MIT AI Conference 2018: Staying Competitive in the World of AI in Finance

So we're going to start off with Ananth Madavan. He's the global head of research for ETFs in index investing at BlackRock. So let's give him a round of applause.

Thank you, Selena. Thanks, everybody.

So we were having a really great discussion just right before this and there's been a lot of talk about asset managers using AI to help investors get better returns. So give us an overview of how they're using this technology and what's driving these algorithms.

Sure. I think before we begin it's probably useful to frame how we think about AI. So to me AI is, a set of techniques designed to learn in an adaptive way and then ultimately to mimic human behavior. People conflate a lot of the techniques used in AI, machine learning and textual analysis and so on with AI. So that's sort of setting the stage. In terms of asset management, I think it's important to understand that asset managers going back to the 70s and 80s have been using computers using quantitative techniques to improve their returns. In that sense, there's nothing especially new about the use of these techniques. I think what is new is the availability of data, the cost of acquiring and storing that data, which has dramatically improved the kinds of data that's available, and the computational power, which allows us to do more with that data. So it's a continued investment in terms of upgrading our techniques, trying to learn as much as we can, and with the ultimate goal of providing investors with better returns, meaning higher returns, and also more risk control.

So Vikram Pandit said developments in technology could see 30% of banking jobs disappearing in the next few years. So do you see AI eventually replacing human stock pickers or do you just see this augmenting the labor force?

I would say that there are elements of asset management like anything else that could be automated. So trading is a great example where for years asset managers have increasingly relied on automation as a way of scaling the human workforce. So that doesn't necessarily mean that the humans are being replaced. placed by artificial intelligence means that humans just do things that are better suited for humans, big block trades and negotiating those things. The smaller trades, maybe a 10,000 share trade in an active tech stock could be traded by an algorithm. That's very common. That's not a problem. In terms of your question about stock picking and so on, well, I think it's useful to, there is always going to be the human element. I don't think that's ever going to go away. And I do think that the techniques and the ability to pick stocks is enhanced by quantitative techniques, but you always need the human judgment there if only to program the computers.

So how is it augmenting the workforce at BlackRock? Are you seeing shrinking staff as your technology gets better?

No, I think we're not seeing that. I think what we're seeing is that the staff is more empowered. So I'll go back to trading because I spent many years on our trading desk. And when I was hired actually at BlackRock, or actually BlackRock's predecessor, BGI, back in 2003, and by the way, I'm based in San Francisco, most of our flow was actually done by what we call voice, meaning somebody would pick up a phone or a chat. and they would negotiate with a dealer. And this is how the vast majority of our trading activity was done. That was 15 years ago. Over time now we've evolved to a much more automated way of trading. That doesn't mean that human traders aren't important. It just means they do less mechanical tasks. They do things that are more nuanced, more complex, that require more judgment. The machines can do a lot of the routine trading in an automated way, more risk control in a very rules-driven way that's consistent across the globe. And so we have both. I wouldn't say that any group has been displaced. I think in terms of portfolio management, the guts of asset management. There's a lot of room, I think, for again, algorithms, machine learning, and automation to again, streamline the process, reduce errors, reduce operating errors, and again, empower the portfolio managers to focus on more difficult, more complex tasks that require judgment.

And what about on the research side of things? How do they need to adapt? You have algorithms that can analyze earnings and bank statements in seconds.

Yeah, well, you know, it's again part of the toolkit. So I just say that we have invested particularly in Alpha side. By the Alpha side, I mean the side of our business where we are attempting to beat a benchmark. We've been investing for years, for decades really in the latest techniques. And maybe about 10 years ago we started to really invest in the collection of techniques that we're talking about today. Machine learning, the textual analysis, these kinds of things. Indeed, the capability to scan tens of thousands, hundreds of thousands of documents, extract information from that, read images is useful. At the same time, I think it's also worth pointing out that a lot of data is still available only monthly and quarterly, GNP statistics, things like that. So there are very interesting things that people are doing with data. So for example, if you think about the World Wide Web, we have probably a billion prices of stuff, cameras, shoes, chairs, whatever, posted on the internet every day. And if you can actually track those items, adjusting for the quality, adjusting for the type, you might have a more real-time indicator of price movements than say the Consumer Price Index, which is published by the government based on survey methods with a lag. Those are the kind of flavor of what's going on in this space.

How far are we from that?

A lot of it's already here. The futurist William Gibson has this great line. He says, the future is already here. It's just not evenly distributed. So I'd say that, and I'm talking about asset management in general on BlackRock in particular, but I'd just say that a lot of it is already here. There are people who are using very advanced techniques to try and infer sentiment, to learn a little bit more about what's going on in the economy. You know, those kinds of things. They're using satellite imagery. They're using a variety of sources of data that weren't there 10 years ago.

So take us inside what AI is being used to do inside BlackRock. I know you recently launched this Evolve suite. Can you talk a little bit about that?

Sure. I'll try and give a little color about that. So first some background. So, you know, One of the more popular sets of ETFs tries to capture movements of sectors. That's important for investors like hedge funds. We're going to hear from Christina and from others who are trying to make bets about things that are pro-cyclical.

Or.

Make bets about technology versus energy, those kinds of things. Traditionally, the way sector funds have been built is that you look historically at the revenue of companies and you classify them into sectors like energy or technology and so on. We took this idea and really tried to do a forward-looking statement. So we looked through the 10-Ks, this is a textual analysis of the statements by companies about what businesses they would like to be in. So often those statements are quite revealing because companies are fairly precise when they put something in writing. about their intentions. So a company may announce that it's going to go into the photovoltaic business or it may talk about, you know, driverless cars or whatever. But you can't look at the past revenues. You look forward. And then what we do is, which I thought was innovative, it was we group companies into these natural clusters where they cluster together. Those groupings are found by the machine and accompany maybe more than one cluster. So we have a modern idea where, for example, Amazon has its web services business, it also is a retailer. So it should be in both kinds of buckets. That reveals, I think, a lot of interesting information. So, for example, we think about Biotech, but Biotech actually has firms in it that are more anti-cancer and firms that are more focused on diabetes. you know, so these little groupings are revealed by the data. The data speaks to us. And then the part about adaptive learning is that you're continuing to learn, you're continuing to read these texts and continuing to classify in a dynamic way these companies. That's what the Evolve suite is about. And again, it's a tool for investors, you know, to perhaps target particular bets more efficiently.

And so this was a pretty recent launch. How has the rollout been so far? How are you seeing people utilize it?

Well, it is very recent, so I don't know if I could really say something definitive about how it's being used. But I would say that obviously there are people that might want to time sectors. They may use it to make a bet about whether we're going into a recession or not. So you might want to be in in relatively safe sectors. If you believe the opposite, you might be in aggressive, pro-cyclical kind of sectors. But the idea is to provide a more modern definition of a sector than what we've had in the past.

So what's BlackRock's edge in all of this? Everybody has access to this technology. Are these algorithms being commoditized? What makes BlackRock better?

Well, I think part of it is experience. I mentioned that we were early pioneers in quantitative investing. some of our funds have been around for 30, 30, 35 years. So we have a long history of using quantitative techniques to improve investment outcomes. The second one, I think, is scale. So BlackRock is the world's largest asset manager. We have about, you know, a little less than $6 trillion under management. So there is a lot of scale. We can, field relatively big teams. And then the third element is close ties to academia, to folks in Stanford, Berkeley, and MIT, of course, and really around the country and the world. And we've had a long history of engagement with academic researchers to better understand how these techniques can be used and also realistically also understand their limitations. I mean, I think nothing is free. There is no free lunch. So you have to invest the time and you have to get it right. But those are the three things that I would say are our edge.

