You’ve both said the use of AI to fight cyber attacks is progressing more slowly than the criminals using AI to perpetrate them. Why is using AI for good behind, and what will it take to catch up?

Hogg: Bad actors work in an unrestricted manner. They are not regulated, they don’t have ethical boundaries, and so if you have unrestricted work with no rule sets, boundaries or ethics, you’re able to take technology and deploy it very rapidly and maliciously. How do we counteract those activities that have proliferated very quickly, and do so ethically and in a compliant manner, where we’re adhering towards policies? 

I think the way that you can turn that and start to catch up or get ahead is to begin thinking about looking at the regulatory environment and saying, ‘How do we better prepare organizations and enterprises, analyze them, and anticipate where new attack vectors are going to come from so that we can better prepare them?’ 

Tobok: It’s unfortunately a lot easier to weaponize technology versus all the ethical things that we have to look at as the good guys. So it does take a little longer, and this is where the cycles of cyber over the past 25 years are kind of flowing. We always start from a little bit of a second position. We move into first, and then the threat actors are trying to pivot and find ways to find compromises and really weaponize whatever new technology is in their hands. 

I’ll just say this: The key is to be prepared, and not to sound cheesy, but we all know it’s not a matter of if, it’s a matter of when. That’s the only way we’ve been able to tackle cyber properly in the past 20 years, [when] it became really popular with lots of incidents and taking advantage of organizations. You have to be proactive. You have to be thinking ahead of the game on how you’re going to combat the situation and be better prepared. This is where AI can play a major beneficial role in being prepared for that, and having the right strategy and solution in place.

Let’s say you are well prepared, you are doing what you can to get ready for an attack, and you still get attacked. What happens next in terms of rebuilding both your cybersecurity and your company’s reputation?

Tobok: Preparation is key. Educate people, [do] consistent assessments and most important, have a plan. I know it sounds very simple, but today, small, medium and large organizations get breached. They don’t actually know who’s going to do what. They kind of know, ‘Okay, we’re going to call a number and hopefully they will have a solution for us.’ 

[What Jay and] I always say when we are both doing board meetings and trying to educate executives is you’ve got to have a plan that you can execute on, because everything comes to TTR: time to recover. A day, a week, a month is a major difference in different industries and different businesses. Some businesses could be losing $50 million a day by being non-operational. Some businesses can lose the production line and they cannot fulfill their orders, and they [could] go into a bankruptcy or a big financial strain.

Hogg: We need to change the way that we are conducting proactive services and testing: penetration testing, red teaming, dark web monitoring, threat intelligence. The way that we need to test it is we need to move in a much less restricted manner. There’s these currently orchestrated kabuki dances that take place between the security apparatus of an enterprise and the testing services, and it really does a disservice. If you tee up the ball, you can swing and hit it. It’s more a matter of when curve balls are coming at you.

A change that needs to be made there is that the testing should be overseen not just by either the CIO or the CISO’s organization, but someone else, like the general counsel’s office or the chief financial officer’s. Those are the places, to Daniel’s point, that are heavily impacted. You’ve got not only the financial losses Daniel was talking about, but you have legal obligations to your consumers and your partners. Having another party can also judge to make sure that it is a valuable test that’s taken place.

Tobok: We always say in the industry when there’s an incident, when there’s a breach, it’s not an IT problem. It’s legal, it’s compliance, it’s operational, it’s executive. Just because the items that were used to perpetrate the crimes are computers, it doesn’t mean this is an IT problem. This is the kind of shift that is required. The CFOs, the executives, legal, the GCs all have to be involved in this. This is a full company responsibility.

What advice would you give to a CIO, CTO or CISO on how to deal with what’s going on today?

Tobok: Cybersecurity does not have to be extremely expensive. It really starts with strategy. Before we start having all the servers and all the flashing lights and looking at technology as our shield, you’ve really got to look at strategy.

I think a lot of people in the industry today have been overtrained on tools and technology versus looking at strategy. I look at military and law enforcement, where it’s strategy first, tools later. We have to adapt that in the corporate world: really being prepared, understanding that it’s going to occur. How do we prepare best? 

Look at organizations that might not tell you what you like, but are really good for you. It’s like you’re sometimes afraid to go to the dentist, but he is going to tell you how it is, versus going to your friendly gardener who took a couple Google classes on how to deal with your teeth. 

In the end of the day, you’ve really got to understand what you‘re dealing with. You might not like the info, but it is going to help you to prepare.

Hogg: I think that it’s going to take a mind shift. The average CISO’s tenure is somewhere between 18 and 24 months. To Daniel’s point earlier, we really need to have a different thought process than we’ll put all the risk on one human in our organization, and all the blame on that human, and they’re responsible for it. It’s a collective effort, and that really does require a significant shift in how everyone thinks about stuff. I believe that there is some practical regulation that could go into place with regard to what boards are required to support and what type of activities they are reporting, particularly public companies. 

The last thing I would say is private equity and venture capital firms should wake up and pay much more attention. I have an expression: Nothing vaporizes enterprise value like a breach. Forcing the discipline, in order to make sure that their portfolio companies are reviewed [is a good idea]. They’re a huge portion of the fabric of our society and the financial underpinning of our economy. Making sure that there’s a requirement that these organizations end up having requirements is going to be critical because it’s a force multiplier. If they’re not running it right, there could be 40 companies that aren’t being properly assessed.