The AI Security Blind Spot: Securing Vulnerable Vector Databases

Hi, it's John Swartz at RSAC again, with Nico Dupont, who's the founder of Cyborg. Welcome, Nico. Hi, thanks for having me.

It's great having you. Day one of the show. You were just...

You just got... Well, you just didn't get here, you're from the East Coast. You went to a show last week down the road in San Jose, GTC.

Yeah. I, I actually wanna ask you about that. Well, we'll talk about RSAC plenty, but what were your impressions of that show?

Uh, it was, insane. It's, it takes over the whole city of San Jose, as you know. Uh, we were exhibiting there Monday through Thursday, and it's really...

I mean, it's the epicenter of AI and kind of the, the pulse check on what-- where the industry's going. So it was, it was very interesting. It's, kind of the polar opposite of RSA, where security very rarely gets talked about at GTC.

Yes. And this is all about security, so. It's always interesting, one comes after the other.

And it almost kind of in the way it plays out in real life where you evolve all these advancements- Mm-hmm ... in AI, cloud, whatever, whatever, and then there are the consequences on the security- Yeah ... side, so that comes later.

Yeah. It's a secondary whiplash, for sure. Yeah, absolutely.

Um, and I was gonna ask you about RSAC. Uh, just a couple things, and then we're gonna go deeper into your company and what it does, because I think it's really important what you're doing, and I want you to spell it out for us because we might have some folks out there who are unfamiliar with your company. But RSAC is...

it's interesting in that it's become almost a little bit of a political bent. I mean, there was definitely last year w-w-what, what, what went on with CISA, and I think the climate, the current climate of our security framework. But I'm wondering what you anticipate coming out of this show, or what type of themes most interest you going into the show.

What would you like to learn more about or hear more about here? Oh, that's a good question. I mean, I think we're seeing a lot of AI for security, you know, in the broad sense of the word.

Um, and I think that I, I haven't gotten a chance to walk the expo floor. It opens at 5:00 today, but I anticipate we'll see a lot of that like we did last year, probably even more so. Um, I'm actually more interested in the other side, which is security for AI, right?

Which is how do you secure model, model behavior by all means, but how do you secure AI infrastructure? The kind of, you know, boring meat and potatoes of the next attack vectors that we'll see in the enterprise. Right.

The, uh... That, that... I'm so glad you mentioned that because we do a show every day, usually live, Techstrong Gang, and that is a constant theme, this, this idea that this, this technology's moving so fast, we see a refreshing of models every month, from each company.

Uh, we hear so much about agentic and autonomous workforces. We hear so much from the top down about how this needs to be put into use, but security is... it's not g-given short shrift, but it's mentioned down the list of importance like it always has been, yet there's that lingering thought in the back of everyone's mind, when is something gonna happen that we have- Yeah ...

to explain? And is that- The underlying anxiety ... Do you hope they acknowledge, do you hope they acknowledge this here?

I'm sure they'll talk about it. I'm sure, I'm sure they will. I mean, we are...

We're at, you know, the RSA conference, so there's gonna be, there's gonna be talk about it. Um, and I mean, that's kind of... You know, I'm biased because that's where we're focused on, right?

The, the underlying risks from the centralization of data for AI and, and what that implicates in the, in the enterprise and kind of downstream everywhere. Uh, so it's, it's always interesting to see what... how everybody else is thinking about it- Mm-hmm ...

and, who else is trying to solve the problem. Right. You know, you've mentioned AI infrastructure, and it was kind of very well put.

I think it may have been from your company, I'm not sure where it came from, but basically said AI infrastructure is harboring a hidden security risk, which is the vector database. Could you maybe expand on that a little bit? Sure.

I know it plays into what your, your product does, among other things. Yeah, totally. So I mean, maybe I can set the lay of land a little bit.

Sure. Absolutely. Um, in over the past, you know, call it three years, we've seen a massive shift in the center of gravity in AI from training, who had the biggest GPU clusters, was able to build model frontier capabilities, to inference.

