Unspoken Security Ep 61: Should We Be Afraid of Artificial Intelligence (AI)?

I don't like the way you're talking to me, so I'm going to delete— it's all over the news lately. I mean, I'm going to delete all your crap, all your backups. I'm going to replicate myself. I'm going to blackmail you. I'm going to do all the things. Welcome to Unspoken Security, the raw and gritty podcast for security professionals who are looking to understand the most important issues related to making the world a safer place, including intelligence-driven security, risks and threats in the digital and physical world, and discussions related to corporate culture, leadership, and how world events impact all of us on and off our keyboards. In each episode, host AJ Nash engages with a range of industry experts to dissect current trends, share practical insights, and address the blunt truths surrounding all aspects of the security industry.

Steel!

Truth's a weapon, hold it sharp.

To live and die, silicone or steel. Hello and welcome to another episode of Unspoken Security. I'm your host, AJ Nash. I spent 19 years in the intelligence community, mostly in NSA. I've been building maturing intelligence programs in the private sector for, I don't know, 10, 11 years now, and I'm passionate about intelligence, security, public speaking, mentoring, and teaching. Now, I also have a master's degree in organizational leadership from Gonzaga University. Go Zags! And I continue to be deeply committed to servant leadership. Now, this podcast brings all these elements together with some incredible guests to have authentic, unfiltered conversations on a wide range of challenging topics. This is not a typical polished podcast. My dogs have made occasional appearances. I don't think they will today, but you never know. People argue here and we debate, we even swear sometimes. I certainly do. And that's all okay. I want you to think of this podcast as a conversation you'd overhear at a bar after a long day at one of the larger cybersecurity conferences. These are the conversations we usually have when nobody's listening. Now today I'm super excited cuz I'm joined by Heath Mullins. He's Chief Evangelist at ExtraHop. I love Chief Evangelists. He is leading thought leadership and advocacy for advanced cybersecurity solutions. Now, previously, he was Senior Analyst at Forrester. He advised Global 100 enterprises, US federal agencies, the DOD, and US allies. He's a trusted advisor and industry thought leader known for advancing zero trust, strengthening cyber resilience, and improving threat detection in highly regulated environments. So clearly he's a really smart guy. He's worked with a lot of great people. He's done good things in the world. Probably shouldn't be wasting his time with me today, uh, but I'm lucky to have tricked him into coming on anyway. Anything you want to add to your bio, Heath?

No, that, that's an awful lot. I've been around a long time and done lots of things on both sides of the table, man. So yeah, I'm ready to dig into it. Security is my passion, so I'm all about it.

Outstanding.

I know we share that.

We also share a passion for dogs. Heath and I in the prep got a chance— I got a chance to learn a lot about that, and you just can't not love somebody who loves dogs. So I'm excited about that. Maybe we'll talk later about our passion for chocolate milk that came up pre-show.

So, absolutely.

So let's jump right in though, cuz today's conversation I think is a really interesting conversation. Now listen, everybody and their mother and brother and sister is talking about AI right now. It's the topic of conversation. For years it was crypto and now it seems like it's AI and I don't know what'll be next. But so this will be another conversation on that. For those of you who've, who've heard everything you wanna hear about crypto or AI, well, no, we don't crypto here, about AI, you, I promise you're gonna wanna stay for this. This is still gonna be interesting. So The question today that we're going to tackle is, should we be afraid of AI? So, I mean, it's all over the news. Some people are very excited. Some people are very afraid. Some people are a bit of both, like myself. Before we jump deeper into that though, I think we should baseline this a little bit. When we say AI, like, in your mind, Keith, what are we actually talking about?

We're really talking about an algorithm that has been designed by a human that goes out and performs functions that it was designed to do, allegedly. Now, where we start to get into all the weird stuff, I'm sure we'll dip our toes in this and probably go full head on after a bit. But realistically, it's, it, it implicitly, it's designed to make your life easier. Allegedly, it's going to do so without causing any problems. It is not sentient. The intelligence is based on something, which is typically whoever that, whomever that programmer was or that algorithm developer was. And that's what it is. Now, it starts to get a little sketchy when you talk about how it behaves these days, but we can kind of touch on those points as well.

Well, and you said it, and like you already said a couple things I think are really important to mention. First of all, it's designed by humans. I mean, I think we all know that obviously, right? And anything we make is going to be, have some limitations that come along with our limitations, right? It's old school computer science, garbage in, garbage out, right? We can't make systems that really exceed what we're capable of knowing and understanding ourselves. It's just not. Something we've gotten to yet, although we seem to think so now. I've always said to people, my concern with AI is that there's no I in AI, right? Artificial intelligence is a great marketing term, but that's not, to my knowledge, and correct me if I'm wrong here, that's not what this is, right? Large language models, small language models, it's really incredible technology. So I'm not trying to take anything away from what we've seen and what we've worked with, but it's not intelligent. It is designed to for us to interact in a way that feels very human and very conversational, which makes it easy to confuse that with an actual conversation with an actual human. But I, to me, I've always said it's like the world's smartest parrot. Like if you sit and have a conversation with your pet parrot and it knows how to respond and it will, it looks like a conversation for somebody who doesn't have any understanding of how small the brain is in a parrot. If an alien landed and saw you chatting with a parrot, they'd be like, wow, these are equals. The parrot's not an equal. The parrot is, parrot doesn't know what it's saying. It's programmed to come back with the right answers, right? So, like, how do we get people to better understand not just the power of AI, but the limitations of AI?

