Transforming Cybersecurity with AI Innovations with Vectra AI’s Jeff Reed

Hey everyone. Welcome back here to Tech Drunk tv. My next guest is Jeff Reed.

Jeff is the Chief Product Officer at Vectra ai. Let's welcome Jeff in. Hey Jeff.

How are you man? I'm well, Alan, how about yourself? Very good, thank you.

Appreciate you coming on. Um, Jeff, we're gonna talk a little, we're gonna talk a lot about fact actually, and we're gonna talk about some new solutions you guys have. But before we do that, let's hear a little bit about you, your chief product officer.

How, how'd you wind up there? How long you doing this? Yeah, what's your background about?

Yeah, so been here about a year and a half. Uh, you know, I lead engineering, product management and product marketing for Vector ai. We'll talk more about what we do, but I got here, uh, by way of Google Cloud.

Uh, and so I've kind of spent, if you look the, I call myself a plumber. Yeah. I've been in kind of the infrastructure security land for the last 25 years.

You started starting file systems and volume managers at Veritas for folks that remember back in the day. Um, and then spent a bunch of time at Cisco, I remember. Yeah.

Yeah. So you went through, are You at Cisco too? You really, yeah, yeah.

I then went to Cisco. You were Like a master plumber, huh? Yeah, no, exactly.

Yeah. Yeah. I never got, I mean, we did our own chips, so I can kind of see I got into chips.

It's probably, you know, you know, but, uh, but yeah, so did, was it Cisco and, and really, you know, from there spent a bunch of time in networking and then, you know, went into security side of Cisco for a few, for four years or so, and then, you know, look, the whole cloud thing's pretty important. Uh, so I had an opportunity to go over to Google Cloud, and that was great, great experience. And kind of did two things there.

One was in kind of the core services, Kubernetes, serverless, you know, that that kind of space. And then, you know, when Google was looking to acquire Mandiant, uh, they wanted to bring in a, you know, security product leader. And so had the opportunity to come in there.

And that was a great role. So kind of had, you know, VP of product for all cloud security at Google Cloud, um, both from the infrastructure, identity, access management, compliance, HSMs, all that side, but also what we're doing in security operations in that world with, at that point Chronicle. Uh, and then you had the, you know, it was interesting.

Hitachi, who's the chattis, the founder, CEO of Vector, reached out and I really was super interested in what Vector was doing. Um, because, you know, the, what we were doing with Chronicle was really interesting at Google. You like the economies of scale, the speed, all that was amazing.

But we were still like, I think in the sim market was still kind of incumbent on the customers to do most of the, the real, like threat finding. And so what I, what I loved about Vectra was how they were doing things that were really unique in the industry around how to detect attackers using, you know, initially network side, you know, uh, you know, data, but then expanding in other places. And so that really kind of got me jazzed about coming over to Vectra.

Excellent. What a charm course of, uh, the, you know. Yeah.

I've been lucky. Yeah. Yeah.

Career. Well, you know, what, what was it, branch Rickey, the guy from the Dodgers back in the forties or fifties said, luck is 80% or 90% perspiration, 10th percent inspiration, right? So luck comes, you know, God helps those who help themselves.

Anyway, Jeff, let's turn to Vectra, right? Yeah. It's a lot of people out here may or may not be that familiar with it.

Sure. How would you describe Vectra to them? Yeah, so it's, there's, you know, Vectra really started this idea of can we apply advanced to AI techniques to what initially was network data to find attackers that had bypassed other, other, you know, security controls within an environment.

And, you know, kind of came out of, you know, some breaches that you have the, the founding team had seen in customers back in, you know, the 2010s where, you know, nothing else was able to pick up their activities, but they left this like trail in terms of the network, uh, activities they were doing. So command and control, reconnaissance activities, lateral movement, and that side. But I think the, the key thing that the, the key part of the premise though was instead of doing, you know, the normal, you know, what's abnormal behavior, the things that have kind of generated so many alerts and so much noise, it's can we take a much more focused approach around what are the durable attacker behaviors?

And if you think of that, like what attackers have done over the past, you know, 10 plus years, like the core pieces are the same. I need to establish some presence. I need to have a com control channel.

I need to figure out where I I'm and the I am and the environment. I'll probably need to move towards different parts. And so those behaviors, those minor, uh, techniques or the things that we really try to find, but we find them using very sophisticated, you know, capabilities.

