How to Agentify the SOC with Marsh Global CISO and CTO Jeff Lund

0:01Hi there, and welcome to Enterprise AI Defenders, a show that highlights how enterprise security leaders are using innovative technologies to stop the most sophisticated cyber attacks. In each episode, Fortune 500 CISOs share how AI has changed the threat landscape, real-world examples of modern attacks, and the role AI will play in the future of cybersecurity. I'm Evan Reiser, the founder and CEO of Abnormal AI. And I'm Mike Britton, the CIO of Abnormal AI. Today on the show, we're bringing you a conversation with Jeff Lund, Global Chief Information Security Officer and Chief Technology Officer at Marsh.

0:36Marsh is the world's largest insurance brokerage, with reinsurance, consulting, and investment businesses that bring in about$27 billion in revenue. Jeff runs both security and IT infrastructure for the firm globally, so he sees the threat and the defense from both sides. A few things stuck with me from this conversation. First, Jeff says AI has lowered the bar to entry. A couple months of experience and a frontier model can make someone as dangerous as a state-sponsored actor. His team is now seeing just-in-time attack infrastructure, which makes attribution much harder. Second, Marsh's plan to agentify its SOC started with people, not tools.

1:10Jeff trained his analysts to work like AI engineers first, then move to AI-assisted playbooks, and eventually lets the AI take action as long as it shows its homework. The Tier 1 analysts aren't being cut. They're being trained up to Tier 2. And finally, Jeff's take on build versus buy is that he's not going to build a tool already offered by a company that has hundreds of millions in R &D behind them. But agents, workflows, and integrations get built in-house. And that only works because Marsh laid down secure, standards-based development pipelines.

1:40Jeff, thank you so much for joining us today. Do you mind telling our audience a little bit about yourself and the role you're in today? Yeah, thanks, Evan. So yeah, I've been in IT nearly 30 years now. It's gone by quickly, and probably 24, 25 of that has been cyber-focused. Today, I'm the CISO and CTO for Marsh globally, and it's a bit of a dual-headed role. And actually, I told my boss when he asked me to take on the additional IT information, the infrastructure components for what we're doing. It was great because I added a bunch of IT staff into my security organization. So it's one way to grow your team is to take over the rest of IT.

2:18It's probably something that are very familiar with Marsh, but I feel like most people in our audience probably don't fully appreciate the full scale and scope of operations. Do you mind sharing a little bit just to give us a sense of what the firm is like and maybe anything that's kind of unique about it from a security perspective? Yeah, we'd like to say we're kind of the largest firm nobody's ever heard about if you're not in a financial services space. We're the world's largest insurance brokerage. And we also have a business around people and investments where we're helping organizations at the C-level sort of manage their human capital, their investments, and how to hedge and sort of manage their risks.

2:59We have Guy Carpenter business line. Now Marsh Re is all about reinsurance. And then we have the management consulting group who's formerly known as Oliver Wyman. And those four core business lines make up a very global organization globally. So it's a large organization, moves pretty fast, but we're a force in that financial space where ultimately we're helping businesses manage risk. And we do that through those different portfolios.

3:26Mike Britton: Where do you feel with AI? So AI is really reinventing the attacker, how the attacker attacks from a speed perspective, from just the ability to generate never seen before attacks. How have you had to kind of change, if any, your threat intelligence program to keep up with everything that's going on on the attacker side of leveraging AI? Yeah, that's a really multifaceted question, isn't it? The AI-enabled threat actor, if you take that topic by itself, necessarily the tactics we're seeing haven't really changed much. An RCE vulnerability still is an RCE vulnerability, as an example. What we're seeing is the scope and scale of those attacks and the lowering of the bar to entry.

4:13So you don't need 10 years of experience to be a great hacker anymore, right? Maybe a couple months of experience in a frontier model, and now you're just as strong as a state-sponsored threat actor. So that bar to entry is really dramatically lower. And that means there's more of them, right? You've got more things coming at you. They come at you faster. So that speed and scale is, I think, the thing that we're sort of battling the most. And it's pretty common across the industry. And if you look at, you know, Volnpocalypse going on now or Volnado, I've heard that one too. I think that's a direct sort of direct correlation to what we're just now talking about, the things that are just coming at you faster.

