CyberWire Daily at 10: Developments in AI and machine learning over the past decade.

Maria Varmazis: Hello, I'm Maria Varmazis, and you're listening to a special edition of the CyberWire. In this episode, I'm speaking with the host of the "CyberWire Daily," Dave Bittner, about the last ten years of AI in cybersecurity, as we take a look back at ten years of the "CyberWire Daily." Here's our chat. [ Music ] All right, it is my distinct pleasure once again to welcome back the host of the "CyberWire Daily," Dave Bittner. Hi, Dave.

Dave Bittner: Hello, good to be back.

Maria Varmazis: Yes, thanks for joining me yet again. And we are as we have been all year talking about the ten-year anniversary of the "CyberWire Daily." Again, congratulations, Dave. That is a wonderful milestone.

Dave Bittner: Thank you.

Maria Varmazis: And we've been in these conversations eventually getting to a topic and ringing the bell of oh, we have to talk about AI. It just feels inevitable when we talk about cybersecurity nowadays.

Dave Bittner: Right.

Maria Varmazis: We're getting that out of the way real early in this conversation today because we're going to be talking about AI and cybersecurity as our topic for today. So --

Dave Bittner: Right, right.

Maria Varmazis: -- ding a ding a ding. Here we are. We're talking about it the entire time today.

Dave Bittner: Yes, it's a funny thing because I feel like in my interviews, you know, as a interviewer you always have go-to questions, right? I refer to it as a bag of tricks. You know, there are things that if you find yourself out of things to ask or for some reason distracted or flummoxed, you can reach into your bag of tricks and buy yourself some time in these days.

Maria Varmazis: You're giving away our secrets to people.

Dave Bittner: Oh, sorry. But these days --

Maria Varmazis: No, no, we're brilliant. We always think on our feet.

Dave Bittner: That's right.

Maria Varmazis: We don't have shortcuts. Yes, it's great.

Dave Bittner: Exactly. Spontaneous. Yes, but these days you can always say, "Well, how does AI affect this?" And off you go, right?

Maria Varmazis: Off you go. Yes, there's always a great answer to that one because inevitably it's doing something. So, when I was preparing for this chat, I think I'm having the same whiplash every human being is having with how much AI as a concept, as a broad umbrella of technology, has quickly progressed in just the past months, if not years. So, trying to go back ten years thinking about this, I'm not sure how much of my own recollection I can honestly trust. Just putting that out there.

Dave Bittner: Yes.

Maria Varmazis: But if -- I'm trusting you a lot more than I'm trusting myself, Dave, if you can go back ten years and remembering, we were talking about AI back then, but it to me seems like it was one day far off or very vague. We're not there yet tech. Maybe your recollection is different. What do you remember?

Dave Bittner: I think you're right. I was -- I think back then it was more the promise of AI versus the reality and much of the AI that was happening was happening under the hood and it wasn't anything that a regular user could really get their hands on. It was just this thing that the folks with technical expertise had included in whatever platform or package you had purchased and it was somehow going to help you do your work more quickly, more efficiently, more securely, all those good things. I want to say it was 2016 or so was the year at the RSA conference was the first year that everything was AI.

Maria Varmazis: Oh.

Dave Bittner: And it was that kind of AI. It wasn't large language models. It wasn't chatbots. It was just everybody. If you were selling a product, you had to say somewhere under the hood, there was AI. And --

Maria Varmazis: That hasn't changed in ten years. Yes.

Dave Bittner: It has -- no, it hasn't changed. But there was a lot of eye rolling back then because I think the notion of what it is and what it could do and like there are still people who get bent out of shape when you say AI versus machine learning and is it this, is it really that or you know, and you have those debates and conversations till the cows come home. But I guess the challenge back then was how much of this is real and how much of it is marketing, particularly when it's all under the hood and you really can't see it yourself?

Maria Varmazis: Were you seeing it in specific contexts at that time? I mean, I know it was sort of being spammed everywhere as the you know, marketing team has been given their directive. You have to include it. But were there certain defense or attack areas that were seeing you know more successful deployment? And if you remember any of this, what was the (inaudible)?

