ways
Speaker 5: into a system, right. But I think that's true if
Speaker 5: you think about like the rise of the Internet, right,
Speaker 5: all of a sudden, everyone was putting their data online
Speaker 5: and you had to think of new ways to stay
Speaker 5: ahead and keep that secure. And I don't think AI
Speaker 5: is any different. You've got companies like Palta, partnerships like
Speaker 5: Powell and IBM that are constantly scanning the landscape for
Speaker 5: not only the current threats, but what's next, what's coming
Speaker 5: around the corner, what's after AI? And so I think
Speaker 5: taking it seriously and being prepared is probably the right
Speaker 5: way of looking at it as opposed to because if
Speaker 5: you think about it too hard, you'll just want to
Speaker 5: crawl into a corner and stuff everything under the mattress.
Speaker 3: I am the CEO of a regional hospital chain, big
Speaker 3: distribute healthcare system, so a ton of data. The consequences
Speaker 3: of being hacked and help for ransom.
Speaker 2: Are life and death.
Speaker 3: Life and death, right, little when you come So you
Speaker 3: come down, you sit down with me, and you chat
Speaker 3: with me, walk me through the kinds of things you
Speaker 3: would tell me about what I need to get safer.
Speaker 3: For example, let's start with one. Is it likely that
Speaker 3: I'm spending too little or am I spending money in
Speaker 3: the wrong place?
Speaker 5: Great question, It depends how you've broken it out. If
Speaker 5: you are distributing all of your dollars across a whole
Speaker 5: bunch of different tools, it's likely you're just spending the
Speaker 5: wrong money. And in fact, you know, putting it all
Speaker 5: in one place is a way of potentially saving money
Speaker 5: but keeping your security actually higher. And I'd love to
Speaker 5: hear Jason, how you would approach it. How we would
Speaker 5: approach it, of course, is by saying, you know, what,
Speaker 5: what does your environment look like? You know, do you
Speaker 5: have the connected medical devices into your EMR? Are your
Speaker 5: respirators and ventilators all online? Right? And so we would
Speaker 5: talk about, okay, here's how you get coverage, and how
Speaker 5: the coverage of both the firewalls as well as the
Speaker 5: detectors all feed back into your security operations center and
Speaker 5: you can manage it and do your learning with AI
Speaker 5: and keep yourself secure.
Speaker 4: And so yeah, and I would say Christy and I
Speaker 4: would go to the same point because if you get
Speaker 4: under what she was just asking, it is your data
Speaker 4: on prem and when it's on prem how active is
Speaker 4: it across the enterprise? And so that begins the basis
Speaker 4: for the start. And then often you're going to say, well,
Speaker 4: we actually take in data from outside and then we
Speaker 4: also have the circumstances. There's a lot of PII and
Speaker 4: so that personal is the personal information, right, Yeah, And
Speaker 4: so now you're saying, okay, now how are we securing
Speaker 4: that and where are we securing it? And so you
Speaker 4: have to start really thinking about the different areas within
Speaker 4: that hospital chain. Are you sharing that amongst your hospitals?
Speaker 4: And now you start to think of if I'm saying
Speaker 4: no to a lot of that, it's like, well, then
Speaker 4: are you as efficient as you want to be? So
Speaker 4: there is that trade off of you know, am I
Speaker 4: so tightly walled that I'm not productive? And so that's
Speaker 4: where we would start to say what's the outcome that
Speaker 4: you're trying to get to? All Right, maybe you're good,
Speaker 4: Maybe you're you're good with your five locations and you
Speaker 4: don't need to go any further, but maybe you want
Speaker 4: to expand to fifty and by the way, you're going
Speaker 4: to go crossporder, you're going to be in Toronto and
Speaker 4: in New York. Okay, Well, then how do you do that?
Speaker 4: And so I think that it's very easy to start
Speaker 4: jumping into any of the typical situations. But the first
Speaker 4: question that you have to ask you, as the hospital CEOs,
Speaker 4: what's your objective? Are? What are you trying to do?
Speaker 4: Because too often what we see is that there's some bright, new,
Speaker 4: shiny thing that everybody wants to put in play. You know,
Speaker 4: it's a sandwich looking for lunch and you go, but
Speaker 4: what is it that you want to do as this?