You know, you go to any AI conference today, it's all about inference. Inference keys- That was GC- GTC was a lot about inference ... It's all about inference because that's where you, you get ROI from your massive AI investments.

And the way that you drive value with AI specifically in the enterprise is by arming the AI app-applications and the AI agents with data that is proprietary and specific to you and your organization so that it can drive insights or take actions that are relevant to you- Mm-hmm ... and your organization. And that creates a, an inherent risk because in order to do that, you have to centralize and pre-process your data to be AI ready, so to speak, to put it in AI knowledge bases.

And so you're taking data that was previously siloed across the organization and centralizing it to a single point of failure, a kind of honeypot of source, which is your vector database. And, this creates an inherent security risk because, A, if I'm an attacker wanting to, you know, breach the organization and get a cross-section of the data from that organization, I now only have one place to hit as opposed to all these various silos. Mm-hmm.

Uh, but also because this AI knowledge base, which is typically a vector database, is, is kind of, it's comically ill-equipped to deal with this type of security risk, and that's because vector databases deal with vector embeddings, you know, the lingua franca of, transformer models. They deal with those in plain text because they have to compute distance co- distances between vector embeddings, and they can't do that over ciphertext typically. So it's-Processing all of this data in plain text, and it's creating kind of a big hole in the security posture of basically every enterprise pipeline out there.

Wow. Has it... I was gonna ask you about the architectural constraints.

So explain this to me as a layman. So vector databases operate in plain text with no encryption in use. Can you kind of g- be more specific on that?

Or may not be more specific- Sure ... but can you explain that to... why that's important, why that's significant?

Right. Uh, so, you know, y-y-- in, in the traditional database world, w- you know, with structured databases, you have row-level encryption, column-level encryption, and, you know, in document stores, you add field-level encryption, et cetera. Um, these are well-known paradigms for being able to use cryptography to secure data and enforce strong access control on that data.

Um, in the world of vector databases, vector databases do-- have really just one job. It's unstructured semantic search. How do you search for data, via context, via meaning, without an underlying schema or structure?

And inherently, in order to be able to do that, you take data, you process it, you feed it to an embedding model, and you convert this data from its original modality, whether it be text, images, audio, 3D spatial data, et cetera, into vector embeddings, which are these, very large, high dimensionality numbers, that encode semantic meaning or context to that piece of data. Uh, and vector databases makes-- allow you to do that search, matching of, you know, for a given query, what is the most rel-- you know, semantically relevant piece of data or- Okay ... pieces of data at scale very rapidly.

To do that, they employ a, distance computation, you know, a distance metric such as Euclidean distance, cosine distance, et cetera. Mm. And to compute the distance between the query embedding and the candidate embeddings that are in the knowledge base, they need to literally compute, you know, do a, a, you know, L2, or a dot product to be able to, compute that distance.

That needs to happen in plain text. So it means that the data cannot be encrypted while they're-- it's being used. And furthermore, if you were to have to encrypt the index and decrypt it on the fly to be able to add this encryption and this strong access control, it would make performance slow to a crawl, this inline decryption.

So it means that every vector database out there is essentially, insecure in this regard because they're operating on data in plain text. And so this creates a risk in terms of, you know, infrastructure compromise, right? Any access to the host, any type of insider risk.

Mm-hmm. The data is not encrypted, in use and sometimes not even at rest. And also, it makes it really difficult to do things securely, like multi-tenancy.

How do you isolate multiple tenants on a single vector database when the data is not encrypted independently across tenants? Um, how do you do strong access controls, whether it be rule-based, role-based, attribute-based access control? It, it kind of-- it's a very immature, breed of technology that enterprises are betting a lot of not only money in their infrastructure, but in their actual proprietary data, storing within these vector databases.

So in a sense, there's kind of this calculated risk or the, the... I-- What I'm, I think about is in, in terms of priorities, in terms of, not to be alarmist, but I'm assuming there are a lot of enterprises who are verily concerned about this, this scenario and what could possibly go wrong. And I'm wondering, what type of companies are you working...

