Transcript
You will not be able to take what was designed for general consumption and try to solve your business problems. This is not a technology problem that you're solving. You're solving a business problem with the technology. Technology shouldn't matter. Today my guest is my good friend Alex Atamalil, Global CISO of Under Armour. We're going to be discussing what it takes to secure technology across a global consumer business. Technology being the leader in an AI deployed case for the business is probably something that we need to tweak and change. The business takes a front lead because they own the process, they understand the process, they know where the process could be improved, where it could go fast. They are the better consultant to deliver on that versus technology trying to deliver on something. You're not going to be able to go to Claude or Chajipiti and say, I want you to automate my identity life cycle management process, right? Eventually what we will see is this micro LLM that will start looking at one problem and continue to evolve and effectively mitigate the process inefficiencies. I'm Ash Hunt. Welcome to The Watchtower. Alex, my friend, it's brilliant to be having another conversation with you. Thanks so much for joining. You got it, my friend. It's been great and thanks for having me. It's great to see you again. No, this is going to be a great discussion. And I guess just for like our listeners, maybe we kind of always do this. And I think particularly with such a famous renowned brand as Under Armour, maybe just tell us a bit about yourself, your journey, how you became into running security at Under Armour and some of what you're doing with the program there. Yeah, wonderful. That's a great question. Cyber has been my passion for a while and Under Armour gave me the opportunity to become the leader there to kind of run security a while back, right? So we were building security for the Under Armour team a little while back. And then over time, I was able to be part of the larger team, learn the business, understand what it takes to security for a large organization like Under Armour. And then I finally applied and got the role as the CISO here at Under Armour. Yeah, amazing. And I know we've, particularly in my past role as a CISO, we've had lots of discussions about the kind of target operating model debates across industry. And actually, I've had a few conversations on the show before with other retail CISOs. Maybe tell us a bit about the kind of program that you're running there, a bit about how you guys are approaching security. I know you and I have discussed loads of things like secure by default, these kind of design concepts around how we think security should be sort of built into the DNA of the business. And I would love to just kind of get your views on what you're running there. Yeah. So with the new revolution with AI that's happening, right, there's two areas that cyber is very much focused on, or the security team and the infrastructure team is very much focused on. One is how do we deploy business enabling AI capability that would enable and move the business forward, right? That is a must have, and those are capabilities that we need to deploy and secure, right? That is a very evolving and changing environment. So not only are we not just looking at a solution and just procuring it or looking at a solution and buying it, everybody's in flux and we are trying to figure out what is right solution that fits the needs of the business, right? So that's one. The second piece is, of course, with capabilities that's out there today, you do have a scale in attacks that we are seeing as well, right? So if you were to think about the traditional phishing attacks that we used to get and we used to train folks on, hey, this is how you detect one. These are the things that you can easily say to understand what that phishing looks like, et cetera. Those days are done and gone, right? So now emails are coming that are super targeted, has a lot of context around it. It is super believable. So we have to unlearn some of the things that we have trained our users to look at and detect some of this stuff and changing that into a new methodologies, right? And also we need to defend that scale as well, right? So these attacks are not coming anymore. These are coming at scale and capabilities need to be deployed that would detect and defend against some of this stuff as well. So two aspects, one is protecting the business enabling AI solutions at the same time, defending the organization against attacks that are AI enabled. Yeah. And we're going to get onto talking about AI in a second because we have to. I think it's a mandatory part of every conversation now, but actually I think we've got some interesting views on this, right? But you touched on something there, which I think I just want to touch on because I probably haven't heard it put that succinctly, but I think it's a really important lesson for the industry, which is we are actually going to have to help enterprises unlearn so much of what we've been preaching and teaching them for the last decade or two. And I don't think we talk about that at all. And I actually, and this is maybe being a bit edgy, but I actually don't think we have as much humility as we need to, to actually tackle that head on. Because I think we very rarely sort of tear up the frameworks that we've entrenched in our industry practice. And I think we very rarely have the introspection to go, actually, we need to kind of take a completely new paradigm and approach to changing the kind of way security is in businesses. Right. That's very valid, right? A lot of organizations, and we all have, right? I can just say a few. Everybody has