Cintas Makes the Business Work Around Automated Patching

Hey everybody, we're back at Rock on Americas, and we're chatting with my new friend Tom here. Hi, Tom. Hi, how are you doing?

Who presented at the show today and basically walked everybody through a case study of how they're using the Qualys products in the portfolio. So I'm going to let Tom kind of explain that a little bit. But Tom, what exactly did you present today?

It was more around true risk eliminate and what you can do with patchless patching, I guess, for lack of a better term, which is mitigate without a patch. Do what you can when there's not a patch available for a particular CVE. So are you applying a certain set of controls?

Because what we're seeing these days is that the exploits are coming faster than the patches are available. So what exactly are you guys doing, and does that involve virtual patching? What is that motion?

Well, our approach is a little different. We do a little bit of automated patching. So we have automated patching that runs daily, and then Microsoft security and update patches that run weekly because Microsoft isn't releasing patches only on patch Tuesday now.

They're doing it through the month. So the automation helps us catch up with a lot of that, especially with devices that we don't catch right away. People, they don't get online, whose partners don't tip, or I should say end users, so people better understand that aren't frequently online or we have people on leave and other things, so when they boot up, they automatically patch.

Critical vulnerabilities, 24 hours. We just, production, non-production, it doesn't matter. We've communicated to the business that they work around patching now rather than us working around the business.

So that was a big step for the business to finally realize that security had come first. How do you decide what patches to automatically deploy? Because a lot of folks would say sometimes, the patch is the cure that's worse than the disease because they're afraid that something will break.

Well, we went down this road early on a couple of years ago, and we did run into these problems. But what we did was we extended what we called a RAF process, which was a risk acceptance form. As we came across these issues with these people in the various applications that we were patching that would break production devices, they had to sign off saying they were going to accept the risk, and then that form went up to the CIO.

And more often than not, the CIO would sign it unless there was a time frame to a fix applied to the RAF itself. So that went back to the owner of the application, and they knew they had X amount of time to get it corrected. " Right.

So did the business kind of decide that the security risks are greater than the risk of the downtime, and people are starting to make a decision there? The business realized that they were behind in terms of spending the money to update the various applications that we were using in the production environment. When they realized the risk of losing production over legacy applications, they realized they had to spend some money to update everything.

Of course, everybody and his brother's talking about AI these days. Are you guys using AI? What are you thinking about it?

We use AI. We've got AI pretty well locked down across the board. We're currently using Copilot.

We've got it locked down, so Copilot itself can't speak out to OpenAI or anything else. We're working on releasing it gradually, trying to find the right tool that we can use to manage AI in general. The issue that we've run across, or at least has crossed my mind is, there's a lot of startups, and you don't want to do more than a one-year contract with anybody.

Are they going to get gobbled up, bought? What are they trying to do? So we're trying to use the larger organizations that are well-anchored out there, like a CrowdStrike, for example, or Qualys that's not going anywhere, and put something like that in place because then we're more comfortable signing a contract.

But it would still only be a one-year contract based on the change in the environment because we're looking for the best product to fit our need. And that may not be the best long term. So are you adding AI into your cybersecurity workflows?

What does that look like? Yes, absolutely. We have a lot of agents out there that are running in our SOC environment.

About 83% of the alerts we get are automated by AI and remediated quickly. So it helps our on-call team a lot in terms of making sure they're not always on the phone. What do you know now about implementing AI into those workflows that you wish you knew maybe a year ago?

What did you learn? A year ago, honestly, we weren't really thinking about it. I mean, that's how new it is.

We got concerned, obviously, when they started using AI to attack, especially from an email perspective, phishing. It was moving. A click to compromise, it went from 21 minutes to from three to seven based on AI.

You're not seeing the things in the phishing campaigns that you used to see because they're AI-generated, so there's no misspellings or some of that. So it's easier to capture a user's attention to get them to click. So we have AI and an email protection system that we have that kind of strips URLs and things like that to better protect us.

Mm-hmm. All this seems to be now happening at machine speed. So has that changed the culture within the security team?

