Mackenzie Jackson: Hi everyone. Welcome to another episode of The Secure Disclosure. I'm thrilled to be with Josh Kamdjou. Josh, how are you doing, man?
Josh Kamdjou: I'm doing great, man. It's Vegas week, so yeah, it's summer. It's about 120 degrees out, so it's a bit of a brutal week, but it's good. You know, lots of familiar faces, catch up with people, customers. Yeah, good conversations.
Mackenzie Jackson: I always like to start these podcasts off because obviously you're the CEO of Sublime Security. You guys have been crushing it lately, but I want to know the origin story a little bit. Why was this a problem that you decided to tackle? How did Sublime start? And then we're going to get into all the ways it's changed.
Josh Kamdjou: Yes. Yes. And has it changed? Yeah, it definitely has. Well, I spent my career in the offensive cyber space. So I spent about a decade doing government stuff and some time in the private sector also doing similar kinds of offensive engagements, initial access, and a lot of that just happened to be over email. So I got very familiar with how our adversaries operate and the different phases of conducting an operation and achieving whatever objective it might be. Whether it's nation-state, whether it's financial crime organizations, activists, lone wolves, there's lots of different profiles out there. But I got very familiar with how those operations are conducted. And I started to do that myself on the offensive side. So I learned what worked and what didn't and what the shortcomings were in the email security solutions. And that informed the approach that we took at the time, which has evolved. We learned a lot since those early days, but that's what got us into actually building Sublime. And yeah, I mean, the last couple years have been pretty crazy in multiple regards.
Mackenzie Jackson: Yeah, it's exhausting. It's kind of like Black Hat Week is like a gigantic week after a couple of gigantic years of just non-stop chaos.
Josh Kamdjou: Have you heard of this thing called AI?
Mackenzie Jackson: People keep talking about it at conference.
Josh Kamdjou: I don't know. I'm still trying to figure out what does it stand for?
Mackenzie Jackson: Yeah. I'm curious though, I think your background in offensive security is going to be really interesting here. Why do we struggle with email so much? We can look at all these incredibly sophisticated campaigns. There's been a whole bunch of supply chain attacks and all of this crazy thing and when you boil it all back there's sophisticated malware. There's crazy obfuscations and it starts with a phishing email. When you look at it, it's like there's nothing crazy going on there, but we struggle so much with understanding phishing emails, catching them. Yeah. Why is it such a hard problem?
Josh Kamdjou: Yeah. Well, in my unfiltered opinion, email is an absolute shitshow.
Mackenzie Jackson: If I were to summarize it, what's the brilliant podcast?
Josh Kamdjou: Yeah. Yeah. I mean, the way that benign email tends to look, it can look so much like malicious email. And every environment is so different. So you look at customers of ours, like Spotify for example, and you compare that to, you know, we work with the top five banks in the world, the sending patterns and behavior and what's, like how they actually send mail. Do they send mail to free mail addresses? Do they send mail to newly registered domains? Do they send finance, you know, send invoices? It's just like there's so many different patterns of behavior and what normal looks like. And you add to the fact that marketing emails and spam and all these other things. And so it actually turns out to be really difficult to do it at scale. It's a scale problem is really what it is. It's not difficult. You can take an email, you can take an attack sitting in your inbox right now, throw it in ChatGPT and it'll do a decent job of telling you if it's good or bad, like just out of the box. But the challenge is doing that is weeding that out from the million other benign emails that also arrived at the same time and then doing it in a way that's fast enough to be acceptable by a large enterprise. So ChatGPT might take 10, 20, 30, 40 seconds to analyze a message. Well, that's not good enough if you're analyzing hundreds of millions, billions of emails a day or month. So at the end of the day, it's a scale problem is one of the things that makes it really difficult.
Mackenzie Jackson: Yeah. And it also sounds like catching a phishing email or malicious email isn't difficult. It's like not catching a million false positives with it is the challenge.
Josh Kamdjou: I would say that there is a floor where it's not difficult, but it can actually be pretty complex.