invested excessive amount of time and effort into putting their security programs together, starting with the users, because the users are the weakest links that we can, we have always kind of been taught, right? But the users can also be part of the defense mechanism as well, right? Instead of having 30 eyes, you could have a few thousand eyes, right? That could help you defend. But at the end of the day, you have to adjust and adapt to the realities of today, right? Tomorrow it could become something completely different and we have to adapt to that one. But what we came from was emails that were coming in, that were a few tens or few hundreds a day versus hundreds of thousands a day, because there's automation involved. And now very few, but very targeted, right? That is really going after the essence of human ideas, right? Or human factors, right? So as the program evolves, right? Inserting those changes into your process can be done, right? Think of it as something that you have done over time, where you have taught folks to, this is how you do it, right? This is how you detect, this is how you mitigate the risk. It's the same process that you can just tweak a little bit to help them understand what the risk is first, right? And then help them understand, well, how do you now mitigate that risk, right? So it's a continuous process. It is not a one and done, right? As with everything else, learning is a continuous process. Same thing for your users, same thing for your security team. You have to continuously adjust and adapt to the realities of the world that you are in. Under Arm is a massively global business. How have you, I guess, overcome the challenge of uniformity, delivering a consistent approach to that, particularly in different parts of the global business? Yeah, that's a challenge. The challenge comes in cultural differences, right? Not only is the cultural differences, time zones are a problem, right? And also there are different aspects of the business that are targeted based on different aspects. So you cannot no longer do one email phishing training environment, right? You need to make sure the training environment is effective for the different levels of folks that you have, right? So what you are sending from a phishing email standpoint may work for the supply chain team, but it may not work for the finance team. It may not work for the accounting team, right? So gone are the days of one standard email that goes out to everybody, right? But it is not targeted, right? So you need to start looking at, well, what makes an accounting team click on something, right? And the attackers are also thinking about the same exact thing, right? They're thinking, look, if I'm targeting the finance team, what makes them click on something? So I want to be able to train and experience them into some of those as well, right? So the programs that we have developed and what programs that we are putting together allows us to kind of go and do targeted training for users so that they can say, you know what, you know, a basketball game may not intrigue you finance team, but somebody saying, hey, I forgot to pay a bill here, you know, send this, right? That may intrigue you more. So you want to be able to take a moment, pause, look at what that email looks like, right? Before you engage, right? But at the same time, you also want to be able to give them a hand, right? You don't want them to be by themselves trying to defend, right? The security team needs to step in and put some mechanisms, backstops in place so that just in case it happens, right? You want to be able to defend, right? We want to prevent these things from coming in, but at the same time, it's a layered defense approach that we need to take. In my last program that we used to run really bespoke configuration of testing, on things like geographies, right? One of the examples was even just language. I found it really bizarre when I was looking at the product market at the time that there would be a uniformity of the English language in a lot of the phishing testing. And I'm saying there are huge chunks of my bit. I was in 54 countries in my last business. It would seem really odd immediately if they had an email in English anyway. So I think there's a bit of realism there. You also touched on something interesting as well, which is some of the asymmetry that AI has brought in for attackers. So a lot of that intelligence that adversaries are now using has now been commoditized because of AI. They can easily access the corpus of knowledge to understand exactly how that accounting team might be working or how an HR function might be operating in the business, which I think makes things super challenging. And as a result of that, I just want your thoughts, because I think it'd be a good segue into talking a bit around some of the innovations in AI. One of the challenges is actually humans are going to play, to a degree, a lesser role in some of the controls and remediation. Actually, we need to be adopting more machine speed, machine-based architecture. By that, I mean, full end-to-end automation. I know this is something that you've thought about a lot, that you're driving at Under Armour. Maybe just give us a few thoughts around how you evolve the architecture and the technology stack to meet those demands. Yeah. So if you were to think about, from a security framework standpoint, you want to reduce the amount of attack surface that you have. But at the same time, you also want to say, you know what? Things are going to happen. The amount of time that you are going to take to figure out what happened is where you spend most of the time. So something went bang at night, and then we woke up and we are looking at things and