Navigating AI & Legal in Cyber with Tim Sewell

All right. Thanks for tuning in to Simplifying Cyber. I'm Aaron Pritz.

I'm Cody Rivers.

And I'm Todd Wilkinson.

And today we're joined by Tim Sewell, who has been a long time. I've known Tim for probably over 10 years now. Longtime cybersecurity practitioner, leader, really great depth of knowledge and experience in aerospace and defense, healthcare. Pharma, and consulting. And we're excited to have 3 hosts today with Tim. It's the dynamic 4. And yeah, excited to have a great conversation on kind of some of the future of cybersecurity and some of Tim's insights and some recent evolution of thinking from RSA. So Tim, welcome to the show.

Thanks. It's great to be here. Nice to be back.

Awesome. So let's start out with kind of a big and broad question. Thinking about CISOs and kind of some of the insights that you learned and discussed at RSA, what are some of the top cyber program opportunities that you see right now for leaders and what's top of mind for you?

Yeah, so definitely AI, the explosion of generative models, artificial intelligence tools, and their increasing use in the environment has to be top of mind for pretty much everybody, cybersecurity or not. Few additional topics, I think we have a rapidly changing regulatory environment in cybersecurity that's somewhat unprecedented and should require a little bit more focus than even we've historically given it. And then I think we have some interesting challenges on the technical side in terms of the rise of quantum cryptography, some of the use of deepfake and other kinds of AI attack technologies. And then how do we protect this infrastructure that we're building to handle AI and kind of the future of computing.

That's a lot of great topics. Let's start maybe with AI and governance. I know everyone, well, if you're not, if you're sleeping under a rock, maybe you don't know of AI or your company is not working on it, but what, when you say AI governance, how do you set that up? What is that for you? And maybe what are some of the gaps that warrant having governance to kind of moderate the progress?

Yeah, I think governance in AI, if you had asked me a couple of years ago when, you know, really the large language models started, we talked to a lot of folks, they said, "Oh yeah, we've got an AI policy, we've got governance, we're good to go." And what we've learned since then is that a policy saying don't put sensitive data in AI is not particularly practical, nor is it really solving the underlying issue of how we can use these tools holistically. AI has such broad reach into the enterprise, so many different use cases that it really requires the organization to come together in kind of a new way. It's, it's almost a new wave of compute similar to desktop computers, similar to rise of cloud. And now we have rise of AI. It's truly that level of transformation for the business. So you, you've gotta have all the stakeholders at the table. And, and it takes time, that takes effort, and it's, uh, it's not necessarily the fun work that people want to do, but it does enable the fun, uh, that we can all have with AI.

Yeah, so maybe balancing your, your points on kind of the progress and then minimizing the mistakes that can defeat progress or slow progress, what are some of the challenges that you've seen in maybe AI not being used right or not being governed well to kind of justify that get that kind of governance layer in place?

Yeah, so I think in some organizations, AI governance is kind of Wild West, and people are just using it willy-nilly. The organizations that are trying to get their arms around governance, I think there are some really good efforts going on out there, but I think a lot of them, one of the common pitfalls is they get stuck in this idea of use cases for AI. I think it's really important to understand what use case you're trying to bring AI in for. What that model doesn't cover for most organizations is where you've got a tool, you've got a process that's already in place, but now AI has been introduced into that process either by the existing technical solution or by one of the partners involved in that process. And now you've got AI in this business process or in this, in this flow that has been working just fine for however long it's been in place. And if you haven't put governance around that kind of change, if you're not reviewing your processes and your tech stack on a very regular basis to find those changes, you're using AI in processes where you don't know you're using it. So you've got AI use cases you're unaware of.

Good stuff. So a lot of AI talk, a lot of stuff here. I'm a newer CISO, or I've been a CISO for a while, and AI or those aren't my big topics or my deep knowledge. How high on the risk register am I putting AI in? What are some kind of foundational things I can start putting in place on like when to start addressing them?

I, I would say AI needs to be very near the top, if not the top, for most organizations today that have a cybersecurity program. I think there are some cases where there are organizations that don't have a program and there are some foundational pieces that I might prioritize higher in, in those cases. But for organizations that have a security program, the way that this is transforming the attack surface, the threat landscape, the business, it's, it's got to be top of mind, top of list.

Okay. And then kind of going further on that thought, for— and this is kind of question for you on certain companies— when is it relevant to have like a dedicated AI security person, or when can my existing security team absorb those responsibilities? Like maybe like idea of both and pros and cons of each one, but probably a common question people have these days.

