Defending Against Machine-Speed Attacks with FICO CISO Ben Nelson

0:01Mike Britton: Hi there, and welcome to Enterprise AI Defenders, a show that highlights how enterprise security leaders are using innovative technologies to stop the most sophisticated cyber attacks. In each episode, Fortune 500 CISOs share how AI has changed the threat landscape, real-world examples of modern attacks, and the role AI will play in the future of cybersecurity. I'm Evan Reiser, the founder and CEO of Abnormal AI. And I'm Mike Britton, the CIO of Abnormal AI. Today on the show, Mike is talking with Ben Nelson, Chief Information Security Officer at FICO. FICO has been a pioneer in predictive analytics for 70 years, and 90 % of top U.S.

0:39Mike Britton: lenders use its score. Its software also makes real-time fraud decisions every time you swipe a card. So for Ben, protecting trust is the whole business. A few things stuck with me from this conversation. First, low-severity vulnerabilities aren't really low anymore. Software companies have long put those bugs at the bottom of the list, but frontier models can now chain them together into real attack paths. Ben's team is using AI to work out how those small issues could combine inside their own environment. Second, they're changing how they handle vulnerability disclosure. Instead of answering the same question from hundreds of customers every time a third-party library vulnerability drops, Ben's team is building a portal where customers can check the fixed status in real time with a red, yellow, or green signal.

1:19Mike Britton: It's a bet that more transparency now beats more email. And finally, Ben's biggest worry has changed. For 20 years, what kept him up at night was people. Now it's the rate of change. Threat actors don't need approval to try a new technology. His job is to keep governance in place while cutting enough red tape so that security doesn't slow the business down. Well, Ben, thank you so much for joining us today. We always like to start by giving our audience just an overview of your career and your current role at FICO.

1:48Ben Nelson: Yeah, I'd be happy to do that. So I've been in the security space for over 25 years now. So I kind of started my career as the lone cybersecurity person, the only person in the IT department who actually cared about security, and turned that into a role at a small startup called RightNow Technologies. We were acquired in 2012 by Oracle, and we were one of the first cloud acquisitions that Oracle had done at that point. And so a lot of us, we were a cloud native company. So a lot of us that were there kind of defaulted into some cloud leadership roles inside of Oracle. And so I spent almost seven years at Oracle running security for the SaaS cloud and the platform as a service cloud.

2:28Ben Nelson: Left there and went to Tableau, which is a data visualization company as their first ever CISO to build a program up from the ground up. We were acquired by Salesforce. So I have a history of being acquired, which is fun in its own challenge. Also, you know, creates opportunities to learn and grow and build teams and things like that. stuck around there for a little bit of time through the transition into Salesforce proper and came over to FICO in April of 21. And I've been here ever since. My current team is responsible for all things cybersecurity at FICO. Also data privacy, physical security, traveler safety, event security, crisis management, BCPDR, quite a lot of stuff in there.

3:09Ben Nelson: We've got a fantastic team and we do all that here at FICO.

3:12Mike Britton: So I'm sure most people are familiar with FICO scores and probably what that means to them on a personal level, but could you maybe give our audience an overview of FICO, kind of the scope of the business, you know, maybe some interesting fact about FICO that the average listener might not necessarily understand or appreciate?

3:31Ben Nelson: You know, we're most well known for our score, but we are at our very core an analytics software company. So we've been around 70 years. This is our 70th year in operation. And we've always been in analytics, pioneer and predictive analytics, which ultimately lended itself well to scoring and predicting a borrower's ability to repay. But FICO software is used widely across the financial services sector for lots of different things, including fraud detection, real-time fraud detection. You swipe your card at a point of sale system and many, many banks are using that to do literal real-time fraud detection.

4:08Ben Nelson: So if you get a notification on your phone that says, hey, we saw a transaction that doesn't quite look right, there's a really good chance that came from a decision that was made by FICO Software in real time. So in financial services primarily, but doing retail fraud prevention, insurance claims, telecom churn reduction, all kinds of really interesting things with the analytic engines.

