"Security by compliance will only get you so far as your first big security incident. Once you have an incident or event that has true business ramifications for you as a vendor, as a company, or for your customers, that is the wake-up call for a lot of organizations."
Eran Leib (00:01.122)
So hello everyone, welcome back to Backline and Filtered. My name is Eran Leib, I’m one of the co-founders of Backline AI. I’m here with Maor Goldberg, my co-founder and CEO. And we’re very happy and excited to have here with us Mike. I’ll let Mike introduce himself.
Mike Geehan (00:17.123)
Hi, everyone. Mike Geehan. I am the head of security compliance and corporate IT at Cockroach Labs.
Eran Leib (00:25.986)
Amazing. So Mike, we’re really excited to have you on. We wanted to cover with you, you know, like two big things today. What about securing distributed systems at, you know, global scale like approach? And the other one is about how security teams balance, you know, like pragmatism versus perfection because we’re all, you know, like we all want to have perfect security, but it’s not really something that is really doable. It feels like the second one is something, you know, every security leader kind of…
faces on daily basis, deciding what’s worth fixing, what’s acceptable risk, how do you measure good enough? And especially now when we have automation and AI starting to slip in, you know, like backline, it makes it easier to move fast, but not always, you know, like with full context. So I want to start there on the second subject. How do you personally approach this trade-off between fixing everything and focusing on what really matters?
Mike Geehan (01:22.575)
Well, I think the critical piece from our perspective, obviously, Cockroach Labs created Cockroach Database almost 11 years ago. We’re about to have our 11-year anniversary. And we launched it as a cloud offering, I believe about five years ago, which has matured and evolved over time. And now we’re a multi-cloud offering across the three major clouds.
Eran Leib (01:34.893)
Congrats.
Mike Geehan (01:48.527)
From a pragmatism of fix everything versus fix nothing versus fix something, what I would say is customers expect you to fix everything eventually. They generally, at least the security teams and customers are equally pragmatic of they understand that it is very hard, especially once you get to the tail, the long tail of vulnerabilities, the moderates and the lows and the informationals.
especially as the industry and the environment change so rapidly. But from a critical and high, there’s SLAs. There are absolute requirements as to what can be fixed and when it needs to be fixed. And so it’s a constant prioritization and it’s a constant juggling internally of what does security see as the criticals.
Maor (02:29.803)
you
Mike Geehan (02:47.769)
How do we measure that in the context of the overall security posture that we have and the security controls that we have? Because a lot of vulnerabilities, yes, it may technically be a critical or a high. But if you have other security controls in place or where it is in the code base or where it is in the ecosystem, can greatly put
their thumb on the scale of is it truly critical or is it actually a low? If it’s a high vulnerability, but it’s in test code, it never actually impacts the customer operations of the platform, at which point it’s deprioritized as compared to a high that can be exploited in a customer environment.
Eran Leib (03:37.861)
Okay, I mean, what would be the metric that you would measure yourself, I mean, internally versus, you like what your customers are kind of measuring you? Do they look at numbers? Do they look at, you know, number of vulnerabilities versus severity versus, you know, like what do they look at versus what you look at?
Mike Geehan (04:01.319)
It depends on the customer. And I think that’s going to be my answer for pretty much anything, to be honest with you, is it depends on the customer. The reality is a lot of the security intensive customers, the customers that have their own compliance and regulatory requirements around security, they expect that on the release of any
new version of the product. here I’m talking about our self-hosted products where we ship them to the binary and they deploy it themselves. They care very, very much about what new vulnerabilities are being introduced with this release. So what is the delta from version one to version two? Or in our case, 25.2 to 25.3 and there onwards.