Speaker 4: Are you doing research? Are your research hospital? Are you
Speaker 4: more consumer wriented? So those are the questions you start
Speaker 4: to ask because they start to then tell a story
Speaker 4: in line with what Christy questions. And I think that
Speaker 4: that's where the again the compliment is that instead of
Speaker 4: just saying, oh, well, that's thanks for telling me all this, Malcolm,
Speaker 4: here's your ten page strategy. Now go find somebody. We
Speaker 4: have the benefit in IBM, and it's probably why I'm
Speaker 4: still there is you know, we're very unique. We're the
Speaker 4: only company on the planet that has a consulting business
Speaker 4: at scale inside of a technology company, and so we have,
Speaker 4: you know, the left brain, right brain, We're able to
Speaker 4: do that. And then we're able to say, okay, now
Speaker 4: which partners are going to be most valuable for our clients.
Speaker 4: What's going to work for you? Isn't going to work
Speaker 4: for the manufacturer down the road, isn't going to work
Speaker 4: for the consumer or CpG company across the river. Those
Speaker 4: things are very specific. The threats and the scenes that
Speaker 4: I was talking about are very specific. So that's where
Speaker 4: it becomes very value to make sure that I'm not
Speaker 4: just giving you some strategy that's generic.
Speaker 3: But everything. As a healthcare CEO, everything I have done,
Speaker 3: almost everything I've done over the last ten years, has
Speaker 3: it had the effect of increasing my vulnerability. I want
Speaker 3: to digitize data within the hospital used to be on
Speaker 3: pieces of paper. I want doctors to go home and
Speaker 3: to be able to seamlessly hook into stuff at work
Speaker 3: because they got to do all their paperwork. I want
Speaker 3: to make sure the diabetes people are speaking to the
Speaker 3: organ transplant people. And so I'm isn't that everything I
Speaker 3: have done to kind of keep up with the revolution
Speaker 3: in healthcare? Isn't that also making me more and more
Speaker 3: vulnerable to a bad actor.
Speaker 5: It's such a great question because think about the quality
Speaker 5: of healthcare delivery, right, So now doctors aren't filling out forms,
Speaker 5: they're spending time with patients, and so the quality of
Speaker 5: care is improving and the vulnerability is improving, right, And
Speaker 5: so I think that's where having a strong cybersecurity strategy
Speaker 5: actually enables all of that. One of our products is
Speaker 5: our sas product, and we tested it with some business applications,
Speaker 5: and oftentimes the wrap is, oh, security is going to
Speaker 5: slow you down, right, Like you have to add a firewall,
Speaker 5: you have to checkpoints. Our product actually increases the velocity
Speaker 5: of your ability to use that application because of the
Speaker 5: way that it is queried through our system as opposed
Speaker 5: to just through the regular network. So it doesn't slow
Speaker 5: it down and in fact, it makes it run more efficiently.
Speaker 5: That's just one minor example. But back to the healthcare question. I,
Speaker 5: as a patient want my doctors accessing all the technology
Speaker 5: and talking to each other and connecting the dots behind
Speaker 5: the scenes. I also want my data to stay private,
Speaker 5: and so having both a consulting partner who understands how
Speaker 5: to ask questions of the environment and of the applications
Speaker 5: you're using, and who understands the industry inside and out,
Speaker 5: and a technology partner that builds and stays ahead of
Speaker 5: all of the different threats, come together and advise you.
Speaker 5: I think is super important. When you bring in a
Speaker 5: partner like IBM, with a platform like pal Aalta that covers,
Speaker 5: you know, all the different parts of your environment, you're
Speaker 5: able to say, look, where where are the vulnerabilities in
Speaker 5: the system, Where are the different endpoints that we need
Speaker 5: to have covered, and then just make sure you get
Speaker 5: that breadth of coverage, and then you're better able to so, yes,
Speaker 5: you've increased the risk, but then you've mitigated it.
Speaker 3: So to give so before I retire my healthcare analogy,
Speaker 3: because I was thinking about just trying to understand the
Speaker 3: importance of this idea of having a single platform. So
Speaker 3: if this muddle healthcare network is typical, I've acquired a
Speaker 3: whole series of over the last ten years. I bought
Speaker 3: a hospital over here, some I've got some physicians things
Speaker 3: that I snapped up over here. I bought a diagnostics company,
Speaker 3: and so I have all of these legacy systems and
Speaker 3: I had, like you said, maybe I got some stuff
Speaker 3: from the cloud with one company, some stuff with the cloud.