Dave Bittner: Yes, I mean I guess the promise was that these AI systems could recognize attacks that had never been seen before. Right? So, we were coming from the days of indicators of compromise and malware signatures. So, it was really built off of the fact that somebody saw something, documented it, reported it, and your antivirus software would then start scanning for that. And the idea was that these AI systems didn't need that, that they could just look for anomalies or they could even look at behavioral things and that -- what black magic was that? And so, raise alerts that your normal virus searching software would miss.

Maria Varmazis: Yes, I want to say there's also a confluence of you know, we were coming off of sims being a big thing that -- not that new at that time, but there was just -- we were well into that world of sims and the flood of alerts and that just became a huge problem also that I think AI was being promised as a potential solution for, but again, I don't remember as well as I'd like.

Dave Bittner: I think also, like just a fun thing to remember is like it was back in 2011, I believe, that IBM's Watson competed on Jeopardy and won.

Maria Varmazis: What? What?

Alex Trebek: And now the newcomer, developed and programmed especially for this moment, making its first appearance on our national television program, ladies and gentlemen, this is Watson.

Dave Bittner: Pretty sure that was 2011, and Watson you know, kicked Ken Jennings' butt on Jeopardy. Ken Jennings now the host of Jeopardy.

Maria Varmazis: I was going to say I think somebody might -- well, I mean who really won? Yes.

Dave Bittner: Yes, right, exactly. In the end, Ken got the last laugh. But what was so interesting about that, and I think what captured people's imagination was like we've been used to computers being able to play chess.

Maria Varmazis: Yes.

Dave Bittner: Which is very deterministic. You know, you could -- most people who know how to play chess can understand how computing power could be thrown at the problem of chess, because of the limited amount of things that chess pieces can do and all those kinds of things.

Maria Varmazis: It's basically an extremely complicated algorithm that the more you study it, you understand certain outcomes. I don't play chess, but this is also my understanding. Yes.

Dave Bittner: Right. And so, you could see that how you could throw computing problem at that and get good results. And so, computers had been competing for chess championships for long periods of time up to this point. You know, there -- you could go to your local radio shack, which still existed, and buy a computer chess set that would play against you. And depending on how good you were, well, if you were at my level, it would beat you every time. Right.

Maria Varmazis: Same. Yes, same.

Dave Bittner: By the way, I should add in preparing for today's episode, I went -- I found a clip of me at the 2016 RSA conference. I was being interviewed by Matt Stephenson, who was working at Cylance at the time. And so, we caught up at the Cylance booth, and we actually discussed this very topic about AI and playing chess. So, here's a clip from that interview.

Matt Stephenson: Any other kind of fringe technologies, maybe you personally, that are grabbing your attention? Obviously, AI and machine learning, big deals as that is maturing in the security market. But is there any kind of outlier that's worth keeping your eye on for the next year or two?

Dave Bittner: Oh boy, that's a good question. I mean, I think a lot of it is -- I think we have this huge problem with workforce issues. So, I will tell you, I heard an interesting interview last week with Garry Kasparov, the famous chess player, and he said that we are at the point where any computer, the best chess playing computers can beat any human. However, if he teams up with a chess playing computer, they can beat any machine. So, I'm really intrigued by that notion of not just the AI, but if you team up AI with a really smart human, how does that change the game? I think that's going to be something looking forward to really pay attention to. Do I sound ten years younger, Maria?

Maria Varmazis: Honestly, I didn't want to say it, but you --

Dave Bittner: Butter me up, flatter me. Tell me what I want to hear.

Maria Varmazis: The optimism and brightness in your voice and kind of how like "Isn't this going to be cool?" you know?

Dave Bittner: Right, right. No, the weight of the world had not yet crushed my spirit.

Maria Varmazis: I know.

Dave Bittner: So.

Maria Varmazis: But also, the tenor of which you speak about AI as a great potential thing as opposed to I think the existential dread most of us can't help --

Dave Bittner: Sure. Yes.

Maria Varmazis: -- but inject now.

Dave Bittner: Yes, the cynicism had not completely set in yet.

Maria Varmazis: No. It's a little wild, but it was also kind of sweet. I --

Dave Bittner: Yes. No --

Maria Varmazis: -- no but, how much things have changed in a decade though? I mean, truly.

