Mackenzie Jackson: Hi everyone. Welcome to another episode of The Secure Disclosure. I'm thrilled to be here with yourself, Frank. Thanks so much for coming in and agreeing to do this.
Frank Vukovits: I'm thrilled as well. I'm definitely excited to chat with you and I know with the topic I want to talk about, I want to walk through a little bit of the RSA craziness and agentic AI agents everywhere on steroids compared to last year. Maybe we're everywhere, yeah.
Mackenzie Jackson: Yeah, well, it's every year it kind of gets more and more fermented. My claim for infamy is that my first year at RSA, I came here, I walked around the booth and I saw all this AI stuff. This is pre-2021 or something. And I wrote this article, "So AI: More A than I." And then it was just basically, this is all absolute crap. And then that article has been widely proven to be the most wrong thing I've ever published in my life, but we can laugh at it now.
Frank Vukovits: Back then, it was like, is this really marketing?
Mackenzie Jackson: It was just marketing spin because when GPT came out, OpenAI released its GPT and all of a sudden it's like, oh, this is what it is. But coming to that, but one of the interesting things and something that you're very knowledgeable about is identity access. And we're getting into the realm of non-human identities, and AI has kind of changed this. So I wanted to start with, why is the access game such a challenge now when it comes to AI?
Frank Vukovits: Yeah, so obviously AI has changed that. It's even the term non-human identity.
Mackenzie Jackson: Yeah.
Frank Vukovits: And the definitions out there, depending on who you're talking to, your Microsoft partner, whoever. Now we're splitting out AI agents as a type of identity, even though our traditional human lumped into machine identity or non-human. Now, non-human, let's say it's cattle out there with the chips.
Mackenzie Jackson: Yeah, yeah.
Frank Vukovits: And machine can be our traditional things like service accounts and other items that are machines, but these AI, those machines have very specific instructions. They do one thing, not autonomous, but agentic AI. That's why we're seeing all this chatter, or it's not more than chatter now, the need to secure these agentic AI agents because they think on their own from an autonomous perspective. They communicate with other AI agents, which makes that a little bit scary.
Mackenzie Jackson: Mhm.
Frank Vukovits: And the third thing is now us humans can control a team of agents that work for us. So, I do a lot of work in the cybersecurity side. I also do a lot of work, my background was business application or ERP software. The Workdays, SAP, the Oracles, the Microsofts all are to point AI agents inside your business applications now as well. So, me or you, let's say we're an AP clerk. I might have a team of agents that can go do work for me. Sounds great. Except what are they doing? What can they do? What data are they touching? So, this, the spiderwebs if you will, or the tentacles of AI agents and what they can do. And here's the other thing, I just left a Microsoft launch and they brought this up, that was a great point. You and I have 9:00 to 5:00 jobs. Maybe we take our work home, that's fine. Guess what these agents, these AI agents
Mackenzie Jackson: Right, yeah.
Frank Vukovits: 24/7, 365, speed of sound, speed of light velocity. They're working all the time. And from a security perspective, then we really got to know what are they doing? What could they do? And then what have they done? And now, so then tie it back to where they even start. So, in the provision of them, which gets into the identity stuff we'll talk about, is extremely critical, more critical than maybe provisioning a regular tradition human identity, because we know what they're going to do, the four walls they're supposed to stay in, and yet agentic AI, are they even staying in those four walls?
Mackenzie Jackson: Yeah. Because, I mean, the concept of the non-human identity, the agents are kind of, and as you're describing them, they're acting like superhumans in a way. So, and something that, about access is, when you have an API, or when you're providing access to something, is provisions to give access, because it's a tool, it's a thing. But with these agentic systems, we treat them, we often think about them more on a human level. So, this access gets very confusing, and what scares me about the agents, when it comes to access, is how do we actually differentiate? Is this a human or is it an AI? Because, you know, walks like a duck, quacks like a duck,
Frank Vukovits: Your back seat driver.
Mackenzie Jackson: Yeah.
