EP271 Can AI-Native MDR Actually Fix Your Broken SOC Workflows or Just Automate the Mess?

Security.

Hi there, everyone. Welcome to a live episode of the Cloud Security Podcast by Google. I'm your host, Tim Peacock, Senior PM on Google SecOps. And of course, we're joined today by Anton Chuvakin, our co-host and senior staff in Google Cloud's Office of the CISO. You can ordinarily find this podcast wherever you get your podcasts, as well as at our website, cloud.withgoogle.com/cloudsecurity/podcast. Anton, what are we doing today? We're in the booth with 2 other people. This is great.

So this is one of the first true live shows at the event we are doing. And of course, this is very fun because we have our friends who actually built some of the stuff we are talking about in real life. And we're going to talk about the enterprise adoption and, of course, AI in this talk, and, of course, challenges that people face. I think it's going to be fun.

I think it'll be great. And so maybe without any further ado, let's welcome today's guests. Today we are joined by Eric Foster, the CEO of 10x, and Bashar Abu-Abusido, the president of 10x. Thank you both for joining us today. Anton, you have the first question.

I feel like the talking about the future and agentic SOC, and somebody, for example, told me that I'm not enthusiastic enough about agents in a SOC. And I kind of feel that many organizations are still barely using their first SIEM. So I want to know, what's the answer we have for organizations that are sort of more mainstream, who are not yet doing agentic, who are not even maybe using cloud all that well? How do we help people who are stuck in the whole SIEM 1.0, barely collecting logs? We can tell them we have AI-native magical technology, and we do, by the way.

Yeah.

But how do we get them to benefit?

It's a great question. And I honestly believe this is the single greatest inflection point. I've been doing cyber 33 years. As you know, you and I came up in the trenches together in a lot of this. This is to me the greatest single opportunity maybe we've had for transformation in the SOC. And I honestly believe this is such a great opportunity for those laggards who want to truly achieve SOC modernization and SIEM transformation. This is the time to do it. You have the opportunity to move from a legacy on-prem, you know, still we see so many people in that model, to a true cloud-native, and then layer in the actual agentic AI and achieve the kind of outcomes. But the biggest thing that I would say that we really see as the biggest mistake right now is people coming in and trying to bolt AI onto these existing platforms. And especially you talk about the legacy systems, like bolting AI onto a legacy SIEM that was not designed for it is like the same thing of trying to go in and take your legacy monolithic application and give it an IP address and put it on the internet. It's a giant change.

What could go wrong?

Yeah, I mean, a lot of fun things, as things pointed out, right? As we've observed, right?

Oh yeah. I think, Anton, if anybody's accusing you of being insufficiently enthusiastic about AI, they're just failing to apply the Russian modulus to you.

Uh, yes, the Gauss curve. Yes, that's right. They should probably post a picture in the notes or something.

Yeah. So, Bashar, I want to ask a question about CISO metrics. Spent a long time in the industry. If somebody is using an AI-native MDR, mean time to detect kind of looks like a vanity metric because the machine is going to be instant. So what's the actual metric somebody should be looking at? Is it time to context, reduction in human toil? How do we show— how do we show the ROI here? What's the metric?

That's a great question. I think with the old metrics are important to continue to look at because What we just kind of learned recently is that it takes now between discovery to actual exploitation is 30 to 45 seconds. So we're dealing in a machine speed level. So we need to look at the outcomes. I would personally look at the false positive rate. I would continue to see that go down. I would like to continue to see false negatives continue to go down as well. True positives being highlighted. I think ultimately the ultimate success, as I operated this at scale in my previous job as a CISO, is to be able to have about an average 5 true alerts a day for an analyst to investigate, to take an action on, to have a quality response, an understanding of the threat landscape, and the ability to understand the situational risk environment that they're dealing with. And that's where we're headed with. But that's going to have to be enabled by AI and has to be focused on outcome and on the actual things that we're going to be able to deliver in terms of actual action that we take based on that visibility that we receive.

I kind of feel like the metrics are changing before people actually collect enough data to sort of do the old-style metrics. Again, another thing somebody asked me yesterday when I was doing the presentation is, Okay. So, how do you know you're better off after you added agents? If you don't measure where you are today, you can't really confidently say, look, I got this AI in my SOC and things are better. But what things? I mean, do you measure things? To me, the metrics argument is really strong because if you say AI helped, how did you measure it? That's why I feel we should go to metrics that support that mission of saying things Things have improved because now we have agents doing some of the work. It can't just be naive time saved or MTTD or whatever else. Yes.

