From West Point to IBM Cybersecurity
Key Points
- Jason recounts his journey from a West Point cadet and U.S. Army airborne ranger stationed in northern Italy to a two‑decade career at IBM, where he now builds teams and expands new business areas.
- Kristy shares her Canadian background and long‑standing experience as a Bain consultant, emphasizing how that role shaped her professional growth.
- The hosts introduce the episode’s focus on cybersecurity and the strategic partnership between IBM and Palo Alto Networks.
- Both guests highlight the value of collaboration with brilliant colleagues and partners in driving innovation within the cybersecurity space.
Sections
- West Point Roots, Ranger Journey - Jason shares his upbringing, West Point education, football experience, and service as a U.S. Army airborne ranger in Italy before transitioning to the cybersecurity discussion.
- Bridging Consulting and Cloud Partnerships - The speaker recounts his journey from Bain consulting to product roles at New Relic and Palo Alto Networks, now combining consulting expertise and product focus to deepen a strategic partnership with IBM, highlighting IBM’s identity as a multicloud, hybrid‑cloud AI company.
- Taming Zero Trust Tool Sprawl - The speaker explains how the proliferation of zero‑trust checkpoints creates alert fatigue and tool sprawl, and how Palo Alto’s unified platform—augmented by IBM’s expertise—helps consolidate and re‑architect environments without sacrificing best‑of‑breed security.
- AI Increases Data‑Security Stakes - The speakers contend that our expanding dependence on data and rapid AI evolution magnify both defensive and offensive threats—especially ransomware—making heightened preparedness essential despite AI’s overall productivity benefits.
- Balancing Data Security and Growth - The speaker urges hospital CEOs to first clarify their objectives before addressing PII protection, inter‑site data sharing, and the efficiency‑security trade‑offs that arise when scaling nationally or internationally.
- Healthcare Innovation Meets Cybersecurity - The speaker argues that as digital tools enhance patient care and collaboration, a strong cybersecurity strategy—like their SASE solution—must protect privacy without sacrificing speed or efficiency.
- From Scanning to AI Defense - The speaker stresses beginning with comprehensive asset discovery and visibility—using integrations and tools like Palo Alto’s attack‑surface scanners, illustrated by a house‑security analogy—and then explains how AI acts as a force multiplier that transforms modern cyber‑defense strategies.
- Accelerating Cyber Threat Detection - The speaker describes how an AI‑based security operations platform slashes mean time to detect and respond from days to under an hour by consolidating alerts and streamlining investigations.
- CIOs Adopt AI Policy Tool - The speaker outlines a newly announced AI governance platform that enables CIOs to define usage policies, gain visibility into risky AI applications, automatically detect prohibited data like Social Security numbers, and block non‑compliant actions at runtime.
- AI‑Driven Automation for Cybersecurity Teams - The speaker emphasizes using AI tools like Cortex XSIAM to automate routine SOC tasks, freeing analysts to focus on advanced threat hunting and ensuring they stay skilled and adaptable against evolving threats.
- Future Vision: Quantum AI 2029 - Speakers imagine 2029 where quantum computing is mainstream and quantum‑safe, cloud firewalls guard cloud instances, and AI acts as a seamless productivity multiplier integrated into every employee’s workflow.
- Integrating Systems Through AI Automation - A speaker explains how unifying disparate front‑ and back‑office functions via workflow automation—using AI tools such as ChatGPT and a consulting assistant—enables strategic work while balancing openness and zero‑trust security.
Full Transcript
# From West Point to IBM Cybersecurity **Source:** [https://www.youtube.com/watch?v=utcYsBKL7e8](https://www.youtube.com/watch?v=utcYsBKL7e8) **Duration:** 00:36:19 ## Summary - Jason recounts his journey from a West Point cadet and U.S. Army airborne ranger stationed in northern Italy to a two‑decade career at IBM, where he now builds teams and expands new business areas. - Kristy shares her Canadian background and long‑standing experience as a Bain consultant, emphasizing how that role shaped her professional growth. - The hosts introduce the episode’s focus on cybersecurity and the strategic partnership between IBM and Palo Alto Networks. - Both guests highlight the value of collaboration with brilliant colleagues and partners in driving innovation within the cybersecurity space. ## Sections - [00:00:00](https://www.youtube.com/watch?v=utcYsBKL7e8&t=0s) **West Point Roots, Ranger Journey** - Jason shares his upbringing, West Point education, football experience, and service as a U.S. Army airborne ranger in Italy before transitioning to the cybersecurity discussion. - [00:03:06](https://www.youtube.com/watch?v=utcYsBKL7e8&t=186s) **Bridging Consulting and Cloud Partnerships** - The speaker recounts his journey from Bain consulting to product roles at New Relic and Palo Alto Networks, now combining consulting expertise and product focus to deepen a strategic partnership with IBM, highlighting IBM’s identity as a