RISE and CARE: The Antidotes to “AI All The Things” – The AI Security Edge Ep 6

Welcome to another episode of the AI Security Edge, where we explore the intersection of cybersecurity and artificial intelligence with the leaders shaping the future of digital defense. I'm your host, Caroline Wong, tech Strong TV podcast feature, your favorite video series, industry thought leader, commentary and analyst research on DevOps, security cloud native and digital transformation. In a podcast format, AI is revolutionizing cybersecurity, both as a weapon for attackers and a shield for defenders.

The AI security edge dives deep into the evolving cyber battlefields where AI driven threats, challenge traditional defenses and cutting edge AI solutions offer new ways to fight back. Our podcast explores real world case studies, expert insights and practical strategies for building cyber resilience in an AI powered world. Whether you're a security leader, practitioner, or AI enthusiast, we hope you'll gain valuable knowledge on the risks, innovations, and ethical considerations shaping the future of digital defense.

Tune in to stay ahead of emerging threats and harness AI's potential to secure tomorrow. I am so excited to announce today's guest, my good friend ko. Did I say that right?

Ke Cur Kos. Yep. Kos.

I'm like so embarrassed about that. Kos. My guess is Kos, we call him Rock, rock Land.

Yeah. Nobody, nobody knows kos. We're, we're gonna call him Rock, but I did wanna like tell the world like what your full name is and yes, he is as solid as his name suggests.

Rock is a 20 plus year tech, cybersecurity and AI veteran who's been shaping the future of secure innovation across industries. As the founder and CEO of Rock Cyber, he helps organizations to navigate the tricky intersection between ai, cybersecurity and compliance, and actually make it work for the business. He is a co-author of the CISO evolution.

Highly recommend creator of the Rise and Care frameworks, which we'll get into in just a moment for aligning AI strategy and governance, and a driving force behind O OSPs AI security projects like the top 10 for LLMs. His career spans leading it, OT security at Marathon Petroleum, optimizing incident response at eBay, where we met and running global security offset general dynamics, all with measurable results. Whether it is wrangling, regulatory beasts like the eu, A I Act, or building security programs that do not slow innovation Rock brings a mix of deep technical expertise and strategic Vision.

Rock. Welcome. Thank you so much for joining me today.

Thank you for having me. You're way too kind with that intro. Thank you.

I Just love talking to you and I love that we get to have this particular conversation. So rock, really arguably the most important part of AI today when it comes to cybersecurity, is governance and strategy. And you have created a couple of frameworks for us to use RISE and Care.

Yeah. Um, I love those acronyms and we'd love to learn all about them. Yeah.

Thanks. So, um, now where do I begin? So, rising Care are frameworks that I developed for, uh, AI strategy and governance respectively.

Um, you know, I I often get phone calls, Caroline, around Hay Rock. You know, we're using AI within the organization. We know we are shadow ai.

People are using their personal, uh, chat, PT or Gemini accounts, whatever that case may be. Can you help us wrap our arms around it? I say, sure, uh, what are we governing?

And they pause and they're like, I just told you idiot ai. No, no, no, no. Right?

Ai all the things is not a strategy. Um, you know, what are your defined business use cases? What are your desired business outcomes?

Uh, have you measured, have you quantified the value of the opportunity? Right? How do you measure that your AI pilots are are working or succeeding, right?

Or, or do you need to pivot? Um, and that's where Rise came about. And then care, right?

From a governance standpoint, it's kind of that rule book, the, the, the guidelines, the guardrails you put in place to, um, to enact and, and realize your strategy. And, right? Uh, a mutual friend of ours, Malcolm Mark, and one said, you don't put high end brakes on a Ferrari to slow it down.

You put high-end brakes on a Ferrari to allow you to go really fast, really safely. And honestly, that's no difference between, you know, our traditional cybersecurity, uh, governance kind of thought model, nor should it be for ai. So, you know, if, if we start getting into the frameworks a little bit, you know, we can start with rise, RISE stands for research, implement, sustain, and evaluate.

