Defending the Grid in the Machine-on-Machine Era with PG&E CISO Yusuf Ezzy

0:01Hi there, and welcome to Enterprise AI Defenders, a show that highlights how enterprise security leaders are using innovative technologies to stop the most sophisticated cyber attacks. In each episode, Fortune 500 CISOs share how AI has changed the threat landscape, real-world examples of modern attacks, and the role AI will play in the future of cybersecurity. I'm Evan Reiser, the founder and CEO of Abnormal AI. And I'm Mike Britton, the CIO of Abnormal AI. Today on the show, we're bringing you a conversation with Yusuf Izzy, Vice President and Chief Information Security Officer at Pacific Gas and Electric.

0:36PG &E is the largest electric and natural gas provider in California, serving about 16 million customers. When the company you defend powers hospitals, homes, and factories, the stakes of a security program reach well beyond the business itself. A few things stuck with me from this conversation. First, Yusuf's team tracks what they call waste elimination. Work that used to take 10 hours now takes two, and people who could handle five tasks a day are now handling 50. They haven't shed a single person, just moved everyone up to higher level output. Second, when PG &E first tried to govern AI, the cyber team blocked every AI website they could.

1:11Yousef said it was a losing proposition. Governance has to move at the pace of the business. The moment it's slower, people route right around you and the whole model collapses. And finally, Yousef says it's no longer humans against machines. You will lose that fight every time. It has to be machine on machine. With new frontier models shipping constantly, the time to make that shift is now.

1:31Yusuf, thank you so much for joining us today. Do you mind sharing the audience a little bit about the role you have today and how you got here in your career? Yeah, so my name is Yusuf Izzy. I'm the Chief Information Security Officer at Pacific Gas and Electric PG &E here in California. We are the largest electric and natural gas provider in the state, about 16 million customers. I have been employed at PG &E for the last 23 years, and I didn't start in the security organization. I actually started on the IT side. I was a database administrator, so I've done a lot of work on the infrastructure side, a lot of work on application side.

2:08And it was probably around 10, 15, well, about 15 years ago that I first came into contact with our cyber team because I was working on a project specifically around online banking and bill presentment and payment and things like that. I was just super intrigued. And it felt like there was such a purpose behind what the cyber team was doing. And being a critical infrastructure company, I actually went to join our corporate security team first. And so why I went there was that entire team was all about kind of guns, guards, and gates at the time. They didn't really have like a technology angle.

2:47They had like access control systems and things like that. But there seemed to be such a big opportunity to be able to apply technology to all the things that they were doing and really kind of make it a much more effective and efficient organization. So I did that for a couple of years and then a role opened up on the cyber team. And so I took that and I've slowly worked my way up after that to be the chief information security officer here. What's really at stake when it comes to cyber, right? It's not just blockheads and phishing emails, right? There's many customers and their customers and their customers and a whole ecosystem that depends on you guys.

3:20Can you maybe share kind of, yeah, like what's really at stake when it comes to cybersecurity at PG &E? I appreciate that question. And, you know, I think that's really what motivates me to do cyber at PG &E specifically. You think about what PG &E does and, you know, we're in the business of providing electricity and natural gas and what that electricity and natural gas does for the customers that we are privileged to serve. All the way from charging their phone to keeping their refrigerators running to be able to heat their homes. It's the things that people don't think about and they just expect those things to work, to be able to carry on and live their lives.

3:57Those are the types of things that we are privileged to be able to enable. You think about hospitals, you think about critical care facilities, all of those types of things, the factories that we are powering. When those things go dark, just imagine what that could look like. And so for us, it's not just about protecting what we do as a business, but it's about what we're enabling our customers to be able to do. I think just there's something inherent that I love about being able to protect, being able to protect people, being able to protect what I consider basic rights and things that we are able to do as a society.

4:38That for me really resonates and is why I'm really kind of in the critical infrastructure business.

