EP225 Cross-promotion: The Cyber-Savvy Boardroom Podcast: EP2 Christian Karam on the Use of AI

Security.

Hi there. Welcome to the Cloud Security Podcast by Google. Thanks for joining us on an off-cycle midweek episode. Your hosts here are kind of myself, Timothy Peacock, the Senior PM for Risk Analytics and Threat in Google SecOps, and Anton Chuvakin, a reformed analyst and senior staff in Google Cloud's Office of the CISO. You can find and subscribe to this podcast in the usual place, but listen up in a little bit for where to find the next podcast we're going to be talking about. If you enjoyed their content, hit that subscribe button for their show as well. Anton, what is going on today and why is our intro so different?

Yeah, yeah. I mean, Tim is being downright weird, but in a good way. So this is kind of an experiment, and I guess we are not listening to enough podcasts because I was told that it's a normal thing for one podcast to sort of embrace another podcast episode, usually the more established podcast for a new one, and basically wrap them in a wrapper and air them.

Wait, are you saying that we're an established podcast?

I think, Tim, we are an established podcast because I just—

Crazy.

You know, it's crazy because remember this case when we were looking to interview a certain person in security and I said, oh yeah, we built questions for him, I think in 2022. And that exploded my brain. And I know we're— You're going on a rant instead of promoting the other podcast.

No, no, no. So yes, we have 3-year-old questions that we're finally going to use soon. But what is this new podcast all about? What is it called? Who are the hosts? And why are we talking about it today?

So the podcast is called The Cyber Savvy Boardroom.

The Cyber Savvy Boardroom.

Correct. If you really want to go linguistic on me, we can debate, is there a dash between cyber and savvy? On their official site, which I built anyway, so there's a dash. But if you think that they should remove the dash, please write us and we'll remove the dash.

I mean, is this one of those AI hallmarks where it uses too many em dashes?

No, no, no. Let's not delve into this one.

Oh, let's not delve into that. Very good. So what are we talking about in our Cyber Savvy podcast we're featuring today? We are talking about AI, right?

Correct. And I also want to briefly touch why there's boardroom in the name because Our podcast, we feel, is useful for security leaders, security professionals, people interested in security, security learners.

Yes.

Like, it's ultimately a cloud security podcast.

Yes.

Maybe some cloud non-security people listen, but maybe we annoy them. I definitely think I annoy them.

No comment.

So the new podcast is for boardrooms and leaders, not security leaders, company leaders.

So it's a much smaller audience.

Much smaller audience, but a much more rarefied, audience with a lot of different interests compared to our audience. So if any of you listen to the Cyber Savvy Boardroom episode, which you'll hear in a few moments, you may not like it because maybe it's not for you. But I assure you—

But it might be for your board.

It may be for your boss, your boss's boss, your board. And deep in my heart, the episode we're going to wrap today has insights for security leaders and professionals.

What are some of the things to look forward to?

Okay. So this is episode 2 of the Cyber Savvy Boardroom that we'll introduce in a moment. And there's one bit that the speaker there, the guest there makes to the hosts. And the hosts, by the way, are David Homovich and Alicia Cade from our team, from my team, Office of the CISO. So they're running that show.

Alicia should be familiar to some of our listeners. We've featured her on the show before.

Correct. And remind me to add her to resources for this episode.

Yes.

Yes. We're being self-serving a little bit.

Us?

Never.

Yes.

No, no, no. at Boardroom Advisor, and he actually speaks to boards and executives all the time. Not to engineers, not to managers, but to company leaders and boards. And one topic that came up is adopting AI security. Now, if you remember AI adoption discussions here, we talk about the use case approach. But the guest mentioned that if you go with use case-based approach and you go kind of wild and you have 200 use cases, 500 use cases, You probably would never convert to a strategy. And I have this instinctive reaction. I want to argue with him. But then, as they say—

But you're not a host, so you can't.

