00:10:25 · Sebastian Johnson
[00:10:25] S0: And and how has it been since joining Google? So I know that you're still, you know, sort of separate, but you're obviously part of this amazing... Much bigger organization now during this incredible period of transformation. What's it been like sort of joining that company?
00:10:41 · Yinon Costica
[00:10:41] S1: It's so first, yes, we we remain independent. So in a way, it continues to be Wiz. But at the same time, I think that having access to resources that we could only have imagined before, For instance, access to threat intelligence that we can now embed into our products and, like, they are available to any customer through... With product, put us at the... Maybe the front, like, the best powered threat intelligence powered security product because of that access now that we have and the ability also, obviously, to leverage access to AI. Access to AI when we think about the AI capacity, the infrastructure, but also in terms of access to advanced AI models that maybe are not yet accessible to the public, and also the ability to control our own destiny in a way and train models on tasks that Wiz cares about. And I think the results are also published recently with Cyber Gemini and other capabilities that are coming, I think that this this ability to do it at scale, given the access to Google, is obviously... For engineers, it's, you know, it's a it's a really fun ride, and it provides us a really additional means to power up Wiz. At the same time, we also have a very significant go to market motion now powered by the Google broader field. And I think that this is another benefit that accelerates our business. I think it was mentioned in a few cases. Wiz experiences tremendous growth before Google and let alone now in Google, part because of, I would say, the AI transformation and the need to secure AI, part because of the product... New products we release, and part because of the acceleration with Google. So a lot of great stuff.
00:12:45 · Sebastian Johnson
[00:12:45] S0: And can we talk about Scan for Good? Because my understanding is Scan for Good. It is... I think it was released this week or last week. It's run on Red Agent, I think it's a good example of where it's, you know, like, Wiz product, but it sits on top of one of the Gemini models. Right? So can you talk a bit about that... Yeah. What it is and and and how it's operating?
00:13:03 · Yinon Costica
[00:13:03] S1: I'm very proud of Scan for Good. I actually think this is a really good example of what we can do when we are part of Google. And, basically, we talked about the red agent. The red agent allows, let's say, any organization that is connected to Wiz to scan their attack surface and validate exposures like it's your own pen testing. Okay? It's scale all of the time. So that's great. But at the same time, we also have a responsibility over critical infrastructure that we use, health organizations, organizations that maybe don't have the same access they have with Wiz today. They don't even know what's their attack surface. And the ability to really leverage the red agent in a setup that is Scan for Good, that secures our foundations as as an... As a society. Right? The ability to apply the red agent at scale and provide findings to the teams that actually can now be ahead of the attackers and have the first mover's advantage and fix it before the AI powered threats find them in a way. I think this is an amazing example of how we can scale what we did at Wiz and provide a... I almost see it like a a sheltering umbrella, right, on organizations that are critical to us. And this is one example. I also think that it it comes from a deep understanding that we have in Wiz in the research team, and I think in general in cybersecurity that the introduction of AI capabilities changes how we think about defense, how we think about security. Security in the past was a lot about risk management and thinking what is more probable than others, what's the impact, what's the likelihood. And I think that today, we need to go on the offense in the sense that we don't need to analyze for impact and the likelihood in the same way we did before. We can actually have the best test, which is can we attack ourselves? And when we find something, that's gonna be the trigger to start a remediation process. So I think that Scan for Good offers it for many organizations that we want to secure today, not tomorrow, and, you know, some kind to get them ahead of the curve. But, also, I think it represents for the greater market how security should look like in the future, moving from a very, let's say, reactive, maybe more responsive to alerts and threats to something that is... As much as we can, we have to apply AI attacks against ourselves.
00:15:43 · Yinon Costica, Sebastian Johnson
So we so we have the first mover's advantage. And that's gonna be the future of security as I see today. That's probably one of the biggest advantages defenders have today, that they can actually do it and unlock immense capacity that up until very recently was bottlenecked by very few expert... Like, experts that we had access to. [00:16:08] S0: Can you give [00:16:08] S1: some exciting moments? [00:16:09] S0: Mean, it's amazing. Was reading some of stuff about Scan for Good. Are there any examples that you can share on some of the things that you found? Because when I was reading it, was like, this is crazy. I mean, like the the the security flaws and some of these, like, critical bits of infrastructure is, like, seriously concerning.
00:16:27 · Yinon Costica
[00:16:27] S1: Yes. And I cannot share specifics. We are sharing examples in our blog post. Think the reason that we share it because it's really important for us to explain to the community, to the industry the change in what AI can identify. And to to simplify it a bit, I hope I'm gonna simplify it, but think about the challenge of really understanding an application. In the past, you had to have a human really going into understanding this API and that API and how how the application works and what it does and where is the... But today... And and by the way, this was a a great barrier in a way because you you needed a very determined attacker start analyzing your application and, you know, do the research. And, you know, there are enough of these, but it wasn't trivial. AI made it trivial. AI can look at your application, can understand the intent, can understand the code, can do a lot more than a human pen tester can do. So it unlocked first, speed because it's automated. Second, scale. I can test everything. And third, it unlocked expertise that was very scarce in the past. So I think that when when we realize how much of the attack surface now is essentially exposed in ways that it wasn't exposed before, or at least it wasn't as easy to automate as it is today. I think this is the main message we need to drive. And we have to have... Going back to my last point, I think we have a a unique time where defenders can move fast and remove these exposures before they become actual incidents. And this is exactly why... If you look at the gun exam... By the way, many examples I can share. Almost any example that we see, and this is what's a bit fun for security folks here, you look at the findings by the red agent, and you're like, how did it find it? Crazy. Like, every every attack is a bit different. You see you see authentication bypass attacks. You see secrets that are exposed in ways that you didn't think about, but AI found it, and then it was able to carry on subsequent attack with these secrets. And I think that it can connect APIs. And you're thinking, how did he think to plug in that API with that API in order to exfiltrate sensitive data? And every attack we find, I think it's it's it's still excites me to see how how intelligent it is. Right? Yeah. So please read the blog. There are many details there. Some of these are actually...