Keynote Cloudflare : Stratégies pour un avenir Internet défini par l'IA générative

Sam, Vuzette, pata, pascuja. Bravo, Technology. Thank you.

Merci, Marie.

Bonjour tous.

Bonjour les assis. Good morning, everyone. So we're going to switch in English, even though Michel is able to understand very well the French and sometimes a little bit shy to speak French. And when we are preparing this keynote, I was wondering, what is the common pattern of Carrefour and Cloudflare? And then as we were thinking of it, I think really the common pattern of Carrefour and Cloudflare is really innovation. Innovation defines what we are doing at Cloudflare. And after having worked with Carrefour for now more than one year, two years, maybe.

One year, yeah, one year.

I really discovered that Carrefour is really very advanced in terms of innovation. And before we go and dive into AI and generative AI, I would like maybe to quickly introduce yourself, Michel and Guillaume.

Sure. Good morning, everyone. It's c' est mais foi. C' est c' est a monoco. So very happy to be here. I'm Michelle Zatlin. I'm the president of Cloudflare and we started about 13 years ago. We help organizations around the world with their cybersecurity connectivity and build needs. And so it's a real pleasure to be here and I'm having a great time. So thanks for the warm welcome.

Hello everyone. I'm guillaume. I'm the SecOps manager at Carrefour and I have the responsibility of the server security tool for. And at least I am the guy that every team IT team in Carrefour call when they have a new technology to deploy and to say what we can do with it.

AI is changing the world, as Maria shared during the introduction. But before we go into the impact of how this is impacting cybersecurity, I'm curious to understand more how AI is changing your business and companies in general that we are seeing. Maybe Guillaume, you can share your view on that?

Yeah, careful of always a customer in the mindset. Then the first AI program we deploy is a program for customer to prepare the basket list on the E commerce website. For example, you can say, I want to prepare a sliced lemon chicken for the dinner and you will prepare all the items for the baker sleep. You can say it's easy, it's not a problem. But after that you can go deeper. You can say we are six. Then it will change the quantity and the hai will not display all the items that everyone has in the fridge or in the kitchen. Some salt, pepper or butter. But butter is not the Right position. Because if in your preparation you need enough butter, many butter, the AI will say, okay, have you got enough butter in your fridge or should I have to add some butter in the cart list? This is the way we are working on. And after that you can say, oh, I'm sorry but I want only organic items that you would change the list. You can say, I want not more €20 for the dinner. And you would change the list to adjust the price, everything like that. And the second part we display, we change an AI for the supply chain to optimize the supply chain, to organize a new supply chain, to change how we are going to display the data in each data warehouse. We are going to move the food in data warehouse. It is the second one and we are not customer. We are even employees at Carrefour. And since yesterday we deploy new things, new AI just for the human resources. And to answer all the common question amp Fourier can have on human resources, where I can, I can make what is the good things to put some vacation where I can find the document because I'm going to have a baby. Everything you need, this is all the changing are going in Carrefour for the customer.

Those are great examples. I'm also hungry after hearing about your chicken example. So anyhow, so at Cloudflare we're also doing a lot with AI. And so in my opinion, AI, the invention of electricity, the invention of the Internet, the introduction of AI, that's how big of a deal AI is. Which is why organizations, you read about it all the time, organizations are trying experimenting it and it's so early. So maybe I can share two ways that cloudflare is using AI that might be helpful to the audience. So the first is actually cybersecurity protection is a really good use case for AI. So we use a lot of AI in our cybersecurity products to help protect our customers. We crowdsource a lot of the threat data around the world and then we use AI to predict the zero day vulnerabilities. And it works really, really well. Yesterday we stopped 140 billion cyber attacks on behalf of our customers. And it's using things like machine learning and AI that allow us to do that. So it's really, really effective. And so I think it's really important to be thinking about how can you build AI into your products. You know, Kafool is food. Think about it in your own businesses, how you can build it in. The second part, which I'm really excited about is we know AI is going to be so Important to every organization. And everyone's trying to figure out what's it going to look like, how can we improve the customer experience, how do you make your own operations better? But improving your customers experience, we want to help enable that. And so cloudflare, we run a global network and within the global network we've put GPUs at the edge of the network. And what that allows is organizations to run the inference, not the data models, but the inference of those models closer to where people are asking the questions. You could imagine if you are an Internet of things company where you have devices out in the wild, where you can now use the edge of the network to do the inference for AI questions. So we're really excited about that, building the foundation for that. It's very early, this is a couple of weeks old and so I'm not sure what people are going to build with it yet. But I can't wait to hopefully come back next year and share some of the exact use cases.

