As an emerging technology, there are a lot of questions about who owns the risk inherent with new AI and LLM-based tools. But even though this technology offers exciting new possibilities, haven’t we dealt with this issue before? Whether it’s the cloud or mobile devices, why are we relitigating this conversation with AI?

This week’s episode is hosted by me, David Spark (@dspark), producer of CISO Series and Mike Johnson, CISO, Rivian. Joining us is our sponsored guest, Jason Clark, chief strategy officer, Cyera.

Got feedback? Join the conversation on LinkedIn.

Huge thanks to our sponsor, Cyera

Full Transcript

Intro

0:00.000

[Voiceover] Best advice for a CISO. Go!

[Jason Clark] So, I’m a former CISO-turned chief strategy officer, so I like to give CISO strategy advice. And first, strategy hasn’t changed for 15 to 20 years. The tactics is what’s changed. So, here’s my six bullets on strategy for CISOs. You do these six things right, you’ll be successful. Number one, know thyself, especially your data, where it is, etc. Two, minimize the attack surface. Three, complicate unauthorized access. Four, rapidly detect and respond to contained incidents. Five, maximize operational excellence. And six, align to business priorities.

[Voiceover] It’s time to begin the CISO Series podcast.

[David Spark] Welcome to the CISO Series Podcast. My name is David Spark. I am the producer of the CISO Series. And joining me as my co-host, you love him, you know him. His name is Mike Johnson, and he is the CISO for Rivian. Mike, say hello to the audience.

[Mike Johnson] Hello, audience. Glad to be with you today.

[David Spark] He is, as am I. We are available at CISOseries.com. If you have not spent at least half of your day there, you’re spending too little time, so head on over there now. Well, actually, no. Stay with us on the podcast. What I’m saying, I don’t want to distract you, focus on one thing.

[Mike Johnson] Spend the other half of your day there.

[David Spark] Yes, exactly. The other half of the day. Cyera is our sponsor for today. Thrilled to have Cyera back on. They are the holistic data security in one cloud platform. Cyera, we’re going to be talking more about them today. And in fact, they’re responsible for our guest, who I will introduce in just a moment. But first, Mike, here’s something that just kind of dawned on me, why, it just dawned on me a couple of weeks ago, and now I’m realizing it.

[Mike Johnson] Okay.

[David Spark] Everybody who listens to podcasts or I’m going to say mostly in our field, I won’t say anybody, we listen to them when we’re not working. So, we listen to professional podcasts, business podcasts, but yet when we’re not working. Let me ask you, do you ever listen to a podcast while you’re working?

[Mike Johnson] No, I don’t. And the reason is I want to concentrate on the podcast, or I want to concentrate on work.

[David Spark] On your work, vice versa. Yeah.

[Mike Johnson] Doing both, you can’t do. It’s an interesting observation, but I think it’s very much along the lines of any self-improvement that we’re doing anyway, if you’re reading a management book or something like that, you’re not doing that while you’re kicked up at your desk at work. That’s something that you’re doing to…

[David Spark] But we go to webinars when we’re at work.

[Mike Johnson] Those are more interactive. They’re also quite often live, and so you don’t get to pick the time. So, you don’t really have a choice. So, I wouldn’t put those in the same bucket.

[David Spark] I would say also professional YouTube videos. People usually watch those when they’re working.

[Mike Johnson] Probably 50/50.

[David Spark] I would say 50/50. But I think podcasts, nobody listens to them when they’re working. And for that reason, this episode drops just for the July 4th weekend. By the way, we see our stats no different during holidays as in regular, and that’s because people are listening when they’re not working. Yes? And that’s the key thing.

[Mike Johnson] You listen when you have the time.

[David Spark] Exactly. Let’s introduce our guest, who we’ve had on before in other incarnations, and thrilled to have him back on again as well. He is the chief strategy officer. In fact, you heard his voice before. He used to be a CISO. He still has the CSO title, but the S part is strategy, not security, although he works in security. So, maybe he could be the CSSO, maybe chief security strategy officer, or I don’t know. I’ll ask him.

[Mike Johnson] I think you’re overthinking it, David.

[David Spark] I’m overthinking it?

[Mike Johnson] Yeah, I think you’re…

[David Spark] He’s our sponsored guest today, and it’s none other than Jason Clark. Jason, thank you so much for joining us.

[Jason Clark] Happy to be here. And I think that knowing security and knowing strategy is together, so it’s a perfect integration to be both and do both and help both my company and the industry.