So what trends are you seeing more generally in this investment management industry? Are quantitative, rules-based funds overshadowing the traditional human-run management?

Good question. I think that debate has been around for a long time since the days of 2001. how computer and, you know, it's not happened yet. I do think that there is across the board a lot of interest in the availability of new data at low cost and the ability to process that data. So I think that's one of the things that's transforming the industry. I do think that also to the other panelists who may speak to cybersecurity or to the use of AI techniques to generally make things more efficient. I think there's a lot of interest even outside of the world of Alpha in terms of just saying, can we make the process more efficient of asset management? Can we deliver outcomes for our investors at lower costs? Can we do it more of months or years? Then it's a little hard to learn. And I think that's the challenge that we have.

So I want to first see if anybody has any questions for a non- before I ask anything else. Any questions from the audience? Sure.

How do you ensure so are these algorithms taking action?

Are they providing insights? And if we're taking action, how do.

You ensure that the actions are safe before they act? Do you have boundaries for their actions.

And then review.

All right, let me just repeat the question just in case people didn't hear it. So, paraphrase a little bit. The question was, do the algorithms that we adopt have boundaries? How do we, you know, are they fully automated or not? And if they are fully automated, what checks do we have on them? So, I'll just say that, you know, in terms of a lot of the signal research, The signals are not directly putting on trades. There are signals that flow to portfolio construction tools which generate trade lists. We don't necessarily need somebody in between that, but we typically do. And that's the guardrail. In the trading context, which I mentioned a couple of times, obviously a trader may take an order and put it in an algorithm. And that algorithm is responsible for breaking it up into little pieces. and placing, say, limit orders in various venues. It may automatically select the venue, it may automatically select the execution prices, and it will trade dynamically in response to intraday volatility and intraday volume and seeing what it's getting. And if it feels that its flow rates are too slow, it will speed up. So in that sense, those things are more fully automated. Typically those are actually offered by brokers to us. So we use the broker algorithms. By and large our experience has been excellent with the broker algorithms. The brokers in turn have probably a couple of decades of experience of putting guardrails on those things. I used to work for investment technology group before I joined BlackRock and indeed we spent a lot of time making sure that algorithms worked as expected in putting in safeguards. That said, there is in our business the famous fat finger. And sometimes it was an elbow of a guy resting on the keyboard which sent off a bunch of extra zeros on the order. And those things do happen sometimes.

So less than two minutes. Take one more.

Can you hear me?

Yeah.

Go ahead.

I'll repeat it. Do you find that some strategies or timelines work better with a fully automated.

Algorithmic system than others? And if so, is there anything that you can share?

Well, I would say that the goal is always the right investment outcome for the investor. And so some investors have long horizons and for them, I would imagine that, again, machine learned insights and so on are a complement to more traditional signals. In the trading context, which again I mentioned a couple of times, obviously these algorithms are designed to execute during the day. And for the most part, that's how they're deployed.

Great. Well, we are just about out of time. Anand, thank you so much for your time.

Thank you, Sunita.

Great, and so next we're going to have Keith Rabo join us. He is a managing director at CoastlUt Ventures. He's been involved in a lot of companies that we use every day like Square and PayPal and LinkedIn. I think the list goes on. So as a former executive at a number of FinTech startups and an investor in several, where do you see the most greenfield opportunities to combine artificial intelligence and finance?

Well, I mean, to some extent, none of this is new. I mean, we used artificial intelligence, our machine learning, and PayPal to solve our fraud problem. I mean, Max Levchin sort of invented a couple of things that have later been used by lots of people, including like a man in the loop sort of feedback on fraud, where we basically displayed a bunch of transactions on the screen, hired hourly workers, and they had red and green buttons, and they just pressed pattern or no pattern, and that's actually how we stopped losing $10 million a month. that sort of got Elon fired. And so that was like 2000, 2001.

How did that get Elon fired?

Losing $10 million a month, especially when it's not intentional. These days it's more intentional when most companies are losing $10 million a month. But when all the money was going to Russia and Eastern Europe, that was definitely not the business strategy. And we had like three months of cash. And it was 2000, so you couldn't raise any more money. Other than that, everything was going great. And he wanted to change the brand to x.com from PayPal. So the combination of those and wanting to get us off Linux and onto like some.NET platform, basically every possible thing that could go wrong was going wrong and that's what brought Peter back as CEO. But anyway, Max solved the fraud problem with this technique as well as everybody now knows what are known as referred to as CAPTCHAs. Max actually co-invented that too. We just forgot to patent it. We were too busy. So we literally didn't file the patent on what what's now known as a CAPTCHA, but we invented it to help stop the Russian fraudsters. So the combination of those two things basically is what made PayPal successful. And then, you know, when we were just starting Square, Square never really had a fraud problem. The reason why was, although lots of people, lots of investors, potential investors, potential employees, would always say, oh, you're gonna lose all this money. You're serving all these long-tail businesses. Anybody can sign up. Anybody can instantly take payments, you know, from your dry cleaner to your personal trainer, your taxi driver. I was like, well, no, I'm not particularly worried about that. We're just going to take all the techniques I learned at PayPal. We're just going to build it from scratch the right way. And Square has never had a fraud boss that's like material. So then today, the way I think about it is maybe somewhat different, which is I don't think there's a species of what I call AI startups. I think there's a component in a stack that allows for an economic transformation by using math. and the more the economic transformation, the more leverage you have in either distribution, customer acquisition, or in some operating costs somewhere where you can either just bring down the price and provide better service or et cetera. So they think of Open Door. So Open Door allows you to sell your house in like three minutes online. It provides instant liquidity to what any normal person's largest asset class, largest asset class in the world. And it does it using pretty advanced math, statistics, and data. but the end customer doesn't care. They don't even know. We give you an evaluation sight unseen of every house in the United States, basically. And you can decide to accept the offer. Now that would be very difficult without a lot of math. It'd be very difficult for us to do that without losing a lot of money without a lot of math. But the end customer has no idea and doesn't really care. In fact, we actually even dumb down how we create the valuation and make it seem more like humans are doing the work. Same thing you're seeing in medical, which is just an example, but metaphorically very applicable to financial services. you can today get a device like this to read your EKG and have it diagnosed instead of by a cardiologist, actually by just machine learning. In fact, the FDA last summer approved that. Literally, a cardiologist is basically right 93% of the time and the math behind this company is right 93.5% of the time. You have a choice as a consumer. You can for free get read by the machine. or you can pay and have a doctor read your EKG. But all of that are just like part of a value proposition where you're swapping out something that needs to be done poorly or something that needs to be done very expensively with something that's infinitely scalable and with no marginal cost.

I thought what you said about Open Door was interesting. You said you were actually simplifying the language to the consumer to make it seem as if humans are behind it. Is that because you think there's some sort of bias to the average consumer about this concept that algorithms are driving a lot of the decisions?

I don't think there is, but there's a big debate in the company about this, and I don't think there's any empirical evidence anybody's really marshaled. It's a sort of a judgment call. I think it's actually stupid personally, but I don't get to control everything.

So you spoke about some of your experiences at Square and PayPal and the fraud side and how AI was being applied. So where are you seeing the most mature applications of the technology right now?

You're seeing it in obviously underwriting, like some large investor in a company called Affirm that basically is underwriting either consumers with thin credit or, you know, non-existent FICO score, which there's a lot of, or with people who are arguably poorly priced by FICO. And so you see the lending, that's a pretty obvious application. There's some regulatory complexities to doing consumer finance that way. We see it in small business lending at Square Capital or a company that we're an investor in called Fundbox. that's using data to provide loans in an efficient way, using fairly advanced techniques and, you know, pretty aggressively investing and hiring, you know, data scientists.

