E251 The AI Cyber Arms Race: Attackers vs Defenders with Smarttech247's Raluca Saceanu

No matter how advanced cybersecurity gets or AI gets, the fundamentals still apply. They will always apply. So when you're planning for the future, plan with that hygiene and the fundamentals in mind as well. Nowadays we're seeing the scale from initial compromise so that's when they get in to moving throughout the organization in a matter of minutes. Defenders have a bigger advantage because as a defender, you know your environment better than anyone else. We are taking all that manual work that used to take a lot of time. We're building a lot of intelligence around it. We're compressing the time in which we can respond to an incident. And we still have the human in the loop, which is absolutely important. Hello everyone, we are here today in Guinness Enterprise Center. And I'm actually delighted to welcome Raluca Shachane, who is the CEO of Smart Tech 247. Raluca, thank you very much for joining us on the podcast today. Thank you for having me. So we're going to dive straight into us. What has changed in the threat and intelligence landscape in the last, I don't know, 6, 9, 12, 1, 3, last three months? A lot has changed. However, the types of attacks that we see are still the kind of same old attacks. You know, people still exploit the human nature fishing. We still see a lot of SQL injections, remote code executions. But what has changed is the number one, the speed, the scale and the impact that these attacks can have. But also the cost, you know, it's much cheaper nowadays for attackers to run their operations. I mentioned earlier the speed, a few years ago, we would have seen these attacks evolve and be successful within hours, days, even weeks. And nowadays, we're seeing the scale from initial compromise. So that's when they get in to moving throughout the organization in a matter of minutes. You know, under 30 minutes, of course, a lot of the other attacks can be much faster as well. And they can also take their time depending on how targeted the attacks are. So when we look at why this is happening, we like to summarize these under three main forces that drive these kind of attacks. Number one, the geopolitical landscape has an enormous impact over the attacks. A research shows that whenever the geopolitical risk index, we call it, rises, 35%. Or we see a 35% increase in cyber attacks. And when you look at the wars that have been taking place in the last few years, the latest one being the war in Iran, it's a prime example of cyber attacks scaling really fast. And we've seen it here in Ireland as well. Number two, as a force is the systemic dependency that we have. You know, we're dependent on massive supply chains, whether we like it or not. The tools that we use, also use tools, who also use tools. And sometimes we don't even know these tools. We have never even heard of them. So they create a lot of risk concentration that we don't know about. And it puts us in a vulnerable position. And then, of course, the third one is artificial intelligence. AI has significantly changed the infrastructure of organizations these days. And the best way to look at it is, as an organization, you've got your multiple layers of defense. You've got your people, you've got your endpoints, you've got your applications, you've got your networks, and you've got your data that you have to defend. And with AI now being so prevalent, it automatically changes your attack surface because AI touches on all those layers. It has impacted your human layer, your data layer, your application layer. So, like I said, inevitably your attack surface has massively expanded. A question that I think about a lot is, businesses are spending more and more billions. I haven't got the number to hand, but I know it's a lot. But there feels like there's just as many breaches that we're hearing about. And I can only imagine the ones we're not hearing about. Is that because AI is enabled the attacker to be better than the defender using us? Good question. And yes, we keep throwing more money at the problem. And the attacks are only getting bigger, and we only see more and more attacks. So, are the attackers gaining an advantage with AI? I would say as much as an advantage as the defenders are getting, because we're also spending a lot of money on these great tools, and AI tools as well. And it's really about perspective. If you think about the attackers, they don't have procurement cycles, they don't have risk committees, they have a lot of money, and they can just move a lot faster than legitimate organizations can move. So, we don't really have a capability gap, we have a lag. So, they move a little bit faster, but so can defenders, especially nowadays, we see it in the news, and you can't really say that we didn't know these types of attacks were happening. So, we have to also invest significant resources. I would say, and this is not a popular opinion, that defenders have a bigger advantage, because as a defender, you know your environment better than anyone else. You know where the gaps are, you know where you need to deploy the telemetry or where you've deployed telemetry throughout your organization. So, you can get an advantage, and you can use the same weapons that they can use. So, if the weapons are equal, then what do you need to look at? You need to look at the outcome. The outcome has to be significantly different. The difference comes in how you deploy the resources that you have at hand. So, as a defender, you need to think like an attacker. You need to use your creativity and your resources to understand where are my gaps? How can I plug them? Because again, you do have the advantage. The problem is a lot of organizations make quite a few mistakes, and they think, you know, this is never going to happen to us. And they also overestimate the cost that it takes in order to plug those gaps. Because you always feel like it's never going to happen to you. It happens to order people, those are people that are unlucky. But then when it does happen to you, I think you just change, don't you? You just have a, it's just a moment where how do you try to explain to that leader that this is worth doing when they kind of feel like that's someone else's issue that will happen to them? Is that still happening? It does happen. It's a big mistake that a lot of organizations do, and I would call it expensive ignorance because it can happen to absolutely anyone. Whether you are a