I got enlightened. Yeah, that's a good point. I'm a listener, so I can't argue.

I can see it, listeners. Anton's driving to work, and he's arguing in the car with the podcast.

Correct. A little bit like Notebook: A Lamb Thing, when you can get to argue with the AI host.

Yes. OK, so how did you find enlightenment?

I actually found enlightenment because you're right. If you go disjoint use case-based approach and never think of a strategy, you just think, gotta try the use cases, it's very hard to retrofit strategy in. So I sense that you need to have a strategy and then practice the use case approach to adoption.

Sorry, can I put on my PM hat for a minute and just say to you—

Please.

Duh. Obviously, you can't retrofit a strategy on top of a pile of use cases. I think they teach you that like the first day of PM school when designing a strategy.

But I'm gonna bite my tongue right now very hard. Oh.

Ah!

Okay, that's the sound of me biting my tongue. And the reason I'm biting it is because I have seen PMs here who kind of are bottom-up PMs, right? You've seen those, right? And no, not name names. Don't name names.

No, we won't name names. We don't do that here. We're like the Verizon guys. We don't name names.

Well, yeah, but the point is that there are people with bottom-up ideas that assume that later the strategy would emerge.

Ah, yes. I think those people are wrong.

Okay, agreed. So that's what I got to when I was listening to the episode. So I think that We suggest you listen to the whole episode. I think it's 20 minutes. Subscribe to the Cyber Savvy Boardroom. Tell your boss about it. That's kind of the most important part. Tell your boss, tell your boss's boss. I don't know if you can tell the board directly, but ultimately it's a very fun show for the right audience. It's very useful. It's very insightful. And they have one advantage over us.

What's that?

They're even shorter.

No way.

Yes.

Yes, they are.

Well, listeners, with all of that promise, I hope that all of you, despite Anton's urging to send it to your boss's boss's boss, also enjoy this content. And with that, let's turn things over not to today's guest, but to, well, today's podcast.

Welcome to the Cyber Savvy Boardroom. Thanks for joining us today. Your hosts are myself, David Hamovich, and Alicia Cade, both within Google Cloud's Office of the CISO. You can find and subscribe to this podcast wherever you get your podcasts. So Alicia, today's guest is Christian Karam.

Oh yes, Christian is a great pal of mine going back to our CISO days in banking and someone that has contributed to our Key Board Publications, Perspective on Security for Boards, available on the Google Cloud Board Insights app.

Yeah, and at the end of our discussion, we finally get an answer to that blockbuster movie question about the true role of humans in the world of AI. So let's get to the discussion. Christian, welcome to the Cyber Savvy Boardroom. You're a strategic advisor, an investor, an overall AI-savvy person. So let's dig into the world of AI adoption and security. And I would say there's a fear of the unknown with AI. AI can seem like a black box for a lot of people, especially to those unfamiliar with its mechanisms. Why do you think that boards see AI as a strategic dilemma for their enterprises?

Yeah, great question, actually. And boards are really struggling right now because there's such an interest in adopting AI. People are very excited about it. It's been in the market for several years now. Probably more interesting since the launch of ChatGPT, and we've seen a lot of adoption in the market, a lot of tests in the market. There's a lot of trial and error being seen there. For many of the boards, they're split into 2 parts, either the skeptics that have tried to do something interesting with it and they haven't seen the gains and then the real enterprise value come to market. And for others, they think of it as a necessity to ensure that their business models are evolving and will have a continuity and they remain competitive considering how the world could change there. 2 different camps that are betting on 2 different futures, and we're going to have to see who's going to be able to win and how they're going to be able to shape the next stage of their evolution.

Perhaps this dilemma translates itself into a slow adoption, which equals missed opportunities, potentially. How are boards of directors in AI-enabled success champion companies addressing these dynamics?