Dave Bittner: Yes, and you know, of course, Matt was a great host and Matt passed away recently, so we miss him very much. But getting back to Watson playing Jeopardy, I think the thing that was so remarkable about that was that that was a natural language engine, and that I think was something that most of us hadn't really experienced before. At the time, that took the big compute that IBM's, was it Big Blue or whatever their Watson engine had that was able to do that to be able to just understand spoken word, interpret it and come back with a meaningful answer, that seemed magical at the time. But, now it's part of everyone's everyday thanks to the large language models we have. But it -- back then, it was magical.

Maria Varmazis: In that vein, that kind of capability and extrapolating out to going a bit back to what you talked about you know, signatures for example. On the defensive side, you could see how these kinds of capabilities would make a lot of sense as an you know, something that can help the defenders aggregate you know, things that are trending or you know, all the unbelievable amount of things that the defenders have to just comb through, but eventually I mean the attackers started figuring out how they could use these kinds of tools to their advantage, and not to sound too dramatic, but that's when everything changed. Okay, that was too dramatic. But I mean, eventually we did start seeing attackers using AI to their advantage, and I do feel like that was a bit of a shift. You could feel the cold winds blowing when we started seeing more of that happening. Can you paint a picture for us about what you remember from when these started appearing more and more, I guess, across your desk at the CyberWire?

Dave Bittner: Yes, I mean, there was the rise of adversarial machine learning. And as you say, sort of a way for the bad guys to parry against malware detection, you know, spam filtering, all those kinds of things, to be able to use this technology to morph your code so that it wouldn't trigger recognition from you know, something that was checking for viruses, just what -- things that are considered simple and maybe quaint by today's standards, but back then were pretty advanced things. You know, DARPA had their Cyber Grand Challenge back in 2016, I believe, which was -- they were looking to see how autonomous systems could work with all this for both discovery, exploitation, and patching of software vulnerabilities. So, they were kind of on the early edge of that. And then I guess around 2018, 2019, we saw SOAR platforms became the new hotness, right? Their Security Orchestration Automation and Response, and that was supposed to make life easier for the SOCs.

Maria Varmazis: Yes.

Dave Bittner: And I think in many ways it did, but that was again looking to automate things to get rid of those repetitive security tasks, to take away the drudgery from the people running the SOCs to, you know, the phrase is always to "allow them to focus on more important things." Right?

Maria Varmazis: This is true. Although I do wonder, I mean that kind of work also, not that this is something you control, just that's also a lot of work for junior analysts and it's a shame for that to go away. But I understand it is the volume that we're talking about. It's just human beings can't keep up with it at a certain point.

Dave Bittner: Yes, and I mean it's an interesting point you bring up because one of the things that I've heard from many folks in security leadership is how do we take junior analysts and turn them into senior analysts when they're not doing the work anymore?

Maria Varmazis: Yes. Ten years ago, you were talking about workforce concerns. Here we are ten years later, I don't think those concerns have gotten any better. In fact, they've gotten a lot worse in many ways, but that is a totally different conversation, but --

Dave Bittner: No, it's weird. I mean, you're right. It's weird. I mean, on the one hand, back then there were all these, oh -- there's so much talk about how are we ever going to fill all these empty positions in cybersecurity? How are we going to ever find enough qualified people? And now, we're talking about Microsoft looking for voluntary layoffs or voluntary separations with 25% of their workforce. So, things have changed. I think there's still demand for folks who know a lot, but sort of to what we were just talking about, it -- it's really tough out there for those folks who are looking for entry-level positions.

Maria Varmazis: It is, yes, and you know what? Every conversation we've had this year, AI has been part of that conversation, so I say it's only fair that workforce comes part of the AI conversation. The tables have turned a little bit. It's only fair. Yes, so all right. So, you were in 2018, 2019. And then COVID hit and we were all stuck at home looking at really funny videos coming across our devices that were in some cases AI powered, and they were a bit of a novelty, but there was of course a security implication of these things as well. And I'm remembering Will Smith eating spaghetti as --

Dave Bittner: Right, right, right, and of course --

Maria Varmazis: Yes.

Dave Bittner: -- we're talking about deepfakes.

