RSA Recap: Dancing Robots, AI Everywhere, and the Future of Security

It's very much so. And like I went to meet up with my friend Trey Ford from Bug Crowd and they had taken over a bar for I don't know if it was the week, but for a couple of days like Tuesday, Wednesday, that was, you know, maybe three blocks from Moscone or something like that, which is really smart. You know, they had their own space for the whole thing, which was great. And it was a little bit out of the way. So you didn't you weren't just seeing people with badges all over the place. But yeah, it even down, my hotel was down on Embarcadero this year, like down by the ballpark, which is a good walk. That's a good 15 minute walk away. But even some of the restaurants and meeting spaces between Moscone and there were taken over by vendors. It was, yeah.

I mean, they've run out. As big as San Francisco is, they've run out of places to put people. Yeah, that is interesting. I'd, you know, it's funny to see how everyone you know takes over San Francisco for this event. It's it's really unreal to see. Even on the, the Uber ride yesterday to the airport in the morning, I was talking to the driver, this awesome guy who was from Brazil, and he'd been there, he'd been in San Francisco for like 9 or 10 years, he said. And he asked me if I was there for RSA. And I was telling him about it.

And he's like, you know, it's gotten so big even just in the last 10 years that I've been here, it's like doubled or tripled. I said, I know. Yeah, it's, it's wild. It's really crazy. But. Did you make it to the Expo floor at all or was it you did? Yeah. How was that experience? It was one of the weirdest experiences. So I went down there. So the show floor for people that I don't know if, if you've never been there and you're listening to this, the Expo floor opens at, I don't know, it's like 10 AM on I think Tuesday, Wednesday, Thursday. So I had a meeting with your colleague John Hammond at 10 AM one of those days.

And their booth was right at the bottom of the the escalators. Like I could see it when we got down at the bottom of the escalators, but they weren't letting people into the Expo floor yet. They had like the, you know, the stretchy barriers across. I was coming down that escalator with one of my colleagues from Beyond Trust. And we're just looking and she's like, what's going on down here? There were, Lindsay, I tell you, 2000 people at the bottom of this escalator waiting to for and it was like 958. They were waiting for the people to drop the barrier so they could go in and get their T-shirts or whatever the hell we got down there and God bless. I love this woman to death.

I don't want to blow for spot, but we we got down there and she was like, I don't know how you feel about this, but I don't wait in lines. And I was like, I do not wait in lines either. Let's go. So we just kind of wormed our way, like all the way up to the front. And she had a booth staff badge, so they let her in and I just walked, you know, me, I, I just walked right behind her. I was like, yeah, yeah, yeah, bye. And just like went past the security guy. But we turned around and 30 seconds later it was like Lollapalooza, like Stampede of people, just like rushing onto the Expo floor.

And luckily the Huntress booth was like 20 yards away. So we just kind of like buzzed over there. I was like, get me the app out of this. I. I'm getting like PTSD flashbacks to any conference I've ever been to where for whatever reason, everyone, the first day of like every day or the the first hour of every day, everyone goes and gets their breakfast and then they're like, we need to go to the keynote. We need to go to the. The. Floor and they all get in the longest line and for whatever reason like can't wait an hour when there's no line.

No, I've got to go see like The Rock Em Sock Em Robots or the, you know, the WWE wrestlers. These are all things that were happening on the show floor this year. There were so many insane things. I honestly spent like maybe 15 minutes walking around and that was that was plenty. Like, I had my Airpods in, you know, had my badge turned around so nobody knew who I was and just, you know, kind of walked around right after I talked to John and I, I made a beeline for the escalators and just that was it, man. I, I just could not.

I had to get out in the sunshine. First of all, the weather was awesome all week. So I was like, get me outside. I went and sat in like Yerba Buena Gardens up behind, you know, Moscone. It's like, all right, good. For your mental. Health, exactly, yes. So it was that part of it was overwhelming, honestly. Huntress had a your booth was amazing. It looked awesome. It was very cool. The Beyond Trust booth was very cool too. It had like a space theme like space exploration theme which is like perfect for like project Hail Mary. Oh yeah, I'm sure you'll love that. I did love it, of course.