Speaker 3: And what you're saying is the first step is to
Speaker 3: kind of rationalize that put it on a single so
Speaker 3: you understand where your points of weakness are as opposed
Speaker 3: to being blind to your points of weakness.
Speaker 5: There's yes, although anyone who's done any kind of M
Speaker 5: and A knows that that's a long journey, right. So
Speaker 5: I think the first step is just understanding where everything is.
Speaker 5: And then you get on a path and you say,
Speaker 5: where's the biggest risk. Let's let's neutralize or mitigate that
Speaker 5: risk one at a time. The thing about open end secure,
Speaker 5: you know Palo Alto. We keep touting the benefits of
Speaker 5: the platform. Everything on Palo Alto, your risk is going
Speaker 5: to be mitigated and you're going to have the full visibility.
Speaker 5: But you can't get there overnight. And so we've got
Speaker 5: you know, thousands of integrations with other technology companies, including
Speaker 5: our partners, to make sure that we can capture and
Speaker 5: have visibility into those those endpoints in those systems as well.
Speaker 5: And so I think step one is just figure out
Speaker 5: where everything is. Just get the scan, so poltize a
Speaker 5: couple of products where you can kind of deploy and
Speaker 5: get a view of your attack surface. I love the analogy.
Speaker 5: Just like a digital environment is a house, right, and
Speaker 5: so like you have your front door lock, of course,
Speaker 5: because probably they're going to try the front door first.
Speaker 5: But that's not all you're going to do, right, You're
Speaker 5: going to make sure the whole you know, the windows
Speaker 5: are locked and there's an alarm system and all of that.
Speaker 5: And I think that's how you have to think about it,
Speaker 5: is just how do we cover the whole service?
Speaker 3: So everyone laid, people like me have been bombarded over
Speaker 3: it seems like over the last year with one thing
Speaker 3: another about how quickly AI is moving forward and how
Speaker 3: big of a deal it is suddenly is going to
Speaker 3: be in the economy. What is the impact of that
Speaker 3: dramatic change in AI's capabilities on this cybersecurity question? So
Speaker 3: what does it mean if you're defending somebody that you
Speaker 3: now have these sophisticated AI tools you disuppose.
Speaker 4: I think that AI becomes the force multiplier for cyber
Speaker 4: to think about cyber Before it was just locking your doors,
Speaker 4: locking the windows. If you were really good, you had
Speaker 4: an alarm system.
Speaker 5: You know.
Speaker 4: Now with AI, you can say, well, I can predict
Speaker 4: what's going to happen, I can see around the corner.
Speaker 4: I know, I can leave my windows open upstairs and
Speaker 4: it's fine and it's okay.
Speaker 3: I mean because why because the AI is running a
Speaker 3: million simulations it.
Speaker 4: Can and that's exactly it. It becomes the intelligent part of
Speaker 4: that AI. It's not artificial, it's augmented. So you now
Speaker 4: have this new capability to see around corners and so
Speaker 4: you're able to do the jobs of yesterday more effectively.
Speaker 4: And the queries that you were doing and that's all
Speaker 4: you're really doing, now you're doing them, you know, faster,
Speaker 4: you're able to access even more data and you're able
Speaker 4: to then make it more secure. So that's why AI
Speaker 4: becomes a force multiplier.
Speaker 3: Yeah, and just talk about the faster part. What does
Speaker 3: faster mean in practical terms? If you're trying to defend
Speaker 3: an enterprise against a cyber attack, what does speed matter
Speaker 3: in that environment?
Speaker 4: You're always trying to find a place through I go
Speaker 4: back to you. We brought up the army. You always
Speaker 4: how do you break the line? How do you find
Speaker 4: a penetration point? And when you think about you know,
Speaker 4: pin testing, penetration testing, where are those? So if you're
Speaker 4: able to do that faster than the bad guys, and
Speaker 4: not only faster, but you're picking more probable points. This
Speaker 4: is back to the intelligence. I could waste time doing
Speaker 4: penetration testing someplace where. That's why I mentioned leave. If
Speaker 4: they can't get in the second story windows, why are
Speaker 4: you spending time trying it? So that becomes more effective.
Speaker 4: So that's when I think of speed. That's what I
Speaker 4: think of because with not just speed, I think it's
Speaker 4: also what's effective.