And you were the chief operating officer at Square in 2013, right? So at that time, how were you thinking about applying AI within the business and how far along have you seen it go?

Well, it was mostly using risk, you know, risk at the time and Square Capital had just basically started. So those were the two key areas. It wasn't really used in most of the rest of the business. Now that's not true. I believe it's used in almost all parts of the business to some extent. But the high leverage parts are still in extending loans to people and preventing fraud. For that company, I think you'll see in contrast, the company is investing more in using blockchain sort of technologies. across the business units, so even the finance team is running a blockchain project.

At Square? Yeah.

Can you talk a little bit more about that?

No, I'll let them talk about it. But basically there's a mandate from above that every part of the company, from customer support to finance, has to build something on blockchain.

Do you think that's a good idea?

I think being fast and familiar with new cutting-edge technologies is a very good idea, like culturally. so for example, there's companies that if where they actually expect all of their customer support people to run SQL queries to get their own data and be able to do their own analysis. And I think that's a statement about a company's culture that everybody's going to be like quantitatively literate and that can be a very strong thing. Or there's a lot of debate, you know, in the last couple days because Bezos published his annual letter about companies that force people to write, write memos as a way of, you know, debating things, discussing things, deciding things as opposed to meetings and/or PowerPoints. And I think that's a very fine culture too. So I think where you have a new technology that has potential, if the company has to care about it, then maybe you want to force every employee to kind of understand the technology at least at a base level.

And generally, are you seeing a lot of good use cases of blockchain as an investor?

No.

Like zero. But that doesn't mean it's about investment. But there's two different things. You could argue what was the use case of the internet? I mean, there was some clear communication use cases that dated back actually over a decade before it was commercialized and internet. So it wasn't quite as much of a leap. But one of the reasons why is no one has really decided what's the best possible application of blockchain. And because of that, it's really hard to fix the right protocol or coin because each one has trade-offs. Like some are better for fundraising applications, some would be better for scalable concurrent transaction applications. And so where both the open source software and the applications are in flux, it's very difficult to predict what one should do. You know, an investor strategy could say, I'm gonna invest in everything. which is a reasonable hypothesis like net-net, I can't figure out what the applications are going to be so I'm going to find every plausible credible protocol that has a significant technology team and just give them all money. Or one could say, hey, you know, I'm actually pretty smart and I can see the future and this application is going to eventually happen and so then I can assess and filter all of the potential protocols and companies and startups by whether it contributes significantly to the application.

So you've looked at companies across industries from health tech, finance, consumer internet, et cetera. Where do you see the biggest space between business needs and technical capabilities when it comes to machine learning and artificial intelligence?

That's a great question, because it's difficult for me, because it's not the prism I usually use to filter things. So I'm sort of a founder-driven investor. So I start with like, Is this team unreasonable, unreasonably strong in different ways and are the problems they're trying to tackle? Do they have an unfair advantage, basically? And so I don't actually care about the market or market opportunity as much as I care about, so for example, go by metaphor here, if you'd invested in a lot of alternative energy companies or sustainable companies in the early 2000s, you would have lost a massive amount of money. My partners, you know, before me lost a lot of money or certainly didn't make a lot of money investing in cleantech. However, if you had said there's this crazy guy named Elon who we talked about before who got fired, who wants to build like a, you know, a new automotive company, you would have made a lot of money regardless of what round you invested in, what price you had paid. So that's why I think about it like, is this founder going to accomplish something heroic? not like, is there a missing opportunity? Very, very rare. So I'll give you an example though of when I did do more of a top-down analysis, which is in cyber security meets insurance, which is like a fintech company. So I like insurance kind of investments, health insurance, auto insurance, now cyber insurance. And we sort of decided from a top-down perspective that the entire world of cyber insurance was completely broken because the prior historical data sets were useless to directionally wrong. And all these people are underwriting based upon either historical data sets or literally clipboard based questionnaires. And that makes no sense in the modern world. And cyber insurance is becoming increasingly more important for everybody. Just you read a headline every, you know, like basically every day. And so it's like, well, the combination of those two things seems like there's a billion dollar company, you know, they're like, you know, like this is probably the easiest thing I've ever seen in my life. Like just combining, combining those thoughts, like someone will build a billion dollar startup. or multi-billion dollar startup that does cyber insurance. So we actually, from a top-down perspective, did say we want to go find a cyber insurance company to either start or invest in. But that's very, very rare for us. Did you find it? Yeah.

It's not announced yet that we invested, but we invested in a cyber insurance company. So a lot of the algorithms that are being used, it's very opaque and it's not clear to the public how exactly they're being gathered and created. So from an ethical standpoint, how do you think startups need to make sure that they're minimizing any potential bias?

Well, let's talk about a couple points there. One thing is the biggest problem for startups is getting access to data. So another reason why I don't tend to think about like, is this an AI startup or not, is the most important thing I'm interested in is can you get access to data? Because if you can't get access to data at scale, there's no algorithms in the world's gonna save you. And I'd actually how I'd rather almost always prefer more data than better math. And so startups just don't have data. And in financial services and healthcare particularly, the people who have data aren't gonna give it to you for a variety of reasons, some good and some bad. So like some strategic and some like regulatory reasons. So getting your hands on massive scale data as a founder, as a startup or as an investor is like by far the biggest like first step. Now on the ethics, like the way, you know, we think about it is, is this better or worse than what humans do? So for example, we funded a company several years ago called Pymetrics in New York that basically matches people applying for jobs with companies that are hiring using purely games. So you play these eight games for about 20 minutes and it tells you what jobs and what companies are perfect for you. So large people, it works really well for things like investment banks like Goldman Sachs and hires a class every year at McKinsey, hires a class every year at costs every year, Bain, et cetera. And it turned out that the, as people now large, several large entities, companies use this for like their on-campus recruiting, either for MBAs or undergrads. And it turns out it significantly reduced, increased, just by changing the math, increased the diversity and the acceptance rate at the same time for all, for basically all of their customers. And so maybe the algorithms are biased, but they're less biased than what they were doing the day before. So as long as you're making net progress, I think it's a good thing. Like the idea that you're going to have a completely neutral detached algorithm and data is probably wrong, but the ethical statement is it better or worse than what humans are doing and have been doing for 100 years in a particular field. And often you can get a benchmark. So per my point about the cardiologist, one of the nice things about help that is there's a pretty good way to figure out how good cardiologists are at what they do. And so the FDA just said, prove to us that you're better. And as long as you do, we'll approve it. And the same thing in radiology. It tends out there's a pretty simple way to grade the reading of an x-ray. So getting sort of FDA approval to have just algorithms read x-rays is actually pretty easy. So as long as you can baseline how well humans do a task, it's pretty easy to understand the ethical implications. Now there's some things, it's just hard to get a baseline and that's a little bit more complex.

So certainly right that for startups it can be a struggle to get data and now there's this global debate right now about a lot of large tech companies that have too much data on us, particularly Facebook and the Cambridge Analytica issue, and the ability for advertisers to target people very granularly. you know, what's your take on all of that and is this whole era of move fast and break things from a startup perspective sort of over?