small company or a big company, you still have data that you're protecting. You have processes. And then in more scenarios, you've got manufacturing processes that you have to protect. And you would be surprised how many times we get these smaller organizations in Ireland or in the UK calling us saying that they've been hit with ransomware and they don't know what to do. And they can't believe that it has happened to them because they're not big. But actually, they've got manufacturing processes. So just, you know, a few weeks ago, we came across an organization that was manufacturing glass. And they were maybe 50 to 70 people. So they thought we're too small. Nothing is going to happen. Then it happened and operations were completely stopped. And the problem is they are in the supply chain of someone bigger. So they're going to get pressure from that client to keep operations going. And if you're in the supply chain of a larger organization or if you process sensitive data, even if you're not a big organization, it can and it probably will happen to you. You cannot take that for granted. So that's one of the mistakes that we seek quite a lot. It blows my mind that only 5% of our listeners actually subscribe to the podcast. We've got one favorite ask. Please can you subscribe to the podcast? If you like our content, you subscribe, we will make a huge difference to the guests that we can get on the show. It also will be a voice for AI applied across Ireland, but doing it the right way. Now back to the show. Your team I was thinking is, everybody is starting off a business now. You don't have to have a toilet. technical background, you just have to have a problem statement and you've got CloudCode or something similar to go on the journey to doing this. What are some of the mistakes or things leaders aren't taking into consideration on cybersecurity when they're starting those new product ventures or whatever it might be? With the pace of AI and how generally fast technology is moving, we see a lot of start-ups which is great. We need more innovation, especially here in Ireland, we see a lot of this innovation. And a lot of the innovation is also developing software and this is one particular risk area where we've seen a lot of the attackers take advantage of. When you're developing software, you have so many things to worry about, primarily developing good products that people will buy and like. But in that process, you also have a lot of code that you're developing, you have a lot of things that you need to worry about, you have developers that may not be or may not know how to secure that life cycle of developing product. You have a lot of data that you're processing, especially if you're using AI. So you have a lot of layers that you need to think about, that you need to secure. And in quite a lot of the cases, unfortunately, we see so many gaps and we see so many steps that haven't been followed correctly from a cybersecurity perspective. And it's really important to adapt that secure development life cycle mindset from the get-go security by design is a really important principle that we always recommend founders and CEOs to think about from the get-go, especially if you're using AI, especially if you're using a lot of data to develop your systems. When you're not coming from that background, it's not necessarily your thinking about because you're just thinking you can start scaling, it's not going to happen to myself or maybe the security's built in, but then you're dealing with order customers' data. And then it's not just your own data, you have to be start to think about all the different parts and then even like the earlier example, if you're part of an important supply chain. And your security is only as x level versus the organization you're engaged with and they want y level and as a gap fund, it's easier to go after the third party for an ability rather than the big company, right? Prospective is really important, it's how you look at the potential problem and a lot of organizations, especially smaller organizations, they tend to underestimate the risk and you have to plan ahead. And I always say this, if you're a CEO, the way you're able to read a PADL statement, you have to be able to read a cybersecurity statement as well and understand your posture and think two years ahead, five years ahead, ten years ahead. Are we going to become a billion dollar software company? Okay, then what does it take to reach that point? What are the key elements to get there? And it's not just having a great product, of course, that's absolutely important. But what makes a great product, what are the foundations that go behind the great product? And cybersecurity then inevitably becomes part of that concept or that conceptual thinking and doing it from the get go without planning ahead is so, so critical. It's a good point because from a lot of companies, they're just totally not going to get true to this quarter, right? And then, but then you want to actually be thinking a year, three years, five years down the line, what type of things do organizations need to start to think about? To build that foundation for the future? Well, when you think about the advancement of AI and cybersecurity, one has to assume that these tools that we're seeing nowadays will only get better from both sides, right? And they will become commoditized, attacks are going to become faster and we are not going to have time to worry about manual things or risk that isn't immediately evident. We need to start planning ahead and we need to start using these technologies. And it all, what's really important is looking at the trends ahead as well and understanding that the fundamentals are still quite key, you know, no matter how advanced cybersecurity gets or AI gets, the fundamentals still apply, they will always apply. And I know that we're going to leverage AI a lot and technologies are really important, but the humans are still quite important. So we need a human and a loop, we need a critical thinking still. We need to leverage technology to, you know, make our life easier, but we need to still be at the wheel. And if you think about internally and smart tech, how are you using AI yourself within your cyber systems and what sort of value your customers are getting from that? We use AI quite a lot from both perspectives, number one, we use it internally to make our operations more efficient. And we use it as part of our products and capabilities as well. So