That's fascinating really. Getting more into the generative AI topic and as generative AI is getting more and more adopted, what are the risk vulnerabilities and what would be your advice to the CISOs here in terms of this adoption of generative AI?

The first point is to work, AI need to be fed by data. You need more and more data, enough data, too much data to make the AI working well then if you want to have something relevant, you need the right data. But for the security purpose you have to take if the data is really relevant for all the use case you are going to have, then you have to control the data. You have to say exactly what is going to be put to train the AI model and is it relevant for the use case or not? Is it interesting for the use case or not? This is the first one. And the second point is in retail we got many, many, many customer data. We've got name, we've got address, we've got email, we've got telephone number and we got shopping list. The frequency you are in store, the frequency you buy something. We've got many, many, many things and we have to be compliant with the law, with GDPR for example. And you have to be very, very close about that, very, very attention about that. Is it okay or not with gdpr? Is it particular for the GPU or not? What you do exactly? Is it in the contract and the consentment of the user or not? Even if you trained the data?

You know, I travel around the world, it's actually the fifth country I've been to this year, meeting with companies around the world, and it's interesting when the topic of AI comes up, there are some organizations like Carrefour that are really leaning in and innovative and experimenting and using in a lot of different ways. And I would say that you are, like, way ahead of the curve. They're using it, they've thought through a lot of the data side of it. There are other organizations that aren't sure where to start because they're scared about a lot of the risk, because there are real risks. Right. I think one of the good mental models is once you put the data into the AI model, you can't get it back, you can't extract it back out of the model. And that's really scary. If you run an organization with sensitive information, and every organization has some sensitive information, it's almost like you decide not to move forward because you're worried about the downside. So I think what Guillaume said is really important is making sure that you have some sort of process of, you know, how the data is getting in so that you feel comfortable so you can get the upside, you can get the innovation and the productivity gains which every organization needs, without the risk of making sure that none of your sensitive data goes in. And, you know, if you start to think about that, it's just like data loss prevention, but a new use case for dlp. And, you know, it's interesting, at cloudflare, we build this connectivity cloud, and that's one of the services we offer, is this ability for organizations to say, hey, I want a way to make sure that none of my sensitive data is going in. It's a kind of another use case for dlp. And at Clever, we have that and we have customers using that. And so I think if that's something that you're worried about, I think find a solution, either a proprietary solution that you build in house around a process, or find a technology solution to help you so that you can get the advantage of all the positive upside. The second thing I'll just say is I do think that it's changing really, really rapidly and not everything is going to work. And that's okay. I think that the goal is not for every single thing that your organization does with AI to be successful. That's impossible. That's not how innovation works. You, you're gonna try 10 things, and maybe a couple things are really, really good. And some things you're like, well, that's not worth it. And so I think having a way to evaluate what's going well. And not going well is important too, because just starting something is really important, but also saying, hey, that's not working, let's stop it and then use those resources and time to do something else.

That's really interesting. I was reading that 42% of employees have already used AI. And out of that 2/3 have not informed their manager or directors. And I'm part of those, by the way.

We'll talk after this.

Yeah, but that could be also an acceleration for zero trust adoption in terms of controlling AV success. And generative AI is part of one of the big transformation, as both of you are the other at the heart of innovation in both companies. What other trends or transformation do you see on the market as you are talking to customers and in your organization? Guillaume.