4:28Mike Britton: I would imagine in this new world of AI, there's probably a lot of opportunities, especially around the predictive analytics where FICO is probably looking at leveraging AI across all sorts of parts of the business. Maybe there's some things you can share on how does an organization like FICO leverage AI today?

4:49Ben Nelson: Well, we do it in two ways. So we obviously have our software business. And so we're building AI and have been for years into our products for our customers to use and our clients to use. But we want to use it ourselves internally as well. So we kind of get both opportunities there. There's a lot going into our products that's new. But again, we've been doing analytics for a long time. And when I say analytics, AI is kind of just the new term we're putting on what used to be called analytics in many ways. So generative and agentic AI, both in our products. Internally, we've spent a lot of time kind of enabling our colleagues and our employees to be able to have tools available to them, but do that in a safe way too.

5:32Ben Nelson: And we may get into some of the details of how that goes down here in a little bit as well. Yeah, AI is not something that's new to us. We're just making sure that we're staying at the front of the wave.

5:44Mike Britton: When it comes to the attackers leveraging AI, from your perspective, what's something unique you've seen or maybe some examples you can talk about where you think attackers are leveraging it more either from the recon side, the attack side. What's fresh on top of your mind around this?

6:00Ben Nelson: Yeah, I mean, so the easy examples are the phishing and impersonation stuff, but that's been going on for a couple of years already too. So that's not like new and fresh and interesting necessarily, though it's still actually a big threat. So I'm sure you get to see some of that as well. What we do see them doing though, is using AI or automation to create attack paths and chain things together a little bit and doing it at a much higher rate of operation than they did previously. And so, you know, that causes us to have to react more quickly. And I hate saying fire with fire because I don't think it's fire necessarily.

6:36Ben Nelson: We all have to love it and adopt it and move with it. But that's really what we're doing on our end as well to try and watch and see what's happening and react to that in real time ourselves too. Do you feel like AI is increasing

6:48Mike Britton: the attack footprint on an organization like FICO or is it, you know, the attack footprint stayed the same? It's just the velocity kind of maybe, maybe walk me through where you see things changing or maybe where some of your, some of your team's focus is probably shifting a little bit.

7:06Ben Nelson: Yeah, there's two different things there. I, you know, security is still security. We're still doing the things that we've always done. We're just doing them at a much higher pace at this point. But one of the things that we're having to pivot a little bit to is, you know, we're a software company and anyone who's been a part of a software company knows that software has vulnerabilities. It's just the nature of the beast. And low severity vulnerabilities have been something that software producers have historically not done a ton about because they just, they were low. Like there's other priorities.

7:34Ben Nelson: We have features out the door, all that kind of stuff. Well, now we're seeing with, you know, super advanced frontier level models that can chain these things together as a low is no longer a low. And so we have to be a lot better at paying attention to what we have out there, what our attack surface looks like, even if it looks like low severity on the surface and use AI ourselves to try and figure out how some of those things might get chained together in our environment with our context to increase our attack surface. So that's what we're having to do. But that's that's what I see changing, really, is we just have to continue to get better at what the things that were always a priority in the first place.

8:10Where do you feel AI has the biggest has the biggest opportunities within your program from a defender side?

8:17Mike Britton: Like, where do you where do you see the biggest bang for the buck on AI use within your team?

8:23Ben Nelson: So multiples on the defender side, specifically, you know, high confidence detections that are high volume are just like absolute low hanging fruit for us. So, you know, anything that we can automatically detect with high confidence and then do something about also with automation is something that we're focused on right now. But other things, too, that are kind of, you know, less appealing sometimes is, you know, I own the GRC group here as well. And so gathering evidence for regulatory compliance certifications has always been something that everyone hates to do. When it comes audit time, us and all of our peers internally who we gather evidence from hate doing that activity.

