Speaker 1: Welcome to tech Stuff, a production from iHeartRadio. This season
Speaker 1: on smart Talks with IBM, Malcolm Gladwell and team are
Speaker 1: diving into the transformative world of artificial intelligence with a
Speaker 1: fresh perspective on the concept of open What does open
Speaker 1: really mean in the context of AI. It can mean
Speaker 1: open source code or open data, but it also encompasses
Speaker 1: fostering an ecosystem of ideas, ensuring diverse perspectives are heard,
Speaker 1: and enabling new levels of transparency. Join hosts from your
Speaker 1: favorite Pushkin podcasts as they explore how openness and AI
Speaker 1: is reshaping industries, driving innovation, and redefining what's possible. You'll
Speaker 1: hear from industry experts and leaders about the implications and
Speaker 1: possibilities of open AI, and of course, Malcolm Gladwell will
Speaker 1: be there to guide you through the season with his
Speaker 1: unique insights. Look out for new episodes of Smart Talks
Speaker 1: every other week on the iHeartRadio app, Apple Podcasts, or
Speaker 1: wherever you get your podcasts, and learn more at IBM
Speaker 1: dot com slash smart Talks.
Speaker 2: Hello, Hello, Welcome to Smart Talks with IBM, a podcast
Speaker 2: from Pushkin Industries, iHeartRadio and IBM. I'm Malcolm Glappwell. This season,
Speaker 2: we're diving back into the world of artificial intelligence, but
Speaker 2: with a focus on the powerful concept of open its possibilities, implications,
Speaker 2: and misconceptions. We'll look at openness from a variety of
Speaker 2: angles and explore how the concept is already reshaping industries,
Speaker 2: ways of doing business and our very notion of what's possible.
Speaker 2: On today's episode, I'm joined by Jason Kelly, the global
Speaker 2: Managing Partner for IBM Strategic Partners and Ecosystems, and by
Speaker 2: Christy Fredericks, the Senior Vice president and Chief Partnership Officer
Speaker 2: at Polowa Networks. We discussed how their partnership in the
Speaker 2: cybersecurity space helps strengthen enterprises by focusing on seamless cybersecurity
Speaker 2: solutions tailored to meet the evolving threat landscape. By leveraging
Speaker 2: AI and automation, this collaboration aims to modernize security programs,
Speaker 2: improve response times, and produce risks. Jason and Christy both
Speaker 2: bring a tremendous amount of experience and expertise to the subject.
Speaker 2: I think you're really going to enjoy this one, Jason, Christy,
Speaker 2: Welcome to Smart Talks with IBM. Thank you for joining me.
Speaker 3: Thank you.
Speaker 4: It's great to be here.
Speaker 2: We are here to discuss cybersecurity and the partnership between
Speaker 2: IBM and Palo Alto Networks. But before we get there,
Speaker 2: I wanted you guys to tell me a little bit
Speaker 2: out yourself. Jason, let's start with you. I see on
Speaker 2: your resume west Point, which makes we think there's some
Speaker 2: interesting things going on there. How did you get to
Speaker 2: west Point?
Speaker 3: West Point? West Point was the decision. First, it was
Speaker 3: it was affordable back in the day. But I had
Speaker 3: a sense of service. My father was a World War
Speaker 3: Two vet, so I grew up on the weekends watching
Speaker 3: World War two video. You know, he's army as well. Yeah,
Speaker 3: and so I thought, oh, that'd be exciting, and I
Speaker 3: thought I do some type of service. Went there and
Speaker 3: now I have the biggest family, extended family I could
Speaker 3: ever have. So it was very exciting. Played football lucked out,
Speaker 3: meaning I wasn't recruited. I walked on and that kept
Speaker 3: me there because it gave me something and outlet with
Speaker 3: all the other pressures. Defensive back I was. I was
Speaker 3: great at knocking the ball down, not the best at
Speaker 3: catching it.
Speaker 2: Yeah, and then you were a ranger I was.
Speaker 3: I was privileged to be a US Army airborne ranger station,
Speaker 3: but did most of my time in northern Italy. We're
Speaker 3: part of the eighty second Airbarnship Post. Oh yeah, that's
Speaker 3: what people say, seriously, like, you know, you were you
Speaker 3: were northern, you were drinking wine and having bred, you know.
Speaker 3: But it was a part of a NATO force there
Speaker 3: at the time. Yeah, so exciting.
Speaker 2: How did you get from there to IBM?
Speaker 3: A long path. As I came out of the military,
Speaker 3: I started manufacturing retail housing and did a quick stint,
Speaker 3: took a leave of absence from industry, and did a
Speaker 3: stint of yet again public service in the state of
Speaker 3: Tennessee with economic development and got a whiff of how
Speaker 3: fun it could be to do things around data and media.
Speaker 3: Started a small media firm what we would now call
Speaker 3: a digital firm, sold it and said I wanted to
Speaker 3: go do it again somewhere, but I want to go
Speaker 3: to a big company. And the family at IBM brought
Speaker 3: me in and yet to let me go.
Speaker 2: That was how many years ago?
Speaker 3: Two decades? Oh wow, So I know I look amazingly young, but.
Speaker 2: Yes, because you must have.
Speaker 3: And IBM was my fifth career and and and I've
Speaker 3: I've enjoyed it since and that's what I what I
Speaker 3: do there, build teams, grow new parts of the company,
Speaker 3: and get to work with some of the most brilliant
Speaker 3: people on the face of the planet, as well as
Speaker 3: partners like like Christy that just keep it exciting.