multicloud, hybrid‑cloud AI company. - [00:06:08](https://www.youtube.com/watch?v=utcYsBKL7e8&t=368s) **Taming Zero Trust Tool Sprawl** - The speaker explains how the proliferation of zero‑trust checkpoints creates alert fatigue and tool sprawl, and how Palo Alto’s unified platform—augmented by IBM’s expertise—helps consolidate and re‑architect environments without sacrificing best‑of‑breed security. - [00:09:13](https://www.youtube.com/watch?v=utcYsBKL7e8&t=553s) **AI Increases Data‑Security Stakes** - The speakers contend that our expanding dependence on data and rapid AI evolution magnify both defensive and offensive threats—especially ransomware—making heightened preparedness essential despite AI’s overall productivity benefits. - [00:12:43](https://www.youtube.com/watch?v=utcYsBKL7e8&t=763s) **Balancing Data Security and Growth** - The speaker urges hospital CEOs to first clarify their objectives before addressing PII protection, inter‑site data sharing, and the efficiency‑security trade‑offs that arise when scaling nationally or internationally. - [00:15:49](https://www.youtube.com/watch?v=utcYsBKL7e8&t=949s) **Healthcare Innovation Meets Cybersecurity** - The speaker argues that as digital tools enhance patient care and collaboration, a strong cybersecurity strategy—like their SASE solution—must protect privacy without sacrificing speed or efficiency. - [00:18:57](https://www.youtube.com/watch?v=utcYsBKL7e8&t=1137s) **From Scanning to AI Defense** - The speaker stresses beginning with comprehensive asset discovery and visibility—using integrations and tools like Palo Alto’s attack‑surface scanners, illustrated by a house‑security analogy—and then explains how AI acts as a force multiplier that transforms modern cyber‑defense strategies. - [00:22:02](https://www.youtube.com/watch?v=utcYsBKL7e8&t=1322s) **Accelerating Cyber Threat Detection** - The speaker describes how an AI‑based security operations platform slashes mean time to detect and respond from days to under an hour by consolidating alerts and streamlining investigations. - [00:25:05](https://www.youtube.com/watch?v=utcYsBKL7e8&t=1505s) **CIOs Adopt AI Policy Tool** - The speaker outlines a newly announced AI governance platform that enables CIOs to define usage policies, gain visibility into risky AI applications, automatically detect prohibited data like Social Security numbers, and block non‑compliant actions at runtime. - [00:28:07](https://www.youtube.com/watch?v=utcYsBKL7e8&t=1687s) **AI‑Driven Automation for Cybersecurity Teams** - The speaker emphasizes using AI tools like Cortex XSIAM to automate routine SOC tasks, freeing analysts to focus on advanced threat hunting and ensuring they stay skilled and adaptable against evolving threats. - [00:31:15](https://www.youtube.com/watch?v=utcYsBKL7e8&t=1875s) **Future Vision: Quantum AI 2029** - Speakers imagine 2029 where quantum computing is mainstream and quantum‑safe, cloud firewalls guard cloud instances, and AI acts as a seamless productivity multiplier integrated into every employee’s workflow. - [00:34:18](https://www.youtube.com/watch?v=utcYsBKL7e8&t=2058s) **Integrating Systems Through AI Automation** - A speaker explains how unifying disparate front‑ and back‑office functions via workflow automation—using AI tools such as ChatGPT and a consulting assistant—enables strategic work while balancing openness and zero‑trust security. ## Full Transcript
Jason, Kristy, welcome to Smart Talks with IBM.
Thank you for joining me.
Thank you.
It’s great to be here.
We are here to discuss cybersecurity and the partnership between
IBM and Palo Alto Networks.
But before we get there, I wanted you guys to tell me a little bit about yourself.
Jason, let’s start with you.
I see on your résumé “West Point,” which makes me think there’s some
interesting things going on there.
How did you get to West Point?
West Point—West Point was a decision.
First, it was affordable back in the day.
But I had a sense of service.
My father was a World War II vet.
So I grew up on the weekends watching World War II video.
Was he Army?
He’s Army as well.
And so I thought, “Oh, that’d be exciting.” And I thought
I’d do some type of service.
Went there, and now I have the biggest family, extended
family, I could ever have.
So it was very exciting.
Played football.
Lucked out—uh, meaning I wasn’t recruited.
Yeah. I walked on.
And that kept me there because it gave me something—an outlet
for all the other pressure.
What position did you play?
Defensive back.
I was—I was great at knocking the ball down, not the best at catching it.
Yeah.
And then you were a ranger?
I was.
I was privileged to be a U.S.
Army airborne ranger.
Yeah.
Stationed—but did most of my time in, uh, northern Italy.
We’re part of the 82nd Airborne.
Hardship post.
Oh, yeah.
That’s what people say: “Seriously?
Like, you know, you were—you were in northern Italy?
You were drinking wine and having bread?”
Eating pasta.
We were part of a NATO force there at the time.
Yeah.
So, yeah, exciting.
How did you get from there to IBM?
A long path.
As I came out of the military, I started in manufacturing, retail, housing,
and did a quick stint—took a leave of absence from industry and did a stint of,
yet again, public service, in the state of Tennessee, with economic development,
and got a whiff of how fun it could be to do things around data and media.