You're working with a lot of enterprise companies. Is it across the gamut in terms of industries you work with or are there particular ones that are more focused on this than others? Um, yeah.

We, we... Well, firstly, we've been partners with, NVIDIA for a little over two years. We, we've been working very closely with them and a number of their teams.

com. Okay. Uh, we're one of seven companies to do this with them.

And it was kind of a reference architecture meant to show for enterprise use cases, how do you build secure AI infrastructure specifically- Mm-hmm ... for RAG, which is the bread and butter of enterprise AI today. Uh, and we're doing some additional work now on agentic RAG with them.

But this allowed us to get a lot of credibility and exposure in the enterprise because w-we also don't wanna be alarmists, but v-we don't believe- Yeah, 'cause- ... there's a calculated risk today. We, we're very much in a phase of the market that is, market education.

Teaching that, you know, this is an inherent risk of vector databases, that vector embeddings, if leaked, are invertible, meaning you can convert them back to the original modality of data. So it's-- they need to be treated with the same level of sensitivity as source material. And so in that vein, we're working with a lot of companies that are traditionally very security-minded.

So the companies that we work with then in turn service regulated markets like financial services- Mm-hmm ... insurance, healthcare and, public sector. Uh, and then there's also a lot of organizations that are starting to realize outside of these traditional sectors that actually my data should be secured even if compliance does not require it.

Is it... Are, are you finding that, say, this year compared to d-last year or even two years ago, the level of scrutiny and, and awareness of, of what's going on in terms of security is much higher than it was? Because, like, to be honest, last year I thought was, was hailed as the year of...

We, we'll talk about agentic AI later. " I'm just wondering if their level of awareness and security is, is higher now than it was a year ago. Definitely.

I'm really glad you brought that up. Uh, firstly, I, I feel for, for, for CSOs today. It's, a, you know...

They've got a million and one risks to-- emerging risks to have to parse through and, and, and they're underwater, so I completely understand. And, you know, a year ago, we were kind of screaming into the void about this particular brand of risk, of the centralization of data, vector databases not being secured, and, um... But thankfully, a lot of, uh-Organizations have come out with lists and with, you know, materials regarding this that have highlighted this risk.

So OWASP came out last year with their top 10 LLM and GenAI risks list. And number eight on there was, vector and embedding weaknesses- Okay ... which is exactly this, this, uh- What were, what was, what were the top...

Do you remember? I don't wanna p- I- ... put you on the spot, but- I, I could ...

it was in the top, it was in the top 10- It was number eight, on there. I mean, obviously, you know, context poisoning, um- Mm ... was, w- was, was up there, model jailbreaking.

There's... Uh, I couldn't tell you exactly what the list is. You know, we're focused on our narrow slice- Mm-hmm ...

of, of the problem space. Um, you know, but they came out with their top 10 agentic risks, which also had that. Uh, MITRE came out with their, with their frameworks and, and called this out as a risk.

Fenno. So there's a lot of, different organizations- And this was based on... W- was this, was this based in part at all on high-risk incidents, or was it just based on possible scenarios that they were th- they were thinking through?

Possible scenarios, vulnerabilities that have come out, emerging vulnerabilities. 3 out of 10 criticality that let anybody with access to the same network as the vector database itself to bypass authentication and dump out all of the, the data from the knowledge base, directly. And they were very responsible in, in patching it and disclosing it.

But, these, you know, security organizations are realizing the, the writing's on the wall, the, the risk is going to, transform from a risk to an actual breach that will be traceable back to this problem. And so I would say the appetite to solve it is increasing, the awareness is increasing, and the, tools with which to actually, solve these emerging risks are also, maturing quite a bit. So in that vein, in terms of solutions, tell me a little bit about Cyborg, CyborgDB.

