EP146 AI Security: Solving the Problems of the AI Era: A VC's Insights

Security.

This is the Cloud Security Podcast by Google. Thanks for joining us today. Your hosts are myself, Timothy Peacock, the Senior PM for Threat Detection here at Google Cloud, and Anton Chuvakin, a reformed analyst and senior staff in Google Cloud's Office of the CISO. You can find and subscribe to this podcast wherever you get your podcasts, as well as at our website, cloud.google.com/podcasts. If you enjoy our content and want it delivered to you piping hot every Monday, please do hit that subscribe button. You can follow the show, argue with us and the rest of our Cloud Security Podcast listeners all on our LinkedIn page. Anton, this is a fun episode because we are going back to a long ago topic for us, which is VC, and bringing in a very modern topic for us, which is AI, and hitting on a constant theme on the show, Which is that problems in cloud and problems in security tend to rhyme with things we've seen before.

Correct. And I think that we are also— one of the most fun elements of this episode would be kind of deriving lessons from the previous, quote unquote, transformations, namely arrival of cloud, arrival of containers, and now the arrival of AI and generative AI has been causing somewhat of an upheaval, I guess, with this. What we can do with lessons from recent past is kind of curious.

And I think our guest today is so well suited to providing that perspective, given his experience first as a founder of a company that was acquired, now as a VC observing the ecosystem. You said some ways into the episode that this is the most interesting part of the episode. I think looking back, I mostly agree with you, but I feel like it's interesting throughout. And so maybe with that teaser, listeners, let's turn things over. Today's guest. Today we are joined by an old friend of mine, first time on the podcast, Wei Lian Dang, a general partner at Unusual Ventures. Wei, delighted to have you on the show today. Wei and I go way back. We have a mutual friend that I just adore. So shout out to Ryan for connecting us. Wei, I want to start off talking about AI for security versus security for AI. In my mind and in the mind of a lot of Googlers around me, Those are pretty distinct things. When it comes to how you're seeing the market and how you're investing, do you agree? Are they different? Is it a useful distinction? Where are we at?

Thanks, Tim. And really excited to chat about this subject. I would generally agree. I think these are separate and distinct in the sense that it's a different set of problems that you're solving for each or that you're trying to figure out. When it comes to securing AI, there's a whole new set of security challenges people are trying to navigate right now. When you're running these LLMs, when you're running these foundation models, you have to think about new ways to protect them. Whether it's the input and the prompts, whether it's how data is used, whether it's the robustness of the models themselves, that's a certain class of problems. I think that's distinct from how do you take LLMs and foundation models and apply them to different security use cases. How can vulnerability management or detection and response or security operations at large benefit from AI? And so I do think they're different things, but they might be related in the context of how organizations are thinking about incorporating AI. For instance, if you're applying LLMs to security operations, you then have to think about how you're going to protect those models. What's your strategy around it? What's your approach? What's sort of tooling and set of solutions that you might suddenly need to think through? So I do think they're related in the context in which people are adopting AI, but they're a separate set of problems that people have to figure out.

By the way, you made a subtle but interesting point. If you are using AI for security, you probably want to secure it really well because admittedly your AI for security would be the target for attackers. So in that sense, if you are doing AI for security, you have to do security for AI.

Yes, that's what I'm saying, Anton. And I do agree with that. Now, I think what you need to sort of prioritize or think about first, I mean, I do think there is that sort of stack ranking that people have to think through in terms of what what it means to secure AI. I also think it's in the context in which, how are, you know, as a company or as a team, are you using AI in terms of your existing workflows? Or is it more you're augmenting what humans are already doing versus are you wholesale sort of, you know, relying significantly on the AI to actually go automate and take care of certain things and reason about, you know, certain things where you would normally have a security operator or analyst or someone else? So I do think it's sort of the extent to which people are thinking about incorporating AI, the relevant use cases. And then I think within protecting sort of model usage, there is a set of different problems that people are thinking about and happy to kind of elaborate on that.