Started a small media firm—what we would now call a 'digital firm'.
Mm-hmm.
Sold it, and said I wanted to go do it again somewhere, but I
wanted to go to a big company.
And the family at IBM brought me in and have yet to let me go.
That was how many years ago?
Two decades.
Oh, wow.
I know.
I look amazingly young.
Yes, I was going to say, “You must have—"
IBM was my fifth career.
And I’ve enjoyed it since.
And that’s what I do, is—I build teams, grow new parts of the company, and get
to work with some of the most brilliant people on the face of the planet, as
well as partners like, like Kristy, that, you know, just keep it exciting.
Kristy, you’re—I was delighted to learn that you are Canadian.
Yes.
From Toronto.
Nothing made me happier.
But you—so you were a consultant for a long time at Bain?
Yes.
Yeah, I joined Bain Consulting intending to spend a couple
years there, learn the ropes, and then go get my first “real” job.
But the value, personally, to my growth and development—and then
that we were able to bring our clients—I ended up there for 16 years.
And then post-Bain, went on to another—my first product company, at New Relic.
And then it’s come full circle at, at Palo Alto Networks.
But at Bain, it was all about bringing expertise across different
industries to help our clients improve whatever they needed to improve,
and bringing that expertise to bear.
And then you have the product lens and you think, “Okay, we’re gonna build
the absolute best product to help our customers do what they need to get
done.” And then I joined Palo Alto about six, seven months ago in a partnerships
role, and I’m delighted to be able to work with amazing consulting companies
like IBM, where we bring both to bear.
How long have IBM and Palo Alto Networks been partners?
Well, we’ve been working together for quite a long time, but we, uh, made it
official, meaning we, we got married as strategic partners, last year.
Oh, I see.
So what is it that each of you bring to the table?
What’s each side’s specialty?
So—so it’s great that you ask that, because about a decade ago, our now-CEO,
Arvind Krishna, says, you know, “Wouldn’t it be great if we just had, you know,
this one focus, which is: What does IBM do?” And you could have this whole list.
And he says, “Let’s make it simple.
We are a multicloud, hybrid-cloud AI company.” And so when you say
that, it sounds very simple, but then people—"What the hell does that—?
You’re ’hybrid cloud?’ You’re—?” Well, both of those two things
have a lot of data involved.
And a lot of those mean that that data is going to sit in multiple
places, in distributed environments.
Well, if you’re able to tie those things together with multiple partners, you
also have to make sure that it’s secure.
Because in the direction that we’re going, where data is now being consumed
in many different places, and it is the fuel behind AI, as we know, then
you say, “Ah, well, who does that well?
And who does it in a way that’s—that’s getting rid of seams?” The seams—that
could be across multiple products.
Multiple product sets, even.
And that’s where Palo comes in.
I think that the conventional wisdom in cybersecurity was always, “You
need all the new tools,” right?
You need a—every threat, it’s like Whac-a-Mole.
Every threat that pops up, you get the tool that’s purpose-built
for that specific thing.
Well, fast forward to, you know, the RSA conference this year.
There were 4,000 vendors on the floor.
Um, you look at an average company—there’s hundreds of cybersecurity tools.
It introduces a level of complexity that is really hard to manage.
You, as a user, query an application, right?
That query can go through a bunch of different pings
from one cloud to the next.
It goes into and out of a SaaS application.
It may be running along a network.
You may be accessing it from your phone, which is an unmanaged device.
It’s gotta go in and out.
And if you say, “Okay, I’ve gotta secure that phone, I’ve gotta
secure the network, I’ve gotta—."
Then all of a sudden you’ve got, sort of, firewalls, software and hardware
firewalls, popping up everywhere.
You’ve got cloud security.
And it’s—you’ve probably heard of this concept of “zero trust,” which
is—every time you have to check and say, “Are you allowed in here?
Are you allowed in here?”—the number of places that can fall
down, uh, just becomes overwhelming.
So you end up with either alerts firing, you know, every two seconds
that you have to then go investigate, most of which are false positives,
or you miss something, right?
And so that was—the conventional wisdom was, “We’ve got to buy all these
tools,” and now you’ve got overwhelmed CIOs and CISOs with hundreds of tools.
And Palo Alto’s strategy has been, “Look, we’re going to create a platform
where—where everything can be stitched together, everything can speak the same
language, and we can, sort of, manage throughout the architecture and, and watch
this call as it’s, as it’s passing through all these different, uh, checkpoints.”
And we can do it in a way that you still have the confidence
that it’s “best of breed,” right?
So you’re not making any, any trade-offs.
But, um, it’s not so simple just to get from the spaghetti to,
to the seamless architecture.
You need, oftentimes, to reengineer your business processes.
You have to re-architect your digital environment.
And so that’s where we partner with a company like IBM, to bring that
expertise and say, “We’re gonna help you not just deploy the best,
um, cybersecurity architecture, but really get your environment
ready to have this ‘zero trust.’
As well as all of those players that cross that spaghetti.