4:44Mike Britton: How do you look at taking work off of the socks plate? How do you look at automation? How do you look at leveraging AI? What are some ways that you guys have maybe approached things there to help kind of take some of the load off of your SOC analysts? I think where we need to go is really looking at the way that we're doing work today and looking at not just the way that we're doing it, but looking at trying to get to similar outcomes or better outcomes and challenging the way that we're looking at processes today. If I could kind of go back and say, like, we're looking at processes as they exist today and trying to optimize them as they are.

5:20I think what we need to be doing next is not trying to just optimize things the way that we're doing them today, but really looking at the outcomes that we're trying to cause and redesigning or reimagining processes from the ground up. Like everyone else, we're really looking at genetic sock types of things. There's another that that is process. That's people. That's technology. Everyone these days are trying to sell us agentic sock solutions. And I'm not saying that they're all bad, but there's definitely some things that we are looking at there. How do you drive the kind of culture of innovation and transformation, reimagination in an environment that is known for being really put a high priority on safety and making sure things are really kind of working correctly?

6:04You guys have been able to do both, right? What do you attribute that to? It's a hard balance to strike, but I think part of the reason we're successful with that is because we are tight with resources, right? We don't have endless budgets. We don't have endless headcount. As you mentioned, we're heavily regulated and customer affordability is always top of mind for us. And that's something that we've been working on as a company for years, and we're going to continue working on it. So we don't have the ability to just say, well, we're just going to throw more money at that problem, or we're going to throw more headcount at that problem.

6:36And so naturally, I think we have to figure out how to get innovative. And we're doing things like, you know, we're encouraging that. We're doing a lot of internal hackathons. We're building our own sandboxes for people to go innovate. We're getting people trained up on different things. We're actually kind of kicking off a very different set of skills and learning and development. And I think that excites people. And so not only are we training them up, but then we're also giving them the space and the opportunity to be able to go and do some of that innovation. So we're making it part of their standard work.

7:13So taking some regular work off their plate and saying, a portion of what we're allowing you to do and focus on is doing some innovation. Go at it. Let's talk about it. And let's make sure that you're doing the best work that you can be. How do you see the rise of AI changing, like how you organize the team or maybe even what skills are more valuable or less valuable in the AI era? You know, the way that we've been talking about it is the future that we're trying to create and we're asking our folks to go is start thinking more about how you can orchestrate work in the future as opposed to just doing more of it yourself.

7:50You know, like I said, we've equipped people with automation capabilities and tools, and we're asking them to be able to just take a lot of the work that they're doing and see if they can start automating those things. And we track that. We track what we refer to as waste elimination. Like something used to take me 10 hours before I figured out how to get this done in two. Or there was kind of a natural ceiling that someone would hit. They're only able to do five of these things in a day. And now we're able to figure out how they can do 50 of those things in a day. And so we celebrate that a lot, right?

8:23And so we call that out. We celebrate it. We've not shed people as a result of that. But I think what we've done is seen gains in productivity, which is exactly what we want to be looking at. And we're measuring higher level output that we're looking for as opposed to just kind of the rinse and repeat work that we've been able to shed.

8:43Mike Britton: Kind of a two-part question. How do you make those judgments and where do you let AI make decisions and take action, balancing that risk with reward? And then I guess on the second side of that, how do you get your regulators comfortable? I don't think we're at a point where we're allowing AI to make decisions for us, or at least not decisions of material risk. And that's something that we're being pretty careful and cautious about. You know, we're definitely trying to leverage AI to get us to a point where we make a decision as opposed to making the decision for us. But I see that in the future, we'll need to figure out how to get out of, you know, even in human in the loop to human on the loop of a setup.

9:24We're not there yet. And the way we're making those decisions right now is like we're choosing what I would call like low risk workloads, where it's more just kind of busy work, analyzing things, consuming large amounts of data to be able to come up with something that says, here's what I think we should do. So getting to that point, we're not allowing decisions to be made. You know, when we think about that more broadly, just even outside of cyber, I think it's kind of the same model that we're following when we think about larger AI use cases for PG &E and just the utility sector in general.