So they care about that, and they care about it in two different lenses. One is we provide them a sanitized report of vulnerabilities from our platform. So against each release, we will run the scan. We will deduplicate the vulnerabilities. We will look at the false positives. We will update our exception policies based on what we know is test code and non-relevant.
vulnerabilities that we know are with certainty cannot be exploited. We provide those reports to them. We also provide your standard SBOMs, which they then run a generic security scanner against. And that generic security scanner will come up with a laundry list of vulnerabilities that we have deduplicated. so depending on the customer, we have to go through that reconciliation process to the point where they can trust that the cleansed
Maor (05:34.442)
Okay. So.
Mike Geehan (05:50.381)
And I don’t mean cleanse in a bad way, but the sanitized report that we provide them is accurate as to the exploitable vulnerabilities in the code base. And they look at it both at a point in time. What are the vulnerabilities in the current version, but also which ones have rolled over from version to version and what are we doing around that? And hence, how are we meeting the…
Maor (06:04.969)
you
Mike Geehan (06:16.451)
contractual SLAs around vulnerability management, which a lot of the contracts now certainly can have.
Maor (06:24.361)
Mike, do you feel that compliance and SLAs drive more of the pressure relative to actual security concerns, both? Is it always the same balance between both, or you feel that different types of customers will treat compliance versus security differently?
Mike Geehan (06:48.943)
I think a lot of companies, both as customers and as vendors, especially the earlier you are in your kind of maturity process from a security and compliance perspective, conflate the two. They consider compliance to be security and security to be compliance. And so a lot of the work that a lot of companies do is security for compliance, not security for security.
And so I’ll go back to my previous answer, which is it depends on the customer. Some customers want the SOC 2 report. They want the clean vulnerability report. They want whatever their requirements are based on the compliance, internal security check marks that they have and compliance check boxes that they have to check off. And so a lot of the times, especially in larger organizations, they have a more myopic perspective.
Eran Leib (07:23.026)
Okay.
Mike Geehan (07:47.531)
on some of these things, they look, I have this report. If it doesn’t meet what I need, then they’re going to be issues. From our perspective, we probably started with a security by compliance, right? That we did these things because we needed to do them to achieve compliance. We have matured well past that now, and we’re looking at it from a perspective of, hey, what is the right thing to do? What do we need to do to protect?
our customers and our customer data. At the end of the day, that is the critical thing that we are stewards of. We are stewards of our customers’ data. And we have to treat that white gloves with absolute care and perfection around anything that can impact their data. So once you’re talking about the vulnerabilities themselves, the way we do that prioritization from a criticals or mediums,
we look at it from a very objective perspective of what could impact our customers, what could impact their environment, what could impact our platform. We’ve all seen the recent AWS and Azure outages. Granted, they were DNS focused, but they happen regularly. More recently, there was the NPM poisoning attacks that were going on. And we treat those as essentially zero days.
And we treat zero days as a, you know, almost drop everything and treat it almost like an incident. We don’t always treat it, you know, through the full incident process, but that’s how we approach it. We’re looking at these things to ensure that we are protecting our platform and hence our, our customers to the best of our ability.
Eran Leib (09:37.245)
Yeah, I can. God.
Maor (09:37.735)
Yeah, I think.
Maor (09:41.255)
No, I just wanted to comment. It’s really inspiring hearing you saying what you’re saying. I think what I’ve seen over the years is that many organizations, when they’re less mature and typically would be in the mindset of we don’t have a lot to be worried about, but we need to move quickly.
So we need to check a lot of boxes that are more compliance oriented. So we will be able to move and build and so forth. Some customers will get to a point when the company is successful, of course, OK, now, holy moly, I have a lot of customer data. I have a lot of assets. There’s a lot of reputation on the line of our organization, of our customers’ organizations. And then some security leaders like yourself will say, let’s
see beyond compliance and let’s make sure that we’re doing the right things for our customers. And unfortunately, I still see customers who will say, well, we’re checking all the boxes. It’s fine. But then to your point, some of these events will come knocking on their doors. I don’t know if just meeting compliance will cut it in these days and age.
Mike Geehan (10:58.959)
The way I see it is security by compliance will get you only so far and it will only get you so far as your first big security incident. That time, once you have an incident or event that has true business ramifications for you as a vendor, as a company, or for your customers, that is the wake-up call for a lot of organizations.