What did you see? So like, tell me more about the weird things you saw. Like I, I did see on Twitter like a couple of things where I was like, what? And then I was just like, you know what, it's RSA Expo 4. Like I saw some people dressed up as like like Matrix characters or something. Like, yeah, I was going to mention this when I left the Expo floor, went across the street to Yerba Buena, found like they have these tables like you see in Central Park that have like, chess boards on them, like, you know, like granite. You just sit down, sat there, found a quiet spot under a tree in the sunshine.

You know, I had my laptop. Whatever. Here comes this long line of people wearing. I have a picture of it. I'll send it to you wearing like silver space helmets and like, like reflective silver jackets with like black backpacks and they're playing music. And I didn't immediately connect it to RSA. So I, I, they were just like walking through the garden, like in a line, not like marching, but like very much In Sync. And there was a leader and there, there was somebody like almost like shouting commands. And because it's San Francisco, I was like, oh, they got a new cult.

Makes sense. Didn't you know, kind of didn't pay attention. And then they walked right in front of me and I realized it was a vendor thing. Yeah, yes. And I, I don't know, do I want to say with the vendors, people can go look it up, but it's it's a vendor that I would not have connected to a stunt like that, honestly. But I'm. Curious. I'll tell you in a minute, but it was so they were walking all through Yerba Buena, all down like Mission, like kind of doing laps.

And they weren't like the branding wasn't super obvious. You kind of had to like their backpacks had branding on it, but it was like very subtle. I don't really know what the point of it was. It was just one of those stunts that, you know, are pretty common, I mean. It's really working. You're, you're talking about it right now, you know? The purpose? That's why I don't want to mention the name. I don't want to give them like this. That's valid, honestly, yeah. But as they were walking through, all kinds of random people were taking videos, like even non RSA people, you could tell that we're just sitting on the grass in the park who you would think would be like used to weird shit in that park every day.

We're just like, I'm sure I've seen all kinds of weird shit in that park over the years. Yeah. That's, that's interesting. So was that so OK, did they go to the? Did they go into RSA after? Were they just kind of parading outside? I think so because I saw them later. I think it's Howard that runs between the two parts of Moscone. I saw them kind of walking down Howard towards the Moscone entrances so I assume that they did, but I was like sprinting the other way towards my hotel.

You were probably like, I got to get out of here. I, I could not move away fast enough. You know, just like my Airpods got worn out this week just ignoring everything. But you know this from past years, even every car that goes by you on the street is wrapped in some kind of vendor branding. Or a lot of the buildings honestly had wraps on them or just advertisements in all the windows on the ground floor or something like that.

All the city buses, everything, every, every, everything. It was wild. It's such a circus. Yeah, I remember like the two years, the time we went two years ago, we were like walking around and I think it was like with some folks like Brian Donahue and like some others. And like we just look up and we see like these these crazy billboards that we're talking about AI and like the future. And part of that is just like the tech scene in San Francisco.

And then the other part of it is just like elevated by all these vendors coming into this complete circus, coming to showcase all their latest tools and the marketing and the hype and all that stuff, all that fun stuff. So. Yeah, it, it really is. I mean, I, I sound like I'm complaining. I mean, I enjoy going because I have a like I, I just have a lot of friends that I'd love to see there. But it, it is a little bit like the noise is really hard to cut through, even for people like us who can, you know, our job is to kind of separate like the signal from the noise and you know, like drown out or, you know, filter out the BS that can, it can be really difficult in an environment like that.

You know, I was able to get to some, some good sessions and things like that. But it was just, I wonder how you know, say a 25 year old, you know, security practitioner in their first job, or even a young journalist, you know, who went to RSA for the first time this year would ever figure out how to even navigate the whole thing. You know, if you're there to try and learn something specific, I don't even know. I don't know how you start.

Yeah, I think it's hard. I think, you know, you need to know the right people in the industry who really bring the value and really understand how the industry has been shaped. And that's how I like to cover those types of conferences is like, look for the people I know about or like people who I've read their research and that's and have like appreciated that. And then go to their sessions or go, you know, try to talk to them and see what they have to say.