What about THIS AI security challenge?

4:07.797

[David Spark] Who owns risk with emerging AI systems? Now, this question came up as part of Stanford’s expansive AI Index Report, which found a resounding 89% of respondents said the developers of foundational models are “responsible for the mitigation of all associated risks,” as opposed to organizations actually using them. So, the index also looked into what security measures organizations are taking to get ready for the expansion of AI tools. These measures include – and get ready – basic security hygiene, vetting third parties in their supply chain, dedicated AI-focused cybersecurity personnel, technical AI-specific cybersecurity checks, and dedicating resources to integrating AI security into existing practices.

Now, the survey found 10% of organizations had none of these operationalized. On average, companies had 1.9 implemented out of the 5. Mike, we hear a lot about the potential security dangers of AI. It seems the danger is security is always lagging behind. Or is this really a very aggressive way of looking at getting prepared? What do you think?

[Mike Johnson] I’m confused by the list because if you look at it, these are typical cybersecurity practices that there’s been a touch of, but with AI. You could actually rewrite this entirely and just substitute AI for software development for a different perspective. It’s not really anything specific to AI, as near as I can tell. And I think, again, looking at the respondents, unless you’re a company who’s actually building foundational models, AI is just more software, or it’s another cloud service, or something like that. I don’t see it as something that needs to dedicate people to it perspective.

I do think security’s always in danger of falling behind with new technologies. The cloud was the last best example we had, where you had cybersecurity saying, “The cloud is scary, don’t use it.” And AI is the same. We’re doing this all over again with a new technology, and we need to figure out how we can help our businesses integrate AI. I think the opportunity here for us is to find ways that we can encourage the business to safely use AI, basically take away the sharp edges for them and empower the company. I think that’s really the opportunity here.

[David Spark] All right, Jason, I’m throwing the same question to you. It’s interesting. There was a while ago, the Ponemon Institute put out a report saying the whole theory of AI in the background was, oh, you’re going to be able to reduce your staff. Which, by the way, never happened. But the Ponemon Institute found, oh, no, the complete opposite happens. You have to increase your staff when you’re trying to include automation or AI. What’s your take on all this?

[Jason Clark] The first part of the question is who owns the inherent risk? And it should be, it’s really a shared responsibility model, just like we have that for cloud, right? So, that’s easy, I mean, and if you Google how to build a bomb, and you make a bomb and you use that bomb, who’s at risk? It’s not Google. It’s not the website that told you how to build the bomb. It’s the person that built it. And so it’s how you use these things, in my view. But on the security side, I think that, one, this is, I kind of use the brakes on the car analogy that everybody knows and has heard a thousand times, but I view it as what’s happening, and what will happen, in my view, to most businesses is this is like your company getting a brand-new Formula One engine in a car. Or maybe even changing out the car in specific business units or applicational use.

And we do need to change our tactics. And that means if your car was doing 60 miles an hour, and all of a sudden it’s doing 200, you need new brakes, you need new tires, you need new springs, you need new seatbelts. So, I do think that there is a tactics change. Again, strategy is the same, like my earlier comments of strategy, but the tactics need to change. And I think that there are times where having a dedicated person in a large company focused on AI security to cut across all of your other teams for a short term, like an overlay, to drive it in and wake up every morning saying, “What are we doing about this?” can be a good thing. I don’t think it’s for everything. I think it needs to be built in. But it, to me, is something that I am seeing be done successfully in large organizations that are significantly thinking about their data and AI.

We’ve got both types of issues – compliance and regulation.

8:53.278

[David Spark] Does anyone have a handle on the new SEC reporting requirements? Now, these require reporting “material” cybersecurity incidents to the regulator. I must just say, everyone has gotten wound up on that one word, “material.” But there’s no agreement on what that means, that criteria, and who meets that criteria. So, this has seen some public companies going so far as to adding contract languages allowing them to take over incident response when a third party gets breached, noted Rob Lemos in Dark Reading. Now, even the SEC seems frustrated by the confusion, putting out statements saying firms are overreporting non-material incidents and causing a glut in their review process. My feeling is they may have caused their own problem too.

So, I’ll start with you, Jason, on this. Does anyone have any idea of how to comply? Or are we just going to be guinea pigs until the SEC “knows materiality when they see it,” and they come down on someone one day, and then we all find out? Because I feel this is exactly the same story as GDPR because that had fuzzy language too, and we’re like, “I guess we’re going to find out what happens.” What do you think, Jason?