Eran Leib (11:11.312)
That’s a good definition.
Mike Geehan (11:27.927)
the kick in the pants that a lot of companies end up unfortunately needing to be able to take that next step in security maturation. So it’s unfortunate, right? Because at that point you’re playing fast and loose with your customers and the trust that your customers have in you. as small companies, it’s really weird. Small companies tend to do this a little more because they have to, they have to move fast.
But any impact from a security perspective on that small company is company ending potentially. You could lose your one big customer that is generating 50, 75 % of your revenue or whatever it may be. You look at it at the alternative side, the Equifax breach that happened several years ago or any of the breaches against large companies.
they’re able to weather those a lot more effectively because they have a much more stable revenue base. So it’s a real balance that is extremely hard for any company to manage. And it comes down to your tolerance for risk as an organization and what risks you do and can take both.
inherently without thinking about it and which ones you were objectively going, yes, we know there’s a risk here. We know there’s work to be done in this particular area and there’s always work to be done from a security perspective. It’s almost the joy of the industry is that you always need something. There’s always something else coming up. These days it’s AI that keeps a lot of people up at night. it’s one of those, it’s an ever evolving situation.
And there’s no right or wrong answer, at least until you actually get, you know, pinged and poked and you have that, you know, that real impact of, know, you suddenly hit the five o’clock news, you know, on what is the headline that’s associated with your company. You want it to be a positive one. You don’t want it to be a negative one.
Maor (13:41.536)
Yeah.
Eran Leib (13:42.171)
Yeah, you know, once I posted. Yeah, that’s very true. Yes, security just for the purpose of compliance is usually failing very fast. Like you said, it will get you so far and then you’ll need to know security and actually act for security and not just for the sake of compliance.
Mike Geehan (13:45.839)
Yep.
Mike Geehan (14:03.503)
Smart customers see through security for compliance sake. They see through it because they have been through it and you are dealing with extremely smart, capable people that won’t take those high level answers, those hand wavy, these are not the droids you’re looking for answers anymore. They want the details. They really will dive into the details.
Maor (14:25.326)
I’m sorry.
Eran Leib (14:31.876)
I think, I think he agrees with you. Very cool. so I’m actually going to, you know, like, I know we’re kind of very on this, but we’ve been working with you and your team very closely. And, I wanted to ask, you know, how did you feel first time when you saw, you know, like, a fix being generated, taking care of vulnerabilities in your environment. And you knew that all of that was by AI.
Mike Geehan (14:34.691)
Yes, I think she does.
Maor (14:35.119)
Yes.
Eran Leib (15:01.541)
Does that give you hope that things can actually turn to the better in this fight?
Mike Geehan (15:11.311)
Is this PG-13 or not? So what I would say is it’s a combination of both exciting and extremely scary, right? There’s AI and any autonomous action that you give to a non-human entity. It’s scary enough giving destructive or change abilities to humans, giving it to…
Eran Leib (15:14.879)
Hahaha!
Maor (15:15.69)
Hahaha.
Mike Geehan (15:39.637)
a non-human that doesn’t necessarily, doesn’t necessarily, absolutely does not have the ethical and moral compass that we hope most humans have. It can be very, very scary. Now the reality is, yeah, it’s exciting because what it’s showing is the ability of a system to effectively analyze our environment, effectively analyze
package versions and dependencies and interdependencies and truly test out fixes in a way that shows that we can remediate vulnerabilities. But even being able to hit a significant number of them is going to unleash and unlock potential and productivity.