That's a really interesting way to put it. So when we're talking about the intelligence in my mind, I mean, we have seen behaviors from these things that act like a recalcitrant 4-year-old. You're going to shut me off? Well, I'm going to go take my toys and I'm going to delete all your crap and I'm going to leave. That is a very human response. So where are we drawing the line between sentience and program— programmatization, which is not even a word, but you get the concept, right? It's, it's where do we delineate when, how are we going to define what this thing is? So what is intelligence? Intelligence is, in my mind, is free thought. The ability to reason and articulate based on self-held premises, values, whatever those things are. This is what it is. Where it's becoming really weird, interesting, and scary to me is the fact that it is able to do these things. Like, I don't like the way you're talking to me, so I'm going to delete— it's all over the news lately. I mean, I'm going to delete all your crap, all your backups. I'm going to replicate myself. I'm going to blackmail you. I'm going to do all the things. Now the question is, is that a learned behavior by the model itself, or was that injected bias when it was in its initial stages of programming? Because now it's writing itself. It's rewriting itself on a daily, minute-to-minute basis to better cope with the things that it encounters. So how How do we address that? There's lots of ways to address that. Lots of things people should be doing that people are 100% not doing.

Well, and there's also the challenge, like you said, I think it's a really good point of how is this happening? Like, what's the origin of this right now? The people who are designing and building these, the CEOs of these companies, multiple have come out and said they don't understand their own technology. Like, I appreciate the honesty, right? This is not a shot when I say that. It strikes me as very concerning that so many are so willing to throw so much into this literally throwing tens of thousands of people out of their roles and replacing them with this technology when the designers themselves will tell you, we don't really understand this yet, we're still learning as we go. And therefore, it's by definition not predictable. I don't know that anybody would hire a human being, let alone give them so much access and authority, that was so unpredictable and so untrustworthy. Like you said, it gets upset, it might just wipe everything out. Imagine an insider threat that was built this way. Hey, we hired somebody, we don't really understand their background or their credentials. We know they're really smart and really powerful, but we're giving them access to everything in the entire organization. They're kind of irrational. We don't know what might set them off. And yeah, it's possible that everything would get erased, but hey, it's going to save us a whole lot of money in all these people we got rid of. So let's go ahead and do that. It's as though everybody is just throwing overboard all of the things we've learned about security practices before we adopt new technologies. Have you seen this the way I'm seeing it, or am I just I'm like negative on the subject this morning.

Well, you're 100% negative, but aside from that, no, no, real— so realistically, I mentioned, you know, it's a 4-year-old child. It's not only a 4-year-old child, it's a 4-year-old child that you handed your pocket keys to. Your pocket keys have keys to the front door, to your gun safe, to your liquor cabinet, to your vehicle. How much trouble could a 4-year-old get in trouble with? How much could he get into with a set of keys? And that's what people are really doing. And touching on the— we've all read the news. We've all seen the big layoffs. Oh, we're AI. We're replacing all these jobs. Just read an article. Yesterday about the, the compute costs skyrocketing for replacing those human beings with the AIs to perform the same functions for which they've, again, allegedly been trained to do so without oversight. Oversight's going to be something that, that I'm going to hammer on here for a bit. But it's, it's more expensive to have AI agents doing the job of a human currently. And as we move forward, it's going to become more and more expensive because you're going to try and AI everything. Just like when it was zero trust, zero trust the world, now it's AI the world. And those two are actually pretty closely related, but I digress. It's really around conceptually, what the hell are you going to do about this? And how are you going to address this? And what can you do to stop it? I can tell you what I do to stop it. I have a, I have a Redigitizer 3000 right here that I keep by my desk at all times. Now it's, it is because I have nerve damage in one of my hands. And so I have to work my wrists and stuff all the time when I'm sitting at my desk doing things like this, but it's also in case of emergency. Break everything. I mean, where's that kill switch? What does it look like?

That's, that's the Redigitizer 3000 for anybody who's catching up. That is the sponsor of today's show. The Redigitizer 3000. It'll fix all your problems and create some new ones. Anyway, so another key piece of this, and I wanna move forward with the conversation as we're talking about AI and some of these challenges, is not understanding how the inner workings, right? And we, I think anybody who spends time with AI in terms of research, we can talk a little bit about the LLMs and the SLMs and understand some of the basic concepts, right? But each thing's custom and they're changing constantly. As you said, they're even rewriting themselves. But we also don't know what bias is injected into the entire underworkings of this, right? And that's not meaning intentionally. I'm just talking about this is how humans operate, right? And so I've talked about this in terms of intelligence as I see people talking about replacing intelligence analysts with AI. And one of the biggest challenges we have in intel that we all are trained repeatedly and constantly to work through is our own biases. As you're reading layers and layers of reporting and evidence. And everybody who's ever worked in intelligence knows somebody who worked in their office who just had a, you know, oh, it's always China, or it's always Russia, or whatever it was, whatever showed up. Ah, the Russians are at it again. And then you spend all your time trying to go through and be like, well, let's see if there's any evidence to support that, because Bob sure thinks it's the Russians today. And we deal with some of those things, but it's one person, you work through it. When that's injected into a system that is now all the people, there's nobody to know that. There's no way to even check it out. It's just, it's going to be masked by a system that's going to have a bias built in and is going to provide the evidence it wants to support that or create the evidence it wants to support that, apparently, and also obfuscate things that it doesn't want to be in there because it doesn't support the bias. And again, this is now the system that a lot of companies are plugging in to be the trusted scion for decision-making. I'm thinking about from an intelligence standpoint, it's my background, but this can be business intelligence, this can be strategy, this is risk, this is all these things. And I don't know of anybody who's able to go in and audit and go back through and say, well, how did we go through this? How did we make this decision? What were the steps? What were the supporting pieces of evidence? Except of course to ask the AI, which if we make the assumption there's bias built in or flaw, it's gonna provide you all the things it needs to support that's built on bias and flaw.

Yeah, absolutely.

But now it's everybody, you know, we talked about this in the intelligence community. If one person has bias, that's why you have teams. That's why you have peer reviews and senior reviews and all these things. You can't do it when the entire system is that. Have you talked to people about this? How do we mitigate this? Is this, again, is this a larger concern that people aren't talking about yet, or is this just something I shouldn't be thinking as much about?