No, I think this is just such an interesting and worthy point that Anton highlighted that you made there, Wei, about as you're using AI for security, you really need to think about the security of that AI. That is, you know, a vendor made this point to me kind of unintentionally a couple of weeks ago. He was explaining to me, and I'm not going to name the vendor, 'Cause that's not very nice. A vendor was explaining to me how they were using OpenAI in their product to help people understand what was being detected. And they helpfully pointed out, but by the way, we don't share the IP address of the vulnerable asset when we send this to the AI. And I'm like, oh, I'm glad you sanitized it that much. But still, that kind of speaks to the unknown unknowns here and the danger that people are taking on. So that's very interesting.

For sure.

I mean, I think it's super early and nascent. I think you have a lot of organizations who simply think, well, I can use OpenAI and they're a well-known, reputable company, and for now that's good enough. But I think when it comes to actual implementation of tooling, and to your point, Anton, how you actually build the right safeguards around usage of large language models and And so on, it's much more complex and it's much more nuanced.

So let's maybe focus on this kind of security for AI side. And I think being a VC, you invest in companies that are trying to capitalize on AI. And my fear sometimes is that with this technology wave, we're going to make the same mistakes as in like with mobile and to some extent with cloud when we build the technology first and then we bolt on security in 3, 5, whatever number of years. What kind of security problems do AI innovators want to solve? Like, what are you hearing from AI companies? What sort of security challenges do they have? Because if you say none, I'm going to go invest in a bunker somewhere in New Zealand where I can hide.

Well, you know, so I do early-stage security investing. And so I have the privilege of seeing what's brand new and what people are thinking about from a formative standpoint. I do think that there's a whole host of different problems and challenges people are tackling. I would say they're not necessarily equally important, in my opinion, Anton. But, you know, to kind of break it down, I think that there's a set of companies and a set of security leaders who are thinking about, how do I protect around data usage and access in the context of utilizing AI? How do I build in assurances that, for instance, my data is not utilized to train a third-party model? How do I build in protections that safeguard what data is sent to, say, hosted model providers? How do I weigh that against the trade-offs of protecting self-hosted LLMs, for instance? So I think data is one category or pillar of AI security. I think another is around— you might characterize it as sort of like network or like inputs. Which is how do I think about prompting models and the risks that that creates? How do I think about, am I concerned about prompt injection and those sorts of attacks? You have the OWASP Top 10 for LLMs now, so there's a familiar framework people can utilize to map to AI security. I think that that's another bucket. I think a third pillar to point out is really how do I protect the models themselves from Whether it's— people talk about data poisoning and so on. I think it comes down to how can you train a model to be robust enough such that the output of that model doesn't in and of itself create security risks or other organizational risks. For instance, people don't want unique identifiers being sent out to end users or customers in terms of model outputs. They're concerned about the risks that that can create. I think there are these different pillars. I mean, To go even further afield, I see companies thinking about supply chain risks around the foundation models. Are these vetted? Have people looked at the vulnerabilities?

But what about supply chain for training data? For some reason today, the day we're recording it, it's been the day that this topic came up roughly 5 times before lunch. And it's really interesting. Is it coming up from your clients?

Well, Anton, by supply chain for training and so on, can you elaborate? What do you mean by that?

Provenance of data. Where is the data coming from? Who had access to it? Who touched it? Who changed it? Have they introduced subtle bias that would then produce something useful to an attacker or a threat at the output, basically?

Is that question even worth worrying about? We already know that the training sets produce egregious bias. Why are we worried about subtle bias?

Because they're afraid that the— so egregious bias versus subtle bias, this is a fascinating topic. I think that roughly from our audience, maybe 3 people would enjoy it, but that's on top of us. But I think that egregious bias that affects everybody and the subtle bias that benefits one person do sit in different buckets, right? Like, if the specific perpetrator biased it in a way that makes him billions rather than everybody else loses a dollar, I think it still goes into different buckets in terms of problems, right? Yeah.