And because, when you start thinking about all the other partners that you work
with, if you’re—you think of an industry perspective, you’re gonna have an ERP.
It could be an Oracle.
It could be an SAP.
You’re not gonna have one cloud, as I mentioned.
It’s gonna be possibly multiple clouds.
You’ll have some AWS, maybe Microsoft Azure, and then
even—even some Google in there.
And then your own that you’ve built in your private—over there.
Some IBM. An IBM cloud.
You’ll have those multiple clouds.
And then you also will have, you know, “fit for purpose.” “Oh, I
need a, a—I need a Salesforce in there for my customer-focusing.
I’m doing some graphics out of Adobe.” So I—just as—I, I could name, name, name—all
of those then have to be reengineered.
Seriously?
I mean, come on, Malcolm, are you gonna sit there?
You think how long that would take?
Mm-hmm.
So if you haven’t done that before, you’re going to have to go to
each one of those individually—or you can work with a company that
can tie those things together.
Because we are also strategic partners with them.
Yeah.
So that’s where you start to say, “Okay, I—I see how this comes together.”
You have to make sure that your ecosystem is going to be stronger
than your competitors’ ecosystem.
And you have to be secure in what you’re doing, because as you add more
players or products, you create seams.
And you want to make sure there’s fewer seams, and that there’s
zero trust across that capability you’re building, and that’s why the
complement between the two companies—
Take a step back for a moment before we, sort of, launch into the
specifics of what you guys are doing.
I’m curious: At this moment, in 2024, how nervous should we be about cybersecurity?
So compare it to five years ago, or ten years ago.
Are we—are you less nervous than you were five years ago, or more nervous?
Are all the changes going on right now increasing vulnerability or decreasing it?
I would say—and I—you know, Kristy also; I think we share the point of view—is that
it’s not necessarily being more nervous.
I think you should be more prepared.
Yeah.
Because the amount of threat is increasing based on our dependence upon data.
And that’s where I think the attention should be placed—is that, more and more,
especially with the importance of AI, that you say, “Okay, then what’s under
all that?” And it’s the data, as I said.
I said, “So, knowing that, you should be more concerned.”
Does the advent of AI and its rapid evolution help
defense more or offense more?
I think it’s—I think it’s like any megatrend that we’ve
witnessed: um, both, right?
So you think about AI; it’s—it’s 99 percent great, right?
In terms of what it’s going to unlock for productivity, for humanity.
But it also makes it a whole lot easier to build ransomware.
It’s a whole lot easier to test different ways into, into a system, right?
But I think that’s true if you think about, like, the
rise of the internet, right?
All of a sudden everyone was putting their data online.
Uh, and you had to think of, of new ways to stay ahead, and keep that secure,
and I don’t think AI is any different.
You’ve got companies like Palo Alto, partnerships like Palo and IBM, that are
constantly scanning the landscape for not only the current threats, but what’s next.
What’s coming around the corner?
What’s after AI?
And so I think taking it seriously and being prepared is probably
the right way of looking at it.
As opposed to—because, if you think about it too hard, you’ll just
wanna crawl into a corner and stuff everything under the mattress.
Let me give you a hypothetical.
I am the CEO of a regional, uh, hospital chain.
Big, distributed healthcare system.
So: ton of data.
Uh, the consequences of being hacked and held for ransom are—
Life and death.
Life and death, right?
Um, when you come—so you, you come down, you sit down with me and you chat with me.
Um, walk me through the kinds of things you would tell me
about what I need to get safer.
For example, let’s start with one: Is it likely that I’m spending too little?
Or am I spending money in the wrong place?
That’s a great question.
It depends how you’ve broken it out.
If you are distributing all of your dollars across a whole bunch of
different tools, it’s likely you’re just spending the wrong money.
Yeah.
And in fact, you know, putting it all in one place is a way of
potentially saving money, uh, but keeping your security actually higher.
And I—I’d love to hear, Jason, how you would approach it.
How we would approach it, of course, is by saying, you know, “What—what does your
environment look like?” You know, “Are—do you have the connected medical devices
into your EMR?” Uh, “Are your respirators and ventilators all online?” Right?
And so we would talk about, “Okay, here’s how you get coverage, and how the
coverage of both—the firewalls as well as the detectors—all feed back into your
security operations center, and you can manage it and, and do your alerting with
AI, and keep yourself secure and safe.”
And I would say Kristy and I would go to the same point, because if you get under
what she was just asking, it’s, “Is your data on prem?” And when it’s on prem,
how active is it across the enterprise?
And so that begins—the basis for the start.
And then often you’re going to say, “Well, we actually take in data from outside.
And then we also have the circumstances—there’s a lot
of PII.” And so that personal—
“PII”?
Personal information.
And so now you’re saying, “Okay, now, how are we securing that?
And where are we securing it?” And so you have to start really
thinking about the different areas within that hospital chain.
Are you sharing that amongst your hospitals?