So in the research phase, this is where you pick the problems. This is where you pick the problems that really matter the most for your organization and with the numbers, right? You don't say, again, ai, all the things you say, things like AI for the claims backlog or AI for order exceptions, or AI for sales follow ups, right?

This is where you check your data, you know, the quality of your data, you know, do you have systems and infrastructure in place you need to go build, procure, and frankly, what's that cost to win? And what's the ROI that you're, you're looking to, to gain, right? And then implement is for implement, right?

This is where you touch a ship, a small pilot, um, that touches real work, right? Hopefully, if it's your first time outta the gate, nothing terribly too business critical. This is where you measure things like cycle time, quality, cost per action, uh, that type of stuff.

This is where you start integrating care, which we'll get into in a second, where you build guardrails from day one. So your success is scalable and not, you know, kind of a one-off as it's for sustain. So now you treat the pilot like, like a product, right?

You monitor things for, uh, model drift. You fix any edge cases, right? Is your model over tuned?

Um, you know, train the people who use it every day, which is super critical, right? We know employees are, uh, kind of afraid that ai, how AI is gonna impact, impact their jobs. So, you know, keep it healthy, keep it balanced, like 'cause AI's value compounds only if it stays in the game.

And then e is for evaluate, right? This is like you compare the promises to the proof. Uh, this is where the measurement comes in.

Did, did you meet your expected ROI, did you have the expected business outcomes? How did you measure those? Did you hit, you know, a predetermined internal hurdle, hurdle rate?

Where did your value leak? Um, all that kind of stuff. What should you kill?

Which pilot should you kill? Like you, you should absolutely have a murder board for AI initiatives, just like you would for a, for, uh, IT initiatives, right? And then what should you double down on?

Uh, then you feed those lessons into, uh, a feedback loop and kind of rinse and repeat and then, uh, care, right? So care is complimentary. Sit side by side ai.

And again, that, that strong governance enables innovation. Um, and care stands for, create, adapt, run, and evolve. And create is where you set that governance framework, where you set that governance framework that fits your risk and your market.

What kind of regulatory scrutiny are you under? Are you operating in the European Union, uh, as a developer or deployer and are subject to the EU AI Act? Um, clear policies, owners, and, you know, documentation records.

Uh, everyone should know what good it looks like, uh, within their AI rollouts architecture and whatnot. A is for adapt. Uh, the third or the, the world moves, right?

New threats, new partners, new laws, right? How do you build an adaptable kind of framework that where those guardrails aren't too rigid, um, but still provides you rules that let you remain compliant, particularly with the regulatory burdens that, that we're seeing come down the pipe, you know, update the rules accordingly, um, and enable controls that align to your desired business outcomes without slowing the work. Ron is now your governance's operational and day-to-day operations, right?

From, uh, post-market monitoring, which is a requirement of the EU AI Act, uh, audits, access reviews, uh, red teaming, uh, evidence gets created as you kind of, as you build this beast, as you build this ship, not after the fact because the regulators will start coming knocking. Um, the EU did it with GDPR, they'll do it with, uh, the EU AI Act. And I keep bringing up the EU AI Act.

'cause that really is the gold standard, um, top of everybody's mind right now for global AI regulation. And many other regulations that we're seeing on the books, whether that be in Asia-Pac Canada or even stateside, uh, here, um, are, are pulling components out of it. And then finally, e is for evolve, right?

This is where you raise, uh, your assurance at scale, right? This is where if you need to go get certifications such as an ISO 40 2001, you're executing on it, right? This is where, um, now you can start answering those third party reviews, uh, you know, from a strong posture, but now you're also having third party reviews conducted on your, uh, AI systems.

And, you know, kind of like the, the, the classic plan do check act model, continuous improvement across, uh, your AI rollouts. So if you put it all together, think about it, it kind of creates a rhythm. A rhythm, right?

