AI, Business Integration, and the Future of Cybersecurity Teams | Security Boulevard Podcast Ep. 13

Welcome to Security Boulevard, the cybersecurity podcast from The Future Room Group. Each episode explores a variety of topics within cybersecurity and the technologies that drive it. com, the Security Boulevard, YouTube channel, tech Strong tv, and all of your favorite podcast platforms.

Before we jump into today's topic, let's meet the panel for today's episode, starting with Fernando, it's good to see you again. Fernando. Hello everyone.

So Fernando, uh, uh, Montenegro, uh, JP cybersecurity lead for Futu Research. And as we get started on this call, I, I, I do want to share that my heart is filled with joy by being with this particular two co-hosts, right? Both of you has been instrumental in my career, and, and I, I, I'm still kicking myself that I get to work with you guys.

Well, we appreciate that, Fernando, speaking of sparking joy, uh, we're joined once again this week by Alan Shimel. Alan, it's good to see you again. Thank you.

And, and Fernando, you know, it, it's, it's funny when, when you came here to FU and reminded me of, of our interaction, and that was 15 plus years ago, it made me realize, and, and it, and it actually goes right into, I think, what we're gonna talk about today. You don't know, you know, a butterfly flaps, it wings on one side of the world, and you don't know how that's gonna affect things years and years later, or who you're gonna work with or what your role's gonna be. And it never, it never cost anything to do the right thing, I think.

Right? I, I've, I've learned that. Be nice.

Be a person. So, Tom, I don't know what you've done to help Fernando, but maybe we could explore that or maybe if not on, on our podcast day and nothing. But, uh, thank you and I'm happy to be here.

Well, we're happy to have you both. Of course. I'm Tom Hollingsworth event lead for security here at Tech Field Day, and, uh, we've got an interesting episode today.

The, uh, the pre-call was, was filled with a bunch of different ideas that that all kind of coalesced into one area, and it has to do a lot with the way that AG agentic AI is creating some interesting challenges for folks, because if you remember in a previous episode, we talked a little bit about securing agents, meaning kind of a singular agent strategy. How do I make sure that this agent is gonna work? And that's great in theory, but in practice, you're not gonna be securing one or five or 10.

You're gonna be securing dozens or potentially hundreds. How does that scale? And there's a bunch of different things that you have to take into account there, because it's not just a technology challenge.

There's some leadership challenges there as well, because these aren't just software programs anymore, in effect, they're digital coworkers. So, let's kind of talk about this, because there's some other interesting moves that are being made in the industry as well, where people are trying to get ahead of this a little bit. There's, there's a lot of money on the table to do this, either to build out how to make it happen or to offer it as a service to people who are in way over their heads.

So I wanna start by, you know, kind of talking a little bit about how do we see the, the challenge of scaling being different than just, uh, maybe, uh, securing a singular agent. Why does it matter if we're doing this for 50 instead of one? So I'll, I'll say this.

I think that scaling happens on two dimensions, right? And this tr, and this ties to a trend that we're following in cybersecurity overall, which is the, the expansion of the attack surface. We, I think that scaling happens on a purely numerical thing, right?

So we're seeing, particularly within, uh, SOC automation, we're seeing, Hey, look, I can launch 50, uh, email triage agents that can help you with that. Okay? So one single, one single issue is, okay, what changes if you have 50 little agents that are the same, right?

They're all asking you different things. We talk about the human in the loop. Sometimes if each of those 50 agents, if each of those agents expects a human in the loop, guess what?

You're gonna have 50 interactions in that loop to play with. That's, that's a problem on its own, right? But that's one dimension of scaling.

The other dimension of scaling that I, that I worry about is within your organization, and that's the topic of, uh, of the paper. I'm just writing now on, on something else. But within your organization, you are going to have agents for agents implementing security for ai.

You're going to have a, an agent that's gonna validate that the, that's gonna do the, the, the testing of your models. You're gonna have an agent. So you're gonna have little agents securing the ai, right?

You're gonna have agents applying AI for security. In other words, you're going to have little agents on the soc. You're gonna have agents in doing data classification, you're gonna have agents doing code scanning and so on.