8:58Ben Nelson: But internally, that's an opportunity to leverage automation and AI as well. Try and go out and gather some of that and validate it and make sure it's high quality before we put a human's eyes on it.

9:08Mike Britton: AI is on top of everybody's mind. It's probably on top of every person in your organization's mind. How do you what's kind of your approach to get them to experiment? And you mentioned it early, you know, safely use AI, but kind of what's been working for you to help your team kind of experiment and explore the art of possible when it comes to using AI within the organization?

9:30Ben Nelson: One thing that we did just recently that was super successful, you know, we've always done hackathons. Two months ago, my trust organization did a hackathon that was specifically focused on novel ways to use AI to improve our daily job lives. And the amount of innovation, and we gave people a 48-hour window where they could just focus on this. They teamed up, had some cross-collaboration amongst teams. And as long as they were solving a real problem that FICO has today, they were free to kind of explore and do whatever they wanted in that. And then they came back and presented all that stuff to a panel of me and my peers.

10:03Ben Nelson: And honestly, the amount of innovation that came out of the freedom that we gave them to do that was fantastic. The GRC thing that I just mentioned was one of the things that came out of that hackathon, actually. GRC team was like, you know, we hate doing this. We got 48 hours to, you know, have AI help us figure out how to automate a bunch of this stuff. And they did. And now we're trying to operationalize that.

10:28Mike Britton: So, you know, I'd love to pick your brain, too. You've been in cyber for a long time. Feels like everything, every vendor is an AI vendor these days. How do you and your team sort out fact from fiction? And how do you sort through all the noise of an RSA or a black hat where everybody's claiming the same thing?

10:48Ben Nelson: For the last, I would say, two years or so, everyone is claiming that they've added AI and really all they added was like an interactive chat interface to the search box that was already there in the first place. We are starting to see a few areas, though, where vendors are adding AI capabilities to do things. And that's more interesting to me, actually. You know, I've got people who know the query language and all of our favorite, you know, detection tools and things like that inside and out. So they don't need help via, you know, a generative AI interface to do that. But where we're starting to see vendors add the agentic abilities to actually go out and do stuff and in real time and handle problems.

11:27Ben Nelson: That's the high confidence, high volume thing that I was talking about earlier. We're starting to see that appear. I wish it was coming faster, frankly, but it's finally happening. And I've been telling our vendors that for the last year and a half. They're like, hey, we got this new AI thing. Take a look and tell me what you think. And I'm like, well, that doesn't really help us do things. It just helps us search better or maybe visualize data. You can help me move faster, actually. That's what I value. Where's an area where maybe you're not using behavior-based detection that you think might actually be more insightful, more helpful in a particular area that you're not necessarily exploring today?

12:05Ben Nelson: I would that's that's a problem space that's tough right now so because we're allowing all of our colleagues to use more AI and create agents and connect to MCP servers to third-party vendors and things like that the the behaviors that we've spent years kind of curating and learning about all have completely changed in the last like nine months so we're having a bit of a relearning moment about what normal looks like in our environment because of the rate of innovation that's going on. So I think that's the first problem that we're trying to solve is, again, using AI to help us analyze the new behaviors that we're seeing so that we can create a map for what we think is now normal versus what it was a couple of years ago.

12:47Ben Nelson: Identities, another great one, like a user creates an agent that does something on their behalf or creates a non-human identity that does something at their behest and maybe on their behalf. Sorting all that is is an interesting problem as well. So identity, I think is the new spot for all of us to pay a lot closer attention to than we have historically.

13:11Mike Britton: How do you measure the value of their AI use? If someone's spending$1 ,000 a month on tokens, what's been something that's been effective for you to kind of either in the performance evaluation or even just in the spend analytics? How do you measure that value?

13:26Ben Nelson: We're trying to measure it in the work that gets offset, which can be hard to measure by itself also. Great example. We've got a couple of, I'm going to call them power users, but they're also heavy spenders in my group when it comes to token utilization. We track all that stuff on a daily basis, actually. And when we see spikes on that, it's literally just a conversation with that person to say, hey, awesome that you're using these tokens. Show me what business value you're getting out of that. And we try and not make it punitive at all. But like, you know, if there's business value being derived here, let's actually showcase that.