But I also understand like it's a conference, it's where a lot of the sales talks are, you know, had and a lot of pitches and things like that. So I think it's probably different based on, you know, your different role in it at the AT you know, RSA or Black Hat or wherever you're going. So yeah, no doubt. Yeah. Yeah, I did this live stream panel on Wednesday that Run Zero was doing. And you know, Todd Beardsley was the host and he was, I don't know how he did this, but he was there for I think 7 or 8 hours doing a live stream on on YouTube with like 5 minute breaks between each 30 minute session. And he had me and Steve Reagan and Bill Brenner on to sort of talk about, you know, that I guess like the evolution of security journalism and, and essentially what you were just talking about, how do you find the right people to talk to? Like how do you know who to

trust when you're a journalist? And there's so much kind of noise and nonsense out there. And my main point was it's, it's not going to be very helpful to people. But the, The thing is you just have to, you know, you find the people that give you good information and you keep going back to them. And then over the years, you can kind of point to them and be like, OK, this is a source I trust. If they're telling me this is true, this is true. Or if they're telling me this is important, it's important. And we were talking specifically about threat research because there's so much of that now and it's coming from so many different places.

And some of it, some of these teams are very new, you know, threat intelligence teams, especially in the AI world, and they're doing good things, but they're, some of them are just people we don't know. And, you know, they're brand new. So by definition, we don't have any like history with them. And he asked, you know, how hard is it for them to kind of breakthrough? And I said, I think it's pretty difficult because we all sort of default to the people that we know and trust. And that's just how, I mean, that's how life works in general, but that's how this business certainly works.

I think that's a really good point. What's difficult too is like as we're talking about right now, it's it's really hard to meet in person and kind of gauge someone as a trustworthy source. You know, you can meet at RSA, but like you're saying, it's so hard to find new faces there with all the noise and all the craziness. And then obviously there's more like localized events like besides those types of things. Then when you have the these platforms like Twitter and granted, like rest in peace, old infosec Twitter, but like new infosec Twitter, in my opinion, is really starting to come together, like not come together, but like people are returning, coming back onto it.

But it's so different than how it used to be. Like there's a lot more like hot takes and drama and like trying to get your name out there. The hottest take that it's just, it's really, really hard as someone as, as any type of news researcher or someone who's trying to get their, their threats research out there to make a name like you're saying. And so how do you kind of invent yourself as, as a trustworthy person in the broader infosec space?

I think it's it's really difficult right now. It's super hard and I had this experience. I mentioned I, I went to talk to or meet up with Trey Ford from bug crowd and I've known Trey for something like 20 years. We were trying to figure out exactly how long and we couldn't, which tells you something. But you know, and I was with my, my colleague from Beyond Trust. We were filming something and when we left, she said, oh, what? You know, how do you guys know each other? And just like, we just know each other, you know, it's just kind of that thing.

And there were a couple of other things like that, too. She was with me when I went down to meet with John Hammond. And she has the same question. And I was like, well, you know, John, I've only known for a few years. And this is actually the first time we ever met in person, which is crazy, you know? And, you know, John was like, great, this is the first time we've met, right? I was like, yeah, as far as I know, it is. Absolutely. And I told you this, but it was such a funny experience there. As I said, their booth was right down near the bottom of the escalators and it was in like a noisy, you know, busy area. So we went over to this kind of seating area to, to sit down and talk.

It was me and John and, and the Huntress PR guy Aaron. And we're just chatting there before I even like we sat down and somebody on the other side of the couch recognized John and asked for a picture. You know, John's the nicest person on earth and said, of course, of course, you know, 30 seconds later somebody walks by, recognizes John, asked for a picture for people to know. Don't know what John, John's a very recognizable looking person.

