# Proactive AI Security for CISOs with David Linthicum

An episode of [AI Security, AI Cloud Ops & Infrastructure | ClearTech Loop](https://invisiblenetwork.ai/podcast/1823980617), 16 Sep 2025, 22 min.

Audio: https://www.buzzsprout.com/2248577/episodes/17846871-proactive-ai-security-for-cisos-with-david-linthicum.mp3

Send us Fan Mail AI isn’t just a productivity tool — it’s a brand-new attack surface. In this ClearTech Loop episode, Jo Peterson sits down with David Linthicum — cloud pioneer, five-time best-selling author, and leading voice on cloud and AI strategy. David shares a practical roadmap for CISOs facing the reality of AI adoption: Weaponize AI for Good: Use generative AI to simulate attacks on your own systems. Find the gaps before adversaries do. Shift Security Left: Bake privacy and security into the first 20% of your AI/ML pipeline, not the last. Rethink Incident Response: Static PDFs don’t cut it. Build AI-driven playbooks that adapt to your live environment. Close the Governance Gap: Break down silos between DevOps and security. Shared responsibility doesn’t mean shared blame. If you’ve been wondering how to hack yourself before the hackers do, govern AI adoption without slowing innovation, or stop incident response chaos before it starts, this is your episode. 👉 Watch the full conversation + subscribe to our LinkedIn newsletter here: https://www.linkedin.com/newsletters/7346174860760416256/ 🎧 Listen: In Buzzsprout Player ▶ Watch on YouTube: https://www.youtube.com/@ClearTechResearch/videos 📰 Subscribe to the Newsletter: https://www.linkedin.com/newsletters/7346174860760416256/

## Transcript

[0:07] SPEAKER_01: Hey guys, thank you so much for joining.
[0:10] SPEAKER_01: We're here today with Clear Tech Gloop.
[0:12] SPEAKER_01: We're on the move and in the know, and I've got a special guest.
[0:15] SPEAKER_01: I've got Dave Linticom.
[0:16] SPEAKER_01: Hi, Dave.
[0:17] SPEAKER_00: Hi, Joe.
[0:18] SPEAKER_00: How are you doing?
[0:19] SPEAKER_00: Man, this is a great show.
[0:21] SPEAKER_00: It's a great platform.
[0:22] SPEAKER_00: I could not be happier to be here.
[0:24] SPEAKER_01: Oh, you're sweet.
[0:26] SPEAKER_01: Thank you.
[0:27] SPEAKER_01: Well, y'all, you probably know Dave already, but in case you don't, Dave is the founder and lead researcher at Linticom Research.
[0:36] SPEAKER_01: And Dave describes himself as an internationally known AI and cloud computing thought leader, very fair, uh, enterprise technology innovator, educator, and five-time best-selling author.
[0:50] SPEAKER_01: Holy cow! Um, and he also says he's an over-the-hill mountain biker.
[0:57] SPEAKER_00: Yeah, very bad.
[0:58] SPEAKER_00: Lots of injuries.
[0:59] SPEAKER_01: Lot of injuries, but still doing the mountain biking.
[1:02] SPEAKER_00: Still doing the mountain biking.
[1:04] SPEAKER_01: But because you love it, right?
[1:06] SPEAKER_00: It's the only it's a way to get out there and get some exercise and enjoy the outdoors.
[1:11] SPEAKER_00: So I I I love that aspect of it.
[1:13] SPEAKER_00: I just don't see me sitting in a chair in a campsite as of yet.
[1:16] SPEAKER_00: Not like riding through the woods and avoiding the bears.
[1:20] SPEAKER_01: Wait, have you seen a bear?
[1:23] SPEAKER_00: Yeah, there are bears all over the place.
[1:25] SPEAKER_00: I live in Virginia.
[1:26] SPEAKER_00: So man, we're crazy nuts with bears.
[1:28] SPEAKER_00: Um, they're they're not they're not aggressive bears.
[1:31] SPEAKER_00: They I always think they look like dogs.