I mean, it's kind of at a rate now where maybe we'll look back, and we used to think it was stressful a year ago, but now it's even more. It's certainly created more urgency because you don't know what it is until you act on it. So we've grown our team a little bit to better react to specific threats in different areas, depending on where it lands or where we see it.

We don't pay as much attention to things that aren't necessarily internet-facing or end-user devices. And again, our weakest point is always going to be our partners or users, that we have 20, well, 50,000-plus people that work for Cintas. And again, people are always the weakest link.

So how has the adoption of AI kind of changed the team or the culture of the way you guys work internally? Some folks are saying they'll have smaller teams, but you have bigger teams. I mean, what does that team kind of look like these days?

Well, for a company our size, if you do the math on what the average company would have in terms of a security staff, we're significantly understaffed and probably going to remain that way. We have about 12 people, and that's engineering and operations combined. How do we keep up with it?

We're starving for automation. Anytime I get a chance to automate something or find a way to automate something, be it conditional access, anything with Qualys or any other of our tech stack platform, we'll automate it. And we tell all vendors that because we've got to keep up, and we ask the questions all the time in QBRs and DBRs.

What's your AI roadmap look like to better protect us? Are you able to keep up with the threat landscape? I mean, those are constant things that are on my mind.

Mm-hmm. Is the rest of the company kind of pitching in more these days? Because when I talk to folks, they're getting a little more help from IT, or they're getting help from the developers, and they're basically deputizing everybody they can find.

Not necessarily in our environment. The security team drives everything. The business is just trying to drive revenue.

That's what they do, and our goal is to protect them so they can do so. They don't really think about security so much, but we did implement some AI training that forced people to better understand what they can communicate and what they can't. Does that make sense?

Yeah. So we use DLP to try to control that. It's an ongoing process that we're still struggling with.

Yeah. So as you kind of look out for the next six months, which is probably as far as anybody can plan these days, what are you thinking about? What's on the top of your agenda list going into 2027?

Control of AI, how to better use it, how to defend against it, how to make sure that our partners or users better understand the implications of what they do using the tool in terms of what they put out there contractually sometimes, revenue, any confidential information. People don't realize that it can get out there if it's not properly protected. And looking at the companies that we use to make sure that our data's protected and it's siloed and everything's processed in the US and not outside the US.

So we're trying to make sure that we move as a whole in the right direction. And it's a big piece to bite off. It's a huge challenge.

There are, of course, thousands of cybersecurity vendors. How did you land on Qualys? What was that?

We had Qualys. The gentleman that I work for, the security director, ten years ago brought me on board, and we were already using Qualys before they developed into some of the-- Their roadmap obviously steered them in a direction that we fell in love with, literally, just because I really believe wholeheartedly in Qualys and the product itself and the patching program and the way that they're trying to approach everything. So I think we didn't necessarily stumble onto it.

I kind of inherited it. And when I was given the program and told to run it, I just molded it into what I thought it needed to be. And as we continue to grow and Qualys continues to improve, it seems like the company we want to stay with because they continue to move in the right direction.

Are you guys trying to increase the number of vendors you work with or decrease or trying to keep it even? What are you guys thinking there? Well, I think we'll probably lose some and gain some.

I don't know that we're necessarily-- I'd call it a break even. I mean, the SIEM's kind of going to go away, I think. It actually slows down detection time, so probably move more towards a data lake-type thing, like a Cribl, simpler, faster, decreases detection time.

If you're using something like a SecOps or something like that, 20 minutes is a long time to wait on an alert, especially with AI out there being a primary threat. Mm-hmm. So there's lots of folks watching this who are in your job, your role.

What's your best advice to your fellow cybersecurity folks out there? Don't be scared of AI. But make sure the people that are using it understand how to use it, the best way to use it, what they can and can't do, develop a training program to help people better understand the implications of what you can and can't do.

Because, again, our end users are our weakest link. All right. Well, folks, I think you heard it here.

" Okay. Thank you. And we'll be back in a minute.