Many of the successful players are really spending a lot of time right now trying to build less technology, And rethink strategically what does it mean for their core business models. So, we're spending a lot of time with boards right now, really discussing what are going to be your revenue drivers in 2035. Today, you make a lot of money selling this kind of product or this kind of services, and then things are changing. And effectively, they want to try to catch up and try to predict where AI could be very disruptive and whether they should get on a— or they could shape a new bandwagon rather than to get on an early bandwagon there. So, I would probably break it down to like 3 main things that are important right now for successful companies. One, Like I said, there's a very strong push from the board in understanding the disruptiveness of the business model and how to evolve in that direction. That's a business conversation. The second one is really about trying to break the existing corporate silos. Many of the big successful companies that we have have built for the last 30 years, 40 years, 50 years a certain corporate DNA based on divisional structures because of mergers and acquisitions and the evolution of their businesses. But AI is an opportunity where, for it to succeed across the whole organization, it needs to start breaking the silos. And we'll speak about it more about what does it mean from an enterprise technology, enterprise architecture perspective. It's best deployed where you get to see things more, where you get to stitch things together and then deliver the big outcomes. And the third part, which is something they can control today, and a very, very, very interesting indicator is that the companies that are moving very quickly to build only use cases are failing. Are the ones that are actually trying to fix a very small problem. And they end up in this doom loop of building just solutions that are short-term, not scalable. They cannot— they can do maybe 2 or 10 use cases, but they cannot do 300, 400, 600 and enable the whole workforce. So the advice really for these big successful companies that have done it, that have succeeded, they have been building AI capabilities that they can then federate or build towards many use cases. And they have a very strong framework to qualify use cases. By that, it means being able to move a use case into a business case that has value tied to it. There is value that directly is tied up to the business of the company.

So assurance is kind of always key to de-risking the emerging technology. And it's true for AI, especially in the cyber context. If your business is adopting AI, what can boards be expecting of their C-suite?

A very interesting tone from the top has really kind of shaped a lot of the thinking around how fast you adopt AI and how important security is part of the conversation. No secret, obviously, people are still very concerned about how to adopt AI, where to adopt AI. The regulation component is still a big question mark. But I'll say something interesting that I've found over the last couple years. The majority of the work that I've seen right now as a top priority in enterprise is actually securing existing AI solutions that have been taken to market. And the security component of it is actually highly focused on the basics of security, identity access management, account security, database sharing, over-permissive rights, all these kinds of things that we've been doing in security for over 20+ years, 30+ years. And it's with the idea that AI becomes a new crown jewel. So, you have to actually secure the interactions with AI that are directly dealing with the AI, right? So, I wouldn't say there's something big today that's different around how we do security. Obviously, building products with AI is a whole different story, requires different rules of engagement, is a new kind of discipline in that space. But for most of the work people are using today, chatbots and knowledge agents and these kind of solutions, it is really about controlling what data they can access, what users are giving them access to, and how you can restrict that and have a good audit trail on it, right? A common story I'll share with you is I was Recently working for an oil and gas company, helping them to kind of like understand, you know, how they should securely implement AI. They have discovered that they have contractors that are still connected to some of their file sharing mechanisms, and they deployed an AI solution, one of these commercial ones right now that can allow them to do, you know, chatbot, retrieve the data. And they just realized that this chatbot has now access to private data and passport data of one of their contractors. Supposedly it shouldn't be any longer there, but it's a classic case of over-permissive access. AI is given a free territory to roam and to operate, retrieve information. And therefore, it's a classic problem that we've seen as well for many years of security. It's just extended out to a new system that is supporting us.

Yeah, I really like that point. So obviously, this is the Cyber Savvy Boardroom. I want to pull on the security thread a little bit more. How should boards be thinking about AI in this world of cybersecurity? And I'm thinking both sides of the coins here, right? Securing AI and then overall using AI For cybersecurity itself.