[1:34] SPEAKER_00: And I go, oh, someone's dog got off the leash.
[1:36] SPEAKER_00: Oh, that's a bear.
[1:37] SPEAKER_00: I guess that doesn't make sense, because they they're about the size of big dogs.
[1:40] SPEAKER_00: And so in Virginia, they're small, they're not the big brown bears out in the northwest, but they're uh getting a bit brazen and coming into where the people are living now, which is I always keep an eye out for them.
[1:51] SPEAKER_00: Not that I worry about them, but it is funny you're seeing more and more bears these days when you're going off and mountain biking.
[1:57] SPEAKER_01: See, and you know, who would have thought we'd be talking about bears on an AI security podcast?
[2:03] SPEAKER_01: But you know, everything needs to be secured.
[2:05] SPEAKER_01: Pretty soon you're gonna get bear secure trash cans, right?
[2:09] SPEAKER_00: Yeah, they have those.
[2:11] SPEAKER_00: Uh yeah, my idea of bear security is speed, so just keep going.
[2:14] SPEAKER_00: They can run about 15 miles an hour.
[2:16] SPEAKER_00: I have to put 20.
[2:17] SPEAKER_01: So they can go that fast?
[2:19] SPEAKER_00: Yeah, they're fast buggers.
[2:22] SPEAKER_01: Oh my habits.
[2:23] SPEAKER_01: Okay.
[2:24] SPEAKER_01: All right.
[2:24] SPEAKER_01: Well, we're gonna shift from bears to generative AI and some security about that.
[2:31] SPEAKER_01: So yeah.
[2:33] SPEAKER_01: Um, Dave, my first question to you is how can cybersecurity professionals leverage generative AI to break out of sort of this traditional tools and tech mindset and drive more innovative thinking and execution in their security programs?
[2:50] SPEAKER_00: Yeah, that's a great question.
[2:52] SPEAKER_00: And there's obviously lots of dimensions to that, but the core value that I see would be the ability to uh simulate novel threats.
[2:58] SPEAKER_00: And so, you know, using AI, you know, to create you unique attack scenarios, you know, figure out uh, you know, different attack surfaces and the ability to kind of in essence, you know, launch an AI agent.
[3:13] SPEAKER_00: It could be an agent, it could be just a generative AI monolithic system that's able to act as a white hack hacker.
[3:20] SPEAKER_00: In other words, figure out ways to attack your system.
[3:23] SPEAKER_00: And so that's what the the hackers are doing right now.
[3:26] SPEAKER_00: The uh people are trying to breach the environment.
[3:28] SPEAKER_00: So using AI as a weapon to figure out different ways and different angles of attack.
[3:33] SPEAKER_00: And instead of going through it with the structured programming like they did a few years ago, they can now go through with an AI where it can hone in on particular, particular vulnerabilities and find those vulnerabilities before you find them in your own system.
[3:45] SPEAKER_00: And so, you know, my advice is to my clients well, use the same technology to figure out where your holes are.
[3:52] SPEAKER_00: And so it's pretty easy for some uh you know, security testing experts and security engineers to put together, you know, some sort of a generative AI framework to simulate attacks and attack surfaces on our various systems.
[4:06] SPEAKER_00: And obviously, there's some security testing tools that are rising out there.
[4:09] SPEAKER_00: They're all AI enabling their stuff.
[4:12] SPEAKER_00: I suspect all of them are going to be systemic to those tools and they'll be able to put up these scenarios.
[4:16] SPEAKER_00: But that's a unique tool we haven't had, you know, two or three years ago.
[4:19] SPEAKER_00: Generative AI was very expensive, and now it's pretty much free.
[4:24] SPEAKER_00: And we're able to define these LLMs as the ability to test our existing security defensive and find these vulnerabilities.
[4:32] SPEAKER_00: And by the way, everybody asked to do that.
[4:34] SPEAKER_00: They went off and found something.
[4:36] SPEAKER_00: You know, they found some sort of an AB API attack, the ability, you know, vulnerabilities occurred, encryption wasn't secured, you know, key management issues, things like that.