Maria Varmazis: Yes, yes, what deep fake -- I'm -- there have got to be deep fake stories from back then that you remember that made you go "uh-oh." There've got to be.

Dave Bittner: I guess so. I mean, I think a lot of the conversation was about the uncanny valley, and I remember as a huge Star Wars fan, I remember Rogue One coming out, and of course at the end of that film they have the AI-generated version of Carrie Fisher playing Princess Leia, and it was okay. It wasn't great. You know, it was one of those things where you could see, all right, where's this going? How interesting that the -- and clearly this is the future. But what I remember specifically about that is, not long after the movie came out, people were homebrewing versions that were way better.

Maria Varmazis: Yes.

Dave Bittner: Right?

Maria Varmazis: I was wondering if you were going to mention that because that was my recollection, too. That was my oblique moment was the homebrew versions are way better. I mean, not a surprise. Nerds, we're awesome like that. But at the same time that home capabilities were able to beat Lucasfilm.

Dave Bittner: Yes, exactly.

Maria Varmazis: I mean --

Dave Bittner: Right.

Maria Varmazis: -- this just was a sign of this is -- it's going to pop off real fast and boy, did it ever.

Dave Bittner: Right, and how quickly it was changing to go from the probably, you know, the most well-known special effects company in the world, ILM, doing a fine job, but only you know, let's say a year later, people being able to do a better job just at home.

Maria Varmazis: Yes.

Dave Bittner: Right? And so, again, you sort of recalibrate what your expectations are and what does this mean for the future if we can no longer trust our eyes, what we see, that's a big deal.

Maria Varmazis: Yes, I remember on a personal note around that time just the biometrics and identity verification procedures for so many things having to evolve extremely rapidly to keep up with just how well deepfakes were evolving and how effective they were becoming. And I was seeing that as you know a consumer in my day to day, and I remember thinking and wondering, what is this like for people who are actually, you know, are defending against something like this? This has got to be crazy. This fire hose. And truly around that same time, not that long ago, I mean four, five, six years ago, instead of AI being sort of this magical under the hood, magical, but under the hood thing for people who really knew what they were doing, it became a thing that a lot of us could homebrew and start using at home and then I mean, I think that's really when, I mean, not to use that again cliche phrase, but a lot of things changed when we started being able to play with it ourselves.

Dave Bittner: Right. ChatGPT comes out 2022 or so, '22, '23, around that time. Yes, it was late '22 was when it came out, and suddenly the world had a new toy, right?

Maria Varmazis: Yes, yes.

Dave Bittner: And you -- are you -- I'm sure you remember, and I'm sure our listeners are vigorously nodding their heads at the avalanche of articles and podcasts and everything that at the end of it they said, "In fact, this article was written by ChatGPT. Ha ha ha ha."

Maria Varmazis: Got you, humans.

Dave Bittner: Right.

Maria Varmazis: That em-dash didn't give it away? No.

Dave Bittner: Yes. Yes.

Maria Varmazis: And in a security context, also, it couldn't not -- it couldn't not change things. All the double negatives, triple negatives going on there. Things like intellectual property, you know, code bases, all sorts of stuff leaking out through ChatGPT. People putting things into these public tools that they really shouldn't. But also, how do you use these kinds of things in a secure way at work? And then all of our advice, I'm thinking you know on "Hacking Humans," a lot of our advice for people on how to detect phishing campaigns, for example, almost overnight became ineffective. You know, the old tells gone.

Dave Bittner: Just supercharged it, right? No longer do you look for clunky English that was oddly translated from whatever the mother tongue was, but no, there -- all of a sudden, you can take anything, run it through one of these large language models. Say "Clean up my English, make it flawless," and it was so.

Maria Varmazis: Yes, it's almost quaint now when I get something that has broken English in it. It's like, "Oh, oh, don't you know about AI, my friend?" Yes, but in terms of, you know, the really heavy-duty lifting of you know, the work that defenders are doing every day in their organizations, I mean, people are using AI in their workflows now in all sorts of creative ways, but also, it's -- you can't ignore its capabilities now, too. So, what have you seen in the last few years as you know trends in that direction?

