39 Seconds to Breach
Wendi Whitmore: The biggest thing today is building networks and organizations for resilience. So not preventing every single attack, but being able to survive through the breach when they occur and keep your systems operational. [ Music ]
David Moulton: I'm David Moulton, and this is "Threat Vector." And I'm back with Wendi Whitmore, our Chief Security Information Officer, for another conversation. Wendi, welcome back to "Threat Vector." Appreciate you making some time to come in today. I know you've been very busy.
Wendi Whitmore: Exciting to be on again. It has been awhile.
David Moulton: Yeah, I wanted to talk to you about something that is maybe a different angle on AI than all the other conversations that are out there, but you don't have to tell me. AI and automation together. That's what I want to get into. Sound good?
Wendi Whitmore: Let's do it. [ Music ]
David Moulton: So I know you've been in the industry for quite a while. A special agent in the Air Force, doing cybercrime, cyber intelligence. And folks, I can't tell you some of the stories that Wendi has given me little bits on, but they do keep me up. How did that foundational experience inform how you think about cybersecurity problems?
Wendi Whitmore: You know, I think anytime that you enter into solving a problem or a challenge with an investigative mindset, you're thinking about it like putting a puzzle piece together.
David Moulton: Okay.
Wendi Whitmore: Or using puzzle pieces to construct the entire puzzle. And I think that mindset and that curiosity is the foundation of what we are doing today when we look at solving much larger breaches at scale, when we look at putting together patterns across clients, and data sets, and you know, really getting that big picture idea of what is going on, so that we can stop as many attacks as possible.
David Moulton: You know, you said something interesting, and I've heard that quite a bit this week, is this idea of curiosity, and how important it is to this. What makes the job one that requires curious people? What is it that allows a curious person to be successful in this world?
Wendi Whitmore: You know, that brings me back to when I was first-I was still in college, and I had decided that I wanted to be a special agent in the Air Force.
David Moulton: Mm-hm.
Wendi Whitmore: And the cool, sexy job to do at that point was to solve regular crimes, right? So, drug offenses, murderers, although thankfully there is not very many of those in the military. But that type of crime. That was seen as kind of the cool thing. But when I interviewed with the-who at the time was the computer crime investigator's office, and I was getting a computer science degree, so I was already interested in that. I talked to them, and said, you know, "hey, they crime guys are really trying to, you know, bring me over there, but I'm very interested in the cyber side of it, what's your perspective?" And I will never forget what the person who ended up being my first boss told me. And he said, you know, "The thing that I like about our job is that every day I work with criminals who are smarter than me. I am solving problems that I need to figure out how these very intelligent people conducted this crime, what their objectives were, what they're going to do after the crime, in terms of stealing this data, and what comes next," and he's like, you know, "I would really much rather work with people that I feel like I can be learning something new every day versus maybe people that are making bad decisions, unfortunately and committing other types of nefarious crimes." And so, I think to me, that kind of summarizes what is so exciting about the work that we do, right?
David Moulton: Yeah.
Wendi Whitmore: You get to constantly solve new problems, and so if you're a person that maybe gets bored easily, probably, I'm sure no shortage of us have ADD or ADHD or whatever, right? We're distractive. It gives you that opportunity to constantly be learning new things, and that is super exciting to me.
David Moulton: And when you get into a case, and maybe there is one that comes to mind, is there a moment where you find yourself getting into like a flow state? Where you're digging in, and you know, time, and going and grabbing food or doing some of these other things that you would need, it sort of melts away, and you just, you can't stop going?
Wendi Whitmore: Definitely, and I actually think if we then apply that to the usage of AI, I'm sure also there's no shortage of us who find that when we're testing new AI tools, when we're solving a problem with AI, that's a whole new area now where you can kind of get into and just be like iterating back and forth with this, what sounds like and feels like a close confidant to be able to solve this really challenging problem, and now, obviously with a lot of the, you know, newer versions of the LLMs, they're continuously prompting that in terms of hey, would you also like me to show you, you know, this new thing that you haven't thought of yet, or this new angle to the problem, and so I think that that actually is going to be helpful for an investigator's mindset, moving forward.
