Running an AI-Powered SOC and Going Passwordless with Equifax EVP & CISO Jeremy Koppen

0:01Hi there, and welcome to Enterprise AI Defenders, a show that highlights how enterprise security leaders are using innovative technologies to stop the most sophisticated cyber attacks. In each episode, Fortune 500 CISOs share how AI has changed the threat landscape, real-world examples of modern attacks, and the role AI will play in the future of cybersecurity. I'm Evan Reiser, the founder and CEO of Abnormal AI. And I'm Mike Britton, the CIO of Abnormal AI. Today on the show, we're bringing you a conversation with Jeremy Kopin, Global CISO at Equifax. Equifax is one of the world's three major credit bureaus operating in more than 20 countries.

0:38Their scale gives Jeremy a rare vantage point on both defending a large enterprise and fighting identity fraud at scale. A few things stuck with me from this conversation. First, Jeremy's team has an AI agent running inside their security operations center that closes about 50 % of incoming tickets. That's half the alerts his analysts no longer have to monitor and triage, which frees them up for the problems that actually need human judgment. Second, they've deployed password lists to employees. Jeremy's point is that you're not just stacking on another control. You're taking away the root cause because there's no credential left to steal.

1:11And finally, Jeremy's view on shadow AI is that if you just put up roadblocks, people will keep finding ways around them. Instead of blocking, his team folded AI into the security review process they already had to get people using the approved tools, but with the right guardrails.

1:29Jeremy, thank you so much for making time to chat with us today. Maybe to start off, do you mind giving our audience a little bit of background about kind of you and your role and a little context with Equifax too? Yeah, no, thank you. So my name is Jeremy Kopin. I'm the global CISO of Equifax. So I am responsible with protecting and managing the security solutions for all of our corporate offices, international. Great to be working with this organization. And, you know, really, I think we're pushing the technology forwards, really using that technology to help our security teams and further our security processes.

2:02Prior to this role, I worked for Mandiant in that realm. And my responsibility was helping organizations that had unfortunately been the victim of a cyber incident, you know, helping through that process and the recovery. So, you know, working with that and then the risk based situations accordingly. You know, there's someone that's been on the fence about joining the cyber industry. um what like what yeah what would be kind of your like yeah why why now right why now is a good time to really kind of invest in cyber right in the kind of age of ai and yeah what what's uh what do you find inspiring about the mission that like you want to share with other people yeah i i think it's a great time where you know maybe a lot of the technologies are changing but that core focus is staying intact you know it's how can you you know protect an environment reduce the risk and enhance your team.

2:47And where I think, especially with AI, is it provides a great opportunity to learn things at a quick scale as well and really experiment. One piece of advice I always have if I talk to individuals is experimenting with a home lab or a home situation and actually seeing how things take place, what sort of events are logged, how does this look in real life? I think those are really fundamental skills as you become prepared with what that looks like in a real environment. And I think, you know, technology helps with that. But even just, you know, experimenting with devices you have at home in a safe, controlled way, obviously.

3:22Mike Britton: What are some ways that you're hearing about from your peers and others on how the attack landscape has changed and what's real and what's kind of noise when it comes to how AI is being used by attackers? Yeah, you know, I think from our side specifically, we have seen an increase in external scanning and other vulnerability identification platforms, which is what you would expect as that technology becomes more available and prevalent. So I think that's one key thing. Also, even, and I know it's been publicized from a social media perspective, so phishing becoming more realistic or all of the fake videos, phone calls, things of that type, I think AI is definitely lended where needing to be much more prudent from a security posture perspective.

4:10When I think about, you know, our side of really how we've tried to look at that is, you know, for the first one, I think it really depends how you evaluate risk. You know, I think that's been a key moment is looking at your external environment, making sure you're prioritizing, you know, obviously we have those generic risk scores, which are very helpful, but I think overlaying some of your environment specific data. So you're compensating controls, other mitigations you have really help, you know, us and I think others to prioritize. Where do you have that truest risk and how do you make sure you have that visibility?