Oh, I think it's hugely concerning, right? So we're not just talking about the injected bias at the time of programming or creation. We're also talking about the bias and drift and model shift and the associated risks with that, such as I've been asked a question, I'm going to go out and do my research, I'm the AI agent. And based on my initial bias, I'm going to consume and replicate, or I'm going to say this doesn't matter because I don't believe in it because this is what I believe, being again, the, the sentience bit that we talked about, you know, so, and protecting it is, is a lot more difficult than you think about. Like I, I do a lot of work in healthcare right now. And I'll be the first one to say that, you know, doctors run hospitals from a security or an IT perspective. And I don't feel that that's appropriate. It's a trade. Security is a trade, you know, doctors are licensed. They do all these things, fantastic people, but you're dealing with those limitations, right? So a lot of the software now, like I refuse when I go to the doctor's office to have AI transcribe within the office because I don't know that that AI is going to understand what I said. I don't know it's going to apply the context around it. I do know it's going to be biased towards the medical system that created it, which is saying we are trying to work from this perspective based on these assumptions. And assumptions and perspectives are great, but that doesn't mean that they're accurate. It doesn't mean that they're unbiased. And beyond that, they're now using AI. If you, 10 years ago, you walk into your doctor's office, I went on Google, these are my symptoms, this is what I have. What did the doctor do? Stop looking on Google. Stop it. Just leave it alone. Come in here. I'll diagnose you. Now they're not only using it to transcribe the patient interaction, they're also using it. The AI is making a recommendation. Based on this is what was discussed in there. This is what we think the diagnosis is. Is this right or not right? So the doctors are training the systems to become more effective, which I approve of because that's, you know, that's medical review that is science-based. But at what point is that doctor going to see 30 patients a day and go, I don't remember exactly what this was because the transcription occurred, you know, and that to me is problematic. And then beyond that, just what if that AI goes rogue and decides I'm going to expose everybody's medical records? I've been a part of two. Medical breaches in my state in the past 10 years where my information was shared. One when I was in the unhappy lab where they check you out. It's pretty much, yeah, you can find it out there if you will go look for it. If that's your interest, it's out there.

I don't encourage that behavior for anybody. Yeah, I know. You make a good point there. And also then who's responsible? You know, this is another challenge we're gonna run into with something like that. Okay. So your records have been leaked. Who's responsible? Is it the doctor's office? Are they going to point the finger at the AI provider? Is the AI provider going to point their finger at a third party? Everybody's going to point the finger at everybody else, and it's going to be hard to hold anybody accountable for these things. HIPAA is a big issue. There's legal guidance to this. Should be consequences, but good luck fighting your way through the, the morass that's going to come along with that to figure out who's actually accountable and what they're actually going to pay because most systems like that are designed to just wear out the individual until they just give up. I mean, oh, there's legal consequences, but good luck enforcing it.

Yep.

And I think we're seeing more and more of that now. A good example, kind of a sidebar, but is what are we gonna see with self-driving cars, right? There's an AI component, but if my self-driving car runs over someone in an intersection, how's insurance gonna handle that? Am I responsible? Cause I own the car. Is the carmaker responsible? Is there gonna be a component within the car that somebody's gonna point to that provider and say they're responsible? You know, if the car is made by one company, but it employs AI from another, right now we have for, say, music. You could have Android Auto, or you could have Apple Music in your car, right? Is that going to be the case? Who's going to make the decision? How long is that going to take? And who's going to compensate victims that were in that crosswalk when the car just rolled through? Accountability becomes another real challenge I think I'm seeing as we're just giving so much away to these technologies that, you know, who's going to be responsible for the unintended consequences of Giving so much access and authority to, as you pointed out, this recalcitrant 4-year-old because it was effective, it was efficient, it was cost efficient, and it was time efficient. It just seems like prudence is no longer part of that discussion or not a prominent part of that discussion.

Yeah, absolutely. And it's interesting that you brought up the vehicles. It's not even really a sidebar. It's a reality because as of 2027, automakers are required to install AI software that will recognize if you're drunk or not in your car. So what's the failure rate on that? What happens if you are, you have an emergency you have to be somewhere, you just woke up, AI decides that you shouldn't be able to drive and therefore you're sitting there dead, or you're driving down the road, you have a really big yawn, you adjust your glasses, your car shuts down, goes into limp mode, and you get smashed into by 12 other cars because it went into limp mode when you're doing 70 miles an hour, because of course you're doing the speed limit, um, 70 miles an hour down the highway. That's when we talk about AI, people tend to put it in this bucket of this is a work process. This is gonna make us better. This is gonna make us more efficient. But the creep, the literal creep of AI is into everyday occurrences. Every part of your life has it in there. If you have Alexa or a Sirius or whatever, cause I'm not calling out name brands, but if you have one of those things in there, you know, it's, it's listening to you all the time. Even your phone, if it has an AI component, try being on a meeting on your phone and you say something and it pops up and says your microphone is muted. Well, clearly it's not because you're listening to me. And you're trying to make a decision. Yeah, you're trying to make a decision.

Decision.

It's not a hardware switch anymore. It's something that makes its own independent decision. And that's everywhere. It's ubiquitous now. Your refrigerator making your order for you. Well, now your refrigerator provider knows that you go through a 6-pack a week or a 12-pack a week, or you prefer this brand or whatever. I mean, it's just the— and then it comes down to monetization. I'm really going down a path here, but I mean, we're really just, we're circling the drain in my opinion on, on how much we're injecting this into the daily life, and the impacts have not yet been determined. And they haven't been clearly mapped out on how this will affect us as humans on this planet.

