EP196 AI+TI: What Happens When Two Intelligences Meet?

Secure running. Hi there.

Welcome to the Cloud Security Podcast by Google. Thanks for joining us today. Your hosts here are myself, Timothy Peacock, the Senior PM for Risk Analytics and Cloud Threat in Google SecOps, and Anton Chuvakin, a reformed analyst and senior staff in Google Cloud's Office of the CISO. You can find and subscribe to this podcast wherever you get your podcasts, as well as at our website, cloud.google.com/podcasts. If you enjoy our content and want it delivered to you piping hot every Monday, please do hit that subscribe button. You can follow the show, argue with us, and the rest of the Cloud Security Podcast listeners on our Google Cloud Security community page. Without any further ado, let's turn things over to today's guest.

Hello, and our guest today is Vijay Ganguly, Director of Product Management at Google Cloud Security. Welcome to the show.

Thank you. Thank you, Anton. Very, very, very happy to be here. Long overdue.

This is also one of those Timless episodes, not to say timeless. Maybe it'll be timeless, but it is a Timless episode, and we are both really sad that Tim's not here today. So anything sad you have to say on this?

Yeah, as you know, Tim's on my team, and he's been on my team, and I think he's going to miss it because usually I'm the one asking him questions, and this was one time that he could have asked me questions. So yes, we both miss him, but I think he'll also miss this episode.

I think that we should have some kind of inside joke because he'll be listening to this one. I'm pretty sure. So we'll just— Tim, if you're listening to this, well, I'm sure you are, please make sure to check for inside jokes.

Yes.

Okay. Yes, we'll try. Yes.

We'll try. And of course, we are not as good at puns as you are, as you know. So back to our topic. This is a fun topic because it's kind of an overlap of threat intelligence, detection, maybe detection engineering, and AI. And let's start with somewhat of a background. And I guess most people who deal with TI or GTI or CTI, however you call it, would know. So historically, in your opinion, what has been the biggest pain points for organizations trying to use threat intelligence, whether it's challenges with curation, slowness of feeds, false signals? Like, give me the lay of the land, why it has been so painful for some people.

Yeah, no, I think that's— it's a great question, and there is a fair bit of history here, and it goes back to vendors in some sense. If you look at the threat intel vendors, the market has been very, very fragmented. And the question then comes through, why has it been fragmented? And I kind of think of it in 3 dimensions. The first one is visibility. The second one is technology. And third one is threat expertise. And if you look at most of the vendors historically, they've had very limited visibility into threat landscape. What comes to mind is this whole blind man and the elephant thing, right?

Yeah.

Where it's the analogy. But that's what it's been like, right? But even if you had limited visibility, they were also not armed with the greatest of technology, right? And when you have those problems, in spite of having threat expertise, it leads to a set of challenges. First and foremost, because it's fragmented, now a customer— imagine a customer's journey. What do they have to do to understand the threat landscapes that's relevant to them? They actually have to source it from multiple places, okay? Curate all of that because these things have different data models, might have conflicts, might have overlaps. So you've got to curate all of that manually. Once you do all that, you have to integrate it into downstream systems where the threat intel gets converted to protections for your organization. Once you integrate it, then you have to write the specific controls in each of those systems, which are detections. In some cases, it could be prevention policies and so on and so forth.

Yep.

Now, every time there's a change, either in the threat landscape or in the environment, which happens every second, rinse and repeat. So what happens? It's very hard to do that. And then the vendor landscape, because they have limited visibility and they're not technology-enabled, they have very shallow context. And threat intel without deep context is really not—

Oh, we're down to lists of bad IPs, which is the most depressing take on TI I've ever seen. When it's like, here's TI, Well, this is just a bunch of bad IPs, right?

Right, right. Exactly right.

Oh, wow.

Yeah. You cannot, like, you can really not do much with that, right? It's not very actionable. So those are things that— I know it's a longish answer, but it's not one bad thing. It's so many things that contribute to just threat intel being really, really hard to organize for a customer.