And now you start to think of, if I’m saying “No” to a lot of that, it’s like,
“Well, then, are you as efficient as you want to be?” So there is that trade-off
of, you know, “Am I so tightly walled that I’m not productive?” And so that’s
where we would start to say, “What’s the outcome that you’re trying to get to?
All right, maybe you’re good, maybe you’re good with your five locations and
you don’t need to go any further, but maybe you want to expand to 50, and by
the way, you’re going to go cross-border.
You’re going to be in Toronto and in New York.
Okay, well, then, how do you do that?”
And so I think that it’s very easy to start jumping into any of the typical
situations, but the first question that you have to ask—you as the hospital
CEO—is what’s your objective; what are you—what are you trying to do.
Because too often, what we see is that there’s some bright, new, shiny thing
that everybody wants to put in play.
You know, it’s a sandwich looking for a lunch.
And you go, “Oh, but what is it that you want to do as this hospital?
Are you doing research?
Are you a research hospital?
Are you more consumer oriented?” So those are the questions you start to
ask, because they start to then tell a story, in line with what Kristy questions.
And I think that that’s where the—again, the complement.
Instead of just saying, “Oh, well, that’s—thanks for
telling me all this, Malcolm.
Here’s your 10-page strategy.
Now go find somebody,” we have the benefit in IBM.
And it’s probably why I’m still there—is, you know, we’re very unique.
We’re the only company on the planet that has a consulting business at
scale inside of a technology company.
Mm-hmm.
So we have—you know, the left brain, right brain; we’re able to do that.
And then we’re able to say, “Okay, now which partners are going to be most
valuable for our clients?” What’s going to work for you isn’t going to work
for the manufacturer down the road, isn’t going to work for the consumer
or CPG company, uh, across the river.
Those things are very specific.
The threats and the seams that I was talking about are very specific.
So that’s where it becomes very valuable to make sure that I’m not just giving
you some strategy that’s generic.
But everything—as a healthcare CEO, everything I have done, almost
everything I’ve done over the last 10 years—hasn’t it had the effect
of increasing my vulnerability?
I want to digitize data within the hospital.
It used to be on pieces of paper.
I want doctors to go home and to be able to seamlessly hook into stuff at work,
because they gotta do all their paperwork.
I want to make sure the diabetes people are speaking
to the organ-transplant people.
And so I’m—you know, isn’t that—everything I have done to, kind of, keep up with
the revolution in healthcare—isn’t that also making me more and more
vulnerable to, uh, a bad actor?
It’s such a great question, ’cause think about the quality
of healthcare delivery, right?
So now doctors aren’t filling out forms; they’re spending time with patients.
And so the quality of care is improving, and the vulnerability is improving, right?
And so I think, um, that’s where having a strong cybersecurity
strategy actually enables all of that.
One of our products is our SASE product, and we tested it with
some business applications.
And oftentimes the rap is, “Oh, security is going to slow you down,” right?
Like, you have to add a firewall, you have to add checkpoints.
Our product actually increases the velocity of, of your ability to use that
application because of the way that it is queried through our system, as opposed
to just through a—the regular network.
So it doesn’t slow it down, and in fact it makes it run more efficiently.
Yeah.
That’s just one minor example.
But back to the healthcare question: I, as a patient, want my doctors accessing all
the technology and talking to each other and connecting the dots behind the scenes.
I also want my data to stay private.
And so having both a consulting partner [who understands how to ask
questions of the environment and of the applications you’re using and who
understands the industry inside and out and a technology partner that builds
and stays ahead of all of the different threats come together and advise
you, I think is, is super important.
When you bring in a partner like IBM, like—with a platform like Palo Alto that
covers, you know, all the different, um, parts of your environment, uh,
you’re able to say, “Look, where, where are the vulnerabilities in the system?
Where are the different end points, um, that we need to have covered?” And then
just make sure you get that breadth of coverage, and then you’re better
able to—so yes, you’ve increased the risk, but then you’ve mitigated it.
Mm-hmm.
So to give—sorry, before I retire my healthcare analogy—because I
was thinking about—I was trying to understand the importance of this, of
this idea of having a single platform.
So if this—my little healthcare network—is typical, I’ve acquired a whole series of.
. . . Over the last 10 years, I bought a hospital over here; some—I got some
physicians’ things that I snapped up over here; I bought a diagnostics company.
And so I have all of these legacy systems.
And I have—like you said, maybe I got some stuff in the cloud with one
company, some stuff with the cloud.
And what you’re saying is, the first step is to kind of rationalize that—put it on
a single platform so you understand where your points of weakness are, as opposed
to being blind to your points of weakness.
There’s—yes, although anyone who’s done any kind of M & A knows that
that’s a long journey, right?
So I think the first step is just understanding where everything is.
Yeah.
And then you get on a path and you say, “Where’s the biggest risk?
Let’s, let’s neutralize or mitigate that risk one at a time.” The thing about “open
and secure”—you know, Palo Alto, we, we keep touting the benefits of the platform.
Everything on Palo Alto, your risk is going to be mitigated and you’re
going to have the full visibility.
But you can’t get there overnight.