Frank Vukovits: And there's always some things where you would label an AI agent and naming conventions and the like, and maybe if they're owned by someone who kicked them off or some stuff to give you there. That's easy stuff. But, looking at the what they actually did, they didn't do, if you will, using old IGA, old TRC term. That's where you then have to tie it back to have context to what were they supposed to be doing. And again, I was just at this Microsoft launch, and I thought this is a really critical point. Intent and content, two totally different things. The content is you provision these agents, what they should be allowed to do. The intent is what they would actually do, and did they change their intent as they figure out they could? Because again, they're working 24/7, 365,
Mackenzie Jackson: Yeah.
Frank Vukovits: Smart. That's why we're really worried about them, and did they change their intent? They were supposed to go help maybe someone, let's say, update posts and profiles in an accounting system, again, going back to my business application side. But then, beyond that, they did something else.
Mackenzie Jackson: Yeah. Still with the same agent
Frank Vukovits: but their intent changed. If you or I were doing that, no, you know what? We would try to get in, we couldn't get in, and we'd just stop. But they're trying to find a second or third way to get in. And that intent and the context around all what they're doing and the intent that they're provision for make them much more riskier, much more tougher to maintain and secure, and that makes us, from a cybersecurity perspective, the identity secure space, all the folks out there like doing it to have solutions to help with that. Now, like you have a great identity security control fight. Why it's so critical that we figure out exactly how to provision them with the joiner move-leavers, and then watch what they're doing, and then very quickly react if we see that their intent has changed.
Mackenzie Jackson: How do you start to control that? So, if an agent, because are you talking about the agents having intent of themselves? I mean, I also think of it as, what if someone else in somehow injects malicious intent?
Frank Vukovits: There's that.
Mackenzie Jackson: That's the other half of this.
Frank Vukovits: Yeah.
Mackenzie Jackson: Is, is
Frank Vukovits: We can think about them as singular focused, one little agent off doing his thing. We've got Easter coming up for a lot of us to celebrate. So, a little bunny rabbit hopping along.
Mackenzie Jackson: Yeah.
Frank Vukovits: And then all of the sudden, another bunny rabbit's out there, and they start communicating together, and all of a sudden the intent of the first one has changed. Maybe they realize that, maybe it's a prompt injection, or what have you, and all of a sudden that intent has changed. That's why again, the interaction of all these agents, and watching what they're doing, and we have to move quickly. I'm an auditor by trade, going back 35 years in IT audit at GT/Verizon, and we always talked about preventative versus detective controls. Preventative are better, obviously, like in the ILM, identity lifecycle management process, joiner move-leavers. Let's treat all identities, human or machine, and let's provision them and know who's supposed to have access to them correctly, do risk analysis before we provision them. But then, what are they doing after they have that access? And that's a detective control. Unfortunately, again, going back to their work 365, 24/7, and the stats that I've been hearing here even in the last 24 hours at RSA, from 5 to 15 minutes when an attack happens until something bad happens. Like they get in and 15 minutes later now, they're doing something bad. Maybe they're taking a major the agent and changing prompts and getting your data, who knows what. So, these detective controls we've relied on that maybe we look at, let's say, all the agents we have out there, we're doing user access reviews on them once a quarter, once a month. Once a day, that's not good enough.
Mackenzie Jackson: Yeah.
Frank Vukovits: We have to have almost real-time proactive review of the data, continuously monitoring. And that word continuous, a lot of vendors out there will say, we have continuous monitoring solutions. Once a month, again, that's a detective control. Once a quarter, maybe once a day.
Mackenzie Jackson: Yeah.
Frank Vukovits: You have to have a loop that's taking the content of all these intents that are changing and looking at immediately and taking action immediately. And because if you don't, that 5 minutes that they get in and the 15 minutes later doing something bad, yeah, you might not identify the next day, but the damage is done. And again, these agents are moving so quickly, I really, I think we're not talking enough about what you just brought up, about what happens when the agent gets off the rails, so to speak. Starts doing things either because another agent and it got into cahoots. That's cahoots being an old fraud term or collusion, but the same concept applies.