we're trying to piece together, what does this mean? You're looking at all these disparate systems, trying to figure out all of this information to say, you know what? This is what happened. This is the action I need to take. So that time between bang to, hey, I'm ready to take an action, we need to shrink that as much as we can because the amount of time, because that's the time the attacker has to do whatever they need to do. Because as soon as you put mitigation, it's game on. So the amount of time that it takes for you to get to a point of, I have an action item and I need to execute an action, that's where AI is coming into play. So looking at disparate systems, bringing context in from different places and helping you get to that point of, I can now take an action. Yes, of course, there are capabilities now to automate those actions, but we are not there yet. There's that still human in the loop capability that still needs to happen. But at the end of the day, what you're trying to do is an alert fired or something happened, I need to determine what that is and that time needs to shrink. And that's the amount of time that your adversary has in their hands. So let's shrink that time and then you can take an action on it so you can mitigate the risk. So that's the goal. I should be the one. I mean, yeah, no, I completely agree. And I spend a lot of my time thinking about the kind of what are we going to have to do to a situation? I mean, I know this is a problem, I dealt with it, every CISO deals with it. And actually I think every CXO technology leader deals with it to a degree, which is the degree of human in the loop within our processing. And I do sometimes think the reluctance of CISOs to have any full end-to-end automation, there will come a time where that's no longer a viable position. I'm not suggesting it will be on every use case across the stack, but I just think to your point, again, that arms race where machine speed is being deployed, what feels like by attackers exponentially in all forms of attacks and capabilities, the sophistication of payloads are getting a lot more complex. So we're going to have to to a position where we're definitely automating more. I think for me at the moment, we actually, if I look at like a kind of Pareto principle, the waiting is still way too far on human in the loop. And actually what I want my controls to do is to be a bit more adaptive to real-time signal intelligence from all sorts of aspects of the enterprise stack and not just the security stack. I feel a lot of our controls are still highly unintuitive. They're very almost Boolean between one and one system. And actually what I want is the corpus of intelligence within the enterprise stack to be feeding into all of my controls. And to your point then, if an alert's coming through, the system's already done 95% of the analytical rigor for me over whether or not it should be suppressed or actually here are my three remediation options and I can have someone execute that very swiftly. That's yes, absolutely right. And to your point, not every event is the same. So there may be events and situations where you could where you could fully automate the process and no human needs to be in the loop because they could be a benign type scenario or super valid scenario, right? That could be the scenario. But then there are scenarios that could potentially give you, hey, there may be downstream impact or upstream impact that if you enable this, you may have a problem with, right? So those are the areas where you want the human in the loop so they can make an assessment. And also to your point, coming up with options, how do I look at that and say, okay, what is the right option for me? The other very valuable scenario that's kind of evolving with this is you're democratizing the response, right? So at the end of the day, you want to make sure that regardless of who is in control that day, right? Who's on the watch desk, right? You wanna have the same exact response, right? So you don't want to say maybe a guy who has been with you for five years versus a guy who has been with you for 10 years. You want them to be making the same decision, right? Because the capability that we are providing should democratize the amount of data, the context system, because it's all coming from the same space, right? That answer should be exactly the same for both of those people and the action that they take. I shouldn't have to worry about, you know what, is person A gonna make one decision versus person B, right? Should be the same. So we'll get to that point, right? We're trying to kind of democratize the response, right? And it'll be beneficial if you could get to that point where every time you ask that question, the answer should be the same regardless of who's in control, right? Yeah, I love that idea of flattening out the inconsistencies in decision making and decision execution. I think that's absolutely one of the sort of promises, right, of AI. You've seen the headlines. Another breach, another agent that wandered somewhere it shouldn't have. That's the bind every AI leader's living in right now. Put AI in every employee's hands and own the risk when it oversteps. This November, Sierra brings you DataSec AI, where you'll hear from top leaders in the industry, from CISOs and security leaders to identity architects and AI evangelists actually rewriting that playbook together. Bring your toughest question. Leave with a framework. That's DataSec AI this November. The future of trusted AI starts here. Head to DataSecAI.io for more. The link's in the show notes. Before we get onto what we think some of the really sort of exciting sort of sexy innovations going on in AI and how they can help us, I want to