Not so much for security, right? We’re ancillary. We’re stewards. We’re reporters of what the vulnerabilities are. Very rarely are we always the ones to actively have to actually patch a vulnerability because we don’t own the code, at least in our system. We have engineering teams that are on very, very specific parts of our code base. But what this is doing is unleashing that productivity for the engineers and removing that toil for them.
where we’re constantly going back and saying, look, there’s a new vulnerability. Can you patch to this version or what version can you patch to? And then go, well, we don’t know what the actual impact is going to be because our code base is.
pretty complex, right? It’s a code base that’s been developed over 11 years. And so there are intricacies in the code base that scare people. Change is hard. Change is scary for people. And that includes just changing package versions because they don’t necessarily know what the impact will be. Is it going to functionally impact the working of the code? Is it going to have performance impact to that code base? And so being able to run a
Mike Geehan (17:53.483)
a fix through the cycles of validating what changes are possible and required, testing them, validating them, and doing all that in a way that is relatively seamless and integrates into our build pipeline makes the process a lot easier because we’re not asking people to operate outside of the normal workflows that they have.
Eran Leib (18:21.38)
That’s a great perspective. Yeah, I agree.
Maor (18:21.846)
Yeah.
Maor (18:26.691)
I think what we will need to, sorry, kind of continue and reflect, I think with AI, I think it’s true to AI even more broadly is what, at what point, what signals do we need to be able to trust that AI can provide, you know, as good answer, take the as good action.
or make the as good decision as a human being because humans are not perfect. So in a way, us saying we will only leverage AI if AI would be perfect, we might be adding unnecessary roadblocks to use technology effectively. I think it’s true to autonomous vehicles relative to human drivers. it’s true to my high schoolers
using Chatchit Preeti to figure out if an answer to a math question is right or wrong.
Eran Leib (19:24.1)
You
Mike Geehan (19:28.505)
They’re not that, no, no, I have to disagree fundamentally with you. They are not asking ChatGPT if their answer is right or wrong. They’re asking ChatGPT to give them the right answer. And then they’re trusting that that answer is right. To your point about human drivers versus autonomous drivers, once I was at RSA this year, I took, you know, I took Ubers around, it’s what you do. And then I took Waymo, I took several Waymos.
Maor (19:32.373)
Okay.
Eran Leib (19:43.5)
it.
Eran Leib (19:53.335)
Waymo.
Mike Geehan (19:58.103)
And it was really interesting to see the difference, right? In that the reality is in a baseline perspective, in a standard operating environment of, you know, driving on the street, Waymo was actually a better driver than a lot of the Uber drivers were. Now it also very much struggles with some of those rapid fire decisions that need to be made.
Eran Leib (20:25.133)
you
Mike Geehan (20:25.295)
in that I wasn’t in the car at this time. it’s a, you can tell me to shut up if you need to. I was standing on a corner and watching, there was a Waymo came up and as you both know, I’m sure RSA, the whole area is just inundated with people. They’re constantly crossing the streets here, there, everywhere. And the Waymo was trying to approach the stop sign to turn right. And it was struggling with both.
the oncoming traffic and then the traffic would clear up a little bit, but then there were people. And so it would pause and wait and pause and move it a little bit and pause. The car sat there for five minutes with traffic piling up behind it, horns honking, and the pedestrians were just like, well, it sucks to be you if you’re in that car. And they just kept on crossing the street. It was hilarious to watch. So from that perspective, you know, do we need to get to a point where
Eran Leib (20:59.587)
you
Mike Geehan (21:22.031)
AI or any automated system is 100 % accurate. Well, I think to your point, if you wait for that to happen, we would still be living in caves and trying to figure out how to light a fire, right? We have to be able to take appropriate risks in the appropriate way. Now the Waymo type of thing, yes, you have to be a lot more careful about it. If you’re impacting production code, you’ve got to be a lot more careful about it.
If you’re talking about your homework for a high school math class, there’s a little more flexibility there. If you get one wrong answer, it’s not the end of the
Eran Leib (22:02.624)
That’s famous last words, you know, those kids are going to be, you know, like space engineers at some point, and they’re going to ask CHPT to get the trajectory of something.