And so we’ve got, you know, thousands of integrations with other technology
companies, including our partners, to, to make sure that we can capture
and have visibility into those end points and those systems as well.
And so I think step one is just figure out where everything is.
Just get the scan.
So Palo Alto has a couple of products where you can kind of deploy and
get a view of your attack surface.
I love the analogy: just like a digital environment as a house, right?
And so, like, you have your front-door lock, of course, because probably
they’re gonna try the front door first.
But that’s not all you’re gonna do, right?
You’re gonna make sure the whole—you know, the windows are locked, and
there’s an alarm system and all of that.
Um, and, uh—and I think that’s how you have to think about it, is: just
how do we cover the whole surface?
So everyone—laypeople like me have been bombarded, over, it seems like
over the last year, with one thing or another about how quickly AI is moving
forward and how big of a deal it is, suddenly is going to be, in the economy.
What is the impact of that dramatic change in AI’s capabilities
on the cybersecurity question?
So what does it mean if you’re defending somebody that you now have these
sophisticated AI tools at your disposal?
I think that AI becomes the force multiplier for cyber.
To think about cyber before—it was just locking your doors.
Locking the windows.
And if you were really good, you had an alarm system, you know.
Now, with AI you can say, “Well, I can predict what’s going to happen.
I can see around the corner.
I know I can leave my windows open upstairs, and it’s fine, and it’s okay.”
You mean—why?
Because the AI is running a million simulations?
It can, and that’s exactly it.
It becomes the intelligent part of that AI.
It’s not artificial, it’s augmented.
So you now have this new capability to see around corners.
And so you’re able to do the jobs of yesterday more effectively, of—and the,
the, the queries that you were doing.
And that’s all you’re really doing.
Now you’re doing them, you know, faster.
You’re able to access even more data, and you’re able to then make it more secure.
So that’s why AI becomes a force multiplier.
Yeah.
And let’s talk about the “faster” part.
What does “faster” mean, in practical terms, if you’re trying to defend
an enterprise against a cyberattack?
Why does speed matter in that environment?
You’re always trying to find a pen . . . a place through.
I go back to—you brought up the Army.
You always.
. . . How do you break the line?
How do you find a penetration point?
And when you think about, you know, pin testing, penetration
testing, where are those?
So if you’re able to do that faster than the bad guys, and—not only faster, but
you’re picking more-probable points.
This is back to the intelligence.
I could waste time doing penetration testing someplace where—that’s why
I mentioned, if they can’t get in the second-story windows, why are
you spending time trying to . . .? So that becomes more effective.
So that’s when I think of speed.
That’s what I think of, because with—not just speed.
I think it’s also what’s effective.
Just to put a, put a fine point on it.
So I found a way in.
Okay, now what?
I don’t know where the jewelry is, so I have to look around and
see if there’s any, uh, hidden gems, and try to find my way.
That used to take a week, two weeks, or 7 to 14 days.
Now it’s hours, right?
So they’re in and they can actually exfiltrate data within less than a day.
The metric we use in the security operations center is “mean time
to detect” so—to see anyone’s there, “mean time to respond and
remediate” to get them out, right?
That used to be also, you know, 7, 8, 9, 10 days.
Now it needs to be less than an hour.
Uh, and with our AI-based security operations platform, it is.
Now you’ve got one tool that’s—whether, whether it’s all Palo Alto Networks or
whether it’s just, you know, “hoovering in” data from other places, then
you’re able to see it all together.
So you actually get fewer alerts.
So you get from thousands of alerts down to a hundred alerts.
Right?
And you can investigate them, and you investigate them using AI too.
And AI is, is today—it’s today’s threat, but it’s—you know, you
think about threat and opportunity, you think about what’s next, you
always have to be kind of evolving.
And you have to think—we talk about threat and risk.
You know, we didn’t talk, you know—what is the cost of
cyber—some type of penetration.
You know, the typical cost is about four, four and a half million dollars.
Uh, and that’s just in labor and remediation.
If you think about reputational risk as well—our Institute for Business Value
did a study and found that in 2023, there were 39 banks that, that we watched,
that, uh, suffered a reputational risk.
A market value of $130 billion.
And so you start to think, wow, that’s just reputational risk.
Mm-hmm.
So that’s what’s at, at stake here.
It’s, it’s—and that is only going to get bigger.
Yeah.
So one of the pieces we haven’t talked about AI that I find super
interesting—because we’ve been talking, essentially, about,
um, like the Terminator, the robots fighting robots, right?
Like, whose robots are quicker?
Like, I’m designing attacks and I’m defending against attacks.
And I think that’s, that’s super important.
But, uh, we recently launched and are working with IBM on our AI
security product to actually secure the use of AI, because it also opens
up another set of threat factors.
Um, I’ll give you an example.
I’m a marketing executive, now, for your hospital, so I work for you.
And you want to announce the launch of a new center.
And so I upload all the information about all the patients and our—you
know, how we do things—into ChatGPT to write the PR for me.
Well, I’ve also just uploaded to ChatGPT a whole bunch of secrets, right?