Speaker 5: Just to put a fine point on it. So I
Speaker 5: found a way in. Okay, Now what I don't know
Speaker 5: where the jewelry is, so I have to look around
Speaker 5: and see if there's any hidden gems and try to
Speaker 5: find my way. That used to take a week, two
Speaker 5: weeks or seven or fourteen days. Now it's hours, right,
Speaker 5: So they're in and they can actually explatrate data within
Speaker 5: less than a day. The metric we use in the
Speaker 5: security operation center is meantime to detect, so to see
Speaker 5: anyone's there, meantime to respond and remediate to get them
Speaker 5: out right. That used to be also you know, seven eight, nine,
Speaker 5: ten days. Now it needs to be less than an hour,
Speaker 5: and with our AI based security operations platform, it is.
Speaker 5: Now you've got one tool. That's whether it's all peloton
Speaker 5: networks or whether it's just you know, hoofringing data from
Speaker 5: other places, then you're able to see it all together.
Speaker 5: So you actually get fewer alerts. So you get from
Speaker 5: thousands of alerts down to one hundred alerts right, and
Speaker 5: you can investigate them, and you investigate them using AI too.
Speaker 5: And AI is is today. It's today's threat, but it's
Speaker 5: you know, you think about threat and opportunity to think
Speaker 5: about what's next. You always have to be kind of
Speaker 5: evolving and you have to think.
Speaker 4: We talk about threat and risk. You know, we didn't
Speaker 4: tell you know, what is the cost of cyber some
Speaker 4: type of penetration. It's typical costs is about four and
Speaker 4: a half million dollars. And that's just in labor and remediation.
Speaker 4: If you think about reputational risk as well, our Institute
Speaker 4: for Business Value to to study and found it in
Speaker 4: twenty twenty three there were thirty nine banks that we
Speaker 4: watched that suffered a reputational risk market value of one
Speaker 4: hundred and thirty billion dollars. And so you start to think, wow,
Speaker 4: that's just reputational risk. So that's what's at stake here,
Speaker 4: and it's only that is only going to get bigger.
Speaker 5: So one of the piece we haven't talked about about
Speaker 5: AI that I find super interesting because we've been talking
Speaker 5: essentially about like the terminator, the robots fighting robots, right,
Speaker 5: Like whose robots are quicker? Like I'm designing attacks and
Speaker 5: I'm defending against a tax and I think that's that's
Speaker 5: super important. But we recently launch and our working at
Speaker 5: IBM on our AI security product to actually secure the
Speaker 5: use of AI because it also opens up up another
Speaker 5: set of threat factors. I'll give you an example. I'm
Speaker 5: a marketing executive now for your hospital. So I work
Speaker 5: for you, and you want to announce the launch of
Speaker 5: a new center, and so I upload all the information
Speaker 5: about all the patients and our you know how we
Speaker 5: do things into chat GPT to write the PR for me. Well,
Speaker 5: I've also just uploaded to chat GPT a whole bunch
Speaker 5: of secrets, right. So it's it's how employees are using AI,
Speaker 5: because I think, you know, some companies are sort of
Speaker 5: building their own language models and their own AI applications
Speaker 5: that they want to keep secure. Others are just curious
Speaker 5: about how their employees are using AI applications on the shelf,
Speaker 5: and so we announced in May a product where you
Speaker 5: can actually scan and see how AI is being used
Speaker 5: in your enterprise and within We made the announcement with
Speaker 5: the GA was last month, but we made the announcement
Speaker 5: in May, and we had immediately thousands of CIOs signing
Speaker 5: up because just understanding you know who's using what, it's
Speaker 5: another open question because you know, we talk about AI
Speaker 5: enhancing productivity and all the benefits it's going to bring,
Speaker 5: but it brings it brings risks, not just in how
Speaker 5: it's being used by the threat actors, but also you
Speaker 5: know what other vulnerabilities that.
Speaker 3: Exc It is the eye that you does that system
Speaker 3: tell you what's a problematic use.
Speaker 5: It does, so what what it does, and you've got
Speaker 5: to train it right. But what it does is say
Speaker 5: this is this is outside of your policy. So CIOs
Speaker 5: will set policies on here's what is acceptable and not
Speaker 5: acceptable use. So we'll be able to scan and say
Speaker 5: these these falling uses are outside of policy, and then
Speaker 5: it'll punt and say I think this is too restrictive,
Speaker 5: I think this is too permissive, and then you can
Speaker 5: sort of update your policies from there. That's just sort
Speaker 5: of the visibility piece, and then there's the run time piece,
Speaker 5: which will actually stop you from using it. So you
Speaker 5: go and say, Okay, here's all my patients' social security numbers.