[4:44] SPEAKER_00: You guys gotta remember people are architecting these systems, they can't make everything in a perfect way.
[4:49] SPEAKER_00: It's not never gonna be impervious.
[4:51] SPEAKER_00: So, your ability to exercise your systems to find these issues, figure out where the open holes are, things like that, is gonna be a great tool.
[4:59] SPEAKER_00: And people should always be using that.
[5:00] SPEAKER_00: I mean, most of the cloud configurations that I've seen over the last 10 years, they all have uh misconfigurations and how they're security because they take the defaults and things like that.
[5:10] SPEAKER_00: And even one you know big uh security agency with the government, you know, had an open uh, you know, um, you know, S3 object where you could you could pull it from any browser and had you know top secret information in it, cross fight information.
[5:26] SPEAKER_00: So all these vulnerabilities are there.
[5:28] SPEAKER_00: We just need to get good at finding them.
[5:30] SPEAKER_00: Number one, you need to get good at setting up your security initially, you know, going to read the stuff you do and basically follow your advice and how do you set up security in a way that's going to reduce the amount of vulnerabilities, reduce the amount of risk.
[5:42] SPEAKER_00: It's never going to be eliminating that.
[5:44] SPEAKER_00: But also the ability to go behind you and test it.
[5:47] SPEAKER_00: So you're doing stress testing, you're doing penetration testing, all these sorts of things versus just running through some sort of a structured methodology and how you're going to look for vulnerabilities in the system, but the ability to create unique scenarios that we may not even think of before.
[6:02] SPEAKER_00: So get a generative AI system, you it's trained.
[6:05] SPEAKER_00: I'm sorry, get an LLM that's fairly good trained, give it some local training with how your configuration is occurring, and then ask it to go, you know, create 100 scenarios that will test penetration of the system.
[6:18] SPEAKER_00: Out of those hundred scenarios, you run them against uh your existing security infrastructure.
[6:22] SPEAKER_00: You may come up with two that point out to a vulnerability.
[6:26] SPEAKER_00: That's a win.
[6:27] SPEAKER_00: You know, that's one that you're able to find versus uh, you know, versus your adversaries.
[6:32] SPEAKER_00: And I think that the security folks are getting that stuff in there now.
[6:35] SPEAKER_00: Everybody's AI washed their stuff.
[6:36] SPEAKER_00: They go, oh yeah, we're AI enabled.
[6:38] SPEAKER_00: Everything's AI, AI.
[6:39] SPEAKER_00: And by the way, we do a Gentec too.
[6:41] SPEAKER_00: Um, but they don't really have those capabilities in the system yet.
[6:45] SPEAKER_00: And so the people who are using it, normally security people I work with, are doing so through their own ad hoc frameworks and utilization of the system, which you can do with any LLM out there.
[6:55] SPEAKER_00: They're all free, they're all kind of plus or minus 10%, the same functionality.
[7:00] SPEAKER_00: You do have to do some localized training to them to understand your configuration.
[7:03] SPEAKER_00: But the reality is they're going to understand more about your security configuration than any of your testers will ever will, and they'll be able to put up unique scenarios that'll test your security.
[7:14] SPEAKER_00: And I think that's an awesome thing to do with generative AI.
[7:16] SPEAKER_00: So turn it against yourself, but for good reasons.
[7:20] SPEAKER_01: I love that.
[7:20] SPEAKER_01: That's great.
[7:21] SPEAKER_01: Hack the hackers.
[7:22] SPEAKER_01: And in case you all are not aware of it, the Cloud Security Alliance has a really great um paper out that maps AI security against NIST.
[7:34] SPEAKER_01: And so there's holes, right?
[7:37] SPEAKER_01: Because we're all growing and learning.
[7:39] SPEAKER_01: Um, so to Dave's point, you know, what's older may not cover all the controls that you need for AI.
[7:49] SPEAKER_01: It's because AI doesn't follow the rules.
[7:51] SPEAKER_01: That's part of the problem, right?
[7:53] SPEAKER_01: It really is truly part of the problem.