So, um, it’s, it’s how employees are using AI.
Because I think, you know, some companies are sort of building their own language
models and their own AI applications that they want to keep secure.
Others are just curious about how their employees are using
AI applications on the shelf.
And so we announced in May a product where you can actually scan and see how
AI is being used in your enterprise.
And within—we, we made the announcement—the GA was last month,
but we made the announcement in May.
And we had immediately thousands of CIOs signing up.
Because just understanding, you know, who’s using what—it’s
another open question.
Because, you know, we talk about AI enhancing productivity and all the
benefits it’s gonna bring, but it brings, it brings risks, not just
in how it’s being used by the threat actors, but also, you know, what
other vulnerabilities it exposes.
Is the AI that you—does that system tell you what is a problematic use?
It does.
So, it—what, what it does—and you’ve got to train it, right?
But what it does is say, “This is—this is outside of your policy.” So CIOs
will set policies on, “Here’s what is acceptable and not acceptable use.” So
we’ll be able to scan and say these—these following uses are outside of policy.
And then it’ll say, “I think this is too restrictive; I think this is too
permissive.” And then you can sort of update your policies from there.
That’s just sort of the visibility piece.
And then there’s the run-time piece, which will actually stop you from using it.
So you go and say, “Okay, here’s all my patients’ Social Security numbers.
I’m going to upload them to ChatGPT to, you know, get an understanding
of, like, where they all live.” I don’t know what—why you would possibly
do that, but let’s say you were.
And then, um, you know, it’ll note, “That looks like a Social Security number.
You can’t upload that into your prompt.”
Oh, it will stop you before you—a thoughtful voice over your
shoulder, just to remind you not to do something silly, yeah.
Exactly.
But this is—just talk a little bit more about adding AI into this mix.
You say it’s a “force multiplier.” It’s a really interesting—just dig into that.
What—other, other instances of what that means.
How does the balance between AI and, um, human expertise work in the, kind
of, next generation of cybersecurity?
I think the, the common way to look at it is, back to the force multiplier—it’s,
it’s not going to be “Is your AI better?” but “Can you use it better?
Can you ask your AI the right questions?
Are you well trained?” So the competition really becomes your use of AI.
And are you pointing it in the right direction?
You have 50 people.
Can they do the work of 250, and can they do it in a safe and secure manner?
So you’re not opening up more risk based on—or too much risk, as your risk
tolerance, in order to get the outcome.
So that’s why I think there’s the opportunity.
And so you see this truly as a force multiplier, because the first thing,
people go, “Oh, you’re going to get rid of people.” No, the people
portion is still—still going to be just as important, because they’re
doing that other piece of work.
One of my favorite statistics is that there are now more
bank tellers in the U.S.
than there were in 1960, before the ATM was invented, right?
So—but it used to be, you would go to your bank—because you had to, I remember
doing this!—you’d go, you’d fill out your deposit slip, you’d hand it to the
teller, and they’d give you your cash.
And then ATMs were invented and it was like, “Oh, no, what’s going to happen to
all of these jobs?” And now there’s more.
But you’re not withdrawing money from a bank teller; you’re doing
more-sophisticated transactions.
I think it’s similar with AI, right?
Like, you want people doing things that only people can do.
The human element remains absolutely central in all this.
Um, how do you make sure that your cybersecurity folks are equipped to handle
high-value tasks—are, sort of, ready for this increase in responsibility?
There’s a couple ways to answer this, but I think the more you’re able to automate
the routine and the mundane tasks.
For example, the bulk of cybersecurity happens in the security operations center.
There’s analysts who are sitting in that center.
If they’re spending all day either configuring, um, alerts or
responding to alerts, they’re not able to do the advanced sort of
threat hunting and analysis work.
And so I think a big chunk of it is just freeing up their time to be able
to do the more-advanced strategic work.
Um—and a lot of the automation tools based on AI, like our Cortex XSIAM product,
um, is, uh—it’s designed to free up their time in order to be able to do that.
And from our perspective, it’s making sure that—it’s a requirement to make
sure that you have the qualifications.
Because people can easily get used to doing what they’ve always done.
And “That’s, that’s what I do.” You say, well, no.
All the threat actors are learning on the fly.
They’re trying to always outsmart you.
So it’s in your best interest, our best interest, our clients’ best
interest, and partners’ best interest, that you are on the front-leading edge
of that, that learning capability.
If you’re talking to a client who wants to develop a kind of unified
cybersecurity strategy, what’s the best single piece of advice you can give them?
You should have a single platform.
It’s hard not to answer that, but it is true.
I mean, all joking aside, having um, you know, the, the best-of-breed solutions
that are all talking to each other and able to stitch together, uh, and identify
threats before a human might be able to.
Um, that’s number one.
And number two, uh, is making sure you have visibility on all elements.
So, uh, you’re able to cover your whole environment and understand
how people are accessing it.
I’d say, “Think like a bad actor.” Always think “outside in.” Because you
get comfortable the other way around.