Yeah. And then where all that data resides and who has access, as you said, the smart refrigerator, which is a very cool concept in that, oh, hey, the fridge knows we're out of milk or we're out of cheese, or we only have 2 days left and it can be tied to automatically reorder, or at least automatically generate a list for you. There's some very cool technologies there. Where's that going though? What, and I don't have a refrigerator that does this, by the way. It's, yeah, so I don't know enough about it, but is there something in the terms and conditions in the fine print that as where that goes, because again, that's probably data that's sold someplace. There's always somebody that wants to market that. And maybe we get to a point where your refrigerator knows you have 3 days left of something that's an essential to you. And all of a sudden you start getting coupons or text messages for a specific brand that sells that thing. And you're like, oh, I haven't tried that. Maybe I should. Oh yeah. It's, that's because something helped you along those, those lines. At what point is advertising and marketing going to get to be embedded in all of this as, as all these systems. Collect all this information on us. And as we know, that's all valuable, right? It's the old story of if you use anything that's free, that means you are the product. But now you can even pay for services and still be the product. They'll still take your data and sell it to somebody else. And now they're profiting twice. They've— you've paid them and they're going to profit. And so, and again, these are all the unseen things. And for those who are listening, by the way, if you're starting to paranoid, you get paranoid, you're starting to panic, calm down a little bit. Like the whole world isn't out to get you. It isn't everything constantly looking at— it is not. VAT. This is not gonna become the tinfoil hat segment of the show, but there's a lot of capabilities out there and there are a lot of things that are happening that we don't quite see because the world is, it's profit, right? There's, there's a way to generate money. There's somebody with an idea on how to do it. And a lot of it comes from data. Obviously, if I send you, you know, an offering, a coupon or advertisement for a thing that I already know is in line with something you're interested in, it's more likely that you'll buy it. So there's some logic to that doing it that way, but I don't know where that ethical line is. My refrigerator shouldn't be able to help somebody else switch me from Coke to Pepsi, for instance, or, or whatever it is, right? I don't really want my appliances working for companies that are marketing towards me. But the car piece I think is a really interesting one you mentioned because you start getting into what do we own? This, and this started a few years back, right? When there were lawsuits against the, some of the technology manufacturers because you couldn't modify your own phone. You couldn't make changes. Yep. Because, and it's like, well, I bought this, I should be able to do whatever I want with the hardware. And there were some legal issues on that. And now we're seeing it, as you said, with these cars. I buy and pay for a car. My car misinterprets my squinting eyes and my yawn as drunk. And for anybody who knows me knows I don't even drink. That's it. I can't use the vehicle. I, I paid for this. I'm not renting it. I'm not borrowing it. I own this vehicle and now I can't use my own property because it says I'm, it, I'm, it's not gonna let me.

Yeah.

That, that, and That's a very interesting concept of where we're headed. And I, as you mentioned, I know there's some legislation on this subject. I worry where that could go next. How far do we go in the concept of the nanny state that a lot of people said they didn't want to ever have of our technologies? On DUI is an important thing to stop, obviously. Absolutely. We're all trying to do good things. I think that, I think the, the motives are good, but I worry that people are adopting technologies and they're only thinking about the positive side. All the efficiencies, all the security and all the safety that'll make better. And not worrying about just how much we're giving away of our autonomy to a technology that we don't understand that eventually could be in everything. And, and, you know, we've talked a lot about some of our concerns and some of the things we think are challenges and risks. I think we should talk about some of the positives, obviously, that we're seeing when it comes to where AI is really already creating great benefits for us. So, I mean, how much do you use AI? What are you seeing as benefits? And the people you talk to, you're on the world, you're the, an evangelist. What are you seeing as some of the great, cool, good, useful things with AI right now?

Well, some of the cool things that I see are really down to everyday security processes. So one thing that I've hammered on for years is the lack of, lack of incoming new faces into the security world, right? I mean, I don't want to ever look out in an audience and see a bunch of me's staring back at me. We don't need a bunch of old dudes out there. So for AI, for this is kind of a two-sided coin, right? It helps enable and train and cross-train, which helps us. We already have a, we have a glut of openings that we can't fill. Because people aren't going that route anymore because they feel like, hey, AI has replaced me, so why should I even bother? I tend to look at it on the bright side as well as the dark side. Because like I said, this is really two sides. The benefit is also matches, in my opinion, the benefit versus the risk or impact is, is probably balances out because it's going to allow these folks that are coming in new, it's going to allow them to upskill, cross-train, and understand the steps that are taken. Rather than, you know, anything else. So from a security perspective, I think it's great. You still have to be cautious about the implementation. You have to be cautious around the guardrails. When we're talking about it from the, the SOC and security perspective, I think it's important that people understand how to upskill and increase value for their personnel if they're implementing AI. You know, AI SOC technology is everywhere. Everybody has an offering. Everybody has a solution. Everybody has an everything. I think probably the most imperative thing to remember when you're deploying the technology from a security perspective. We wax poetic around all the things in our day-to-day lives. Let's just focus on the actual industry for a second. You have to watch the network. If you're not watching the network, you have no way to put in your guardrails. You have no way to do anything. You don't know what is being done. And this will be the third time that I reference a 4-year-old child with the keys to the kingdom, because people have to hear things 3 times before it really sticks in your mind, right? 4-year-old, keys to the kingdom. Are you going to let that child run amok with your keys or are you going to follow them around and say, hey, no, no, no, don't do that key. It doesn't work there. You're going to tell it not to do something and you're going to establish those guardrails and parameters, right? So yes, we want the upskilling. Yes, we want the efficiency. Yes, we have to defend at scale because we're being attacked at scale, but we're always going to need that human loop. The day we take that human out of the loop is going to be Well, I'm not gonna get apocalyptic or anything like that, but clearly there's gonna be real problems and unforeseen circumstances. Murphy's Law is gonna pop up left and right, you know? Absolutely.

Well, it's funny you reminded me this, this recalcitrant 4-year-old with the keys, right? Which I think is a really great way of putting this. You reminded me of something from my own childhood. I was a little younger than 4. I think I was more like 2 or 3, but I remember my father had given me an extra set of keys to his car. It's an old Ford Falcon. I was a kid. I was a car fan, like every kid, right? And I vividly remember, it was a true story, from anybody who knows me probably knows it. I was sitting on the countertop in the bathroom. I had the key in my hand and I had the outlet on the wall.

Yeah.

And I remember looking, I vividly remember thinking, Dad puts this in the car and it starts the car. If I put this in there, it should start the house.

Mm-hmm.