Speaker 2: Christy, you're I was delighted to learn that you are Canadian?
Speaker 2: Yes here, yeah? But you so you were a consultant
Speaker 2: for a long time a Bane Yes.
Speaker 4: Yeah. I joined Baine Consulting intending to spend a couple
Speaker 4: of years there learn the ropes and then go get
Speaker 4: my first real job. But the value personally to my
Speaker 4: growth and development, and then that we were able to
Speaker 4: bring our clients. I ended up there for sixteen years
Speaker 4: and then post Bane went onto another my first product company,
Speaker 4: a new relic, and then it's come full circle at
Speaker 4: Polota Networks. But at Bain it was all about bringing
Speaker 4: expertise across different industries to help our clients improve whatever
Speaker 4: they needed to improve and bringing that expertise to bear.
Speaker 4: And then you have the product lens and you think, Okay,
Speaker 4: we're going to build the absolute best product to help
Speaker 4: our customers do what they need to get done, and
Speaker 4: then I joined pal Alto about six seven months ago
Speaker 4: in a partnerships role and I'm delighted to be able
Speaker 4: to work with amazing consulting companies like IBM where we
Speaker 4: bring both to bear.
Speaker 2: How long have IBM and Palo Alto Network's been partners?
Speaker 3: So we've been We've been working together for quite quite
Speaker 3: a long time, but we made it official, meaning we
Speaker 3: got married as strategic partners last year.
Speaker 2: Oh I see. So what is it that each of
Speaker 2: you bring to the table? What's each side special?
Speaker 3: So it's great that you asked that because about a
Speaker 3: decade ago, are now CEO Arvin Christ says, you know,
Speaker 3: it wouldn't be great if we has had this one
Speaker 3: focus with what does IBM do and you have this
Speaker 3: whole list, and he says, let's make it simple. We
Speaker 3: are a multi cloud, hybrid cloud AI company. And so
Speaker 3: when you say that, it sounds very simple. But then people,
Speaker 3: what the hell is that? What your hybrid cloud? Well,
Speaker 3: both of those two things have a lot of data involved,
Speaker 3: and a lot of those mean that that data is
Speaker 3: going to sit in multiple places and distributed environments. Well,
Speaker 3: if you're able to tie those things together with multiple partners.
Speaker 3: You also have to make sure that it's secure because
Speaker 3: in the direction that we're going, where data is now
Speaker 3: being consumed in many different places and it is the
Speaker 3: fuel behind AI as we know. Then you say, ah, well,
Speaker 3: who does that well and who does it in a
Speaker 3: way that's getting rid of seams, the seams that could
Speaker 3: be across multiple products, multiple product SATs even And that's
Speaker 3: where Powell comes in.
Speaker 4: I think the canal wisdom in cybersecurity was always you
Speaker 4: need all the new tools, right, you need it every threat.
Speaker 4: It's like, whack them all. Every threat that pops up,
Speaker 4: you get the tool that's purpose built for that specific thing. Well,
Speaker 4: fast forward to you know, the RSA conference this year.
Speaker 4: There were four thousand vendors on the floor. You look
Speaker 4: at an average company, there's hundreds of cybersecurity tools. It
Speaker 4: introduces a level of complexity that is really hard to manage.
Speaker 4: You as a user, query and application right, that query
Speaker 4: can go through a bunch of different pings from one
Speaker 4: cloud to the next. It goes into and out of
Speaker 4: as SaaS application. It may be running along a network,
Speaker 4: you may be accessing it from your phone, which is
Speaker 4: an unmanaged device. It's got to go in and out.
Speaker 4: And if you say, okay, I've got to secure that phone,
Speaker 4: I've got to secure the network, I've got it. Then
Speaker 4: all of a sudden you've got sort of firewalls, software
Speaker 4: and hardwel flows popping up everywhere. You've got cloud security,
Speaker 4: and it's you've probably heard of this concept of zero trust,
Speaker 4: which is every time you have to check and say
Speaker 4: are you allowed in here? Are you allowed in here?
Speaker 4: The number of places that can fall down it just
Speaker 4: becomes overwhelming. So you end up with either alerts firing,
Speaker 4: you know, every two seconds that you have to then
Speaker 4: go investigate in most of which are false positives or
Speaker 4: you miss something right. And so that was the conventionalism
Speaker 4: was we've got to buy all these tools, and now
Speaker 4: you've got overwhelmed CIOs and CSOs with hundreds of tools,
Speaker 4: and Palo Alto strategy has been, look, we're going to
Speaker 4: create a platform where everything can be stitched together, everything
Speaker 4: can speak the same language, and we can sort of
Speaker 4: manage throughout the architecture and watch, you know, this call
Speaker 4: as as it's passing through all these different checkpoints, and
Speaker 4: we can do it in a way that you still
Speaker 4: have the confidence that it's best to breed right, so
Speaker 4: you're not making any trade offs. But it's not so
Speaker 4: simple just to get from the spaghetti to the seamless architecture.
Speaker 4: You need, oftentimes to re engineer your business processes. You
Speaker 4: have to re architect your digital environment. And so that's
Speaker 4: where we partner with a company like IBM to bring
Speaker 4: that expertise and say, we're going to help you not
Speaker 4: just deploy the best cybersecurity architecture, but really get your
Speaker 4: environment ready to have this zero customers as well as.