4:55On the threat intelligence side, you know, that's really one of the keys and sort of the foundational components of my cyber program is that everything is driven from threat intelligence. And we make decisions based on that data. It's fact driven, if you will. The process of threat intelligence, I don't think really has changed. We're trying to consume more sources, if you will. But for us, what really matters is taking that threat intelligence and making it actionable in the way that we implement controls or defensive measures or implement IOCs so that we can better detect the threat actor. And we have to do that at pace.

5:32So the thing maybe we've done in the last few years is automate how that intelligence is actioned in the environment. You're pulling from these 10 sources, and if they all agree that's high-value data, and I want to, in an automatic way, get that out to my infrastructure and instrument that control so to have instant protection against that high-value data.

5:54Mike Britton: When we look at AI, and we've had this conversation with a lot of different security leaders, and it's been interesting to hear some of the ways they're leveraging AI within their program. What are some ways inside Marsh's security organization today that you guys are leveraging AI to speed up that ability to respond or find needles in haystacks? What are some of the use cases that you guys have found a lot of success within your own organization? So in our, I'll just call it the SOC function, but this is detection response, threat intelligence, detection engineering, all of the sort of capabilities that enable a well-outfitted SOC.

6:31We know that given that scope and scale problem we talked about earlier, You know, the individual human speed can't keep up with 3x, 6x, 10x volume increase of things to research, look at and tear down. So we need to automate those processes. And this is AI, you know, this is our AI play here is sort of gentrifying our SOC, if you will. But this taking, you know, in step one was really about, you know, educating all of our SOC team on how to be kind of AI engineers. You need to do the upskilling first. You can't just throw an AI tool on somebody and say, okay, now, you know, go do. So there's a training element.

7:11It's bringing everybody up to the speed of being an AI developer almost, right? How do I problem solve with this new tool set? How would I do this differently with this new tool set? So then it's about taking that capability and start building, you know, sort of processes that you would do manually through AI. So your AI-insisted processes, if you will. It can do some of the legwork, you know, following a runbook or a playbook, go out and take the incident that came in, enrich that incident with a bunch of data, you know, go out and reach out to your different security tools and pull that information back.

7:44Do some analysis on that capability, again, following your playbook, and then get that to an analyst to make a decision on, you know, do we action this recommendation or not based on that work. We'll continue to do that for a little while. We'll iterate on this and we'll add more processes and more processes. And we're going to, over time, get comfortable with, you know, the AI is making recommendations and decisions that are consistent with how we would run that incident or run that case or solve that ticket. And over time, we'll start flipping that over to, okay, now you can take the action, but I want you to prove to me that you took the right action to kind of show your homework along the way, if you will.

8:20And then eventually we'll be able to scale, you know, scale that capability. So it's a little bit of a crawl, walk, run sort of methodology, but for us, I think it's holding true. It'll also prevent us from having to go hire 100 more analysts to do the work that we should be able to automate. And then using the analysts that we have on that higher value, sort of deep understanding of what actually is going on in the environment. What do you think is missing? Like, what do you think the next generation of tools look like for, you know, the kind of AI powered SOC? And like, what do you think maybe like the industry is kind of not quite understanding yet that you'd like to kind of remind both your vendors and users, right?

9:01Hey, this is maybe what's this is kind of like the paradigm that's required to win this new world. Yeah, if I get all of my security vendors to collaborate on on how to identify and solve a problem and actually have a common way of integrating the data set, that would be outstanding. That's probably the thing, right? I get in the soapbox every time I'm talking to some of my suppliers, like, I need you to integrate with these 10 things. That makes my job a lot easier because what you end up doing on the back end is some sort of loose integration yourself. I would love for that to change. And they're starting to see it.

9:32Some of our suppliers are doing direct integrations with some of our other partners, and that creates a tighter ecosystem for us to manage. And that's outstanding. you know, across the IT structure, you know, everything from your hyperscalers to, you know, to your AI agents and everything in between, it would be great to have those things sort of interconnected. It paints a clearer picture. It reduces the time to do, you know, that correlation and that sort of aspect of it. You know, probably what we're doing in the AI space is actually automating all of that data collection and correlation so that we're not spending, you know, two hours trying to log on to different consoles and bring that together.

10:08That agent can do that for us and you know an eight of the time yeah i mean that seems like we have there's some we have it some somewhere close to that because there's just a volume of attacks you can't just brute force it with more staff and like some better operations so did you imagine like you know would you say like or to what extent do you think this next thing is true like do you think the few like current tier one analysts are basically now doing tier two tier three work in the future tier one's kind of more delegated to ai and you have more ai augmentation or assistance for kind of these more strategic or more decision-based tasks?