Like rise picks the right problems and turns them into results. And care keeps those results safe, compliant, and repeatable. Um, choose a workflow.

Give it a whirl. Give it an owner. Uh, get, you know, try and ship something small.

Uh, succeed. Don't succeed. Learn your lessons.

Rinse and repeat. That's, I think, how you turn AI from a promise into a true competitive advantage Rock. I just think that is so cool.

And here I am just like grinning and laughing. Not only 'cause I'm delighted that we get to hang out, but also because you've said this phrase a couple of times, a couple of times, like ai, all the things, and that literally is just like what people are doing. Yeah.

That literally is what boards are demanding that folks do, right? I've talked to so many friends and colleagues and clients, and literally their boards just want them to AI all the things that's practically, that's practically the direction from like every company board today. Um, and so to have something that is so elegant and so straightforward as rise and care, um, that is really cool.

Thank you. Thank you. And you know, you and I are relatively fluid in board speak, and we know, like you and I know that when the board says ai, all the things they really mean, CEO go figure out the things to AI and prioritize it.

But so much of that gets lost in translation from the board to now, like your AI steering committees that are determining what to do what and when, right? And that's like where the disconnect starts to happen. I have heard about so many conversations where the objective is just do something with ai.

Oh, fomo, tongue Fomo. And it's just, and it's such the wrong conversation starter, you know, because as you talked about with research folks, you know, it's so fascinating, um, because AI is a tool to help us achieve business outcomes. Um, and yet, you know, this thing that, that we've seen happen over and over again throughout our careers and technology, which is to say, technologists get super pumped about tech, which is fine, but actually the tech itself is not a business outcome.

Um, and so I'm super glad to hear about these frameworks. I'm super glad that you have created them and that you are sharing them with the world. Thank you.

Thank you. And I'll also double down on that saying that the tech is not the risk, right? The risk is the risk.

And you know, I don't if you, if you indulge me to go on a little bit of a rant, like we're seeing all these regulations trying to regulate the tech and not the risk, right? Like, we have consumer privacy laws on the books, we have anti-discrimination laws on the books, right? Which is, which is all the things that we're trying to prevent with, uh, all these proposed AI laws and regulations coming down the pipe.

And, you know, nobody's gonna listen to me, but if I were in charge, right? I would encourage taking a step back. Let's enforce the laws we already have on the books.

Do we need to maybe make some amendments to account for ai? Sure, totally open for that. But I'm fearful that especially here stateside, we're going to fall into the same kind of cybersecurity and privacy patchwork, uh, that we've been battling for decades.

And, um, now, you know, we have the America's AI action plan and you know, we're definitely not gonna derail this podcast going in into that and what that means and some of the language in there. But, you know, uh, dis encouraging states or disincentivizing states from coming up with their AI laws. We'll see how it all shakes out.

But I would just say, let's regulate the risk, not the tech. Let's regulate the risk, not the tech rock. I've got a couple more questions for you from your perspective, and you have deep expertise in, for example, incident response.

You know exactly what it's like to go up against these attackers. How is AI helping attackers? Uh, what about my bald head and gray beard makes you think I have a lot of experience and it's instant response?

Uh, so fortunately we haven't seen like widespread AI enabled malware yet where the attackers are leveraging AI is honestly, uh, we're seeing it very prevalent in phishing and deep fakes, right? So more on the social engineering side of it. Um, what did we use to, you and I work at eBay, don't need to mention how many years ago, but long enough ago to say, to remember that, you know, we used to tell users, oh, look for bad grammar and bad punctuation, uh, in your emails, and that's a dead giveaway for phishing.

Um, well that's, that's long gone, long, long gone. Even whatever, you know, small remnants there was with that preoc October, 2022, um, is, is long gone. Um, so, you know, we're seeing things like business email compromised and whatnot happen due to super believable phishing emails.

