The First Cybersecurity MCP Server

Hey everyone, welcome back here to Techstrong TV. I've talked about this before. I came up in the security world, I think in kind of the golden age of security, if you will.

Those early, the first decade of the century, even the second decade, so from 2000, let's say, all the way through COVID maybe. I was really lucky and blessed to come up with a group of people, a whole class of people that really defined security. Because quite frankly, before 2000, we called it information security, but it wasn't anything like it is today, certainly.

But it really wasn't the discipline that it became in those 20 years. My next guest is one of those people who came up in those days with me. Always a happy face to see at the Security Bloggers Network every year at RSA.

But throughout the year, he was always saying smart things, doing good things. My friend Wolfgang Goerlich. Wolfgang is now an IANS faculty member, as well as a public sector CISO.

Wolfgang, welcome to Techstrong TV. It's great to have you on here. So great to be with you.

And I agree, those golden years, we're all just trying to figure it out, right? Yeah. We were.

What is this field? What are we doing? How can we give back?

How can we help? But you look back on it, besides it being just such a great time with great people, it was quite an impact. It was quite an impact when you think about the things, and we really kind of defined a discipline, right?

Mm-hmm. Because no one went to school for cybersecurity out of the people I knew, right? We all were network people or whatever.

You got shoved into it. But, now, of course, it's so different. Wolfgang, I don't know if a lot of people out here know IANS, I-A-N-S.

I mentioned it to someone a couple of weeks ago, and they looked at me like I was talking about dog food or something. So why don't we start there? How would you describe IANS to the folks out here?

Yeah. Perhaps IANS is one of the best-kept secrets in cybersecurity. So it is a practitioner-led organization that provides research and intelligence to other professionals, right?

So if you're a CISO and you're in healthcare, financial services, tech, public sector, all areas I've worked in, you're always wondering, like, "What do I not know? " Like, "I'm about to do X. I know there's pitfalls.

" And what IANS has done a really good job as is pairing up practitioners to become faculty with people who are trying to make decisions, trying to take action. So you're trying to get something done. Let's say we're putting in an AI policy, and you can reach out to folks at IANS, and they can give you advice about what's worked, what's not, and what's up and coming and emerging.

Love it. Before we go further, because I'll forget, if people want more information on IANS, what's the website? com.

Perfect. And I should mention, besides Wolfgang, I have more than several friends who are affiliated with IANS. Rich Mogull, Adrian, I can never pronounce Santareia.

Jennifer Jabish, Jennifer Mannella Jabish, whatever. Just off top of my head, those three come to mind, but there's more, I'm sure. Because whenever we're in the same town together and I wind up going to an IANS or a restaurant where the IANS folks are, it seems like I know everyone at the table.

But Wolfgang, recently, IANS launched something a little out of character for them. Yeah. Right?

A piece of software. Yeah. The- And, go ahead ...

Yeah, they recently launched the first cybersecurity MCP server, which is providing this research right in the prompt. That's pretty cool. What do you mean exactly by that for our folks out here?

Yeah. So let's suppose, first, let's jump back to what you said, right? We all came up trying to figure this out, and we've seen lots of different innovation waves, be it the cloud or zero trust or what have you, when things are changing very quickly.

And I think we can all agree right now the space that's changing very quickly is generative AI. But you get on the prompt, and I have a problem trying to solve it, and you ask the prompt, and you get back this answer that sounds all right, that sounds kind of generic, maybe sounds a little bit like marketing fluff, sounds way too well-written for any cybersecurity person, if I'm honest. And you're like, "Okay.

Sure. That sort of makes sense," but it isn't really tailored, right? Because as we all know, AI is trained on the entire corpus of the internet, but it's not necessarily trained on decisions that people are making right here, right now.

And so, what the IANS MCP allows us to, say you're working on something in Claude, and you're like, "Hey, I'm trying to update my policy. I'm trying to update my standard. " This is a real example.

I was working on a runbook. I'm like, "I wrote this runbook about six months ago. " And it reaches out through the MCP to IANS research and pulls back quotes, insights, polls, what have you, to enrich the content that you're working on.

So is it a one-way connection into the IANS research corpus? It's not. So that's the gateway.

Well, APIs are one thing, MCPs are another thing, obviously. But so that's pretty cool then. Now- You have to be, I guess, an IANS customer to be able to access this.

Yeah, that is true. It is for IANS clients and IANS faculty members. And it has the complete corpus of IANS research kind of idea.

What a great thing to have at your fingertips when you think about it, right? Yeah, it is. And so you mentioned JJ and all the other folks, right?

So I could pick up a phone, I could get on a Zoom for these folks, but we're all pretty busy, so it's going to be two, three weeks out. Yeah. I could get on the portal, and I could download the research.

Remember how we used to do this? You download the paper, and you'd yellow highlight it, and you go through it- Yeah ... with your laptop date.

Yep. You know what? Part of me is sad.

People coming up now are never going to know from that. Mm-hmm. Look, we lived through the generation where we went from going to libraries to Google searching, but this next generation is going from Google searching to just AI spoon-feeding.

And so whether or not that's going to rot your brain, I think is a question for another day, but it's certainly become a lot easier to access that kind of information instantly. Wolfgang, so Techstrong is part of the Futurum group now, and we actually have something called the FIP. We call it the FIP internally, the Futurum Intelligence Platform.