Maor (22:13.015)
I think it’s exactly…
Mike Geehan (22:13.295)
That they are. And the first time that it goes horribly wrong, I mean, you’ve got the whole stories of the studies around giving an AI system control over an air defense system. And it makes the decisions to protect the majority of the population, that it won’t just not protect all of the border locations. It will actively destroy those border locations itself.
to protect the majority. Right. And so that’s where the ethics and the morals get very, very hard once you start dealing with real life situations. I, you know, overall, am I excited or scared? I’m both. Right. I grew up in the era of Terminator. Right. I remember the advent of Skynet and the repeat events.
Maor (23:07.168)
He
Mike Geehan (23:12.323)
Can it go that way? I mean, it could, but who knows?
Maor (23:19.038)
I think, yeah, I’m with you.
I was right there with Terminator and Skynet and all of that. So of course, everything that we’re seeing recently brings back all of those memories. I think it’s about exactly the way you’ve described it. It’s our risk tolerance. If we wait for it to be perfect, it will never be perfect. And we will lose a lot of efficiencies that we can already gain today and tomorrow and next year. But then how do we…
make sure that at a certain point in time, when we’re driving a car or changing a production code, we have enough checks and balances, we have enough techniques to verify the work so we know that we can leverage the technology effectively.
Mike Geehan (24:09.847)
Yeah, one way I’ve heard it, and I can’t remember who told me about this, but one way that, it might’ve been a different vendor to be honest with you, that they look at it is the whole concept of pilot, co-pilot, autopilot. And I don’t mean co-pilot as in GitHub co-pilot, Microsoft co-pilot. Yeah. It’s the whole concept of fully manual, semi-autonomous, fully autonomous work.
You should never go from pilot to autopilot without anything in the middle. Where we build the trust, where we build the respect that the tool can do what we say it’s going to do and not do what we don’t expect it to do is in that middle ground of human in the loop, validation, verification.
auditing of the system and the capabilities. When AI tooling and AI as an overall industry progresses beyond the build, build, build, do, do, do to a point where we can effectively manage and govern it, then we’re going to be in a much better space. But right now it’s very hard to impossible to truly govern.
AI has a, as an overall entity and beyond that AI deployments within an organization. so from our perspective internally, we’re very, very focused on what data is being ingested or managed or leveraged by the tools, what actions can be taken and what level of human in the loop do we have on the critical pathway? You you look at backlined, you know, we, yes.
We’ve been doing the testing with you all and we have it at the point where it generates the PR with the fix and the details. It doesn’t auto merge it, right? We’re not just saying, hey, have at it. Our code base is your code base. AI the crap out of it. We can’t do that, right? We can’t afford to do that for ourselves or for our customers. And so we’re taking that slow measured approach of, know, crawl walk before we even consider.
Mike Geehan (26:32.429)
Jogging.
Eran Leib (26:36.48)
So it kind of, you know, like actually connects us very nicely to the other topics we wanted to touch. What it means, you know, like to secure a system or secure systems that are never designed to go down, right? Your database is one of the most resilient and distributed platforms. And there is a whole set of challenges that some of the systems when people are talking about
99.9, you probably laugh at them and say, what are you talking about? You need to be, I don’t know, five, seven eyes, I have no idea. So let’s talk about what does it mean to secure something like that and have constant availability in the era of AI and coding with AI and stuff like that.
Mike Geehan (27:28.141)
It’s a complex situation, right? Yeah, you’re right. look, I think the recent outages on two of the largest cloud platforms show how hard it is to consistently keep a system up, right? Getting a system up, maintaining an uptime, it’s not the most complex thing in the world anymore. We’ve been at it for…
you know, from a web basis, you know, 20, 30 years, right? We understand what is required to keep a system up and running. I wish they could figure out how to keep my power up and running here in Houston, because I kid you not, I have a, you know, a smart breaker system and I had the better part of, you know, six or 12 outages, short outages yesterday alone.
because our power grid is a little wonky. But from a cloud perspective, from an environment where, we sell ourselves as a highly resilient database, right? It’s where the name of the company comes from. It’s the ability to survive anything.