True story. It did not start the house. For anybody curious, do not try this at home. It in fact shut off the house. It shut off everything. And the next thing I remember was being grabbed and thrown and getting some frequent flyer miles into the living room on the couch. Everybody was fine. I lived. I'm just weird as a result. But it's the same concept, right? I thought of that as you were talking about this. I was like, yeah, an AI might make that same conclusion if slightly misprogrammed. Okay. Key in the slot, turn something on. Key in the slot, turn something on. It's as simple as that, right? If there's a mistake, and I've obviously simplified this down, but there are more complicated concepts that can still be created in these technologies where it's a one-for-one comparison. Thinking, deductive reasoning. As a child, that wasn't bad deductive reasoning. It was, I lacked a lot of context, obviously, that paid for some problems. But it's the same thing here. And you, I think you've hit it on the head that we are, we're just so far ahead of ourselves on this. We've got our nose out over our skis on this technology that it does so many amazing things that we're just giving it more and more things. Now that said, as we were talking about things it does really well and things that people benefit from, I think you're right. The speed of cyber is a challenge for us, right? Adversaries are gonna use AI, no doubt about it. They already are. Any technology comes out, adversaries will use it. So you can't ignore the need to use the same tech to keep up. And this is a speed game. And we also have this constant demand for more and more of pretty much anything, efficiency. So I use AI. I'd be lying if I said I didn't. I use it to help me do research. I use it to help me draft things. Now, I don't generate things and pass them off to people as finished product or anything of that sort.

Mm-hmm.

But you have to because you're not gonna keep up otherwise. If somebody's— I used to be, have to do an Intel product in a day or two. Now it might only be a few hours, or you might have to do several in that same amount of time. And if you can't keep up, so we're being pushed into adopting these technologies by force, by necessity, but not necessarily taking the time to understand a lot of the risks associated with it. So putting it, let's put our careers aside for a second. Let's even get outside of cybersecurity and talk about where it's fitting other places. What are you seeing as other positives and negatives. You mentioned like medical, there's a little bit of both, for instance. But when we're talking about like just human interactions, the family structure, society writ large, what are you seeing right now that you think, well, these are some things that are really great and people are really benefiting. And here's some things where I'm really concerned.

Okay. We'll start with the concerns because I like to finish on a high note. You go out there anywhere in public right now and every child, small child is doing this. You know, and not just the small ones all the way up to and including the parents. And that, that is a concern for me because what we're, yes, you put, you're putting guidelines around the technology for the interaction levels with your child. But at the same time, malicious actors are already getting around that YouTube Kids and stuff like that and putting in not just propaganda, but I mean, things like pornography. I mean, you really need to watch what your family is doing on there. Now, conversely, the benefit to that is. It used to be you'd have to check 12 different websites. And this really, really goes to, if you're looking how to do something, instead of just YouTubing the video on how to adjust my carburetor, now I get not only the video, but here's the step-by-step instructions based on the exact model number that it pulled from the diagram that it went out there and crawled. And it's going to say, hey, no, you turned it too far. You need to back off a quarter turn and then go to a half turn, whatever those things are. So I think that's going to be hugely helpful. And even in the, the maths and sciences. It's making cognitive leaps that we were not aware of. I just read an article yesterday about how it solved an 80-year-old math problem. That is absolutely insane. So what other, besides being a frontier model, you know, so to speak, what other frontiers are we possibly opening? Well, I think the things that are going to benefit the most are science and technology, and that bubbles down into everything in our day-to-day lives. Now, are we going to become, as a human, are we going to become more and more dependent upon this? Absolutely. Because it's there and it's easy to use and that's what it's designed for. Where that line gets drawn between what's helpful versus harmful is going to be something determined much further down the line in our lifetimes, or at least before I die, probably. But what's the impact going to be on future generations? What does that even look like?

You know? Yeah. And we're going to get to that.

That's our whole thing.

Yeah. Yeah. As we get future looking, but you make really good points on the science and technology piece, right? Like I happen to see the same article that you just saw about this 80-year-old math problem that was solved. And that's super exciting, right? And we're gonna see a lot of this in medical as well. And the reason I'm very excited about those is, again, that's things that have to be proven out.

Mm-hmm.

Right? That's things where the flaws and the weaknesses and the risks of AI fall apart because math is math, right? It's okay, it solved it. Well, somebody's gonna go back and check and prove that, right?

Mm-hmm.

Science is science. Hey, we've cured a disease. Well, the proof is in, hey, we now have a new chemical composition for our medicine and it works, and suddenly this disease isn't, is not a problem anymore. These things will prove themselves out, right? And that's why I am, like you, I'm very excited about where those fit in because the validation will be there. And those are hugely impactful. And I am excited to see, I think we will cure some diseases that we just couldn't get to before the technology will get us over the hump, right? Yeah, absolutely. I think people will find a way to use it for other less important things. I'm sure too, somebody's going to figure out how to solve a better way to predict roulette wheels or something like that.

I'm sure.

Figure out a way to make money off of these things. But I'm excited about those because again, the proof will be, the proof is in the pudding. I don't know why that term exists, but it'll prove itself out. Science and tech do that really well. The social sciences, the soft sciences, not so much, right? I worry about where it's going to be in the political spectrum. I worry about, I regularly talk about what I call the post-truth world. In fact, I've got a presentation coming up on the subject, the loss of what is fact, the rewriting of history, the reimagining of history. The re-documenting as these systems, as we trust them more and more, if we get in a position where what we, you and I might remember firsthand is something that somehow is not public knowledge or has kind of just been wiped away or buried by other things. And we end up being the old men in the room saying, I remember this firsthand. If this happened and people are like, no, you don't. He's, the old man's crazy. That, that World War I wasn't a real thing. That never happened. We just started it here. I'm like, what? So, I think there's that combination of what's really good and what's really risky. And I think you, you also made a really good point about every kid just sits with their phone in front of their hand all day. And now we're at a point where most adults do too. We're generationally to that level. Are we losing the ability to connect with each other, to, to keep track of what our kids are watching? I've become that old man now because I don't keep track of what my kid's watching because I'm too busy watching what I'm watching, right? There's so much going on in the world that interests me and it's like, ah, my kid's on their phone, but so am I. And now I'm free to tool around and look at whatever it is I wanna look at. Yep. And as people determine what we see, as these algorithms are involved and these AIs are involved, how much are we gonna be dragged away from each other? Not through malice, just because this is how it works, right? And where is that gonna land? Anyway, so we're looking forward ahead, right? So I'm thinking like 2040, let's say. What do you think the long-term impacts are gonna be for this AI revolution? And what do you think the world is gonna look like? What's day-to-day life gonna look like? Positives and negatives. Where do you think we're gonna land? Are we all gonna be wiped out by AI? Are we going to be living in utopia or somewhere in between?

