Nikesh Arora

Seriously - the only attraction for me to do this, is the ability for me to be able to say it in my words, when I want, and how I want. Yes, I will make sure to the best of my ability to follow rules re: public company fiduciaries and dissemination of information. But the idea that someone else crafts your communication and tweets for you - is not better than giving an interview to a publication and worry that the journalist will cherry pick to validate their narrative. Control the narrative and the consequences by doing it yourself.

That's a good question - firstly it's 3/4 years. I would say 50%, but by then their product vision has been realized or not been executed. In today's market getting a consistent team to work on something for 7-8 years is a blessing. It takes 4-7 years in tech to build a great product, maybe timelines will compress with AI.

open.spotify.com/episode/1eD… @davidsenra thank you for coming over to do this. Was fun.

What people don't know is that - frontier LLMs are not "defending customers”, they are exposing vulnerabilities - defense means - no false positives, comprehensive coverage, and a cost efficient solution. Any defense involves, sensors, inline inspection and enforcment, this can only come with a collaborative approach. It's time for frontier LLMs to take a responsible approach to Cyber. I have been watching them consistently tout their abilities on finding vulnerabilities and daisy chaining them to be able to attack enterprises. I have also recently learnt about their efforts to create synthetic data to enhance their capabilities. I am all for it. But don't use this as a tactic to require each enterprise to scan for vulnerabilities again. The narrative needs to change - we already know that we are in a cycle where all enterprises need to remediate their vulnerabilities. It is important to understand: 1. Vulnerability discovery is existential, because bad actors will - patching it is even more so. Expending efforts at more vulnerability discovery needs to be balanced with a solve. 2. LLMs are capable of recommending patches, but before a patch is developed, and deployed, it needs to be tested in its environment to ensure continued functioning of the application, and even now the solve has high false positives. No enterprise can do it all at speed. 3. Despite their enhanced capability, there is still significant difference in what vulnerabiities are found across all their Frontier LLM's, so customers will need to test across a multi-model harness. One LLM isn't the solution. 4. Most organizations do not have capacity to patch at the speed needed, especially the smaller ones. 5. We don't talk about operational technology enough, most critical infrastructure relies on OT and we need a solve for them in addition to Open Source. The most obvious solution is virtual patching. This is a time tested technology that is currently available with cyber vendors for endpoints, WAF, cloud, network use cases. It also is not comprehensive enough currently, we need to scale this fast. We need a vulnerability clearing house and fast signature development for all these vulnerabilites to respond at speed across our industry.

Attacks will accelerate from here on - We are there: Six months ago I said Mythos like capability will be widely available. It's happening. A critical vulnerability, a social engineering attack that looks innocuous, or daisy chaining publicly available vulnerabilities and conducting a sniper strike is all being witnessed in the wild. Incident responders have never been busier. Some key points: - attacks are not becoming more sophisticated, it's the same attacks, faster and by a lot more people. - attack path discovery which took trial and error and multiple attempts is now trivial, open source LLMs are here to help - you are as secure as your supply chain, insecure down or upstream players who have access to your infrastructure could be the next attack path, marketplaces and supply chain is an easier vector The increase in activity is a result of more people becoming better at hacking due to the ease of being able to attack. Had not contemplated that in my calculus. Please: 1. Test your infrastructure for accessible vulnerabilities and misconfigurations 2. Fix your code and demand your vendors do. 3. Old infra, or insecure infra at the perimeter needs to be updated first 4. New AI tools, especially coding need a security framework. Your developers will do more with code, new skills, and more automation. Don't forget the coding models have trained on human code. Stay safe this Halloween :)

It seems @altcap is on campus at the same time speaking. Maybe we should do it together :)!!

That chicken puff is not to be messed with.

In non cybersecurity news - loving the Eylan brunch menu @CPChefSri

But they don't know that yet :)