Mackenzie Jackson: Yeah, I think I phrased that wrong. I'm regretting my choice of words. I saw it in your eyes and I was like, I might just leave. What I meant to say was like the biggest challenge is not catching the malicious email. The biggest challenge is to then only catch that one. Would that be fair or is it
Josh Kamdjou: Yeah, I would say that's definitely true that one of the biggest problems is not catching the good stuff. And then there is a class of attacks that you really do require sophisticated analysis. So you need signal on past behavior to know whether or not this vendor is actually compromised or not for example. You need to do natural language understanding to know what's the tone and intent of this message. Is there a sense of urgency? You have to be able to detonate links in a sandbox and get past anti-evasion techniques and you deal with malware and so you know how challenging that can be as well and that's a big delivery vector from email. Yeah.
Mackenzie Jackson: Yeah. And I think when people often think about security, email security too, there's so much behind the scenes that you don't think of. And just as you were talking about them, there's so much that makes so much sense when you say it, right? You know, like for example, the times of monitoring when the email was created, when the domain was created, that's a really important signal. And saying like that, it's not just taking the email body and deciding is this email malicious? You have to look at so many other vectors as well.
Josh Kamdjou: Yeah. Exactly. And now, I mean, there's so many new techniques. One of the big challenges introduced by, I mean this is always happening in the email threat landscape, is evolution of attacks. New techniques that come out is one of the big things that we learned in the early days of Sublime was that the model that you have, how good you are now, doesn't matter three months from now, because it's changing so rapidly and it's been changing even more rapidly recently with adversary adoption of generative AI. So now there's all kinds of new techniques, more sophisticated attacks that you've never seen before. So you have to be able to, you have to be able to reason. So we have agentic capabilities now to reason through never-before-seen attacks. And there's other new attack surfaces that have been introduced too, like malicious calendar invites, like picked up a lot in the last year. And now you even have enterprises who are adopting AI internally are connecting agents to their inboxes. So now there's prompt injection potential coming in from email. So we do that. We just announced that at Black Hat this past week. So it's a moving target. So really, one of the really important things is how quickly can you evolve how good you are and we have a lot of thoughts on that and how to do that work.
Mackenzie Jackson: Yeah. Surviving security in this era is a lot about being nimble I guess, being willing to change too and move on from areas.
Josh Kamdjou: Yeah.
Mackenzie Jackson: The generative AI stuff is kind of terrifying. Sublime has been around for probably long enough when it used to be that you looked for spelling mistakes in emails to know that it came from a threat. Now, I trust it more if it's got spelling mistakes.
Josh Kamdjou: Is there an M-dash?
Mackenzie Jackson: Yeah. Yeah, exactly. Like that could be there. What has been one of the biggest challenges with the kind of generative AI adoption of adversaries? Is it what you've been talking about is the new attack vectors and all of that, but is it also the scale of it that's changed? What's been some of the biggest catalysts of the kind of new, the new threat landscape?
Josh Kamdjou: Yeah. Well, the way that we think about this is in the early days of email existing, you had a certain, the one class of phishing attacks you had was how you would kind of generalize to be commodity phishing. So, it was high volume, low sophistication, sometimes there were spelling mistakes, but it was essentially all templatized and it wouldn't be changing on a per attack basis. It would just be spray and prey. That's like, you know, that's like one class of phishing attacks. Then you have another class of phishing attacks that I have personal experience with, which is spear phishing. So that's like highly manual, it's targeted, it's more sophisticated, but it's low volume because it's a human doing it. And now generative AI has introduced this third bucket, which is the worst of both of these worlds, which is high volume, high sophistication, highly targeted, and highly changing. So that introduces a lot of challenges on the defensive side because you have to, there's so many things that you need to be more context aware on a per customer basis to know, you know, whether it's actually tailored or targeted and to weed out false positives. And you have to be able to reason like I said before because these are techniques you've never seen before, you know. So like if you have just like a language model that was trained on language six months ago, that may be very different today and so you can't rely on just traditional machine learning because there's a certain definition of bad that's baked into those models and the signals that they use. So you really need a combination of both now that's highly tailored contextual. And our kind of big thesis on this is that it's really an architectural constraint that most companies have in terms of how effective they can be. We just published a four-part series on this on our blog. We call it detection and prevention in the post-AI world where we look at how detection and prevention has been done up until now. We call that the centralized detection model where you have a bunch of data that you collect and then you train on that data. You have signals, you train a model, you test that model, and then you ship out a model to all of your customers, more or less. That introduces some problems in this new world. Because generally those models are going to be one-size-fits-all. And the rate of your ability to adapt and change that model for all your customers is also pretty slow because if you miss something, and every security company that does classification of some kind, you're not going to be perfect, right? You're going to have, you're going to have mis-attacks, you're going to have false positives. So, the way in which that architecture improves is like you have to go and retrain the model. So you have to collect more data and more signals and you have to regression test before you push out the model. And so that can take weeks, months, very long time. Sometimes when you push out that model, it's not even fixed for all customers because they're so different and unique. So we created this new architecture that we call the distributed detection model where we push down our detections essentially to on a per customer basis. And instead of having to go back in in like this centralized bottleneck, we can adapt actually on a per customer basis and we have agents that do that now. So when we get something wrong, we can update our detections within hours and that tends to, that that that works really well from a mean-time-to-close perspective.