Speaker 3: All of those players that cross that spaghetti, because when
Speaker 3: you start thinking about all the other partners that you
Speaker 3: work with, if you're you think of an industry perspective,
Speaker 3: you're going to have an ERP. It could be an Oracle,
Speaker 3: it could be an SAP. You're not going to have
Speaker 3: one cloud, as I mentioned, it's going to be possibly
Speaker 3: multiple clouds. You'll have some AWS maybe Microsoft asure and
Speaker 3: then even even some Google in there, and then your
Speaker 3: own that you've built in your private over there, uh,
Speaker 3: some an IBM cloud. You'll have those multiple clouds, and
Speaker 3: then you also will have you know, fit for purpose, Oh,
Speaker 3: I need a I need a salesforce in there for
Speaker 3: my customer focusing I need. I'm doing some graphics, so
Speaker 3: I have Adobe, so I just as I can name
Speaker 3: name name, all of those then have to be re engineered. Seriously.
Speaker 3: I mean, come on, Malcolm, you're gonna sit there you
Speaker 3: think how long that would take. So if you haven't
Speaker 3: done that before, you're going to have to go to
Speaker 3: each one of those individually, or you can work with
Speaker 3: a company that can tie those things together, because we
Speaker 3: are also strategic partners with them. So that's where you
Speaker 3: start to say, Okay, I see how this comes together.
Speaker 3: You have to make sure that your ecosystem is going
Speaker 3: to be stronger than your competitor's ecosystem, and you have
Speaker 3: to be secure in what you're doing because as you
Speaker 3: add more players or products, you create seams, and you
Speaker 3: want to make sure there's fewer seams and that there's
Speaker 3: zero trust across that capability you're building. And that's why
Speaker 3: the compliment between the two companies.
Speaker 2: Well, take a step back from a moment before we
Speaker 2: sort of launch, once get into the specifics of what
Speaker 2: you guys are doing. I'm curious at this moment in
Speaker 2: twenty twenty four, how nervous should we be about cybersecurity?
Speaker 2: So compared it to five years ago or ten years ago.
Speaker 2: Are we are less nervous than you were five years ago?
Speaker 2: Were more nervous? Or all of changes going on right
Speaker 2: now increasing vulnerability or decreasing it?
Speaker 3: I would say Christie, also, I think we share the
Speaker 3: point of view is that it's not necessarily being more nervous.
Speaker 3: I think you should be more prepared because the amounts
Speaker 3: of threat is increasing based on our dependence upon data.
Speaker 3: And that's that's where I think the attention should be placed.
Speaker 3: Is that more and more, especially with the importance of AI,
Speaker 3: that you say, okay, then what's under all that? And
Speaker 3: it's the data, as I said, So knowing that you
Speaker 3: should be more concerned.
Speaker 2: Does the advent of AI and its rapid evolution help
Speaker 2: defense more or offense more?
Speaker 4: I think it's I think it's like any mega trend
Speaker 4: that we've witnessed both. Right, So you think about AI.
Speaker 4: It's great, right in terms of what it's going to
Speaker 4: unlock for productivity, for humanity, but it also makes it
Speaker 4: a whole lot easier to build ransomware. It's a whole
Speaker 4: lot easier to test different ways into a system. Right.
Speaker 4: But I think that's true if you think about like
Speaker 4: the rise of the Internet, right, all of a sudden,
Speaker 4: everyone was putting their data online and you had to
Speaker 4: think of new ways to stay ahead and keep that secure.
Speaker 4: And I don't think AI is any different. You've got
Speaker 4: companies like Palta, partnerships like Powell and IBM that are
Speaker 4: constantly scanning the landscape for not only the current threats,
Speaker 4: but what's next, what's coming around the corner, what's after AI?
Speaker 4: And so I think taking it seriously and being prepared
Speaker 4: is probably the right way of looking at it, as
Speaker 4: opposed to because if you think about it too hard,
Speaker 4: you'll just want to crawl into a corner and stuff
Speaker 4: everything under the mattress.
Speaker 2: I am the CEO of a regional hospital chain, big
Speaker 2: distribute healthcare system, so a ton of data. The consequences
Speaker 2: of being hacked and help for ransom are life and death.
Speaker 2: Life and death. Right littally, when you come so, you
Speaker 2: come down, you sit down with me, and you chat
Speaker 2: with me. Walk me through the kinds of things you
Speaker 2: would tell me about what I need to get safer.
Speaker 2: For example, let's start with one. Is it likely that
Speaker 2: I'm spending too little? Or am I spending money in
Speaker 2: the wrong place.
Speaker 4: Great question. It depends how you've broken it out. If
Speaker 4: you are distributing all of your dollars across a whole
Speaker 4: bunch of different tools, it's likely you're just spending the
Speaker 4: wrong money. And in fact, you know, putting it all
Speaker 4: in one place is a way of potentially saving money
Speaker 4: but keeping your security actually higher. And I'd love to
Speaker 4: hear Jason, how you would approach it. How we would
Speaker 4: approach it, of course, is by saying, you know, what,
Speaker 4: what does your environment look like? You know, do you
Speaker 4: have the connected medical devices into your EMR? Are your
Speaker 4: respirators and ventilators all online? Right? And so we would
Speaker 4: talk about, okay, here's how you get coverage and how
Speaker 4: the coverage of both the firewalls as well as the
Speaker 4: detectors all feedback into your security operation center and you
Speaker 4: can manage it and do your learning with AI and
Speaker 4: keep yourself securing.