[Jason Clark] I think that if they’d stayed with the financial materiality thresholds only, this would have been much more clear.

[David Spark] And explain what that is.

[Jason Clark] It’s like 5% rule, right? Auditors make decisions on, okay, is it material? Does it change the stock price or earnings by essentially a misstatement by 5% rule or less? That’s kind of what the gap materiality is. And so that’s commonly used, but instead, they’ve added language that essentially says what’s qualitative is a catch-all, which is just quoting this, right? You must report if there’s substantial likelihood that a reasonable shareholder would consider it important. That’s extremely vague. That freaked everybody out, right? And so all of a sudden, you add the SolarWinds stuff in with that, and then the enhanced 10k [Phonetic 00:10:59] language, and it created a storm of panic. And I think that’s kind of a problem that has been created by the vagueness by the SEC.

[David Spark] Mike, where do you stand? I mean, I got to assume you have to have conversations with your legal team about things like this. Like, “This is what we read,” and everyone puts up their shoulders, “I don’t know, what does that mean?” Or do they know what it means?

[Mike Johnson] I think on the one hand, the SEC was deliberately vague here. Your illusion or comparison to GDPR, I think, is a good one. They weren’t really sure where the bright lines should be. What’s material to one company is absolutely immaterial to another. The 5% rule that Jason mentioned, 5% of $200 billion is very different than 5% of $20 million. And so I think the vagueness of the language was to try and allow for that. But ultimately, I think really what the SEC is wanting is that companies actually consider whether or not an incident is material and have processes in place to define a decision matrix to say this is material, this reaches our threshold. And yes, you absolutely have to have your lawyers involved. I mean, this is not a decision that an incident responder is making in a vacuum.

[David Spark] But let me pause both of you because my whole thing is we’re all a bunch of giant guinea pigs just waiting, who is the hammer going to fall on? It’s going to fall on somebody, and somebody is going to break some imaginary line, and nobody exactly knows where it is. And maybe someone will do it so egregiously, it’s like, “Well, yeah, obviously that case.” But we don’t exactly know yet. Is there a fear of we are guinea pigs and hence, why the overreporting is going on? And now they’re annoyed, the SEC?

[Mike Johnson] I think for an industry that really operates within ambiguity, that’s where cybersecurity lives is kind of in the margins and in the edges, where there really aren’t bright lines. We’re not going to get bright lines here because it’s going to differ so much from company to company. And we also are going through a period where everyone is asking for companies to be held accountable for their security and for security breaches. And then as soon as a regulator comes out to try and do it, everyone panics and says, “No, not that.” So, yeah, it is going to be ugly for a while, but this is what it takes for us to actually get to regulation. We have to try a few things and learn and fix it. And over time, we will get better. Maybe a hammer does come down and everyone learns from that. But time will tell, and it’s going to be squishy till we get there. If there were bad bright lines in here, nobody would like that either.

[Jason Clark] For sure. I think it’s good for transparency though, just to be clear. It is good for the industry, and it will self-correct itself. In my conversations, I’ve had this with a hundred CISOs, and my next-door neighbor’s a lawyer that actually has this discussion every single day with their own company on every single incident they deal with. And the companies already have a disclosure committee that handles SEC regulations and have familiarity with this for other topics, not cybersecurity, have this well under control. This is nothing new. The part that’s new is the cybersecurity part, and it’s freaking the CISOs out. But I think this is good.

Sponsor – Cyera

14:35.113

[David Spark] Before we go on any further, let me tell you about our awesome sponsor, and that’s Cyera. That’s where Jason works. So, data is the largest and fastest growing security attack surface in the world. Every business is using data to collect insights and create new products, but they have to do so without placing the business at risk. And yes, data does that. So, solving data security starts with knowing your data, and this is where Cyera’s data security platform can help. This is what they do. Discover your data attack surface. That’s key. Monitor, detect, and respond to data risk and help govern data use.

Imagine if your organization’s OneDrive was compromised by ransomware. Would you know what data was in the OneDrive? Would this trigger an actual compliance issue? And how much would it cost you to use outside counsel to determine materiality? Hey, this is just what we’re talking about. So, Cyera delivers the insights you need. It all starts with their agentless approach to data discovery, which occurs across any environment – cloud, SaaS, even on premises – making deployment fast. And Cyera’s classification is based on their own LLM and has an accuracy of 95%. Companies like Paramount Pictures who trust Cyera to discover their data, its sensitivity, and who has access to it. To learn more, you got to go to their site, and it’s sierra.io. Go check it out.