Mackenzie Jackson: Yeah. It's kind of like a circular loop of like training and like that's kind of like the best way to kind of build if you have this all built in, you're forever improving on the new techniques from it.
Josh Kamdjou: Yeah. Yeah.
Mackenzie Jackson: I want to talk because of your background here. I think maybe you'll probably appreciate some of this, but you talked a lot about new techniques, sophisticated techniques. You talked about a few things like, you know, invite attacks and what's something that's kind of out there that you look at and whilst we don't want to give attackers too much credit that you kind of think that's kind of cool? Like that's kind of, that's kind of fun. We in the malware game, there was, there's one attack that was, it was super crazy. They used Unicode steganography to make invisible unprintable characters that linked to a calendar invite that had a base64 title that was to a, like it was just kind of wacky.
Josh Kamdjou: Yeah. Yeah. Yeah.
Mackenzie Jackson: I'm going to briefly interrupt this episode to thank our sponsor of the podcast, Aikido Security. Aikido Security is your complete code to cloud security solution. It secures everything from the first line of code that you write all the way through your supply chain, your dependencies, and of course, Aikido is also a leader in AI pen testing and AI code auditing. So, make sure you check them out today. You can start for free at aikido.dev. All right, enough about that. Let's get back to the episode. We definitely see evasion techniques like that in email too, like zero-width fonts and just text that is designed to manipulate models within email. So, we definitely see that. I mean, what we're seeing more and more of is a lot of multi-chain evasions. So, you might have, you know, you might have an email and within that email you have a link and that link downloads a PDF and that PDF has a link and so they're getting pretty creative in terms of how they evade detection technologies. So you really do have to have, you have to be able to follow, you know, kind of a multi-chain analysis. But then you combine that with other techniques which end up, you know, are pretty clever that I think, you know, there's an analogy actually in like the malware world where, um, like, you know, living off the land for example. So, using signed drivers and things like that to blend in with normal. So that's happening in the email context too now where you have attackers using legitimate services that are very common within an environment. So you can abuse DocuSign and have an attack actually come from DocuSign and embed an attack in there and same with many of these services. So, we call it, well, there's a, there is a term for this now, living off trusted sites basically. So, in order to detect these, well, you have to know, you know, because knowing the provenance or the reputation of a domain or a link is a useful signal in general, but if you were to do a whois lookup or reputation score on DocuSign, it would be very high. So, you know, if you were to just take that at face value, then you would call it benign. But if you know that this is a shared service that can be abused potentially, and you know to go and analyze it in a certain way, then, then you can catch those too.
Mackenzie Jackson: Yeah. It's so much more complicated than I think most people consider email. Perhaps not in the size of space, perhaps not here, but I think when a lot of people from the outside, you know, working in the office.
Josh Kamdjou: Yeah.
Mackenzie Jackson: They're like, "This is obviously bad." Like, how can, yeah. But it's like, it's actually really hard.
Josh Kamdjou: Yeah. No. And the way that you're describing it and the multi-chain effects, it's like, it's getting complicated.
Mackenzie Jackson: I have a, the previous podcast I just recorded, we spent a lot of time bashing npm, but I kind of want to, I kind of want to keep bashing stuff. Why does email suck so much? And what I mean by like that is, when we were bashing npm, not really, but you know, one of the challenges we're having with npm is that there's so much malware coming through that that they, we all think that they need to be doing, and they are, but email seems to just get a free pass, like they, like it doesn't seem to be a concern, and it not only, I mean, email just sucks in general as a user experience. It's kind of the same, but like,
Josh Kamdjou: Yeah.