Speaker 5: I'm going to upload them to chat GPT to you know,
Speaker 5: get an understanding of like where they all live. I
Speaker 5: don't know what why you would possibly do that, but
Speaker 5: let's say you were, and then you know, it'll note
Speaker 5: that looks like a social security number. You can't upload
Speaker 5: that into your prompt, so it.
Speaker 3: Will stop you before you Yeah, thoughtful voice over you shoulder,
Speaker 3: just to remind you not to do something silly exactly.
Speaker 3: But this is just talk a little bit more about
Speaker 3: adding AI into this mix. You say it's a force multiplier.
Speaker 3: It's really interesting dig into that, what other instances of
Speaker 3: what that means. How does the balance between AI and
Speaker 3: human expertise work in the kind of next generation of cybersecurity.
Speaker 4: I think the common way to look at as it
Speaker 4: back to the force multipliers, It's not going to be
Speaker 4: is your AI better? But can you use it better?
Speaker 4: Can you ask your AI the right questions? Are you
Speaker 4: well trained? So the competition really becomes your use of AI?
Speaker 4: And are you pointed it in the right direction. You
Speaker 4: have fifty people, can they do the work of two
Speaker 4: hundred and fifty and can they do it in a
Speaker 4: safe and secure manner, So you're not opening up more
Speaker 4: risk based on or two much risk is your risk
Speaker 4: tolerance in order to get the outcome. So that's why
Speaker 4: I think there's the opportunity. And so you see this
Speaker 4: truly as a force multiplier because the first thing people go, oh,
Speaker 4: you're going to get rid of people. Oh, the people
Speaker 4: portion is still still going to be just as important
Speaker 4: because they're doing that other piece of work.
Speaker 5: One of my favorite statistics is that there are now
Speaker 5: more bank tellers in the US than there were in
Speaker 5: nineteen sixty before the ATM was invented. Right, So, but
Speaker 5: it used to be you would go to your bank
Speaker 5: because you had to. I remember doing this. You go,
Speaker 5: you fill out your deposit slip, you hand it to
Speaker 5: the teller and they give you your cash. And then
Speaker 5: ATMs are invented, and it's like, oh, no, what's going
Speaker 5: to happen all these jobs and now there's more, Right,
Speaker 5: but you're not withdrawing money from a bank teller. You're
Speaker 5: now doing more sophisticated transactions. And so I think it's
Speaker 5: similar with AI, right, Like you want people doing things
Speaker 5: that only people can do.
Speaker 3: The human element remains absolutely central in all of this.
Speaker 3: How do you make sure that your cybersecurity folks are
Speaker 3: are equipped to handle high value tasks, are ready for
Speaker 3: this increasing responsibility.
Speaker 5: There's a couple of ways to answer this, but I
Speaker 5: think the more you're able to automate the routine and
Speaker 5: the mundane tasks. For example, the bulk of cybersecurity happens
Speaker 5: in the security operations center. There's analysts who are sitting
Speaker 5: in that center. If they're spending all day either configuring
Speaker 5: alerts or responding to alerts, they're not able to do
Speaker 5: the advanced sort of threat hunting and analysis work. And
Speaker 5: so I think a big chunk of it is just
Speaker 5: freeing up their time to be able to do the
Speaker 5: more advanced strategic work. And a lot of the automation
Speaker 5: tools based on AI, like our cortex XIM product, is
Speaker 5: it's designed to free up their time in order to
Speaker 5: be able to do that.
Speaker 4: And from our perspective, it is making sure that it's
Speaker 4: a requirement to make sure that you have the qualifications
Speaker 4: because people can easily get used to doing what they've
Speaker 4: always done. I know this, and that's what I do.
Speaker 4: You say, Well, now, all the threat actors are learning
Speaker 4: on fly. They're trying to always outsmart you. So it's
Speaker 4: in your best interest, our best interest, our client's best
Speaker 4: and partners best that you are on the front leaning
Speaker 4: edge of that learning capability.
Speaker 3: If you're talking to a client he wants to develop
Speaker 3: a kind of unified cybersecurity strategy, what's the best single
Speaker 3: piece of advice you can give them?
