Security teams face two persistent challenges: alert fatigue and security product fragmentation. Organizations generate endless streams of alerts from dozens of disconnected tools, creating an overwhelming operational burden that leaves teams reactive rather than proactive. The problem intensifies as AI-accelerated attacks arrive at internet speed, exploiting the gaps between fragmented security products while defenders struggle to make sense of the noise. Traditional tools generate alerts in silos, making it nearly impossible to identify the attack patterns that matter before a compromise occurs.

In this episode, Peter Worth, founder, president, and CEO at Athena Security, explains how their security operations platform addresses these challenges through unified detection and response. Joining him are Jason Taule, CISO at Luminous Health, and Will Gregorian, head of security at Galileo Medical.

Want to know:

• Why are security teams still struggling with alert fatigue despite decades of awareness?
• How does security product fragmentation create blind spots in enterprise defense?
• What’s the difference between indicators of compromise and indicators of attack?
• How do AI anomaly detection systems avoid declaring malicious activity “normal”?
• What strategies prevent model drift and adversarial poisoning in AI-based threat detection?
• Why does each client need their own behavioral baseline model?
• How do open source foundations impact enterprise security platform reliability?
• Why are CISOs increasingly held personally accountable for security incidents?

Got feedback? Join the conversation on LinkedIn.

Huge thanks to our episode sponsor, Athena Security Group

Full Transcript

[Voiceover] Connecting security solutions with security leaders. Security You Should Know starts now.

[Rich Stroffolino] Welcome to Security You Should Know. I’m your host, Rich Stroffolino. Today, we’re going to be talking about Athena Security and what they’re doing in the security operations platform space. Lots of important work there, vital for every organization here, and we can’t wait to learn more.

I’m super excited to dig into, but first, we’ve got to get into one of the overall problems that they’re addressing, and that’s two big ones in the industry: alert fatigue and security product fragmentation.

Helping us get answers to these questions are Jason Taule, CISO, Luminis Health, and Will Gregorian, head of security over at Galileo Medical. Jason, I’m going to start with you. Why are we still struggling with alert fatigue? This phrase has been around for forever, right?

Can’t we get refreshed with alerts? Why are we so fatigued all the time?

[Jason Taule] Well, we have the non problem. We have non-stable environment, we have a non-zero chance of not having a breach, and we have a lot of non-sense that still pervades in the market. The volume of activity is non-stop growth, we don’t have unlimited funds to address that, the complexity…

We’re changing the wheel and moving the car, right?

We have an environment that wasn’t designed from the ground up with security in mind, and that’s not just on the customer side; that’s also the vendors. There’s a limit to how much they’re going to invest in their product; they’re pressured to get software and hardware to market, which means that the bad guys have a opportunity-rich environment.

All they have to do is find one or two weaknesses, and now, the worst-case thing is that we’re being attacked at internet speed with AI as a tool for the bad guys just as much as for the good guys.

[Rich Stroffolino] All right. Well, let me come to you. On the security product fragmentation space, why is this still a struggle that we’re seeing in the industry all the time?

[Will Gregorian] There is a general overlap with the security tool. There’s fragmentation there. There’s alert fatigue on the SOC side, and if you go to the Reddit cybersecurity subreddit, you’ll see a whole bunch of practitioners complaining about the fatigue.

Burnout. There is potentially…and I don’t necessarily want to capitalize on this, but I do think that there is a talent shortage, which contributes to the overall problem.

[Rich Stroffolino] All right. Well, now that we understand the problems a little bit better here, we’re going to be talking with Peter Worth, the founder, president, and CEO at Athena Security. Now, Peter, we’ve got three essential questions here, you need to help us out.

Help us understand what’s going on here. So can you explain the value of your solution to my CEO? What does your solution do? What does it not do? What are the bounds of it, and what is the pricing model? Can you help us out? Give us these preliminaries?

[Peter Worth] Yeah. So as a CISO for many decades, I’ve sat on that other side of the desk and looked at this product fragmentation, and all of these different tools that were generating their own alerts, tried to make sense of them, and very frustrated as I tried to pull all those things together.