From my side, for CAFO's side, there is no really impact of the cyber security is working. We are going to control the background of the other AI, the hardware all the time. It's exactly the same as the other. We are going to control the operating system. And the new change is the model. What we do with the model, what is the impact if someone take control of the model? For example, in the supply chain we are in July and the model say you have to buy turnout umbrella. Is it relevant or not? And is it normal or not for humans, it's okay, it's not relevant. There is a problem. But what if the change is very slow, is very not detected? What happens really in the system? What is the impact for the company? For example, we monitor everything in Carrefour also AI, what is the request? What is the answer? And we check if there is some drift or they have some mistake. For example, last week, it's a real fact, last week we detect that in the customer AI. When you can ask him where is the nearest store from me? Right now there is a change before the list of store is displayed. If it's a hypermarket or supermarket and it's mixed, no problem. But since two weeks hypermarket was always first and supermarket was in the bottom. And this is a change. And what does that mean? What is it? For the fun fact. I know you love when you say fun fact, Boris. For the fun fact is because the file that is put inside the AI every day to refresh this data have changed the format. On the first format, there is all the data alphabetically ordered and no distinguish for supermarket or hypermarket. And the last file there is hypermatter top and supermarket at the bottom. Then this sample change change everything for us. And the other part we speak about data is there is a way to put some data and say to the AI, okay, this data is confidential, then you don't have to display this data in detail. You don't have to do it. You can't do it. It's not possible for you to display the detailed data of the raw data. But there is a prompt, there is a question, I don't know, I don't know where, but there is one question that the AI will say, I display the data for you. You have to keep that in mind, in your mind when you set up AI model. This is very important, but this is the way that change the relationship with some input with the cyber security for us.

So interesting. Those are such good examples because they're so simple. You think you said, oh, of course, that file changes, of course. But these are the sorts of real life things that teams have to kind of keep an eye on right now.

Exactly.

Yes. Yeah. Maybe, maybe zooming out a little bit about some other trends. I think there are a lot of trends right now, which actually makes all of our jobs a lot harder because there's just some big shifts going on and it's hard to know what's going to stay and what's going to change. Maybe a couple to add that might be interesting. On the cybersecurity front, you know, new vulnerabilities continue to be really top of mind. And again, I don't need to tell this room, but even earlier this week there was this large vulnerability in the HTTP 2 protocol. And these are big, scary, gnarly situations for companies. And you know, this, there is this vulnerability that was exposed that broke all previous records of DDoS attacks in terms of size by more than three times. That's really scary. It was something like Google and Amazon and actually Cloudflare also came to the market to help tell more about this vulnerability. But three times the size, you just think about your organization, could I handle three times the size? Maybe not. Like that's a big, big, big shift. And so I think we have to stay vigilant and continue to work together. And so we see attacks getting larger and that's scary if you're an organization. The good news, I think the technology is a lot better today and so make sure that you have good layer 7 and layer 3 and 4 protection because several vendors on the market can help protect you, including ones like Cloudflare. So that's on the cybersecurity front more broadly, there's a huge convergence between networking teams, security teams and IT teams. And it's interesting. Ten years ago, those were pretty siloed organizations that can make decisions that they had a lot of control over. But today you're making a new decision. It's hard to make a decision without getting input from the network if you're in the security team, without getting input from your networking counterparts and your IT counterparts. And in some organizations, those teams work really well together. So it's quite collaborative. And it's exciting because you learn, you get to know each other better. In other organizations, it's harder. Maybe they don't know each other or it's not okay to go talk or to recommend a solution. And they say, well, I didn't recommend it, so I'm not going to approve it. And it becomes a little bit of a stalemate. And so this convergence of networking, having security built in and so the security teams having to talk to networking, and now zero trust, which is definitely an IT situation, but needs security input, all of a sudden, the lines that used to be pretty clear are becoming much more blurred. And so I see that across many organizations. And I think if I just kind of. If you do a bell curve, there's some organizations that are faring really well with that, and there's others who are having a hard time. And I worry a little bit about the ones who are not making decisions to modernize their enterprises because of internal organizational processes and how organizational structures. So I think that that's an important trend that I see right now, and I'm curious to see how the next three years work out for that.

So we're talking about consolidation. Do you see Guillaume as well, consolidation in your solution, in the organization within Carrefour as well, network security and IT in general?

Of course. Of course. When we start working with Codefair, the goal was to reduce the number of tools we have and to not chain all the tools, but have only one tool and to say everyone, every team that is involved in this process have the same tools and the same dashboarding and the same metrics, and everything is unified and everything is talking about the same thing. That is the main goal when we start working with Cloudflare.

Guillaume has a concept of six in one that he shared a couple of weeks ago. So if you are curious about that, come and talk to him. This is very interesting and fascinating. So transformation comes with obstacles and people who are not always embracing transformation. What would be your advice to the CISOs here in terms of dealing with obstacles, helping convince their boards on making this transformation and not waiting to transform what would be Your advice both of you.