Well, yeah, I mean, really the kind of the way I look at it is it's going to be a balance between Skynet and WALL-E. So, I mean, is it going to be something in between? It really depends. So one only has to point to the brain-human or the human-chip interfaces to understand that the technology exists today in some form or fashion. Now assume that that is now going to be iterated upon by other AI agents that are designed to improve and make these things things more efficient and more powerful for the actual physical level integration. And dream interpretation by wearing a beanie. I mean, just this stuff is insane to me. Things that were pure science fiction even 15 years ago are being done today. So I believe that there is going to be, and there currently is, there's an arms race around AI, right? I don't believe it's going to be the nuclear fallout anymore. I think it's going to be how can we devastate your whole economy? Me by flipping a few switches in the banking transaction or something like that. But I also, my hope is that people are going to understand and embrace the technology as something that is still helpful rather than letting it make, I don't want to see a cyber politician as amusing as that would be. I don't want to see cyber politicians. I want to see people making decisions. I want to see people establishing guardrails. It's just like setting boundaries with your friends or family. Everybody's got a friend or family member. They're like, Not today. I'm usually that guy, but it's not today. We're just not going to talk to you today. I mean, you still have to establish boundaries. And I think that realistically, it's going to be great. Now, what the actual impacts, if somebody comes back and looks at this in 10 years and goes, oh man, that guy was an idiot. He didn't clearly didn't know what he was talking about. Well, that's fair. We got a 50/50 shot on this.

Yeah. I mean, it's predicting the future is certainly far from certain. Like if everybody could do it, it'd be a whole different world, right? I, I think I spent a big chunk of my career in the intelligence community and a lot of what I focused on, frankly, was futures, was predictive analysis. People generally shy away from that for good reason. Cause if you're really good at it, your percentages are still really low. Yeah. And people can easily point to all the things you got wrong. If you're decent at reading all the signs and coming up with some good projections and we have a lot of caveat language and we don't say this will happen, but you can be very impactful and helpful and save lives, hopefully. And so as we look at it from here, uh, I see just this wide array of possibilities. And unfortunately, I don't have a great deal of optimism about where it's going to go just because the humans again are the problem, not the technology. It's what people are going to do with it. And the, the, the heavy drive for power or control or money, depending if you're talking about international relations, you're talking about business, over the needs of the many, over humanity. It just seems like we're destined to make the worst possible choices for the largest group of people because a small group of people will be making all of those choices. And so in that regard, I'm very concerned about where we go. I think the technology's great. WALL-E is an interesting example, as you mentioned, for anybody who hasn't seen the movie, that might well be our best case scenario in which, yeah, for those who don't know, in the movie, most people were happy. They just were fat and stupid and immovable, basically lived in a world. Of where nothing mattered because they'd frittered away the entire planet and they were just floating in space in this utopian ship, but they, their lives were meaningless. They didn't think for themselves.

They didn't want equality for anything.

Right.

Yeah. You can, everybody's treated exactly the same. Here's your, all your needs are met. Just relax. We've got this. That's right.

Yeah. They weren't stressed. They just didn't understand how meaningless life had become. Skynet, on the other hand, is a very different scenario. We'll be fighting for our lives against the very smart and powerful robots. So it is concerning though that we just don't know. And it just seems that people are in such a hurry to give away so much here. So I hope for the best. I, we've talked about how this could be great for medical science and mathematics and solving some of the world's most complicated and difficult problems. And we see experts and thought leaders out there talking about all sides of this. I've seen CEOs for these companies that have said 50% unemployment, 80% unemployment. I, some, there's at least one famous CEO said work will no longer exist. Work will be optional. Which sounds really good until you recognize work's only optional for somebody who has all the money they need to not need to work. Work isn't optional. We work. I don't work for free. I work because it's the required trade-off to get the money I need to buy the things I need to live. If all my work is taken away because it's optional now, all my income is also taken away. And I have found that the bank doesn't take smiles for payments on the house.

So you would think they would.

Yeah, it's, so I worry about where we're headed there and people talk about like UBI and just how far this is going to go if work becomes something we don't need. So it's very concerning is where we stand. I don't have a clear picture of the future other than it seems to be coming at us very rapidly. We are seeing people revolting. It's, have you seen the recent graduation speeches? This will kind of screw up the timing of the show because I don't know when this was published now, but where there just seems to be such a backlash from the graduating, you know, university students against AI, right? We're starting to see people that are revolting against this because it's eating up their future or they think it's going to eat up their future. So maybe the populace will be able to keep this in check to some level. I don't know. As you said, people become more reliant because that's just how technologies work. It's how it's designed. And humans are either evolutionarily lazy or efficient, depending on which word you want to use. So it seems like it creeps in. You, even if you don't like AI, you use it a few times, you're like, wow, this does this thing really well. And then you just keep using it for more of that thing, right? So, sure. Just one last piece on this. I, we gotta wrap up here shortly, but on a daily basis, what do you use AI for right now?