You know, he's red hair, red beard. He's like he's, you know, identifiable. And he has a very popular YouTube channel. So people, you know, it's very funny, I think we were talking for, you know, something like 20 or 30 minutes. I think that happened like 8 times. And I could see other people like kind of hanging around the periphery that wanted to come over but didn't. It was just like this very odd thing. But I've had that experience in the past too, with other, you know, very well known security researchers.

You're just kind of standing around it at a party or something, you know, somebody like our snake or, you know, Charlie Miller or somebody like that. And people want to come over and say hi. You know, I, I really like your work or something like that. And it's just such an odd thing. And now, like, people want to get their picture with you and put it on Twitter because I see that a lot with, you know, not even people who are so well known, but just everyone being like, hey, like, I'm here, I'm meeting these, you know, I'm meeting people like I'm seeing people in person. Somebody, a couple people asked me for pictures this week and I was just like, are you?

Are you confusing me with somebody? I'm not Charlie Miller. I know we look alike. That's not me. You're. You know your local security journalism legend, Founder of perhaps person. To say, I don't know, just yeah, old is the answer. But John was so gracious. It was it was really funny. And you know, Aaron, the the PR guy kept like the laughing just like he was like, this is all the time. If we're if we're in public, this is all the time. Yeah, it's crazy.

But that does bring a good point though, is that to the point that we were discussing earlier about getting your name out there. Like I do feel like now YouTube and that's really the new avenue of. Very much so he's. Out there. I asked John about that specifically actually, because I and I was completely wrong about this. I had thought that his YouTube channel was relatively new, like I thought it was, you know, within the last three years. And he was like, no, no, it was like 2019 that he had started it. But it really took, you know, there was some, you know, massive ramp up in the last like 3 years. I don't, he didn't, he couldn't really pinpoint it, but yeah, that's like it.

He was, he was a well known security researcher inside of our community. But I think at some point, I don't, I don't know what it, what the inflection point was, but the YouTube channel that he does sort of on his own really took off. And you know, he was kind of baffled by it too. He's like, I'm not really sure why because I'm just some nerd talking about malware reverse engineering and things like that on the Internet. I don't know how many people want to hear about that, but apparently a lot. And I was like, yeah, it's a lot, man. And there's other people, there's a few people that I've started following on Twitter recently who I don't know in person that have millions of subscribers on YouTube that do, you know, roughly the same thing that John does. Kind of like malware reversing or IR, you know, deep dives and things like that, which I think is another cool way that people can learn about this stuff without, you know, being on the ground at RSA or Black Hat or,

you know, cyber work on or whatever it happens to be. But yeah, it's a completely new thing in the last like handful of years. Yeah, and I think part of that too is that the nature of cybersecurity and just tech in general is a lot of it is tinkering and teaching yourself and learning. And where do people go? They go to YouTube for for training videos. So I think, you know, it really has unlocked something that there's a strong demand for there. So that's that's an interesting aspect of it as well.

Yeah. And I think that's only going to get larger. We were talking before we started recording about the opening night of Major League Baseball was in San Francisco during RSA. And I went to the game with a couple of our friends, the great Matt Johansson among them. And Netflix was broadcasting the game. And they're they had taken over a bunch of spots right near my hotel, which is right by the ballpark. And every morning as I'm like walking out to go to the Moscone, there's just all these like D list content creators and like influencers, like recording content outside this sports bar on the court, like on Embarcadero. Just it was the I know I sound like I'm 1000 years old, but I was just like, who is who's watching this? Like, what are you doing?

I don't, I don't it just, but that stuff was all over the, the Moscone too. You could if you were just walking through the lobby or even down on the Expo floor or the Marriott, you know, over there everywhere, just random people with like somebody filming them. But I don't know what they were doing. But you know, I assume they're a lot of them probably work for vendors or contractors for vendors or something like that. I don't know. Yeah, I'd imagine the like, you know, video is really the new medium and I saw it too.

And I think they had this like starting like, you know, at least three years ago, but that they instead of just a press pass this year, they have content creator pass and, you know, passes that specifically cater to those types of, you know, people that are posting videos or other types of formats like that. So. Yeah, which is smart on their part. I mean, that's, you know, it's another way to sort of draw attention to things. But yeah, it's just such a weird shift in the last couple of years to see all of that, you know, just like random people walking backwards down the sidewalk with like a, a huge camera to, you know, filming 2 random people in like vendor shirts just walking down Market Street. Just like OK.