[7:55] SPEAKER_01: Um, so Dave, next question: how can organizations embed security and privacy controls into their AI model development without sort of slowing down the innovation?
[8:07] SPEAKER_00: Well, the first thing I would tell and advise people who are doing this, and I do teach an AI architecture class, and we talk about these things all the time, you know, would be to shift left with the automation.
[8:17] SPEAKER_00: So you're able to integrate security and privacy checks, you know, early in the um, you know, AI machine learning pipeline.
[8:25] SPEAKER_00: And your ability to put it early in the stage would be something that I constantly recommend.
[8:30] SPEAKER_00: Everybody has a tendency to, when they're done with the system, you know, suddenly they throw it out and they go, let's, oh, by the way, let's do just check in for security.
[8:37] SPEAKER_00: Here's a checklist security, checklist governance, checklist operation control.
[8:40] SPEAKER_00: Um, I'm a big advocate, and I have been for a long time since I've been doing this architecture stuff, to put that up in the front.
[8:46] SPEAKER_00: In other words, I'm not going to be able to build a system that's going to have the best security unless I build it into all of the core processes.
[8:53] SPEAKER_00: I build it into my AI systems, you know, things like that.
[8:56] SPEAKER_00: Because you got to have new vulnerabilities with AI, model poisoning, all the kind of stuff that's popping up.
[9:00] SPEAKER_00: But you think about it early in the process, you're not getting to this point where I've already built it and we realize, oh, darn, we screwed up 10 things that we have to go back and fix.
[9:09] SPEAKER_00: And you have to basically have to loop back.
[9:11] SPEAKER_00: And I've done this a few times in my career, it's not fun, and then redo existing stuff because of security vulnerabilities that are built in.
[9:18] SPEAKER_00: And so, you know, I tell everybody, you know, that setting up, you know, dev pipelines for generative AI systems and agentic AI systems, security can't be an afterthought.
[9:27] SPEAKER_00: And by the way, security can't be the last of the three steps.
[9:30] SPEAKER_00: I say normally people do it in the last 20% of the project.
[9:33] SPEAKER_00: It needs to be put in the first 20% of the project.
[9:36] SPEAKER_00: It needs to go into the design phase.
[9:38] SPEAKER_00: And I understand it's something else we have to deal with is you know, AI architects and AI application creators and designers, things like that, to figure out how security is going to be systemically building this stuff, but it's part of building an exceptional system.
[9:52] SPEAKER_00: And virtually, you know, 80, 90% of the systems out there haven't thought about it that way.
[9:59] SPEAKER_00: And so they think of it as an afterthought.
[10:01] SPEAKER_00: You can kind of tell the security is kind of jerry-rigged in the end and basically living up to the minimum viable vulnerability that they're able to have.
[10:08] SPEAKER_00: And we don't have to do that.
[10:10] SPEAKER_00: I understand we're going to make the process a bit more difficult and a bit more complex because we're adding additional steps early in the phase, but we won't have to deal with it later in the phases, phases of development before we do the deployments.
[10:23] SPEAKER_00: And you're going to find yourself much better off with higher quality software.
[10:27] SPEAKER_00: And by the way, if you build your system systemically around a security model, as well as governance and operations, those are a part of it as well.
[10:35] SPEAKER_00: And also SecOps, um, you're going to have a much more viable product that's going to exist, have a life cycle that's going to be probably twice as long.
[10:46] SPEAKER_00: Because many of these things are shut down or deprecated or sunseted because of low security issues or security issues they have in the system and too much time to engineering the stuff.
[10:55] SPEAKER_00: If you build the thing, you know, setting it up predefined to accept a number of security models, encryption patterns, compliance issues, things like that.
[11:05] SPEAKER_00: When you get it out and you start operating it, it's going to have a life cycle that's going to be 10 to 20 years, not five to 10 years.
[11:12] SPEAKER_00: And like good engineering is good engineering.
[11:15] SPEAKER_00: So I urge people, even if it costs a little bit more money, to shift left with your AI security procedures.