10:42Yeah, I think that's spot on true. I think most of our tier one capabilities, we won't need that anymore. It'll be an AI driven thing. And all of the people that we had in tier one will have been trained to move up to tier two. So we're not eliminating or removing people because of AI. We're upskilling those people to take on the higher functions and letting the AI automate the things that are repetitive in nature. right well i guess we have one of the challenges they have is like everyone is claiming they're going to do that right i think part of the problem is this huge fragmentation of different tools and technologies and so like any any advice when you're looking at kind of like you know people to partner with for the future like what's like the one or two things that really stand out right or kind of like become a differentiator it seems like it's less and less like one feature right because anyone can build these easily is it the you know is it culture is it like the data organization?

11:34Like, are there any advice about how to like choose kind of the right, you know, vendors to partner with? Well, I said, that's a tough question. Well, I say tough question because there's like 12 answers that are coming to my head at the moment, right? The, we like vendors that interconnect or operate with the technologies that we have, have here at Marsh. So, you know, if I have a solution we're looking for, for, I don't know, I want to do a new sim or something, right? We're trying to understand, does it, does it fit within the AI strategy that we've got for our detection response SOC capability?

12:05Does it deliver the value that we're expecting to get in sort of a timeframe? Can it consume the data that I need it to consume at a cost that's fair? You always like to say, I'm gonna start low in the cost and they always start high in the cost and somewhere in the middle we'll end up. But some of the limiting factors is the consumption driven licensing model or even platformatization licensing model. It makes some of the tools kind of priced out of your market. So especially when you're talking to an organization as large as we are, you know, it's hundreds of devices or thousands of licenses.

12:38And so when you start talking about why I need to license all of Marsh for this thing, I really only need this piece that it just becomes financially unfeasible. Integration of the tools I have for a price that I think is fair, what we're trying to achieve or accomplish. and it satisfies the goal that we're trying to get at. Whether it's like a SIM solution, like I was giving an answer to, it's got to do the SIM function well. Seriously, I think a couple of years ago it would have been, oh, it's got to have like these features and these technologies. Now the answer is shifting more to like, they have to have a culture of partnership.

13:14They have to be able to like be willing to be ambitious to kind of actually consume our data, whatever it is. So it seems like as we're using more AI to kind of build these products more quickly, right? It's more about the culture and the quality of partnership more so than like, you know, the bits and the bytes or the features. I like the strong partnership aspect of it. You know, at the end of the day, when you're, you know, sort of you're in battle and you're in the foxhole, so to speak, you want the person next to you that's, you know, not trying to write up the next invoice, but it's there to help you solve that problem.

13:46We'll worry about the financials. We'll make sure you're whole, but help me solve the problem now. Let's stop the bleeding, so to speak, right? So partnership for me in that vendor space is super critical. The ones that sort of take the gloves off and are getting in the trench with you are the ones that will be here long term.

14:04Mike Britton: I'm starting to hear in this world where we're successfully eliminating L1 and L1 is now L2 for SOX. If every company does that, because I don't have an answer for this, but where do you find your pipeline in the future? Like in a world where there's no entry level security work, where's that next generation of security person coming from? Yeah, that's an excellent question. You know, the reality is AI is kind of reshaping how an organization looks like. The organizations used to be sort of very pyramid organized where you've got, you know, the smallest point of that pyramid at the top and the widest point of that pyramid as being your early career staff and sort of gets narrower from there.

14:47And, you know, we've always had a pipeline that, you know, pulls in from, say, colleges or, you know, early career sort of opportunities for them, you know, coming into your organization. We try to build a career model and a career path for, you know, for our colleagues as they progress, you know, throughout their career. I think it's one of the reasons why we have really good tenure, you know, across our organization is another reason why I think the program is pretty successful. Like people stay. But to your point, that's starting to get reshaped a little bit because of AI. that bottom tier that used to be the widest is now narrowing.

15:17You don't have that solid pipeline and you could see it, right? Colleges are having a hard time placing graduates into roles. And it's not just our field, it's so many other fields as well. So it's an organizational kind of change. But in cyber specifically, we still try to maintain a good pipeline of new talent. And it's generally coming in from universities and colleges around the world, but I've also built an organization that is very much a sort of a follow-of-the-sun capability. We have what we call tech hubs, and that gives us access to markets that are not only just U.S., but colleges and programs in other countries that have incentives into the cyberspace specifically.