I did two points, one somewhat contrarian and one maybe conventional. Look, everybody knew that this data gathering was going on. Like do a Google search on VentureBeat or Inside Facebook or TechCrunch. The idea, or as Dick Costello said, you know, I'm shocked that gambling is going on here. There is nobody who was involved in technology that didn't know what data Facebook was collecting for at least seven to 10 years. I mean, the one failed company I did that you crossed over nicely in a resume, it was a company called Slide. And we built applications on Facebook and at one point we were massively popular building applications on MySpace and Facebook. And we had all of this data times like basically every Facebook user. And actually, ironically enough, and I should probably tweet about this, We sort of misused the data one day and Facebook caught us. And it was my app, like the one I actually ran, my team. And it was a very banal misuse of the data. Actually, you could argue it was pro-consumer, but it violated Facebook's policies at the margin. And so they suspended our app. They spent my app called Top Friends for like two months. So while they were bothering policing me, they forgot about all the other people. But the fact that obviously we had all this data in both Facebook people and, you know, journalists covered our app got suspended. It was widely known that our app got suspended for slightly using things at the edge. Basically, it would show you who your top friends, top friends were. So you're doing a second degree calculation. So you could see, which is very similar to what Cambridge was doing. So I think all of this is kind of a myth. And as I tweeted a couple weeks ago, a lot of our companies use direct mail. You can do a hell of a lot better targeting in direct mail than you can on Facebook. Like this is a dirty secret that anybody does customer acquisition, particularly for SMBs knows. So for example, if you want to figure out an income band, direct mail is much better than Facebook. So you want to target people who earn a precise amount of money, can't do that on Facebook very well. You want to target by type of business, can't do that on Facebook very well. You want to get dry click, so for example, if I want to mail to, we did this at Square, huge customer acquisition channel for Square is direct mail. You want to know all businesses created in the last 30 days, great, you can do that on direct mail. You want to know all businesses that are dry cleaners? in the last 30 days, you can do that direct mail. You want to know all the attorneys, you can do that. It's very, very easy to target in direct mail in ways that Facebook can't do. So in the idea that politicians didn't know about direct mail because they all use direct mail and they all target this way is like ridiculous. The part that is a massive change that I think startups need to calculate a little bit differently is a metaphor I sort of started using a couple of years ago, which is sort of the pirates in the Navy. So for most of my life, Silicon Valley was like the pirates. Famous Steve Jobs quotes about this and literally having pirate flags at Apple. And it was kind of to try to overthrow or improve society. And Silicon Valley was like the creative energy. And people root for the pirates. There's lots of movies where the pirates are the heroes actually, although it's kind of ironic if you think about what pirates actually do. But once software sort of ate the world and in the introduction Horowitz framing and technology companies became more and more important and more and more powerful. It's very difficult to act like the pirates anymore when you're actually in the Navy. So you have the brute force of the Navy, you have the resources of the Navy, you have to start acting like the Navy and people don't cheer for the Navy acting like pirates. And I think there was some transformation sometime between 2010 and '15 where more software became like the Navy than the pirates, but without necessarily all the companies realizing that or the founders realizing that.

Rise over career. So I just wanted to start out and ask, why start a high frequency trading hedge fund? It's a very competitive environment.

That's a really good question. So just a couple of things. For CPW, by the way, this is a total coincidence. They didn't know that we knew each other and then they just put us on the same event. And so this is amazing.

Does everybody here know what CPW is? Raise your hand if you-- okay.

Yeah, it's basically when you make it to MIT, they send high school seniors to MIT for Weekend to preview. And I was assigned by total random coincidence to Selena as her host when I was a current student then. And so that's what happened. So anyway, back to Selena's question. She has a really good question, which is like, why would you start a high-frequency trading hedge fund when it's such a controversial industry, obviously, and it's very competitive, like everyone says. That's a really good question. And I'll actually go off of actually Keith's answer from which is really nice. He said how in healthcare, for instance, there's actually not a lot of data available. It's hard to come across. Actually in finance, what's interesting was there was a period of time back maybe six, seven years ago when we were starting our business where there was actually a lot more financial data available than the number of quant or high frequency trading hedge funds out there. So if you ever want to feel like a celebrity, by the way, what I did was actually we would go to these big financial expos in Chicago, and you would literally walk around and people would line up to see you. People would literally line up to talk to me about, hi, Christina, I'm selling this latest textual newsfeed. Here's what we do better than the other competitors out there, and it was really competitive. And I was sitting there looking at them five years ago being like, we just started our company. How do you know who we are? Because we were so new back then. But that just gives you a sign of just how competitive it was in the data space already back then. But there just weren't a lot of people who were out there really applying that into the, you know, into different usable signals in the financial space. And so we started it back then and then have kind of grown the firm since then and we're still alive today. So really happy about that.

So sort of high level speaking, you know, this industry has really been thrust into the public light over the past few years with, publications of mainstream books like Flash Boys. So from your perspective, you started your dome yard before that book came out?

Yep. And then the book came out, I think two years after we had started. It was an interesting time. And there was a couple, I think the book unfortunately, it did cause two really big misconceptions in our industry, which today it's a little bit better with our investors. They understand misconceptions. The first one being that front running, you know, that all HFT firms do front running, which is not true actually. A lot of the people who buy order flow and do front running, you know, are the larger, you know, the larger banks basically that are here today. So, so, you know, you can be in high frequency trading firm like us and we don't buy order flow, so we actually don't do what Michael Lewis called front running. And the second thing is actually the definition of front running itself. Front running itself is illegal. You know, you're not allowed to do that today. And so that's the other thing about, you know, you can buy order flow, that's different. And so just definition wise, it kind of confused the entire industry and definitely set us up for a lot of challenges moving forward. So like one instance is when I go to conferences like these, you know, people always ask me like, well, what are you doing in your industry to improve it? Like, you know, are you, what is what you're doing ethical? And someone will always raise their hand and be like, hi, Christina, I hate everything you're doing and you should be in jail. You know, just like all kinds of crazy stuff like that. So we have to be able to represent the entire industry, even though we just, you know, we're, I consider ourselves a start up in our space. And yet here I am, sitting next to the CEO of KCG and Citadel, and I have to be able to defend myself just as much as they do. And so that's definitely the impact of Flash Boys on us.

And how have you seen the industry, aside from the public conceptions or misconceptions? How have you seen the industry change over the past five or so years?

It's changed a lot. Let me tell you this. So for instance, when we first started up, when an investor would ask us, what's your advantage? What makes you different from all the other high frequency traders out there? And back then I would say one word answer and I'd be like speed. Like yep, we're faster and that was it and they would totally believe me and that was great. But then today, the same investor, if they came up to us and said, what was your advantage? And if I said speed, he would just probably laugh in my face. He or she would probably laugh in my face. And that's just because today speed is the bare minimum requirement of any Quant fund really to kind of stay stay on top of things. And so, you know, you have to be good. You have to have better risk management systems. You have to have a better trading pipeline. You have to have a better idea generation, better technology. Everything has to be really on top of things in order to kind of stay afloat today. So a couple of other changes, actually, just in terms of the pipeline. So today I say, you know, if you want to enter finance, don't study finance in school. You want to study, you know, computer science or mathematics, right? Whereas, like, 10 years ago, usually, you know, you study traditional finance and about PE ratios and book-to-market ratios and things like that. And so it's definitely, I think that the hedge fund space has definitely changed as well. So like when people approach me and they tell me hi Christine, I'm starting a high frequency trading, or just let's just say hi Christine, I'm starting a hedge fund today. I usually assume it's either a crypto fund or like some kind of quant today. That's just kind of the assumption. There is not a lot of, you know, in terms of your long only traditional fund, the chances of of succeeding are very slim unless you have like 40 years of experience and backing behind you. So anyway, yeah.

Well, that leads me to my next question. I'm going to play the role of investor. So in this world where quant hedge funds are popping up all the time, how do you stay competitive and better?

