Nikesh Arora

Seriously - the only attraction for me to do this, is the ability for me to be able to say it in my words, when I want, and how I want. Yes, I will make sure to the best of my ability to follow rules re: public company fiduciaries and dissemination of information. But the idea that someone else crafts your communication and tweets for you - is not better than giving an interview to a publication and worry that the journalist will cherry pick to validate their narrative. Control the narrative and the consequences by doing it yourself.

What people don't know is that - frontier LLMs are not "defending customers”, they are exposing vulnerabilities - defense means - no false positives, comprehensive coverage, and a cost efficient solution. Any defense involves, sensors, inline inspection and enforcment, this can only come with a collaborative approach.

It's time for frontier LLMs to take a responsible approach to Cyber. I have been watching them consistently tout their abilities on finding vulnerabilities and daisy chaining them to be able to attack enterprises. I have also recently learnt about their efforts to create synthetic data to enhance their capabilities. I am all for it. But don't use this as a tactic to require each enterprise to scan for vulnerabilities again.

The narrative needs to change - we already know that we are in a cycle where all enterprises need to remediate their vulnerabilities. It is important to understand:

1. Vulnerability discovery is existential, because bad actors will - patching it is even more so. Expending efforts at more vulnerability discovery needs to be balanced with a solve.
2. LLMs are capable of recommending patches, but before a patch is developed, and deployed, it needs to be tested in its environment to ensure continued functioning of the application, and even now the solve has high false positives. No enterprise can do it all at speed.
3. Despite their enhanced capability, there is still significant difference in what vulnerabiities are found across all their Frontier LLM's, so customers will need to test across a multi-model harness. One LLM isn't the solution.
4. Most organizations do not have capacity to patch at the speed needed, especially the smaller ones.
5. We don't talk about operational technology enough, most critical infrastructure relies on OT and we need a solve for them in addition to Open Source.

The most obvious solution is virtual patching. This is a time tested technology that is currently available with cyber vendors for endpoints, WAF, cloud, network use cases. It also is not comprehensive enough currently, we need to scale this fast. We need a vulnerability clearing house and fast signature development for all these vulnerabilites to respond at speed across our industry.

Attacks will accelerate from here on - We are there: Six months ago I said Mythos like capability will be widely available. It's happening. A critical vulnerability, a social engineering attack that looks innocuous, or daisy chaining publicly available vulnerabilities and conducting a sniper strike is all being witnessed in the wild. Incident responders have never been busier.

Some key points:
- attacks are not becoming more sophisticated, it's the same attacks, faster and by a lot more people.
- attack path discovery which took trial and error and multiple attempts is now trivial, open source LLMs are here to help
- you are as secure as your supply chain, insecure down or upstream players who have access to your infrastructure could be the next attack path, marketplaces and supply chain is an easier vector

The increase in activity is a result of more people becoming better at hacking due to the ease of being able to attack. Had not contemplated that in my calculus.

Please:
1. Test your infrastructure for accessible vulnerabilities and misconfigurations
2. Fix your code and demand your vendors do.
3. Old infra, or insecure infra at the perimeter needs to be updated first
4. New AI tools, especially coding need a security framework. Your developers will do more with code, new skills, and more automation. Don't forget the coding models have trained on human code.

Stay safe this Halloween :)

It seems @altcap is on campus at the same time speaking. Maybe we should do it together :)!!

That chicken puff is not to be messed with.