4:43Alternatively on that, making sure you're testing and validating your controls. So is that kind of doing simulations and really having that power to have confidence? So that's been a big game changer on our side. And one thing that's thinking more about that social engineering facet, where we've been successful is we've actually removed passwords from the environment. And I think that is a gigantic advantage here where we're taking away kind of that root cause of credentials. But I think with that, I would encourage everyone, securing an environment, just to make sure they're being very aware on those attempts, because just time by time, they're going to continue to get more realistic.

5:22What would be your advice to other people that are trying to figure out how to prepare for the thing I don't know about? And how do I kind of get ready for that, this crazy world we're going into. Yeah. You know, I think a key thing that we, you know, I've just found important as I go through that roadmap is, you know, being able to pivot quickly and, you know, outline what are the objectives, what are the focuses and do they still make sense? I think that's a key aspect because you had a good point of, you know, something that we may have thought was an immediate threat and say first quarter.

5:53Well, maybe in a month or two, we've determined that that didn't maybe materialize in the same way, or maybe something else came in its place. And so being able to quickly adjust and say, okay, will this provide us that risk reduction we're looking at or improve our posture? I think that's a key one. I think also it's staying extremely engaged with the community. You know, I'm very, you know, pro of, you know, talking with your peers, talking with others. So whether it be at conferences or groups, you know, but sharing what you're seeing in the wild, so that everyone can kind of learn and continue to advance at that same rate.

6:24I think those are going to be key metrics we have just like, as you said, with the speed that we're having that change go through.

6:31Mike Britton: What's probably the craziest type of attack you've seen over the last year, AI or not? Like what's, what's one that's either, you know, crazy that it worked or crazy with how ingenious the attackers are getting, or just, you know, what, what stands out in your mind from an attack perspective? I think probably, and this is maybe going back, I don't even know it could be a year So I think just hearing how realistic voices could be emulated, you know, and I guess maybe not. I think that was feasible, but I think the speed at which it could be done, you know, that technology. And I think it's maybe just because it seemed, you know, I think when you hypothesize this three years ago and say, oh, in seconds, you can emulate a video or voice, you know, whatever it may be.

7:15I think that was one thing that just kind of was interesting. I think you could physically see that action or hear that. So that was one thing that did really stand out as I think about that AI perspective. The other ones, and I think this is more just from a research perspective, is how well AI has been at chaining together vulnerabilities. So I know there's a lot of reports out there of finding either really old legacy vulnerabilities or is able to chain things together to get to a condition or do things. And I think that's just really interesting to me because it's able to look at the same, in that case, source code or application, whatever it may be, and go through a different logical attack path.

7:55So, again, really focusing on from a security side, making sure we're incorporating that as we think about how we defend our products. When we're thinking about how to prepare for the future of these AI-powered attacks, what stuff you would encourage people to start paying attention to? Not because it's catastrophic, but it's indicating where the world's going and maybe where we have to better prepare. Yeah, I think prior, I've had a lot of experience with threat actors and the investigation. I think they're always going to lean towards methods that can be done at bulk and quickly at scale. And you had a key point with text-based entry, that was a relatively cheap and easy, effective method.

8:34And now seeing audio and visual continue to go down that line. So I think keeping a pace of how quickly technology allows for these types of attacks and just the scale is something to always keep in view and kind of use that as where things may go. I think it also, though, brings down more focus on kind of those core foundational controls. You know, at the end of the day, it is still some of those focuses on network, identity, protections, detections. You know, having those key focus things are what put you in the position where even as you see that technology change or maybe an approach change, you have those redundant layers that you can make sure you're able to either add in additional detections quickly, you know, alert certain things or, you know, pivot, as we said, to make sure you have that in flight.

9:19Those are very key things that I would focus on. I agree with you is just, you know, keeping an eye out as you see kind of starts and where it may get to later, but then making sure you have controls ready that you can adapt quickly.

9:30Mike Britton: So where do you feel like you guys have been able to leverage AI in your security program? Like what are some areas where you feel like, you know, it's had some outsized gains and really helped make your controls more robust? Yeah, you know, I think one of the key ones that stands out to me is using AI within our security operations centers to up with those teams from a technology side. And I'd say kind of a combination of both AI and automation. You know, I think in some cases, automation can accomplish a lot of looking at, you know, that patterns of data and then AI as well with that. So we've gotten in a spot now where we are using, you know, agentic based solutions to help resolve a lot of our alerts that are coming in.