[11:23] SPEAKER_01: Yeah.
[11:23] SPEAKER_01: And that, you know, what you're saying hits on so much of some of the studies that have come out that talk about the fact that enterprises are launching AI products, but they're not securing them.
[11:39] SPEAKER_01: I thought I saw one study come out a couple of weeks ago where only six percent, six percent of the AI projects that had been launched had security baked into them.
[11:53] SPEAKER_01: Like crazy low, right?
[11:56] SPEAKER_00: I'm seeing that as well.
[11:57] SPEAKER_00: And it and it's bad practices.
[11:58] SPEAKER_00: And you would figure, you know, we're 2025, we should be much better at doing security and we're able to do things in a faster way.
[12:07] SPEAKER_00: Um, I think it's a kind of a lack of understanding out there.
[12:10] SPEAKER_00: I don't think the security professionals are being taught about this early on, and they're not necessarily being taught in how security gets into the application development lifecycle and the AI development lifecycle and how it's going to be impacted.
[12:22] SPEAKER_00: In many cases, we have the silos of the devs, um, you know, sitting in DevOps frameworks, things like that.
[12:28] SPEAKER_00: And they do security and they do some initial testing as well, but they don't understand its systemic use.
[12:34] SPEAKER_00: And that's because they're not taught to.
[12:36] SPEAKER_00: And so when I, you know, talk to Google about this and they said, well, why aren't you doing that?
[12:40] SPEAKER_00: We've never been instructed to do it.
[12:41] SPEAKER_00: I have all these DevOps certifications and you know, Google DevOps and AWS DevOps and all these sorts of things.
[12:47] SPEAKER_00: Well, the reason you don't you haven't gone into it because they're not going to talk to you talk to you about something that's outside of their implementation power.
[12:55] SPEAKER_00: And the reality is that this is going to be uh groups of software that's gonna be all the various vendors out there and how you make everything work and play well together.
[13:02] SPEAKER_00: So they're not having the discussion with them because it's not related directly to the software cloud service that they're selling.
[13:09] SPEAKER_00: So therefore, we have all of these devs out there, and you know, DevOps engineers, people have very powerful positions in these companies, are not working with the security teams.
[13:18] SPEAKER_00: The security teams are not insisting on working with the devs, and we we have this big chasm that's occurring where the people doing development, you know, aren't necessarily the security professionals that they need to be and not building systemically into the system in terms of the capabilities that they need to need to happen.
[13:34] SPEAKER_00: And the security people know it, by the way, but I would talk to them and they say we have no uh we have no influence with that group.
[13:42] SPEAKER_00: And so, well, you know, this is one of the things where uh you got to kind of knock their heads together and say, you guys gotta be on the same page because security people, you're not gonna be very effective if the app if the devs are opening up vulnerabilities into the system because they're not systemically building security into the environment.
[14:00] SPEAKER_00: They're putting it as an afterthought.
[14:01] SPEAKER_00: And by the way, devs, you're not doing a good, you're not doing a good job anymore.
[14:05] SPEAKER_00: You're creating stuff that's gonna get is gonna be worthless in about two years because security is so bad, we're gonna have to sunset it, throw it out, and replace it with something else.
[14:15] SPEAKER_00: So, what do you want to do?
[14:16] SPEAKER_00: You want to build something for the long run that's gonna bring lots of value back to the business, guaranteed to do so with the best security security posture you can have.
[14:25] SPEAKER_00: And with that, it means building into the system or you know, option two, and option two sucks.
[14:32] SPEAKER_01: So that that's the takeout from this conversation.
[14:37] SPEAKER_01: Option two sucks.
[14:38] SPEAKER_01: Um, all right, last question.
[14:41] SPEAKER_01: So, you know, we've got security that's built in, and then we've got organizational governance.
[14:48] SPEAKER_01: At least that's how the way I think about AI sometimes.
[14:51] SPEAKER_01: I think about it as kind of two separate areas.
[14:54] SPEAKER_01: So I'm a CISO, or you're the CISO.