And we've seen millions and millions of dollars be transferred into fraudulent hands, uh, due to DeepFakes, right? Uh, people purporting to be on the other side of a Zoom call or the CEO or CFO convincing, uh, poor accountant or whomever to transfer large sums of cash. I mean, heck, we even saw, and this is very public knowledge, kudos a no before for making it public and writing blogs about it.

Uh, north Korean employees getting hired, uh, onto US tech companies and I'm sure beyond, uh, leveraging deepfake tech deepfake technology. So that's where we're seeing attackers, uh, primarily leverage it right now. Um, and then, you know, I would say nation states are leveraging AI with regards to, well, a lot of, you know, intellectual property theft, distilling other models, distilling other models, um, you know, uh, critical infrastructure, uh, you know, to, you know, I would not be surprised if they're starting to develop tools to get into our infrastructure, uh, easier, faster, and quieter.

I mean, we know, um, all of the, uh, campaigns right now with, you know, China and our infrastructure from the telecom industry to the power industry, uh, that's all public knowledge. I don't think I'm sharing anything that isn't widespread knowledge. Um, and then I think from, you know, on the flip side of that, from the defender perspective, if we deal with a ton of data from an IR standpoint, right?

From a security monitoring standpoint, from a triaging standpoint, from an incident response standpoint, are we at the point yet where we could fully automate a security operation center? Um, no. Are we gonna be at that point anytime soon, in my opinion?

No. Uh, still still need some actual real human intelligence there and human in the loop. But can we start to get more effective at triaging the billions of alerts that come in across, you know, across the world daily, um, and becoming more effective at that and reducing our false positives and false false negatives and quickly potentially taking action tier one type action, maybe tier one and a half type action on that incident response side from quarantining assets to whatever, and, you know, shrinking meantime to response, shrinking, dwell time within an environment, all that kind of stuff.

Yeah. Um, teams are leveraging AI now. The tooling that the teams are using are leveraging AI to assist.

I think it's exciting. I think it is super exciting. I cannot wait to see what this future holds for us.

Rock, last question for today. Is there anything else that you want to tell us about your personal or professional use of ai? Anything sort of particularly fun or surprising or unexpected?

How, how are you using it? Oh, gosh. Um, I am, I am very much all in on it.

Um, I am not a laggard or a Luddite maybe to, uh, maybe hurts me sometimes, but, uh, I, I joke with people, right? My wife does not work from home. I do, and I joke that sometimes I have more conversations with an LLM during the day than I do her.

Um, and I use it everything from, you know, work, you know, running my consulting business to helping me study, right? I am, uh, recently enrolled in a master's program. Uh, you know, notebook, LLM is great for capturing study notes, creating study guides, you know, uploading transcripts of courseware, uh, videos or whatnot and creating the study notes off of that.

And it helps me because then I can focus on the lecture or the conversation versus like rambling and jot down notes, um, and then, you know, go back and kind of reinforce it afterwards. Um, you know, those are some of the ways that I've been using it. Rocky, you and I got to talk about this in Atlanta, but for our guests, which master's program are you doing?

Uh, because I'm a nerd and I hate myself, the masters of Data Science and AI at the University of Denver. So just to be clear, this is not a master's where you're learning about ai, you're learning how to do ai, you're learning how to make ai, this is like hands on keyboard from scratch, build this stuff. All I have to say is thank God for vibe coding, because I have a room coded, coded in earnest, you know, for like 20 years, um, for school.

I'm not so worried about necessarily the quality and the security in my code. I just want to get the, the assignments done. I'll worry about that later when I, before I put it up into a GitHub for everyone.

It's so cool. Uh, I can't wait to hear a lot more about your journey as it continues. Rock.

Thank you so much for joining us today. Thank you for having me, Caroline. Always great hanging out with you.

This has been the AI security edge. We're exploring the intersection of cybersecurity and artificial intelligence with leaders who are shaping the future of digital defense. I'm your host, Caroline Wong.

Thanks again so much for joining us today on Techstrong TV podcast. Don't forget to come back and look for more of your favorite video series, industry thought leadership and Analyst research. Thanks so much folks.