10:18And where I think that's key is that allows our team to focus on, you know, those those problems that may require that more human analysis time review and more focus and attention from a risk perspective. And so that is where we've had a lot of success. You know, again, just having that there, it frees up that time and can clear out some of that backlog. And where I think we'll continue to see is, you know, using those to review those alerts at scale. And I think we're going to see that continue to pick up just in security solutions overall as they continue to push forward. So, Jeremy, when I was doing kind of some prep for this, I think I read someplace that you have this kind of AI kind of triage agent that's like closing, I think, on the order of like half of kind of your tickets.

11:01I'm curious, kind of like, you know, a lot of people aspire to get there. I imagine getting in that process has also taught you some things about where AI is effective, where it's not, where you want AI to be doing work versus your human team. Any lessons from that? Also, Phil brag a little about what's working and why it's worked. Yeah, no, you are correct. We have the AI agent right now working within the SOC, and it is closing approximately 50 % of our tickets. So, you know, if you think about that scale, that's 50 percent that our analysts no longer have to go through and monitor and triage through that work.

11:38The key things that we found, you know, is it's it's always staying up to date. You know, so you think about technology first was prompting and then we went to skills based and things continue to adjust. I think it's always evaluating how you can improve the agent at scale and then do troubleshooting. So one thing we had a lot of success with is, you know, almost doing, you know, a testing process and being able to replicate that test as you add new features. I think that's one key thing with AI is making sure you have that baseline that you can go back to and say, hey, is the agent operating as expected and running through that process?

12:13I think also it's, you know, continuing to help the agent understand your environment. So I think, you know, if you think more traditional off the shelf things, they don't know exactly what software you allow to run. They don't know exactly what processes or network connections. And so being able to utilize that agent and give it that detail, you know, it kind of helps in two ways. Where one, it allows it to be more accurate and more effective on where it does that analysis. So it can get a better understanding of what's normal in that environment. But on the second part, it helps from our side to identify abnormal activity.

12:49So if a tool is being executed or a software that we do not allow, well, now we can know to escalate that. You know, we can use that as our defensive advantage as well. What are some of the next steps you think in that kind of AI native threat defense journey? Yeah, I think you hit a key spot where, you know, just looking at, you know, I was thinking back like 10 years ago and how much you would have from, you know, in a logging perspective, whether that be event logs, web logs, whatever it may be. You know, it was insane to think about how that compares to now. You know, I mean, you think nowadays, even just having a modern EDR, the amount of telemetry you can get compared to, you know, historical days of just static virus scanning.

13:27So I do agree. I think as we get there, having AI be able to look at that data at scale is, you know, really, as you said, finding things that are, you know, just different in the way it's acting operationally, what it's connecting to, what doesn't add up in those equations. That is going to be a huge part of this detection. You know, again, trying to get beyond more traditional malware detection or things of that really focusing in there, I think, is a key aspect. And I think it will be helpful because from an AI agent or just AI in general, you know, it's really good at that, you know, evaluating large sets of data for patterns to detect things.

14:04That's where I think we'll continue to see that uplifting where we've used and we're continuing to enhance our technology. But then as you overlay more data with it, you get a more comprehensive story. Each source, as we see more log data become available, whether it be through a cloud provider or other source, I think that's where we're going to start to have even better efficacy overall. So, Jeremy, I'd love to hear your thoughts on how also cybersecurity teams need to play a role to make sure we do roll out the AI safely, securely, and quickly. And then, Mike, maybe you can kind of add on to just your perspective as a CIO.

14:36Yeah, I think the first part is evaluating the processes you currently use to bring on, you know, new technology and seeing how AI fits into that. I think, you know, that was a great point for us. You know, we can bring it through the traditional security processes that have been adapted to make sure they account for that technology. And by doing that, I think then it's working to be an enabler within the organization. So, you know, again, I'm always a proponent of, you know, if you just put up roadblocks, people are going to consistently try to find ways to get around those roadblocks. And then you have that, you know, security debacle you're going through.