Totally agree. And this is actually something we're working on. We're not quite ready to release yet, but we're going to try in conjunction with a couple other partners, vendors in this space, we're going to try to redefine how SOCs measure these metrics because you're exactly right with the question that the old MTTR just doesn't apply anymore. Unless we're all going to move it into seconds. So not to make this a product pitch by any means, but just to tell you the art of what is possible in the agentic space today with the partnership with Google Cloud and the Google Security Operations layer, and then the agentic AI that we've put on top, what we are doing for customers, you've got 100% alert coverage.

Yep.

That's triaged to true MTTR in 48 seconds.

Yep.

That's our metric today. 48 seconds across 100% of your alerts.

48 seconds across all your alerts.

But, and it's 100% of your alerts because that's the big game change. Like, most people don't realize most SOCs are usually triaging like 10% or 20% of their alerts. They're throwing everything else away, right? And so we've changed the game materially in order of magnitude, the whole idea of the name of the company. And you can find a public case study on this on the Google Cloud YouTube for— if you look that up with Sunrun and 10x, you'll see a public case study where they talk about this. And what do they talk about as the main metric? Mean time to dwell. And reducing that by an order of magnitude, that's the metric.

So I agree that investigating all the alerts looks better. That's cool.

Yeah.

But what is that moving that you can measure as an outcome from that? What gets better when you do that? Because it feels like it should get better, but what actually does?

No, absolutely. And that's where I think being able to show the reduction in actual attacker dwell time in your environment, that's probably the single most important metric. And then obviously we would hope to have it be not actual attacker dwell time. How many, like, serious attacks did we catch before they were able to establish any sort of foothold?

Yep.

But as Bashar was saying, now that the average time from exploitation to C2 is measured in under a minute, like, I thought, like, oh man, we're triaging 100% in less than a minute. We've made progress. And then the numbers come back and it's like, no, you're still not fast enough.

Yeah. Yeah.

I still want to dwell. I'm usually the one— You want to dwell? I want to dwell a little bit.

Yes. Not delve, mind you.

I'm going to dwell.

Not your dwell time.

No delving.

Just dwelling.

Yeah.

I'm going to dwell on this, on the tooling. And usually I'm the guy who says people process, yes, more important than tools. But I want to touch on the tools a little bit. You made a point which I agree with is that a lot of bolting AI to an existing old legacy tool is not working. Why is it not working specifically? Like, it's not a kind of a marketing copy about you should buy ours. It's kind of more about there's genuine architectural difficulties with some of the tools. Certain tools have poor quality data or incomplete data or data that's not structured for AI. So, what's your argument for AI native, for modern tools over here's the tool we used since 2007 and by the way, they have AI now? How would you build the argument?

Man, the AI washing in our industry has just been so incredible. Oh yeah, AI washing, but it's an extreme form. Right, it is the most extreme that we have ever seen. And as somebody who lived through the first dot-com transformation, like I will tell you, it is the exact same thing that we saw back then. And we make an analogy here. If you take a monolithic application, if you took SAP or the old school Oracle and like, oh, we're just gonna give it an IP address and put it on the internet. That's the equivalent of just bolting AI onto this. The advantage, the reason that SAP was disrupted by Salesforce was because they came to the table with a cloud-native solution. And obviously, that's why we've seen the disruption from Google Cloud in the SIEM space and leading the Gartner Magic Quadrant to go, look, cloud-native security analytics is the answer here. And to me, then AI-native being truly built, the data structures, the context graphs, Fundamentally building this into every part of your platform as opposed to bolting it on, that's the secret. That is the differentiator.

But I want to ask, before Tim manages to put a word in, I want to briefly follow up on this. There are also people here, I mean, we are at RSA, that say that actually you can pick modern components. You can do decoupled. You can pick modern data lake, modern AI, modern content downloaded from somewhere, and kind of like, do a decoupled route where you connect them, put some duct tape around them, and the result is better than the legacy platform. What's your argument here, if I may ask?

Well, hang on. If it's better than the legacy platform, I buy that argument. If it's better than a modern platform, I don't buy it.

Ah, well, I think fundamentally most people, when they use bolted-on AI, is they look at it as an intelligent search engine. I don't think that's a solution. Yes, that's That's not truly a new way to unlock the value of AI to help take an advantage and give the defenders an advantage. I still think we need scale and we need the ability to leverage all the investments we made. I feel like the cognitive infrastructure being built is a disruptive evolution, not a revolution, meaning we need to continue to build on the investments we made in detection engineering, in predictive analytics and rule-based infrastructure, a quality, a quality detection engineering will lead to a much better and more effective AI.