David Moulton: Yeah. So listen, you've led teams at Cross Wright, Mandiant, you and I met at X-Force, over at IBM, and then, you led teams here at Unit 42. How did the organizations and their different cultures, different scale, maybe the way that they operate, affect what you're doing and/or, are there through-lines that you see across those organizations, because they tend to track? Maybe that curious person, or those folks that are always looking to learn the net?
Wendi Whitmore: That's a great question. I think each of those organizations is different culturally, and every organization you ever work at has pros and cons, in terms of areas where you'd like to replicate more of, or maybe areas where you're like, oh man, we're not doing this quite-you know, firing on all cylinders.
David Moulton: Mm-hm.
Wendi Whitmore: And so you're constantly trying to then adapt a bit of the ways you solve problems to those unique organizational cultures. What I think when you ask about the through-line, though, to me, what's the fundamental challenge that needs to be figured out at every one of those organizations, is how to align the right people with the mission? And so even if there are some cultural dynamics that shift in there, what I'm always trying to do is figure out what problems do I need to solve here at the highest level in terms of organizationally, I'm going to align the mission challenge we have with what skills I need the leadership team to have, and from there, then figure out how can I build the best team of people who is going to be equipped to solve this problem most effectively? And that means you have to understand what motivates people on the team. The more-to me, the more that you can align a person or a leader with tasks that they love to solve with a mission challenge that we need to solve this as an organization, one, the better that individual leader is going to feel because they're going to feel like they are having major amounts of impact, they're going to feel good about the work they're doing, and a byproduct for the organization is that they're probably going to work harder, because they're really enjoying it. And so one of the greatest kind of joys I've found is putting people together that maybe didn't necessarily think that they would get along, or maybe even didn't want to work with the other people.
David Moulton: Mm-hm.
Wendi Whitmore: At the beginning, and knowing that hey, okay, I've seen enough now in terms of leadership that I think these skillsets are going to work out, or these people are going to really compliment one another, and that's what we need to build as a team. And over time, having someone who has come on board where other people have said I don't think I'd hire that person, and then you look, three, four, six months later, and those people are incredibly close allies, and they're saying hey, we're so glad that you brought this person on board.
David Moulton: Yeah.
Wendi Whitmore: They are so fantastic, and we didn't really see that at first.
David Moulton: Yeah.
Wendi Whitmore: So, I think that that mindset, of aligning, you know, what is motivating to individuals, with the objectives we need to solve as an organization. That is to me always the top level. Figuring out what problems we need to solve, how can I best do it? What skills is that going to take? Then no matter what that organizational culture is, we can figure out the path to achieve success.
David Moulton: Yeah. I've seen you do that, here at Unit 42. Watched you do it at IBM. Where did you learn that skill? Where does that come from in your background? To be that, not quite matchmaker, but the person that can put a team together that doesn't have, you know, the bias of everyone matches. It's the diverse group of complimentary skills.
Wendi Whitmore: Well, thank you for that, but I think you need people that think differently. That is so important in all of the work we do. And I probably learned that in the intelligence analysis training within the Air Force, right? So understanding that, hey, we've got people with different skillsets. When I joined and entered the military it was the heart of, you know, six months after 9/11. We were straight into the War on Terrorism, and it required people with all kinds of different skillsets and backgrounds, language skillsets, regional backgrounds, understanding of different ways to commit crime, to be able to solve all those cases. So I think that was incredibly helpful. But I also think that, you know, I grew up, my parents were both teachers and my dad was a coach. And so I grew up on baseball fields, being around, you know, 20 older brothers at all times, type of environment. And my dad was very good at identifying people's skills, and then modifying what they were doing to fit the team's need. So one example is that I was a softball player, and I was a softball pitcher, and in high school and then in college. But in high school, we had moved to a new location, I had to go to a new high school and meet all these new people.
David Moulton: Yeah.