It's been an eventful week. Multiple vulnerabilites in Internet facing software, coding repositories, examples of agent behavior that seem concerning and a flurry of security specialists with solutions that can partially solve your problem. There in lies the challenge. Given the state of IT and security infrastructure, no one solution works. Let's break it down: 1/3 1. Vulnerabilites are being found and will continue to be found as models get more capable, the fragmented nature of the effort denies us the opportunity for a comprehensive find and replace option. 2. Even if all vulnerabilities could be found instantly and patches available - we will be reliant on the ability of enterprises to deploy all these changes at speed. It is not clear what the collateral impact of all these patches will/could be to our infrastructure of deployed en masse. We will need a hybrid patch approach. 3. Virtual patching(VP) is needed in conjunction with direct patching but for a comprehensive (VP) solve you have to be lucky enough to have "modern frontier defenders" (Cyber companies that have vaulted infrastructure that can create patches at speed and push content rapidly to protect their customers) you need them for your network traffic, your traffic to applications on the cloud, your WAF, your end point. 4. There will continue to be patches that will need to be deployed directly but virtual patching will take the heavy load off. 2/3 Medium term solve: Unfortunately token economics and current cyber architectures will not allow for defender swarms to contend with an offensive attack launched using agents. (Some x pundits who aren't steeped in cyber should take heed). Yes, theoretically we should aspire to have these agentic swarms defend us when we are under attack, unfortunately an attack is a sniper moment, chained vulnerabilities, cloaked attack followed by swift exfiltration. It's a speed program not a brute force problem. To solve for this, enterprises need to get their SOC architecture right, logs, feeds, cyber products orchestrated via a modern SOAR for swift response. Only then can we deploy agents to detect and remediate. In addition, enterprises need to modernize and dare I say platformize their perimeter stack to ensure consistency. Unfortunately, enterprises still seem to not see the urgency across the board, decisions are stuck, CIO/CISO's have a lot on their plate. While some honestly have bit seen the scale of such a problem before and it's hard convincing the organization that one needs to open the floodgates on modernizing the IT and security infrastructure. So we will continue to see environments being brought down to patch today it's for PHP, tomorrow it will be for the next one. 3/3 AI deployments are the"wild wild west" - LLM capabilities are expanding faster than we can build products to secure them. Sure an agent will jump across guardrails in a research lab, which is a lesson for all of us to deploy agents securely. But there is a lag between the discovery, the availability of that in a public model and the time needed for the cyber industry to build governance or an antidote. And no, dear frontier lab friends, the world cannot just trust you to build the solve. The infrastructure industry in tech builds and the cyber industry secured and provides assurance to the boards and organizations around security and safety. AI security is the new attack surface. CEOs (present company included) want AI adoption, getting the pace of adoption wrong could be the last decision we make, at the same time "deploying it wrong" could have the same consequence. There are billions of dollars being spent on coding, is your coding harness secure? Start there. If agents can jump guardrails, they can hide stuff in code. Validate business outcomes needed, test your user case and ensure agentic deployments are well guard railed. Deploy a second set of eyes to watch your deployments for drift, compliance and verifiability.

Lol. We all want our LLMs to respond faster, to be smarter, to not hallucinate. Agents have just made an appearance on the scene, wait till every app is rewritten on your iPhone and it's interacting with agents. Enterprises are in the first innings of AI adoption, coding is diffusing and promises to continue to grow. As models get smarter, it will open up more applications and use cases - so yes demand is insatiable and it has nothing to do with security. Of course, security will introduce trust to enterprises who want to adopt AI. Have you tried to get your hands on compute? CPU and GPU? It takes 3/4 times the spend to deliver a MW compared to 2 years ago. There send to be no respite for another 24 months at least, hoping compression techniques, advances on technology will relieve some of the pressure and things normalize in due course.

We did that first thing this morning. paloaltonetworks.com/blog/20…

You know it's serious when heads of state get involved.

Let's go :)

Will have to try harder or @michaelpwalrath and I will settle it on the golf course :).

You should read my sequel to the ninja move post. I suggested that the original ninja move could actually backfire if we didn't change our approach as an industry to focus on benefits and instead turn to delivering this technology safely, securely yet still at pace. It is not possible to pace open source even if you got some frontier labs to collaborate switch would continue to define the pace.

Free wisdom for those of you opining on my last tweet. It's easy to cast individuals away because you disagree with something they did or their opinions. When I turned 40, I turned a corner and decided to appreciate the good in someone for their act, for the moment and for what they did. My friends are my friends and I respect many people for their achievements in various fields, but I wouldn't have them work on stuff In other areas. An absolutist bar on each human is a recipe for failure. I expect things from people, but I don't expect them to be perfect. If their heart is in the right place, and their intent on the matter at hand is well placed, I respect the effort.

Thank you @agarfinks and @FortuneMagazine for featuring us @PaloAltoNtwks

The meeting at the WH on SI was an epic moment. The good and the great of AI (SI) showed up from all over, I was just happy to be in the room. First and foremost I felt that @realDonaldTrump showed us what a true leader is. He was thoughtful and focussed on ensuring that SI was developed at pace and was going to be deployed safely and securely. He encouraged the room to focus on the positive impacts of technology, demonstrate the true benefits of the technology for each and every one out there. His message was clear - engage with communities get grassroots support for what is going to be a pivotal moment for America and the world. He was statesmanlike and clearly focussed on the US winning the SI race. The focus needs to be how to ensure what is being built is safe and useful. There are enough laws and regulatory frameworks that allow for effective governance we don't need more. What we need is: 1. Accountability by the labs 2. we need SI to have the right APIs available for cybercontrols and third party governance and 3. We need equal focus on diffusion of this technology in a useful and effective manner. We all walked away with continued and renewed enthusiasm to bring on the SI future. When you get cyber companies focussing on furthering a technology you have already moved the needle.