So we use long short-term memory, recurrent neural networks for C two channels. We do some really interesting clustering techniques around, you know, trying to identify, you know, where's privilege within an environment. And then, you know, where are places where we see, you know, potential privilege escalation.

So things like that I think is really kind of unique to the, the capability with the whole desire being, can we always find the attack behavior, but do so with as much clarity, so there's a little noise as possible. I Love it. I'm assuming the website's vector ai.

It is, yes. B-E-C-T-R-A. And, And be clear.

So one thing, like, you know, the obviously AI is, you know, very hot topic these days. Um, you think, you think just, just as, just a sco uh, uh, we've been around for over 10 years, you know, these techniques were started being deployed in, you know, 20 18, 19. So pre the big gen ai, you know, wave.

Uh, so, so yeah, we, we describe ourselves as the OG of, uh, of, uh, AI and security. Fair enough. Very good.

I I love the OG staying current here. Alright, let's, let's pivot into our topic of discuss. It's not really a pivot, it's a continuation of what we're talking about, but Jeff Vectra AI recently announced a, uh, a new generative AI solution, uh, for AWS powered by the, the Amazon Bedrock platform, which, you know, Amazon is really, uh, put a lot into and continues, right?

It's a big part of their strategy there. Um, talk to us about this new, this new solution. Yeah, so this is our, your Vector AI analysts, and we need to take a little bit of a step back.

You think, you know, I talked about the idea of, you know, we want to drive great clarity. Like, hey, here are the small number of things that you, Mr. Customers should worry about each week within your environment.

You know, we do that in kind of these stages. So we start with the actual detections themselves, and we talked about recurrent neur networks, you know, then we have actually a triage, a age agentic framework that's been around for a couple years now. And it basically is trying to find out like even if there's attacker behavior within your environment, some of those behaviors are, are actually hard to decipher from what normal, like real, you know, legitimate use.

And so it basically tries to kind of like take that and, and reduce the number of, uh, of potential, you know, alerts and detections that we have. Then we go through a prioritization scheme basically says, and what that is, it's a constrained optimization model that's trying to mimic what a, how an analyst, a security analyst soc analyst would prioritize all the things that hit his or her desks in a day. Then that kind of pops out with a score.

And then, and then the last thing that this new, this new analyst agent is really about the next step from that. So once we've prioritize an ity, a host, or an I or, or prioritize anonymity, a host or an identity, how can we then like make the next steps for that analyst as easy as possible? So think about this as being able to go out and, and do all the, the kind of work around, you know, investigating that, that entity, what are the behaviors potentially reaching out to new data sources that we haven't naturally?

'cause what's nice about these agentic models is you, they have the ability to go out and read blogs of the latest attack, you know, attack techniques out there, or, you know, go to find and do new additional sources of data within that customer's environment and basically come back with a, a more sophisticated assessment of that entity. And do we think that this is actually a, a likely to be a malicious behavior or not? So that's kind of the, and it does that this, and I think the, the interesting thing here is if you just throw this to a large language model and have it go, it would, uh, sometimes it'll be amazing, sometimes it'll be completely wrong.

Uh, and so the, I think the, a lot of the work that we've been doing is how do you not just leverage what the, the gen generative AI capabilities have brought to bear, which is a lot of good, like fuzzy logic and like long tail reasoning, but compliment that with, hey, there's some guidelines or, you know, guardrails in terms of this type of, you, we've seen these behaviors on this, on this host. What would the normal steps be for an, an investigation? And so this kind of mix of expert system logic plus large language models kind of combined, do we think deliver a really interesting approach.

Love it. Jeff, what about for the people out there who say, this is a great AWS solution, but I'm multi-cloud? Well, so Yeah, yeah, yeah.

So to be clear, and this one maybe I should have, should have done this earlier. My bad. Uh, we are leveraging AWS as bedrock and the infrastructure to deliver this solution.

It is by no means, uh, limited in terms of the, oh, okay. Purpose area coverage, just AWS environment since You guys are actually sort of hosting it on AWS, but it's available network, However you wanna call it, on inter ID M 3 6 5, Azure AWS, like everywhere that we have, uh, detection coverage, so kind of our native signal generation, you can apply this analyst. Now, the one thing I, just to be clear, you right now, this is available as part of our managed detection and response service.