Wendi Whitmore: You know, all the things that come along with that, right? Pretty challenging. And we, sorry, was new to the team, but I was going in and my dad had kind of already reached out to the coach of this new team of high school, said hey, you know, we moved into town, this is what we're doing, and he came to practice, you know, there is this old baseball coach that we started by that time kind of being interested in what I was doing, and came to one of the first practices we had. And there was a girl on the team named Jenny. She was playing first base. And he was looking, and you know, he had told me already like after the first practice, like hey, you know, we're not going to be good if you don't have a great catcher. Like this team is going to go nowhere if you don't have someone who can catch. I'm going to need to find, you know, figure out who this catcher is. Saw the first baseman, saw that she was exceptionally fast, had the best arm on the team, by far. And could-was very coachable. And so approached her and said, "Hey," you know, "Jenny! How do you feel about playing, you know, I see you're playing first base," she's like "Oh yeah, I've always played first base." "How do you feel about being catcher?" She's like, "No, I play first base."
David Moulton: Yeah.
Wendi Whitmore: And he's like, yeah, but you know, catcher gets to do all these things, right? They're kind of the boss behind the scenes, they're doing this, they're really the one that is telling the pitcher what to do at all times.
David Moulton: Yeah.
Wendi Whitmore: But pitchers like to think that they're in charge.
David Moulton: They're not.
Wendi Whitmore: And she's like-
David Moulton: Hm!
Wendi Whitmore: I don't know about that. And he's like, "You know, you've got a great arm, we could really use you in that position," and she's like "Well, I don't know how to do that position." "You know what, Jenny? I was a catcher, I played in college, I played in the minor leagues, I can teach you how to catch. It's really easy, you're just going to have to boss the pitcher around a bit," knowing that was, you know, me. So he convinced someone who was very much set in their ways, to step way outside of their comfort zone, that hey, you have the skills that we, the team, needs for this role. And I think that was pretty pivotal for me, because I saw it-oh man, you know, I'm the new girl in school, I'm not trained to ruffle any feathers. These people already have their established positions. On and on. She was, thankfully, willing to give it a try.
David Moulton: Jenny?
Wendi Whitmore: Yeah, worked with Jenny, and by the end of, you know, two years later, as we were graduating, we were both the league FEP, we're on the All State Team, she got a scholarship to college to be a catcher, went on to play all throughout college. So I think that moment was pretty transformative for me. I'm like, oh, okay. He was just going in and identifying what people did really well that was needed for the team, and then molding them into something that was better than they even dreamed that they could do.
David Moulton: Yeah.
Wendi Whitmore: And to me, that was really fundamental in when I went into the Air Force, it was just figuring out, okay well what are all the things that we need to do in terms of what are the tasks that we have as a team, and the problems that we've got to solve, and who is going to be best positioned in each of these positions to do that?
David Moulton: Right.
Wendi Whitmore: And so it's really just putting people in the right position.
David Moulton: So you go and look for your catcher, they just don't know they're your catcher yet.
Wendi Whitmore: Right [laughs].
David Moulton: And you put them, you know, behind home plate, and you're right, you've got to have a monster of an arm to make that throw to second, right, to throw somebody out.
Wendi Whitmore: Definitely.
David Moulton: What have you found in some of the best cybersecurity practitioners, that's like that common thing, but maybe it doesn't show up on a resume?
Wendi Whitmore: I'm going to give you a couple different answers, because I think it actually depends on the task that they're doing.
David Moulton: Okay.
Wendi Whitmore: So let's say for example, when you come to incident response, so solving a data breach. To me, the hardest role on the team is that engagement manager, who has to have the skillset of not only having the right level of technical depth, so that they can challenge the team with the analysis that is being presented, and they, you know, need to understand enough about the network traffic analysis, enough about the host base analysis, now, they have to understand something about the cloud, and the browser, and all the data sets, and telemetry that is feeding into the investigation, but they need to then be able to synthesize it in a way that they can talk to leadership at the client, and in particular, that leadership in the client who is under fire, under the gone, trying to solve problems as quickly as possible, with all kinds of influences and pressure coming at them.
David Moulton: Yeah.
Wendi Whitmore: That's a really challenging role. You're having to do multiple translations, and gear switching essentially in your brain, on a multiple times throughout a single conversation. And so I think the ability to understand that role as a translator is one of the more important tasks that we have. You can really only master that, if you will, after you've got proficiency in one or more of the other areas. So that's going to take someone a little bit of time. But it also then, I think, requires the ability to observe people, listen more than you speak, and really listen to understand, versus listening to respond. And I think those are areas that are fairly hard to figure out on a resume.