Speaker 5: You should have a single platform. It's hard not to
Speaker 5: answer that, but it is true. I mean all joking
Speaker 5: aside having you know the best of breed solutions that
Speaker 5: are all talking to each other and able to stitch
Speaker 5: together and identify threats before human might be able to.
Speaker 5: That's number one, and number two is making sure you
Speaker 5: have visibility on all elements so you're able to cover
Speaker 5: your whole environment and understand how people are accessing it.
Speaker 4: I'd say, think like a bad actor. Yeah, always think
Speaker 4: outside in because you get comfortable the other way around.
Speaker 3: You guys work together with a push Environ company, and
Speaker 3: I'd love for you to talk a little bit about
Speaker 3: use that as a kind of case study for what
Speaker 3: this collaboration between the two your two companies looks like.
Speaker 3: When you work with a cloud.
Speaker 5: It really was, you know, IBM leading on a digital
Speaker 5: transformation for this client that wanted to move their applications
Speaker 5: into the cloud. And so you're asking a lot of
Speaker 5: questions about how does AI increase the risk and the
Speaker 5: surface area. Those same questions ten years ago were asked
Speaker 5: about the cloud, and we're still on the journey where
Speaker 5: companies are migrating to the cloud. We're not anywhere near
Speaker 5: finished that yet. And so there's two pieces to a
Speaker 5: cloud migration. One is just refactoring for the cloud to
Speaker 5: make sure the application works effectively in the cloud. And
Speaker 5: the second is security. And then you built in security
Speaker 5: by design using power does prison of cloud products to
Speaker 5: make sure that not only did you have the visibility
Speaker 5: so our cloud product you can scan and see where
Speaker 5: the vulnerabilities are. And then there's also you know, cloud
Speaker 5: firewalls essentially that will keep bad actors out and keep
Speaker 5: the cloud instance secure.
Speaker 3: If we sit down and have this conversation five years
Speaker 3: from now, which I actually hope we do, be fun
Speaker 3: this pretend is twenty twenty nine. Tell me what are
Speaker 3: you happy about in twenty twenty nine.
Speaker 4: I think twenty twenty nine quantum computing is mainstream I
Speaker 4: think quantum computing is now quantum safe, where we're using
Speaker 4: quantum computing to make sure that those bad actors aren't
Speaker 4: as bad as they used to be back in twenty
Speaker 4: twenty four, and that we're seeing around the corners and
Speaker 4: that we're empowering our palo alto relationship. That in twenty
Speaker 4: twenty nine is the premiere type of capability that people
Speaker 4: are looking at when they think of what used to
Speaker 4: be AI and now is quantum capability.
Speaker 1: Yeah.
Speaker 5: Yeah, I think for AI, everyone's just using it part
Speaker 5: of their job. The way email was an innovation in
Speaker 5: the nineties, the way you know cloud was an innovation
Speaker 5: in the twenty tens, and we thought, how are we
Speaker 5: going to use this? What impact is it going to
Speaker 5: have on productivity? All these people who are spending their
Speaker 5: days typing up memos, like what are they going to do?
Speaker 5: We're going to be past that fear and we're all
Speaker 5: going to understand that it is this like truly positive
Speaker 5: force multiplier for you know, every employee is able to
Speaker 5: do their best work and spend their time on the
Speaker 5: things that only they can do, and then the AI
Speaker 5: is doing the rest of that for them.
Speaker 4: Right AI, it's fun to enable many things to work together.
Speaker 4: It won't be just one language model. We won't even
Speaker 4: think about. It will be the difference between you know,
Speaker 4: Malcolm having a fax machine, a stereo and a telephone
Speaker 4: and a memo board. Now it's in your pocket and
Speaker 4: it's all one thing and you don't even call that,
Speaker 4: you know. I said, walk them into my kids the
Speaker 4: other day and they're like, what's a walk man? So
Speaker 4: I do think will it'll be part of the past
Speaker 4: and it's it will be the start of the seamless connection.
Speaker 4: That is secure seamless connection of HR, of finance, of distribution, logistics,
Speaker 4: of billing, all of those will have a capability to
Speaker 4: work together.
Speaker 3: Yeah, I have to do some social quick fire questions
Speaker 3: you guys ready, all right? What's the number one thing
Speaker 3: that people misunderstand about AI?
Speaker 4: The reliance on data?
Speaker 1: What do you mean by that?