You guys work together on a—with a Fortune 500 company, and I’d love for you to talk
a little bit about—to use that as a kind of case study for what this collaboration
between the two—your two companies looks like when you work with a client.
It really was, you know, IBM leading on a digital transformation for
this, this client that wanted to move their applications into the cloud.
And so you’re asking a lot of questions about, “How does AI increase the,
the risk in the surface area?” Those same questions 10 years ago were
asked about the cloud, and, and we’re still on the journey where, where
companies are migrating to the cloud.
We’re not anywhere near finished that yet.
And so there’s two pieces to a cloud migration.
One is just refactoring for the cloud, to make sure the application
works effectively in the cloud, and the second is security.
And then you built in security by design, using Palo Alto’s Prisma
Cloud products, to make sure that not only did you have the visibility—so,
our cloud product—you can scan and see where the vulnerabilities are.
And then there’s also, you know, cloud firewalls, essentially,
that will keep bad actors out and keep the cloud instance secure.
If we sit down and have this conversation five years from now—which I actually
hope we do; it’d be fun—so, let’s go, let’s, let’s, let’s pretend it’s 2029.
Tell me, what are you happy about in 2029?
I think 2029, quantum computing is mainstream.
I think quantum computing is now quantum safe, where we’re using quantum computing
to make sure that those bad actors aren’t as bad as they used to be back in 2024.
And that we’re—we’re seeing around the corners, and that we’re empowering
our Palo Alto relationship that, in 2029, is the premier type of
capability that people are looking at when they think of what used to
be AI and now is quantum capability.
Yeah.
Yeah.
Kristy?
I think for, for AI, everyone’s just using it as part of their job.
The way email was an innovation in the ’90s; the way, you know, cloud
was an innovation in the 2010s.
And we thought, “How are we going to use this?
What impact is it going to have on, on productivity?
All these people who are spending their days typing up memos, like, what
are they going to do?” We’re going to be past that fear, and we’re all
going to understand that it is this, like, truly positive force multiplier
for—you know, every employee is able to do their best work and, and spend
their time on, on the things that only they can do, and then the AI is doing
the rest of that for them, right?
AI is going to enable many things to work together.
It won’t be just one language model.
We won’t even think about it.
It will be the difference between, you know, Malcolm having
a fax machine, a stereo, and a telephone, and a—and a memo board.
Now it’s in your pocket and it’s all one thing.
And you don’t even call that—you know, I said “Walkman” to my kids the
other day and they’re like “What’s a Walkman?” Um, so I, I do think it
will, it’ll be part of the past, and it’s—it will be this thought of this
seamless connection—that is, secure, seamless connection of HR, of finance,
of distribution, logistics, of billing.
All of those will have a capability to work together.
Yeah.
I have to do some social quick-fire questions.
Are you guys ready?
All right.
What’s the number one thing that people misunderstand about AI?
The reliance on data.
What do you mean by that?
I think that it’s just assumed that it’s happening and it can
just go out and grab data anywhere.
Oh, I see.
Yeah. Oh, I see.
Yeah, yeah. You have to have good data.
Reliable data, and access to the data.
I think people are too afraid of it.
Chatbots and image generators are the biggest things in consumer AI right now.
What do you think is the next big business application, Jason?
I think it’s the tying together of multiple capabilities.
I, I hinted towards this earlier—is that—I think tying together the disparate
systems that sit in different parts of the organization—front office, back
office, making it one office—and tying together those different functions.
That’s it.
For me, it’s workflow automation.
I think, back to your point on . . . the reliance on data seems easy.
It’s a lot harder than you think.
Because you have to have everything set up in exactly the right way to get
all of your systems automated, and the more-boring jobs taken care of so that
humans could do the strategic ones.
How are you already using AI in your day-to-day life?
I mean, I use it at work all the time.
Um—and then I’ve found, right now, I go to ChatGPT instead of
Google, uh, to look things up.
I like having a conversation.
We have a wonderful, uh, capability in our consulting business called,
uh, our consulting assistant.
Uh, uh, Consulting Advantage is the proper name for it, but I
look at it as a, that assistant.
It, it’s a force multiplier for me, so if I need to, to, to pull
together content, proposals with the teams, we go straight to that.
We got one more.
We hear so many definitions of “open” related to technology.
How do you define it, and how does it—the concept—help you innovate?
By definition, in cybersecurity, you don’t want to be too open, right?
So I think we enable openness, um, with this concept of “zero trust,” and saying,
like, everyone’s invited in as long as you have the right credentials, right?
So that’s, that’s one way.
And then the other way is just making sure you’re connected to all the different
systems, uh, in order to be able to have that visibility and see what’s happening.
Because if you are blind, um, that’s the minute you have that vulnerability.
Yeah.
And I’d say it’s moving quickly with security.
It sounds contradictory.
“Open.
Oh, then it means you’re not safe.” No, you are safe and you can move faster.
Yeah.
Thank you so much.
This was fun.
Thanks a lot.
This was great.
We’ll see you in five years?
Yeah, five years.
See you in five years. Yeah, that’s right.
Man, I’ll be old in five years.