[14:58] SPEAKER_01: How would a CISO be thinking about AI and option, you know, in those two swim lanes, emerging threats, and then from an organizational governance perspective?
[15:09] SPEAKER_00: Yeah, the main priority that comes to mind would be proactive intelligence or proactive use of AI frameworks, generative AI frameworks, specifically LLMs.
[15:20] SPEAKER_00: And basically it's enhancing uh threat intelligence and the ability to adapt defenses around different responses out there and what you're gonna do.
[15:31] SPEAKER_00: So, how are you gonna automate incident response?
[15:33] SPEAKER_00: How you're going to uh look at the um the new threats and how you're gonna adapt to the new threats and do so in a very short period of time.
[15:40] SPEAKER_00: It's not this big run in a big circle until someone figures out what went wrong.
[15:45] SPEAKER_00: And really, you do that with uh using intelligence as a weapon and the generative AI systems.
[15:51] SPEAKER_00: So you're proactively looking at what the vulnerabilities are, you're proactively looking at the incident response, you're creating incident response procedures, you're creating workbooks in terms of what you're gonna do if some sort of a breach attempt occurs, or you know, God help us, some breach occurs.
[16:07] SPEAKER_00: So that's the best, that's the best use of the technology.
[16:10] SPEAKER_00: Um, you can do other things like governance frameworks and put you know security governance around that, and some of the LLMs will tell you a good way to do that.
[16:18] SPEAKER_00: And then also collaboration, you know, with cross-functions teams, you know, you know, partnerships with security, things like that.
[16:25] SPEAKER_00: You have to deal within the silos within the business.
[16:27] SPEAKER_00: But I think nothing is going to be more valuable than the proactive intelligence.
[16:31] SPEAKER_00: So you're enhancing threat intelligence, you're you know adapting to different defensivenesses in a rapid way.
[16:38] SPEAKER_00: And the big thing wasn't this as many things that uh these CISO CISOs don't have, is have some sort of automated incident response that occurs.
[16:47] SPEAKER_00: In other words, they don't know what's going on.
[16:48] SPEAKER_00: They pull out a paper, yeah, someone wrote this five years ago.
[16:51] SPEAKER_00: Here, tell us what to do.
[16:52] SPEAKER_00: We got a ransomware attack.
[16:54] SPEAKER_00: Um uh, but your ability to get into a tool, and by the way, this again, the security people are moving in this direction, security tools and technologies haven't moved there yet, though.
[17:04] SPEAKER_00: So, in other words, we're we're basically custom building much of them stuff ourselves.
[17:08] SPEAKER_00: And you guys are yelling me at through the screen right now.
[17:10] SPEAKER_00: Uh, you know, if you got something, show me.
[17:13] SPEAKER_00: Uh the reality is that we have the LLMs, they're programmed with most of the best practices in how security responses should take place.
[17:24] SPEAKER_00: And we're either pre-creating those scenarios or we're creating some sort of a pre-trained model.
[17:29] SPEAKER_00: In other words, a model that is an LLM, ChatGPT, you know, uh 4.1 or whatever, um, where it is trained with everything that's in your current system configuration, all your parameters, you know, all your touch points, all your uh surfaces, all that kind of stuff, and knows everything about your existing as is state of your system, also knows everything about the uh best practices and security and the ability to use it in a proactive way.
[17:57] SPEAKER_00: In other words, if something is going to happen, figure out the path to do the most uh correct incident response that's going to minimize the damage.
[18:07] SPEAKER_00: And I think that's where this value, the technology can come in hand because guess what?
[18:12] SPEAKER_00: Most CISOs that I see do not have incident response uh procedures.
[18:16] SPEAKER_00: They don't have things like that.
[18:17] SPEAKER_00: They figure it out as they go and they do so in a reactive way.
[18:21] SPEAKER_00: And I understand why they're doing it, but they don't have current documentations, workbooks, playbooks, and what to go through.
[18:28] SPEAKER_00: So when something like this happens, they kind of run around in a circle with their hair on fire until you know someone figures out some sort of approach to making it happen.