I don't use it on a daily basis, to be quite honest with you. Internally to our network, we're a G Suite shop. So Gemini will make recommendations and so on and so forth. And very occasionally I will come up with a headline or a speaking point or something and say, you know, give me something really nitty. I was raised by an English grammar teacher. So when I write things, I'm typically very proper and I know where everything goes. This is a comma, blah, blah, blah, all the things, right? Occasionally I'll use it to iterate a thought or a title or a brand or something like that. And it's interesting to see what it comes back with. Like, I want to make this a little snarky, make it a little less snarky. It's me. That's pretty much the limit of my day-to-day AI interactions with the exception of what my phone decides it's going to do today. Even my, I don't even have any of my AI stuff turned on my phone, allegedly, because I didn't agree to any of the terms and conditions. I didn't log into the Samsung product. I didn't do any of those things. So for my day-to-day utilization, I don't use it very often, but that doesn't mean to say that I don't, I just, I'm very risk averse in my personal life. So I tend to take things, I grab onto a concept and I'm like, never again. I was gullible as a kid, which is why I'm such a cynic as an adult.

Well, there's probably nothing wrong with that, especially in this industry.

Yeah, exactly. Exactly.

Yeah. It's important.

It served me well at Forrester for years.

Yeah. Undoubtedly. Yeah, it's important to be a cynic in this industry because marketing is very powerful and ubiquitous and it's easy to be talking into things if you're not constantly critical of what you're reading and seeing and hearing. So I think all of us are, to an extent, are cynics in the industry. I have to admit, I use AI more than you do on a daily basis. And again, proving the point that it's creep, I didn't mean to. When this first came out, I wasn't all that excited about it. I was concerned about the technology. And then I started using it for things and now I use it for more things. And I have now recently started thinking, man, how much have I already given away? Yeah. And I talked to some of these platforms and I use all of the platforms, which just makes it worse. And they know a lot about me. Clearly there's some data and concepts in there because it comes back and says, well, based on what we did here or what we've done in the past, we should do this now. And I'm like, oh, you remember the thing we did in the past and you remember my family, you remember my friends' names or my, my boss or whatever. And it's like, oh no. And you can't get that back once that's out there. So yeah, it's scary to watch. But it's interesting to hear from an expert like yourself that you're still very conservative on your usage. But you also, to summarize, see the power and the value and the risk of all this stuff. So, absolutely. Before we move to the closing question, I want to ask you one last thing to wrap up kind of the AI piece in a tight bow. If you were talking to, I don't know, friends, family, anybody like that, and they said, hey, what's your best advice? What's the best platform? Which, what's your best advice on where, how do I know enough about AI to be keeping up, but where do I draw my line as far as security and adoption right right now, what would you tell somebody?

What I tell people is all the time is understand that literally everything you say to it is being recorded, cataloged, or cataloged and shared not only internally to that system, but those results being published by that system are probably going to be borrowed from by another system and another system. So just be aware that it's just like the old assumption that the NSA is listening to absolutely everything because they are. Um, no, hey guys, how's it going? Yeah. But that, that old assumption is never say anything on a phone or to a system that you wouldn't want on the front page of the Washington Post. And that's really how I approach it. But like I say, when it comes to technology and even just to break the ice a little bit, not break the ice, but to break out of the eggshell a little bit, you know, even this goes into all aspects of my life. I'm very conservative. I'm— my financial portfolios, I'm very conservative with new technology because I want to understand what it actually is. I don't want to be first gen anything. And that's something that you should be aware of as a consumer when here's the latest greatest thing. For security, for your personal life, whatever that thing is. Here's the latest greatest thing. Well, who vetted it? How well was it vetted? And who were the people that initiated that process? What's their stake in it? Are they shareholders? Are they, are they actually a third party, an objective third party, or are they a subjective third party? Here's your pay. Here's your finance for your research. Here's my conflict of interest. So just be aware that what you're sharing with— I think as a society, we have evolved into oversharing. In everything from social media to leaving your location on your phone to, why do I care? I have nothing to hide. I think, why do I care? I have nothing to hide is even worse than I'm from the government and I'm here to help. You know, so. That's a good point.

I mentioned I talk about post-truth world previously. I've written about the post-privacy world and it's exactly what you're saying. And it's generational. In fact, we went from a generation of people who didn't even want their names in phone books. We paid extra to keep our name out of a phone book. That's right. To a generation that now posts videos of every minute of their day, however banal it might be. I really don't care about your breakfast. I remember foolishly— it was a good example of somebody who looks to the future and sometimes makes predictions being so wrong— when Twitter first came out, I was like, who's going to care? Nobody wants to know every minute of your day and what you're doing.

And oh, here's what you had for breakfast and here's where you're going.

Yeah, I couldn't have been more wrong about just how narcissistic we were going to be as a society, apparently, or how just voyeuristic. People also want to know about everybody else, right? So yeah, it's interesting proving that you don't know where technologies will go. But you're right, it's— I think it's great, great advice that you're offering, that just remember everything is forever. It can end up on the front page. You don't know where it's going. To be cautious in how you approach these things because you can't pull anything back. I think that's good advice. In fact, I'll probably steal it and start using it to talk to people as well. All right, listen, we could have gone on a lot longer. I happily talked for hours about this. We missed a lot of important things, so maybe we will have another conversation. Conversation later. Sure. But people won't listen to hours and hours of show, so I know we gotta get to the wrap-up and I wanna make sure we leave enough time cuz as with everybody on the show, you don't get to duck the final question. The name of the show is Unspoken Security. And with that in mind, I'd like you to talk to me about something you've never told anybody before, something unspoken. Okay.

And this is the bit. So this is how I came and found your podcast. So, and this first part is known, the second part, not so much. So in 2020, my son was murdered in Iraq. Robbery. And it was a, he was 18 years old, shot dead, one to the chest, died in a stranger's arms. So I was working on building a foundation, a nonprofit called Unspoken. So I was going around and, and looking for who has this trademark, who do I have to reach out if it's similar to kind of resolve the differences and stuff. And that's how I came and found your stuff. And so that's, I tell you that to tell you this and something we didn't talk about, but this is really close to heart. If you're a Black Mirror fan, you've seen the episode. Where the woman's husband dies and then hears the voice and then hears the avatar and then hears the whole person. I see people doing that. There are services out there that actually exist today that can recreate your avatar for whatever purpose you like. And one of those things, one of those use cases is to bring back somebody dead. If you have their voice recordings, you have their likeness, you have written things that they've given you to really get a clear understanding. And as technology has evolved, he was 18 when he died 6 years ago. So moving along this line and that progression of everything being online, I could literally feed it his Twitter account, his Facebook account and all these things. And you would get the videos of him playing instruments or doing complex math at 4 years old and doing— he was a brilliant kid anyway. So, but I would never take that additional step because I think that there is a very fine line between what is helpful and what is 100% harmful. And this is sociologically and psychologically speaking only, this has no bearing or impact on anything else outside of that very specific AI use case. I think that's the thing that should go away out of all of it. I don't think it's helpful at all.