13:59Ben Nelson: and let's compare it against what we were spending on doing the thing that you're automating now differently and showcase that to encourage further use further valuable use in other parts of the

14:09Mike Britton: organization i've always felt like the business always moves faster than security can keep up what are some things that have been successful for you to kind of stay on pace as you probably battle shadow ai the same way we battle shadow it how do you stay up to speed with your business on the new things that they're trying to use?

14:28Ben Nelson: Yeah, it was a little rough up front, like a year and a half, two years ago, and it was kind of a no before yes type situation. And we created a governance committee that had to approve all AI usage internally. It was really heavy handed, it was slow. So we quickly spun up some internal engineering teams that built governance systems that allowed approved pathways and repositories of previously approved AI projects as well. and the privacy team is in on that. The legal team is in on that. The security team is in on that. And so we've kind of, at this point, curated a pretty robust library of pre-approved use cases for AI internally.

15:06Ben Nelson: And the idea there is we want to give people a clean, fast pathway to adoption and to let them know what's out there already too, because you don't need two people building the same thing in vacuums, right? That's also wasteful. But folks have really enjoyed, they go browse the repository and see their use case there. And it's really the pre-approved pathway approach is the approach that we're taking.

15:29Mike Britton: What have you done? Like, what have you found that's worked well to create a collaborative partnership with those other stakeholders?

15:36Ben Nelson: Yeah, it's actually really good at FICO. So I am hip to hip with both our CIO and our head of engineering and our head of product. No decision gets made without all of us at the table. And we also, you know, we've really tried hard not to be the traditional team of no. Like we're there helping solve real problems. We're acting like engineers. We hire software engineers into my team so that they have the experience and the chops to have real conversations with the actual software engineers in our organization. So really about building relationships and working side by side. You know, we're not handing requirements over.

16:16Ben Nelson: We're carrying requirements over with us and digging in to help build the systems that meet those requirements with them. And so that's the approach that we're taking. It's kind of the approach I've taken most of my career, actually. I learned pretty early on that the adversarial relationship just doesn't work. It's not healthy for anybody and we actually get less done.

16:37Mike Britton: And then where do you think the world's going? I know a lot of organizations leverage the frontier models for their large language models. Some of the open source models are getting better and better. Do you see a world where the data is too sensitive to trust the frontier models and you want to bring it all in-house? What's kind of your thoughts on where this will all go as the technology only gets better?

17:02Ben Nelson: I think to your point, as the open source and open weight models get better, we'll probably run all of our intellectual property oriented activities in-house using those models. But there's still a tremendous amount of work that needs to get done. That is, it's not part of our intellectual property and there, you know, there's a good opportunity. So we have kind of a two pathway approach even today inside of FICO where we, where we're doing agentic coding and things like that. And, and actually working on real IP for FICO, We're doing that in-house. And then we use, you know, the frontier companies for like generating Word documents and doing analysis and research and things like that.

17:43Ben Nelson: And I see us continuing that path for quite a while, actually.

17:47Mike Britton: You know, I imagine you guys probably see a lot of attackers impersonating you, trying to attack other people pretending to be FICO. And you probably have a lot of attackers just trying to attack you to get at the data you guys have. Which do you feel is the more difficult of the two to defend?

18:02Ben Nelson: I think the impersonation is a lot harder to defend because I can't control it. You know, I feel like we have a good handle on where our data is at, the controls that we're applying to it, the monitoring that we have on it. But impersonation attacks are hard to detect in the first place until often it's too late. Usually it gets reported to you after something bad has happened. You know, we have some DNS providers and other kind of open source Intel providers that help us try and find that stuff quickly. But I think that's definitely the more dangerous of the two, particularly with a super strong brand that's literally built on trust like FICO.