You know what's funny? The thing I love about AI security is how many times the problems rhyme with other problems in security and egregious failure versus subtle failure. That's like a classic problem in crypto systems, right? Like, we've got egregious failures of crypto systems and then NSA compromise of crypto systems, same thing. So I don't know, Wei, what are your thoughts on this?

Well, I do think it's a very interesting topic, and I do think people are thinking about it both in terms of for the data that's used to train a model, like the person who's sending that or using it, should they actually have access to that? What are the inherent risks in the data that's And so on. And I think on the flip side, it's like, how do you guard against— I would say the corollary to that is, let's say a model was trained on data that someone shouldn't have access to. How do you deal with that from the output side? How do you deal with RBAC and data access and permissions? Someone asks around some business metrics, they prompt the model and ask a question around, like, what are the sales figures for this particular segment or customer. And if they were just interfacing with the data warehouse, they wouldn't have access to that. And so how do you manage that when something's just being spit out by the model? So I think it's end-to-end. It's the provenance that you were talking about, the bias in it, the quality of the training data, who's submitting it and working with it, all the way to the output and who should have access to this particular output. And companies are still figuring that out. It's definitely a topic of discussion.

So I guess on that note, is this a thing you're investing in? What's getting the hotness right now? Because I'm sure there's hot investing happening. Is this an area that you're looking at, or is it other stuff?

Yeah, no, it's definitely an area that we're looking at. And we're also looking at applying AI to security and using LLMs for security. I mean, I think the way we think about it, going back to the first question, is pretty different. I think from a standpoint of AI security and how you secure these new AI and model-based systems, It's really a question of, I see security leaders trying to figure out what can I extend my existing tooling to cover and what are the new gaps that exist that I don't have a solution for, and it's pressing enough or risky enough where I need to solve for it now. On the LLMs for security side, which we're also really interested in, or it's something that I'm paying particular attention to, Mm-hmm. I think you have existing companies, existing vendors that are extending and augmenting with LLMs. And so I think that creates interesting challenges from a product and go-to-market standpoint for new companies, because how do you insert yourself into that? Like, do you want to really go build a new LLM-enabled MDR or detection and response solution, or do you want to bolt on?

Right.

Particularly in a way where existing incumbents are going to, you know, there's everyone thinking about this. So I think in that space, it's less a question of, is there meaningful value in utilizing AI for security? It's really, what does that product look like? And how do people get started with it, especially in a world where a lot of the existing platforms, Google included, have a bunch of the data that you need to actually drive efficacy of the AI itself?

I mean, this comes up. This gives me flashbacks to my Gartner days, kind of intense flashbacks when People would show up in vendor briefings and they would present something fairly interesting. And I would think, wow, that's really, that's like a secure one component of middleware or it's middleware for middleware or something, or it's some really narrow sliver with possibly something interesting. But it's very hard to imagine that we'll be living in the world of like, here is my cloud security platform, here is my AI security platform, here is my whatever other platform. So it's actually kind of a fascinating question and I hope you can answer it magically and crisply and briefly. Would we have future AI security products as a separate category, or would it be part of securing cloud, including AI? I think one of the cloud security platforms have announced securing AI toolsets, right? So it's kind of already happening. Yeah.

I mean, I think my perspective, I'm curious to get yours and Tim's, my perspective is there's kind of the immediate and sort of short-term versus the long-term. I think in the short term, and you've seen this play out, I mean, I saw it play out, you know, having been a co-founder of StackRox with container security, which for a time, you know, similar to AI security, for a time, people are going to kind of want some sort of standalone solution because there's a window where everything's new and there's a gap in the market. But I think the general trend in the security industry, especially on the customer side, if you talk to CISOs, is consolidation. And to me, one way to sort of demarcate is you have pillars around infrastructure, applications, data. And to your point, Anton, I think in the very long term, there's not necessarily— it doesn't necessarily make sense to have a standalone AI security solution. This gets baked into one of those areas. There's other ways you can kind of, I think, slice and dice the security world, the security stack. But to me, I think over time that makes sense. In the near term, there's tremendous opportunity for new companies and founders to create—

To just go fast and be focused.