Yep.

And I think that's the winning formula. Add to it the human expertise. Now you're having the secret sauce. However, I look at alerts as 2 separate categories. One is alert and full visibility related to malicious activities where I need to take and immediate action. Yep. Or second-tier signals that can be very use case specific, that can be handled narrowly with a data lake approach. But for the most important stuff, you do need the technology and investment in the SIEM and detection engineering at scale, and then leveraging AI and agentic AI to get to the outcomes we want.

Yep. So last year when we spoke, Hard to believe that was already a year ago. You said that you were having like a 95-5 split between agentic and human handling. Now you're telling me it's 100%. What was the last thing to get automated and what made it so hard?

By the way, we should— this is a profound moment, by the way. I just want to— people who would be listening to this for the next few years would probably need to pay attention to this moment because this is kind of hugely important.

Yeah. So, you know, man, the last mile, it very much is. It's like the Pareto principle concept, right?

Absolutely.

Like the first 80% took 20% of the work, and then closing that last gap literally took the last 80%. So for us, we do this very scientifically. We use a lot of quality assurance metrics and a lot of production manufacturing metrics in this, which a lot of people— it's really surprising to me that people don't apply those to security. We as an industry figured out a long time ago, like, if you have a process that needs maturity, there's all sorts of tests you can do statistically to figure out if this process is actually working. It's the same thing that medical device manufacturing people do, right? It's not a foolproof process, but at the same time, they can apply a level of QA that lets them produce like a 5 nines quality of the device that comes out. We're applying the same approach to security and the way that our agents look at things. So we're moving the quality metrics to go, no, look, last time we talked, we had quality that we would consider end-to-end for 95%, and then it was more and more to close out that approach.

Yeah.

So the difference in how we've done it For us, it's human isn't just in the loop, it's on the loop. So we do constant human reinforcement learning at 2 different levels of every single thing that goes through our platform. Then a lot of it here is actually after the fact. So like the AI comes and decisions something and we put it in front of a human maybe a day later and go, here, verify that this was the right activity, verify that this was the right thing. The last big piece, the last big breakthrough for us was like, end automated response using computer use.

Wait, so you did that already?

Oh, yes.

Oh, I thought you're still struggling.

Man, you know, like you say, it's been a year since we last talked. It feels like it's been a decade.

Yeah.

Like, it— things are moving so fast and we are moving so fast. There for a while, I was sleeping in 3-hour increments waiting for Claude tokens to refresh. Like, no exaggeration. I would go to sleep for 3 hours, wake back up, come back in, new Claude tokens had refreshed and we go.

Shouldn't you have been waiting for Gemini tokens? I don't like this.

We're purchasing it through the GCP Model Garden.

Oh, okay. Okay.

Okay. Literally using our GCP commit to access the partnership with Anthropic. So really great way to do all of it.

But on a more serious note, that is hugely impressive. I assumed you were talking about last 5% of detection. I didn't even think about the remediation aspect. I thought this is above the 100%, but you did deal with remediation part. That to me is hugely impressive by any measure.

Yeah, we've wired end-to-end remediation, but the other approach, so Quite frankly, the customers aren't ready for it. So what we do when we go into each customer is we let the customer define their risk tolerance of what are they letting us remediate and what do they still want a human for. And we honestly believe that's the magic approach to this. It's the great, you know, not only technical partnership with Google, but it's the human-led— it really is human accountability.

Yeah.

Like, the customers still need a human to hold accountable and to be able to say, like, no, look, I don't want you quarantining a domain controller because you saw something there. I don't want the AI doing that. We want to put that in front of a human that then makes that call.

Yep.

So that's exactly what I want to ask about next. Bashar, how do you help a CISO actually trust this? Because every CISO has been burned by something taking out production or impacting executives. So how do you trust and get your customers to trust that 3:00 AM containment action by the agent?

Eric alluded to this. We need to continue to build that cognitive infrastructure and the infrastructure and the connection between AI and the human factor to make sure that we establish a true risk appetite around autonomous-level decision-making. We're closer than 2 years ago when we talked about this during the NEXT conference, where we all want self-healing concepts, and we're closer than ever.

Sure.

But we think in order for that to continue to progress, meaning freeing up the top talent that we have for the most complex issues, is to establish digital trust in that cognitive infrastructure of AI.

Yep.