David Moulton: Yeah. As you were talking about that, does AI help accelerate somebody into that kind of role, to synthesize data, to bring in a understanding of the emotional state, the hot moment that you're in, or do you think that we're not quite there, where that AI isn't a good assistant for that kind of a role?
Wendi Whitmore: I think AI can be a great assistant at the communications piece. So again, AI is the outputs you're going to receive are only as good as the inputs that are crafted for it, right? But presumably, if you're configuring columns or creating your own, you know, GPT, LLM, Gem, whatever-
David Moulton: Yeah. Assistant.
Wendi Whitmore: Choice is, yeah, I do think that you could train it to explain the situation and whether you're applying that to a singular case, or you know, a set of case data over time, to explain the dynamics that are going on, and then be able to feed in, you know, let's say a status report, and then craft out some outputs that no doubt would actually create the written outputs, but certainly from a verbal script perspective, that would help you communicate more-
David Moulton: Yeah.
Wendi Whitmore: Now, I think if all a person is doing is, you know, programming it in, and getting an output, and then repeating that output, they may not be learning the actual nuance, and that is what is going to make you better and more effective, time and again, where you continue to learn okay so set it this way. The same, but that wasn't really quite received like how I might have intended it-
David Moulton: Right.
Wendi Whitmore: Right? So I'm going to modify that for the next time. So can AI help? Yes, no doubt about it. But can it-it needs to be done I think very pragmatically. [ Music ]
David Moulton: You're making me think of my son. For the last couple of years, he's really come into his own on his sense of humor. I used to think I was the funniest guy in the family, and I'm pretty sure I'm not. But a couple years ago, he would land a joke, and he didn't land it right. It wasn't funny. You could see the structure of where he was going, but it-it missed.
Wendi Whitmore: Yeah.
David Moulton: And he had to have a number of, you know, bombing if you will, on stage. It just-within the house-of telling the joke, until he finally got the timing, and the, you know, just tone, and this person at this moment, maybe that person at a different moment, not funny.
Wendi Whitmore: Sure.
David Moulton: But he's nailed it. And so I think there's a-I don't know, where he could look up jokes and understand what they are, and then if he tries to say it, it doesn't work. Practice. Kills. And I think what you're talking about is like you can't let the robot turn your brain to mush, right? You've got to be able to do some of the thinking, but maybe it is a great assistant to say like, here's how you might frame it, or here is some of the other contexts, that this group is going to be stressed out about, or like, concerned about, that didn't come in from the diagnostic, or the investigation or the technical side, but it's truly important, you know, even understanding who is in the room, who is not in the room.
Wendi Whitmore: Right.
David Moulton: With an audience, is always-I think it's interesting to think about that. Because it influences things. And listen, about a year ago, you took over a new role, Chief Security Intelligence Officer for Palo Alto Networks. What does that role and the shift that you have mean for you personally, and the intelligence that you're used to getting access to for the organization? Just talk to me about that.
Wendi Whitmore: Yeah, so the role was really created for us as an organization to be able to take all of the insights we have across all of the products that we're building, the research teams that are embedded in those, including Unit 42, and to be able to really translate that into actionable insights for customers. So what does that mean? I'm meeting with an endless amount of customers, right? Nearly every day, it's a different CIO, or CISO, and really helping, for me, to learn what kind of problems that they're trying to solve, and then making sure that the solutions that we're building, one, I can translate that into here is how we would recommend you do that, and here is the insights we can provide. But also learning, are there areas where maybe there's gaps, where there's problems that, you know, customers are trying to solve, where we may not have solutions for you. So that's generally not the case, obviously, our portfolio is pretty comprehensive-
David Moulton: Right.
Wendi Whitmore: At this point, but it has really been a great opportunity for me to just be in the field, learning as much as possible about the challenges our customers are trying to solve.
David Moulton: Wendi, you're an official speaker at RSA this year. And you are on a panel called "Inside the Hunt for China's Typhoons." That was a talk about cutting through the hype of AI to get to the ground truth around AI and automation and how they're shaping security. After running through hundreds of incidents, what does the ground truth look like, and maybe what did you learn from the conversation or from the panel that you would add to that?