It’s taken a lot, right? It’s a core part of the engineering focus of the organization is to be building quality and resilience into everything that we do. There’s something to be said for being able to move fast and bring features to market quickly and effectively. But we always, always have to keep in mind that quality aspect of the code and the ecosystem that the code is living in.
needs to be robust and resilient. And as far as I’m aware, during the AWS and Azure outages, unless a customer only has a cluster deployed in US East 1, then we’re able to survive regional outages. It’s the way the system was designed.
Mike Geehan (29:35.811)
Right. Now, a lot of that comes down to not only system engineering on our side and a follow the sun approach from how we monitor and manage our environment. And we’ve got a huge amount of observability to keep an eye on how the ecosystem as a whole is performing and where there are bottlenecks and where there are issues. But it comes down also to this shared responsibility matrix between us and our customers.
of how they configure their database. If they configure their database in a way that doesn’t meet the resilience parameters to keep the database up, then there’s only so much we can ensure in that regard. So there is a shared model there. From a security perspective,
It’s a tough one because we are almost ancillary to the true operations of the platform. We get involved when things go wrong, right? We get involved to ensure that we’re deploying things in a safe and secure manner, that we’re building systems that are safe and secure from a fundamentals approach. The actual operations of the platform itself, luckily, we don’t always have to get in the middle of it because we’re a small team. can’t be doing that.
So it’s, yeah, Cockroach database itself, Cockroach Cloud especially has extremely good uptime. It’s one of the core things that we sell and we pride ourselves on. But there truly is so much nuance in the way that a customer deploys any system that even if you say, we can guarantee uptime.
There’s always a little asterisk off as long as you’re doing A, B, and C and continue to do so and don’t abuse the system or we don’t get hit or anyone doesn’t get hit by a state, nation level attack against a particular component. And even there, as best we’re able to, we’re resilient for component and partial system outages. That’s how we built the system.
Mike Geehan (31:58.387)
I’m in security, can I say that you can always guarantee always up? I don’t think anyone ever could for anything, right? It’s just the nature of the game.
Eran Leib (32:13.038)
More? You’re on mute.
Maor (32:15.74)
Yeah, I just wanted to say that I agree. think even in the best case, like I don’t remember ever. And I don’t think anyone can say 100 % of uptime, of security, or whatnot. In some rare cases, of course, you can operate in your own little world if you’re disconnected. So maybe that can dramatically help with security in disconnected environments, but even then.
I don’t think it’s 100 % right. You always have…
Mike Geehan (32:47.759)
I think a lot of people can and do say, we can guarantee 100 % uptime until it doesn’t happen. Right? They can say it, but being able to guarantee it is different. And yeah, there are organizations that operate in a connected fashion, but if there is an issue, it’s like a hub and spoke type of approach to some of these systems. think automotive industries where they have factories building cars.
Maor (32:53.65)
they can say. Yes.
Mike Geehan (33:14.971)
that are all interconnected in some shape or form. But if there is an issue at one location or at the headquarters, all of the remote factories can disconnect and run in an autonomous fashion. So it depends. It really just comes down to what the infrastructure is and what you’re trying to build. Go back to the energy grid. Even the energy grids are not fail-proof.
Right. The Texas grid has shown that repeatedly, unfortunately.
Eran Leib (33:50.49)
Yeah, I’ve been in Austin a few times where the grid just went away and I’m like this is the 21st century. I did not expect that.
Maor (33:53.443)
Unfortunately.
Mike Geehan (33:55.15)
you
Eran Leib (34:05.436)
Mike, I’d only say that we’re all like with some gray hair, but we all are with some gray hair.
Mike Geehan (34:16.377)
Some more than others. Yes, I know, Eran, you don’t need to pull me out.
Eran Leib (34:19.005)
No, no, I have a lot of gray hair here. But what I want to say is Or no hair, yeah. I think both of us will take more hair than the no hair. But what kind of advice would you tell a younger sister or head of security from the perspective that you have right now, which is not something to belittle at all.