I think that makes sense. And I think that it's the difference of sources also reminds me of my Gartner days when We tracked, I think, the leading 40 TI vendors or something. It was some kind of ridiculous number, which was tagged in all the spreadsheets as key vendors to know. And you open the spreadsheet, you think, oh, the key vendors. And it's like, oh, why do we still have 35 of them? Oh, it's because we removed 3, but then 7 more were added. So, a lot of this is very fragmented. But another pattern from my old analyst days was that A lot of people seem to live in the 1, get more TI, 3, profit, and they have no idea what's step 2. So, the operationalizing of TI has been super difficult. Like, if a vendor shows up, and I don't want to say it's us, but some vendor shows up and says, we have the best TI, and it may not translate into a customer becoming— feeling less risk, becoming more secure. So, this whole operationalizing or converting threat knowledge into some useful security measures has been very painful. It's probably, to me, it's the number one pain. The other pains are great, great pains, but this pain to me is like the pain. So why has it been hard to turn knowledge about threats into actual defenses?

I half-jokingly say that threat intel has made people wise but not made companies safer, right? And therein lies the big conundrum. And I think operationalized threat intel It's really a massive market. It's a massive opportunity in front of us. And we actually, I think it's our responsibility to deliver it. So the question you're asking, why has it been hard? Again, there are a multitude of reasons, but I think bad threat intel or hard-to-put-together threat intel is one of the primary causes. If you're not able to convert raw threat intel to structured threat objects that are consumable by machines and humans alike in an automated fashion at scale, converting those into defenses almost cannot happen. So first of all, you need that first step. But the question is, even if you were to do the first step, how do you convert the knowledge about the threats to protections in your environment? And there are many reasons why this hasn't happened. One of those is that How you do that is through detection engineering. People who do detection engineering understand the environment, not the threat landscape, but understand the environment. They need to write detections that actually operate in that environment. They need to understand the logs that are getting in there, right? The threats themselves are understood by CTI analysts, and these people have been separate. We need to bridge that silo. So, it's like the yin and yang. They need to work together to actually make that happen. And those have been siloed. So, the opportunity is in bridging them. And there are tools and technologies that allow us to do it now, but this hasn't been the case in the past. So, that big gap has been—

But isn't it just about some box-selling vendor of, like, I don't know, firewalls saying, we're going to integrate TI into firewalls and the whole thing is done? Like, there were vendors in the past who have security tools, firewalls, whether it's firewall or SIEM, and their own first-party TI. But ultimately, they still have not delivered on that. So, why not? By the way, if you, the audience, thinks I'm taking a jab at a particular vendor, I'm really not. I do see firewalls, SIEMs, or others with first-party TI. They've existed for 10 years.

Yeah.

but they have not really delivered, yeah, we fixed the operationalizing.

Yeah. I think there's another dimension to it, right? Which is, we often talk about pyramid of pain in the context of threat intelligence. And for the audience, just very quickly, things at the bottom of the pyramid of pain are very easy for adversaries to change. It's not painful for them to change it and hence evade any security controls. Things at the top of the pyramid are very, very difficult for adversaries to change, And hence make up for very effective security controls. And on top of the pyramid, you have, you know, TTPs or tactics, techniques, and procedures that hackers use. On the bottom of the pyramid is things like hashes and maybe IP addresses, which are very, very easy for people to change. Now, when you talk about firewall vendors as an example, you know, we still operate at the bottom of the pyramid. Even if you are able to operationalize it, people can actually change them very, very quickly and evade all your security controls. What has been hard as part of this operationalized journey, operationalization journey, is to actually move up the pyramid of pain so that you're actually putting your controls that map to techniques, tactics, and procedures that attackers are using. And that again has not been easy, right? And we can talk about like why that is not easy and how we can solve it now, but that has been one of the key conundrums for us.

Yes, I think I agree because ultimately most of the vendors who claimed to have a box and packaged intel really did focus on the stupid bad IP lists.

Yeah.

Like, it was not really— so you're right. Actually, I had a mind-opening moment at this point, actually, funny enough, because it's been kind of a conundrum that so many tried to say, we have a box, we have TI, they're integrated, but it still didn't work out. And it didn't work out because their TI ultimately was not TI. It was sort of like still bad IP, bad domain. It wasn't really intelligence. It was kind of like blocklists, blacklists, whatever the term today, shoved into a product. It wasn't the intelligent enablement.

I completely agree with you. I think we collectively as an industry have to move up the pyramid of pain. And if we are just tottering at the bottom of the pyramid of pain, that will be both noisy and will be riddled with missing attacks.

Right. You get the pain, but you don't get to climb the pyramid. Sorry. That's not a very inside joke, but okay, fine.