Yeah, that's a really good question. And this is something that, you know, when people ask me like, how do you stay alive and what do you recommend for startup hedge funds out there? I would say a couple of things. Like one thing that we actually did differently was we raised venture capital back then. And five, six years ago, a hedge fund raising venture capital was almost unheard of, early stage VC funding. And that bought us a lot of time and a lot of runway to be able to do things right. So we had to build up an entire trading ecosystem in our office from scratch. So that's definitely one thing. And then the second thing is definitely, I recommend with other startups, don't cut any corners. So when people tell me, I'm starting a hedge fund, I only have $100,000 in our bank account, that's not enough, right? So like our, the legal cost of setting up our fund structure, which is six different entities, that was like $300,000, just the legal backbone of like the company. And then from there you have your data licenses, your co-location, your computers, your servers, you know, everything combined, and hiring all the talent, getting an office, all those operational expenses, you know, that's like what, five, $10 million right there. So, you know, today in order to kind of get up and running, definitely recommend, you know, raising some form of funding if you're going to be technical fun, you know, company on the inside. And then definitely don't cut any corners. Like don't just think that you can self lawyer and start a fund that way because you know you run into a lot of trouble with the SEC and with NFA and et cetera.

So yeah. Your technologies were designed and created in house. How long did that take and did you need, I assume you have a very lean workforce?

Yep, that's a really good question as well. So we do have a very lean workforce and the technology itself I'll give you a sense. It took us two and a half years to launch the fund. And those two and a half years were not easy at all. I mean, we were, you know, I was busy raising venture capital at the time and raising money in the fund. So LP, GP capital, our company, you know, the team was busy. We had to build the order management system, the data feed handlers, like, you know, every, the entire, like, ecosystem internally. And so all that took a lot of time and a lot of a lot of trial and error also on our part because there weren't a lot of service providers out there that have done it before. And so yeah, I mean, I can also tell you, I don't know if you're curious about how we raised our first penny. Please do. But basically how we raised our first penny was actually, there was a company that came over, big VC firm, and they came over to MIT a few years after I had graduated and they said, hey, we'll have a bunch of startups here. You get, typical story, right? Every startup gets, three minutes to pitch. And you sign up and you go over there in the evening and you pitch to them. And so I signed up and I spent all day preparing, you know, like five different slides for three minutes. And I went up there and I said, hi, I'm Christina. You know, I started this high frequency trading fund. And immediately the CEO of this VC firm, they're like, wait, does that mean you do front running? Because he read Flash Boys. And I was like, oh, no, you know, because it's a huge misconception. I had to explain the misconception and why, you know, front running is actually legal and that we don't do front running even though we're a high frequency fund. And then my time was up and I went home being like, that was the worst talk I have ever given. And I apologize to my co-founders on Slack. I was like, I'm sorry guys. So then it was 11:30 p.m. And the CEO calls me and he says, hi Christina, can you come meet at my hotel and bring your two co-founders. And I was like, oh God. And so I grabbed my co-founders and we went over to the hotel. we talked for like five or six hours and he was like, okay, I'm gonna invest. And that was it. That was our first investment. And this VC firm basically, so it's RenRen who they're owned by SoftBank. And so we got a really great, it's the biggest fintech investor in the world. We got a really great investor there just by that one, that three-minute pitch that went terribly. And just to give you guys some perspective as well, we have talked, you know, we've pitched and failed hundreds of times over, and that was the first time that it had succeeded, you know? And so it wasn't like an easy thing where I just went there one day and it suddenly worked. It was a two and a half year process for me.

So serendipitous, but also meets hard work. So, you know, more recently, a lot of high frequency trading funds have had tough times amid low volatility and the expensive costs of keeping the technology and the network running. So what what sort of opportunity have you found that a lot of these maybe more mainstream investors have not? And what do you make of the consolidation?

It's a good question as well. So the opportunities that we actually look at when we started off as well as today is like we may trade in certain markets and products that other larger firms may overlook. Just because like if you're you know if you're on the high frequency trading team at like a Goldman Sachs they're managing what like billions of dollars in assets under management. And so they can't afford to look at some of the smaller markets or the more niche markets out there because there might not be enough volume or might not be enough players out there and it's just not worth the efforts for them. Whereas for us, because we had built up the product and we're pretty niche already, we can look into those other markets and be like, oh yeah, that's easy for us to enter. And we can make an additional, even if it's an additional $20,000 a day, for us that's significant because we're a tiny team of people, whereas at a larger firm like Goldman Sachs or like a BlackRock, it may not be worth the effort that they have to take to do that kind of stuff. So that's definitely one area that we try to do a little bit differently. And then the other comment I had to make is you probably have read a lot of headlines in the news these days about high frequency trading is dead. All the firms are dying and you should never want to even consider being in this industry. Why would you want to do that? it's dying, right? And I think the only comment I have to say about that is actually, I wouldn't say that it's dying. I mean, actually finance is moving towards fintech. So like today, if you start a finance company, I just assume it's fintech. That's going to happen to hedge funds as well. So I would say it's not really dying in the underlying concept and the technologies are still going to be, it's going to go even more and more into finance, basically. But I would say that the industry.

Is maturing is what it is. Can you give us a little dive into how you're applying artificial intelligence at Dome Yard and what the limitations of it are right now? That's a good question as well.

So also one thing to clarify on is, so artificial intelligence, what it's really good at in finance today is areas of finance where there's like a large data set. So like textual news feeds where there's tons of news articles coming out day to day and it's pretty easy to kind of aggregate that and analyze it and figure out what the keywords are and what the signals are from there. So that's really easy to do. A lot of, not just like us, but even like quant firms will look at textual news feeds. And also there's even like discretionary firms, like I used to sit on a discretionary trading desk, even the most discretionary guys out there actually use some automation in their strategies too. So like, so you know, it's like not just for us, but all kinds of firms out there do use AI. For us in particular, you know, we'll look at like for instance signal generation, we do use some to look for signals, we'll look at neural nets, for instance. And then we do look at some textual news feeds as well, which is really exciting for us too. But yeah, so those are the main areas that we use a little bit of AI today, some AI techniques. The limitation that Selena asked, one of the biggest limitations of these machine learning techniques, by the way, is that machine learning optimizes for throughput rather than for latency, meaning that some of these techniques are slow. inherently just like slow. And for us, you know, because every morning, like this morning in the New York Stock Exchange, we get what? 350 million signals in the New York Stock Exchange coming into us, like into our data feeds, right? 350 million signals in like one hour is a lot of data. And if you're not fast enough to process all that data within the same hour and to actually turn that into a strategy within that same hour, then, you know, you can't really survive in the to begin with. So yeah, I guess the biggest limitation right now is still the speed issue. It will get better though over time, I'm sure.

So what's your ultimate vision for Domeyard? One of your co-founders said in a news article that he sees your machine learning algorithms being applied in other areas, even outside of finance. So I'm wondering how you're thinking about it.

Yeah, I think that's one thing. We started with HFT because this was the area that we knew we had like an edge in. But now that we've kind of grown bigger and we've reached capacity, we trade about $1.5 billion a day now. So we've gotten to a point where we're pretty big. Now we're looking at things like, let's do some low frequency quant. And then after low frequency quant, well, why don't we consider expanding into a fintech company where we're selling our trading platform that we were lucky we had created it back then. So we're selling our trading platform to some of the larger banks in the Boston area right now. And they're utilizing that to do some of their high frequency trading strategies as well. So, you know, we can become a fintech fund and then later use, you know, if the data ever becomes available, like in the healthcare space, for instance, we could always go and do, you know, research in that area as well. So I think the key for us is like keeping an open mind. You never want to be close minded to just, you know, just high frequency.

Trading because it may not be around forever.

So. Right.

I mean, so in, let's say, the next five years, what do you think the high frequency trading industry is going to look like as these technologies continue to accelerate?