9:56There's a lot of scope, but we're not at the point where we're out of the decision making business, where humans are out of the decision making business just yet.

10:05Mike Britton: And then I guess the other kind of a follow-up to that is I'm assuming the rest of your business is like every other business where all across your business, they're wanting to harness and leverage AI to solve their problems, to do more with less and all those things. What are some interesting ways that you guys have stayed up with them to help manage and balance that cyber risk equation as obviously you want them to run as fast as they can, but not put the organization in any sort of great peril? So maybe some tips and tricks for the audience that you've found successful or maybe some even some challenges that you've had.

10:39I think the key actually ends up being how do you govern the deployment of AI in the organization? I'm not saying that we've got this dialed in perfectly, but I think we're learning and we're adjusting. When we first started with AI governance, one of the first things we did as a cyber team was try to go block every single AI anything website that we could. And that was obviously a losing proposition. It was just not something we could keep up with. Our idea was, can we at least figure out how we're going to govern this stuff before people just start going wild with it? And you're right. Like everyone across our company has targets of around efficiency, around waste elimination, and everyone's silver bullet is using AI.

11:24So there's a ton of demand. What you have to be able to do, and this is kind of where we're learning this, is that the governance model needs to be able to keep up with the pace of the business. Because if it goes any slower than that, people are just going to go right around you and your governance model just completely falls apart. And so we're making the distinction between what we would call kind of your Manhattan Project size AI use cases, like the really big meaty ones that are supposed to yield fairly significant savings. and we're pushing those through our AI governance process. What we're not trying to push through is if we've already approved, for example, that employees are allowed to use Microsoft Copilot, if they're going to come up with some fairly innocuous use case around Copilot, we're not going to send that through governance and have us looking at it.

12:16It's going to get a little bit of a pass because it's using a technology that we're fairly comfortable with. Now, we're going to put our own guardrails around how we've deployed Copilot and things like that. But the point is that there are things that it makes sense to have kind of a one-to-one governance process for. And then there's others where it makes sense to have kind of a one-to-many approach. And we're still trying to figure out what that right balance is. But the business is the key. Like if you don't operate at the pace of the business, it's not going to work. So getting continual feedback on that and making sure that you're adjusting as opposed to just being like, well, I'm the cyber team and you have to listen to me and we will dictate the pace.

13:00That just doesn't work. What do you see as like maybe the underestimated or overestimated risks? Read the media. Everything's about like hackers using frontier models to create vulnerabilities. Right. But there could be other things. Right. It could be attacks getting hard to identify. Right. Maybe the outside of malware. It could be shadow AI. It could be like good people using good models to kind of go haywire and do the wrong stuff. And no one can notice it because it's a bunch of yellow flags versus, you know, a red flag. I think there's a lot of attention here already, but I am really concerned about just non-human identity management, especially, you know, when we talk about the use of AI.

13:38Depending on where companies are at, if they've started allowing people spinning up agents and if you don't have good control over that, I'm concerned about that. Like, you know, where's the attribution? Where's the auditability of that? That's something that is big for us and, you know, is kind of top of mind for me. I think the part that, you know, we all are of the opinion that AI-based attacks are a real thing. We're seeing a lot of it. And so we're preparing ourselves to the best extent that we can. What's the implication for defenders? What do you think kind of like as a global cybersecurity team, right, in the entire industry, like what do we need to be doing more of or differently or better to kind of combat these new threats?

14:19It's no longer about humans against machines. It's got to be machine on machine. If you haven't built that into your strategy and you're not moving that direction, that's going to be a problem. So we are trying to figure out how to do that. And especially with the new AI Frontier models being released, I think it's just kind of sped up a transformation that we knew we had to make anyway. And so I think rather than us thinking that we've got a couple of years to figure that out, that timeframe is just so collapsed and it's now. It's like, we got to figure that out now. And so that's changed a lot of things for us.