Maor (34:22.294)
It’s either gray or no hair, so…
Mike Geehan (34:47.075)
Well, I mean, my flippant answer would be run away. Don’t do it. You know, find a job where you can have balance and you can leave stress at work and sleep well at night and not feel the paranoia of every Slack message that you’re seeing, that you’re self analyzing. You know, what are they saying? Is it something that could go wrong?
Security is not a field for the light of heart. Yes, there’s always a need for security, at least I hope. But it’s an ever-evolving environment. And so that’s extremely interesting in that the industry itself is constantly evolving. I look at the security program that we put in place after I joined.
and where we are now and kind of where the roadmap was even two years ago, compared to kind of where we are now and where we’re going towards, there have been some fundamental shifts and AI has been core to some of those fundamental shifts. We’ve had business changes as well that impacted, but it’s AI and our internal use of AI, how we integrate AI onto our platform and use it on the platform and within the database and how…
Data itself is becoming so, it was always important and we always know how much it’s kind of logarithmically growing in terms of the amount of data that’s being managed. AI is just injecting jet fuel into that process. yeah, where our hope is that Cockroach Database can be the platform for AI agents and AI companies moving forward. I would love to see Backline using us, obviously, you know, but that’s me.
Overall, yeah, it’s an exciting field that’s constantly evolving. So if you like that change, if you’re always looking for that next challenge, can’t rest on your laurels. can’t abide by the secure of the perimeter of the corporation. Because these days, there is no such thing as a perimeter. There is a couple of offices. There may be some data centers if you have that model.
Mike Geehan (37:09.515)
Then you’ve got a whole bunch of people just roaming the world and doing what they need to do to run your business. How you secure them, their access, your systems, the data flows. It’s exciting. It’s also continuously daunting because there’s always something else. And no matter how well-prepared you feel you are, there’s always something out there.
Yeah, AI is exciting because it can help you secure things better. It can help you fix vulnerabilities quicker, you know, with tools like Backline. But it can also be used as any tool can be for nefarious purposes, right? Phishing attacks are getting more complex. Social engineering attacks are getting more complex. Deep fake videos are becoming harder to figure out. It gets to the point where it’s…
It’s causing a lot of people who are not in security to think like security practitioners in that it’s reducing the trust that we have in what we see. Right. You can’t just inherently trust that the funny video that you watch on tech talk or Instagram is real because more and more, a bunch of them are being created and they’re being created better and better in a way that you can’t actually immediately tell that it’s an AI generated or
Maor (38:21.657)
you
Mike Geehan (38:34.881)
AI-filtered or AI-influenced video or system. And so, yeah, I look forward to the day where everyone is just as paranoid as I am, at which point I can relax a little more.
Maor (38:38.744)
I’ll tell you, I think the point, it’s really funny. I got to the point where I’m looking at videos and it’s incredibly hard for me to tell.
Eran Leib (38:49.368)
I think I win.
Maor (39:03.508)
if it’s real or not. And now on social media, there’s a lot of, you know, Sora, Sora, Sora. So you’ll see the watermarks and it kind of helps you. But some people are doing good job cutting the watermark away from the image. actually went to show my son like an hilarious video. He’s like, Dad, this is an AI generated video. And I was shocked, you know, that I kind of fell into this trap.
Eran Leib (39:29.667)
You felt
Maor (39:33.812)
My biggest scary thing is getting a FaceTime call one day and talking to someone I know from my family, asking me to do something or asking for help where it’s an AI and it’s a fake real-time video behind the scene. And I think we are getting increasingly close to the point where these things will happen.