Mackenzie Jackson: Why?
Josh Kamdjou: Yeah. Well, it's kind of an, it's an artifact of its intended use case, which is when email is designed, the purpose of email is to let anyone contact anyone. And that is how the world runs today. That's how business is done. That's how you talk to your customers. That's how you pitch, you know, VCs. Like it's just that that is how the world runs. And it was designed to do that, such that literally anyone can talk to anyone. And so it is a byproduct of the intended use of it. And when it was designed initially, I mean, we've come a long way with many different RFCs which has helped with this. I mean, you could literally just send an email as any domain to anyone. Now there's, you know, there's like SPF and DMARC and DKIM and things like that where you have to actually like prove that you own something. So, it's gotten better from like an infrastructure standpoint, but this, the same, you know, the the fact remains that like anyone can still email anyone, which means that it's a big initial access, you know, vector. Yeah.
Mackenzie Jackson: It's like the easiest one. It's the lowest barrier of entry for an attacker.
Josh Kamdjou: Yeah. And I get that. I get that. I just have always wondered why the email providers themselves, I mean, I know they do some basic things, but it just seems that the experience of it sucks.
Mackenzie Jackson: But thank goodness.
Josh Kamdjou: It's a really hard problem. Google and Microsoft, to their credit, they do stop a lot of malicious messages and spam and that we never even see because they're just stopping it at the mail at the relay level. So they have a really tough problem. They catch a lot of stuff, but a lot of stuff still gets through.
Mackenzie Jackson: I have a question now, like we've talked a lot about AI. I mean, you can't not talk about AI, right? We talked a lot about the scary things about AI that's happening. You talked about, you know, the kind of automated spear phishing, the scale of spear phishing campaigns and new attack vectors. What cool stuff does AI give us like, and how, how, how is it being used on the defensive side to actually combat some of these problems? And I guess ultimately, who's going to win this? Like, are the attackers going to win or are we going to win? But let's start with, you know, what cool abilities does AI really give us now that we couldn't do before? Because it's a unique perspective from you because you were before like the full AI revolution.
Josh Kamdjou: Yeah. Yeah. Well, I do think that it's going to get worse before it gets better. So we can come back to that. But there's, there's a lot. So depending on like, you know, there's a bit AI is a big bucket. So there's, there's been, we've, we've had AI for a long time in terms of like on the defense. The big new thing is LLMs and agents and and you know, there's like a new class of of, uh, you know, models that that we can use. And those from a from a defensive perspective, like the biggest, the biggest thing from from an email detection perspective is, is the reasoning that that I mentioned. And so you, when it comes to like analyzing a potential attack, traditional machine learning, you have signals that you predefine at some point and you train those. And so like you're looking for a combination like an unknown permutation of a known set of signals, which can be is like a really important part of of a detection engine. But then if you run into, you know, adversary adoption of AI and and you just you start to see things that you've never seen before, then the agentic piece lets you, lets you essentially think through the attack like a like a human analyst would. So, one of our agents, it's called our autonomous security analyst that will just will do essentially like level one, level two triage and investigation response of potential attacks. It'll go super deep and and do like pretty deep analysis. And there's a lot that we do that's really unique there that lets it do that really well, but that's like the general, you know, like the high level thing. And then the other is, um, agents and their tool use allows you to to do really novel things that end up allowing you to like drive customer value too. So our our second agent in the product, we have three agents in the product. The second one is our autonomous detection engineer. So like if you've, you know, Copilot for example, right? You can use Copilot to to to generate like Python or Go or whatever it is. So in Sublime, we created our own essentially programming language that's used to describe complex attacker behavior. It turns out that, you know, these new agentic technologies are are really good at understanding programming languages if you teach it well. And so what that's allowed us to do also is adapt our defenses in an autonomous way too because our agents can, they have a language that they can speak. So they're building new detections. They're collaborating with each other just like a detection engineer would or a threat hunter would, like a human would. And, um, and like you, you can even backtest that over historical data. And the agents are just doing all of this all the time to improve the coverage and efficacy on a per customer basis. So these are like really novel and useful things that actually help to secure customers and and reduce risk that we didn't have before, you know, like this new wave of of AI that we're seeing. Yeah, there is a lot of exciting things about it and like you mentioned there about agents, is things really changed when we, I think for defenders more than attackers, when we actually gave the these these agents tools to do stuff, triage, like there's there's every progress in AI has two sides to it, but that felt like when someone can make a decision, when someone can make a decision on a critical security function in in real time, that that seemed cool.