Nice. But we don't have the MCP piece of it. It's still a web interface, but it's the same thing.

It's all of the Futurum research, and we have data from G2 and another company we just bought called ETR that has $2 trillion in IT spend tracked. And you could pull that up. Why I bring it up is it's such a...

Could you imagine? Think back 10 years ago, 15 years ago. You talk about taking out your yellow highlight pen.

You couldn't even pull up those reports to highlight. Right. You didn't have them in any place.

There wasn't one kind of mother lode that you could hit like that. Mm-hmm. It's amazing.

And that's the thing with artificial intelligence, right? It's only as good as the content behind it. It's only as good as the actual data that you're building off of, the insights that you're harvesting.

So I agree with you. But I want to jump back to something you said, because this is something I struggle with a lot, right? This idea of de-skilling versus upskilling.

This idea of like, is AI going to rot your brain? " Surely it's going to rot my brain. If I'm on Claude saying, "Hey, give me some insights," maybe that's a little bit better.

If I'm on Claude and I'm like, "Hey, look across the faculty. Who's arguing about this? " Now a little bit better because my brain's getting engaged.

I'll tell you what I've started to do is going through that entire life cycle and then creating flashcards or creating learning guides, creating podcasts that I can listen to, right? Sure. Here's the content.

" Now, since the content comes to you, it's- That was an art in and of itself, right? It was, yeah. Using the Dewey Decimal System and all that stuff, right?

Yeah. I still remember those numbers for computers. So I've done a little research.

I remember. So Wolfgang, I've done some reading on this, old-fashioned reading. And interestingly, they said when we moved to that Google Search thing that it was going to rot people's brains.

Mm-hmm. But the fact of the matter was, is it actually made them sharper. Because when you did a Google search, you still had to discern between quality content, not quality content, what was useful.

Because Google, well, back then anyway, that's before they started zero clicking and keeping all the traffic, they would just give you a list of resources, and you as a human had to make a decision. Much like a jury decides what testimony to believe and how much weight to give it, you had to make a decision and give weight to the different Google answers. With AI, that went away.

It kind of gives you just that answer, as you said, right? But then the latest studies found that if you're an AI user, someone who uses AI a lot, you don't do that. You don't just ask AI the question, get the answer, and move on.

People generally engage the AI at that point. " And that that dialogue, if you want to call it, actually does sharpen our brains, right? And this is why we're getting this gap between, let's call them power users or not.

Mm-hmm. If you're the kind of person who's just coming into Claude and saying, "Give me the answer," and I run with it without thinking twice because I didn't have to, you might wind up in WALL-E world, like that movie. Remember?

They're all... That guy sitting on the servers. Right.

But if you're the AI power user who takes that and now has a dialogue and now refines the answer and puts your thoughts into it, and actually, you now have a digital coworker to kind of, or a digital IANS faculty member to bounce this around. It's actually good for your brain, as it turns out. What does that mean?

Not everybody's going to be a power user, I know for sure. But that's what they're saying. Well, I think it's the difference between advice that you hope is right and advice that you act on.

Right. Yeah. There's a couple different components.

Certainly the media literacy. Mm-hmm. And then the access to good content that you know is accurate and represents both sides of the issues and is enriched.

And then is the mindfulness to make sure that you're interrogating it. I uploaded one of my strategy documents, and I pulled up the last six months of data from ions. I had it redline the document, put in comments, and then I spent the next like half hour going, "I don't agree with that.

I don't agree with that. Eh, it's probably good. " Right?

And if you are actively working on it, I think you're right. We oftentimes say new technology makes us less intelligent, less effective, but it's only if we let that happen. Right.

And these smart people always find a smart way of using it that keeps them smart, and I think that's the lesson there to be learned from it. But it's interesting. Let me ask you another quick question.

Being at ions is all about security. Look, it seems that we're hearing a lot of holes in the MCP armor, a lot of c****s in the armor. Look, this is a technology that was maybe two years ago was brand new.

I think it was a year old in January. Yeah. So in two short years, it became the de facto standard for the way we interact with AI, and maybe we didn't think through all of the security kind of what we could do to harden it, what we could do to make sure there's not the vulnerabilities in peop-- Because think about it.

If someone can get into it, redirect or whatever, it'd be catastrophic. What do you think? Have we locked the MCP protocol down enough?

Is it truly, truly safe? I think, well, nothing is ever truly safe. I do think- No ...

ions is in the fortunate position of being surrounded by 170 practitioners that can shoot holes in it, and you can rapidly iterate. But you're spot on. Whenever there's a new technology, we're out always over our skis.

We've been over our skis for decades. We put something out- I know ... we see how people use it, we see where the holes are, and then we respond and react.

API security in the beginning is exactly where we are with MCP security today. It's a good way of looking at it. All right.

Hey, Wolfgang, we're about out of time. I got to wrap up. But are you going to be out in Vegas for Hacker Camp or no?

I will. I look forward to seeing you and everyone else out there. Absolutely.

Just in another week or two. Until then, though, hey, great seeing you. Say hello to all my ions friends, and congratulations on this MCP launch.

Maybe we'll see. Maybe ions becomes a software company. Who knows?

There you go. There you go. Hey, you're watching Techstrong TV.

We're going to take a break. We'll be back.