Mackenzie Jackson: Absolutely. And it's kind of, it was not kind of like, it is almost an inside threat. Because you have this threat with, you know, with you, I mean an employee has turned malicious or something happens like that, and they have all this access, right? It's the same with an agent is that, and you know, the scary thing is that an agent could be turned malicious or as we've kind of talked about, it also could change its own intents. And maybe it doesn't realize that it's malicious.
Frank Vukovits: No, it doesn't. No, that's the thing. That last part is critical. Absolutely. It thinks it's doing the right thing.
Mackenzie Jackson: Mhm.
Frank Vukovits: It was given instructions to do A and maybe it was a little bit difficult. "I'm going to try for a way where they're scrapping myself different access or going around and figure out who's granting access. I'm going to turn their access off." It's not necessarily malicious like a human would be. I mean it's pretty obvious from a prior perspective when someone wants to do something malicious and we can, you know, find a nice little trail there. But with these agents now, this might sound bad, but its master or whoever owns it, would be proud of what it's doing. And trying to be like, "You know what? Look at all the stuff I can do." And "I like you sent me to do this, but I'm doing these other things too because I think that's what you want." And they're telling, it's probably not what you want. But then there's still a slew of other, I mean, threat actors know, let's get in, let's find these agents that have elevator privileges. I mean access that has changed to take advantage of those because what do you call the keys to the castle or you want to call it? Elevator privileges can do the most damage, cover your tracks, lateral movement, all that obviously still applies. But it would apply in the normal human side of it as well. So a lot of things when you do control wise, security wise. The concepts we've been applying, least privilege access, so we can we can shorten up our, limit the blast radius. Same thing holds true for these agents. Let's not, I mean, how is it documented what do they have access to? Is there onboarding of agents from our identity solution to, or do we look at what they're supposed to do, the type of access they're supposed to have? Do we question that like we would a regular human or do we just say, "Oh, the vendor says it needs to you need to have this up and run with it." It's scary because we're not asking those questions.
Mackenzie Jackson: No, and I think like when you think about agents too, often we think about this it's one thing they can do lots of, so the temptation is to over-privilege it. Yes, because the temptation is I want this one, I want to manage one agent, but I want it to do all of this stuff. So, have everything. Have access to everything, right? And then it deletes prod or whatever.
Frank Vukovits: There's examples that are happening. Yeah, exactly in prod doing that backups, whatever. Maybe it thought it was doing the thing. The other thing that's real, real scary with this is this has happened years ago. Vendors would say, "I need, we're using this API needs to run wide open with admin access." Or now you need to all these service accounts, I mean I was working doing audit work on mainframes. And we the concept of service account was around back then. And these have a certain level of access. No one questioned the vendor. Same thing with these agents. But again, once they start doing multiple things, people are afraid then to rope them back in and change the access. Because the damage it will do and no one wants to be responsible, just like service accounts and other things on the human side with elevated privileges, if we try to ramp back what they have access to, what if we break something? No one wants to be that person that said, "You know what? Change that access." And guess what happened? All of a sudden at the quarter end we're running our financials and we can't. All of a sudden at the end of the day we're shipping orders and we can't. All of a sudden whatever it might be or people are afraid. But the flip side of it, if you want to run wide open, that's just a big old target on the back of your company and your business processes that you can't do that. You wouldn't do that with humans. But we're afraid especially because we don't know AI. We're afraid what it's going to be if we if we don't let them run with the access they came with out of the box.
Mackenzie Jackson: Let's go into this fear topic here, because it's very interesting the way that you're talking about it. We're talking about the risk of the agent, but you're talking about it as if it's a foregone decision that we're going to have them, which I think it is. But we do, we are still having probably a little bit less, but like the conversation of, should we have agents? You know, what should we give them to? Why should they exist? But it sounds like I'm maybe reading in between it, but you know, sometimes when I talk about AI, I kind of think, "Well, it doesn't really matter what I think or what anyone thinks because the cat's out the bag. Like we're not getting it back in now."