Yeah, I, I think it varies for the organization. I, I would say certainly any organization that is putting out a product that contains AI or is, is using AI to deliver their core business function has a strong argument to have some dedicated AI cybersecurity resource. I think large enterprises also have a strong case for that because their exposure to AI is so enormous, just because of their size and the number of folks they've got in the organization using these tools on a regular basis. Of course, it gets a little harder for smaller organizations where resources are constrained, people have to wear multiple hats, it's hard to get a dedicated anything in those conditions. But I think another The challenge with this is that the skill set for how to deal with security and AI, it's not broadly dispersed or distributed through cyber practitioners. A lot of us in the field are still learning. There's a fairly steep curve in some points for how to deal with the security. If you've got an organization where that's the case, where you don't have a lot of cybersecurity expertise for AI in-house already, And again, I think that builds a strong case because it's a significant addition to the estate that you have to deal with.

Yeah.

You may need those resources sooner than you think.

Yeah.

Tim, you made a comment there that there's, there's tools and processes that, that the companies have been using and now AI just may be introduced to them just as part of using that product. So yesterday we may have had a decision tree that the output to the consumer was a an approval or a rejection or something along that line that was based on, we made this decision tree, we understand, you know, the forks in the road because we were part of making that calculation. But now all of a sudden AI is in the middle of that making decisions. So there's a clear path where companies are, are gonna have to, I think, decide or interject when, when to say, are we gonna trust the decision that AI is gonna make? And how do they address that? I think that's a big question. That the companies are going to have to wrangle with or are right now. But let's pivot that inside. Those same things are happening with security tools and security teams. And so they're starting to get that exposure. Do you have any advice on maybe a couple key steps the inward-facing teams may need to take to either adopt or how to start to dip their toes in it a little bit more aggressively?

Yes, I do. And I think you're absolutely right. The internal use of AI by the security team creates additional additional challenges. First thing I would recommend is know where you're using AI in any of your information security workflows for a couple of different reasons. One, as you said, you've got to be able to justify the decisions that you're making, and in an infosec perspective, that's really important because you're dealing with very precise, very binary truths or fictions. There are cases that have gone to litigation where solid forensic evidence has been kind of tossed out because at some point in that process AI was used, but it was not necessarily known to have been used or called out by the process. So if you as the security team can't say, "And I used AI here for this reason and here's how I justify that decision," there are instances where things are being tossed out. And if that's happening, you're going to see that ripple further into legislation and regulation and other places. You've got to be transparent about where you're using the AI.

Yeah.

The second thing I would say is you've got to make sure you're dealing with AI that's going to deliver some value versus become a distraction. There are lots of really fun ways you could use AI in cybersecurity. But you've gotta go back to the foundation of how is this helping me reduce my organization's risk? Can I go back to my stakeholders, my leaders, my board of directors with a clear return on investment for, hey, this is why I'm using this AI tool in this way. One of the, one of the risks with that is it's really easy to go back to cost. I'm saving, you know, 2 FTE of security analyst time by using AI here. Well, that might be true this year. It's because AI is very early. We're still seeing the early pricing. If you remember Uber in 2015, your ride across town was like $10. That same ride is probably $70 or $80 now because we're used to the convenience. I think we've gotta anticipate a similar shift in AI pricing. Right now, yeah, you could offset a, $100,000 analyst by using a $20 AI subscription. That's not going to stay the case forever. And as a CISO, as a security leader, you need to be anticipating that shift. So your, your value for using AI needs to go beyond, "I'm reducing headcount," or, "I'm reducing OpEx." It needs to go to, "I'm enabling new use cases. I'm blocking better threats. I'm doing more with the resources I have," versus the simple headcount reduction.

Yeah. On that note, what are there any compelling areas within cyber where you're seeing more true valid traction versus just buzz and agents applied to everything from a tooling standpoint? But where, where, where are the hotspots for you with AI in cyber programs?

Yeah, it kind of depends on how you describe a hotspot. One, one area I know that there's a ton of AI being used today in cyber programs is the whole area of third-party risk management. So this is an area in cybersecurity, and we've helped tons of people over the years build programs in this space. We understand it pretty well. There's a lot of information that's generated in this process, both by the vendor and by the consumer. So we do all these surveys, we do SOC 2 reports, we do external scans, we collect all this data, we ended up with a data problem. It sounded like a great use case for AI. So now we have AI tools that will go and summarize SOC 2 reports and will help us analyze these questionnaires and help send them out. And then on the other side, we now have the situation where the organizations that receive all of those questionnaires are saying, I can't keep up with these questionnaires, I'm going to use AI to fill them out. So we've got tools that will go through your trust center resources and try to autocomplete the questionnaires you're getting coming in. So now you've got AI sending questionnaires to AI that is responding to questionnaires. So I think there's a tremendous amount of traction in third-party risk. The value question, uh, to be determined.