Yes, I like this a lot. So it's like the 3 main perspectives are securing the AI as AI being your new crown jewel and a system that you want to invest in and build your company around and then grow it. Securing from AI, which are obviously new AI emerging threats that we're seeing that are yet to see in the wild in a more pervasive manner, but they're going to come. It's going to open a new attack surface, a new set of problems to address. And the third part is really securing with AI, which is the element of productivity. How do humans run much faster using AI as a co-assistant or a partner that we can work with to deliver the same outcomes, to do everything a lot faster, to do things in a more holistic, highly visible way that gets things done? And it's quite interesting because when you see the current evolution of the cybersecurity market, all the AI startups are coming up. the last 3 years are really based out on these 3 main categories, right? Securing specifically the new AI products that you're releasing, giving protection for them hasn't really picked up completely, but it's still there. And I think as the market is growing in AI solutions, it will grow eventually. You see probably the biggest growth in securing with AI, which is classic assistance coming in. Very strong, I would say a very strong interest right now around AI and playbooks. AI and providing secure layers for prompting, for the DLP, observability, all that bit. I'm seeing this year and very excited to see probably in the next couple of months at RSA, I'll see probably a lot of interesting companies coming in around security operations and AI. Last year, they were mainly in information retrieval. This year, they're a lot more in what we call agentic capabilities. And agentic capabilities are an evolution of LLMs. We always remind, like to remind board members that LLMs are very interesting solutions, but they're more like an unfinished product. They're more like a brain. And then for agents are more of a finished product where they have memory, they have to be able to interact, they have to be able to execute some work. I think the market is evolving so quickly and it's very exciting in many ways, but for sure there's a big opportunity to kind of invest in that world.

So exciting market, exciting offers. It means supply chain and perhaps changes in the supply chain and the whole partner ecosystem. And for any enterprise, of course, the supply chain is very important part of doing the business and considerations for security and operational resiliency. Is AI transforming the architecture of the supply chain and the dynamics within?

Yes, AI is definitely changing the way we're interacting on the supply chain side and even more on the internal enterprise architecture side. Let's unpack this in 2 bits. So maybe on the supply chain specifically, The advent of AI agents is really kind of like hiring a Fiverr consultant, bringing them in for a short job, getting the work done, and leaving. I don't see how people actually hire Fiverr consultants in a normal company without doing all the checks and balances before they bring them in. So, imagine the amount of risk that you're bringing this company when you have an agent solution coming in. This can be managed, obviously. There's, you know, technology always can be managed. There's a lot that can be done. And there's a great opportunity there. But we will be expecting to see a lot of these, you know, free agents, consultants format coming in, doing some work, which means that obviously API security is very important. Agent API security will be even more important because you need to see what's interacting with your infrastructure, with your data, with your workflows, with your key partners and ecosystem. So yes, it will change significantly. There will be a need for elasticity. To be able to operate and to secure those layers of interactions there. On the enterprise architecture side, this is a very important moment because AI architecture is very unique, very different. We touched on it in the earlier segment around silos. The companies that are succeeding today are the ones that have found a way to break those silos and to create a fabric for AI that allows it to pull the information, pull the required data as needed, and then to be able to deliver those transformative outcomes for the organizations. So, if I were to kind of put it together, the opportunity is this. Last 20 years of success in SaaS has really been on what we call systems of record. The classic big names that we have known for the last— very successful companies worth billions and trillions of dollars are really built on systems of record where you store the data, you make the data available. And probably in the last 10 years, we've seen them evolve towards system of intelligence where they're showing insights. You know, they're not just owning your data, but they're also allowing you to kind of derive insights so you can do things smarter, better, more efficient. And then today, what AI is adding to that equation is what we call system of action. So, it's the ability to move from just storing your data and driving insights to actually actioning that insight and doing the work. And that's important because it changes, obviously, one, the economics of how we charge for SaaS. It's no longer just a standard license, it's usage because you have to see the outcome. At the same time, you're seeing how, as a company, now you depend more on your vendors and your ecosystem to do work on your behalf. It's the equivalent of hiring consultants in the old days to come and run a control for you or run a job for you. But now it's all being done by an actual AI system. And that's very transformative. It's a big opportunity nonetheless, requires to be addressed very carefully with a lot of risk management in mind. But I think the future is very exciting when you think about the possibilities you could kind of really unveil with this.