[18:36] SPEAKER_00: And while they're doing that, the uh penetration in the system is typically getting worse.
[18:40] SPEAKER_00: They don't have the ability to assess the damage, they don't have the ability to isolate, you know, isolate the uh compromised areas of the system because no one has thought in terms of how that's going to be done.
[18:52] SPEAKER_00: And by the way, you can set up systems now that are able to diagnose, you know, some sort of an incident and then give you, based on your configuration, step by step, what you need to do.
[19:03] SPEAKER_00: So in these sorts of situations where everybody is running around the hair on fire, you get to list step ones, what you shut down, step two, what you check, check three, where you find the artifacts, step four, you know, all these sorts of things that are gonna be very difficult for us to figure out in high pressure situations.
[19:19] SPEAKER_00: We need to pre-do this stuff before these things occur.
[19:22] SPEAKER_00: And I guarantee you, we're gonna see some huge breaches in the end of this year in 2026.
[19:28] SPEAKER_00: We always do, and by the way, most of them aren't reported.
[19:30] SPEAKER_00: You know, they just kind of they're not doing press releases around it.
[19:34] SPEAKER_00: Where the incident response around this stuff has been abysmal.
[19:38] SPEAKER_00: And if you ask the CISOs, more often are very honest and good people.
[19:41] SPEAKER_00: They say, you know, how come the incident response was a little subpar based on some of the best practices?
[19:46] SPEAKER_00: They would tell you they never thought it this would happen.
[19:49] SPEAKER_00: And this is where you're going to have an opportunity to figure out the different scenarios and how this stuff would happen.
[19:55] SPEAKER_00: And by the way, you're not gonna have to pay um, you know, consultants uh to come in, you know, a million-dollar project to do the incident response procedures for you because the Gen AI system should be able to do a yeoman's job and getting your configuration.
[20:10] SPEAKER_00: Rather you do that and actually you you form your incident response procedures than wait for some consulting firm to come do it for you, and they're gonna do stuff in a static way.
[20:19] SPEAKER_00: You're not gonna have the ability to go back to the model and ask them questions.
[20:23] SPEAKER_00: They're gonna give you documents, PowerPoint presentations typically, and they're gonna leave the area.
[20:27] SPEAKER_00: You're not gonna use it until these incidents occur.
[20:29] SPEAKER_00: I'm talking about not only creating proactive incident responses in terms of the paths you need to take to deal with these certain instances, but also have interactive systems where you can figure out stepwise based on how the configurations change and also have the AI system have dynamic understanding in terms of the configuration, how its current instance is, not as you defined it a couple of years ago, and the ability to uh um basically define your best path out of it.
[20:56] SPEAKER_00: And I think it's it's too bad that uh the uh CISOs out there don't aren't using this technology, but this is what it's for.
[21:05] SPEAKER_00: Uh, and so your ability to automate things in a way that's gonna be able to do stuff very inexpensively, and your ability to create pre pre-create procedures are gonna be proactive in nature and the ability to query it and model when you need it, and it's basically free.
[21:21] SPEAKER_00: There's no excuse not to be doing this.
[21:24] SPEAKER_01: That's a really good explanation.
[21:26] SPEAKER_01: And I I am, you know, a glass half-full girl, and I feel like we're moving in that direction.
[21:32] SPEAKER_01: I'm starting to see some things happen that are gonna that are folks are putting into place exactly what you're talking about.
[21:40] SPEAKER_01: So I'm hopeful over the course of the next 12 months, we're just gonna get savvier about some of the incident response things that are happening, right?
[21:49] SPEAKER_01: And and better at it.
[21:50] SPEAKER_01: So, as always, I could talk to you for another half an hour.
[21:54] SPEAKER_01: So, thank you so much for taking time out of your day, Dave.
[21:57] SPEAKER_01: And thank you everyone for joining.

Shows are listed from Apple Podcasts' charts and directory, and Podcast Index where it is used. Every show and episode belongs to its publisher and plays from the publisher's own feed; this site hosts none of them.