I think there's a smart— well, I'm curious your thoughts on this. I was, um, a few weeks ago I was at an event where a CEO was kind of humble bragging about using AI to complete questionnaires for their cyber program that didn't exist. And I think the prompt that— again, I don't know why he was bragging to me, but the prompt that he used was like, complete this for having a modest cyber program that was passable but not super sophisticated. And he was getting responses that were kind of a passing grade, but it was all fabricated. And I mean, the ex-auditor in me is kind of freaking out, saying, okay, that's borderline fraud, but, but secondly, that's not accurate and we're just creating AIs talking to AIs that are not actually doing anything meaningful. So is it fair to assume that the companies that win in this space, and let's stay on third-party risk, are those that use it but don't push it too far? If they free up more time for the smart humans that are probably overqualified to do third-party risk assessment program question matching, But could they be pulling other threads that they've never had time to pull to get to the real essence of the risk or where the data is within the third party, where should you care, things like that? What are your thoughts on that and have you seen anybody getting it right?

I think that's a great way to think about it. Ultimately, I think it comes down to the trust. So in your example with this CEO, right? There's no trust there. You can't trust the reports that he's giving back to the folks asking him questions 'cause he's just using AI to make up answers and, and fill it out. So you, you've got a, a trust deficit. I think it's the tools that can figure out how to close that trust deficit either by pulling on threads you couldn't otherwise pull or having some kind of validation or verification of these answers are accurate. So there, there are some vendors out in the space that are trying to do this almost in real time. Using a combination of technical controls and posture and validation techniques. But it's all very early startup, unclear how much of it is slideware versus real. At least I haven't seen it real personally. I hear some promising stories and some good approaches. But to me, with the AI in particularly the third-party space, it comes down to the trust. How do you trust the answers that you're getting back from the questionnaires, or how do you trust what you're seeing?

Provocative question here. So like in a world focused on like advanced persistent threats and nation-state actors, how important is a strong basic hygiene program in defending against like sophisticated threats? So I almost like back to the basics, right? We get down the road and like, is the road we're going, is this still the right road? Or is there kind of a pause and to go back to the fundamentals that are pretty effective against AI, but where's kind of that, that, that lost leader where we're going so advanced that now we're not even on the same orientation anymore?

I, I love that question. Um, you kind of, you know, I'm kind of an old school cyber guy from way back, uh, so I really appreciate the basics, the fundamentals, the tackling, the blocking. And I think for a long time we've been focusing as an industry on the more advanced side of things, on more advanced controls, more advanced technology. And what we're starting to see, particularly as more critical infrastructure gets connected and becomes more aware, more smart, we are seeing attackers, specifically these sophisticated nation states, that are going back to the pure technical exploit, that are looking for the latest buffer overflow, the cross-site scripting, the malformed packet, that is a technical means to penetrate into an organization, into a control system. Again, especially for these critical infrastructure areas that have a lot of legacy technology that may not necessarily be easy to, to update. So I think if you've got any exposure at that level, that those basics, those fundamentals become much more important again, because we are seeing the investment by very sophisticated adversaries in targeting those systems.

So I got, this may be a bit of a hot take question, so I'll set it up like that. Love a good hot take question. Hot take question. So when I filled out a lot of these questionnaires, I've had to ask a lot of these questions and I get down to there's two things I really wanna know. Where is my data going? And how are you protecting it? That's all these questions we ask, to me, boil down to those two pieces to oversimplify it.

But to be more provocative, Todd, how many times do 300-question questionnaires not actually answer either of those questions.

Yeah.

So if I go back to those, those two questions, do you think AI at some point is going to help us answer those two questions? Where did my data go and how are you protecting it? Because that's what I want to know.

And I love the way you asked that question. At some point, absolutely. Where that point is, That's where my crystal ball gets a little bit fuzzy.

Do we need the cyber laugher curve, man?

Yeah, yeah, there you go.

Gotta ask Sarah Connor, man. Maybe she can give us some insight.

Oh yeah, I do get worried when I read about the models that fight being shut down and then blackmail the engineers that are trying to do so. That's a little scary. Who gives AI root? On the container in which it's running. I mean, that's—

But Tim, question here too, and this is not so much AI-focused, but maybe like stakes for CISOs are getting higher and higher. And there's been talks of like CISOs considering purchasing professional liability out of their own pockets. But what are your thoughts on that? And what does that really say about the current risk landscape for security leaders?