Yeah, yeah. So a bit of a funny way to pose the question maybe, but I think it's very serious and something that a lot of people within companies are concerned about is, what is the role of the human in the Terminator world now, right? And so how can boards ensure that the entire company, not just their tech teams, not just their security teams, can truly kind of grasp the potential use of AI, the benefits associated with AI, and then how can they ensure that the workers within their companies have a role in the AI world?

It's such a good question. And I think this is one of these topics that definitely is a direct factor on slowing the adoption or increasing the adoption, right, in many cases. Here's a small anecdote. I was doing a short offsite the other day with a big conglomerate rethinking the future of AI. What does it mean for their business? And one of the board members said, Well, I don't think our people are ready for this. I don't think people are ready because many of them, they have jobs, they feel very threatened by AI. And I said, well, look, here's another way to approach it. Let's take a job description, anybody's job description. There's definitely 4 to 5 bullet points that they would be very glad to just give back to AI and not have to do. You know, it's a phased approach. We're not talking about completely removing, you know, a job. But the way you build AI agents today is very much modeled to our humans. A human has a role, a bunch of goals to execute, and these goals have to have a bunch of tasks. And so when you build agents, you build them bottom-up. You give them some tasks, eventually some goals. In the future, they may have a role. We don't know. But it will redesign the way that we think about it. I think that's the approach that many of these successful companies are thinking is that we need to get the first step in. help them understand that, yes, you don't have to do these very difficult, unwanted tasks, cumbersome tasks that they do not enjoy as well. And that's a good compromise to start in the right direction. The other bit that I will add to it is that the mindset of a security culture is important because the employees now are very hypersensitive to the risks of AI. I think there's the— when you think of the adoption in the last 2 years, it has been drumming a lot around their minds that you could leak the data, this can go rogue, this can do wrong things. If you've seen a lot of things go well, things go bad. So I think that most of the employees, your overall company, there is this alarming behavior around working with AI, being around it, which is a good thing in many ways, I think about it, because people are being very responsible on how to deploy it, but also make sure that you're able to talk about controlling the risks. I find this thing very interesting because in some companies, for example, data leakage is no longer a concern around AI, but it's rather around explainability reasoning abilities, where do you use AI and where you shouldn't use AI today, or you should have maybe a different process to do assurance or quality control over it if you decide to use it versus being stuck in just a data leakage, data exposure component where obviously today there's already solutions for that on how to handle it, how to deal with it. And the problem is moving so quickly right now as the technology evolves that the market isn't keeping up with what's become kind of standard and can be dealt with quite comfortably.

So, Christian, I feel like we could talk about this for hours, but just one final question, and I call it the drop the mic moment. If there is one key action a board listener should take away from this discussion, what is it?

I don't know if I can drop the mic, but I can tell you that. Look, I think the most important advice that I would have to summarize is board members, Incredibly smart individuals. This is an incredible opportunity to be ahead of where AI is going to shape the direction of AI in the market. Ultimately, this all boils down to, it's a great opportunity to modernize your business and it deserves the time. This is not about technology. AI as a technology is there. It's about how you apply the technology to existing business models. And I think in 10 years' time, We're going to go back and we're going to think, geez, these business models used to exist and they no longer do. And we've seen this for many years, right? We've seen Yellow Pages disappeared and many other technologies, many other business models, and DVD rentals. We were just talking about it a couple of days ago over dinner. This is very important for them and it's table stakes. It's an important topic and the technology is here to enable all the possibilities that they never thought. could have been done. It's the time, it's the maturity of it that's there.

Kristian, thank you so much for sharing your expertise with us today on the Cyber Savvy Boardroom.

Thank you very much.

Pleasure to be here.