Frank Vukovits: No. The toothpaste is out of the tube. No doubt. But the application and use to them, I'm fortunate enough to speak a lot of conferences, again, cybersecurity conferences, business application software conferences. On the latter, I do a lot of sessions on securing AI agents in XYZ business application. I ask people, "Raise your hand if your team is using any AI agents in your business software?" Very few hands are up. But, they're already available in the software.
Mackenzie Jackson: Yeah.
Frank Vukovits: Someone can turn them on. And here from a visibility perspective, the people that didn't raise their hands may not know that it was agents that were even installed. And maybe their security team doesn't even know they're actually turned on. And this gets into the whole, we had shadow IT coming around COVID, and now we have shadow AI. And inventorying everything out there, all identities, especially AI agents. So, I know at Delinea we love to talk about discovery as foundational. And the risk auditor in me would say, "You know what? Absolutely, because we can't take a risk-based approach until we know our risks are, and we have to inventory all our identities, and we go through and see what they have access to." And then tie that to exactly where the business is at business process-wise. And again, we need to take care of these items first because they're riskier. So, we got to start with that inventory, which includes those AI agents to begin with. But then it's what are all they doing? Are they inside the company like our employees are using them? Your copilots of the world, our Claudes of the world. Just day-to-day tasks. That's one use. We're building some of them in our product we ship. I mean, that's great. I mean, that more, that's more generative AI, but a lot of companies now have like, I have tools that are agentic agents you can turn on. But then the third thing that no one's really thinking about is, "Okay, from day to day, especially on the DevOps side, what are my developers doing from an agentic AI perspective?" We're reading all about vibe coding lately. I get it.
Mackenzie Jackson: Yeah, yeah, yeah.
Frank Vukovits: So, what we're seeing a lot at Delinea, we just announced last week we closed on the StrongDM deal, which is great news I think from a Delinea as a company more broadly just from an identity security saying, "You know what? There's a segment of AI agents maybe that aren't getting as much coverage as they should." And that's in the DevOps world. And talking about over-privileged and sometimes developers have their own vault they may be using. They don't use their standard PAM vault the rest of the company use. Sometimes they're using other, they need to get directly in the database. Other ways they do it. You don't want to disrupt their business what they're doing, but at the same time you have to secure enough gets in discussions about just-in-time zero standard privilege formal access and all that which I would argue again that all ties to least privilege too that those concepts that we're talking about that have developers, let's not forget about our humans that have access to sensitive data systems and let's not forget about these other agents outside of the development side that have similar type of access because ultimately from a control point perspective you have to inventory all the risk all the identities all the risk and make business decisions where to invest with people process and technology. Going back to like what you were talking about at the start of that conversation, it kind of awoken something in me because you were talking about the fact that a lot of these products have agents in them and so in a lot of ways you've kind of, you've got all the risks of having an agent.
Frank Vukovits: Yes, you do, regardless of whether you or not you're taking advantage of the, of the
Mackenzie Jackson: Yeah, so they're already there. So, and again, we used to laugh a lot on the business application side. Jane in payroll that wasn't very computer literate, she would look at a screen and click on something and just click okay. And what she didn't realize she just sent off a PO to go order 10,000 widgets to build something they only need to, they only need a 10 because she didn't realize that she was tabbing through and hitting zeros. Just it was in the, in the finance world GRC world, we would call that occupational fraud in some cases, just a mistake that happens.
Frank Vukovits: Right, yeah, yeah.
Mackenzie Jackson: How many mistakes are happening because these agents are there and someone's kicking them off, don't even realize it or maybe you don't even set it up correctly. You think they're all turned off and the switches you're using and maybe they're not because guess what, if the agent's turned on, and I'm going to try to call him he or she, but this, this agent is going to start doing stuff. It's not like the human is going to sit there and do nothing because it's not part of their job, the agent thinks it has to do something. It has, it has someone to make them feel like they're doing the right thing, so that's it's there and that's the hidden thing, there's shadowy eye in my mind two parts, you don't know where it exists and you don't know where it's even been turned on in some cases. And those, those sound like the same thing, they're not. If we would inventory all the places AI exists that are in a product tool or what have you. And then let's also inventory how it's being used, is it turned on or not? Because
Frank Vukovits: Yeah, yeah.