It'll have to do.

So now I want to bring the subject du jour, namely AI, into this conversation. And I think that we are living in an age where, of course, hype is still deafening, but I think that we are clearly starting to slide off the peak of the hype cycle, at least if we are to believe my former employer. And occasionally I still see people who think it's all hype. I think these people are wrong. It's very clear at this point, but they still exist. So what's genuinely different about AI In the context of threat intelligence and in context of turning threat intel into something that makes you secure? I wouldn't notice— I'm not saying detections right away— turning TI into something that makes you measurably more secure. Like, how does AI help that?

Right. I think it's very useful to answer this question, what's different with AI, independent of threat intelligence, first of all, this time around, because I think we've been through AI hype cycles and winters since the '60s, right? The first one was in the '60s. And I've been a practitioner of AI for a little while as well myself for the last 15 years or so. And I do firmly believe this time it's different. I'll tell you why it's different. The specific thing that's different now is the generalizability of the AI.

Okay.

What we had before this was what I would call narrow AI, which means that you're doing largely supervised learning on specific tasks. Any model that understands, gets trained on a particular task, actually starts from zero with every new task. It doesn't remember any of its learning, right? So, and that is something that has changed. What you're seeing with these LLMs are large pre-trained models that are trained on one task, but are actually able to generalize that ability to other downstream tasks without any significant new data. Right. And that is the big, big, big improvement that we've achieved. And that generalizability is what has opened up many, many avenues, even in threat intelligence, right? So let's talk about threat intelligence. Threat intelligence, in my mind, again, broadly breaks up into 2 phases. One is taking all that raw data that you get and converting that into structured and actionable threat data.

Mm-hmm.

And then converting that into operational detections and controls. So I think that's the second part. So let's focus on the first part. The first part essentially is raw, unstructured data coming in. It could be— and it's multimodal. It could be text, it could be screenshots, it could be videos, audios, whatever. All of those coming in. And you need to then extract structured data out of it. And this is where GenAI is super useful. Today, if you look at threat research pipeline, That process is highly manual. We do use machine learning techniques, but we use the NLP of the previous generation. Entity extraction would not have as much effectiveness there than with the current-gen technology, right? So that whole pipeline fundamentally will increase both in throughput and speed, right? So we'll see a dramatic improvement in both of those because of that. The net effect of that is another version of TTP, which I call time to protection. Not tactics and procedures, but threat information.

Tactics.

And it's actually going to come down dramatically because of GenAI here. And that's what we are doing, even at Google, as you're probably aware. And then there are other islands of threat research that are very, very important, critical, like malware detonation and malware analysis. So we have used GenAI to do effective malware analysis And detecting new stuff and doing it much faster and much more efficiently, right?

Yeah, those VT blogs by VirusTotal when they loaded up reversed code into Gemini and just got magical results, they were super impressive. From the recent discussion of the GenAI for security use cases, these were like the legit use cases that are novel, impressive, and people look at them and say, you did what? And it's like, yep, that really happened. So I think that we have obviously a bit of a shortage of such use cases, but there are some that are really impressive. And of course, some of them are not public, but equally impressive, kind of on the threat research side.

Absolutely. I think CodedSide is one thing that clearly stands out, but I think the overall pipeline for threat research is going through a sea change because of GenAI. And I think that will dramatically, over the next year or so, you'll start seeing the effect of that in the core problems that we identified, like fragmentation, that curation, all of that starts to reduce dramatically because of infusion of this technology. Yep.

So let's talk about— I know, with apologies to the audience who actually may be curious about how specifically we do it at Google, it may sound a little marketing-ish, but it also kind of would reveal some of our— maybe not secrets, but I think some of the tricks. So can you elaborate on how we actually talk about AI-driven operationalization in Google TI? Like, how does it work in practical terms? Like, or as Tim would say if he was here, what gets better once we started doing this for GTI specifically? And GTI is, of course, a unified brand for the combination of TI from VirusTotal, Mandiant, Google, and other sources that we have.

That's right. That's right. So I think, yes, you're right about Google Threat Intelligence essentially is the brand that brings together You know, Mandiant, Google, and VT, and actually becomes not 1 1 1 3, but 111 and more, right?

Mm-hmm.