It’s time to play “What’s Worse?”

16:18.376

[David Spark] Jason, I know you know how to play this game. Two crappy scenarios. You have to determine which one is worse. I am going to make Mike answer first. And while I made a call out, by the way, to the community to give me some “What’s Worse?” scenarios, and I got a bunch in the hopper that we’ll use in future shows. This one I got from BadThingsDaily, which is a…

[Mike Johnson] Oh, them again.

[David Spark] …a Twitter handle. And so I just picked two that I thought were comparable, and I think these are two good ones. So, are you ready, Mike?

[Mike Johnson] I thought we’d agreed we weren’t going to pull from them again.

[David Spark] No, no, we didn’t agree. You thought that.

[Mike Johnson] I agreed.

[David Spark] There was no agreement that was made. I definitely didn’t… I didn’t send you in a contract.

[Laughter]

[Jason Clark] I’m scared.

[David Spark] All right, here you go. Scenario number one. Your e-signature vendor has announced a breach. So, it’d be like a DocuSign. They announced a breach. But we didn’t say, by the way, DocuSign did not have a breach. This is all imaginary, by the way. I don’t want any letters from DocuSign. So, your e-signature vendor has announced a breach. All your contracts have been exposed to an unknown adversary. So, every contract you have, some unknown adversary has got them. Scenario number one.

[Mike Johnson] Okay.

[David Spark] Scenario number two. Classified documents are now being distributed publicly from your servers. That’s it. Who knows who’s got them? Your eyes lit up on that one.

[Mike Johnson] Okay. I know you’re just picking two at random.

[David Spark] I think I know where you’re going to but go ahead.

[Mike Johnson] I think I know where this one’s going but didn’t expect the classified documents curveball. So, first scenario, you’re a commercial entity. You’re doing business with all manner of other businesses. There may be really trade secrets or deals that you just don’t want in those contracts exposed. Maybe you’re Google who pays $5 billion to Apple for search placement or something like that. You don’t want that out there. The other is classified documents. You are a defense contractor. You are a government entity of some sort.

[David Spark] Well, I didn’t say that, but you’re saying that.

[Mike Johnson] Well, to actually get access to classified documents, there’s really only a few ways that you can do that. So, to be in a possession of a cache of classified documents, I’m making an assumption.

[David Spark] Yeah. Okay. But the other thing is, I just say they’re public distributed, which is not good, and we got to assume adversaries are going to get access to it. Maybe or maybe not. Who knows? Probably. But in the first scenario, adversaries definitely have it, and one that doesn’t like you.

[Mike Johnson] Yes. But in the second one, again because we don’t fully notice the scenario, classified documents means something very specific. I’m in the US. I’m going to assume US federal regulations around classified documents, they don’t care that you’re distributing to public or to adversaries, they’re going to be very unhappy with you. That really is the worst scenario.

[David Spark] Is unhappy just a polite way of describing it?

[Mike Johnson] That is the polite way of describing exactly what’s going to be coming your way very quickly.

[David Spark] Okay. So, you’re saying the second scenario is far worse.

[Mike Johnson] Correct.

[David Spark] All right. I throw this to you, Jason, do you agree, or you disagree?

[Jason Clark] I agree. And certainly every industry is different and there are industries where it’s potential that the first one is worse. If you don’t really have any intellectual property, and you’re really kind of more of just a sales and marketing company, and you don’t want what you’re selling things to disclosed.

[David Spark] Yeah, the second scenario, if it’s a government entity, that is off the charts worse.

[Jason Clark] Or anything intellectual property. Right? But I still go with the second one. And the reason is when DocuSign’s compromised – not that they are, we said that already – but whatever third party’s compromised, there’s a lot of other people that are also compromised. And there’s a little bit of a, okay, thousands of other people that potentially are compromised unless obviously it was credentials, and it’s just your environment, but there’s an aspect of there’s a third party potentially to blame. And you have blame in that, but it’s far less worse than your internal systems. In my view of classified documents, that means you personally were breached, not a third party, right? Well, you should have had control. So, you have blame for both.

[David Spark] That’s a good point.

[Jason Clark] But the second one is you were breached, and that’s way worse.