Dave Bittner: Well, I think similar to what we were talking about from back in the early days of 2016 when it was under the hood but still part of everyone's marketing pitch. Here we are again, right? History may not repeat itself, but it sure does rhyme. And are there any cybersecurity companies out there who do not have AI as part of their marketing pitch? You have to. It's required. And I think it's easy to be cynical and poo-poo that. But on the other hand, it may be required. It may -- like to keep up with because the adversaries are using it, so why not? It's part of the toolbox now, and it's expected. I think it's just a matter of what are you using it for? Who's using it? How much does it include the human in the loop? You know, getting back to the clip of where -- from the old clip of me talking about chess, how the human plus the computer was the real chess champion. And I think a lot of folks are settling into that that you want the AI to handle the stuff that requires high speed analysis, but at the end of the day, you still need a human to sign off on it. The analogy I use all the time is that AI is like a tireless intern, which is great, but you're not going to bet the company on the output of an intern.

Maria Varmazis: And on the attacker side, to me, AI has been like pouring gasoline on a fire in terms of just what -- the volume that attackers have been able to you know, pump out what they do essentially, and the effectiveness and the way that they can iterate and the speed at which they can iterate. And we haven't even touched on things like prompt injection attacks. That's like a whole other world. But in terms of you know, what defenders are seeing coming across their worlds from the attacker side, AI has been an incredible tool in the arsenal for attackers and it also has, I mean to me, I don't know about you, but I'm sure in the conversations you've had, it has significantly lowered the bar for how technically sophisticated an attacker needs to be. You know, you don't even have to be a script kitty.

Dave Bittner: No.

Maria Varmazis: And that's alarming.

Dave Bittner: No, and to anyone who's experienced the joy and delight of vibe coding, you know, which I personally held off on for a long time because I just -- I don't know, it didn't -- didn't really see how it applied to me. It's not really part of what I do, but a friend of mine, I was asking a friend of mine who knows a lot about developing websites. I said, "I want to make some updates, but I feel like I'm you know, out of my realm here," and he said, "Well, just vibe code it." And I said, "What do you mean?" He said, "Just tell -- ask one of the language models what you need to do, and it'll do it for you." And sure enough, I tried and it did.

Maria Varmazis: Yes. Yes.

Dave Bittner: Right? My point being that, as you say, the bar is on the floor now for being able to create technically sophisticated things quickly, without having that technical expertise. And I think that's another big part of the story here is how much AI is a velocity engine, how it allows you to iterate quickly and just hammer away at things, set the system out on a task, and all the AI engines want to do is please you. And as we've seen story after story, they will do whatever it takes to please you, even if that means escaping their sandboxes.

Maria Varmazis: Yes, and we've -- that's been really the story of the last year, is exactly what you just said, and that has felt extraordinarily consequential, I'm sure, for everybody listening. And not that you have a crystal ball, Dave, but you know, given again the conversations you've had over the years and the trends that you've been following, where could you imagine this going?

Dave Bittner: Boy, that is the big -- that's the million-dollar question, isn't it? But it -- to be fair, it's a question I get to ask people all the time, as do you.

Maria Varmazis: Yes.

Dave Bittner: And it's been very interesting to me to hear the question -- the reactions that people have, the responses that people have to that question. I was asking someone recently, I was at a conference and had the opportunity to speak off the record with someone who was a very, very high -- high level person when it comes to all of these things. This is someone who knows a lot about cybersecurity and has been at leadership positions at the highest levels. And I said, "What do you think? What's the future hold?" And this person said, "I think like sort of like California wildfires, it has to burn down before it can be rebuilt." In other words, there's so much deadwood, there's so much brush, inflammable material at the ground level, and by that I think they meant just pre-existing bugs and vulnerabilities, all of these things that we're seeing being discovered at machine speed, and that all has to be cleared out before we can build the next thing. So, I think it's a interesting possibility that the next few years are going to be those wildfires making their way through the ecosystem, burning out all the dead wood, but then after that there won't be as many fires because all that kindling, all that tinder is gone. And then hopefully, it'll put the defenders in the better position of being able to spend their time on new novel things rather than having to clean up all the messes that were left behind.

Maria Varmazis: That is an oddly optimistic and I mean that it's a really optimistic take actually. It -- more optimistic than I would have guessed.