Speaker 4: I think that it's just assumed that it's happening and
Speaker 4: it can just go out and grab data anywhere.
Speaker 3: Yeah, you have.
Speaker 4: To have good data, reliable data, and access to the data.
Speaker 5: I mean people are too afraid of it.
Speaker 3: Checkbox and image generators are the biggest things in consumer
Speaker 3: AI right now. What do you think is that next
Speaker 3: big business application?
Speaker 4: Jason, I think it's the tying together of multiple capabilities.
Speaker 4: I'm hinting towards us earlier is that I think tying
Speaker 4: together the disparate systems that sit in different parts of
Speaker 4: the organization front office, back office, making it one office
Speaker 4: and tying together those different functions, that's it.
Speaker 5: I mean, it's workflow automation. I think back to your
Speaker 5: point on the reliance on data seems easy. It's a
Speaker 5: lot harder than you think because you have to have
Speaker 5: everything set up in exactly the right way to get
Speaker 5: all of your systems automated and the sort of the
Speaker 5: more boring jobs taken care of so that humans could
Speaker 5: do the strategic ones.
Speaker 3: How are you already using AI in your day to
Speaker 3: day life?
Speaker 5: I mean I use it at work all the time,
Speaker 5: and then I've found right now I go to chat
Speaker 5: GPT instead of Google to look things up. I like
Speaker 5: having a conversation.
Speaker 4: We have a wonderful capability in our consulting business called
Speaker 4: our consulting assistant, and consulting advantage is the proper name
Speaker 4: for it, but I look at it as that assistant
Speaker 4: and it's a force multiplier for me. So if I
Speaker 4: need to pull together content proposals with the teams, we
Speaker 4: go straight to that.
Speaker 3: We are one more. We hear so many definitions of
Speaker 3: open related to technology. How do you define it and
Speaker 3: how does the concept help you innovate?
Speaker 5: By definition? In cybersecurity, you don't want to be too open, right,
Speaker 5: So I think we enable openness with this concept of
Speaker 5: zero trust and saying like everyone's invited in as long
Speaker 5: as you have the right credentials, right. So that's that's
Speaker 5: one way, and then the other way is just making
Speaker 5: sure you're connected to all the different systems in order
Speaker 5: to be able to have that visibility and see what's happening.
Speaker 5: Because if you are blind, that's the minute you have
Speaker 5: that vulnerability.
Speaker 4: And I'd say it's moving quickly with security, it sounds contradictory.
Speaker 4: Open hold then it means you're not safe. No, you
Speaker 4: are safe and you can move faster.
Speaker 3: Yeah, thank you so much. It's fun.
Speaker 5: Thanks a lot, Thank you great. We'll see you in
Speaker 5: five years.
Speaker 3: Five years, man, I'll be old in five years. Thank
Speaker 3: you to Jason Kelly and I M and Christy Fredericks
Speaker 3: at Palo Alto Networks for that fascinating conversation about the
Speaker 3: threats and opportunities in cybersecurity today. As Jason and Christie stressed,
Speaker 3: AI can be a force multiplier for enterprise across industries.
Speaker 3: When you're working with multiple products and have your data
Speaker 3: in distributed environments, you need technology that will work across
Speaker 3: your organization, and with Palo Alto Networks platform, you can
Speaker 3: enhance cyber resiliency and simplify your operations. Through their collaboration,
Speaker 3: IBM and Palo Alto Networks are charting the future a
Speaker 3: fully integrated open end to end security solutions. Smart Talks
Speaker 3: with IBM is produced by Matt Romano, Joey fish Ground,
Speaker 3: Amy Gaines McQuaid, and Jacob Goldstein. We're edited by Lydia
Speaker 3: Jane Kott. Our engineers are Sarah Brugaer and Ben Holliday.
Speaker 3: Theme song by Gramoscope. Special thanks to the eight Bar
Speaker 3: and IBM teams, as well as the Pushkin Marketing team.
Speaker 3: Smart Talks with IBM is a production of Pushkin Industries
Speaker 3: and Ruby Studio at iHeartMedia. To find more Pushkin podcasts,
Speaker 3: listen on the iHeartRadio app, Apple Podcasts, or wherever you
Speaker 3: listen to podcasts. I'm Malcolm glapwom. This is a paid
Speaker 3: advertisement from IBM. The conversations on this podcast don't necessarily
Speaker 3: represent IBM's positions, strategies, or opinions.