But in order for us to do that, we need to build that risk appetite and reflect it in the policies implemented by AI. There are certain things we're going to be very confident and comfortable saying, you as a CISO, for these type of decisions, can we delegate to AI? because it's a low risk. Once they learn, once they trust, you will see that autonomous-level delegation will continue to expand based on that risk appetite, based on the criticality and the risk. And I think we're moving toward that, that push in the continuum of maturity as we continue to learn more about how to trust AI.

But that one cannot be sped up. There is no magic wand you wave and say, you trust this AI tomorrow and it happens. Like, that's not a thing at all. Like, that has to be a kind of a gladder sequence of steps. There's no power within the IT business, so to say, can make somebody trust it faster than they would otherwise, right? That's kind of what I'm hearing is that there has to be a set of steps.

Totally agree. But, you know, Tim, I don't know if you're aware of this, but a number of years ago, the security luminary wrote this white paper called Autonomic Security Operations.

I might have heard of that paper, yeah.

And, you know, really laid out this vision for a true self-defending, self-healing SOC. And we really truly today, like, we are standing on the precipice of accomplishing those objectives. And so I'm here today to ask you to write a new white paper for where are we going 5 or 10 years from now so that I can go build that next weekend.

Yeah, we do still show people that 2021 paper and they still say, Wow, that's very futuristic. And I'm like, yeah, that's 2021. But you're right. That's actually a really good challenge to figure out where this can end up in, I would say, 3 to 5 years. Can you please not hold me to 5 years?

So listeners, the good news is that Anton is on the other side of the stage, so he can't kick me under the table when I tell him the magic wand for CISO trust is actually a Forrester wave giving these guys a good review.

I still want to go drill into this whole decoupled data gravity argument. Oh, you want to ask one more question? No, no, no. It's the last question.

Yeah.

Because I have industry debates with people who say that you have an analytic platform, stores data, does security, does UX, does AI, but surely in the modern world, everybody can have an agent pull data from one place, have it stored somewhere else, analyze it through whatever research. Like, is there a need for modern but ultimately coherent platform? And that's a really good debate. And I have a 3 AM test. If you wake me up at 3 AM and somebody says, Which paradigm do you think would win? And I would very oddly point at data gravity as an argument why the platform built for this purpose would win over decoupled federated system. Not that the other one won't work. I just think that for the majority of people, you want the machines fairly close to where the data is, and you want data to actually be there when you need it. Best effort works. often enough, but then it kind of doesn't at the worst possible moment.

Which is the real money in the cloud.

So that's why I'm kind of like betting on data gravity. Am I betting wrong? I'm betting.

No, I completely—

Wait, wait, question. I was supposed to ask a question and not give a speech. Do you agree with that? Do you think that this type of modern platform where data is secured, analyzed, processed by AI, looked at by humans, is the winning strategy, whether it's built by MDR or together MDR and the cloud provider? Or you can go do assembly instructions on your own?

It's a great question and it is a great debate. Like, I don't feel this is settled. My personal opinion, I think we're going to a barbell approach. I think it's going to be both, which isn't a cop-out. It's— I think there is a tremendous amount of data gravity. There's a tremendous amount of benefit of the centralization of having your agents have the right structured, unstructured data in a system that was built for it and all those advantages. And then at the same time, I believe more and more is going to move to the edge. Yeah. So I think you're going to see endpoint-based AI models that are doing like behavioral analytics at the endpoint, gathering data, but then feeding the core components of that because you're not going to want to egress all that data.

For sure.

You know, God love them, but like Tanium, you can't pull all this data back into a centralized repository. It's going to be let's process it at the edge, pull the meaningful signals out, pull that back into that data lake, that data gravity platform that's going to have the right Visibility to what's happening.

So this is kind of a hybrid model is the winning model, essentially. Not that you would have to collect every single log you ever made into a single platform. I'll go with that.

I think you need to take that data approach across the board. There's some malicious that we need to act on immediately, some in a centralized full visibility fashion. Sometimes it's closer to where the risk is as well to allow you to get time to reaction and to be able to detect and respond. But I also think we have many, many areas of telemetry that we need access to that is just not immediate. We have time. We have a week. We have 2 weeks, like DLP. We have NDR. We have other things that can be handled in a more direct fashion through direct access to normalized, clean, quality data. I think clean and quality and normalized is critical to unlocking the value of AI.

Yes. And also being there available I mean, it goes without saying, if it's clean, it must be available. But sometimes it's the availability that tricks you. It's clean, but it ain't there, or it's not there after 30 days.

