00:13:03 · Yinon Costica
[00:13:03] S1: I'm very proud of Scan for Good. I actually think this is a really good example of what we can do when we are part of Google. And, basically, we talked about the red agent. The red agent allows, let's say, any organization that is connected to Wiz to scan their attack surface and validate exposures like it's your own pen testing. Okay? It's scale all of the time. So that's great. But at the same time, we also have a responsibility over critical infrastructure that we use, health organizations, organizations that maybe don't have the same access they have with Wiz today. They don't even know what's their attack surface. And the ability to really leverage the red agent in a setup that is Scan for Good, that secures our foundations as as an... As a society. Right? The ability to apply the red agent at scale and provide findings to the teams that actually can now be ahead of the attackers and have the first mover's advantage and fix it before the AI powered threats find them in a way. I think this is an amazing example of how we can scale what we did at Wiz and provide a... I almost see it like a a sheltering umbrella, right, on organizations that are critical to us. And this is one example. I also think that it it comes from a deep understanding that we have in Wiz in the research team, and I think in general in cybersecurity that the introduction of AI capabilities changes how we think about defense, how we think about security. Security in the past was a lot about risk management and thinking what is more probable than others, what's the impact, what's the likelihood. And I think that today, we need to go on the offense in the sense that we don't need to analyze for impact and the likelihood in the same way we did before. We can actually have the best test, which is can we attack ourselves? And when we find something, that's gonna be the trigger to start a remediation process. So I think that Scan for Good offers it for many organizations that we want to secure today, not tomorrow, and, you know, some kind to get them ahead of the curve. But, also, I think it represents for the greater market how security should look like in the future, moving from a very, let's say, reactive, maybe more responsive to alerts and threats to something that is... As much as we can, we have to apply AI attacks against ourselves.
00:15:43 · Yinon Costica, Sebastian Johnson
So we so we have the first mover's advantage. And that's gonna be the future of security as I see today. That's probably one of the biggest advantages defenders have today, that they can actually do it and unlock immense capacity that up until very recently was bottlenecked by very few expert... Like, experts that we had access to. [00:16:08] S0: Can you give [00:16:08] S1: some exciting moments? [00:16:09] S0: Mean, it's amazing. Was reading some of stuff about Scan for Good. Are there any examples that you can share on some of the things that you found? Because when I was reading it, was like, this is crazy. I mean, like the the the security flaws and some of these, like, critical bits of infrastructure is, like, seriously concerning.
00:16:27 · Yinon Costica
[00:16:27] S1: Yes. And I cannot share specifics. We are sharing examples in our blog post. Think the reason that we share it because it's really important for us to explain to the community, to the industry the change in what AI can identify. And to to simplify it a bit, I hope I'm gonna simplify it, but think about the challenge of really understanding an application. In the past, you had to have a human really going into understanding this API and that API and how how the application works and what it does and where is the... But today... And and by the way, this was a a great barrier in a way because you you needed a very determined attacker start analyzing your application and, you know, do the research. And, you know, there are enough of these, but it wasn't trivial. AI made it trivial. AI can look at your application, can understand the intent, can understand the code, can do a lot more than a human pen tester can do. So it unlocked first, speed because it's automated. Second, scale. I can test everything. And third, it unlocked expertise that was very scarce in the past. So I think that when when we realize how much of the attack surface now is essentially exposed in ways that it wasn't exposed before, or at least it wasn't as easy to automate as it is today. I think this is the main message we need to drive. And we have to have... Going back to my last point, I think we have a a unique time where defenders can move fast and remove these exposures before they become actual incidents. And this is exactly why... If you look at the gun exam... By the way, many examples I can share. Almost any example that we see, and this is what's a bit fun for security folks here, you look at the findings by the red agent, and you're like, how did it find it? Crazy. Like, every every attack is a bit different. You see you see authentication bypass attacks. You see secrets that are exposed in ways that you didn't think about, but AI found it, and then it was able to carry on subsequent attack with these secrets. And I think that it can connect APIs. And you're thinking, how did he think to plug in that API with that API in order to exfiltrate sensitive data? And every attack we find, I think it's it's it's still excites me to see how how intelligent it is. Right? Yeah. So please read the blog. There are many details there. Some of these are actually...