Speaker 3: So yeah, and I would say Christy and I would
Speaker 3: go to the same point because if you get under
Speaker 3: what she was just asking, it is your data on
Speaker 3: prem and when it's on prem, how active is it
Speaker 3: across the enterprise? And so that begins the basis for
Speaker 3: the start and then often you're going to say, well,
Speaker 3: we actually take in data from outside, and then we
Speaker 3: also have the circumstances. There's a lot of PII and
Speaker 3: so that personal is the personal information, right, And so
Speaker 3: now you're saying, okay, now, how are we securing that
Speaker 3: and where are we securing it? And so you have
Speaker 3: to start really thinking about the different areas within that
Speaker 3: hospital chain. Are you sharing that amongst your hospitals? And
Speaker 3: now you start to think of if I'm saying no
Speaker 3: to a lot of that, it's like, well, then are
Speaker 3: you as efficient as you want to be? So there
Speaker 3: is that trade off of you know, am I so
Speaker 3: tightly walled that I'm not productive? And so that's where
Speaker 3: we would start to say, what's the outcome that you're
Speaker 3: trying to get to? All Right, maybe you're good, Maybe
Speaker 3: you're you're good with your five locations and you don't
Speaker 3: need to go any further, but maybe you want to
Speaker 3: expand to fifty and by the way, you're going to
Speaker 3: go crossport or you're going to be in Toronto and
Speaker 3: in New York. Okay, well then how do you do that?
Speaker 3: And so I think that it's very easy to start
Speaker 3: jumping into any of the typical situations. But the first
Speaker 3: question that you have to ask you as the hospital CEOs,
Speaker 3: what's your objective? What are you what are you trying
Speaker 3: to do? Because too often what we see is that
Speaker 3: there's some bright, new, shiny thing that everybody wants to
Speaker 3: put in play. You know, it's a sandwich looking for
Speaker 3: lunch and you go, but what is it that you
Speaker 3: want to do as this? Are you doing research? Are
Speaker 3: your research hospital? Are you more consumer oriented? So those
Speaker 3: are the questions you start to ask because they start
Speaker 3: to then tell a story in line with what Christy questions.
Speaker 3: And I think that that's where the again, the complement
Speaker 3: is that instead of just saying, oh, well, that's thanks
Speaker 3: for telling me all this, Malcolm, here's your ten page strategy,
Speaker 3: go find somebody. We have the benefit in IBM. And
Speaker 3: it's probably why I'm still there is you know, we're
Speaker 3: very unique. We're the only company on the planet that
Speaker 3: has a consulting business at scale inside of a technology company,
Speaker 3: and so we have, you know, the left brain, right brain.
Speaker 3: We're able to do that and then we're able to say, okay,
Speaker 3: now which partners are going to be most valuable for
Speaker 3: our clients? What's going to work for you, isn't going
Speaker 3: to work for the manufacturer down the road, isn't going
Speaker 3: to work for the consumer or CpG company across the river.
Speaker 3: Those things are bare very specific. The threats and the
Speaker 3: scenes that I was talking about are very specific. So
Speaker 3: that's where it becomes very valuable to make sure that
Speaker 3: I'm not just giving you some strategy that's generic.
Speaker 2: But everything as a healthcare CEO, everything I have done,
Speaker 2: almost everything I've done over the last ten years, has
Speaker 2: it had the effect of increasing my vulnerability. I want
Speaker 2: to digitize data within the hospital used to be on
Speaker 2: pieces of paper. I want doctors to go home and
Speaker 2: to be able to seamlessly hook into stuff at work
Speaker 2: because they got to do all their paperwork. I want
Speaker 2: to make sure the diabetes people are speaking to the
Speaker 2: organ transplant people. And so isn't that everything I have
Speaker 2: done to kind of keep up with the revolution in healthcare?
Speaker 2: Isn't that also making me more and more vulnerable to
Speaker 2: a bad actor.
Speaker 4: It's such a great question because think about the quality
Speaker 4: of healthcare delivery. Right, So now doctors aren't filling out forms,
Speaker 4: They're spending time with patients, and so the quality of
Speaker 4: care is improving and the vulnerability is improving, and so
Speaker 4: I think that's where having a strong cybersecurity strategy actually
Speaker 4: enables all of that. One of our products is our
Speaker 4: sas product, and we tested it with some business applications,
Speaker 4: and oftentimes the wrap is, oh, security is going to
Speaker 4: slow you down, right, like you have to add a firewall,
Speaker 4: you have to checkpoints. Our product actually increases the velocity
Speaker 4: of your ability to use that application because of the
Speaker 4: way that it is queried through our system as opposed
Speaker 4: to just through the regular network. So it doesn't slow
Speaker 4: it down and in fact, it makes it run more efficiently.
Speaker 4: That's just one minor example. But back to the healthcare question. I,
Speaker 4: as a patient want my doctors accessing all the technology
Speaker 4: and talking to each other and connecting the dots behind
Speaker 4: the scenes. I also want my data to stay private,
Speaker 4: and so having both a consulting partner who understands how
Speaker 4: to ask questions of the environment and of the applications
Speaker 4: you're using, and who understands the industry inside and out,
Speaker 4: and a technology partner that builds and stays ahead of
Speaker 4: all of the different threats come together advise you. I
Speaker 4: think is super important. When you bring in a partner
Speaker 4: like IBM, with a platform like pal Alta that covers
Speaker 4: you know, all the different parts of your environment, you're
Speaker 4: able to say, look, where where are the vulnerabilities in
Speaker 4: the system, Where are the different endpoints that we need
Speaker 4: to have covered, And then just make sure you get
Speaker 4: that breadth of coverage and then you're better able to so, yes,
Speaker 4: you've increased the risk, but then you've mitigated it.