What does that, how does that address this problem or, try to tackle it? Well, you know, we, we are, we're laser focused on this, this problem, and we have been for a while. We've been working on the underlying technology for CyborgDB for close to six years.

And so CyborgDB is essentially application layer security for AI knowledge and memory. So what that means is it's a, it's essentially a Docker container that sits within your AI infra, in front of a backing store, whether that be object storage, whether that be, you know, Postgres, Redis, or your file system, distributed file system. And it, it replaces your vector database and it does two things.

It does what a vector database does, which is, um- Mm ... essentially approximate nearest neighbor search. Uh, but the, the second part, which is unique to Cyborg and subject to our f- our, family of, 16 US patents, is, cryptographic indexing.

So we transform vector embeddings into s- cryptographic tokens that allow us to selectively regenerate those tokens at search time in order to do that course approximate nearest neighbor search on encrypted vectors without decrypting them. Then we only decrypt the final candidates that need to be re-ranked and fed to the LLM, or we have, y- we even have modes that use partial homomorphic encryption for the last re-ranking step such that there's no decryption at all. And so it does a few things.

That firstly now makes the vector database encrypted, even in use- Mm-hmm ... significantly elevating the security posture of your entire pipeline by making this, you know, your proprietary data secure. It allows you to do cryptographic multi-tenancy, cryptographic isolation for multi-tenancy- Okay ...

which is a really difficult thing to do today with vector databases. How do you have multiple tenants, whether within an organization or actual, you know, separate organizations in a, in a, in a, on a, in a hosted solution, have strong guardrails and, and isolation guarantees, and allows you to do, strong access control that is cryptographically enforced- Okay ... whether it be rule-based, role-based, attribute-based access control.

And so we've built this, and we shipped it, last year when we... It's, at the heart of this blueprint that we did with NVIDIA, and essentially meant to, to solve this whole, class of problems- Mm-hmm ... at the heart of enterprise AI pipelines.

Um, can... So I'm gonna go back. You founded the company, you said, was it six years ago?

Yeah, we started working on this about, on this about six years ago. So you started in this speci- specific area six years ago? We were working, essentially a separate startup before that on- Okay ...

data compression, and, p- we began working on searchable compression, which was a really interesting technical space that had zero commercial value. Yeah. Um, and that kind of gave the idea for, this venture working on searchable encryption.

So that's wh- yeah, that's kind of what I was getting at, is y- every company has this journey, and I was just wondering how maybe in the last couple, few years with this kind of rabid, kind of almost feverish pursuit of AI that changed the thinking of the calculus within your company of what you were gonna do. But it seems like you were already on that, you were already on that, in that path. You're, it's not- Yeah ...

" Right. That's, that's kind of- Sure ... what I'm trying to get at, actually.

I mean, look, I wish I could say that in 2020 when we started working on this it was- Mm ... we saw the whole in enterprise RAG pipelines, but to be, to be honest with you, enterprise RAG didn't exist. I mean, none of these words were really around at that point in time.

We were working on, building solutions to do... We were laser focused on how do you search in a, while keeping data encrypted, and vector embeddings were actually a means to an end for that. And then we just happened to be, extremely fortunate in terms of market timing that vector embedding started to become- Oh, yeah ...

the heart of, you know, enterprise AI applications, and we just happened to have built a, a, a robust system for being able to search through them, semantically while keeping them encrypted. So I n- I do not mean this as a loaded question, but do you... How prepared do you think are...

How prepared are most companies, uh-Addressing this kind of agentic AI or autonomous workforce, mandate, I-I'm, I'm wondering i-if, if most of them are pretty well positioned or have thought this out, or if there... There's such an incredible amount of pressure to adopt, whether there's... They're kind of walking a tightrope.

And I, I don't want you to, like, cast- Yeah ... aspersions towards industries, but I'm won- I do wonder bec- based on what we have written about and some of the studies I come across with CISOs, it's like they are being asked to run, down a very fine line with a lot of... Not a lot of margin for error on either side.