15:08So for us, it was really working with, you know, identifying how we could, you know, go through and govern AI appropriately, put in the required guardrails. So, you know, things from such as a networking or other realms, and then also help to, you know, train our employees of how to use AI. So that way we can, you know, make sure they're using the approved tools that we want with the guardrails that we need and allowing them to continue to enable the business as they continue to advance, you know, in many other initiatives. So that was where we had a lot of success and continue to because, you know, technology changes very quickly.

15:44So continuing to make sure that we're keeping that up.

15:46Mike Britton: I think preventative controls are good in some of these things. And obviously, you know, you've been around a while. you've struggled with shadow IT like most organizations and now shadow AI is even much more difficult because the barriers are almost non-existent for users to sign up and use. What have you kind of had to change about your approach of just like trying to stay up with your business? Because I'm sure everyone, every leader across Equifax is being pushed to leverage AI in some form or fashion. And the last thing, you know, you want to do is be the drag on that. And so maybe, maybe, maybe tell us how some of your approaches have changed around that partnership with your business and helping enable them to use more, not less.

16:32Yeah, I think a key part is becoming more involved in that product design in the, you know, initial phases, you know, and helping with those teams as they outline, you know, how they would like to use technology or what technology would be implemented. I think that's a key one of adding in those security features is much easier at that phase than trying to bolt them on later. You know, I think that's been a key, you know, lesson we continue to implement in our teams. On the other side, I think it's, you know, utilizing foundational preventative controls. So networking is an extremely strong one.

17:05You know, if you look at from, you know, accessing, whether it be, you know, requiring only using approved models, You can put in those restrictions to help safeguard in that realm. And so using very traditional tools. And then I think a key part is also the monitoring facet of just going through evaluating those. So I think, you know, from our side, a lot of it has been the partnership with technology, business, etc. And that's been a key factor in our success with using AI. And then on the security side, you know, kind of as you'd reference, you know, enforcing that with those preventative controls and the monitoring so we can make sure we're staying on top of it.

17:42Mike Britton: You feel like the business is more willing to pull security into these conversations sooner? I know in previous technology innovations, it's always felt like security was lagging in an afterthought. Do you feel like they're coming to you faster now? I think, yeah, it's definitely been a great partnership in that realm of engagement. And I think a lot of it is, again, working with them for the same overall objective. How can we help you with your initiative or your focus area? And how can you use this to go? I think that's where it's been a real game changer and, you know, that side of having them bring security in.

18:16Mike Britton: And we've had a great culture with that. You know, security is in our DNA of, you know, that building process. And so I think that is a requirement for that product development lifecycle. And, you know, hearing from others as well, continuing to go down that road just to make sure you have all those guardrails built in. We could teleport in the future two years and there's some kind of solution that can do that automatically with AI. Like, what are some of the requirements for it to do that? Right. And like, how do you think that type of problem gets solved in the future? I think you hit a key spot where I think it's having a solution that is able to scale to the amount of data that's being produced.

18:53And I think the more we can bring in that data sets that actually, you know, you want data sets that have value of being able to bring in that telemetry. You know, I look at things such as, you know, actions on, if we say a system in this case, actions on or against the system, whether it be a firewall device, an endpoint, a web server, in that realm, but then being able to correlate that with additional data. So you could say, is this frequent? Is this uncommon? Okay, what is the other network telemetry we see? Have we seen this ever before historically? Really having a solution that is able to take data inputs and then expand on those to determine how luck does that align with our environment.

19:35And then you could also overlay that with doing threat intelligence on the indicators and really just at scale, being able to get a whole story of what happened during that time period. I think that's where we're going to continue to see. And that's, you know, we've done and continuing to do that with our agents. But I think in the future, you're just going to get more and more data sets. And I think that's where we're going to see that big convergence where, you know, you're shifting from more of those static detections and just using the data to really help outline what occurred and then learning from that.

20:06And I think then you can even go the next step of taking the output of that and now funneling that into another system of going through processes, you know, and refining overall. That's where I think, you know, we're on the road to as it continues to evolve with just that data set at large.