You are also going to have agents outside of security in your organization. Your, uh, procurement team might be running an agent that is going to do, uh, price lookups. Your accounts payable team might have an agent that is doing, uh, uh, uh, pay validation, right?

All of those agent workflows need security. So I think that you are going to run into a problem where you need to, this is a call for security teams to be even more deeply entrenched in the business as we, as we say it, right? You have to understand what your company is doing, and where does, where are they thinking about using AgTech, right?

At scale, right? Because they may have coordinated agents, oh, they're agents gonna talk about third party. What does that third party agent do?

And so on and so forth. So, you know, this is our first show for 2026, correct? And I think it's a good time to put our stake in the ground that like many things that have taken place in the tech world during my career, during Fernando and Tom, your careers, it's not waiting for security to say, okay, we're ready for this, Craig.

It's happening. It's happening. Agents are being deployed by, by the busload, by the truckloads, by, by the gross, you know, every day.

And I think 2026 is gonna be a year where that really hits its stripe. So we can't afford to take a wait and see approach. We can't afford, we, we need to address this.

However, I'm a big believer in fate and that nature of pours a vacuum. All we have heard about for the last, I don't know, five years, 10 years, is we don't have enough workers here in security. We have all these jobs that are going unfulfilled, right?

And now, lo and behold, the law comes, this, this is like a fable, an aesop's fable or something. A lord comes agentic AI who says, I can help fill these holes for you, right? Help, you know, take me, use me, help me, let me help you make better security, because everyone's using them everywhere.

I'm your new digital coworker, and I think it's incumbent upon the security profession on the industry this year to decide, do we embrace them and, and leverage them as quickly as we can, or do we do the usual security thing, which is, uh, wait a second here. I, I wanna, let me just make sure this is okay. Let me dip my toe in the water and, and let's see where we are, because what we decide is gonna make a big difference in the next year and beyond.

And so, and, uh, I'll just jump into that, uh, I'll jump with the first economics reference for the call, right? Which is, uh, uh, people respond to incentives, right? Uh, there's an Upton Sinclair quote I quote, sometimes multiple times a day.

It's difficult to get a man to understand something when his salary depends on him not understanding it, right? So if security leadership is gonna tell security teams to behave a certain way, and they're going to be measured that way, that's what they are gonna do. So Alan, exactly, to your point, we have to have the, the, the mindset of, yes, there are things we're going to have to navigate traditional security mindset that we do.

We are focused on risk reduction and, and, and, and other things, but we also need that having the, the, the, the broader view of these people are not waiting for us, and if we expect them to wait for us, we're gonna be in trouble. So you're, you're spot on. So I think it's interesting that, that you bring up the way you do, Alan, that, that we've had this problem where we haven't had enough security people for a very long time.

And, and I feel like part of it is because security has always been very reactive, right? We, we don't know what the exploit is until we see it. So we're going to attack the things that we've seen before, and, and we're always playing a little bit of catch up.

And one of the things that AI has promised is that we can start to maybe unearth some patterns and see some things that could potentially lead to exploits down the road. I think about like, anytime a new technology comes out, someone's like, well, why didn't you consider that it could be used for this, you know, very evil purpose? Well, because I'm not an evil person, I didn't think about it like that.

You know, think about Reed Richards in the Fantastic four movie. My job is to come up with all these horrible ideas so that I can figure out how to stop them. So we're currently trying to figure out how to train the people that we've got to think in that way.

And we have a crop of people who are probably, you know, later Gen z gen alpha folks that are starting to come near to the workforce. And instead of using cybersecurity as kind of like an adjunct for things that they've been doing, maybe coming from assisted admin background or a networking background or something, they're focusing primarily on cybersecurity because they see the potential. But at the same time, I've got people on the other side of the fence going, well, if you're gonna have to train these people to learn how to do security, why don't you train these agents to do it instead?

Because one, they're a lot smarter, Uh, And they can learn faster, and they can start thinking ahead of where the problems are gonna be. And so some people are probably gonna look at this and go, well, if I'm gonna have to train a person or a software construct to do this, why don't I just train the software construct? Because then I can keep deploying it over and over again, and I don't have to pay it benefits, and I don't have to worry about it leaving my company in two years with all of the knowledge that it has to become a consultant somewhere else.