kind of maybe start the first part of that conversation really around the kind of promise that is being sold to enterprises at the moment. You know, you're an enterprise exec and maybe some of the delta between how it's being talked about, how it's perceived and actually the reality of yielding true return on investment and how you think that kind of enterprise transformation is going to kick off because I feel like a lot of the time it's the efficiency story being sold and in many cases, rightly so, but actually the way then that's articulated, thought about, conceptualized, executed and delivered in the enterprise, that doesn't seem to be happening and therefore the reality is not yielding the type of return that a lot of the promise is kind of giving out. So what are your thoughts on that? Yeah, so the two aspects that we talked about, right? The cyber aspects of defending the enterprise from an onslaught, right? I mean, that is something that the cyber team fully owns, manages, et cetera, right? We know or we can understand, hey, it's not anything new that's happening. It is the same capabilities that we trained it to do but at scale, right? So we can easily figure out, okay, well, if it is coming at us with an onslaught and as soon as we can figure out what it is and when it is, where it is, we can easily make a call to defend, right? So that's one piece. The second side, which is where the struggle is with the larger AI problem, right? So AI is perceived and conceived as a technology enabler, right? Or the technology problem that we need to solve. So when you present that to the business as a, hey, there's a capability that we are bringing to you, it's always been technology delivering on the product, right? Bringing it on board, installing it, running it for the business. So the business kind of takes a backstep and say, you know what? I'm gonna step back and I'm gonna let the technology team work this for me and then I'm just gonna get the answers, right? But this is very different because technology will not be able to find inefficiencies in your processes because let's assume, you know, you have a financial team that is running a process that could be improved, run at scale, changed, et cetera, but that process is the finance teams, right? So if there's a supply chain thing that you could improve on, that's a supply chain. They are the experts and they are the ones who's got to run the solution with our help to understand what this is. So technology being the leader in an AI deployed case for the business is probably something that we need to tweak and change, right? So you need to make sure the business takes a front lead because they own the process. They understand the process. They know where the process could be improved, where it could go fast. They are the better consultant to deliver on that versus technology trying to deliver on something, right? Because there is no way your technology team or your cyber team or any of your technology aspects would be able to deliver on process changes across the entire enterprise, right? So you need to bring the owners of the process into the game. They need to take ownership of, okay, I need to sit down with you technology team. This is where my choke points are. This is where my process improvement is, right? And at the end of the day, that's what AI is delivering. The AI isn't delivering on anything magical other than the fact that, look, I can now look at the bigger picture and I can find inefficiencies, right? And I can solve those for you so you can make things go faster, quicker, effectively, right? That's the game that we need to get our businesses to look at. I think that's a really great point. And there's a direct analogy, I think, with a lot of sort of security products in market at the moment, whereby if you look at, since LMS became largely deployed across the global market space, the products that kind of came after it were all almost verticalized point solutions around an aspect of AI security, as if that these were net new problems that we were dealing with. And actually, you know, when I look at it, 95% of the DNA of what makes up AI are nestled in not only control stacks we've owned for a very long time, but we have huge design failures in those controls. And it actually requires the ground up refix of those in order to address many of the challenges in AI deployments. And I guess you touched on something that I would love to get your thoughts on further, which is when I hear what you say, which I totally share the same view, that for me is where frontier labs are falling short. I think the genericism of, and particularly leveraging LLMs as a specific technology, for me, they're absolutely the wrong tool to deliver genuine enterprise process transformation, which is in my view, many ways boring. It's highly repeatable. It requires you to focus on consistency, repeatability as design attributes of just making sure, you know, you're not gonna be able to go to Claude or to Chajib T and say, I want you to automate my change management process. I want you to automate my identity life cycle management process, right? Because to your point, the business has architected them over time in a way which has invariably ended up complex, maybe poorly designed, et cetera. So you're gonna have to do the groundwork. So maybe with some of your experience with some of the frontier technology, do you think that's a fair characterization? Do you think they'll get there? Or do you think maybe we need to be looking at something different in the kind of broad AI stack? Yeah, and I think that is, you're spot on, right? You will not be able to take what was designed for general consumption and try to solve your business problems, right? So