16:01So that's another way. It's not limited to one market. I've very much built an organization that is distributed globally so that I don't have pressures of sort of one market. I can pull and sort of ebb and flow across these markets. And that's been a bit game-changing for us in terms of that resourcing model.

16:19Mike Britton: Let's switch to AI on the attacker side now because I'd love to pick your brain on a few things here. I think it's probably not controversial or debated anymore that attackers are using AI, whether it's simple things like grammar and spelling all the way to deepfakes. I'm assuming insurance is one of those lucrative areas for attackers to try to extract financial gain. What are some things you're seeing from attackers, either your customers are seeing or you guys are seeing that are maybe some novel type of attacks or some interesting attacks that maybe you haven't seen in the past before this current era of AI that we're in?

16:57Certainly something we've seen an increase in is sort of a deep fake video or a WhatsApp post being sent to somebody's personal phone outside of your control, outside of your visibility. So somebody sends a really good crafted WhatsApp post claiming to be your firm CEO. And of course, they're working on a super secret M &A deal and they need your help. but the picture is good and the language is perfect and it's you know it's going it's being sent to somebody's personal phone so you know i can't see that communication we've definitely seen an uptick in that we've also seen an uptick in so the video impersonations of you know some of the senior leaders in the organization certainly more of that as a result of you know ai enabled attackers a lot more phishing of course in the end of you know the phishing that you're getting now is really hard to spot, right?

17:53We used to say, you know, so the old scams that you see, right? Those misspellings, or it doesn't make sense, or the periods in the middle of the word, or, you know, like all these classic things, those are gone. It's not that way anymore. And then maybe lastly, kind of along the phishing realm, we're seeing just-in-time attack infrastructure being much more common. So I'm going to send you a note, but at the moment you click that note, that's when I stand up my attack infrastructure to be able to respond or handle that interaction. Then I immediately take it down again. So getting attribution, following up on IOCs, trying to understand what the attacker is using to try and get a foothold in your environment becomes incrementally harder in that case.

18:37So that just-in-time attack infrastructure is probably another one. I think it was maybe like five or six months ago, but Paul Beswick was on my other podcasts and one of the things you talked about was um kind of like trying to shift more towards like kind of building some tools in-house right and like i think a lot of people are struggling including us you know me and mike we're trying to figure out like you know where do you build where do you buy what's the balance what are the pros and cons any when you think about kind of um you know like developing kind of the next generation of you know the sock or kind of you know security operations like how do you think about that balance because it feels like in some ways it's easier to build stuff than ever, but also like there's some things that like really you should find the expert for, you know, we're struggling with this.

19:18I imagine a lot of our audience are kind of struggling with that, that build versus buy balance as well. Yeah. Maybe two answers to that, to that one, Evan. The, the, the first one is on the buy versus build, you know, if I can do it better, faster, cheaper than I think the argument is pretty easy to, you know, to build it. But at some point is, is the thing you're building, is that a, you know, material differentiation for your capability, whether that's business and you're developing an insurance product or, you know, in cyber and you're sort of building out, I don't know, some workflow or automation or something.

19:48Does it materially define your, you know, your offering? And if it's so significant in one way, you probably want to buy the thing that, you know, has hundreds of millions of, you know, R &D built into that product because it's a differentiator in how you're competing. I'm not going to go out and build, you know, the next Zscaler or the next Wiz. is, I'm just going to buy that capability, right? They've got the R &D behind it, they've got, you know, all of the, you know, sort of the features and capabilities that I need, and I can just work on the integration. But on the on the back end, if I need an agent, or I need a workflow automated, or I need to build some bridge or integration, you know, capability, or, or even just to, you know, transform how a sort of a fundamental business process operates, all that can be done internally.

20:32And we definitely prefer, I'm sure, as Paul highlighted, the idea of we can build that capability better than we can buy it. And that's totally enabled by, you know, AI and vibe coding and the, you know, so that all the upscaling into development space. But that also is, I'm sure Paul probably talked about, is built on like a model that created space for that to happen, right? You know, we had an underlying infrastructure that allowed us to have that rapid development all built on standards. It was all done through security reviews and built with that in mind. So writing something now built on capability that we established five, six years ago, that was the enabler.