Um, candidly, I think the market at wide is, is vastly underprepared for what's to come. Yeah, I completely agree. And it's n- it's, you know, no f- not, not for fault of trying and, and- Mm-hmm ...

you know, even at this, this conference, everybody's trying to solve this problem. I think that the, the problem fundamentally is that, most organizations have not figured out how to mitig- mitigate insider or rogue employee risk, right? Mm.

Social engineering attacks are still running rampant, and the way that they work is by, you know, getting a... You know, conducting a social engineering attack on an employee or an insider in order to be able to conduct, you know, some sort of breach. Uh, and a-agentic AI is no different.

We're trying to imagine that it's a new future where, you know, you've got these machines that are, you know, somehow very different than humans and very different than em- than employees. But I think that if you're looking at it that way, you're looking at it wrong. You're really...

With agents, you're just onboarding e- new employees, essentially. You're onboarding non-deterministic systems, non- Yeah ... deterministic agents within your organization.

Well, guess what? Mm. Companies have been hiring non-deterministic people for a very long time.

That's humans. They're employees. And so looking at how we solve the insider risk problem is kind of the same way that we solve the agentic AI risk.

Different tools, by all means, but the... So long as we've not solved one, I don't think that we're gonna have the other one fully solved. And the risk there is that, the speed at which an insider attack happens, w- by an employee is vastly slower than by an agent.

See, this is, this is the thing. This is the rub for me that is particularly terrifying 'cause I'm, I'm seeing, given the state of the economy and this, this urgency among companies, and I'm not saying it applies to most companies, but there are q-quite a few companies, Meta, there's a rumored 20% layoff, which I think was influenced by efficiency- Sure ... where humans are replaced by a-an autonomous workforce.

I think Amazon, there's this long-term goal of swapping out 600,000 folks for robots, what have you, in whatever form they are. Uh, Dell just announced 11,000. I, I was just...

I always wonder if they, in their pursuit of better profits, more efficiency, whether this kind of raises the ante and, and raises the stakes or raises the risk. And I mean, I know they've looked at it internally. I would hope they have.

Sure. But it's just that this, the one thing when you, we mentioned th-this kind of, this whole kind of movement towards non-human factor and where that leads for every, for everything. I, I, I don't wanna comment on any specific company.

I- No, no, I'm just, I'm just talking in general, this kind of climate that we're in- Right ... where companies are trying to raise their market valuations or trying to address- Totally. I, I think that the, the, the change is going to be painful and is going to be, a ripe opportunity for attackers.

Right. Um, and I, I, I, I don't know, it's hard to say because the, losing talent that is in charge of, you know, this, the security that we're, we're s- we're seeing, you know... There's a lot of rumors about downtime happening at some of the major infrastructure providers, that it's happening because the, you know, security DevOps cloud talent is- Excuse me ...

is gone. But replacing with agents doesn't nec- does that mean that it's going to be worse off or better off? You know, it's hard to say, but I know we're gonna see probably a whole new class of, of issues.

But on the, I mean, yeah. I mean, I was ... But then on the bright, perhaps on the bright side, maybe we'll get better orchestration of agents to address security.

Maybe. May-maybe. I mean, I, I- Maybe.

We don't know. We're, we're, we're in for a very tumultuous, tumultuous time, and I feel for all the people that are losing their jobs as a result of it. Yeah.

And I, you know, I, I hope that we... We've got some problems to solve from a security lens. We've got some very big problems from a societal lens to figure out- Absolutely ...

as well. Absolutely. But I don't wanna step outside my- I, I know it's, it's very ...

You're a wise, you're a wise man, Nico. Hey, thanks, Nico, for your time. Appreciate it.

Nice to meet you. Thank you for having me. Thanks.

I appreciate it. Pleasure. Um, that's it for, today for me, I think day one.

Day two, I believe Alan will be back with a lot of interviews back to back to back all day. So, stay tuned, stay on TekStrong TV. Thanks.