And in a way, we, we've kind of cut off the next generation, and I feel like we do that a lot in technology, right? It's like we get to a point where we think we've solved that problem so that we can start teaching people how to deal with it. Only then something comes around and, and revolutionizes the problem.

So we don't need it anymore. Go ask any telecom engineer how, how that feels, because nobody uses the phone anymore, at least not the way we used to. You know, Tom, this, this is bigger than security.

It's right. This, this is what you just described, right? Uh, uh, uh, beat, uh, the guy who runs Salesforce, um, joining off be Benioff, mark Benioff said, we're not, we're not gonna hire junior developers.

Well, you know, not to do the birds and the bees with you, but if you don't, if you don't bring in junior developers pretty soon, you don't have senior developers either, right? Because that's where the, the seniors come from. But really, so I, I have a, a more nuanced view of this, which is we still need the junior developer.

We still need those cybersecurity people who are, some of, many of them are getting tremendous training in schools and universities. They don't have on job experience, which is tough, but they, they're learning great things in school. But what it really comes down to is the nature of their role is changing, right?

Fernando spoke about it in our green room discussion before coming on. You know, today's security person may find himself more of a security agent manager than what my generation considered a security professional. I think the same thing is true for developers, by the way.

He may have developers who code less, but manage code production more. And, and, and that may not be a bad thing. Fernando, I, I know you have thoughts on it.

I do. And and I, we are evolving. So let me, I'll go back to networking.

How many of us hardcoded Mac addresses on wifi, right? We don't anymore, right? Uh, uh, or, or, and, and, uh, because things have evolved.

So there are things that we, that we are evolving towards that are perfectly fine. Where I, where I'm concerned, is what happens at the market? What happens at the edges, at the details, right?

The details matter, right? So one of the challenges with outsourcing a lot to that, uh, to that agent capability is that you lose the, the, the, you lose the, the, the, the, the struggle that taught you something, right? And, and that is something we're struggling with.

And, and Tom, to your point about we're teaching the agent yes and no, because that's where, uh, a lot of the, the agent deployments are actually, like, we're not, we're not teaching the agents. We're typically buying pre-trained agents that do something, right? And then we have some no-code capability to, to, to, or, but, but we're not teaching an agent as we teach a junior, right?

And that is something that managers need to navigate, right? Because like, I think we're, we, were in agreement like the, the, the seniors come from somewhere, right? And if we're not teaching the juniors and we're not letting them fail, in some cases, the, the, how are we bringing this up?

Like, uh, to bring back to economics, right? The, the, the short term results that we're achieving are, uh, are an externality in the context. Like someone managing for someone focusing on short term results is not looking into the broader picture.

And that's gonna have negative consequences down the line. Economic consequences down line. You could say that about our whole stock market, right?

We managed quarter to quarter, and not long term, but let me, lemme throw another analogy at you guys, what you think. So I was from the generation, you weren't allowed to bring your calculator into the test with you, you guys maybe too, right? Mm-hmm.

And the thought was that by using a calculator, you didn't really learn how to look things up on the co-sign table, or you didn't learn the finer points of, of division or, or whatever calculus or trick. Now, my children, they, they walked into the, they were allowed to bring scientific calculators, not just pure math calculators, but scientific calculators into their test. Did it make them any less proficient in math than I was because I had to do it by hand?

I, I don't know. Right? When we talk about a, now, let's fast forward to agents.

I don't know if agents will learn, Fernando, I think this goes to the, to the very heart of what an agent is. Is an agent ephemeral? So it does one task and it's disposable like a container is, or is it persistent?

If it's persistent, it might learn, you might be able to train it and teach it. It might have that capacity under today's, you know, current state of things. But certainly that would be a hope in the future that a persistent agent or a robot for that matter, right, with AI on board, can learn.

I don't know. Yeah. So counter that by saying agents can be programmed, but I don't think they're learning.

One of the things, and I I realize this because I said it last week, um, is something I say to a lot of people. Experience is what you get when you don't get what you want. When, when I do something stupid and I go, oh, I shouldn't do that anymore, that's learning, right?

Like we, we talk about like, don't touch a hot stove, or I think about, uh, Percy Spencer, if you don't know who that person is, in 1945, he stepped in front of a magnetron with a Snickers bar in his pocket, and that's when he discovered that you can heat things with microwaves. And that was complete accident. He wasn't looking to patent a way to cook food in 2025.