21:12It's all about building a house. You can't do that if you don't have a good foundation, right? So you spend months building the foundation. You can put the house up in three weeks. It's all about that foundation. So that's, for us, having that capability to rapidly build, deploy through standard pipelines. I've got all the controls built in now creates the sort of the framework or environment in which you can now build these tools yourself better than you can buy them. So that's kind of my second answer is, first one, is it really a differentiator? I'm not building the next whiz. And two, given that framework that I've got, that changes the calculus a little bit around the value of building something yourself.

21:51I have like four or five questions from that, but our producers normally have to go to our final segment, which is a lightning round, where we basically do four or five questions that are basically impossible to answer succinctly. And we try to get you to give like the one tweet version of this. So please forgive us and hopefully we can stay friends after this segment.

22:09Mike Britton: So what's the one piece of advice you'd give a security leader stepping into their very first CISO role, whether something they might underestimate or overestimate about the job? One piece of advice to don't over, well, actually I would say just be truthful, be a bit open and honest about the status of things. Considering how large your organization is and kind of the breadth of what you oversee, you're very up to date with kind of like the latest technology. Like, do you have any advice for how people can kind of stay up to date with, you know, AI threat landscape, AI tools? Like, you know, how do you do that when there's like new stuff appearing every moment?

22:45You know, I have an ability of just soaking in information just given my technical background. So, I don't know, that's an innate thing that I just, I can just consume it. I do a lot of learning. Maybe that's the one answer I would get is, you know, every chance I get I'm trying to learn, you know, what are we doing? What in this space? I'm going to extend that answer because I think it's relevant. I'm not an app developer. I'm an old school infrastructure guy. And I didn't understand what an app pipeline actually was until I attempted to build an app and push that all the way through deployment.

23:17So if there's something you don't understand, go do it. That's the one answer is, like, go do it, and you will learn a ton by doing it. All right.

23:24Mike Britton: We always love to ask a kind of a personal question. What's a book that you've read that's had a big impact on you and why? And it doesn't necessarily have to be a cyber topic or work related. Actually, I like DaVinci Code a lot. I can't really tell why. I like the mystery and the problem-solving aspect of it. So that's always pretty interesting. I and my team, I think we're big problem solvers. It just feeds into how I operate. So I'd say that one, DaVinci Code, Dan Brown. It just feeds into the way I think. I'm a problem solver all the time. And sometimes my wife just says I should empathize and not problem solve.

24:04So that gives you a level of detail there. Okay. What do you think will be true about the future of AI and security that most people maybe listening would consider to be science fiction? I think all the apps that you interact with are going to go away. And you're going to have a single sort of AI-enabled, you know, I don't know, super app that just does all the things for you, right? You won't need Word. You won't need PowerPoint. You won't need a browser. You won't need your individual AI agents that you use. You're going to have one big super app, if you will, that is AI, and it just does everything for you.

24:39You need an app to display this thing? Boom, I'll create that for you. If you need to go make reservations to fly somewhere, I'll just go do that for you, and I'll create a calendar thing. I think the individual disparate apps probably will just go away, and your computer is just going to become your AI assistant and we'll just build whatever I need you to be able to go do at that moment.

25:01Mike Britton: So what gives you hope for the next generation of cyber leaders? You know, I think we've got an amazingly talented group of people in the cyber field. And sometimes they're really underappreciated in terms of the capabilities that they've got. But that's changing. I think business leaders are seeing the value in cyber. So that's what gives me hope is that, you know, boards are becoming more educated. Your CEO and your executive teams are becoming more educated, right? That's what I do is sort of bringing that up to speed. And that next generation is coming in. I think you'll see business leaders really across the board value cyber as a differentiator in how they compete successfully in a market.

25:42That needle is moving for sure. Jeff, thank you so much for taking time to speak with us today. Really enjoyed the chat. Hope we get to talk again soon. Great. Thanks, Evan. Thanks, Mike. That was Jeff Lund, Global Chief Information Security Officer and Chief Technology Officer at Marsh. I'm Mike Britton, the CIO of Abnormal AI. And I'm Evan Reiser, the founder and CEO of Abnormal AI. Thanks for listening to Enterprise AI Defenders. Please be sure to subscribe so you never miss an episode. Learn more about how AI is transforming cybersecurity at enterprisesoftware.blog. This show is produced by Abnormal Studios.

26:18Mike Britton: See you next time. Thank you.