Yeah, that's, you know what? It's that's where everything's going. I know I gotta go get like I feel like selfie sticks are out now and they have been for a decade, but like feel like I need to get a selfie stick again and go bring it to our set You. Might have to you might have to it's and even just not even creators, but random attendees I would see walking around the Expo floor with like a a selfie stick or something like that, just kind of filming themselves walking through the the thing of like recording their experience being there, which, you know, again, if you have never, it would be an experience if you had never been there before and you're just like, holy shit, look at all of this.

And I only I didn't even go to the other side. I only went to the South Expo floor. There's another whole one at north. I didn't even go to that. You know, there's another who knows 200 vendor. I don't even know. But yeah, it's it. It's wild. That's really. Yeah, that I, you know, that's a interesting piece of it too, is like people doing almost like a, my experience at RSA, like just recording, walking down the hall, like, you know, going through the different booths, things like that. You know, I've seen a few of those YouTube videos. They're about like an hour and a half long and it's literally just that.

And they get a ton of views, like people want to watch it. I don't get it. I know it reminds me of the travel bloggers or vloggers who who, you know, just literally do that. And here I am boarding my flight to, you know, Abu Dhabi or whatever. And then they just like, yeah, it, it's that kind of thing. Yeah. But but in the Moscone Center, yeah. Yeah. In terms of sessions, like what did you know, were there any of that stuck out to you like any or any like I guess overarching like topics or anything that stood out to you overall this year or was it mostly just continuation of previous years and what what everyone's been talking about?

Yeah, it was. It was AII texted you about this. It, it's just, I mean, I was prepared for it or I thought I was, but it is just every single session. I would, I should just go and do it. You know, a search on the sessions now and see how many actually were in some way related to AI. It's got to be a large percentage. But that was the overarching theme, not just of the conference, but of every conversation I was in, everything I was overhearing in the halls or in a restaurant, in the elevator, everything was about AI in one aspect or another.

I had a meeting with Elia Zatsev from Crowdstrike who was on the podcast a few months ago, Really smart guy, you know, researcher. If you guys haven't listened to that podcast, you should. He's incredibly smart and we only talked for like 20 minutes, but he we were talking about AI in offense and defense, like how attackers are using it and how defenders are using it. And that was kind of the, that was what I was asking a lot of people over the course of the week was kind of that duality.

I was talking to John about that and our friend Rich mogul things like and everybody seems to land on the fact that attackers are moving faster on that side than defenders are for various reasons because a, because they can, they don't have to worry about, you know, product life cycles or managers or, you know, rules or laws. They're just testing things and seeing what works and then going.

And if that doesn't work, after a week, they do something, they move to a different model or they move to a different tool or whatever it happens to be. But there seems to be a lot of consensus around the fact that like we've seen some like relatively decent AI enabled malware or you know, AI developed malware. I guess I would say not enabled, but people seem to be very apprehensive about that getting much, much worse, like very, very soon, like in the next like few months, not not years, like a very short timeline.

You know, one of the keynotes I went to they it was a guy from this company called Databricks. And he was talking, I think I put it in my story. He said something along the lines of, you know, these models in these tools are the dumbest they're ever going to be right now. So, you know, just this is going to get worse in and not, not in the, the long term, in the very short term, this is going to get worse. And from a defender perspective, you know, yes, companies are deploying AI in, in socks and things like that. And but they, everybody still needs to have humans in loop somewhere to oversee what these agents are doing or how these tools are being used.