that's, I 100% agree to that one. But that's, I think that's where the evolution is happening, right? That's part of the maturation over time. So you will actually now see, you know, custom built solutions that are coming. They're taking an open or open weight solution and trying to customize it for a very specific area, right? Or they're taking something to deliver on a security problem, right? So eventually what we will see is this micro LLMs, if I may, right? That would start looking at one problem, right? And continue to evolve and effectively mitigate the process inefficiencies, right? So, you know, if we were to think about, you know, taking a look at emails across the board, yes, generic LLMs would probably do some of the work for you but that is not gonna be effective as things are changing, right? So you want to be able to tune your LLM to have more context around what you are experiencing rather than having a generic one, right? And that also brings in some value to you as well, right? So it's your data, it's customized to you, reduces the biases, reduces the hallucinations, right? So eventually I feel that, or I think this is where the industry is going, right? You are going to, just like how you have SaaS solutions for individual things that we have, right? At the end of the day, they're taking a bunch of data that you have and they're customizing it for you, same thing, right? And I feel like that's basically where this is gonna go to, right? So we are following the same paradigm. We are going to take an LLM, an open weight or one that is out there, you know, Gemini, et cetera, et cetera, and we're gonna take that and we're gonna customize it and we're gonna use it for our very specific purposes, right? So you could host it in your own hyperscaler model, you could bring it back into your data center. There may be opportunities there that may actually deliver on some of that specific ones. Too early, I think, because we're still, it's still very much in flux. Everybody's kind of learning, everybody wants to get into it, right? But at the end of the day, eventually we'll get to a point where, okay, I think I know what I need because your business is your business, right? And you will start tailoring these capabilities, agenda capabilities, et cetera, to your business needs. Yeah, and I think at the moment, the genericism with which we treat LLMs for the purpose of enterprise transformation is limiting many of, or I should say, actually much of the, again, quite mundane rigor that's gonna be required to actually change a process. There's a new lab type phase have just released, JEV, a new model, which is, I always, it's a system one thinking model. So it operates more on structured data, structured decision output with a handful of decisions that is then probabilistically weighted and leads to an outcome. For me, in many ways, a lot of people go, oh, it's a lot more basic, it's a lot more, you know, maybe even a step back, but actually the system one type thinking is what's required to genuinely change and make automated many of the highly manual processes that we have in enterprises today, and therefore underpin a lot of what the system two stuff, which is like the frontier LLM-based technology is actually delivering. Because, I mean, I was talking to a colleague in Switzerland last week, and I was saying, if you think, you know, when I'm speaking to maybe an audience where English isn't their first language, I am relying on an expectation that there will be a divergence in understanding in what I'm saying to a degree, even if they understand English perfectly well, same way as if someone was speaking in a foreign language to me. And yeah, LLMs are language interpretation foundationally. And so when people are sort of surprised about the variance and quality of the outcome of using those models, I'm like, yeah, a lot of enterprise transformation use cases don't require that kind of random variance that is inevitably part inherent in part of the output of LLM technology. And in fact, actually, we just need to really understand how our processes are built and just build them better. That's right. At the end of the day, I mean, if you start thinking about the variations in answer that you get, right, depending on the LLM that you are playing with, et cetera, even for, you know, highly technical folks, it is a hard process or hard area to fathom, right? I can only imagine, you know, if we were to start training people on, oh yeah, make sure that your prompt engineering is done this way and you've got to ask it the right, that is just going to put a very big damper on the whole journey that we are on, right? So to your point, minimize it as much as you can and customizing and training it is probably the value that we're going to use it for the capability that it provides, right? Don't try to make it something for everyone, right? It just quite doesn't work that way. Yeah, I love that you're taking that kind of right fit approach to AI. I think I don't really hear that often enough in industry. And I think, again, there's an expectation that we put in a frontier. I mean, this for me is also part of the promise with open way models and open source AI. I think it's absolutely needed because of the, you know, the sheer extent of use cases that are going to be required. And it's actually back to your earlier point, which is I'm actually seeing a lot more success with SLMs rather than LLMs because like you said, like you build these almost micro AI microservices where you take a very specific, even if it is a language model, you're still taking a very specific model, which is trained on a very, very specific data set for that. data set for that, for that use case, for that problem. And