That's a really good question. So I think high frequency trading, as long as the regulations are pretty friendly and as long as the taxes are low and stuff like that, I think it'll continue to kind of stay around for quite some time. And so yeah, that's definitely one area that I think because the industry is kind of consolidating and it's aging and maturing though, we are starting to see who the winners are in our space. So Virtu acquiring KCG was a huge acquisition. in our space, HRT acquiring Sun, there's been these really big acquisitions. That's exciting and also, but there's definitely space for startups as well. It's a really good environment right now for good and bad. It depends on how you view it. You'll see articles of people saying it's bad because the cost, obviously the cost is very expensive. But then it's also good because there's so many sources of data and there's so many different vendors out there that cater to your industry now. so it's kind of good and bad at the same time.

You mentioned earlier that you assume people starting new funds that it's going to be related to crypto and more than 100 of them have been created since the whole Bitcoin surge. So how are you looking at that space? Did you ever consider investing in it?

It's a good question. So for some reason, like every day someone reaches out to me on LinkedIn being like, hi, Christina, I'm starting a crypto hedge fund and here's what we're doing. And and, you know, it's hard to not roll my eyes and and feel like, oh, you know, because they're everywhere. And all I would, you know, say is just the same thing. Like, you can't cut any corners when you're doing a crypto hedge fund especially. It is a very, very new field. So this is like high frequency trading maybe 10 years ago, right? Now it's crypto. So like it's the same thing. It's a very new field. There's a lot of people who are entering it and we don't know who the winners are today. And that could be good or bad. So like we have one of our VCs that invested in us, they actually, he's like one of the biggest crypto investors out there. And he tells me the same thing. He's like there's no winner out there. And basically he invests in like 40 different companies like crypto various crypto asset managers and stuff like that. And he says maybe one of them will succeed and that's about it. And so that's our view on it is like okay yeah we do mine. We might mine Ethereum on the side or do a little bit of crypto trading here and there and maybe just trade a little bit just because as a young millennial manager I think it would be a shame not to understand the underlying and the underlying technology behind it. You know, not all these firms will be around, but at the same time, the technology behind, you know, behind Bitcoin, behind Ethereum, it's going to be around for quite some time. And so that's important for anybody, I think, in this room to understand, no matter what you think of crypto, whether you think it's a freaking bubble, doesn't matter. Like, you should probably do some diligence in terms of understanding how it works, because there are going to be more and more startups. It's just, you know, it's going to.

Double or triple this year. The hedge funds basically is going to be like probably 500 by the end of this year.

Here.

I definitely saw some eyes light up in the audience when you said that. Do we have any questions? We have five minutes left right there.

Since you have developed lots of new technology, can you put out some of the stuff in open source and the ideas will come to you in all kinds of shapes and forms?

Oh yeah, we already do that. So we do have some things in open source. we actually work with some schools as well on open source projects. And those are areas that have benefited us significantly and also just the community in general. So that's, as a startup, it's not easy to do open source. I'll let you know that. I mean, because we have budget constraints. We're not a giant Goldman Sachs, right? But we still try to do that because I think it's in our stage now, I think it's important to be able to kind of not only give back to the community and show them a little bit of the glimpse of what the black box kind of looks like. but also in terms of helping our students in the future. And people who are interested in the open source community in general just understand a little bit more. So yeah, that's definitely one thing that we're trying to do more of, I guess.

All right, got time for one more question. Right there, Mike is coming to you.

You mentioned earlier that it took about two years to get funding.

What did you do in that time.

To prepare and to make sure that your tech was advancing and that you.

Were advancing as a company, as a team.

That's a good question. So, you know, to be honest, we didn't have any money starting off and we don't come from rich families. So I was literally sleeping on couches and buying ramen from the shaw's nearby. And that's literally how I lived for two years. It was not easy. And during that time though, in terms of on the technology, we actually prepared from the ground up on the technology side first. so we looked at all the service providers out there and we decided there was nothing out there that catered to our high frequency trading and exactly what we wanted. And so we built it ourselves. So we built, I think we first built the order management system, which handles orders and takes in stuff. And then we built the data feed handlers, we bought all the servers, we configured everything. And basically we had, by the two and a half years, by that time we had everything going where we could kind of run a strategy directly hook up with the CME or another exchange. and basically get data from the exchange, extract that data, get a signal, and then go make a signal, basically place an order to the CME. So all that whole entire pipeline we had within those two years or so. And so that was-- the good thing about that was it created a lot of IP. And I think that IP was what excited a venture capital firm because they're like, oh, you could use that to fintech stuff in the future.

Yeah.

Well, thank you so much, Christina, for the dynamic conversation.

Thank you, Selena.

To introduce Zulfiqar Ramzan, who is the CTO at RSA. He's had sort of a marathon weekend with the big RSA conference going on. So very excited to have him here today. Thank you.

Well, it's very easy to be here. I stayed at the hotel whole week. So I was told, Shuja, if I can make it down after my shower.

I should be able to squeeze this in before going back to the conference. So thank you for that. The conference marathon for you. So RSA works with companies in practically every industry. So just sort of broadly speaking, how are you seeing AI being applied across these broad swath of companies to protect security?

Yeah, I think if you look at RSA's markets, I mean, certainly, you know, government and FinTech tend to be two of the biggest areas where we see a lot of demand. Obviously, securities are premium in both of those areas. and so as a result, there's active interest. Now what we are seeing is that generally speaking, we live in a world where people are collecting increasing amounts of data. And RSA is part of EMC, which is a major storage company, now part of Dell, which is a major technology company. And so storage is something that's in our blood in many ways. And what we're noticing is that when you collect all this data, to be able to do anything useful with it, to avoid having a data landfill, and really create more of a data lake, it's critical to be able to find meaningful insights from that data. And AI and machine learning techniques have been around for decades and have enabled people to find and glean those meaningful insights. And in fact, it's kind of interesting to see this resurgence and talk about AI, even though many of the underlying concepts have been studied carefully at places like MIT and Stanford and others for quite a long time and have been applied in actual production environments to glean meaningful insights that have true business value.

And so give us a little perspective on some of the challenges of deploying AI systems at large scale, working with some of the biggest companies in the world.

Yeah, and I've been involved in both sides of that, not only in terms of seeing how AI gets applied in other industries, but also developing large scale AI systems on my own and seeing maybe 100, 200 million people use those systems on a regular basis to glean meaningful insights. And what I've noticed is that with AI and machine learning, it's very easy to get caught up in the latest type and the latest technical concepts. People caught up in, my neural network is bigger than your neural network and so on and so forth. And really, what's amazing is there's a disproportionate amount of time spent on the classifier side, the sort of very technical side, as opposed to the underlying side of gathering the right data. So AI is very much garbage in, garbage out. And if you think about it, it's kind of like we're here in California, you can't make good wine from bad grapes. and so we see the same sentiment happening. After you look at the right data sets and you collect the right high fidelity data, the next question becomes, what are the meaningful questions to ask of your data? What kind of features do you want to extract? And that typically requires a certain degree of domain knowledge. And so when I see a lot of startups who are trying to develop AI-based solutions and they tell me about all their great PhDs in machine learning and AI, what's often missing is the person with the domain expertise to say, this is what you need to look at. at a broad level in this data set. And so it starts off with the good data, good features, and then classifier in that order, whereas in most places they do it in reverse. Most people spend all the time looking at the classifier and then the features, and then they place less importance on the data. Now I mentioned that because if you have the right data and the right features, it almost doesn't matter what classifier you pick. I think most of the commercial off-the-shelf classifiers you can find are gonna perform within a fraction of a percent of each other. And in fact, in those cases, you are better off picking a simpler classifier, one that you can understand, where you can understand how the results were derived and are able to fix issues, because ultimately data is never perfect in the real world. And because data is never perfect in the real world, you may have to make adjustments in other aspects of that flow in that pipeline to account for that. And the less you understand about the end of that pipeline, the more difficult it is to make those adjustments to get successful results that will be applied in real world environments.