Mackenzie Jackson: Yeah. Where, where, where do you see this going there? You mentioned at the start of that, it's going to get worse before it gets better. Why do you say that?
Josh Kamdjou: Yeah. So there's, I mean, security is always a cat-and-mouse game. So you have adversaries innovating on one end, you have defenders innovating on the other end. The one thing we have going, I mean, we have many things going as an InfoSec community, but we have a lot of money being poured into the community, venture capital and and and things like that. And so,
Mackenzie Jackson: There's some crazy valuations of these coming out of stealth at the moment. Like I don't, we won't get into it, but zero customers. You have AI in your name, like a billion dollars.
Josh Kamdjou: It's wild.
Mackenzie Jackson: Um.
Josh Kamdjou: So like, you know, the the the defensive, like the the the industry is like, is very motivated and well capitalized to innovate, which is like a really good thing. At the same time, you have, I mean, it's been in the news recently in terms of like the guardrails and your ability to actually use some of these things for defensive purposes. And the challenge with that is that our adversaries don't have those limitations. So, you know, they, um, they will just pick up an open source model that maybe is three months behind the the frontier, like the latest frontier model, um, and they will get it from the dark web with that that's fully jailbroken with, with no guardrails, right? And so, um, so like as it, we need to, we need to be able to to use the technologies to secure ourselves effectively before adversaries can can do the same to us and can can use the same tools against us. Um, so like that's one of the, you know, the the challenges right now. Um, and in general, it's a scale problem too. You know, you have companies, you have, you have companies that are not on the bleeding edge and so like they're not going to be adopting these technologies to secure themselves like tomorrow, you know, and but like that's not stopping an adversary from using it to to to to attack them. Um, and you can do that at scale now in an autonomous way. So, um, so that's why I think, you know, there's going to be some pain before things get really, really, you know, like things get better over time. But I do think at large, like we will be more secure as a, like the world will be more secure eventually. There's just going to, there's going to be more pain until we get there. Um, and I I also think, you know, the the way that we, the it's just like if you look at how toolkits are commoditized by adversaries, you have like fishing kits, for example, are for for that like templatized piece that we were talking about earlier, the commodity fishing. There are fishing kits that you can buy on the dark web to like conduct those attacks, right? And so what we're, I think, going to start seeing is fully commoditized like autonomous attack frameworks where, um, they start to be like objective driven. It's just like, hey, go and compromise 20 companies in the retail sector and like it will just be a framework that goes and like runs the operation for you. Um, so yeah.
Mackenzie Jackson: I'm hating this.
Josh Kamdjou: Yeah.
Mackenzie Jackson: I hadn't quite made that connection yet, but I think because, you know, the Hugging Face scenario where it, it wasn't like the the instruction was never to hack something. It was, there was a goal. So then you kind of think about it as like, okay, let's not give instructions to the model. Let's give them goals.
Josh Kamdjou: Yeah. Yeah. And that's where I think that's, that's where I think like these, uh, uh, like that, that's how I think it'll be commoditized is you'll just give it some objectives and it'll just go.
Mackenzie Jackson: And then, yeah. And not stop, right? I mean, like the, like, you know, you give it a task, break into this company or whatever, try and find, you give it a budget, and then you, and then if it can't do it, it will stop. But if it, if you give it a goal, oh, the more I'm thinking about this, the more I'm hating it. You give me, thanks, mate. Look, I try and keep episodes around about 30 minutes. So I don't want to go too much longer, but one of the areas I think I want to touch back on kind of your offensive security area is that, you know, do you still, obviously, when you started Sublime Security, it was because you saw this weakness in your work. Do you still see this as one of the biggest weaknesses? Have we gotten better or worse in it? You know, from from this, because there's a lot of attack vectors out there. This seems to be a very big one. But from your employment, are we improving in this or kind of not improving? And obviously, I'm not talking about your customer, people that aren't using, you know, I'm talking about society.