So you, we Right. We provide a managed service that'll, you know, basically where Vectra analysts will sit side by side with their SOC counterparts to help kind of make sure, so initially it's powering that service is is where this analyst is coming to bear That that's available. Right now It's available right now it's, it's on, if you go to the, uh, AWS marketplace and their generative AI tool sections around security, it's one of the, you know, one of the solutions as part of that.

I gotta ask you a hard question. Uh oh. Bring it on.

Alright. You know, look, I spend most of my day on videos like this with people like you. Yeah.

And not just vendors, practitioners, analysts, you know, a good mix. Everyone, everyone has an AI story, everyone, as we talked about earlier, right? How much of this is not, not that I, I'm not saying it's not real.

It's obviously real. Yeah, yeah, Yeah. But how much of it is must have today versus, oh, this sounds cool, but you, I could live without it.

I think that comes down to the problems we're trying to solve. You know, every year we do a, a big survey of SOC practitioners and, and kinda ask them a series of questions around, you know, kind of what their, with our day-to-day life is. And, and some of the findings from the last one we did were, were amazing.

You know, like, um, you, 71% of them worry that they're gonna miss a real attack buried in a flood of alerts every week. Uh, so that to me kind of stands out. Like that's one of just numerous findings.

But I think for the way I think about it is given the scale of people's environments and, and the thing we've seen is just the fact that it used to be simpler. We had a data center, we had a campus put some firewalls around it, you know, it was like, it was a much simpler environment to protect. Yeah, no, I get it.

You know, between, you know, everyone still has those, and they have cloud and they have SaaS. And so the, the, the complexity of their environment and, and you used to find, I mean, you've been in this world a long time, you know, 25 years ago you talked to someone that kind of knew everything that was going on within the IT infrastructure. That's almost impossible to find now.

Not Today. You're Right. Just not.

Yeah. And so I just don't, I don't think the tools that aren't leveraging some degree of more sophistication in how they identify, triage, prioritize, I just don't think they're gonna be successful in, in really helping avoid that problem of, I'm flooded with alerts every week. I'm thinking I'm gonna miss some the thing that really matters in that flood of alerts.

And so, so to me, that's the thing. And, and really that's the foundation of why Vectra, that's we've 10 years ago, that was That's Right. That was your reason for being to begin with.

Yeah. And, and, and so I think that, you know, and we've been, we have, we have more data scientists at RA than we're working at insecurity at Google Cloud. So, so I think that just gives you a sense for the scale of investment when the bet we've made that this stuff is really important.

And it's not really, like, the thing I wanna say is like, like generative is another technique that is very useful in some parts of this problem set, but it's not the end all be all to what we've been trying to do and what we think you need in order to be successful. And so, to me, it's a great compliment. It's absolutely, I'm really excited about stuff.

You see some of the stuff we've seen in terms of like, you know, you know, MCP servers and things like that, I think, you know, how the stock operates I think is gonna radically change in the next five years. And, and I think that we can play a key role in that through the, the mix of technologies that we have. Yeah.

No, we, we just had this discussion on Textron gang the other day. I don't even think it's five years. I think, I think it might be two to three years at most.

Amazing. The way, the way thing, right? Agentic AI things are snowballing so quickly.

Yeah. And You get this kind of compounding capability set the things you really, um, so yeah. No, I I, I was, I I'm very confident by five years it will be totally different.

Oh, Absolutely. I, I don't disagree. 18.

And I think also it's all sort of relative, right? When you look at how this whole AI thing is affecting the speed and velocity that code is being developed. I was about to say That, yeah.

That new apps are being deployed and now you gotta manage those apps and observe 'em and all of that, and you gotta secure them. You know, it's, uh, it's the circle of life here, right? Absolutely.

On steroids. And, and so, you know, I, I think that that's what we go with. ai is the website Yeah.

For people who are interested in this particular new offering, where is it Right off the front page kind of thing, right Off the front page. Yeah. Yeah, yeah, yeah.

And you'll, you'll also see how well we did in the Magic Quadrant. Uh, for first ever MQ for NDR, we were really both Access Axi. So yeah.

So really happy about that. Oh, Congratulations. Strategy.

Yeah. Thank you. Good for you guys, man.

Hey Jeff. Come back on and keep us posted here. Right.

World's changing real quick. We got to stay on top of it. Sounds good, Alan, thank you so much.

You're welcome. Jeffrey. ai here on Techstrong tv.

Go check out their new, uh, gen AI solutions, powered by Amazon Bed Bedrock. You're watching Techstrong tv. We'll be right back.