For sure.

To go fast and be focused. Fast and focused wins very crisply, and we've seen many examples. By the way, if you say consolidation, you almost have to add never-ending consolidation, because whenever I say consolidation, somebody shows up out of the bushes and says, Anton, you're an idiot. The security industry is never going to consolidate, because consolidation Was predicted many times, but actually never happened. But we always have consolidation. It's consolidating.

Isn't it always happening?

It's always happening, but it's never achieving. You're closer to an English major than I am. But like, it's ongoing but never ending. It's basically always happening, but never is going to happen.

Yeah, yeah, yeah. It's like maybe Zeno's paradox of security trends, except I think really what's happening is the industry keeps growing what it has to protect.

Or or it's asymptotic in time. You know, you cover the low hanging fruit, you know, eighty percent, but then it's an exercise in. Continuing on and on and on, to your point.

So I really enjoyed your podcast that you did on the Startup Field Guide, which is a podcast your firm produces, talking about your experience with StackRox. What do you think are the lessons for this wave of companies out of that wave of companies? You know, you mentioned the container security market. What do you think we can learn from the past here?

I'm sorry for barging in, but I think this answer would be worth the price of the entire episode because containersec and cloudsec lessons From the early 2010s may be magically applicable to the current wave, if only we learn them rather than repeat the mistakes.

Yeah.

What Anton's saying is they asked a good question.

Yeah, yeah, really, really good.

Well, I think it ties back to the previous question, but what I would say is my learnings and observation from having built StackRox and seeing the whole shift to cloud and cloud-native architectures is there's a lot of focus on, oh, the attack surface and the footprint, and like you have containers and you have Kubernetes and you have these things that are not covered by security tooling. To me, actually, that was not really the primary driver in what created the opportunities for newer companies. I actually think it was the shift in persona in terms of who was driving the thinking and adoption of these security tools in the sense that it was actually not really sort of like the central security team within larger organizations. It was the development and DevOps and operations platform engineering teams, infra engineering teams That was driving that. And I think that gave the opening for some really new substantial companies to be built. Some of them ended up as part of larger platforms, but some of them are still going standalone. I also think if you just look at that context in terms of cloud, like it's what's given rise to significant platforms like Wiz and so on. And so I do think it's this combination of when you have a platform shift, and I would analogize to AI, There's sort of a new surface area that you have to cover, and that's an opportunity to build new tooling. But then it's kind of like, who's thinking about this? And it's not just necessarily the security team. I think in the AI context, you have the rise of what people call the AI engineer, or every developer is going to be an AI developer. You have prompt engineers as kind of a new role or function or job that people advertise for. So I think that creates opportunities as a tailwind to create You know, a new type of company that doesn't necessarily think about security in the traditional context.

I think the persona thing is hugely important.

Is there like a thesis here to focus then not on the security buyer, but on the dev buyer or the ops buyer?

I don't think I've made up my mind on that one, Tim. You know, I think that it's still early and you have a lot of tinkerers in AI, you know, people who are building hobby projects at the same time. What's really exciting is you are starting to see more and more LLM or AI applications moving their way towards production. I do think though, in this case, different organizations are, you know, and who's thinking about these priorities, it really does vary. I think there could be opportunities on both sides, frankly. Like there could be things that you want to think about that are better targeted or aligned with what engineering is doing versus other things that your security is trying to figure out.