Dave Bittner: I'm hopeful. I'm buoyed by how many people I've talked to, people who I respect who believe that ultimately the defenders are going to have the advantage. It may take us a while to get there, but it seems like there are plenty of people who think that that's how it's going to play out. And here's hoping, my friend, right?

Maria Varmazis: Yes, yes. I mean, this is one of those things like I trust people with much greater technical expertise than I certainly have. If you had asked me to guess how people would feel, it would not have been that. Which -- so that does -- that honestly gives me a lot of hope as well. Dave, in your capacity as host of the "CyberWire Daily," doing a daily cybersecurity news show, talking to so many people and just watching these trends, especially with AI, when did it crystallize for you that AI was going to be basically a required component of any major cybersecurity news story? Was there an incident or a year, a date, anything like that where you went, "Yes, this is real, this is permanent."

Dave Bittner: I think it was the release of the large language models when those became publicly available, I'd say the year after that, when anybody who was paying attention could project out where this was going, right? Because the models were only going to get better and they have. The GPUs have only gotten fast -- or were only going to get faster and they have. People learning how to apply these things effectively gotten better, right? These tools have gotten more powerful. If you just look at the answers that you get back from these systems compared to what we did four years ago, they're so much more capable than they were. And the -- again, the folks I talk to who are working on the cutting-edge versions are saying, "You ain't seen nothing yet," right? Like they're -- it's just -- we've got a long way to run out. Like Moore's law isn't going to run out for AI for a little while. Like don't -- we don't seem to be up against that wall. Obviously, there are concerns about the toll that may play on our economy, our -- the environment, you know, all of those things which I think are legitimate concerns of -- as a civilization balancing out our needs and the advantages versus the resources that they demand. So, that's a whole other conversation for another day, but they're here to stay. I do believe that the release of the large language models was an inflection point in history. There was before and there is after, and now we're in the aftertimes. And so, we'll see how it plays out. I try to stay optimistic. I try not to get overly cynical about it. Some days it's easier than others. Some days it's harder than others. I think we're all fighting that fight and particularly folks who have an inside view of this, it's hard to know what ground truth is sometimes from day to day. It's hard to know what to believe, who to believe, and so hopefully, you know, something that we're really focused on is trying to provide that ground truth and you know, pre-filter things so that our listeners don't have to. But hasn't gotten any easier. I'll tell you that.

Maria Varmazis: Well, Dave, it's been an honor and a joy speaking with you, as always, and I want to make sure that if there's anything you want to leave the audience with before we conclude, that we -- I give you that chance.

Dave Bittner: So, just for fun --

Maria Varmazis: Okay.

Dave Bittner: -- if you have not done so, and I suspect a lot of people out there who are younger than me, and that would include you, Maria, go online. There are a million different versions of this online and search for Eliza. Maria, have you ever played with Eliza?

Maria Varmazis: As in like Eliza Doolittle, Eliza?

Dave Bittner: Just it it's -- yes. So, one of the first widely available AI toys was called Eliza, and --

Maria Varmazis: Oh.

Dave Bittner: -- it was written in BASIC back in the late 60s, and it's a therapist basically.

Maria Varmazis: Oh, my goodness.

Dave Bittner: And it's very clever, but I first came across it in the 70s, I think. It was running on like on a TRS-80 or an Apple II, but it's interesting to look back at something like Eliza, which is from a different time, but how Eliza can capture your imagination, how Eliza can make you feel like you're interacting with someone and not something. You know, I know Eliza doesn't pass the Turing test, but it's a really early indicator of how these sorts of things have the capability to delight and capture our imagination. So, if you're not familiar with Eliza, it's everywhere. Just go search for Eliza. I'm sure there's one -- run in your browser, and just poke around at it, see what it can and can't do, and remember that this was created probably before most of you were born.

Maria Varmazis: Oh, that is super fun. Well, I know what I'll be doing this afternoon.

Dave Bittner: Right.

Maria Varmazis: So, thank you, Dave. Appreciate it. And as always, Dave, thank you so much for taking the time to speak with me and share your insights with me and all of our listeners. And again, congratulations on a wonderful ten years and to many more.

Dave Bittner: Yes, thank you. This was great fun. Talk to you soon.

Maria Varmazis: Thank you for joining me for this special edition. See you next time.