He just happened to accidentally leave something in his pocket. And that's where I think that humans are always going to have an advantage over ai. We're gonna do dumb things, and then we're gonna step back and go, I shouldn't have done that.

And, and Alan, to your point about, you know, learning math the long way, you know, slide rules and mul and memorizing multiplication tables and things like that, yeah, if someone rattles off to me, you know, what is six times seven? I can pull it up quickly because I had to memorize that as a kid. Whereas nowadays, people need a calculator to, to figure out a tip on a, a meal.

Although now the tip pops up and says, you know, do you want to tip this? Because we're trying to eliminate the fundamentals that we feel are unimportant, but why do we feel they're unimportant? Well, because we already learned them.

Like, like, I don't need to teach people, and this is something that I've told people a lot. We forget what it feels like to be new at something all the time. And all you've gotta do is go ask that kid or that, that entrant into the job market, what it feels like to be new at something, because they are, and AI agents are just like that.

Whether they're ephemeral or more persistent when they start, they are a blank slate. They will do nothing that you don't tell them to do. So you can load in everything that you can think of that they're ever gonna need to do, and they will do exactly that because that's all they've been taught to do until they get to a point where they do something they're not supposed to.

And that's where we have to step in to tell them, don't do that anymore. Do this instead. But this is the challenge, right?

Because current AgTech technology doesn't have that training, that retraining loop in there, right? Yes. You can feed, you can feed context to your rag till cows come home, right?

Uh, uh, you can see the cows come home to the rack, right? And, uh, but, but, but it's not learning, right? That it is replicating whatever it was supposed to be doing.

So Let me, you, you brought up a point, and I wanna bring this up because about six or seven years ago, I was trying to explain the difference between what I consider to be AI and machine learning to somebody. And I use the Hitchhiker's Guide to the Galaxy as an example. Deep thought is a machine learning computer.

You feed it a whole bunch of information and it comes up with an answer 42. And then you go, what's the context behind the answer? And it goes, I don't know.

You didn't ask me for context. I can't think outside of a bounded solution set. Now, the fact that everything that we talked about there became ai, to me, AI is being able to learn from your mistakes.

It is being able to think outside of the bounds of the condition and go, wait a minute, what if we did this instead? What if this happens? It, it still has to have that element of creativity.

That's why we need people. I, I don't disagree with, with what you're saying, but nevertheless, we have a generation that brought their calculators to the test, right? And the world hasn't fallen apart, though some may argue with that, right?

The world hasn't fallen apart because of it. But I, I think it goes back to something I said before, is ultimately, what is the nature of the role gonna be in a, an agentic ai, especially of armies, you know, call Sagan billions and billions of AI agents. What's the role, let's say, of a security person or a developer or an IT admin or any of us?

What is our role gonna be? Yes, you need, you need to get that cut your teeth experience, but if an AI does it better, cheaper, faster, faster, you do, oh, different things, right? And, and since we're, since we're on a, on a mask kick, right?

I'm gonna use my, my, uh, an expression, I, i, I say a lot. It's like, it's not precisely completely accurate, but go back to high school calculus, right? Remember your limits, right?

Mm-hmm. So the, the, i I like to say that the limit, right, for cybersecurity as time moves to infinity, right, is anti-fraud. And what I mean by this is that we take the technology and we abstract it away, right?

We, uh, we commoditize it, we industrialize it, we operationalize it, and then we focus on higher level problems. Right? Now, it does not mean that those technology problems are not important, but we've contained them well enough that a few experts can deal with that problem at scale, and we get to focus on other things, right?

And I think that's the answer to your question. Where do we go in a world where we have agents? Well, we need to go in a world where we have an agent that saves time for a SOC engineer to review an alert.

We now go to a world where that SOC engineer can perhaps give a call to the marketing people and say, Hey, whatcha guys doing there? Like, let me understand what you are doing from a marketing perspective. Let me understand what the initiative, okay, perhaps not the SOC engineer, but you, but we, we move to a world where cybersecurity becomes much more attuned to what's happening in the organization, right?