just last week we launched our agentic soccer capability with Microsoft, which is really exciting for us because we've basically packaged everything that we've learned in the last 15 years from a cyber security perspective, from a, from a blue team perspective, right? So the defenders, we've built an enormous library of use cases over the years, detection rules, engineering capabilities, service delivery capabilities, absolutely everything that we've, we've now packaged into this agentic soccer capability that our customers can leverage from us. So what that means is that we are taking all that manual work that used to take a lot of time. We're compressing the, the time in which we can respond to an incident and we still have the human in the loop, which is absolutely important. So our customers can benefit from essentially better and faster security operations. So how does that work? Is that just a connector that an organization can, can connect in more around the system? What does that look like? Well we have our own platform called VisionX. So VisionX is our managed detection and response platform, which essentially sits on top of other security technologies that we've spoken about earlier on, you know, all these technologies that organizations invest in, and it allows our customers to get even more visibility into their security operations. So that technology that we've built, you know, it's our proprietary technology now has even more capabilities for AI, to leverage AI and leverage agentic AI as well. And automation in the form of a SOAR, to take all these, what I mentioned earlier, use cases, detection rules, knowledge essentially, and experience, to package it up, connect it to our customers environment, and then they are able to leverage the, you know, the faster incident response, the capabilities. And it's not using, you know, at the moment it's available for Microsoft. It's not using co-pilot. So we're using our own AI, our own capabilities and SOAR to deliver that to our customers. So it connects to their Microsoft environment. So you're taking all those learnings, you've embedded a proprietary and then getting access to us. Exactly. And okay, and use AI to facilitate us. You're still leveraging the capabilities that smart tech have to offer and they've always offered, it's now better and faster. How has your experience been working with Enterprise Ireland over the years? Have you had much collaboration with them? We've had a lot of collaboration, you know, earlier on I mentioned about all of these fantastic startups and the innovation that happens in Ireland and I think in the Enterprise Ireland are key to that. And we've been working with them for the last 13 years, back when we were much smaller company and they've been supporting us throughout the process and they continue to support us. So the collaboration has been great. How do you step to speed where everything is moving so quickly? Well, that's the million dollar question, right? You have to know where the technology is going. You have to be in a position to move fast as well. So innovation is absolutely key for us as a company. And it's very easy to kind of fall behind when things are moving so fast. So you also have to move so fast. You need to know where the trends are going, where the technology is moving, and you have to try a lot of different things in a very, very fast way. But it's also quite fun. Yeah, it is. It is. This is sacrificed though, even at the weekend, I was getting up early just to figure out these different tools and systems and try to solve problems with them and you just want to get it over the line. But then it's eating into hours. You just literally wake up and say, "Whoa, and you've just solved it and then something different. Change to you. I suppose you have to have an appetite for that." You do, but you also have to have a great team because it's not just you, and it's a mindset that you all have to share. In our team, across the world, and we've got teams in Romania, Poland, Ireland, of course, and the UK, very diverse teams as well. They share that mindset that we have to move fast, we have to innovate. And they also share that curiosity. And then when we all have that mindset and we get together and we do these amazing things, this innovation, it becomes quite cool in a way, you know, quite interesting that we all get to head in the same direction, we get to innovate and we get to solve these amazing customers all over the world. Yeah, I think Carol Tweck is some of the best. It's kind of a growth mindset, and pushing for that. That's a book that I have on my, I always keep 10 copies with me in my office and I like to give new employees because it's a great book, and the great philosophy. It's wonderful, but if you want to just watch the TED Talk on it, it really, really goes like 10 minutes or so, it's fantastic. Raluca Sichano, CEO of Smart Tech 2 for 7, thanks for joining us on the podcast today. Thanks for having me. LAIR Island, we're helping over a million people become literate using artificial intelligence. And we do this in a variety different way. The easiest way is our AI literacy program where we do a 60 to 90-minute program via virtual Zoom or Microsoft Teams where we teach the rules of the role of AI from basic business concepts to ethical and resourceful decisions on how you actually use AI every day. This is our literacy foundation. The second way we use AI training is within our workshops. These are in a virtual or in-person workshops where executive leaders come and use some of the AI tools that we make available for them that they can actually start to take their own documents and re-imagine savings of time and energy but take away friction from the work that they do each day. Later on, we actually empower different departments, HR, finance, sales, marketing, operations, and start to utilize AI across relevant use cases to upskill their different types of departments. If you're interested and ready to go on your AI journey, you'll be able to showcase over 700 applications of applied AI but how you can actually stop re-eventing the wheel and start using AI fuel organization today. If you want to start out, I'm going to find a little bit about the golden thread of activities that we've got to allow you to start to utilize AI straight away. Please feel free to reach out to us and I'll give you a good couple of heads of overview about the arts that are possible, minus the hype, purely applied. See you there.