I think like that's, even though I think enterprise technology is moving to horizontal capability as much as possible within a systems-based architecture, I think that is how it is going to be achieved, which is layering up multiple specific use cases and slowly transforming the business, you know, bit by bit. And I think, I'm not saying the frontiers absolutely cannot support that, but it's about being smart enough, I think, to know where those are going to be the most effective and how they're deployed. And not just saying, do you know what, a bit like kind of what we did with Microsoft originally, like we can just sign up to it and it'll run the estate. And it's actually like, you know, I mean, I, it's like, I still ran CrowdStriker against Defender. I, I, lots of organizations have DLP stacks that augment purview. It's necessary because there is no one size fits all when you're in a large enterprise, right? That's correct. You're right. You're absolutely right. And, and every enterprise is different, right? They are unique, right? Right. And it is bringing the right, the right mindset, the right talent into the equation. And it is, it is going to be a team effort, right? We have to start thinking about this is not a technology problem that you're solving. You're solving a business problem with the technology. Technology shouldn't matter, right? I mean, it doesn't matter who you get your solution from, but at the end of the day, you have to understand what the problem is and the problem can be solved with this solution and get the folks who understand the problem and how, what would be the benefit to them and let the technology team kind of deploy what they say is needed rather than technology telling you, Hey, this is, this is a cool gadget. You should deploy this. And everybody's just going to be like, okay, go deploy it. And we'll wait for the answers, right? That doesn't work with this scenario, right? This is very much of a, this is a team play thing. You know, if you, you know, we always talked about shared responsibility model, right? Pure shared responsibility in the enterprise. Right. And just before we come to sort of one of the final points I wanted to talk about, which is around some of the potential end to three consequences with, with frontier tech, you just sort of jogged my memory on something there, which is in your view, then do you see that as being integral to the survivability of the CSO role long-term by taking that business first approach? Because when I look at a lot of the trends in technology, I can absolutely viably see a chief engineering officer, macro CTO for the business where you, you know, core attributes like data and security become design principles of quality in the overall good or service the business is doing. And I think that is the right model, but you made an interesting point, which I think like you can almost, for me, that is one of the only ways that CSO role is going to really survive is by taking that business first approach. And I think there's a great opportunity if you take on maybe the view that you've got, which is having the business proactively engaged and actually leading the transformation use case with technology as a co-partner, rather than relying on the internal tech functions to just deliver the, to almost push the tech out. This is more of a push and pull model as you work collaboratively. For me, that is absolutely one of the ways the CSO role will survive. Is that how you're sort of thinking about it more broadly? Yeah, I mean, there's, I had a couple of thoughts around that one. You know, I'll just give you an example. Like, you know, the more I think about automated cars and automated, you know, driver scenarios, right? You take the human out of the loop. There are things that, industries that will just fall apart completely because there's industries that have grown around a problem that we created, right? Human being in the steering wheel, being distracted, you know, slow reactions, you know, whatever the scenario is, you know, there's the insurance industry, there's the manufacturing industry, the fixer upper industry. All of those things are going to be, you know, disrupted in the long run, as soon as you take the human out of the equation, right? It's the same kind of a model that we are kind of thinking about, right? So the security team thinks about, you know, what are the things that I can, you know, I am going to be worried about, you know, one of the big ones in my mind is my humans are my weakest links. They are the ones who can be extrapolated, they can be social engineered, you know, they may make mistakes in a config standpoint, et cetera, et cetera, right? So what this is allowing us to do is to automate repeatable processes, right? Reducing the need for a human to come in and mitigate. So for example, you know, you said Purview, DLP solutions, et cetera, right? If I were to automate that process, instead of a human going in and changing permissions for X, Y, Z, right? That would be a lot more robust and scalable solution, rather than a human making a mistake because they are tired, or they've been going at it for six hours, right? And this is the last 31. So I truly believe the capability that you're bringing into play is going to make security teams life a little easier so that they can focus on more important things because things aren't, you know, going away, right? You are now replacing some of the simple ones with more sophisticated, more complex things. And if you still play in that, you know, I want to still solve the smaller, simpler problems, you don't have time to look at and adjust and adapt to the complex ones, right? Because at the end of the day, you are, you know, you are what you