And you combine that, as you mentioned, with the AI acceleration, Jason, in terms of the velocity and the sort of volume of attacks, and all of a sudden, what was a workable and annoyance became actually very critical in terms of cyber defense, right?

So we started a company that looked to solve those two problems, bring everything together into one platform, and handle the detection and the response problem at scale, and address alert fatigue and product fragmentation. So we’re built on an open source core from Wazuh.

It is a SIEM and an EDR platform; we’re adding network intrusion detection to that, XDR capabilities, and AI enablement. The way that we price is we have a core module, which is SaaS based. We have the ability to deliver that standup clients within a matter of days, and then we have add-on modules, we have a network intrusion detection XDR, and then we have an AI module, and then we have an MDR and a SOC.

We can actually handle the managed detection and response for you.

Those are priced based on endpoints. So we have small, less than 100, medium, less than 250, large, less than 500, and then custom, anything larger than that. And that’s the way we price and been in the market for three months, and we’re really excited about the opportunity of being able to provide some value into the space, and help CISOs that are in need.

[Rich Stroffolino] Fantastic. Well, okay, so there’s a lot to dive in here, I feel like. So let’s get to some of the questions. Will, I’m going to start with you. What other questions do you have about Athena security?

[Will Gregorian] Okay, so Peter, answer me this. Security teams. You often have a solution, the security team is going to implement it. What are the barriers that you run into when you’re proposing your solution? What’s the implementation runway? What does it look like, and what are the barriers that you run into when you’re implementing something like your solution?

[Peter Worth] That’s a really good question, and it actually spills into the third challenge that you mentioned, the talent shortage. Our biggest challenge, getting folks up and running and being able to show the visibility and the value of the platform, is getting mindshare from people that can let us in.

So we have full automation around agent deployment, and so it’s a fairly straightforward implementation. We take a subset of your network, we deploy some agents on there, and immediately, you get visibility, and you can see the power of the platform.

But the hard part is getting the person that’s in charge of the network infrastructure, getting 30 minutes from them, to be able to dedicate some time doing a quick agent install. That is, by far and away, by the way, the biggest challenge that we have across the board, and I think it is because of that issue that you already mentioned.

It’s the talent shortage. I think that’s very consistent across everybody we’re talking to.

[Will Gregorian] Do you often run into potential policies that would prohibit your agent to be installed? Do you ever get into the diligence factor? Somebody has to look at your source code. What does that look like?

[Peter Worth] Well, there’s always the security assessment piece of the puzzle, right? We’re SOC2 certified, and that includes a kind of a code scanning and revision vulnerability scan piece. We have all those controls in place, but usually, the network security teams on the other end, on the client side, look for all of that.

If they don’t want to install our endpoint, we do…and this is one of the reasons why we selected Wazuh as an open source platform on the EDR perspective, is we can actually ingest and integrate with other endpoint solutions out there, whether they be CrowdStrike or Sentinel or anything like that.

So it’s not a requirement that you install our agent. There are things that our agent brings to the table that are unique, and certainly helpful and valuable, but if you have 1,000 endpoints and you don’t want to install another endpoint on all your devices, we can also provide the same value on our platform, and we can ingest the data from your existing endpoint provider.

[Rich Stroffolino] Jason, why don’t you jump in there? What other questions do you have for Peter?

[Jason Taule] So let’s start by saying that we’re not going to have the conversation about why we should do SOC, SIEM, XDR, EDR, at all, right? I think it’s understood that that’s a given. Not that there aren’t organizations who aren’t doing that. I think there are many organizations that are hiring their first-ever CISO, and he or she may be challenged to get the organization to make that investment.

But for our purposes, let’s presume that the audience understands that’s an absolute need. So then the question is not why at all, but why you? And let’s start with that, because then I want to dig into some of the integration issues, and then how we can demonstrate value.

Why you? So what do you want companies that already have some of these existing tools that are in the same space, what do you want them to do differently? “What are your differentiators?” is another way of asking the question.

[Peter Worth] Yeah, if you’re already along the maturity cycle and you have some of these tools, let’s say you have a SIEM and an EDR, let’s say you don’t have…we run into this quite a bit, you don’t have a network intrusion detection or true XDR, and you haven’t outsourced the SOC and the MDR capability.