And everybody's trying to shove AI into their products in a lot of different ways. In some ways it's working, in some ways it isn't. But yeah, I mean, AI was just, it was crazy town how overwhelming it was. Was the consensus like based on people you talked to that AI, the attackers usage of AI has significantly evolved and gotten better? Because my understanding over the past year and granted this was, you know, I would say like mid last year, most threat actors were using it for, you know, like social engineering, like at a high level, maybe, you know, spell check, like making their phishing emails seem better like. But then, you know, you would see like there were a couple of research pieces that came out that looked at malware that had been, I think it was like

developed like with AI components in it or something, right? There were still kind of caveats there because the the malware was like easily detectable. So what was the consensus there in terms of like the sophistication at this point of threat actors? It seemed to be that like a lot of other trends or shifts in, you know, offensive tool development, the people at the very top are moving really fast and doing things very well, you know, state back, back to actors.

Top level cybercrime operators are using AI coding tools to speed up malware development, to refine their tools to in some cases, refine exploits as well. But that doesn't seem to be as effective as malware development, you know, implant development. The exploits themselves. Most of the people I talk to are aren't great so far.

They need to, you really need humans to because there's so many variances in like the version of the software that you're attacking or you know, small environmental, environmental variables or whatever it happens to be. But yeah, the malware development with AI coding tool seems to be where a lot of people are putting their time and effort and also using AI to help spin up fishing and C2 infrastructure and tear like very, very quickly.

You know, some of that stuff was automated before, but it was, I mean, it's going to sound dumb, but automated by hand. Like people had to go and like build their own tools to automate things like that. Now they can use AI tools to automate the development of fishing templates and you know, fishing as a service platforms and domain generation and all that kind of stuff that plays a big part in cybercrime. So that kind of stuff is just like accelerating at like almost an exponential pace. So it's, I think it's if you're just a defender in a even a large enterprise with a mature security team, man, it's going to be really tough in the coming years I think. Yeah, and even beyond like quote and quote sophistication, like I feel like, you know, 10 years ago or more like the big thing was OK there.

Now these, there's these fishing kits or whatnot. And that is lowering the barrier to entry for cyber criminals. But now with AI, it's, it's not just lowering it, but like making it quicker because as you say, a lot of cyber criminals are just using these processes to like speed up their work flows and like streamline them, automate them. So on the back end now, like even if you have you know, phishing kits like that, what happens around those processes is being speed up so quickly as well.

Yeah. And once they get access to a machine or a network, then they have AIAI enabled tools that are going out and doing the reconnaissance and the lateral movement and all of that kind of stuff. Without an operator with hands on the keyboard on the other end, You know, they can walk away and go get lunch and come back and see what they got, which, you know, it's a little scary. Yeah.

And then on the flip side, like, you know, it sounds like what you're saying is a lot of people were saying we're not ready for this, but like you have like these large enterprise organizations where to deploy, you know, to, to make these types of changes to meet that challenge, it's gonna take months and it's or like, you know, even years to implement that. And even, you know, that's with large enterprises for like smaller organizations, this isn't even on the radar really. No, it's.

Just Nope. Yeah. Not at all. And the other, there's two other things I wanted to mention about that. One is vulnerability research from AI tools. I mean, we're at the very, very, you know, like Jurassic period of that right now, but it's already moving fast. I mean, in the next, I would say, you know, handful of months, we're going to see some weird shit happening with, you know, vulnerability discovery from these AI tools.

You know, we've seen some of it already, but it's, I think it's going to be a huge chunk of the vulnerability research landscape really soon. And that kind of automation like software vendors don't have the ability to triage all those reports. If you're, you know, if you're an independent research out there, say you're a bug bounty person who, you know, there's plenty of those out there that make their living off bug bounties and now you can automate that discovery. I mean, some of that stuff was automated anyway, but now you can do it in a pretty efficient and effective way with AI tools and you're sending out, you know, could be dozens of bug reports a day to vendors.

You know, even if you're Microsoft or Google, you can't deal with that level of incoming stuff, a large percentage of which which will probably be trash or, you know, duplicates or, you know, false reports or whatever. But somebody still has to look at those and decide whether it's crap. Yeah, yeah, I know. Did you get to B sides at all? Because I know Katie Moe had a good talk I heard on Twitter about somewhat about that topic.