are, and there's only so much time in the day that you can do these things, right? So you're trying to find time by automating and solving some of the stuff that are routine, mundane stuff, and by automating some of that, right? So there's some consistency, and you don't have to worry about that. So you can go solve the bigger stuff. I did write an article about, you know, this is something that I've been thinking about from a software industry standpoint. Will there be a scenario where we will not have vulnerabilities in software, right? Because, you know, the whole Glasswing project, the Mythos scenario that we were dealing with, right? I was thinking, look, you know, just like how the bad guys are exploiting that, eventually we'll get to a point where we will have these models that we can test our software against before we release, right? So what does that bring to bear, right? Are you now thinking about, oh, you know, we don't have to worry about security teams defending any of this stuff, right? That's not the case, right? What you're doing is you are now enabling the security teams to now look at logic scenarios or logic vulnerabilities that you may have introduced that an LLM may not be able to find, right? Yeah. As it's gone. So this problem isn't going away. The problem is exponentially increasing. You have to be creative in trying to find that time by reducing your everyday, you know, day-to-day work. You push that out, you automate some of that stuff so you can find the time to go deal with things that you are not looking at today, or you have now introduced into your space because you have new technology, new capability, your landscape has increased, that kind of stuff. That's the way I'm just thinking about it. You've seen the headlines. Another breach, another agent that wandered somewhere it shouldn't have. That's the bind every AI leader's living in right now. Put AI in every employee's hands and own the risk when it oversteps. This November, Sierra brings you DataSec AI, where you'll hear from top leaders in the industry, from CISOs and security leaders to identity architects and AI evangelists actually rewriting that playbook together. Bring your toughest question. Leave with a framework. That's DataSec AI this November. The future of trusted AI starts here. Head to DataSecAI.io for more. The link's in the show notes. I'm doing a lot of thinking at the moment around, and I know a couple of CISO friends as well in the industry doing this around software factories and what they're delivering is going to be, you know, so fully Gen 6 CICDs or fully automated ones as well. And that's going to be shrinking. The time is actually, you could almost model out that the frequency of error rate could actually almost exponentially skyrocket. But the error correction rate will for the first time begin matching the speed of error creation. And I think we've done, that has been the mismatch, right? In vulnerability remediation for years. And to your point, that cycle of almost self-correcting processes is going to be something that we're going to be able to begin to deploy in security. And it's funny because I see that as a microcosm of something that's happening more broadly across enterprises. So I was saying in a speech a couple of weeks ago, every enterprise on the planet does two things. It builds and it sells. And over the time, up until the last 20 years, we built as humans, a ton of scaffolding, if you want to think of it like that, around those two core processes, those two core functions. So whether it's operations, HR, finance, legal, all of these manual ops sat around how we built a good or service and how we sold that and pushed it to market. Well, the really interesting thing about this kind of transformation era that we're in at the moment is all of that scaffolding is being torn down. And so the go-to-market velocity is now becoming increasingly commoditized because everyone's getting access to kind of the new democratized forms of artificial intelligence. And actually, it'll lean out the business in many ways because it can iterate its build and sell processes so much quicker. And I think the same thing's happening in security. And I've been screaming for that for a long time. I think it's great that we're finally seeing some traction with it. Right. I think that is essentially what the long-term goal should be for each of us, right? Trying to make sure that we can lean out the processes, get unnecessary steps out of the way, see if there is a need for a human in the loop. Can we automate some of that stuff? Maybe this is shifting. We talk about shift left, right? Getting some of those processes in place, security baked in, et cetera, so that when you deliver on a product, the product is now reasonably in a good spot, right? And when you release it, you don't have to worry about now somebody finding a bug in a library that you have or runtime issues, that kind of scenarios, right? Now you need to focus on, well, is there the logic scenarios that you need to think about? Those are kind of the areas that you can now focus on and then potentially use your humans to look at those versus, that's what humans are good at, right? Until the LLMs catch up to those things or the agents catch up to those things. Right. You should be able to figure that out. And I feel that the more we enable or we enable the users or our teams to start focusing on what is new and improved vectors that we need to look at, the less time we would need to worry about some of the mundane stuff that we have, right? That's the way I kind of foresee this. Yeah. And I agree. I think a lot of the mentality in the debate across industry is that we'll speed up the way to eradicate the problems that we