Speaker 2: So to give so before I retire my healthcare analogy,
Speaker 2: because I was thinking about just trying to understand the
Speaker 2: importance of this idea of having a single platform. So
Speaker 2: if this mudtle healthcare network is typical, I've acquired a
Speaker 2: whole series of over the last ten years. I bought
Speaker 2: a hospital over here, some I got some physicians things
Speaker 2: that I snapped up over here. I bought a diagnostics company,
Speaker 2: and so I have all of these legacy systems and
Speaker 2: I had, like you said, maybe I got some stuff
Speaker 2: in the cloud with one company, some stuff with the cloud.
Speaker 2: And what you're saying is the first step is to
Speaker 2: kind of rationalize that put it on a single platform,
Speaker 2: so you understand where your points of weakness are as
Speaker 2: opposed to being blind to your points of weakness.
Speaker 4: There's yes, although anyone who's done any kind of M
Speaker 4: and A knows that that's a long journey, right. So
Speaker 4: I think the first step is just understanding where everything is,
Speaker 4: and then you get on a path and you say,
Speaker 4: where's the biggest risk. Let's neutralize or mitigate that risk
Speaker 4: one at a time. The thing about open end Secure,
Speaker 4: you know, Palo Alto. We keep touting the benefits of
Speaker 4: the platform. Everything on Palo Alto, your risk is going
Speaker 4: to be mitigated and you're going to have the full visibility.
Speaker 4: But you can't get there overnight. And so we've got
Speaker 4: you know, thousands of integrations with other technology companies, including
Speaker 4: our partners, to make sure that we can capture and
Speaker 4: have visibility into those those endpoints in those systems as well.
Speaker 4: And so I think step one is just figure out
Speaker 4: where everything is, get the scan, so politize a couple
Speaker 4: of products where you can kind of deploy and get
Speaker 4: a view of your attack surface. I love the analogy.
Speaker 4: Just like a digital environment is a house, right, and
Speaker 4: so like you have your front door log of course,
Speaker 4: because probably they're going to try the front door first,
Speaker 4: but that's not all you're going to do, right, you're
Speaker 4: going to make sure the whole you know, the windows
Speaker 4: are locked and there's an alarm system and all of that.
Speaker 4: And I think that's how you have to think about it,
Speaker 4: is just how do we cover the whole service.
Speaker 2: So everyone lay. People like me have been bombarded over
Speaker 2: it seems like over the last year with one thing
Speaker 2: another about how quickly AI is moving forward and how
Speaker 2: big of a deal it is suddenly is going to
Speaker 2: be in the economy. What is the impact of that
Speaker 2: dramatic change in AI's capabilities on this cybersecurity question? So
Speaker 2: what does it mean if you're defending somebody that you
Speaker 2: now have these sophisticated AI tools, you suppose.
Speaker 3: I think that AI becomes the force multiplier for cyber
Speaker 3: To think about cyber Before it was just locking your doors,
Speaker 3: locking the windows, and if you were really good, you
Speaker 3: had an alarm system. You know. Now with AI, you
Speaker 3: can said, well, I can predict what's going to happen.
Speaker 3: I can see around the corner. I know, I can
Speaker 3: leave my windows open upstairs and it's fine, and it's okay.
Speaker 2: I mean because why because the AI is running a
Speaker 2: million simulations.
Speaker 3: It can And that's exactly it. It becomes the intelligent
Speaker 3: part of that AI. It's not artificial, it's augmented. So
Speaker 3: you now have this new capability to see around corners,
Speaker 3: and so you're able to do the jobs of yesterday
Speaker 3: more effectively. And the queries that you were doing, and
Speaker 3: that's all you're really doing, now you're doing them, you know, faster,
Speaker 3: you're able to access even more data and you're able
Speaker 3: to then make it more secure. So that's why AI
Speaker 3: becomes a force multiplier.
Speaker 2: Yeah, and just talk about the faster part. What does
Speaker 2: faster mean in practical terms? If you're trying to defend
Speaker 2: an enterprise against a cyber attack, what does speed matter
Speaker 2: in that environment?
Speaker 3: You're always trying to find a place through I go
Speaker 3: back to you. We brought up the army. You always
Speaker 3: how do you break the line? How do you find
Speaker 3: a penetration point? And when you think about you know,
Speaker 3: pin testing, penetration testing, where are those? So if you're
Speaker 3: able to do that faster than the bad guys, and
Speaker 3: not only faster, but you're picking more probable points. This
Speaker 3: is back to the intelligence. I could waste time doing
Speaker 3: penetration testing someplace where That's why I mentioned leave if
Speaker 3: they can't get in the second story windows. Why are
Speaker 3: you spending time trying it so that becomes more effective?
Speaker 3: So that's when I think of speed. That's what I
Speaker 3: think of because with not just speed, I think it's
Speaker 3: also what's effective.
Speaker 4: Just to put a put a fine point on it.
Speaker 4: So I found a way in Okay, Now what I
Speaker 4: don't know where the jewelry is, so I have to
Speaker 4: look around and see if there's any hidden gems and
Speaker 4: try to find my way. That used to take a week,
Speaker 4: two weeks, sort of seven to fourteen days. Now it's hours, right,
Speaker 4: So they're in and they can actually expeltrate data within
Speaker 4: less than a day. The metric we use in the
Speaker 4: security operation Center is meantime to detect, so to see
Speaker 4: anyone's there, meantime to respond and remediate to get them
Speaker 4: out right. That used to be also you know, seven eight, nine,
Speaker 4: ten days. Now it needs to be less than an hour.
Speaker 4: And with our AI based security operations platform, it is.