In those situations, usually companies are looking at a compliance standard that they’re trying to adhere to. We can facilitate that compliance with a strong background in compliance and built-in capabilities into the product. And we also have the ability to, again, as I mentioned, integrate into existing SIEM or EDR providers.

So there’s a peaceful coexistence element to that.

Why would you work with us versus bolting another product on from another vendor? Because, ultimately, if you’ve come to the realization that product fragmentation is your enemy and not your friend, if you’re…it’s starting to add different products into the picture, whether it’s adding a NIDS provider or an XDR provider on top of your SIEM and EDR, you’re ending up with another risk that you’re introducing into your platform, right?

So what you want is you want visibility across that whole stack and across your entire security operations infrastructure, and our platform gives you that ability, and we have the AI capabilities that are baked in into the framework at the same time.

[Jason Taule] So with all respect, I don’t know that I heard a meaningful differentiator there. I think there are lots of companies in this space that will say everything you just said, that “With our tool, I’ll fit with your stack, I’ll help you rationalize it, and we’ll help you achieve your compliance or whatever the objectives are that are driving you to make this investment.” So I’m not asking you to give up your secret sauce, but tell me about what your secret sauce helps me do?

[Peter Worth] Well, look, ultimately our secret sauce, as a CISO that didn’t have an incident over the course of 20 years, is we have the ability to execute. Now, I wouldn’t…as a CISO, sitting in your position, I wouldn’t take my word for it. What I would do is I would actually let us in inside the henhouse, give us a small proof of concept, and we’ll prove you that we can do it, right?

[Jason Taule] This is where I’m going, because I think most of us would say…most of us as CISOs, who have the responsibility for explaining why something happened after the fact, right? What’s the value in doing the Bake Off? I’ve been at this game a long time, and I remember when Bake Offs were things that the security RAGs did so that you could understand, “This one found and stopped this much.

This one found and stopped much more.” “Right. Oh, that’s a better solution.”

We don’t tend to do that as much anymore. We tend to do single-value PoVs. But what’s the value in any of us finding one, God forbid, actual attack or an indicator of attack that our current solution missed, right? I mean, you can’t put a price on that.

[Peter Worth] Yeah. Yeah.

[Jason Taule] If you’re saying…if you want to go into PoV or POC and you can demonstrate that or even… So part of my role as CISO is to drive efficiency through standardization and automation, and we measure the heck out of everything. So if our current measurement is, “We want to detect 90% of the events that we get hit with, with a mean time to response of 15 minutes or less,” we’re going to have that.

We’re going to be able to give you the same chunk of data, point you to our data lake or whatever, and have you come up with results that hopefully beat that, then it’s really a no-brainer. So you’ll do those kinds of things?

[Peter Worth] Yes, we’ll work with you, and we want to be able to prove our capabilities and our value. In fact, we’ve worked with some customers that want to put us under contract initially, and we’ve actually slow-rolled some of that work and said, “No, no.

Let us prove our value to you, and then we’ll be in a much better position to work together on, “What scope of deployment do you want to make, and what’s the level of investment that we’re worth, relative to the value that we’re bringing to the table?”

[Jason Taule] Excellent. So I mentioned one term there. It’s one last question if you’ll let me pull on this thread a little bit. Indicators of compromise is what most of the industry calls the things that we’re supposed to go look for to see whether the thing that somebody else got hit with is now something that is plaguing us.

And hopefully, if we belong to an information sharing center, if we belong to a SOC, and they see what’s happening across the industry, hopefully somebody else got hit before us, and we’ve got that heads up.

But it’s indication of compromise. That’s too late, right? I think the industry is slowly beginning to recognize and move to the term “indication of attack,” right? There’s a pattern there where it’s not just seeing this thing, but we typically, in the past, did not have the longitudinal reassociation of all these types of activities.

Because you can say, “Well, it’s possible that your sysadmin is doing that for a legitimate reason. But doing that and this and this, those three things, there’s no legitimate use case for that. That is clearly an indication of an attack pattern before the compromise.” So are you moving in that direction versus just using IOCs?