20:21Mike Britton: I also know you guys provide identity fraud services as well and have seen a lot of synthetic identity fraud. We've seen a lot of identity fraud around the North Korean IT worker scams that are going on with remote employment. Do you think AI is making this problem harder? Do you feel like attackers are able to blend in and look like the rest of folks with AI? Or what's your kind of take on, is this problem going up and to the right? Or is it always been this way? Kind of give us your perspective from Equifax point of view. Yeah. I think that looking at that problem, and it's a great question.

20:57I was actually talking to someone about that yesterday. I think we've seen an increase just in synthetic fraud, and that's been reported, you know, in many passives of, you know, that. And I'm sure technology is playing a role in that of, you know, generating falsified information. I'm probably the, I'm more of an optimist side as I think about it from the security perspective. And again, you know, where he said there is, I think where it will help from a fraud side is identifying patterns and identifying, you know, irregular based data. So if, you know, the same item is being, you know, modified, you know, in these X ways, being able to see that at scale and identify so that you can have real time detection.

21:38I think that is where we're going to continue to see technology increase or implementation in identifying fraud of that type. So I think while it is maybe increasing, I think that's one where technology will start to help and, you know, bring that of mountain down just through that detection process.

21:55Mike Britton: And where do you where do you feel like organizations need to be more aware of the problem hitting them? Like, you know, sometimes it's remote work, sometimes it's other aspects. What do you feel are some practical tips that any organization, you know, someone watching the show from another organization could do to kind of help combat that? Yeah, I'll split into two. And one you thought I'd say one is definitely reviewing just that hiring identification process, verifying identities, you know, that is a key spot. And then, you know, also looking back for patterns, you know, whether it be from, you know, names, addresses, photos, et cetera, things that, you know, we're seeing duplicated.

22:34I think that's a key one. And just making sure for that realm from, you know, I, you said remote work side, which kind of made me think as well is evaluating connectivity for remote workers. You know, where are connections coming from? Are they coming from, you know, proxy based devices or other things? And not that that is a, you know, 100 percentile of it being malicious or legitimate, but just having that visibility where you can understand the workforce and their connectivity. Lastly, you know, again, we've deployed password lists. And I think that's helped a lot where, you know, we have that additional level of verification from, you know, needing something beyond just a username and a password.

23:16So not necessarily on the fraud side, but I would say just like security in general with remote work, you know, from our perspective, that that's a huge thing is removing that username password and, you know, hopefully an MFA type thing, but moving that to more, you know, biometric physical MFA and removing the password component is a huge thing to external remote access.

23:38Mike Britton: You know, we all want to be in this world with the autonomous SOC and AI and, you know, move the mundane work off, uh, off everybody's plate, where does that leave new grads and people wanting to get into the cybersecurity market? Cause you've got to start somewhere. And, you know, are we creating the situation where they're not ever going to be hireable because they don't have experience and that level of experience required for human work is too high for them? Like, where does that leave us? Yeah, I think it's a great point. And my thought was going through there is having teams still be aware of cybersecurity fundamentals.

24:18So I think at the end, you still need to understand kind of what events are indicating, what does that mean from a reporting perspective, and being able to tell that story of taking technical events and lay it out into an activity timeline. From using technology now, where I think it actually helps is using it to learn in a quicker space. So, you know, I would think back when I started, if you had a question about a specific event or, you know, something that may come up, you'd end up going through, you know, Sysinternals books and all kinds of other, you know, old printed off documents to try to find a little bit of the details.

24:54You'd then go to various blogs trying to find out what did that event mean. And I think now we have all that information readily available where you can start to piece together and say, what does this mean? You know, how does this impact this scenario? So I think for, you know, individuals in that phase is you're really looking at how cybersecurity works, how events on the system take place, and then, you know, using that to upscale and go through. I do think it's going to be an important factor to be fluent in AI of how you can utilize it, how you can effectively use these models in order to, you know, help with any of the analysis you're performing, development.

25:30I think that's going to be another key piece. So, you know, making sure while you're learning that fundamentals, you're staying up to speed with technology. You know, I think Evan had mentioned, or maybe as you, Mike, early on is, you know, we we might be dealing with an entirely different type of threat or review needed in two years from now, five years from now. And I think that's another key thing is making sure that you're staying aware of that technology because rules are always going to adjust. You know, there's still the prerogative and the mission statement stays the same, but making sure we have that focus on the overall objective.