14:53How do you think we need to shift or what parts of human-led defense need to shift more to AI-native threat defense? Or maybe what are some areas you think are going to be important for us to upgrade and re-examine how we approach these new types of attacks? A lot of cyber programs have been very list specific, right? It's like run down this list of vulnerabilities, run down this list of passwords that need to be rotated or service accounts that need to be deleted or whatever. It's very like list based. And I think what we're seeing is like there's just you can't run down lists anymore and especially not just humans running down lists because the velocity is just so much different.

15:29The volume is so much different. And so that's where we're moving into this era of like, you've got to be prepared for runtime protection, runtime detection, runtime protection. If you're not moving in that direction, and if you keep thinking that as long as I run these lists down to zero, I'm going to be okay, that's not going to happen. I had once heard that defenders often think of defense from the point of view of it's kind of top to bottom, right? It's kind of, I'm going to work my way down this list. and those on the other side, the attackers are really thinking about flow, right? And so those two things don't always match up.

16:08And so if you aren't moving your defensive operations to be actually thinking about flow, you're never gonna catch things where they should. But that also then kind of begs the question, like what is it that you need to transform? Are you transforming your ability to detect things that you never could detect before? And the answer to that should be a yes. But then it's also critically important, like once you've detected it, what are you able to do? Like how fast can you actually react and fix something? If you're still thinking of, you know, cutting tickets and sending things to humans and all of that, that's kind of a losing battle.

16:42So you have to get into this mode of find and fix within like right next to each other. There's no more find, send and then fix.

16:51Mike Britton: What has AI done to disrupt how you do SDLC at PG &E or maybe even how you look at your suppliers from a risk perspective? Yeah, from a AI DLC point of view, absolutely. You know that we've replaced the S with the AI and we're trying to really get good about like DevSecOps. We've been on that journey for years. I think there's just so many other things that we need plugged into our pipelines now that we didn't have before. But then that also begs the question, like when you're looking at like an AI enabled IDE, what are the controls you're putting in place there? Like what is you're trying to balance the developer experience with the security that they that needs to be a part of their mindset and a part of their practice.

17:36And it's a very fine balance. Right. Like how do you how do you actually set that up? So what we've been focused on is like, okay, well, if we're doing AI DLC, what are the things that we need to be looking at in terms of the outcomes that make sure that we're still doing high quality software development? Like looking at things like defect density and speed of deployment and things like that. But now looking for all different kinds of defects as well, which is very different than what we had been before. That part, I still feel like is something that is in our control. the supply chain piece is scarier.

18:13So there's a whole set of things that you can do to protect everything that's within your walls and within your shop. But then what about all the things that are happening on the outside? And I'll be honest, I don't think that that's a nut that we've cracked as well as we should yet. A lot of it tends to be kind of attestation-based. And I think we need to move from attestation-based to kind of full-blown validation confirmation. And that's still something that we're working towards. How do you see kind of physical and digital security or safety kind of merging in the AI age or not? We often talk about when we think about defense in depth and we talk about layers of defense, that physical security layer is so important before we even start thinking about digital security.

18:59And then vice versa is true. You know, these days, like drones are a big topic for physical security. And so that leads to things like what is our ability to actually not just detect, but be able to take a drone down or control it or send it back. And those types of things are super important to us. We've had a lot of discussion around identity and access management, especially what that looks like, you know, when you think about both physical identity and access management with digital. And so kind of like I'm a single person that has both of those things. But right now, if we manage those two things separately, we think that there's something lost in the context that could be gained between having both of those sets of data in one place.

19:42So I think it's super important.