Speaker 4: Now you've got one tool that whether it's all peloton
Speaker 4: networks or whether it's just you know, hoofringing data from
Speaker 4: other places, then you're able to see it all together.
Speaker 4: So you actually get fewer alerts, so you get from
Speaker 4: thousands of alerts down to one hundred alerts right, and
Speaker 4: you can investigate them and you investigate them using AI too.
Speaker 4: And AI is today, it's today's threat, but it's you know,
Speaker 4: you think about threat and opportunity to think about what's next.
Speaker 4: You always have to be kind of evolving.
Speaker 3: And you have to. I think we talk about threat
Speaker 3: and risk. You know, we didn't tell you know, what
Speaker 3: is the cost of cyber some type of penetration. It's
Speaker 3: typical costs is about four and a half million dollars.
Speaker 3: And that's just in labor and remediation. If you think
Speaker 3: about reputational risk as well, our Institute for Business Value
Speaker 3: to the study and found it in twenty twenty three
Speaker 3: and they were thirty nine banks that we watched that
Speaker 3: suffered a reputational risk market value of one hundred and
Speaker 3: thirty billion dollars. And so you start to think, wow,
Speaker 3: that's just reputational risk. So that's what's at stake here,
Speaker 3: and it's only that is only going to get bigger.
Speaker 4: So one of the piece we haven't talked about about
Speaker 4: AI that I find super interesting because we've been talking
Speaker 4: essentially about like the terminator, the robots fighting robots, right,
Speaker 4: like whose robots are quicker? Like I'm designing a tax
Speaker 4: and I'm defending against tax and I think that's that's
Speaker 4: super important. But we recently launch and our working at
Speaker 4: IBM on our AI security product to actually secure the
Speaker 4: use of ALI because it also opens up another set
Speaker 4: of threat factors. I'll give you an example. I'm a
Speaker 4: marketing executive now for your hospital. So I work for you,
Speaker 4: and you want to announce the launch of a new center,
Speaker 4: and so I upload all the information about all the
Speaker 4: patients and our you know how we do things into
Speaker 4: chat GPT to write the PR for me. Well, I've
Speaker 4: also just uploaded to chat GPT a whole bunch of secrets, right.
Speaker 4: So it's it's how employees are using AI, because I think,
Speaker 4: you know, some companies are sort of building their own
Speaker 4: language models and their own AI applications that they want
Speaker 4: to keep secure. Others are just curious about how their
Speaker 4: employees are using AI applications on the shelf, and so
Speaker 4: we announced in May a product where you can actually
Speaker 4: scan and see how AI is being used in your
Speaker 4: enterprise and within We made the announcement with the GA
Speaker 4: was last month, but we made the announcement in May,
Speaker 4: and we had immediately thousands of CIOs signing up because
Speaker 4: just understanding you know who's using what it's another open
Speaker 4: question because you know, we talk about AI enhancing productivity
Speaker 4: and all the benefits it's going to bring, but it
Speaker 4: brings it brings risks, not just in how it's being
Speaker 4: used by the thread actors, but also you know what
Speaker 4: other vulnerabilities that.
Speaker 2: Exc It's the eye that you does that system tell
Speaker 2: you what's a problematic use.
Speaker 4: It does, so what what it does, and you've got
Speaker 4: to train it right. But what it does is say
Speaker 4: this is this is outside of your policy. So CIOs
Speaker 4: will set policies on here's what is acceptable and not
Speaker 4: acceptable use. So we'll be able to scan and say
Speaker 4: these these falling uses are outside of policy, and then
Speaker 4: it'll punt and say I think this is too restrictive,
Speaker 4: I think this is too permissive, and then you can
Speaker 4: sort of update your policies from there. That's just sort
Speaker 4: of the visibility piece, and then there's the run time piece,
Speaker 4: which will actually stop you from using it. So you
Speaker 4: go and say, okay, here's all my patient's social security numbers.
Speaker 4: I'm going to upload them to chat GPT to you know,
Speaker 4: get an understanding of like where they all live. I
Speaker 4: don't know what why you would possibly do that, but
Speaker 4: let's say you are and then you know, it'll note
Speaker 4: that looks like a social security number. You can't upload
Speaker 4: that into your prompt.
Speaker 2: So it will stop you before you Yeah, thoughtful voice
Speaker 2: over your shoulder, just to remind you not to do
Speaker 2: something silly exactly. But this is just talk a little
Speaker 2: bit more about adding AI into this mix. You say
Speaker 2: it's a force multiplier. It's a really interesting dig into that.
Speaker 2: What other instances of what that means? How does the
Speaker 2: balance between AI and human expertise work in the kind
Speaker 2: of next generation of cybersecurity?
Speaker 3: I think the common way to look at as it
Speaker 3: back to the force multipliers, It's not going to be
Speaker 3: is your AI better? But can you use it better?
Speaker 3: Can you ask your AI the right questions? Are you
Speaker 3: well trained? So the competition really becomes your use of AI?
Speaker 3: And are you pointed it in the right direction. You
Speaker 3: have fifty people, can they do the work of two
Speaker 3: hundred and fifty? And can they do it in a
Speaker 3: safe and secure manner? So you're not opening up more
Speaker 3: risk based on or too much risk is your risk
Speaker 3: tolerance in order to get the outcome. So that's why
Speaker 3: I think there's the opportunity. And so you see this
Speaker 3: truly as a force multiplier because the first thing people go, oh,
Speaker 3: you're going to get rid of people. Oh, the people
Speaker 3: portion is still still going to be just as important
Speaker 3: because they're doing that other piece of work.