There is. There is not this problem in Carrefour. For Carrefour there is no problem. We have a board we are size that always want to go faster and to go in the technology and go in front of everything. We have the quarter time in advance, like we say yesterday all the time. Then we want to be a first, we want to be in the move. There is no problem with that. But we have to do something with that. Not for regulate, but to have the control that are there. And we made a rule set in Carrefour with a security team. We made a rule set in three points. The first point is what you say. AI is used by employee, even if they have accordance with management or not. And we say okay, EI is authorized. You can use EI in Carrefour, no problem. But. And there is a but in each rules. But public AI without any sensitive data. And if you don't know if it's sensitive data, maybe it is and come to us. We will. We will check. This is the first one. The second rules is if you need sensitive data it's okay, but always a bit. You go back with a private model and a private ar. Okay, no sensitive data in private er. And the second but in this one and no auto learning model with his sensitive data, we don't want you put some data for a request and another people have this data for his answer. We don't want to share this kind of data. This is the second one and the third rule here. If you have sensitive data, you put on a private model. If you need a autolearn model, it's okay, but always but you have to do. A few people are authorized to use this model and this use case. And all the people that are involved to use this model need to have the same level of agreement of the data that is shared in the model. And with these three rules we can cover mostly all the use case in Carrefour. And this is the rule we are deploying right now. And this is all we manage the solution with the board, with all the team. And that's why everyone come to me or to my team to say we are going to deploy this. Is it relevant? Is it in the right tool set or is it okay or not? Or we are going to do it.

I feel like many of your colleagues are going to come find you guem after and find out how you're able to do this so well at KEF pool. Because I know that's not the same for every organization where I was with A customer recently, and it was their chief security officer. And we were talking about a lot of opportunities and modernization. And I said something about your boss and he said, okay, it was a railroad company. He said, my boss is the cio and he knows nothing about technology. He only knows about railroads. He's been in the industry for 35 years and he only knows about railroads. And our CEO even knows less about technology. In fact, every time I come up with, every time I use the word transformation or modernization, they don't listen to me. Instead, they hire a consultant to make the recommendation and then they go with what the consultant says. And so I think that these are the tale of that. I mean, that's a real life example that just happened a couple months ago. And so I'm sure some of your organizations are in, are in that. And you have to find a way to navigate how you bring in the new tech, the new modernization, and explain why it's important. I think in those cases it's really helpful if you talk about risk, because C level executives and boards care about managing risk in an organization. It's their number one. And they probably don't care about the coolest and then being innovative, but they do want to manage their risk. And so putting in the context of right now we have a cybersecurity risk because we're using services that were maybe right 10 years ago, but no longer current in the shifting threat landscape. Okay, that's interesting. Or my supply chain, we need to make it more innovative of how we, how we're managing the supply chain. And there's many examples around this where it becomes down to enterprise risk. And I think that that is a really effective way to help perhaps have a conversation with someone who's not interested in innovation even when you are. So it helps bridge the gap.

Very good advice. Thanks. And maybe one final question. The technology innovation is moving so fast. What is your advice to this room on how do you stay up to date with the latest technology, latest innovation?

Guillaume, one word. Run. Run in the right way, but run. Follow the system, follow the model, follow everything you need and be helped by people that know everything. But if you miss the train right now, it will be very, very difficult to go back into the train in the future. It's not an evolution for us, for everyone. It's a revolution. Then we need to have something. We need to be involved in the solution. We need to have information. We need to follow exactly what happened in the future. Because AI will be everywhere in few years. Then if you don't know exactly what happened. If you don't know exactly what is done with AI, it will be very, very difficult for our job to be something, to do something right.

You know, I think I couldn't agree more. Where it's if you just start learning and you start kind of getting even, if you don't know a lot, you read the article, you come to a conversation like this, you're like, oh, I learned a little bit more next time you just kind of keep following. And I actually think that's why conferences like lesys are so important, because it brings people together to be able to talk about what's new, what are you doing, what works, what didn't work. And so I think sharing examples is really helpful. And then coming to conferences like this is super important. And of course you can't always come to beautiful Monaco to the event. And so in between leices, I think there's a lot of resources online of people writing about new current things, whether it's personal blogs, people's LinkedIn accounts. But I do think reading real life examples from operators who are actually trying to practice it is really, really important.

Great. Merci beaucoup. Thank you, Guillaume. Thank you, Michel, if you want to continue the discussion.

Thanks a lot. Thank.

You. Thank you, Michelle. Mercia. Basically, you, you need to be.