Now, AI can bring a lot of efficiencies to companies, but it can also open up vulnerabilities. So what are the potential and possibilities for companies to have their AI algorithms to be hacked?

This is a huge issue, one which I believe is not being carefully looked at these days. So ultimately, when you collect a lot of data and you try to derive insights from it, what AI tends to give you is some type of model that tries to explain that data and allows you to make important decisions. based on that data. But today's AI systems were not designed to function in adversarial environments. So, you know, case in point, there's a paper written recently where they showed that by putting some duct tape in very careful places on street signs, you could fool self-driving cars without too much effort. Because ultimately these models are assuming that the data is good. And so what I get worried about is when people collect all this data and they try to run an algorithm they don't fully understand, if I'm a threat actor and I want to really disrupt a business, if I can add a bit of noise to your data in the right places, there's a good chance you'll not detect the noise and more importantly, when the models come out at the other end, you won't be able to detect what actually went wrong along the way. When we start talking about using AI at scale, especially in areas like FinTech, where there's a lot of money involved, certainly I could see situations where a well-motivated threat actor with a little bit of effort can wreak a lot of.

Havoc and probably find ways to benefit from that financially. Are you seeing that right now?

No, I think that's the, you know, I look at that problem as the keep me up at night problem. Whenever somebody asks me what do I think the future is of security, I think data manipulation and poisoning of data will be one of the biggest issues we'll face. Now we're seeing very early instances of that. For example, we see attacks on ransomware where somebody will go into an environment, they'll encrypt all the computers in that environment and then demand a ransom payment in the form of Bitcoin, typically, to decrypt the corresponding data. Ironically enough, that uses technology MI to develop in public cryptography to make that secure for the attacker. So it's probably an example of cybersecurity techniques being used for adversarial purposes. But I think ultimately what we're finding is that threat actors realize there's value in data and people are willing to pay money to regain access to their data. And in many cases, you know, we talk about FinTech, but a lot of our customers are hospitals. And for them, if a critical hospital system is taken down because of ransomware, that can create a true life-threatening impact. So we are seeing this blurring of boundaries between the digital and the physical in a way that can be quite concerning.

So how are you seeing these threat actors actually use artificial intelligence, and is that an increasing concern as they can come up with adversarial algorithms that can sort of learn things on the fly?

Yes, we're seeing very early stages of threat actors trying to apply AI. I think at this point, here's the thing with threat actors, ultimately, for lack of a better term, they're often somewhat lazy. If they were not lazy, they probably would be doing good things with their time. And so what they typically try to do is expend the minimal effort they need to succeed in whatever endeavor they're trying to do. So in other words, if they're trying to make money, nowadays there's so many basic vulnerabilities in systems that you don't need to do anything fancy. But I've seen some funny cases. For example, we saw, one sort of small scale threat actor developed technology to solve CAPTCHAs, which we talked about earlier. Those are those, you know, really annoying things you've got to type in like letters and numbers when you try to log in online. And for a long time, the premise behind CAPTCHAs was that it was supposed to be easy for humans to solve and hard for computers to solve. But over time, they become harder and harder for humans to solve. Like they can never tell, is that a six or a nine or, you know, and what's funny is that now computers have gotten much better at solving CAPTCHAs and humans. And so we saw one threat actor said, look, I'm gonna offer you a SaaS service. If you pay me a certain amount of money per month, I will actually solve all those CAPTCHAs for you. And this is great for people like spammers who try to harvest accounts at scale. And the pricing is pretty compelling. So, you know, if I'm a threat actor, I wanna get some AI as a service. We're already seeing that in practice. And of course, these are toy examples, but here's the thing with toy examples. Today's toy examples end up evolving because attacks never get worse over time. They only get better.

So the annual cost of cyber attacks is projected to reach $6 trillion or 10% of the world's GDP in just a few years. And Equifax alone exposed half the data of all US citizens. Could better AI have stopped that?

Yeah, I believe better AI would have played a helpful role. And here's the interesting thing. When you look at these breaches, whether it's Equifax or others, You know, oftentimes there was maybe one simple thing that company forgot to do in the right way to, that ultimately led to the breach. But what mistake people make when they think about breaches is that it's not about just the breach itself. There's an intrusion that precedes the breach, and it's the intrusion that can ultimately lead to the breach. In other words, think of it this way. Imagine you are trying to build a secure bank, right? You can build a really strong front door for the bank. But the bank robber's goal is not to get in the front door of the bank. In fact, no matter how hard you try, they're probably going to find a way in because your bank is open for business at some point. But the actor's goal is to get to the money that's in the vault. And it can take quite some time between when somebody first gets in to when they get out with the most critical assets, which means there is a window of opportunity. So even if you make a mistake early on and you don't have the right front door in place, there's a lot of opportunity to detect attack activity throughout the course of the attack lifecycle. and we are seeing a lot of use of AI techniques in that realm. And we've certainly deployed it in our own technologies at RSA. We've been able to detect in one case, I know at least one situation where we were working with the foreign government who was being attacked by another foreign government, and we were able to detect that using even some fairly sophisticated conceptual ideas, but the AI part of it was actually not that complicated. We were able to detect some pretty profound things just with those techniques alone. So that's one area. The other area where I think there could be a lot of value is in doing a better job of predictive risk analytics. Cybersecurity today is a problem where people get so focused on the threat part of it, but beneath the threat, you've got to start off with understanding your broader risk portfolio. Understand what is the threat actor going after, why would they go after it, and what impact it could make to your business. And when you think about risk and risk analytics, analytics lends itself to techniques from AI and machine learning when you talk about can I predict where my risks are going to lie in my environment. And that enables our customers in turn to be able to do the right kinds of things. So they don't have infinite budget, they don't have infinite time, but they can find ways to prioritize what matters most to their organization. And there's a huge opportunity, I believe.

There for AI to play a major role. Why does it take organizations so long to actually deal with the problem once when there's an initial signal? We were just talking earlier and you mentioned the average time is like nine months.

Yes.

It's almost a year.

Yeah, you know, it's amazing between the time that a company is first intruded upon to when they first recognized the intrusion occurred, the average time is 270 days. Now it depends on whose survey you ask and how you measure, but I'll just put it this way. Look, if somebody was living in your house for nine months and you didn't know it, that would be a pretty shocking thing to consider in the physical world, right? And so when we look at the digital world, this seems to happen all the time. Now I think the reason for that is that Historically, when people thought about security issues, they've been so focused on prevention. Can I stop the bad guys from getting in? And they haven't really focused more on detection and response. Can I really understand what's happening across the entire threat lifecycle? To be able to do that problem effectively or solve it effectively, we need to have visibility as a foundation to understand what's happening across all of our key assets. But as I mentioned earlier, visibility on its own is necessary but not sufficient. It gives you the data you need, but you have to be able to glean meaningful insights from that visibility so that you can actually make decisions that improve your security posture. And that's where AI and machine learning.

Techniques can play a really, really powerful role. So a big part of your role is also working with a lot of your partners and clients and figuring out the market needs. So what are you hearing? What's the biggest concern right now?