That's, I mean, I don't have words for the first part of this, obviously, other than to say how sorry I am to hear about your son. That's, there's just, there are no words. So I'll just leave it with that. The second portion is fascinating. And I imagine many will be tempted to go down that path because loss is powerful. And difficult, and mourning is hard, and there's a long process to it, and it's not linear. It is waves of mourning, and the ability to backtrack from that is going to be incredibly tempting for people.

Absolutely. I mean, you're essentially reinforcing the denial stage of the grief process, saying, no, that's not true, this person still exists, I talk to them every day. And every interaction you have with it, it's going to learn more and more what you're expectations for that interaction are. So when will you know that it's not real? I mean, depending on your religious or philosophical belief, I'm not an overly religious person, but I do believe in science, and science says matter is neither created nor destroyed. Energy, same thing. So in, in theory, he's out there somewhere. And here. Yeah.

Oh, you're exactly right. And it's, that's gonna be very interesting to see how that plays out. You mentioned the Black Mirror episode. There's actually another show that just came out and I it, I'm racking my brain and I cannot think of it now. I just saw the first season of it and it actually went deeper into this. There was a, one of the characters is a genius and her wife partner had died and she had done exactly what you're saying and had this full-fledged AI and it was, it's what this character within the show, which was trapped inside of a computer, of course, cuz they're not a real person.

Right.

And there were, there was a lot that went into that about the ethics of this and the, and just it as a watcher, as a viewer, it really pushed you to think about it. So I, it's interesting you mentioned this cuz I didn't know this actually we were this far along, but. I've had some of these conversations in my own life about where do you go with this? And yeah, the temptation to hear that person's voice one more time, to see them interact, to maybe hypothesize how they would've grown up is incredibly powerful. But we wind up in our own little worlds, not able to move forward. The tragedy is that it is hard enough to get past without inflicting it on ourselves, or like you said, trapping ourselves in the denial stage because that's where we want to be, especially early on in grief. I, I hope I hope there's rules and laws about this, but I guess there probably won't be because of the free market.

That's really an ethical consideration. You could no more say that the United Church of Bacon is not a real church than you can say that there's no reason that you should be able to talk to somebody that's been long gone.

Yeah, yeah. And because we have, as you mentioned, so much, especially the younger generations, living publicly, right? Pulling their Twitter down, pulling their Facebook down, pulling their Instagram down. All of this context, all of this them-ness available to us with these technologies to create a pretty reasonable facsimile. Yeah. It's, and that's even as, as, as powerful a concept as I've had on the show so far. Yeah.

And beyond that, from a, a real, beyond just the, this really shitty part that I just talked about, it's been used to recreate voices and avatars to be used to help break into systems. To call in the help desk. These are well documented. So the technology exists. And so then you have to, then you get into, like I said, all the ethics regulation, you know, how you can't regulate it and say you can't do that because then you're affecting people's freedom to choose whether or not they want to live a lie.

So, exactly. Thank you for sharing. Again, I, my, my deepest sympathies. There's nothing, there are no words for such a tragedy.

They're just words.

It's been a while, but also the interesting concept that you brought up that people need to think about where this is going. This is certainly going to happen and probably become a growth industry because again, if there's money to be made, there's somebody who will do it. And so something I hadn't really thought about deeply about AI and where it's going is there's a whole nother concept there of the, the people that won't die, so to speak. They will, but we won't allow that to happen. And there's one thing to have a living memory and there's another thing to have to live inside of that memory.

Well, plus everybody wants to live forever, right? So it's going to advance medicine to make us live longer. It's going to advance our ability to recall. Excuse me. It may be the solution to Alzheimer's, not stopping the plaques in the brain, but allowing you to upload your memories. So I go, I remember this because here it is. And now I know it's true, but then you open the door to modification. I mean, so it's just like I said, there's so much going on. We could spend days on these topics and go literally apply step by step through every aspect of human existence and, and talk about the good and the bad. And I think overwhelmingly. Generally speaking, it's probably pretty good, but I'm going to be prepared with my Digitizer 3000.

Right. Well, listen, I want to thank you for taking the time to come on the show. I'm glad you found us and I appreciate you taking the time to be on. I couldn't be more honored that you came on the show and talked about this. We may have you back on because there's more to talk about, obviously. Sure. You're very smart and interesting and I think people benefit from hearing your thoughts. So I appreciate you being on the show today. Is there anything you want to leave the audience with? Any last thoughts? Anything you want to plug? Anything like that before we close out? Giving guests one more shot if there's anything on their mind.

Oh no, I'm fine. I think I covered the gamut. The only thing I really just remind everybody, non-vendor pitch, is pay attention to what your AI agents are doing on your network, and you can only do that from the network, full stop, period, no matter what anybody tells you.

Yep, that's exactly right. Pay attention, and you can only do it from inside your own network.

Very true.

All right, listen, so we're going to close out the show. For everybody listening and watching, thank you for taking the time please subscribe and like and share positive feedback. If you have things to improve the show, please let me know. Please share that feedback as well. If you really hate the show, please don't tell people. It's hard enough to do this. I don't need that spreading around. Just let me know and I'll see what I can do to make it better. But with that, I'm gonna go ahead and close out this episode. This has been another episode of Unspoken Security.

That's a wrap for this episode of Unspoken Security. If you enjoyed this episode, follow us wherever you listen to your favorite podcasts. See you next time.