Wendi Whitmore: Well the conversation was pretty dynamic, I do have to say. We were all surprised it was in first of the morning, so 8:30 a.m., on Monday morning, RSA talk, we thought maybe we'd have five adventurous people that joined us, and the room was packed, was standing room only, and there-it was spicy on stage, and we got some great questions from the audience. So you know, we started with setting the stage, which was, what's the difference between-who are these Typhoon actors?
David Moulton: Mm-hm.
Wendi Whitmore: And in particular, who is Salt Typhoon versus Volt Typhoon, and I think it is important in that conversation, as well as this one, to talk about just objectives, and why that is still important when we look at attackers, because certainly when you look at using AI, that remains important.
David Moulton: Right.
Wendi Whitmore: So, you know, Volt Typhoon typically related to military pre-positioning, so more of PRC attackers coming from China, who are looking to embed themselves within critical infrastructure, within the U.S. Organizations throughout the country. And the concern is that has been going on for quite a long time. It is hard to find, because they're not installing new malware that you've never heard of, they're simply leveraging existing administrative tools that already exist in your environment, and then using those for their benefit. So harder to evict and hunt, in that sense.
David Moulton: And when you say in an environment, this is across the corporate network, it's in OT networks, it's pervasive that way, or is it really concentrated in some strategic areas?
Wendi Whitmore: It, well, critical infrastructure focus, so certainly water, power, electrical grid, and-but it's all over. So not just one specific geographical location or one specific part of a, you know, a state.
David Moulton: Yeah.
Wendi Whitmore: This is certainly pervasive throughout the U.S.
David Moulton: And so you said that was Salt.
Wendi Whitmore: That was Volt.
David Moulton: Volt!
Wendi Whitmore: Yeah.
David Moulton: Copy, yeah.
Wendi Whitmore: And Salt Typhoon typically more traditionally espionage related. So again leveraging existing tools that are in environments, so hard to detect, but for the purpose of data theft, of understanding what's going on, and being able to steal, in this case, specific telecommunications data. So about communications going between high level or sensitive individuals, existing ways to attack future telecommunications, and so obtaining intelligence about that. So two very different types of motivation here, but if we take that back to a CISO, or a CIO, who maybe has worked their way up in the organization because they were a great engineer, or they were a great analyst, network analyst, for example, they're probably not going to be a geopolitical expert and also understand how to defend their organization against a foreign military capability.
David Moulton: Sure.
Wendi Whitmore: So we are really asking CISOs and CIOs to do a lot in today's day and age, where cyber is so closely coupled with the geopolitical threat landscape, and that was really the next part of the discussion. It was going into, then, okay what are we seeing with Iran? How is that different? My take on it was that was a different phase of conflict, so if you look at Volt Typhoon, that's much more strategic. It's still military pre-positioning, but we're talking about doing this years in advance. Salt Typhoon, still strategic, but a different angle, right? It's more data collection and understanding and some, you know, theft of data related to specific types of data that you might be interested in on these conversations. Now if you look at what Iran is doing, where it's much more tactical. So tactical disruption, tactical destruction, wiping, and these are, you know, Iran and Iran-related groups that we are seeing and investigating. And the reality is, modern-day CISO has to be able to react against all of those-
David Moulton: Right.
Wendi Whitmore: Defend against them, in addition to oh, by the way, all this other criminal groups that are out there, that might want to steal data so that they can conduct a, you know, financially motivated attack against you.
David Moulton: Well, and maybe not part of the conversation, but we've also been seeing and reporting on activity out of North Korea, and fake IT workers, and theft there, so if you're a CISO, you've got every different flavor of problem, and you know, with massive funding behind it, different strategies, and capabilities. I do want to go back to, you said it was an animated conversation, on Monday morning. I think that's a good thing, right? That people are involved, and have some questions. What do you think is so animating about this topic right now?