19:44Mike Britton: You run security for an energy company in California, and I'm assuming that probably your number one business goal or one of your top business goals is how to produce more energy to fuel all of these data center builds. And the increase in energy consumption is probably going through the roof. How is that impacting your security program, the company overall? I'd love to get your take on that just because you guys do offer a different perspective being an energy company that's probably investing a lot of capital on building new power plants. First of all, like you mentioned, the energy demand in California nationally, but in California specifically, is going through the roof, especially not just the demand of new energy, but there's a push to actually convert a lot of the natural gas business into electric as well.

20:44And so what that means is that you have to first be able to generate that kind of energy, right? And in the past, it was a fairly vertically integrated business where the energy that we're providing to our customers is also generated by PG &E. That's not necessarily true anymore, right? We have our own generation facilities, but there's also a lot of generation that we don't do ourselves. And those generation assets are connected to our grid. And so having some sort of visibility into them, especially the technical components of that, those are the types of things that concern me from a cyber perspective.

21:22You're talking about distributed energy resources that come from different parts of the globe, don't know what all the parts and pieces are. And you're plugging these into our grid now, something that had been kind of very self-contained. Another part of our energy generation strategy actually heavily focuses on electric vehicles. And so now you've got all these electric vehicles that are also plugging into the grid and you've got bidirectional flow of energy. There are concerns around those types of things, not just those assets plugging in, but all the software that's being used to kind of control that highway, the flow of energy where it used to be kind of very one directional.

22:02It's now bidirectional. So all of the flow that's happening is being managed in a very different way. Think about all the data that comes along with that in terms of the usage. Think about like, you know, in order to provide energy in a modern way and energy management solutions, there's very different metering infrastructure. There's different meters, all of those types of things. There's a lot of compute at the edge, which were very different before than they have been. Sorry, different now than they had been before. Those are all cyber concerns, right? The attack surface is increasing and we don't own the entire surface anymore.

22:40We like to end the show as a bit of a lightning round. So we're kind of going for like your quicker takes on things. And so we're basically going to ask like five questions. We're looking for like the one tweet response. So please don't hate us if they're overly difficult answers to ask in one tweet, but we're going to try anyway. So Mike, why don't you kick it off for us?

22:54Mike Britton: What's the one piece of advice for someone entering their very first CISO job? Maybe something they would overestimate or underestimate about the role. Do not underestimate the power of the rest of the executive officer team. Make friends. What is the best way for systems to stay up to date with the latest technologies coming out, especially when there's like a new thing in AI every two seconds? Trust your team, ask them for insight, and stay close with your strategic vendors. So on the more personal side, what's a book you've read, and it doesn't have to be recent, but what's a book you've read that's had a big impact on you, and it doesn't necessarily have to be cyber or work-related?

23:32I really enjoyed reading the tipping point. Kind of helped me realize there's a right size for things. And then beyond that, like you start losing gains. What do you think will be true about the future of AI and cybersecurity that most of your peers might consider science fiction? I think especially when I think about convert security, humanoids are not that far off as part of the security team.

23:56Mike Britton: So what gives you optimism for the next generation of cyber leaders? A ton of inquisitive, curious people that want to make a difference in the world. Why is it so important to be protecting critical infrastructure right now? I think there's just so many other things for us to worry about. Critical infrastructure doing what it's supposed to and providing us these natural basic services shouldn't be one of those things. That is definitely the world we all want to live in. Well, Yusuf, thank you so much for joining us. It's great seeing you and looking forward to chatting again soon. Thank you. Appreciate it.

24:29That was Yusuf Izzy, Vice President and Chief Information Security Officer at Pacific Gas and Electric.

24:35Mike Britton: I'm Mike Britton, the CIO of Abnormal AI. And I'm Evan Reiser, the founder and CEO of Abnormal AI. Thanks for listening to Enterprise AI Defenders. Please be sure to subscribe so you never miss an episode. Learn more about how AI is transforming cybersecurity at enterprisesoftware.blog. This show is produced by Abnormal Studios. See you next time.