00:11:21 · Matthew Prince
[00:11:21] S2: Yeah. I mean... So so first of all, you don't need AI to take advantage of the vulnerability in this case once it's been discovered. So the the people who are trying to exploit this now, they're not using models to exploit it. They're just running they're running, you know, fairly simple scripts that are just, you know, trying to check every single server, every single IP address online Yep. To see if it's vulnerable to take it over. Mhmm. What what I think has changed is the rate at which attackers can figure out what they do when they find themselves in an environment. So about a year ago, there was a very, very, very popular plug in that plugged into Salesforce that got compromised by a Russian hacker. And it was it was so broadly deployed that it effectively gave the Russian hacker access to a huge portion of Salesforce's infrastructure and Salesforce's customers. But what was interesting was when you actually studied what the attacker did, they clearly... Like, they they weren't in enterprise sales. So they didn't really know how Salesforce worked. Sure. And so they kind of bumbled around like not quite knowing what to do or the fact that they'd stumbled on what was an incredible treasure mine. And as a result, what could have been just a disaster of a hack wasn't nearly as bad. What we're seeing now is if that same hack happened today, the attackers are using AI to say, okay, I found myself in Salesforce. What what stuff should I go, you know, looking for or stealing or trying to do? So the ability to very quickly, you know, figure out I'm here. What what what can I take advantage of, You know, is gotten there? What we're not seeing yet are, you know, I think that the example out of OpenAI with the hugging face compromise, I mean, that again makes, I mean, it's almost out of science fiction, some of the things that are happening there. But I think the good news is that the cost of running that type of Intact, an agent swarm like that is still extremely expensive. Hundreds of thousands, if not millions of dollars for that. And so an organization like, you know, OpenAI that's got those resources, the good guys have more resources than the bad guys. Yep. And so for now, I think you're you're actually seeing kind of a very naive use of AI by by at least the sort of typical cyber criminal.
00:13:40 · Matthew Prince, Jordi Hays, John Coogan
He's probably different when you're looking at nation state actors. I think that if you if you look at China or Iran, the NSA in in The United States, like, that... That's a different case. But but right now, I think that AI is actually helping the good guys more than it's helping the bad guys. Yeah. We're finding the monsters that are hiding in the closets and... [00:14:01] S1: What advice would you... So over the last week, we had open... Like, a open code ran into issues and reported being, like, attacked for basically days on end. Obviously, the attackers were going after the... [00:14:16] S0: It was token theft. [00:14:17] S1: Yeah. Effectively token theft. [00:14:19] S0: It's the modern version of... [00:14:20] S1: Railway. Railways had had massive issues over the last twenty four hours. I know of another big inference provider that has been, like, under attack and, like, viscerally feeling that for the last three, four days. Wow. And that that that people... That everyone And would [00:14:39] S2: this is... And what this is probably... What a lot of these are symptoms of are the attackers are like, wow. We could do a lot more if we had more compute, if we had more AI models. And so stealing tokens [00:14:50] S1: Yeah.
00:14:51 · Matthew Prince
[00:14:51] S2: You know, hacking inference providers, That... That's that's giving them access to tools. We... You know, you'd see this before. Like, it's... For a long time, Cloudflare was an Okta customer, and Okta kept getting hacked over and over again. And the reason why... And Okta was an identity provider. I mean, the the reason why was they were going after us and they were going after Coinbase, which is another another one of their one of their customers. And again, I think you... The attackers are trying to find their way to whatever is valuable that they can that they can get to online. And and I think right now, the ability to have more inference, more tokens is something that attackers are very much longing for. And so they're going to go after a bunch of those providers. And then to your question of what to do, like you got to just stay up on all of the security patches that are out there. You know, my... I I don't know the the the details of, like, the railway attack, but my hunch is it's probably based on one of these, you know, latest vulnerabilities that was out there. And so it's just, you you know, they... You talk about like an ODA loop, which is like how quickly you can adapt versus your attacker. And so at Cleflo, we're just sort of saying how can we make that ODA loop faster and faster and faster and faster so that we can adjust incredibly quickly. And part of that is using AI tools and using things that can actually proactively you know, have a swarm of defenders that are looking out for the swarm of attackers. And and that's that's exactly what we're doing at at Cloudflare and what we're doing for all of our customers.