Please, enough! No, more!

20:58.080

[David Spark] Today’s topic is data security, and this is a big, big one, Mike. All right? So, just give me the Cliff Notes, highlights on your, your response here. What have you heard enough about when it comes to data security, and what would you like to hear a lot more?

[Mike Johnson] I think people make assumptions when they hear the term data security. They actually jumped to security of data, and it’s just a matter of preventing people from accessing it because it just comes back to that native access control, and that’s how they think about data security. That’s where the mind goes. What I’d really like to hear more of though, is how we can empower employees with access to data. Not prevent them from getting it, but control the data, protect the data still while empowering the business, while empowering the employees. That’s what I’d really like to hear a lot more about.

[David Spark] I like it. All right. I throw this one to you, Jason. Jason, and I will set people up. This is really Sarah’s bailiwick here, but let’s start with you. What have you heard enough about with data security and what would you like to hear a lot more?

[Jason Clark] I think people think too much that data security is, “I have a DLP solution.” And without understanding where your data is and how important it is, DLP is a further down control. And if it’s not informed correctly, it’s only as valuable as the input. And so the accuracies has a lot of challenges. What I’d like to hear more of is people realizing that data security’s the number one thing information security, I’m not saying cybersecurity there, its job is to protect, right? It’s about information. That’s our job. And we are super mature on a lot of aspects. We talk a lot about threats and a lot about vulnerabilities. But if you ask most CISOs, even the largest ones, how mature is your data security program? It’s going to be one of the lower maturity things they’ll talk about, and it’s the most fragmented space. Next is identity. But those are two very fragmented spaces. And I think that’s a big challenge.

[David Spark] That’s a really good point. So, let me throw this at you. I’ve talked to many about data security, and correct me if I’m wrong here, it just really boils down at the very beginning. Can you find it, and can you classify it? Because it’s that very beginning step that if you can’t get that right, nothing else can happen.

[Jason Clark] Yeah, exactly. And if you think about creation of data, you create data, then you discover it, you need to classify it, how important it is, then you need to govern it, protect it, control the flow of it, monitor it all across. How is the risk state changing? There’s no data risk platform. And then respond to any incidents around that risk changes. It could be the worst case of breach, or it could be just somebody exposed something that we need to react to. And then the last thing is destruction. That’s the life cycle of data, right? The destroying, the cleaning up.

By the way, we’re data hoarders. If we were a house, we wouldn’t be able to even walk in it. And so there needs to be something over top of the whole life cycle, kind of being the brain of your data security. But you can’t get it right if you don’t know that Sun Tzu, know thyself. Well, data is the main asset, and you have to discover and classify it before you can properly do everything else.

[David Spark] And the way you just described it, it sounded so simple, but that very beginning stage of you create the data, then you classify it. I think we just create the data, and then the rest of your story, for most, is forgotten. Yes? I mean, that’s kind of the problem everyone’s in right now.

[Jason Clark] I think this was an impossible problem. I know this was an impossible problem for the last 20 years. I’m going to say this. There is not a chief security officer I talked to or a CISO I talked to who will answer, do they know everywhere their data is, everywhere it’s sprawled, the materiality of each of those environments. I’ll use OneDrive. I have not had CISO that told me they know the materiality of all of their data in OneDrive unless they’re using us as an example. And then who has access and what they’re doing with access. All those things have been in separate systems historically, right? But they definitely couldn’t answer the first two.

And so this is an impossible problem. I view it as it’s like we had a bunch of four- and five-story buildings in a village, and now we’re able to build skyscrapers. But you couldn’t ever build a skyscraper unless the foundation was built properly, and that starts with discover, classify. And it was an impossible problem. And AI, like we talked about earlier, the power of AI has made that doable. It has made it easier to discover. It has made it faster to discover. And it’s absolutely made it possible and much easier to classify and not putting the onus on the people.

[David Spark] That is really interesting that you’re leaning into that. So, I want you to give us a little more details of how Cyera is doing, but I’m intrigued with that. Can you describe to me how AI is actually turning what seemed like a tantamount, like, “Well, we kind of blew it. We already generated all this data.” I don’t know. Let’s just start with OneDrive, the example you gave before. How is it able to understand what I have, the sensitivity of it, the materiality? Explain what AI is doing here.