Mackenzie Jackson: sometimes you don't turn these things on, but a lot of times they install by default.
Frank Vukovits: And I think that that's such a fascinating attack path for someone is when an attacker can go in and do it. And we actually have seen examples of attackers using agents because there was an NPM package that was compromised, and this NPM package was for helping manage large repositories, Git repositories.
Mackenzie Jackson: But it had an AI agent in that package. The malware that the attackers put in told the agent to scan for secrets.
Frank Vukovits: You know, it wasn't actually that good. They switched to something else, but you know, you can see this is an example of the agent being turned, it's already happened. We have an example of that.
Mackenzie Jackson: Well, the agent might not think that's a bad thing.
Frank Vukovits: No. No, yeah, yeah.
Mackenzie Jackson: You or I
Frank Vukovits: Well, there's probably, there's probably legitimate reasons why you would ask someone to find all the secrets in a, you know,
Mackenzie Jackson: Yeah, no, it's fascinating. I mean, I joke a lot. I troll analogies to War, the WarGames movie, 2001: A Space Odyssey, and how supercomputers, I mean, it's all of this coming together at the speed of sound.
Frank Vukovits: Yeah.
Mackenzie Jackson: And yet the other thing I always tell folks, and actually sat through a session right here at RSA, I talked about it. I love to say you eat an elephant one bite at a time.
Frank Vukovits: Yeah.
Mackenzie Jackson: You can't do it all at once.
Frank Vukovits: Yeah.
Mackenzie Jackson: Risk-based approach. And that's the irony taking sitting there and saying that. But also people and process and technology. And we can have all the tools we want.
Frank Vukovits: Mhm.
Mackenzie Jackson: But if we don't understand where the risks are in our business processes, deploying any technology to try to govern and control AI agents is not going to be successful. And if people don't understand how to use the tools, in this case AI agents, they don't understand how to govern them and build in the business processes, no way are you going to be on a path for for strong security, whether cybersecurity, business application security, whatever framework you're worried about, people, process, and technology have to work together. And I still think, I don't know what your other guests have said about this, I still think this whole security and AI thing, in a lot of cases, is viewed as an IT project.
Frank Vukovits: Right.
Mackenzie Jackson: And IT should be responsible for figuring out where to secure it. You might have AI governance in place, that's great, and I probably started with legal. And then, and you have different maybe departments that are part of that and IT's probably part of it. But if if you think it's just an IT thing to figure out, just like we thought Y2K, dating myself a bit, was an IT thing to figure out. Just like we thought bring your own device to work was an IT thing to figure out. Just thought way back when this whole crazy thing called client server came about, what are we going to do?
Frank Vukovits: Yeah, yeah, yeah.
Mackenzie Jackson: You're wrong, but the good news is there's a lot of things we've done in the past with these new, I'll call AI in general a new shiny ball, probably the quickest moving technology we've seen in my lifetime, but still those other ones, BYOD, heck even GDPR, we had to pivot
Frank Vukovits: Yeah.
Mackenzie Jackson: change things. And we did things that ultimately allowed us to figure out how to manage it. We will with AI as well, it's just moving super fast. I mean data governance applies just as much now as it did for Y2K, as it did for client server. Now you talk about these agents, what do they have access to? Well, if you're not labeling your data to begin with, it's pretty tough then to control what they can and cannot do. If the agents are built and said, you can only have access to these three things and they're labeled correctly, I mean if they can very high level, that's a step in the right direction. So, we can rely on a lot of things we've done in the past successfully, in fact I just dropped a blog around AI governance. I know there's a ton of AI governance out there and picked four or five examples, things we've done in the past successfully to deal with new technology and don't try to start from scratch on how to address some of these things. Because ultimately it's a new technology, it's moving fast, it's getting all the coverage in the media and rightfully so. But there's stuff we've done already successfully, successfully in our companies, approaches, methodologies that maybe we can then use those to try to get a handle on securing AI and managing how it's used internally, externally and in our own product that we're selling to customers.