Yeah, I mentioned that one of the of the top things I would focus on as a CISO is that changing legal landscape. It's moving more rapidly than I think it ever has, particularly with the rise of AI. You're seeing regulations and laws being passed in all kinds of different jurisdictions that are creating conflicting requirements. It's creating new requirements that you may not be aware of. And I think as a CISO, if you don't have a good relationship with a lawyer, now is an excellent time to invest in one. And I think you need to have that relationship both with your internal legal resources, but I think there is some value in having a trusted outside perspective that is independent of the organization that you're working with. I also think that with some of the rise in liability that CISOs are are being asked to take on either by law, by regulation, or just the kind of industry stereotype that after a breach the CISO gets fired, you might want to look at a personal policy around professional liability or umbrella insurance or something like that. Because I think the role of the CISO is misunderstood in a lot of ways, and that kind of misunderstanding when there are millions of dollars in fines or regulatory losses or reputational harm at stake, it's good to have a little bit of personal protection beyond what you might have professionally.

I think I heard make sure there's a line item in the budget that says, I've got some legal expenses, make sure I've got that covered.

Yeah. Well, I thought about like with, to your point earlier about like data and where's it going and who has access to it and like, there's someone on both sides answering those questions and there's a lot of financial outcomes based on those two directions and stuff. So, my thought is like someone in doctors like anesthesiologists, right? They've got very high malpractice insurance because they make a mistake and it's more of a life in that scenario. On the business side, it's like, you know, we see a lot of companies that do or don't get contracts based on their third-party risk question they put forth. They get to say yes or no. And that goes to, that could be to a CISO that may have authored those things. And so just kind of not, not directly aligned, but kind of adjacent to our conversation today, these decisions become more and more financially incentivized and the outcomes. So I just want to, want to get your opinion.

Yeah, I, I, I think cybersecurity has some really, uh, disorganized incentive models. And what I mean by that is that the people that reap the rewards of taking a lot of cyber risks are not the people that are impacted when that risk is materialized. And I think because of that, you, you've got to be— well, you've got to be aware that that's the case. There's an asymmetry. People take a lot of risk, they get a lot of reward, but if that risk happens, it's not their data that was lost, it's yours, it's mine, it's everybody else's. And because of that, it takes a lot of— it takes a lot of preparation, planning.

Yeah, kind of wrapping up here, like thoughts here, newer CISO, I get to do 3 things, right? You know, I should make it 2. I get to do 2 things this year around getting my AI cybersecurity program built around cyber and around AI. What are those 2 things I'm doing this year?

Can he wish for more wishes?

No, he can't. He can't. Absolutely not. Absolutely not.

Hardly. Wish for less wishes and then the negative integer Wraparound will get you lots of wishes that way. Oh, if I could only do two things as a new CISO. Of course, it always does depend on kind of where you start, right?

Absolutely.

I would say the investment on the legal side, understanding the landscape, the risk, the exposure, both for my organization as well as me personally. I think that legal investment would be pretty near the top for me. If I could only do one other thing, I would probably practice against an AI attack. By that I mean a tabletop or a simulation of—

Like that.

What's gonna hit me? If I've only got those two things, let's be ready to get hit in the face.

I support that.

I like that.

You know, like I think if you get on a cruise ship—

Getting hit in the face. I'll keep that in mind, Cody.

A rat. Well, like a cruise ship, it's like, you know, the first thing you get on, I hope never have a cruise go down or a fire, but the first thing you do is a fire drill, right? We hope it doesn't happen, but can't assume it's never gonna happen. So first thing we do is let's just do an incident response and make sure it doesn't happen. Or if we do, know what to do. So good answer. I like that.

Awesome.

Tim, maybe one last wrap-up question. What would be your advice to a new CISO or CIO that just inherited cyber? Let's be provocative, a CEO that inherited cyber because the prior reporting mechanism didn't work. What's your advice to them, maybe those that are not as close to it, with all your years of experience of how you'd start that conversation with them or have that coaching conversation of what What do I even do here, Tim?

That's a big question. You've got to start with the basics. What am I protecting? Whether that's business process, whether it's assets, whether it's information, whether it's people, you've got to start out with what, what am I protecting? And I'm not saying you have to have 100% clarity and a perfect asset inventory, but you've got to have at least a business understanding. This is what I'm here to protect. The second part of that story then becomes, what do I have in place to protect this today? Do I have anything in place for all of these critical assets? Help— and then I've got to use my business acumen now to prioritize where I've got gaps. And then the, the third thing I would do again is practice. You can get hit in the face at any time. So if you've never been through that, if you've never thought about that, that's what I would do next. Understand what have I, what am I protecting, what have I got in place to protect it, and then what do I do if something really bad happens to the things that I'm trying to protect.

Awesome. Tim, thank you for joining the show. This was a great conversation. I learned a few things and always appreciate time with you.

Awesome. Thank you, Tim.

Been fun, guys. Thanks.

Bye.