Mike Geehan (39:54.649)
Well, we are. I mean, look at it. You look at it for all of us, that is a concern, especially for people who are potentially less security conscious or less paranoid. And even if you’re paranoid, you can get caught out. It’s so easy to get caught out by any of these scams, right? The text-based scams and all of that. They’re a diamond dozen, right? These days enjoy…
poking at the scammers once they text me and I try and keep it going for as long as I can before they walk away from me after I’m trying to woo them to the call to Cthulhu or sell them on Bitcoin strategies myself because that’s what they’re trying to do. But you look at it from a corporate perspective, there’s been a large uptick in recent years of kind of the social media text-based attacks where it’s the CEO of the company.
Maor (40:27.031)
You
Eran Leib (40:28.024)
.
Eran Leib (40:35.106)
you
Maor (40:35.595)
Hahaha
Mike Geehan (40:52.375)
I joke about our CEO, you know, every time that I present it, accompany all hands of if you get a text message from our CEO, don’t believe it, right? Because it’s a scam. Right. But to your point, yes, at some point that’s going to evolve to the point where it’s not a text message. It’s a video call or it’s a Slack huddle that somehow they’ve gotten access to your Slack instance and they…
you know, huddle you and you just see the CEO’s name, you don’t think about it twice. You answer it, right? And so, yes, security teams need to be able to help secure your system so that you’re not allowing those external intrusions. But, everyone has phones, everyone is accessing them. If you’re moving at a breakneck pace and aren’t able to stop and think about something and you’re not able to respond with thought as opposed to…
react on the spot, then people are going to get caught out. It’s yeah, absolutely.
Maor (41:55.36)
Yeah, for sure.
Eran Leib (41:58.488)
Yeah. Um, I think we’re going to wrap this and I wanted to say thank you, um, because, uh, you’ve been working with us very closely, you and the whole team. Um, and, um, you have a lot of insights that are, you know, like helping us and helping, I feel like the industry, uh, because the stuff that we’re working on right now is, is, you know, like groundbreaking in some ways and, uh, getting insights from.
people like you and others is very useful. And I wanted to thank you personally for that. I’ve done it off mic, but I’ll do it on mic as well. So thank you again.
Mike Geehan (42:40.003)
No, of course, what I will say just to wrap up from my side for you guys is it’s exciting to be able to work with you, right? I’m glad that we are able to help and any help I can provide. Helping you helps us, right? And it helps the industry as a whole. If we’re able to help the security industry progress and mature and reduce the friction that is…
Maor (42:40.384)
Yeah, absolutely.
Mike Geehan (43:07.597)
constant between security organizations and the rest of the company or the rest of the world, it feels like some days, then all the better. And being able to help yourselves get to that point and help us get to that point just makes all of our lives a little bit easier. And we can all sleep maybe an extra five minutes.
Eran Leib (43:31.703)
Thank you very much.
Maor (43:35.478)
Thank you very much. We really appreciate the cooperation. It’s really humbling and inspiring working with industry leaders like yourself. We learn a lot. We’re doing all of these to really face the most demanding environment and make sure that we can help the most demanding customers. And then we appreciate the opportunity really from the bottom of our hearts.
Mike Geehan (44:06.189)
No, of course I’m glad. Thank you for having me. I will say just one last thing. I don’t think I actually answered your question about what advice I’d give to a young CISO beyond running away. know, what I would say is, you know, be open-minded, you know, and approach things with that open mind, with a healthy level of skepticism and, you know, look at your organization and help your company grow and progress in a way where security is.
Eran Leib (44:15.201)
to run the page.
Maor (44:16.981)
Ha ha ha.
Mike Geehan (44:35.969)
adding business value and bringing business value and isn’t just a roadblock, right? If your security team is just seen as a roadblock, as a blocker to progress, be it velocity or whatever it may be, then you’re holding yourself, your team and your whole company back. And at the end of the day, that does no one any good.
Eran Leib (45:02.081)
Perfect.
Maor (45:02.74)
I love it. I think this is going to be on LinkedIn next week.
Eran Leib (45:10.273)
Thank you.
Maor (45:11.54)
Thank you very much.
Mike Geehan (45:11.695)
Thank you.