Frank Vukovits: Let me kind of go dive in a little bit to the kind of maybe going a little bit back to access, too, is do we need to completely rethink the way that we deal with access? Because you know, you, because isn't it you're saying like, "Okay, let's not like throw out, let's not throw out everything and start again." But the AI agent is different from securing access to a human, it's different to securing access to like a non-human identity, but I'm just kind of like, does non-human identity work now? Do we need a whole new thing? Like where, where do we go?
Mackenzie Jackson: I don't know when this is dropping, but you know I'm doing a session here at RSA talking about the exact topic. Do we treat AI agents with the path, the way we normally treat human identities or the path through which we, we treated machine identities?
Frank Vukovits: Yeah.
Mackenzie Jackson: We're doing a little debate format. At the end of the day, we need to pick and choose both parts of both. But we're not starting from scratch. I would tell you that traditional identity life cycle management a lot of times is more human focused. It can focus on machines, too, but more the person and the onboarding tied to the HR system. You're joining a company and you need to, and this is your job role, so you need access to these three systems and you find different things. That whole identity life cycle management join, move, leave. Now, we need to be doing that for agents because we need onboard them and we need to handle what they're supposed to have access to and set up accordingly.
Frank Vukovits: Yeah.
Mackenzie Jackson: And then on the machine side, there's a lot of stuff with cryptography and other things that maybe we've had to think about that we haven't to with humans where we treat them a little bit differently, but I think there's still some stuff there. You know, it's still a type of identity. I would argue put them in different categories, but the steps you follow to provision them, to secure them, and ask the probing questions what do they need access to for their job? Or in this case, what the agent's supposed to do? Those all can be built into your identity life cycle and your identity security, more broadly speaking, control plane. You're going to have already tools in place to review what the users, the humans have been doing. User access reviews. What do they have access to? You should have been doing that for machines as well. Maybe you were. You got to do that for AI agents now, too. And so now we look at a list of, okay, here's the, let's say you have 20 employees and you have in some of the states we have a billion labs lately and this is probably outdated by now. There was 46 non-human or machine identities for every one human. So, let's say you have 20 employees and let's 20 times 46. You have that many couple thousand agents or machine identities. You need to monitor all of them as well. So, I think to answer your question, it's a little bit of both. The strength is we're now managing human identities, strengths of machines. However, here's where it gets scary. And Microsoft was has been talking the last 2 days about a IDC study they did with IDC. By 2027, maybe 2028, there'll be 1.3 billion agents out there. Billion with a B. So, obviously, to the point about what do we do, there's no way to do that by hand. So, we're the best which scary, AI is with AI. So, we have to have the right tools in place. And those tools have to be using AI to figure out what all these agents are doing. And looking for the proverbial needle, needle in the haystack. That whole intent versus context. And, and I think the only way to accomplish that is with AI. Which gets really scary because you're probably running AI agents to look at what AI agents are doing to ultimately provide stronger security and improve your security posture.
Frank Vukovits: Yeah. Yeah, it's you kind of think of like the meme where they're everyone pointing to each other, you know? But that is, is where we're at. And it's also kind of
Mackenzie Jackson: you're looking at the, I know it's a slightly different topic, but it's still similar to the vibe coding thing, where we're generating code at a speed that broke our old app sec workflows. Because now we're getting too much longer, too much stuff to look at and all of that. So, the only way to solve that is to inject AI into the triage process, right? Which is, which is effective. I think that's kind of what a lot of companies are figuring out in the AI world. But then, let let me ask you this question then. Not from a productivity point of view or whether or not it's even good or bad, just from security. Do agents make us in the, I would say now they make us less secure. But if we look forward just a little bit into the future once we understand this a little bit more, do agents make us more or less secure? Does it increase the attack vector or bring it down? An easy, an easy question.
Frank Vukovits: Yeah, does it increase your attack vector or the threat landscape? Obviously, yes. The math is simple. Yeah. But to address that math, the only way to do it is with AI. So it is inherently eventually going to make us more secure because the tools we need to manage that threat landscape can only be powered by AI. A trillion needles in a haystack. I mean 1.3 billion agents.