Wendi Whitmore: I think that those of us who have been in the industry for some time really want-are frustrated that these same types of attacks continue to go on, and want the United States to have a coronated defense, and certainly not only the United States, but across our allies, and across the private sector. So we spoke a lot about how we could work together to effect change, and what that looks like. I think there are many great examples of that work that is already ongoing, but no doubt it needs to continue to be operationalized much more effectively, where it becomes routine on a daily and weekly basis. And that's where a number of us are very passionate about-
David Moulton: Allie Mellen came on, talking about Code War, her new book, and in there, she described the histories of the countries, and she mentions the U.S., she talks about China, Russia, Iran, and some others, and how our histories and our social contract are what drive what we do and don't do. And in the cybersphere. Do you think that the U.S.'s social contract, that we have this idea of as minimal government intervention as possible, maybe distributed systems that aren't always coordinated, is one of those things that is at odds with being able to pull together that coordinated, integrated response that is necessary to address some of these huge problems that are in front of us?
Wendi Whitmore: Well, I think that no matter what way any country or large organization organizes their infrastructure, it's likely to be used against them by the adversary, so we start there, but-so then apply that concept to what we're seeing today. So the fact that there are distributed systems that much of these attacks actually occur on private networks, within organizations that are far outside the government, but then the government has the authorities to effect change. Those being two separate entities. Certainly it can work against us, but I don't think that means it's the wrong approach.
David Moulton: No.
Wendi Whitmore: It just means that we need to work together more effectively and learn how to overcome some of those barriers that we may have constructed in order to achieve the outcomes at a speed that we need.
David Moulton: Well, speaking of speed that we need, how is AI affecting this problem, either in a making it more urgent, or helping things out, or maybe it's a little bit of both?
Wendi Whitmore: I think the biggest change by far is just the speed with which an attacker is able to operate. So we talk about in our report, where we see cases where in 72 minutes that, you know, we've seen from initial access into an environment to data theft.
David Moulton: Mm-hm.
Wendi Whitmore: We also talk about stats today where we see 400-times increase year over year, in terms of being able to see data exfiltration in as little as 39 seconds. That is a massive amount of speed that you can see if you're applying your manual detection and response capability, you're going to be beat by the attacker every day. So, that's the biggest change, and that is, I think, the most pivotal reason why it's critical that we fight AI with AI, and that organizations like ours who are really building world class capabilities continue to be innovative and cutting edge.
David Moulton: Yeah, I feel like going back to your softball stories, and baseball, it's kind of like playing T-ball versus the bigs, you know, that ball is coming in a whole lot faster now, and if you're not able to respond, you know, you're going to get struck out. Pretty quickly. The adversaries are using AI too. And not just nation states, you know, cyber criminals as well, but the FBI has flagged the nation state actors in particular, and in specifically China, are testing AI across the full life cycle. And you just mentioned exfiltration in 39 seconds, an attack completed in 72 hours. I was speaking with Steve Elowicz earlier this week, and in my head, it was 72 days [laughter] and he's like, "No, 72 minutes," you know, like--
Wendi Whitmore: Right.
David Moulton: Move your time structure there. And it's just wild to me that it's moving that fast. How do those changes affect offenders who are still trying to deploy tools and structure the stories to, you know, the teams that help finance and fill the roles, who made it understand the urgency that we're up against.
Wendi Whitmore: Well, I think that should be a big wake-up call, right? In terms of the time frames that we need. So if we're still applying more outdated models of approaches of how we're responding to attacks, then we're not going to detect them in time. We're not going to be able to respond and contain them in time, and the win is not going to be that we prevent every attack from ever occurring, it's going to be how quickly we can detect it, respond and contain it, so that a compromise of an individual system doesn't become an entire enterprise-wide compromise.
David Moulton: If next year, you're sitting on a panel, what does success look like? You mentioned the community piece, working together. Is that the direction that you think things need to go? Or are there other elements that you would add to that?
Wendi Whitmore: That's a great question. I think one of them is specific to AI, and so I'm going to cover that, and then I'll talk about the community piece. But specific to AI, one thing that to me looks more like success next year is if the innovation of AI doesn't so far outpace the security of AI.
David Moulton: Okay.