Yeah, the biggest concern, I think people, you know, and generally speaking, when new buzzwords come out, you know, one of the biggest concerns, at least security-wise is understanding the implications of that buzzword in their environment. So obviously AI and machine learning have been two of the biggest buzzwords in the last few years, certainly older technology, but we are seeing more and more active deployment. You know, a lot of our customers are concerned about some of the automated decision making that comes with that and whether or not you can truly gain the efficiencies you want without creating, you know, some catastrophic ripple effects when you don't understand the full cycle. And of course we're seeing a lot of customers ask us about things like blockchain, for example, in the context of cryptocurrencies and beyond. And again, part of what they're thinking about is not just how do I look at this technology in isolation, it's how do I bring this technology into my environment, but in a safe and sane fashion where I don't introduce new.

Risks that I'm not fully aware of and haven't fully created compensating controls around. Blockchain, since you mentioned it, has sort of been touted as a panacea to a lot of problems in protecting digital identity. I can say as a reporter, with given all the Cambridge Analytica issues, I've received tons of pitches from startups saying, hey, like our startup is gonna be doing social network on the blockchain, and we would have stopped something like Cambridge Analytica from happening.

What's the real story? So, you know, I think blockchain has taken over AI as the magical pixie dust of the future that's gonna solve every problem. You know, we say AI will, you know, address, you know, world hunger and solve for world peace and save the whales and, you know, cure cancer. I think the same thing is now being said of blockchain. My perspective is that blockchain was really created for enabling digital currencies, what we now call cryptocurrencies, although I hate the word crypto currencies because crypto is now this new concept which has been around for decades in terms of security and we're seeing this other community overtake the term that we've used for a long time. So that's got me as a personal rant. So set the record straight, crypto does not mean currencies, it really means... Like they stole your name, you know? It's MIT's name. We invented half of this field, so please. But kind of going a step further, when you look at some of the properties that matter in the context of digital currencies, you may need distribution. You want maybe some level of privacy. You may want what we call immutability, where you can create a transaction and have it live on forever, where someone can always look at that record. And the interesting thing is that I'm not really aware of any other applications that really leverage or need all those same exact properties. In fact, if you look at something as simple as distribution, right? Distributed systems are highly decentralized systems. We often don't want true decentralization. For example, today, you know, I buy a book online. Two things I want. I want to make sure the transaction goes through quickly so I'm not sitting there for four days before the transaction's through. And number two, if the book doesn't get to me, I want to be able to call somebody up or send an email to support to make sure something happens. We want, in many cases, centralization in our lives because it facilitates many, many aspects of what we do. And so when you start to remove the need for decentralization, all of a sudden you don't need blockchain anymore. You can actually address many of those problems with much simpler mechanisms. For example, a database probably solves 90% of the applications or addresses. 90% of the applications where people are talking about using blockchain. Or digital signatures, which have been around for now over 40 years, can also be used to address many of those same kinds of problems. And so where I get concerned is I think, yes, maybe you can use blockchain to solve certain problems, but I'd be willing to bet in 99% of those cases, maybe even 100%, you could solve those exact same problems using techniques that have been around for decades with much less complexity. So we're seeing something strange now where normally innovation sort of shows progress. I think what people are calling blockchain now and implementing in many of these companies is probably a step back from.

What even came out in the cryptocurrency realm. I want to ask about the European privacy regulations, GDPR, that are going into effect soon. Is that going to be game changing for protecting user privacy and should we apply those same regulations in our country?

Yeah, I mean, the perception is it's going to really be a fundamental game changer. So what's unique with GDPR is twofold. One is that GDPR is not about the territory the company is in, it's about the person who was impacted. So any data of a European Union citizen falls under the aegis of GDPR. Now, of course, I'm not a lawyer, but that's my understanding of it, which means that even if you are a US-based company with the data of a European Union citizen, you have to worry. And more importantly, even if, for example, some of our customers are in the government, they're like, oh, you know, US government, you know, we deal with US veterans. Why would we care about GDPR? All of our, you know, all of our customers are US veterans. I said, look, a lot of US veterans end up living abroad after they their military service. Many of them are expats who have now European Union citizenship. So all of a sudden, companies that didn't think they were susceptible to it become that way. The second key thing that GDPR has done is impose a substantial fine for companies that fail to meet its regulations. And the fines are anywhere from 4% of their annual revenue to 20 million euros, whichever is higher. And that's a substantial fine for getting things wrong. There's also a third element, which is that the requirements are fairly strong. For example, there's a reporting requirement that requires that you report an incident within 72 hours when it occurs. Now, I told you earlier that most people don't even know for nine months they've been breached. 72 hours is a long way from that. And so a lot of our customers are deeply concerned about their ability to comply and the fines that can result from that complication.

Do you think we should apply that in the US for US citizens?

I think, you know, some form of GDPR is healthier abroad. I think it's going to be applied for major companies in the in the US anyway because even if you're a major organization, you're going to be multinational because you have EU data, which means to some degree you have to comply across the board. I rarely see companies that try to have different compliance policies for different geos. They try to have one umbrella policy for the most part because it's easier to manage one policy than managing 17. So I think we're going to see a situation where regardless of what the regulatory landscape looks like here, people will follow through to a common denominator. and more importantly, a lot of the technology companies like RSA that develop technologies for addressing these problems, we're typically looking to really address the security issue at play here. Compliance to me is an artifact of security. If you get the security posture right, you'll get some degree of compliance or hopefully a full degree of compliance as a byproduct, maybe with some adjustments around that. And so I think it makes sure the vendors are doing the right thing.

Everybody will then tend to benefit from that result. So we have time for one question if there are any takers.

I'm curious about the relationship between, you know, private companies like RSA, academics, and intelligence community for the government. How, what is the relationship as far as advancing technology and research and how has that played out over the years?

Yeah, I mean, there's been, I guess, a set of relationships. I think the challenge to that question, it's a great question, by the way, is that, you know, the federal government is not a monolithic mosaic and there's many different nuances and subtleties in interacting with the federal government. For the most part, we've generally had very positive interactions. And I say for the most part, I'll talk about some of the less positive ones in a moment, in the sense that a lot of the standards that are used in cryptography today were essentially approved by people like the National Institute of Standards and Technology or NIST. They did a really good job of really engaging the private sector and the public sector together with academia to develop the right kinds of standards. A lot of our customers, for example, leverage something called the NIST Cybersecurity Framework as their foundation for their security strategy. That framework, although published by NIST, involved about 4,000 organizations, industry groups, and individuals in the process of developing the document. And I think about, I would say 40 to 50% of RSA's customers used the NIST CSF as their primary vehicle for developing their security strategies. That's been a success case. The other cases have been around some of the regulatory issues with things like encryption. So for example, if you remember the Apple versus the FBI issue that came up a number of months ago, that issue is now reincarnation of an issue that's been coming up over and over again. When you start talking about security technologies, sometimes governments want exceptional access to those technologies and exceptional access to the underlying data. Our philosophy at RSA has been very simple. I don't believe it's possible to make the system weak for one person and keep it secure for everyone else. And so if you were trying to weaken it for the government to access data, you're not gonna succeed in making it strong enough for everyone else. So our philosophy has always been that we would never intentionally weaken a system for one party. And I think that philosophy, I believe most vendors in the security space, especially in the private sector, tend to think that way. But that's been a case where we have, you know, we've put up a fuss on our end. We have created campaigns around providing a point of view for the private sector. And just this past week, we had the RSA conference. We had 50,000 people at the conference who showed up, collected a badge, people from all over the world, including the public sector and private sector. And we host that conference, and we started it actually 27 years ago, and the entire conference could probably fit in a room about half this size. But for that exact problem, which was that we wanted to make sure that all the key actors who were worried about cybersecurity issues were discussing issues together, and trying to move the world forward in a collaborative fashion rather than trying to be antagonistic.

Well, thank you so much for your time. Unfortunately, we only had enough time to sort of touch on the surface level. But again, really interesting conversation. And thank you everyone for sticking around.