Speaker 4: One of my favorite statistics is that there are now
Speaker 4: more bank tellers in the US than there were in
Speaker 4: nineteen sixty before the ATM was invented. Right, So, but
Speaker 4: it used to be you would go to your bank
Speaker 4: because you had to. I remember doing this. You go,
Speaker 4: you fill out your deposit slip, you hand it to
Speaker 4: the teller and they give you your cash. And then ATMs
Speaker 4: are invented. It's like, oh no, what's going to happen?
Speaker 4: All these jobs and now there's more, Right, but you're
Speaker 4: not withdrawing money from a bank teller. You're now doing
Speaker 4: more sophisticated transactions. And so I think it's similar with AI, right,
Speaker 4: like you want people doing things that only people can do.
Speaker 2: The human element remains absolutely central in all of this.
Speaker 2: How do you make sure that your cybersecurity folks are
Speaker 2: equipped to handle high value tasks are ready for this
Speaker 2: increasing responsibility.
Speaker 4: There's a couple of ways to answer this, but I
Speaker 4: think the more you're able to automate the routine and
Speaker 4: the mundane tasks. For example, the bulk of cybersecurity happens
Speaker 4: in the security operations center. There's analysts who are sitting
Speaker 4: in that center. If they're spending all day either configuring
Speaker 4: alerts or responding to alerts, they're not able to do
Speaker 4: the advanced sort of threat hunting and analysis work. And
Speaker 4: so I think a big chunk of it is just
Speaker 4: freeing up their time to be able to do the
Speaker 4: more advanced strategic work. And a lot of the automation
Speaker 4: tools based on AI, like our cortex XIM product, is
Speaker 4: it's designed to free up their time in order to
Speaker 4: be able to do that.
Speaker 3: And from our perspective, is making sure that it's a
Speaker 3: requirement to make sure that you have the qualifications because
Speaker 3: people can easily get used to doing what they've always done.
Speaker 3: I know this, and that's that's what I do. You say, well, no,
Speaker 3: all the threat actors are learning on the fly. They're
Speaker 3: trying to always outsmart you. So it's in your best interest,
Speaker 3: our best interest, our client's best and partners best, and
Speaker 3: that you are on the front leaning edge of that
Speaker 3: learning capability.
Speaker 2: If you're talking to a client he wants to develop
Speaker 2: a kind of unified cybersecurity strategy, what's the best single
Speaker 2: piece of advice you can give them?
Speaker 4: You should have a single platform. It's hard not to
Speaker 4: answer that, but it is true. I mean all joking
Speaker 4: aside having you know the best of breed solutions that
Speaker 4: are all talking to each other and able to stitch
Speaker 4: together and identify threats before human might be able to.
Speaker 4: That's number one, and number two is making sure you
Speaker 4: have visibility on all elements so you're able to cover
Speaker 4: your whole environment and understand how people are accessing it.
Speaker 3: I'd say think like a actor. Yeah, always think outside
Speaker 3: in because you get comfortable the other way around.
Speaker 2: You guys work together with a fortunate enviioutrial company, and
Speaker 2: I'd love for you to talk a little bit about
Speaker 2: use that as a kind of case study for what
Speaker 2: this collaboration between the two your two companies looks like.
Speaker 2: When you work with a cloud.
Speaker 4: It really was, you know, IBM leading on a digital
Speaker 4: transformation for this client that wanted to move their applications
Speaker 4: into the cloud, and so you're asking a lot of
Speaker 4: questions about how does AI increase the risk and the
Speaker 4: surface area. Those same questions ten years ago were asked
Speaker 4: about the cloud. And we're still on the journey where
Speaker 4: where companies are migrating to the cloud. We're not anywhere
Speaker 4: near finished that yet. And so there's two pieces to
Speaker 4: a cloud migration. One is just refactoring for the cloud
Speaker 4: to make sure the application works effectively in the cloud.
Speaker 4: And the second is security. And then you built in
Speaker 4: security by design using POW does prison of cloud products
Speaker 4: to make sure that not only did you have the
Speaker 4: visibility so our cloud product you can scan and see
Speaker 4: where the vulnerability. And then there's also you know, cloud
Speaker 4: firewalls essentially that will keep bad actors out and keep
Speaker 4: the cloud instant secure.
Speaker 2: If we sit down and have this conversation five years
Speaker 2: from now, which I actually hope we do, be fun,
Speaker 2: this pretend is twenty twenty nine. Tell me what are
Speaker 2: you happy about in twenty twenty nine.
Speaker 3: I think twenty twenty nine quantum computing is mainstream. I
Speaker 3: think quantum computing is now quantum safe, where we're using
Speaker 3: quantum computing to make sure that those bad actors aren't
Speaker 3: as bad as they used to be back in twenty
Speaker 3: twenty four, and that we're seeing around the corners and
Speaker 3: that we're empowering our Palo Alto relationship. That in twenty
Speaker 3: twenty nine is the premiere type of capability that people
Speaker 3: are looking at when they think of what used to
Speaker 3: be AI. Now is quantum capability.
Speaker 4: Yeah, yeah, I think for AI, everyone's just using it
Speaker 4: as part of their job. The way email was an
Speaker 4: innovation in the nineties, the way you know cloud was
Speaker 4: an innovation in the twenty tens, and we thought, how
Speaker 4: are we going to use this? What impact is it
Speaker 4: going to have on productivity? All these people who are
Speaker 4: spending their days typing up memos, like what are they
Speaker 4: going to do? We're going to be past that fear
Speaker 4: and we're all going to understand that it is this
Speaker 4: like truly positive force multiplier. For you know, every employee
Speaker 4: is able to do their best work and spend their
Speaker 4: time on the things that only they can do, and
Speaker 4: then the AI is doing the rest of that for them.