Mackenzie Jackson: Yeah.
Frank Vukovits: And you and I both know that stats probably going to be outdated in the next 6 months. Whatever calculation IDC did because all these tools and technologies are included in it. And generative AI is is everywhere. So I think to answer your question, yes. Maybe not right now, but ultimately we're going to figure out and companies like Delinea and others are going to figure out how to use AI in their tools to ultimately rope in some of the shadow AI and rope in the use of AI by by employees and ultimately get in front of and again it starts with and discovering all of your identities right to begin with. And most companies don't have an idea what AI is, how AI is being used in their company much less the identities on the genetic AI perspective. I think that's without discovery, you can't make business decisions again the autonomy or space approach. Most companies in this
Mackenzie Jackson: This came up in a session earlier today, too.
Frank Vukovits: And I used to joke all the time and again I'm been in this a long time. Yeah, people may not know there used to be magazines in the back of airplane seats. Like very glossy magazines and I used to joke all the time, "Oh, your executive came up with a new idea from reading the airline magazine." Like way back when it was BI this crazy thing called business intelligence. He or she read it, came back to office, had a meeting go, "We're going to do BI." That's what's happening with AI. Wasn't in airline magazines, but it's everywhere and executives are going to unfortunately probably just their IT team and saying, "We're going to do AI."
Mackenzie Jackson: Yeah.
Frank Vukovits: No clue what that means.
Mackenzie Jackson: Yeah.
Frank Vukovits: And then and then people are jumping. Oh, let's go do it without thinking about how to govern it and secure it. So we'll get there with that part because that part is fundamental to the process.
Mackenzie Jackson: Yeah.
Frank Vukovits: We'll get with the technologies with AI helping us look at all the threat landscapes. That's the technology. And then ultimately people you understand how to use the tools and the technology together like from a SOC perspective, you're going to have to use AI to keep track of all the stuff that's going on. So, it's a long answer to your question. I don't think we're there, but I do I do truly believe we will get there because of AI, but the threat landscape is going to get greater, but guess what? AI can keep up with that because it's working 24/7
Mackenzie Jackson: Yeah.
Frank Vukovits: 365. The threat actors are using it. We as security professionals need to use it as a weapon to our advantage.
Mackenzie Jackson: Yeah. Yeah. Yeah. Absolutely. Well, I think that's a great place to kind of leave the conversation because I think it's, it's positive. And I've actually enjoyed this because a lot of the conversations I have around AI agents are inherently negative. And I've actually enjoyed the fact that you're very pragmatic about the risk that it has, but the way that you talk about it is like, "No, we need, we need this." And it's actually quite refreshing. Yeah.
Frank Vukovits: Now, if you scare people like coming up with off-the-wall, then people are going to go like this. They're going to be afraid to make decisions. They're going to stay in their little four walls and only do what they're supposed to and not think holistically.
Mackenzie Jackson: Yeah. Yeah. Yeah.
Frank Vukovits: And again, people got scared when they heard about Y2K originally. People got scared about GDPR and I get it and that's I know it's a little bit different, but still companies had to react to that. Bring your own, I mean bring in your cell phone to work and connect to the company network. I remember sessions I hear years and years ago. People are scared to death of that. Let's be positive. It's a new technology, but we can handle it. Just need to pivot a little bit. Let's build on our strengths we had before.
Mackenzie Jackson: Yeah. Excellent. Well, I'm actually feeling, I'm feeling really good. This has energized me, but thanks so much, Frank. I appreciate you spending the time with me.
Frank Vukovits: I appreciate the invite. Love chatting like this and thanks for everything you do with putting this out there for the community as well. You got a lot of good, a lot of good guests on there.
Mackenzie Jackson: Over the years and it's well done. Yeah. Yeah. Well, we're definitely improving and and having great conversations like this really grows the audience. So,
Frank Vukovits: Yeah. Awesome. Awesome. Great.