00:19:15 · Yinon Costica, Sebastian Johnson
We are sharing the the details of... The exact details. Some are more general. [00:19:20] S0: Yeah. I mean, I I think there's something like 470 incidents found or vulnerabilities found. [00:19:27] S1: And counting. [00:19:28] S0: Yeah. I mean, it's crazy. I I think the one that was was was insane almost was that it didn't say what country, but it was a European country, I think, with the national archive. And there was the ability to access and delete something like 9,000,000 files or something. And this is, like, of the National Archive. It's, the job is to keep... You know, to, like, hold down these files. [00:19:50] S1: You hit the nail on the head. So you... It's like, in a way, I'm seeing many of these attacks, and I'm saying, like, it... Like, it's it's almost like someone scripted it. Like, in the national archive, I'm find... Like, we can find delete all vulnerability from remote. And you're like, it's it's it's like someone scripted it. And times and again, we find these examples. I I I don't know what I can share and and not, so I'll be I'll be cautious here. But there are many examples that you are like, someone scripted it. Someone scripted it, otherwise, you know, it's impossible.
00:19:50 · Yinon Costica, Sebastian Johnson
[00:19:50] S1: You hit the nail on the head. So you... It's like, in a way, I'm seeing many of these attacks, and I'm saying, like, it... Like, it's it's almost like someone scripted it. Like, in the national archive, I'm find... Like, we can find delete all vulnerability from remote. And you're like, it's it's it's like someone scripted it. And times and again, we find these examples. I I I don't know what I can share and and not, so I'll be I'll be cautious here. But there are many examples that you are like, someone scripted it. Someone scripted it, otherwise, you know, it's impossible. [00:20:26] S0: Yeah. Yeah. It's crazy. Right now, where do you think the power lies? I think you've spoken about this a bit before, but you're right. The the technology is amazing at being able to find these vulnerabilities. Both for me, how sophisticated do you think the attackers are getting? Because, you know, you're finding these things before they are. Where does that power lie between the companies that are trying to protect themselves, the defenders, versus the attackers? Do you think the defenders have a bit of a head start in being able to sort of lock their stuff down? Or are the... Do you see... You know, are you worried about the increased sophistication of these attackers?
00:21:01 · Yinon Costica
[00:21:01] S1: I think that, essentially, when we all start today with access to the same data, let's say, we just try to apply a model against ourselves, so we are on par. Right? So, you know, an attacker could do it in the same way the defender can do it. And attackers, they always have the attacker asymmetry, so they need to find one. We need to, as defenders, to protect against all. But the reality is that the technology today for defenders gives us, maybe for the first time, by the way, gives us a huge advantage in three dimensions. One, our ability to leverage our own context is key. Because if only only me, only... Let's say let's say I'm an organization, and only I, as an organization, have access to the infrastructure, the code, the application, the inventory. And I can use that context in order to have a comprehensive scan across everything that an attacker cannot do. Attacker can have my domain and start from there, maybe some discovery, but they don't know the behind the scenes about my... Hopefully. They don't know the behind the scenes about my environment. And I think that this is a huge advantage because it gives us... As a fact, it gives us a first mover's advantage in so many cases. So that's one. The second thing is that I think AI allows us... And that's a point that is not spoken about enough in in my perspective. But AI is giving us immense capacity to unlock threat intelligence at the speed... Almost speed of light. Right? So it's like immediate threat intelligence and machine speed. Because when we think about creating threat intelligence in the past, it was a very tedious process that we had to gather a lot of signal and scrutinize and make sure that the... We call it IOC, indicators of compromise are indeed unique and so on. And then we had to propagate it to the rest of the world. And this process took days, weeks. But today, we can all... We can... Like, Wiz closes the loop in literally minutes. We see very few signals, and AI can see through these signals and understand that there is a new IOC. It can actually perform all of the tests, automate, scrutinize, see that it's unique, and so on. And then we can automatically propagate now the IOCs. Now threat intelligence is the ability to immune ourselves against attackers. And now we have immense capacity to do it at scale that we didn't have up until now.