Speaker 3: Right, AI is fun to enable many things to work together.
Speaker 3: It won't be just one language model. We won't even
Speaker 3: think about. It will be the difference between you know,
Speaker 3: Malcolm having a fax machine, stereo and a telephone and
Speaker 3: a memo board. Now it's in your pocket and it's
Speaker 3: all one thing and you don't even call that, you know.
Speaker 3: I said, walk them into my kids the other day
Speaker 3: and they're like, what's a walk man? So I do
Speaker 3: think it will. It'll be part of the past and
Speaker 3: it's it will be the thought of the seamless connection.
Speaker 3: That is secure seamless connection, of HR, of finance, of distribution, logistics,
Speaker 3: of billing, all of those will have a capability to
Speaker 3: work together.
Speaker 2: Yeah, I have to do some social quick fire questions
Speaker 2: you guys ready.
Speaker 3: All right?
Speaker 2: What's the number one thing that people misunderstand about AI?
Speaker 3: The reliance on data? What do you mean by that?
Speaker 3: I think that it's just assumed that it's happening and
Speaker 3: it can just go out and grab data anywhere.
Speaker 2: Yeah, you have.
Speaker 3: To have good data, reliable data, and access to the data.
Speaker 4: I mean people are too afraid of it.
Speaker 2: Checkbox and image generators are the biggest things in consumer
Speaker 2: AI right now. What do you think is that next
Speaker 2: big business application?
Speaker 3: I think it's the tying together of multiple capabilities. I'm
Speaker 3: hinted towards this earlier is I think tying together the
Speaker 3: disparate systems that sit in different parts of the organization
Speaker 3: front office, back office, making it one office and tying
Speaker 3: together those different functions. That's it.
Speaker 4: I mean, it's workflow automation. I think back to your
Speaker 4: point on the reliance on data seems easy. It's a
Speaker 4: lot harder than you think, because you have to have
Speaker 4: everything set up in exactly the right way to get
Speaker 4: all of your systems automated and the sort of the
Speaker 4: more boring jobs taken care of so that humans could
Speaker 4: do the strategic ones.
Speaker 2: How are you already using AI in your day to
Speaker 2: day life?
Speaker 4: I mean I use it at work all the time,
Speaker 4: and then I've found right now I go to chat,
Speaker 4: GPT instead of Google to look things up. I like
Speaker 4: having a conversation.
Speaker 3: We have a wonderful capability in our consulting business called
Speaker 3: our consulting assistant, and consulting advantage is the proper name
Speaker 3: for it, but I look at it as that assistant.
Speaker 3: It's a force multiplier for me. So if I need
Speaker 3: to pull together content proposals with the teams, we go
Speaker 3: straight to that.
Speaker 2: We are one more we hear, so many definitions of
Speaker 2: open related to technology. How do you define it and
Speaker 2: how does the concept help you innovate?
Speaker 4: By definition? In cybersecurity, you don't want to be too open, right,
Speaker 4: So I think we enable openness with this concept of
Speaker 4: zero trust and saying like everyone's invited in as long
Speaker 4: as you have the right credentials, right. So that's that's
Speaker 4: one way, and then the other way is just making
Speaker 4: sure you're connected to all the different systems in order
Speaker 4: to be able to have that visibility and see what's happening.
Speaker 4: Because if you are blind, that's the minute you have
Speaker 4: that vulnerability.
Speaker 3: Yeah, and I'd say it's moving quickly with security. It
Speaker 3: sounds contradictory open. Oh then that means you're not safe. No,
Speaker 3: you are safe and you can move faster.
Speaker 2: Yeah, thank you so much. It's fun.
Speaker 4: Thanks a lot, Thank you great. We'll see you in
Speaker 4: five years.
Speaker 2: Yea years, five years, man, I'll be old in five years.
Speaker 2: Thank you to Jason kellyot IBM and Christy Fredericks at
Speaker 2: Palo Alto Networks for that fascinating conversation about the threats
Speaker 2: and opportunities in cybersecurity today. As Jason and Christie stressed,
Speaker 2: AI can be a force multiplier for enterprise across industries.
Speaker 2: When you're working with multiple products and have your data
Speaker 2: in distributed environments, you need technology that will work across
Speaker 2: your organization, and with Palo Alto Networks platform, you can
Speaker 2: enhance cyber resiliency and simplify your operations. Through their collaboration,
Speaker 2: IBM and Palo Alto Networks are charting the future a
Speaker 2: fully integrated open end to end security solutions. Smart Talks
Speaker 2: with IBM is produced by Matt Romano, Joey fish Ground,
Speaker 2: Amy Gaines McQuaid, and Jacob Goldstein. We're edited by Lydia
Speaker 2: Jane Kott. Our engineers are Sarah Bruguerer and Ben Tolliday.
Speaker 2: Theme song by Gramoscope. Special thanks to the eight Bar
Speaker 2: and IBM teams, as well as the Pushkin Marketing team.
Speaker 2: Smart Talks with IBM is a production of Pushkin Industries
Speaker 2: and Ruby Studio at iHeartMedia. To find more Pushkin podcasts,
Speaker 2: listen on the iHeartRadio app, Apple Podcasts, or wherever you
Speaker 2: listen to podcasts. I'm Malcolm Glapham. This is a paid
Speaker 2: advertisement from IBM. The conversations on this podcast don't necessarily
Speaker 2: represent IBM's positions, strategies, or opinions,