18:36Ben Nelson: You know, impersonation attacks. People assume a level of trust when they see a FICO logo on a web interface. And that's really hard to defend against when impersonation attacks can happen literally within minutes at this point.

18:49Mike Britton: I'm curious, like from an education perspective, you know, I feel a couple of years ago, I could have trained most of my employees to look for things, you know, simple things like misspellings and emails and very, very kind of kludgy and rudimentary attack types. What have you done around your awareness and training to help educate your users in this new world of AI where attackers are more sophisticated and the attacks are happening faster?

19:15Ben Nelson: Yeah, we've, so we've evolved. So phishing tests are a great example. Everyone does phishing tests. To your point, you know, historically they've been misspellings and super obvious stuff. But we're using AI to help us create phishing tests now. And our failure rate's gone up. Surprise, surprise on our internal testing. But that's a good learning opportunity too. And so our phishing tests continue. We've just evolved them. but also on our one-to-many outreach that we do to all of the colleagues inside of FICO internally. We spend a lot of effort creating succinct messaging that helps people understand what a deepfake might look like, how to interact with a deepfake to maybe detect that it is one in the first place.

19:56Ben Nelson: And then, you know, as every company does, we see them happening too. Our top executives are impersonated quite frequently by threat actors who send the classic, you know, what's that message to somebody inside the company. And so giving people an easy pathway to report that too, and not feel ashamed of reporting it or asking hard questions about it is a big deal. And I think that it's not a, there's nothing punitive about reporting what you think looks fishy.

20:24Mike Britton: What keeps you up at night?

20:27Ben Nelson: So my historical answer to that question for 20 years has been people, because I can put all the best technology controls in place. And still to this day, it's somebody clicking a bad link or answering a phone call and handing out a password or something like that. It's the beginning of the attack chain. Right now, what keeps me up at night is the rate of change. We are having to learn new technologies as fast as we can and also apply them as fast as we can. And the classic security leader problem is we've historically had a ton of red tape. Threat actors don't have to go get approval to use a technology and experiment with a technology.

21:10Ben Nelson: And so trying to find ways to help us remove red tape and shrink process internally so that we can have a chance at keeping pace is one of the things that keeps me up at night because I still have to have governance And I still have to understand what's out there, but I can't slow us down. And so that's probably the single biggest thing that's currently keeping me awake is can we innovate fast enough and keep the business moving forward?

21:36Mike Britton: Where do you feel mythos and fable and some of these newer, more sophisticated class models? Where is that going to force folks to kind of change either their software development lifecycle or vulnerability management or even bug disclosure processes? Where do you feel like that's going to force some change there?

21:55Ben Nelson: Yeah, I think it will absolutely force change in the way that we develop code and fix bugs. I mean, agentic coding agents can create buggy code too. But again, fire with fire, you know, put multiple agents in place to try and remedy that stuff. I'm actually hopeful that the step function change that we're going through right now in the next, call it 12 to 18 months, will level back off. And what I've been telling our folks internally is that we're being forced to, in a very short period of time, do all the things that we should have been doing previously. Code hygiene and bug fixing. We're just going to have to automate it all.

22:35Ben Nelson: And I'm hopeful that we'll get to this nirvana state here in the next 12 to 18 months where our jobs get a lot easier. The frontier models are interesting, but to your point earlier, you know, the open source, open way models that are out there now are getting pretty darn good, too. And so I think leveraging those is important. You asked about vulnerability disclosure as well. Customers have been clamoring for SBOMs, software bill of materials, for a couple of years now. And software providers have been reluctant to provide them because of the way that we all, and this is an industry-wide problem, the way we incorporate third-party libraries into what we do to try and speed up our work.

23:16Ben Nelson: I think the days of not providing an SBOM or something like it, and I will get to your vulnerability disclosure question here in a second, but I think it's tied to the SBOM question. I think we're going to have to start disclosing SBOMs without question soon.