Wendi Whitmore: And I see that happening today because organizations, CISOs, CIOs, are pushed by every angle of the business, every department, their leadership team, to drive efficiencies and so they want to implement and innovate AI as quickly as possible, which is great, we're all for that. But what we're not for is keeping the same level of security which then creates this massive increased attack surface-
David Moulton: Yeah.
Wendi Whitmore: But not only a year from now, we'll have an attack surface this big, versus this big. So what you know-what is needed for that, cybersecurity for AI is needed. So we all talk about AI for cybersecurity in terms of, hey, we're creating these new capabilities and we're innovating with cybersecurity detections and we're able to take billions of attacks and get it down to one per day for manual-like, all of that is awesome. But that is AI for cybersecurity. We equally need cybersecurity for AI, in terms of making sure that we keep those guardrails in place, so that companies can safely innovate, can build and drive those efficiencies, without exposing themselves to such a massive attack surface that is going to be unable to defend against and create inevitably more problems for them. The second piece, the community side. So what does that look like?
David Moulton: Mm-hm.
Wendi Whitmore: I think what that looks like in an idea state is that we really operationalized more of a disruption piece that we have as a community a group of private partners who are really working together to share telemetry across the board with the government in a much more operationalized, routine manner, that enables-doesn't violate any legal challenges-
David Moulton: Yep.
Wendi Whitmore: In terms of about sharing data, certainly not sharing customer-specific data, but also doesn't violate any government titling and authorities either. But really creates the opportunity for us to operationalize intelligence as quickly as possible so that we can make it more expensive for attackers to conduct attacks. Make sure they don't reuse infrastructure. Make sure that they cannot continue to use one attack and be successful against many organizations, and it's more than one to one.
David Moulton: For a security leader who is in the unenviable position of figuring out the differences between the Typhoons, and dealing with the conflict, and the output from Iran, or a nation state like North Korea, or run of the mill cybercriminals, at the same time that they're trying to figure out their AI and their automation strategy, with that pressure from their business or from their industry, they continue to move fast to innovate, you know, what's the most important thing for them to get right before they start deploying the tools that would allow them to be exposed on a large attack surface and/or massively exploited by some of these nation states that have more funding to find those weaknesses?
Wendi Whitmore: I think those challenges both require the same solution, at the highest, most simplest level, which is the right visibility, into the environment. So the visibility for your team members, for your analysts, to be able to detect at scale very quickly with one screen, and then when you get into AI, what's being deployed across the environment, CIOs and CISOs need to equally have visibility into that environment. They need to understand visibility and to shadow AI and what's being implemented in the organization that they haven't approved. Same visibility into the actual prompts that are being input, and ensuring that prompt injection is not occurring, you know, within an AI system, that they've got red teaming into the models and at right times, so that all of that kind of level of visibility is going to enable the innovation they need to implement moving forward.
David Moulton: Wendi, this has been really fascinating. I'm sure that a number of our listeners are curious to reach out to you. Where can people find you online, and continue the conversation?
Wendi Whitmore: You can find me most often at LinkedIn.
David Moulton: Okay.
Wendi Whitmore: I believe it's LinkedIn.com/WendiWhitmore2?
David Moulton: Okay, we'll have it in the show notes. So LinkedIn is a good place to go, and drop your questions for Wendi. And you said you're out there talking to people a lot, so you know, she may not get back to you instantly. I really appreciate you making time for me today, and for coming in, and having this conversation, giving me a little bit of a snapshot of the conversation you had at RSA. We'll go ahead and link to that, so people can experience the spice that you mentioned [laughter] and understand what that's all about. And again, it's always good to have you on "Threat Vector."
Wendi Whitmore: Fantastic, thanks for your time today, David. Really enjoyed the conversation. [ Music ]
David Moulton: That's it for today. If you like what you've heard, please subscribe wherever you listen, and leave us a review on Apple Podcasts, or Spotify. Those reviews and your feedback really do help me understand what you want to hear about. You can reach out to me at "Threat Vector" at PaloAltoNetworks.com. I do read every email, and it shifts the direction of the show at times. I want to thank Mike Heller, our Executive Producer, original mix and music by Elliot Pelsman. We'll be back next week. Until then, stay secure. Stay safe. Bye for now. [ Music ]