Well, another tech that I know you love that you just mentioned that I should have, like NDR, NTA, like, do I need to take every single packet and put it into a central data? Absolutely not.

Even though you have glasses that say otherwise.

But with that, you go, no, I want to process it with a network appliance that's going to give me that, pull the signals out. And to Bashar's point, be able to come back to it 2 weeks later in a deep dive investigation to go, oh, let's go reconstruct this session and drive all of this. So I need to be able to do both.

Yep.

So I hate to do it because we're having a ton of fun, but I have to ask our traditional closing questions. So for both of you, and you can go in whichever order you like, one, do you have a tip to help people get better at their AI SOC adoption? And 2, do you have recommended reading? We love to give our audience something to read afterwards, and that could be anything Except Anton's blog.

Absolutely. So my recommended AI adoption actually is such an obvious cheat, but at the same time, man, I tell you, most of you hearing my voice today are so early in your AI journey that you don't realize it. Like, if you go outside and touch grass and talk to a normal person, not one of us fellow cybersecurity people, like, AI is still so, so early. And the biggest advice I give those people especially is You don't realize you actually have immediate access to maybe the greatest instructor that has ever existed. So you want to know how to do something, you turn and ask Gemini, teach me how to do this. Or I don't even know what question to ask. What question should I be asking to understand this? The AIs are one of their best use cases to me is unlocking human knowledge and accelerating that. So my how you get better is literally as trite as it sounds, but ask the AIs, they will take you through that. So, my recommended reading, I plugged this last time I'm on, but I'm still going to do it again because there's still so much great opportunity for this. So, WeHack Health, wehackhealth.com. I lay this out because in cybersecurity, more than ever, we are under constant attack, right? You're under constant emotional attack. You're in a very stressful situation. Way too many of us don't eat well, don't take care of ourselves, don't, you know, fuel the engine the right way. WeHack Health is a cybersecurity community that we have set up to try to help each other get healthy through this whole process. Food, workouts, stress reduction, just people to talk to. Like, one of the biggest things I see, you know, we are in a world that is just constantly under attack, right? We're in a profession that is constantly under attack. Your fight or flight is going off all the time. You need people around you. You need community. You need somebody to talk to when you're stressed, when you're crazy. And that is there for that. It's an open Discord you can jump into. You can literally find me and go like, man, I heard you talk and I'm really bummed that the Terminator is coming for my job. Like, help me understand this. So that's my 2. Bashar, you?

Well, what I think my advice is, I've been investing in AI for a very long time. I think we need to move past just being impressed by interacting with AI to start thinking of true use cases that will allow us to look at the combination of data, a use case where we have a challenge. Let's get the data, let's get AI, and let's get the experts involved. Truly what I see is that the old model of being a SaaS is kind of moving and evolving into a service-oriented, AI-enabled world. And if you want to do that, you need to talk to an expert, you need to focus on use cases and focus on outcomes, because We're past the— we're very impressed with AI and the ability and the progress that we've seen with AI. We need to focus on outcomes, and you need experts to help you guide through the challenges associated with how do I take a concept, a use case, and turn it into a real outcome that is sustainable? And that is really the focus that we need to be laser kind of focused on and prioritize going forward.

I love both of those answers. I want to share real quick one outcome that Anton has created recently with AI. Anton was once a PM, and it shows when he has lots of ideas and never executes on them. But recently, he's created an AI capability to do 2 things. The first thing it does is analyze the current security zeitgeist— what's happening on security Twitter, what's happening on security LinkedIn. And then the second thing it does is it trawls the back catalog of our podcast episodes for a relevant episode and a quote. And then Anton, because he doesn't trust anything, manually pastes that into social media.

That's right.

So he's come so close in trusting it and yet so far. But that is a wonderful example, I think, of actually using AI in his day-to-day life. And so, Bashar, Eric, thank you both so much for joining us for this episode from the show floor. That's all for today.

Thank you.

And now we are at time. Thank you very much for listening and of course for subscribing. Please subscribe so you can get new episodes piping hot And if you love our content, please drop us a review on your platform of choice.

You can find this podcast on YouTube, Apple Podcasts, Spotify, or wherever you get your podcasts. Also, you can find us on our website, cloud.withgoogle.com/cloudsecurity/podcast. You can argue with us on the Google Cloud Security Community site, googlecloudcommunity.com.

You can follow us on X, x.com/cloudsecpodcast. Tweet at us, email us, argue with us. And if we like or hate what we hear, we can invite you to the next episode. See you in the next episode.

This has been another episode of the Cloud Security Podcast by Google.

Security.