So I would love to hear what I heard about that. I heard the same. Yeah. I haven't had a chance. No, I didn't get to see her and I didn't make it to B sides, but I heard the talk was really good. Of course I heard she also sang a song if I'm correct. I heard karaoke was involved. And she loves karaoke, yeah. My two favorite things, yeah. Oh man, she loves it. We, I don't think you were there, but we had a decipher party, a Black Hat. Gosh, it might have been 2019 probably was at this bar.

I don't even remember the the hotel that it was in, but it was like a music theme, like a a record themed bar and it had all these private karaoke booths you could go into. So you could go into this little closed like phone booth thing with like two or three other people. Yeah. And so you weren't like black, you know, overwhelming the whole bar. I. Think karaoke. Oh my God, it people loved it. Yeah. I think Katie was like going in and out of booth, like, yeah, that was like her. She was home.

That's great. Yeah. The other interesting thing, and this isn't totally about security, but on the AI topic, I was talking to a few of our former duo colleagues, like just casually hanging out one night and just talking about like AI revolution, all that kind of shit. And, you know, one of the guys is like, the thing that I really worry about is if all of this succeeds, like if AI does what everybody says it's going to do, like the number of jobs that will be eliminated, the number of humans that will be affected by this in a really detrimental way. You know, forget about like we're destroying the environment with all of the compute like requirements for this. Like that's a real concern too that we have no control over. But he's like, I really worry if this succeeds, like if everybody's right, like we're already seeing it. You know, there's good

developers and software engineers that can't find jobs. Just because of this, in the last 12 months, 18 months, you know, and I thought he, I hadn't heard it put exactly that way, but I'm afraid he's right. Yeah, I think about that a lot because you know, for us specifically like this AI's impact on writing and kind of our entire industry is, is huge. And you know, if you can pop in, you know, if you can pop out articles on AI, there's actually a really interesting Wall Street Journal article about a journalist who was just using AI to write articles. But it's like, what is your role and your function? And I feel like personally, I actually have a little more of an OP more optimistic take on it, which is that I think that like we were talking about trust earlier in the podcast, Like I don't, I think there's going to

come come a time when people realize they don't trust AI models and what they're generating and what they're doing because, and we've talked about this too, but the whole, you know, we, there's no like clear source of information or source of where these workflows are coming from that people understand at this point. So I think, you know, it's going to get worse before it gets better. But like, eventually down the road, I think people are going to be like, like, this is crazy. Like, you know, we need human eyes on this. Like we need someone who is looking over this like, so personally, I'm optimistic about it. I think there's going to be that people are going to go all in on AI and then they're going to back off and be like, whoa, whoa, whoa.

Like it's not, it's not more. It might be more efficient, but it's not better. It's not the best quality. So I I don't know though. I mean, it's certainly not great. Like. Not great for cybersecurity and for the workers in cybersecurity, but who knows? Yeah, I'm with you on that part of it, the writing part of it. We were talking about that on that panel I mentioned earlier, me and Steve and Todd and Bill specifically about, I think Todd asked us like, can you guys look at an article and tell if it was written by a human?

And I think Steve and I both landed on, yeah, most of the time I think I can. And somebody brought up the problem of people like us who have 20 years of content on the Internet that was used to train AI models now. So something that a model spits out might sound like Steve, or it might sound a lot like me or you in a technical article.

And then then Reagan said that he has, I forget which tool it is, but he said he has settings. He's like, have the write this story in Dennis Fisher's voice. Yeah, he has it. He has some tool set like that so that he can he can sort of say like, what would this specific journalist, how would he cover this story? I'm like, Steve, I don't like that man. I don't like. That's. Amazing. I don't. I don't care for that.

That is true though, I mean like it's it's really easy for these models to be like rated in this voice totally, which is just crazy It's. Yeah, I mean, it's cool and it's horrifying at the same time. Which is kind of the overall my feeling about AI. It's cool and it's terrifying. Yeah, I know. And AI in general is just or where it's at right now is like just classic tech industry like there's. Something tiny. And cool. And let's go after it.