[Peter Worth] Yeah. I mean, I think that’s table stakes, right? I couldn’t agree with you more, right? I think that’s beyond the SIEM and EDR, that’s beyond the NIDS, and now you’re bleeding into the XDR capabilities, which are built off of AI and anomaly detection engines.

That’s a core part of what we’re building in Athena Labs, that will be integrated into the product in short order, that gives you the ability, on top of the alert-based detection mechanisms, to also look at anomaly detection across the system’s infrastructure, to identify bad actors and behavior.

That next level, that is, I couldn’t agree with you more, is a necessary condition to cyber defense in the age of AI.

[Jason Taule] Well, I can keep going.

[Rich Stroffolino] Will, get back in there.

[Will Gregorian] Jason is asking all the hard questions.

[Jason Taule] Well, no, I’m also teeing them up a softball if they’ve got a good answer.

[Peter Worth] Yeah, but the right question is… I mean, we live in a world where first it was seen in EDR, right, and then everybody was like, “Well, you need the network piece.” And it’s like, “Okay.” But then the bad actors have just gotten very intelligent.

That intelligence capability is going to increase with the adoption of AI. And so there’s all this sort of fake activity that’s coming through that looks normal. So that’s going to pass all the alert detection engines, right?

But once it looks normal, they’re off into a system that looks normal, and then a potential privilege escalation, combined with an access into a system that’s not normal. To your point, Jason, that’s the alert, right? And if you don’t have a system that’s designed to capture that, that person is inside the henhouse, and they’re exfiltrating and deploying malware while your team is single-signing on to the fourth system that determines whether or not they’ve violated any rules.

[Jason Taule] So you hit on one of the issues I’ve had for a long time with the vendors in this space. The fact that something is normal is what helps us establish a baseline from which we detect anormal, anomalous, and we alert on that.

Well, hang on a second. Just because something is normal doesn’t make it okay. If every day, at two o’clock, I have a C2 command that exfiltrates data. That’s normal. That doesn’t make it okay. And a lot of the tools, unfortunately, if they learn and they see that, and they say, “That looks legit,” because they wouldn’t know, I mean, based on how these…a lot of these AIs are trained, they just see it, and they declare it normal.

Again, doesn’t make it okay. So care to comment on how you may be able to help companies deal with that issue?

[Peter Worth] Yeah, you actually you hit the nail on the head in terms of how you design these AI products for anomaly detection, actually. So the way you train them is based upon the principles of zero trust, and that makes these tools as annoying and operationally challenging to implement as they are useful, and your baseline is zero trust.

Nothing’s okay. What you do is you deploy the system into the network and security infrastructure, and your security analysts, the intelligence… This goes back to your point around the talent shortage. Okay, this is fundamental to setting these systems up, these modern AI systems.

That analyst then looks at the alerts as they come in, which are very noisy initially, and determines whether that particular keystroke and that activity of exfiltrating that data at two o’clock is actually normal and okay. They are the gatekeepers of setting the anomaly baseline.

So even though you have a very valuable and powerful anomaly detection engine there, all of them ultimately rely on the real senior staff, where the knowledge of what’s okay and how your network infrastructure works, is fundamental to setting up the framework within which that anomaly detection engine is going to actually provide value and catch the abnormal bad actor activity.

[Jason Taule] So with your AI anomaly of threat detection models and engines, how do you prevent drift and adversarial poisoning in production? Can we give you… Tell me your retraining cadence, what your validation dataset strategy is, or every… Actually, if you have a real example, you can share with us, of how you had to roll back or hot patch a model because it started crying wolf when…or going blind to something.

[Peter Worth] Well, you need… We use the prominence space intrusion detection system. I won’t get into the technical details of that. It’s a fairly advanced system that’s just really relatively new coming out of the research community, coming out of Athena Labs, and we basically baseline on a quarterly basis, and/or whenever there’s a big network upgrade at a given client.

Each client gets their own baseline, and then we baseline on a quarterly basis.

[Jason Taule] Oh, okay.