In order to do that though, we need to train the people to do that, right? You don't, uh, we have to teach, uh, uh, the juniors, what's a p and l statement, right? What, uh, uh, how does marketing work, right?

What is, uh, accounts payable, right? So that they can have meaningful higher level business conversation. Now, there, it doesn't mean that you're gonna move your sock engineer to an accounts payable trainee next, next day, but it's understanding, it's making the connection between, oh, look, this particular system here deals with externals, and here's the identity that the IDP for those externals and how does it tie into a system?

And oh, by the way, they are, a token was just compromised and blah, blah, blah, blah, blah, blah. So the skills that we're going to need is this kind of systems thinking. How do things connect both as technology as well as quote unquote the business, how it all connects together.

That's that, that, as we look into the year, that's, that's what I, i, I hope people take, okay. How, how do I grow in 2026? Well, I think that, I hope that one of the areas people grow into, how do I understand the company I'm at?

How do the organization I'm at, how do I support their business, their mission? In a way, it sounds like what you're saying is that the people that we're hiring can't be only focused on point solutions. They have to be integrated into the business so that they understand the mission of the business, as opposed to, well, I'm just gonna do sales, I'm just gonna do security, I'm just gonna do marketing.

I'm just gonna do accounting. They, they have to have a broader vision. And what agents and what AI and what we're doing here by, to Alan's point, letting them bring their calculators or their agents to class is abstracting away the nuts and bolts to give them the perspective to focus on the bigger picture.

You know? com 12 years ago, about a year or two after with two lovely ladies, I, I founded the DevOps Institute, and we, we probably, in the eight to 10 years we were doing DLI, we probably had about 65,000 people take certification under DevOps Institute. One of the things we taught then, and I think it's true and more true today's security as well, is what do you wanna be?

Do you wanna be what we call a t individual where you have one kind of domain that you do and you go deep on it? And how valuable are you in tomorrow's job marketplace? How valuable are you in an AI empowered marketplace as a tea individual versus let's call it a broom, right?

Where you have different expertise, right? And we always taught that the broom, the brew person, was more valuable because they had a, a more rounded, uh, knowledge base of, of expertise. And I think, Fernando, to your point, that's exactly the point.

You gotta know the business you're in to figure out, and it, and it can't just, you can't just know security. Now, paradoxically, that was one of the great things about security when we were coming up, is that no one was just a security person. We were all a network person.

We were all a, a cis admin help desk guy. We've all been there, done that, and we got, you know, forced into security somehow. We weren't just that pure play, if you will.

I don't know, are we dinosaurs when it comes to that? Could be. And, and, and, but I think that I agree.

Uh, yes, we are ic, right? But I think that if there's, we, this is such an important time in society, right? Because, uh, we've reached a point in our evolution.

So another quote I like to use all the time is, uh, Edward Wilson, a biologist, right? The problem with mankind is that we have paralytic brains, medieval institutions, and God-like technology, right? We've reached a point where the technology impact of security is widespread.

Like we've grown out of the, the, we've moved out of the basement, right? And, and the role that we need to play is to navigate how do you infuse security agentic or not into everything that we're doing? And how do we teach people how to do that, right?

And, and, uh, I, uh, I worry a little bit sometimes about the guidance that, that the juniors are seeing, especially too early on, is very much, oh my God, okay, let's go. You have to go deep into the technology. You have to, to win every CTF that you play in, you have to, to, uh, have so many CVEs to your name or, or, or whatnot.

And we have to help them make this transition from very narrow into something a little bit broader. That's the role that we can play right now, right? And I think that's, uh, uh, I, I encourage people to, it's one word, Shakespeare, right?

Know thyself, right? Where are you? But go ahead, Tom.

No, no, No, go ahead Alan. I was just gonna counter in here. Take nothing of what we're saying as a discouragement to enter the cybersecurity field.

There's gonna be plenty of jobs and plenty of roles and plenty of new, new vistas and hills to conquer and climb, right? The job and the function's not going away. And in some ways it's gonna be better than it ever was because you're gonna have all these digital coworkers at your side and at your beck and call.

So for anyone out there watching this who's contemplating a career in cyber, by all means we need you. Come on in, come on in the water's fine. Um, and it's gonna be different than it was for me or Fernando, or you, Tom, but it's still gonna be an exciting, rewarding career.