Let's go all in, and let's just not think about what that means. No question. Security, we're, we're very much used to that mentality, unfortunately so. Yeah, the the hype cycle on this one is faster and more intense than anything I've seen in my career, which probably means that the down, like the the inevitable downside of it will be faster and more intense than than previous ones too.

Yeah, I remember like, you know, 2021 or whenever this was first coming out, maybe 2022, whenever Gen. AI first like really started the boom that you were talking about this how it felt similar to the cloud, you know, earlier, which it was like way earlier. But do you still feel like, do you feel like it's surpassed that at this point or like. Yeah, I think so. Yeah, the cloud thing was interesting because it was the first real new, like mobile computing was one thing, you know, like the smartphone thing and whatever that wasn't. I mean, it was a shift, but it wasn't. It was different.

I guess the cloud platform shift when everybody was just putting everything on AWS or Google Cloud Platform or whatever was pretty gradual. It was not an overnight thing at all. I think a lot of that had to do with compliance and governance concerns about where your data was and how it was being accessed and analyzed and a lot of legal concerns. So enterprises had to be a little more cautious and and slower about that.

And you would think that AI would be the same because in a lot of cases, you're taking hopefully not sensitive data and putting it into an AI tool. But we know that people are doing this. We've we've seen plenty of stories about it. And, you know, some companies are being cautious about how they're deploying these tools, but they can't totally control how individuals are doing things, you know, especially on their own time or things like that. But yeah, this is so much faster and so much more intense than that than the cloud thing.

And I feel like the security folks who got really interested in cloud security at that time, like Rich Mogul or Chris Hoff or Dave Mortman or folks like that, that, you know, know, as much as there is to know about cloud computing and security had long backgrounds in enterprise computing before that. And I think some of the people that are rushing into the AI, you know, Tornado don't have that.

You know, they're just kind of like, hey here, like you said, there's a shiny new thing over there. Let's go see what that is and throw a bunch of money at it and throw a bunch of data at it and see what happens. I'll tell you what happens. Bad things, so. Yeah. Well, yeah, it's it is. We'll we'll see how kind of the AI problem progresses, but. Sounds. Yeah, sounds like it's going to continue to be crazy. Yeah, it is. It'll be fun to see a year from now what RSA looks like or even, you know, five months from now what Black Hat looks like with this. I'm I don't know what the Black Hat CFP deadline is. It's probably relatively soon, honestly, but I'm sure there's a shit load of AI security talks on there. And some of which will be like here's how I completely compromised Claude, or here's

how I completely compromised this model or got access to this LLM that I shouldn't have or you know, things like that, which is great. That's what we need. We need to people pointing out the weak weaknesses in this whole ecosystem so that they can be addressed. But I have a feeling that conference will be, you know, a big fraction of it will be AI research, too. Yeah, I mean, as long as it helps like address the core problems in in the industry instead of take away from them cuz yeah like even just this week the whole team PCP like supply chain attack like we're seeing the same things happen over and over again. And if we're putting all of our, you know, like if we're just talking about AI during these conferences and like all the time, like and ignoring kind of the, the core issues that we continue to see, then it's just

like. Frustrating. They're still I. Think cuz it's where it's like where are we going? Yeah. We still have a lot of fundamental problems that we have not fixed in any real way. Yeah. And AI is not going to fix those problems either. It's probably gonna exacerbate a bunch of them. So. Right. Yeah. So, yeah. So that was RSA. It was a thing. It was a time. That's exactly the way you described it on the podcast is exactly what I would have thought chaotic, crazy, but also like great to see friends and you know, people so. Yeah, that's, that's accurate.

Yeah, that was accurate. So all right, well, you are back. This is it. Yeah, you're back next week, back from leave, back to doing things. Ready to jump back in. Yeah, we didn't fix anything while you were gone, so don't worry about it. Yeah, nothing got better. I'm, you know, like I've been catching up with everything, like all the security news and everything over the past few days and yeah, I'm excited to be back and get back into the swing of things so. Yeah, we're, we're very glad that you're back. So.

All right, I will talk to you soon. All right. Bye. Dennis. While you were back in planning, I was trying to. Decide what in land, even if I could not understand.