So that's what it does. And while that's a separate topic, specifically around operationalization, how we leverage where the opportunity lies is that, remember we talked about taking structured threat objects where you understand what the bad actors are doing. You have to convert that into security controls. Which means when bad actors do something in your environment, they're leaving evidence behind that shows up in logs, and you have to detect patterns in those logs. And that often translates into detection rules and so on and so forth that you have to write. Now, that conversion is something that is very tedious today.

Yes.

And AI essentially can dramatically help reduce, and it's already doing that in GTI, is that what you will see is curated rules and detections coming out of GTI as part of your threat intel, crafted in different languages that are relevant depending on the downstream systems that are ready to be tested and then deployed in your environment, right? So, I think the automation of detection engineering, which is the manifestation of operationalization of threat intelligence, would be one big area that you would see. And this goes back to the time-to-protection value proposition that I was talking about. Instead of going from months, you will be talking about minutes in which you go from knowing about a threat to actually having a protection deployed against it.

So that means that instead of humans shoveling a pile of data, turning it into intel, then another set of humans talking to the first set of humans to write rules, then recheck with the first bunch of humans to check if it adequately describes it, it sort of goes into the funnel, a handle gets cranked a few times— sorry for the pre-IT Computer visual, and then effective, workable, robust detections come out at a speed that's much faster than what it was before, but with the quality that's also higher. So that is the— I think that in the past, people did have a lot of automation for pipelines, say for malware reversing and dynamic analysis, but the detections were often quite bad. Here we have actually both speed and quality go up. And to me, that's quite magical.

Yes. And I think this is a journey. Right. I think we will take some time to get there. And again, it's not going to be many, many years, but it's going to be 12, 18 months. We'll start seeing dramatic improvements in this. And we have to remember that we will still have human override and human oversight to all of this.

Right.

And the pipelines will actually automatically surface things that require approval because they will automatically test it on data that we already have before they get deployed. So there's a massive amount of automation that you'll be able to achieve with humans in control to make this happen.

That makes sense. And I think that I want to also ask about the balance between human and AI in AI work, because ultimately it's very clear that a lot of this is run very much by humans. There's no, hey, Gemini, write detections for what's relevant for me, and then out of thin air they drop into your lap. I mean, it's obviously not like that. But how is the balance between what the humans do, what the threat analysts do versus what machines do? And do you see this balance shifting somehow in the future?

Yeah, I think I'll start with the last part of the question first. Absolutely, the balance will shift because I think in many ways we are at the front end of some of the technology revolution that we are seeing in the AI space. So what AI can do today versus what AI will be able to do in this domain 24 months from now is going to be dramatically different. So given that, I think the balance today is in terms of humans being assisted by AI. That's where we are at today. Humans get massive assistance and it shows up in things like what we have, Gemini Assistant, and so on and so forth. Where we will go as new layers of technology get added to LLM-based technologies, reasoning layers on top of it that is happening, what we will see is that Humans would be more of an override oversight mode over time, right? They'll be controlling it, they'll be defining it, but be run by AI with human override and oversight. That's where we'll get to. And another way to think about this is that today a lot of the AI is applied to the right of the security operations workflow. So investigations, any playbooks and so on and so forth. We'll also start to see it moving to the left as AI becomes more sophisticated. This is when detections also will start to see AI playing a role in detections as well, right? So that's one way to think about it. Humans becoming override and oversight and AI shifting to the left as well.

But that means probably not the collection, because ultimately, if somebody needs to get into the forums or have a conversation with a human in possibly engage with threat actors. Some of this still implies a role for a human threat analyst, at least as of the short-term future, right?

Oh, absolutely. I think the mental model I have, Anton, of this is AI essentially supercharges and empowers humans. It allows them to do things, more things, and do things well and do things more deeply. It's like MRI machine, like an MRI machine enables a radiologist, doesn't replace him, right?

Right. So no, no, no, of course. So this, we are not, we are very much in the, this is a tool wielded by a human. I think that there would be some people with naive perceptions that we are on the verge of AI just taking over completely. But I think that we are still very much in the tooling, AI is a tool land and not AI is this separate entity that just does the work. At least that's my impression.

Yeah, absolutely. And on the research side, as you mentioned, I think we will continue to use AI to make that research pipeline more efficient, both from a time perspective And throughput.