[Peter Worth] That baseline is presumed to be benign. In the event that we identify that a given baseline is not benign, and it’s been corrupted, we will then revert back to the prior baseline, and that’s what we would implement.

[Will Gregorian] The operators don’t have access to that?

[Peter Worth] No, we handle that on behalf of the operators. The operators provide the input to tell us whether or not the activity, once we baseline, is normal or abnormal, but they’re not involved in the training and the resetting of the configuration of the model itself.

[Will Gregorian] Got it. And this is unique to each client?

[Peter Worth] Yeah. Each client has their own model because they have their own network topology, and they have their own behavioral structure that is normalized, right?

[Will Gregorian] Gotcha. One question that I have is the investment in open source. It’s pretty risky if the open source project, for whatever reason, decides that they want data…their maintainers go away, which often happens, whatever the case might be.

So what’s your bet there? What are you doing to de-risk that situation?

[Peter Worth] Really good question. So there’s about a thousand installs worldwide, and there’s an entity that runs and owns that Wazuh, a platform and open source community. So there’s a solid community behind that. However, we actually adopt new releases several weeks after the fact, into our platform, and then we have built up our own front-end and back-end stack to support the horizontal and the vertical capabilities that we’ve added.

So in the event, for example, let’s say, worst case scenario, they go away, we actually have the ability to just build in new plumbing because that’s primarily what we’re relying on, is the plumbing.

[Will Gregorian] Right.

[Peter Worth] Having said that, there’s a lot of great features that come out of that open source community that we adopt. If, for some reason, that went away, we still have the existing source code that we can manage and support ourselves because we have our own team that understands how to do that as part of what we built out.

And, again, alternatively, we can actually just build up our own plumbing pipeline if we need to. So we built that risk into the product strategy, knowing that it gave a 18 to 24-month head start. There’s a ton of capabilities, we like the community, but we’re building an enterprise business, we want to support enterprise customers, we got to make sure that, no matter what the situation is, they’re going to be protected.

[Rich Stroffolino] All right, well, Peter, I think we dove right into the deep end on this one. Fantastic conversation. Really enjoying it. But what’s one thing we didn’t ask about that we need to know?

[Peter Worth] I think the other thing that’s unique about what it is that we’re bringing to market, and I think it’s lost in a lot of the noise of the conversations, and I think you two, as CISOs, this is the perfect place for this. You’re starting to see a little bit of how these CISOs are being held accountable, relative to some of these incidents and breaches that are happening.

SolarWinds is probably a great example. The SEC brought…FINRA brought some cases against their CISO. The company actually backed him up, but he actually… There was an article that was published a couple of months ago, I think in the Guardian, where he talks about his experience.

I went through my own experience around these lines, which I don’t necessarily want to get into here, but I very much empathize and sympathize with the chair that you guys sit in, and the responsibility involved. Our motto is, “Built by operators for operators.” That is the laser focus of our platform, and our team is to support that function because we have a very good understanding of what’s required in order to do that and be successful at that.

And so there’s a community aspect to what it is that we’re doing and why we’re doing it the way that we’re doing it and why the underlying economics around open source are important relative to that. We want to give you the ability to hedge against some of these larger vendors as well.

So there is a unique perspective that we bring to the table that doesn’t necessarily show up when you look at the tool or when you look at the pricing schedule or anything like that. But we very much feel, each and every one of us, that we’re adding back to the community, and that’s a big part of our mission.

[Rich Stroffolino] Fantastic. Well, that’s just about it for this episode of Security You Should Know. To learn more, head on over to athenasecuritygroup.ai. If you have any feedback for this show, send it to us, feedback@CISOseries.com.

Thanks to Jason and Will for helping us learn more about what Athena Security is up to, and thank you, Peter, for your time and being game to answer all of these questions. And thank you for listening to Security You Should Know.

[Voiceover] That wraps up another episode of Security You Should Know. If you like this program, please subscribe, tell your friends, and leave us a review. All companies showcased on this program are sponsors of CISO Series. If your company would like to be spotlighted and interviewed by our security leaders, go to our contact page on CISOseries.com, or just email us at info@CISOseries.com.

Thank you for listening to Security You Should Know: connecting security solutions with security leaders.