But I think the meta lesson from this is that cloud really caused this change because a lot of cloud sec is sold to cloud people, not to security people. And admittedly, even in my Gartner days when I was supposed to be like the all-knowing dude, I made this mistake myself. I've met people who tried hard selling cloud security to security people and completely ignoring the cloud people. And the result was subpar. And now I learned it. I mean, I know better. Is that even— Actually, maybe Tim enlightened me that SCC is sold to cloud people and security people.

Yeah, both.

And something of the same sort may happen here. That's interesting.

I do think one thing that's interesting about AI, you know, if I could analogize to kind of the shift to cloud, is there were almost a set of basic controls. I use basic in the sense that these are controls that are table stakes that now are recognized as everyone needs. And you also had things like CIS benchmarks and different frameworks for how people should think about managing certain baseline level of controls, security controls on cloud. And that gave rise to CSPM and so on. And these new categories where you had businesses like Wiz enter have now expanded into adjacent categories such that it's just cloud security. I mean, people just think about cloud security at large. And so, I do think there's this aspect of AI where there's probably some sort of baseline standardized set of controls that the industry or the ecosystem will work towards over time. I do think cloud providers like Google have a big hand and role in shaping that and how we think about that. And so I think that could also give rise to interesting opportunities for where people can kind of get a wedge to start in terms of if you're a new startup founder, like, you know, how do you get a foothold in the market? I do think there's something similar that will likely emerge in AI.

That's a really interesting thing, and I wish we had more time to dig in on that last point, particularly the how do you get a foothold here, but we're coming up on time, and so I have to ask our traditional closing questions. First, do you have a tip to improve security, AI, maybe investing, or for people that are pitching you in this area? And then 2, do you have recommended reading?

So I think on the first, Tim, I think thinking you know, really carefully. And, you know, how you tell the story around your unique approach or differentiation is critical. Because I think in this environment, like, where it's very noisy, and it's very early, there's dozens and dozens of the same pitches. And it's really hard, you know, as an investor to say, hey, this stands out in terms of how you're going to tackle this particular market, especially given some of the structural challenges that I was outlining earlier. I think in terms of recommended reading, I mean, you know, I certainly would plug our startup field guide, you know, if you're a new founder, I would say there's security leaders out there that are helping to provide primers on how to think about LLMs and LLM security. So Caleb Sima is one that comes to mind. He's been posting some interesting materials and content. But I would actually— what we love to do and what I love to do is spend time talking to security leaders in these organizations who are trying to figure this out in real time. And personally, I think there's no replacement for that. There's no way to compress that set of learnings. I think if you're a new founder and starting a new company, either in AI security or applying AI to security, I think it's imperative that you kind of spend the time to do that discovery.

That all makes a ton of sense. I love the story about differentiation and discovery. Do you have recommended reading?

So just on recommended reading, I would say there's not much in the way these days right now yet, but I would say take a look at materials like the OWASP Top 10 for LLMs. I think that's a good starting point. You know, if you're coming from it as a security practitioner or someone who's trying to familiarize yourself. Frameworks like that, I think, can be helpful in helping to categorize and wrap your head around how do I map something that I'm familiar with, more traditional security, and how I can understand that in the context of AI security. I'd recommend there's a new guide around the OWASP Top 10 for LLMs. I know some of the folks involved in the project are working on new books. I think once those come out, that'll be good reading for all of us.

Amazing. Well, Wei, thank you so much for joining us today. This was a ton of fun.

Thank you, Tim. Thank you, Anton.

And now we are at time. Thank you very much for listening and, of course, for subscribing. You can find this podcast at Google Podcasts, Apple Podcasts, Spotify, or wherever else you get your podcasts. Also, you can find us at our website, cloud.withgoogle.com/cloudsecurity/podcast. Please subscribe so that you don't miss episodes. You can follow us on Twitter, twitter.com/cloudsecpodcast. Your hosts are also on Twitter @Anton_Chuvakin and @_TimPico. Tweet at us, email us, argue with us, and if you like or hate what we hear, we can invite you to the next episode. See you on the next Cloud Security Podcast episode.

Security.