Perfect. So we obviously say we work for Google, right? So we say we are better in this, and we have some pretty solid data points that indicate that we are better. We have more of X and more of Y, and I'm not going to quote from our marketing slides, but data points there are very real. We are better. But how are we better, or why are we better from a client point of view in terms of threat intelligence, in terms of threat intelligence for detection? If you briefly wear a client hat or client empathy hat, maybe, why are we better from the client point of view?

Yeah, I think that 3 things that our clients tell us, which is kind of playing back of some of the things that we have wanted to be our strength. The first one is just the depth and breadth of coverage that we provide. And the reason they get this comfort around depth and breadth, I'll give you some examples, and this is not comprehensive, but to give our audience an idea. The breadth is about, are you able to see threat landscape from different vantage points, right? Remember the blind man and the elephant analogy. You want to be able to see it from different points to actually get a full picture. Google, because we are able to get a picture from consumer footprint, right? We protect browsers. So we understand what threats are coming in at internet scale.

Mm-hmm.

We're able to see it from a business perspective because we have security products that go and protect businesses. We see it from that vantage point, as well. So, we have multiple vantage points to look at a threat landscape that give us the breadth. Our depth actually comes from, in many cases, the incident response that we do. Now, remember, these engagements are, by definition, around attacks that have gone past the current security controls. And when we go in and resolve those, we essentially get—

Right.

in-depth understanding of most advanced attacks. That's the depth we bring into play. So when they look at our threat intel, they see the manifestation of that breadth and that depth, which makes it actionable. So that's the first part, visibility. The second one is how we are actually weaving in technology to make jobs easier and improving time to protection. They can effectively see us rolling out— you alluded to malware analysis.

Yeah. Mm-hmm.

Those are like real tangible points of infusing technology of current generation to make threat intel better, right? And the third thing, this is super important again, Anton, is that people want to have experts by their side. It's a lot about trust. Do you have a trusted partner? And we at Google have expertise, human expertise available at scale that is powered by technology. So we are able to put an expert by the side of every customer out there, and that trust and that assurance and that partnership is something that they value massively. So when I look about, you know, think about clients, they essentially say visibility, technology making a difference, and human expertise that we can trust.

Perfect. That makes sense. That's very much appreciated. So I think it's close to our traditional closing time, so we have our closing questions. Please give one tip to somebody listening, presumably on using AI, and one piece of reading. It can be a book, it can be a blog, it can be anything.

Yeah, I think the tip I would give, because I think AI is such an integral part of what we do and what we will do in future, I would strongly encourage everyone, regardless of their technical background, to read latest and greatest papers on AI. Even if you don't understand technology, read the abstract. And read the conclusions. It will give you a very good sense of what AI can and cannot do and how AI is going. I think this is one thing that I've trained myself is not to get intimidated by the content, core content of it, but actually read the abstract and the conclusion. Okay, so that is one tip I strongly recommend people, people do that. Okay, and you want a piece of reading, I think that Okay, here you have me stumped because I was going to recommend things that are not necessarily tied to TI.

Oh, it's perfectly fine. Yes, just again, people have recommended poetry on previous episodes, so please don't do poetry without Tim. He may not appreciate it. But some other— it can be fiction, can be anything else.

I think I would recommend a book which has a set of essays on brain. It's called The Future of Brain. I think it's been edited by Gary Marcus, if I remember correctly. And the reason I say that is because I think there's a lot of inspiration the current AI has from the way our brain works. And these essays essentially capture, in summary, everything that we know about our brain as of today.

Yes, I think I've heard of that. So very much, I need to read it now that I've heard of the book and now I need to read it. Thank you very much for the recommendation. And of course, thank you for being on the show. This was good. I appreciate your time and of course your insights.

Thank you very much, Anton. Happy to be here.

And now we are at time. Thank you very much for listening and of course for subscribing. You can find this podcast at Google Podcasts, Apple Podcasts, Spotify, or wherever else you get your podcasts. Also, you can find us at our website, cloud.withgoogle.com/cloudsecurity/podcast. Please subscribe so that you don't miss episodes. You can follow us on Twitter, twitter.com/cloudsecpodcast. Your hosts are also on Twitter @Anton_Chuvakin and @_TimPico. Tweet at us, email us, argue with us, and if you like or hate what we hear, we can invite you to the next episode. See you on the next Cloud Security Podcast episode. Thank you, everybody.