Tom, I'll over to you. I'll, I'll just leave you with this thought because I think about the people who were sailing over the oceans in the 15 hundreds, right? There's this vast ocean in front of them, it's unexplored and nobody knows what's going on out there.

And there's a lot of people on the ship that know how the sails work and how the rudder works and all of those other things. But the job of the captain of the ship is not to focus on those systems, it's to focus on the horizon and chart a course to figure out where to go. If you want to be the rudder operator, that's great.

If you wanna be a captain though, you've gotta put your eyes on the horizon and not on the rudder. Alright, we're gonna go ahead and wrap it up there. This has been a great discussion.

I wanna thank you guys for being a part of it. Uh, since this is the first episode of 2026, um, Fernando, what have you got coming up that people should be checking out in the next couple of months? Because I know you're gonna be super busy.

So, uh, it's really interesting. At Tuum, we have the, the, the signal report that we created for security operations in, uh, in q4. Uh, the Q1 report is, uh, most likely going to be on sass E and I get the pleasure of working with you on that.

So I'm, I'm, I'm looking forward to that report report. And, uh, but in general, right, it's a relatively quiet January in terms of events, but then things pick up a reminder to people that RSA is, I mean, for listening to this in early January, RFA is less than a hundred days away, right? Uh, less than about 90 days away or so, like, so, uh, late March in, uh, in San Francisco.

I'm looking forward to seeing, uh, friends old and new there. And, um, yeah, I think that's the, that's the, the, the, the early start for the year. Awesome.

Alan, I know you guys have some exci exciting stuff at Techron coming up in the beginning of the year. Yes, we, we have our annual predict this year. Of course predict 2026 as one would do in 2026, though we could play 2025 and see how to turn out.

But no, we have predict 2026, this is the eighth or ninth year we're doing this virtual event. But this year what really predict is powered by the FUT analyst team. So Fernando, Mitch, a bunch of of the, uh, uh, RUM analysts will be presenting at Predict, I believe it's January 15th.

It's all day. You can watch it live then, or you can watch it on demand. We'll also be announcing live at Predict the winners of the, uh, DevOps Dozen awards for this past year, which is also, I think it's 10th year, um, exciting with that.

We had a lot of, a lot of interest in that. And then like Fernando, we are full speed ahead into RSA again, I think the 10th year we'll be putting on our DevSecOps event on Monday of RSA week at Moscone, a partnership with the RSA conference folks this year it's securing AI native Dev. Fernando will be, uh, chairing a panel as well, Mitch.

And we have a full day I've lined up, by the way, David Burin, a very famous sci-fi author, Hugo NE award-winning author and a PhD from JPL, uh, to Keynote as well as, um, harness CTO and founder GT ELL and SNC co-founder and Tessel founder and founder of the AI native Dev community. Guy pja guy will be keying is and Patrick dubois, who kinda gave DevOps and name will be there as well. So very excited for the our RSA.

And of course we'll be at broadcast Alley all week doing videos. Tom, I'm pretty sure we have a Tech Field day going on that week. Yep, yep.

You're Absolutely right. So I think we'll be all hands on deck in San Francisco for RSA conference. Absolutely.

And I wanna make sure that everybody knows that we do have an event focused on AI infrastructure that'll be going on at the end of January. com has more details. And as Alan mentioned, we're gonna be at RSA for the first time.

We've already got two great presenters lined up and we're looking for more. So, uh, stay tuned for more details on that. And we also want to thank you all for listening to this episode of Security Boulevard.

If you enjoyed this conversation, please make sure that you subscribe on YouTube or your favorite podcast application so you don't miss any of our episodes throughout 2026. We'd also leave it, if you'd leave a, we'd appreciate it if you'd leave a rating and a review, because that really does help the show grow. And if you have a fun comment, please leave it below because we love reading those.

com and the Futureum Group. com. You can also see it on the Textron TV website, or make sure you check out the Textron TV app.

It's available on pretty much every platform that has a screen, and we would love to see you there. Make sure you follow Security Boulevard on X, Twitter and LinkedIn. Just look for security BLVD and you'll have tons of content to keep you tied it over during the winter.

We'll, thank you very much for tuning in. We'll see everybody next week.