26:02Okay, so the last couple minutes here, we like to do a lightning round. And in the lightning round, we basically try to ask you questions that are very difficult to answer in like the one tweet format, but we're trying to go with one tweet format. So please forgive us.

26:14Mike Britton: Awesome. So what's one piece of advice you would give to a brand new CISO stepping into their very first CISO gig? Maybe something they'd overestimate or underestimate about the job. You know, I think taking a step back to evaluate, you know, just I think anyone would go in. But one thing to help me was meeting with my team, understanding all of the technology, external footprint and truly the environment sitting to understand the risk perspective. Because I think that helps to really determine, you know, what are your plans for the next 30, 60, 90 days? So that would be, you know, an instrumental thing I would go through, you know, coming in as a new CISO.

26:51So I think the other is continuing to build relationships with the business and all of your partners. I think that's extremely valuable. Well, as you start to learn those small pieces of the environment to make sure you can operate at speed. How do you stay up with the latest of what's happening in technology, in the threat landscape, the best practices of 2027? What's your advice to how to stay up to date when the world's changing every week, it feels like? Yeah, I think one, I'm always curious. So I think maybe it's a thing where I'm always kind of wired to understand what did change yesterday to today from a threat landscape.

27:27And that's something that's been a part of my life now for the last few decades of going through. So I think that's a key thing is keeping that focus and having sources, but also learning new ways. So it sounds weird, but even using AI to update you on AI technology. So having those automatic workflows that we can really tailor the news to what you're looking for. On the other side, I have a very strong and great team that is instrumental in that, where they're really able to dig into the details on threat analysis, detections, hunting. And that helps as well where I can keep my purview, but then I also have that strong team that's helping through all of those processes.

28:08So those have been extremely successful in our organization.

28:12Mike Britton: What's a book you've read that's had a big impact on you and why? And it doesn't have to necessarily be cyber or even work related. You know, I'll go with one that I read recently. I was going to think of the name, but I think it was Tools of Titans by Tim Ferriss. And I think where I liked that one for anyone that hasn't read it is it's little short stories from many different individuals. and it was interesting to see how they each approach different problems or how they would solution things throughout life. And that was just an interesting moment for me because I feel then you could see just a breadth of different experiences from all different careers, whatever it may be.

28:52And I kind of picked away a little piece from each one of them where it would resonate a little here and there. So I really enjoyed that just to kind of go through all those journeys. What do you think will be true about the future of AI and cybersecurity that most of your peers would consider science fiction. I still think, and I think it's continuing to evolve. I'm an optimist, or I do believe kind of in the scenario you were outlining, but even probably more, even advanced side, where we will have agents that are able to look at large-scale data autonomously and make real-time determinations on what that data maintains.

29:27And still going to have that human component to go through, But I do think that is probably closer to real life than farther away as I look through that problem statement. So I don't know if people would say that's not a, you know, a science fiction is not going to happen. But in my mindset, I don't think that is as far out as we continue to see technology advance. And as we start to see those data scales evolve, I think we are going down that path. And I think that would be, you know, really valuable for our teams. Now, then again, then I think it becomes, you know, as with anything, there's probably new threats that then need to be evaluated.

30:05And how do you detect those? So, well, I think we'll get those solutions that can do that level of review. I'm always leaving kind of that room for the unknown of, you know, what will be there next we're going to need to work on. Awesome, Jeremy. This has been a really fun conversation. I regret that it's only been one hour. Maybe we'll have to do a part two in the future. But thank you so much for joining us. I really appreciate sharing your perspective with our audience. No, thank you for having me. That was Jeremy Kopin, Global CISO at Equifax. I'm Mike Britton, the CIO of Abnormal AI. And I'm Evan Reiser, the founder and CEO of Abnormal AI.

30:39Thanks for listening to Enterprise AI Defenders. Please be sure to subscribe so you never miss an episode. Learn more about how AI is transforming cybersecurity at enterprisesoftware.blog.

30:49Mike Britton: This show is produced by Abnormal Studios. See you next time.