have today, the existing problem stack, and we'll get to zero at some point. And it's just not true. And there's a similar analogy around the redundancy fears in jobs, which is that it's not that, it's displacement because new opportunity is created. And if anything, it's an accelerant to growth and opportunity. I see the same way even within security, which is a much smaller example. But like you said, it's more that a lot of the way that the distraction of where our time is being addressed and focused on at the moment is going to be dealt with by machines. And we're not going to have to devote to it. And actually, it's going to free us up to be more creative, to think of new opportunities. And I think that offers an exciting hinterland for security because I think it allows us, I said to someone the other day, we actually end up owning, this is why I think CISO has become the role that it has and often gets a lot of flack, which is we actually own a lot of stack technology that can do a lot for the business. And we know in the product space as well that we probably utilize, again, maybe 20, 30, 40% of our product's capability for a whole host of reasons. But if you can imagine a situation where we were pushing the exploit of limitation of those products to full, and we were actually extracting all of their value, we can potentially be huge operatives of change in the enterprise. And I think that's where we can nestle ourselves into in a lot of the AR debate and transformation as we go forward. Yeah, I mean, sweating the assets, that's something that we kind of live by as well, right? It's easier to have two stacks of solutions than 35 stacks of solution that does bits and pieces of something, right? So sometimes that is not doable in this scenario, but at the end of the day, we should always strive to make sure that you sweat your assets, right? Making sure that when you bring it in, you're not bringing it for 10% of what it can do versus maybe look at a solution that actually does 80 to 90%, right? Of what it should be able to do. So that, yeah, 100% with you on that one, Ash. Yeah, and I can see a lot of that, like I said earlier, right? A lot of those kind of vertical silos in stack technology breaking down and moving to more horizontal platform play. And even when you look at the VC work that I do and now being in a product company, if you look across market, you look at the Palos, you look at Cisco, you look at CrowdStrike, it is these large, expansive service. Now it's the same, right? To own capability. And I think that's happening as a by-product of the fact that enterprise technology environments are trying to move to more systems-based architecture, to systems thinking, where your processes are truly end-to-end and you're not creating these silos. And I think one of the interesting sort of challenges and opportunities, I'll say that, I'm sure you're tackling brilliantly, is how you do that, particularly in globally segmented businesses. Because I think that's going to be the real success criteria for lots of businesses that operate internationally. Yeah, 100%, 100%. Yeah, I know, 100%, 100%. I would agree that the end-to-end processing is something that the business really likes to engage on and thrive in, right? Yeah. And they try to have an end-to-end solution, right? That'll be a very silo type solution in place. Security also kind of does the same kind of thing only because it makes it easier for us to collect the data, right? And analyze the data and react and respond to it, right? There was a time when we were always worried about, you know what, all eggs in one basket scenario, right? That still is applicable, right? But at the end of the day, you need to kind of pick and choose, you know, what is the, you know, maybe logging and monitoring, you want to have it end-to-end, right? ADR, you want to have end-to-end, right? Those kinds of scenarios that you need to start thinking through so that it makes it easier and effective and take advantage of some of the new capabilities that you're bringing in. So you don't have to worry about, you know, jury rigging all these wires and connectors back and forth, right? So that's where the value really comes in, I think. No, a hundred percent. Well, look, my friend, this has been an amazing conversation. We've covered a huge amount as well, which invariably happens when we get going on these topics. But I just want to say thank you again so much for spending the time with us at the Watchtower. I can imagine our audience will get a huge amount of value out of not only, you know, your forward-leaning thoughts about the industry as it goes forward, but actually about the amazing work that you're undertaking at Under Armour. And, you know, as always, thank you to everyone for listening. Alex, just briefly, actually, if people maybe want to reach out to you or follow some of the thoughts that you're giving across industry, any ways they can do that? Yeah, absolutely, man. I'm on LinkedIn. I love chatting with folks, right? You can absolutely reach out to me and let's have a conversation. I love to learn. You know, I always love to kind of hear from folks, new ideas, new thoughts, you know, hey, something you haven't really thought about, this is something that's coming down the pike. I love those conversations and please do, right? I would absolutely, you know, take you up for a cup of coffee or whatnot, right? So we'll definitely do that. For any skeptical listeners, I haven't paid Alex to be my friend. He is in fact an extremely nice guy who loves all of these open debates and conversations. So yeah, I can confirm. Look, Alex, thanks again so much. And to everyone listening, I'm Ash Hunt and this has been The Watchtower. Thank you.