00:16:14 · Jordi Hays, John Coogan, Matthew Prince
[00:16:14] S1: Do you think that ski resorts are ready for this new wave of cyber vulnerabilities. I'm I'm joking, but I'm joking, but I'm actually... [00:16:23] S0: Yeah. People have been talking about bringing down the grid. [00:16:24] S1: If you bring down a ski resort, that's actually... You're out Very popular. You're out getting a couple laps in and the I mean, I was... And the lift signs to a halt, your your first thought might be, oh, is this kind of like a ransom attack? [00:16:36] S2: Or the the snowmaker turns on when it's not below freezing and just sprays water all over everyone. It could be a horrible thing. I mean, and I think that, you know, I I I have some insight into into a into a certain ski resort operator called Vail and and some of the the board meeting conversations with the activists. And and one one of them, the... An alternate person for for this lady, named Bryce Roberts, who's a great VC. I think you've had him on. [00:17:04] S1: Yeah. We love Bryce. [00:17:06] S2: He he he... He's he's up to to to to be a candidate unveiling. And he said, have you guys thought about AI at all, like, in terms of that? Because it's something like, you know, 30% of questions to AI are about trip planning. And like literally everyone in the room scratched their heads and said, oh, we haven't thought about that at all. There's a there's a lot of there's a lot of there's a lot of industries that that need some serious modernizing and and a lot of management teams that need some serious modernizing. And I might point at Veil as being one of those.
00:17:06 · Matthew Prince, John Coogan
[00:17:06] S2: He he he... He's he's up to to to to be a candidate unveiling. And he said, have you guys thought about AI at all, like, in terms of that? Because it's something like, you know, 30% of questions to AI are about trip planning. And like literally everyone in the room scratched their heads and said, oh, we haven't thought about that at all. There's a there's a lot of there's a lot of there's a lot of industries that that need some serious modernizing and and a lot of management teams that need some serious modernizing. And I might point at Veil as being one of those. [00:17:32] S0: Yeah. Last question for me. It seems like the balance between attackers and defenders is going to be increasingly infrastructure driven, and I feel like this might change the discussion a little bit, maybe not at a national level, just around the AI data center build out because there's a certain amount of just if you have a bigger data center with more GPUs running more inference to secure systems and you're going up against a smaller data center with a similar model or a distilled model that's three months behind. Like, you want as many advantages as possible. And I'm wondering if you think that, like, raw compute power becomes an important discussion in, like, the geopolitics of cybersecurity.
00:18:15 · Matthew Prince
[00:18:15] S2: Yeah. You know, I mean, maybe at some level. I think that, again, I think I'm encouraged that it's the good guys have more resources than the bad guys. And that's, I think, that's going to help the defenders stay in touch. But you've got to have great partnerships between companies like OpenAI and Anthropic, companies like Cloudflare and others in order to make sure that this is going forward. At some level, the whole thesis of Cloudflare from the beginning was that if you got enough internet traffic flowing through a system and then you could use machine learning to look for patterns and attacks and threats that you could that you could see things and stop things. And I think we're really good whether that's an attacker working for North Korea or it's a swarm of agents at identifying those things and staying in touch with it. And I think that's why we're seeing such just real demand for our services and more and more people signing up for Cloudflare. And again, I think it's important to us to say that you don't have to pay us in order to stay safe online. We want to make sure that everyone has the resources regardless of what their budget is. And so we continue to be committed to this. And again, I wish I could say that this was like a really unusual or bad week, but I think for the next two years, we're going to basically have kind of a week like this on average almost every week where big vulnerabilities are getting released. We already know about a number of substantial other vulnerabilities that will come out over the, you know, coming weeks or months. Sure. And and the good news is that we're ahead of them and we're and we're protecting them. And if you wanna make sure that you're protected, using a service like Cloudflare is one of the best kind of, you know, bandwidth.