[Jason Clark] So, I’m just going to give a really simple example that I tell people to do. Write on a piece of paper, Confidential Mergers and Acquisition Strategy. And then say, “We plan to acquire,” and write five company names. And write, “We’re willing to pay,” and write dollar amounts next to those five company names. Take a picture of it on your phone, use your company email, and email it to somebody, right? Myself or anybody, or your own personal account. Watch that DLP, that probably the five or seven different data security solutions you have won’t do anything about that.

And then take that same document and just upload it to Chat GPT-4 and say, “What is this?” And it’s going to say, “This is a handwritten document, looks very sensitive, looks like a mergers and acquisition strategy. And these are what you’re willing to pay for these companies.” By the way, you can prompt it and say, “Well, what are those companies actually valued at right now?” You can prompt it. My point is, is that’s a very simple example of how DLP has failed us for our whole lifetime because technology didn’t exist to make it awesome and how it changes with AI.

[David Spark] That is a really, really good example. And we’ve been having examples of this recently. We’ve had them look at contracts that make sense of it. So, it not only can classify, it can actually truly make sense of these documents too. So, it’s not just slapping one or two database labels on it. It’s actually a deep understanding. Yes?

[Jason Clark] Exactly. It’s game changing. These things weren’t possible before. That’s what I’m saying. It’s taken an impossible problem. We weren’t able to build these skyscrapers before.

[David Spark] So, you couldn’t do this to this level, say, three, four years ago.

[David Spark] Correct. Not possible.

[David Spark] So, in closing right now, what is it that you want to let our audience know about where you guys are with Cyera?

[Jason Clark] Our vision is to really help transform data security, solve, to me, the biggest problem in cybersecurity. The number one reason we exist as an organization is to protect data. And to truly build a platform that understands everything about your data, all of the context, who uses it, how protected it is, and how the risk state changes on a continuous cycle and respond and alert you to those state changes. And really, make your job much more significant to the business as you do that because the value of once you know where data is and how important that data is, you don’t just start solving security use cases.

I believe this elevates the CISO to solve a lot of other things for the business, for the chief data officer, for innovation, for privacy, for legal. I mean, all across the board, you can start doing things. Even saving money because you understand how much redundant data you have and how you can clean that up. And that’s a security risk because you’re reducing attack surface. But it’s also a cost savings on why do we have one third of our data sitting in this environment or this cloud, but it hasn’t been touched for two years and it’s all redundant?

Do you trust this LLM?

29:48.110

[David Spark] Can GenAI help get us out of the cybersecurity skills gap? So, LLM-based tools could help entry-level SOC analysts improve their skills, argues Maria Korolov in CSO Online. She outlines some possible use cases, such as using LLMs to develop first drafts of investigation reports, and explainers for analysts, or it can work as an advisor trained on internal data that can answer questions, and as a way to review compliance policies. Mike, have you tried GenAI for any of these use cases? And do you think we can view this as a way to upskill analysts in the SOC?

[Mike Johnson] So, it’s funny that the first use that I’ve heard of generative AI by cybersecurity teams has been related to security questionnaires. And I’ll get to the SOC analyst question, but I’m amused that everyone was so excited about generative AI, and then they said, “Oh, let’s have it read questionnaires. Let’s have it read questionnaire responses.” And then you end up with generative AI talking with generative AI and bots are talking with bots, and that just amuses me to no end. For the SOC analyst, I mean, I’ll straight up say Maria has some great ideas in here that we haven’t tried yet. I think there’s still a gap in terms of how you bridge the generative AI technology with the day-to-day analyst workflow. How do you bring that together? There’s some glue that doesn’t exist yet. That’ll come with time. And I think that will then allow us to really reap the benefits of how we can make our analysts more efficient.

Generative AI is great at looking at massive amounts of data and summarizing. One of my favorite usages is to hand it a very large document and say, “What are the top 10 things I need to really pay attention to in this document?” And it can come up with that very quickly and usually pretty accurately. So, I do think that’s the future that we’re heading towards is putting large amounts of data and then summarizing that data to draw the analyst’s attention into the obvious areas. We still have to figure out how we deal with the needles in the needle stack. It’s not necessarily going to find that one event out of the million. Maybe we get there, but I think there’s still some research that needs to be done before we get to that level of comfort with it.

[David Spark] All right, Jason, I throw this to you. And actually, this sounds very much in the wheelhouse of what you’re doing over at Cyera, yes?