23:30Mike Britton: Yeah, I think what scares me is the fact that you get requests for SBOMs, and historically, it's been a check the box. okay they provided an s-bomb with ai it's it's going to unleash a whole lot of other things because now they're actually readable and people can quickly analyze and say well what does this

23:48Ben Nelson: really mean to me so an s-bomb is is one avenue to basically you know open things up and let everyone know what we have we want to do that safely as well but when it comes to vulnerability disclosure too one of the things that we're doing in response to the rapid vulnerability discovery is creating an internal portal where our customers can log in and see in real time. We've got a third-party library that a vulnerability was just disclosed for red, green, yellow. Where's FICO at? And fixing that with the software product that we provide to our customers. And we're literally developing that and hoping to release that internally here in the next month and a half.

24:24Ben Nelson: But the days of our customers sending us individually, hundreds of our customers sending us the same question about a particular vulnerability are over, we need to just start putting that in dashboard where they can self-service that information themselves and be more transparent than we ever have.

24:39Mike Britton: One thing we like to do on our show is we have a lightning round where we just, you know, some rapid fire questions. They're not meant to be, you know, think kind of the tweet version of the answer versus, you know, a long-winded answer. Not that, I mean, I feel like all of your answers have been really awesome, but I've got just a series of questions. We ask the same questions of all of our guests. So just love to get your take on these and I'll just start at the top. What advice would you give to a security leader that's stepping into their very first CISO job? Maybe it's something they might overestimate or underestimate about the role.

25:14Ben Nelson: I think you should not underestimate the power of relationships. We talked earlier about my relationship with our engineering leaders and CIOs. Develop those right out of the gate. That's a must do because when bad things happen, you want to be on the same team.

25:30Mike Britton: All right. So clearly, you know, you're vibe coding, you're staying very educated. Where's your go-to source for knowledge to stay up to date on the latest technology, the latest risks, whatever it may be from a cyber perspective. How are you keeping yourself informed?

25:44Ben Nelson: I still subscribe to a handful of daily kind of newsletters and things like that, but I've also taken to taking those newsletters and feeding them into Gemini at home and saying, okay, tell me more and getting good summarizations that way.

25:59Mike Britton: All right. So on the personal side, we'd love to hear what people are reading. What's a book that you've read that's had a big impact on you and why? And it doesn't necessarily have to be cyber or even work related. And it doesn't even have to be something that's been recent.

26:12Ben Nelson: So I'm looking at it right now. Leadership is a big part of my job at this point. Like I have technologists who are super smart, but a really good one that I've read just recently is called Leaders Eat Last. And it's all about leading by example, putting your employees first.

26:28Mike Britton: If we fast forward this, what do you think is going to be true about the future of AI and security that most of your peers might consider science fiction today?

26:37Ben Nelson: I think we've been talking a lot about quantum computing for years and not actually doing anything about it because we thought it was kind of science fiction. Again, those days are over. And I think AI will only make that happen more quickly. All right.

26:52Mike Britton: So what gives you hope about the next generation of cyber leaders?

26:57Ben Nelson: Man, they are so innovative and so energetic. I'm blown away all the time when I meet the next generation and work on mentoring the next generation. Their enthusiasm for the role is amazing. I'm still enthusiastic about my role as well, but it's inspiring me to see that passion and drive still out there in our young leaders.

27:19Mike Britton: Once again, Ben, thanks for taking your time today. It was awesome to have you on the show and I really appreciate your insights and the wisdom that you shared with us. Yeah, my pleasure. It was a nice chat with you, Mike. That was Ben Nelson, Chief Information Security Officer at FICO. I'm Mike Britton, the CIO of Abnormal AI. And I'm Evan Reiser, the founder and CEO of Abnormal AI. Thanks for listening to Enterprise AI Defenders. Please be sure to subscribe so you never miss an episode. Learn more about how AI is transforming cybersecurity at enterprisesoftware.blog. This show is produced by Abnormal Studios.

27:55Mike Britton: See you next time.