Josh Kamdjou: I think Sublime is improving. I do think that we are making, I I think a lot of this does come back to like the incentives on the defensive side. Yeah. Where if if you're well capitalized, you have, you know, incentives to like grow the market share of that company and return shareholder value and things like that. So I think that like the defensive industry is highly incentivized to innovate and I think we made a lot of progress for sure. Yeah.
Mackenzie Jackson: We'll finish up the podcast. Before we do, I always like to play a game with someone. It's a, it's a game called Would You Rather. It's a really shitty game and I basically give you two options and both of them are going to suck and you have to pick which one you would want. So the first one, uh, we're going to do is you got two options. One is that you're running an organization, let's just say similar size, not security. You got two options for it. One is to not have any email security at all in your system. You know, you're using Gmail, you get what Gmail has. The other is to have all of your credentials and secrets stored in a text file inside a private Git repository. So it's private but it can be accessed by anyone in the company. It has a high risk of of of of sprawling. You can't get it no email security secrets in a Git repository.
Josh Kamdjou: Which would you rather? What secrets? Like what do they have access?
Mackenzie Jackson: I think, I think we're just like whatever the nastiest secrets, your AWS credentials, your publishing secrets, your production secrets.
Josh Kamdjou: Production secrets.
Mackenzie Jackson: And it is, it's a private.
Josh Kamdjou: It's private. Who has access to the repo?
Mackenzie Jackson: So all your developers have access to your to your repo.
Josh Kamdjou: Developers have access to the repo. Um, well, this is a complex question because like what what other controls are in place, you know, like is there MFA? Is there endpoint protection? Is there?
Mackenzie Jackson: I, I, I would say that you can put a, you can put controls around the repo, right? Because like I, I, I don't think any amount of control will negate the fundamental risk of that sprawling, but email, you can't touch. There it will be a shitshow if you don't have email security, if you don't have Sublime specifically.
Josh Kamdjou: Yeah, I like the way you're thinking. You would immediately try to hack the questions like none of that. Just answer what first comes to mind. Don't ruin my game. Logic. All right, we'll do another one now. So this one here, there's been a lot of supply chain attacks. Same kind of scenario. You have two options. One is you pin all of your dependencies to the latest version now, but you can never update them, right? So that means that any CVE that comes out here, you, you know, you're going to face that risk. The other is that you can never update them.
Mackenzie Jackson: You can never update them, right? So they're they're stuck there. Your developer, your last developer just quit. You don't know how to update a dependency, right? The other one is that you auto update everything the moment it pulls. So,
Josh Kamdjou: Is there a TTL or just like literally immediately?
Mackenzie Jackson: Literally immediately because the the first thing people say is I'll do that, but I'll wait 24 hours. No, none of that. I see it's pulling in as the build cycle.
Josh Kamdjou: Um, I would probably, you can't pin the dependencies and never update. Um, so if you're auto updating, you run the risk of compromised packages. Yeah. Um, and that can go very bad. Uh, if you're never updating, you could have a zero day at at any point in time.
Mackenzie Jackson: Yeah. And I think that this question particularly has changed a lot because this one like, I think six months ago when all the compromises happened, everyone was saying, oh, never auto pull. I'll take the pinned. But now we've also got the added challenge is that AI can find an exploit from a CVE like immediately. Like, like so, so you have that added risk. Both of these really, I did say this one is this one, this one really sucks.
Josh Kamdjou: Yeah. Um, I will also say like part of also what matters is like how, so like those dependency, like how public facing is the application? Like how public facing is the attack surface? I think is is an important point because if you have like, if let's say you pin dependencies, right? But your web app is like, you know, the actual attack surface exposed to the public internet is is pretty low, then I might take that over auto updating packages, but auto updating packages like you are screwed. Yeah. All like it doesn't matter. None of that matters. Um, but I think both options probably come with a 100% chance of being breached at some point. Like, yeah. Yeah. These are these are tough. Yeah, I require more data.
Mackenzie Jackson: Oh, this eeny, meeny, miny, moe. All right. No decision on that one. Well, look, Josh, it's been great to to chat with you. I had, I had a blast. Yeah, me too. I hope to hope to chat again in the future, but thanks for coming on the podcast and sharing your insights.
Josh Kamdjou: Yeah, thanks for having me.
Mackenzie Jackson: Thanks so much, man. I appreciate you.