[Jason Clark] Yes, but let’s kind of keep it to the SOC though because I also do own security here as well because security is very important to us being a cybersecurity company, and Lamont Orange came over with me as the CISO here. And what I’ll say is humans suck at doing repetitive, mundane work, especially at scale. Who sits in a SOC for their whole career or for very long at those tier one, tier two jobs? I’ll give an example as well, that the human brain can take in 6 bits of data per second, in just your eyes or ears, and your brain can process 50 bits of data per second. I’ve read that the brain can total store 2.5 petabyte of data max in your total memory of your total life. Obviously, AI far surpasses the speed and amount of information it can ingest and output. Right? And so that’s just a simple example of us throwing people at a problem versus AI at a problem.

My example of what we’re doing with analysts is we have tons of customer contracts. And so if there’s any type of potential incident in any way, we want to know, okay, how does that relate? Or if there’s a compromise for any company, how does that relate to their 10,000 customer contracts, and all the compliance requirements across 10 different countries? And so what we’d have to do historically is take that to the GRC team and to the legal team and go figure all that out and go through that data versus being able to build a model and prompting the model on this.

And so that’s just, to me, one example of how certainly we can help tier one analysts be more efficient, but this is overall. I’m kind of saying persona-based work, expanding to other personas, and we’re able to do more things interconnected from an incident the SOC sees. So, then they can know how to deal with something quicker. Especially when it comes to compliance-related stuff because that is, as you mentioned, it’s about large amounts of documents and looking across all these things that are moving, right? These regulations and keeping up to speed on that. So, I think that’s a perfect use case. Excellent.

Closing

35:06.785

[David Spark] And we will bring it right to a close right there. Awesome use cases, in fact. And by the way, love all these sort of examples and scenarios you made throughout this episode. In fact, I think you win the prize for having the most of anybody or any guests we’ve ever had on this show. So, thank you very much, Jason. That was Jason Clark, who is chief strategy officer over at Cyera. Cyera, who sponsored this fantastic episode, holistic data security in one cloud platform. Remember, go to their website, cyera.io. I’m going to let you have the very last word, but first, Mike, any last thoughts?

[Mike Johnson] Jason, thank you for joining us. I loved the conversation about the importance of data security. You wove that in throughout the entire episode, and I really think it’s a good perspective for folks. And I think one of the things that you said that people should really take away is that reminder of data is the main asset of our companies, and the main asset that we should be protecting. And I really do think that’s something that folks should be focusing on. And aligned with that, you were talking about inventory. If we go back to our standard fundamental controls, CIS top controls, at the very top is know your assets. So, I think it’s a good reminder of folks to really recognize the importance of data, go understand it, and be able to then build a program on top of that. So, thank you for those reminders. Thank you for the tidbits. And I really appreciate you joining us today, Jason.

[David Spark] Jason, any last words? And if you have an offer for our audience or anything on how they can reach you, let us know.

[Jason Clark] So, first is this is the best podcast in the world.

[David Spark] We love hearing that.

[Jason Clark] And it’s doing good for the industry. And I’m very passionate about this industry because I’ve been in it since I was 17 and nothing else my whole life. Joined the Army and done cybersecurity ever since. And that’s why data security really matters to me because I believe it’s the next big thing we need to take on. There needs to be something that can see our data everywhere and protect it and understand the risk that it’s at wherever it is. And my offer is to engage with us, whether it’s me directly on LinkedIn or any one of our team members. We want to come in and help you build a strategy around data security, especially as your business is adopting GenAI. We want to help you build that roadmap and come help you discover and classify and then build the rest of the journey. We want to go on a multi-year journey with you on getting our arms around this thing and taking the security program to the next level.

[David Spark] That is awesome. Well, a link to Jason’s LinkedIn page will be on the blog post show notes for this episode. So, you can just go there and see it as well. Thank you very much, Jason Clark with Cyera, and Mike Johnson with Rivian, and me, David Spark with CISO Series. We greatly appreciate your contributions and for listening to the CISO Series Podcast.

[Voiceover] That wraps up another episode. If you haven’t subscribed to the podcast, please do. We have lots more shows on our website, CISOseries.com. Please join us on Fridays for our live shows – Super Cyber Friday, our virtual meetup, and Cybersecurity Headlines Week in Review. This show thrives on your input. Go to the Participate menu on our site for plenty of ways to get involved, including recording a question or a comment for the show. If you’re interested in sponsoring the podcast, contact David Spark directly at David@CISOseries.com. Thank you for listening to the CISO Series Podcast.