Rapid Response: Battling cyber attacks and deepfakes with AI, w/Darktrace CEO Poppy Gustafsson

0:00Scaling a business in the US can feel like a maze. Each state has its own payroll, benefits, and compliance rules, pulling your focus away from growth, which is why founders use Deal. Deal is the professional employer organization, or PEO, that gives you a dedicated HR expert, plus Fortune 500-level benefits for your team. The National Association of PEOs says businesses can grow twice as fast if they use one. So, if you're scaling, make it simple with Deal. Go to deel.com. slash MOS and get up to three months free. If you're in private capital, you understand that your next great deal starts with who you know.

0:41That's why over 3 ,000 firms trust Affinity, the CRM platform purpose-built for private capital. Affinity's relationship intelligence reveals your team's strongest paths to founders, investors, and decision makers using insights It's hidden in emails, calendars, and meetings. With powerful AI tools like Affinity NoteTaker and Deal Assist, you'll spend less time managing data and more time closing the right deals. Learn more at affinity.co slash marketplace.

1:18Let's take us knowing that novel threats are the new normal. We're always going to be facing an attack that we don't quite anticipate or was unexpected. And how do you protect a business? And AI is a really powerful tool in that. And yes, AI can be leveraged by the attackers as well. But cybersecurity, it's nuanced and it's evolving. It's self-learning. And that makes it such a natural home to be able to use AI. You really get excited about this. It's Matt. I love it.

2:22cybercrime has also become way more professionalized and businesslike than I'd realized. Poppy is both a guide to this world and a passionate advocate for how technology can help us get the most from technology. We also talked about deepfakes, which are getting richer and more common, and how our biggest cyber risks come from human weaknesses, not software. This is an area that business people would often rather not think about, but they should. and it's actually quite fascinating. So here's me and Poppy getting into it.

3:06All right, so let's jump in. So Darktrace is one of the fastest growing tech firms in Europe. You've got more than 9 ,000 corporate clients around the world. Just a few days ago, So Darktrace released a report about sort of the state of cybersecurity risks right now. And one of your colleagues said to me, threats are evolving at an insane pace. That's absolutely the case. So as you said, we just published our threat report. There's a look back on the last year. And one of the biggest takeaways from me is that innovation isn't something that's just available to the good guys. The bad guys are innovating and evolving constantly.

3:45We're seeing a huge rise in the number of sort of what we call as-a-service tools. So ransomware as a service, malware as a service, all the tools of the attackers are now available to rent. It's like a commercial ecosystem around like cyber attacks? There are helplines for the criminals to use to help them say, oh, I'm trying to do this malware as a service. I'm having a little problem. So I press button A or press button B. This is big business. that's operating on the other side of the dark web. That's both fascinating and terrifying all at the same time. It's very much a business. There was a big breach last year on the pipeline attack across the US, which saw people queuing for gas stations.

4:32And there was a huge uproar as people were getting very frustrated not being able to fill their cars. And I remember at the time, the attackers sent out a statement saying, oh, I'm so sorry that we caused so much harm and disruption to society. And in the future, we're going to do sort of better diligence as to the types of organizations that we hack into. And you think, hang on a minute, this is a business, albeit a legal business, that's basically signaling their sort of principles in a way that any legitimate business would do. And it was a real moment of this is big business that's happening on the other side of these attacks.

5:10Recently, the director of CISA, the U.S. Security and Infrastructure Agency, testified before Congress about the risks of like this societal panic. And they're talking about state actors from China. And why can't the U.S. or the U.K. government just take care of all this? It's just too hard. It's too big. One of the biggest misconceptions I always think about cyber is that it's a binary problem. So you have like bad things or good things and that it's a static challenge. And if only it were, because then you could just say, look, here's all the bad actors, here are all the threats, button down the hatches against this and you're done.

5:51But the reality is it's much more analog than that. It's things are a bit bad or something that starts out as benign but can become malicious or something that's malicious could become benign. But it's constantly changing and evolving and transitory, which means it's very hard to keep up with, which is why it's become such a large scale problem. Davos, you know, the World Economic Forum, a third of the businesses there were saying that they have suffered financial impact from significant cyber threats in the last 12 months. I mean, the Hollywood version of cyber attacks is like, you know, some evil tech genius, right?

6:31Who is finding software gaps or something to sneak into systems. It sounds like the range of threat actors and kind of threats is even more complicated than that. I always think about the level of threat as a sort of R &D roadmap, if you like, of attack innovation. And the top end, there's a lot of expertise in the nation state attacks. And how do you protect sort of corporate infrastructure from very targeted attacks to get to a specific thing that could be in water infrastructure, for example. But once you've created that technology, like the cat's out the bag, it then rolls into these enterprises that roll these attacks out at scale and mimic a lot of the business practice that we see in legitimate businesses, such as the as a services model that I referred to earlier.

7:24And then at the other end, you've got your bedroom hackers who are just there to sort of showcase their skills and expertise and just to cause that disruption all the way through to malicious insiders. So people who are legitimate employees of an organization but are feeling disgruntled and they want to sort of punish that organization. So there's such a broad spectrum of understanding where that attack may come from. It becomes very challenging for security professionals to anticipate where it's going to come from, by whom, for what benefit. Darktrace is sort of predicated on the idea that AI could be a tool to sort of stay ahead of that.

8:05But it seems like as you talk about these things that sort of the solution becomes the problem, the problem becomes the solution, that now AI and with generative AI, that it's being used by threat actors to make it more complicated again. We set out 10 years ago, let's take us knowing that novel threats are the new normal. We're always going to be facing an attack that we don't quite anticipate or was unexpected. it? And how do you, in that knowledge, protect a business from a threat when you don't know what it is going to be? And AI is a really powerful tool in that. And yes, AI can be leveraged by the attackers as well.

8:47And I'll touch on that in a moment. But cybersecurity, it's nuanced and it's evolving and it requires an ability to reassess decisions that have been made in the past. It's iterative, it's self-learning, and that makes it such a natural home to be able to use AI to put the defenders on the front foot. Because ultimately, the defender has the home turf advantage. They are the people that know the business and its culture and its digital identity better than anyone else. And by leveraging AI, they're able to arm those defenders with that knowledge and stay one foot ahead of the attacker. I saw this recent report about deepfakes, a finance worker in Hong Kong who was scammed out of like$25 million by a video call with who they thought was their CFO, but turned out to be someone else masquerading as their CFO.

9:44It doesn't surprise me. It's something that we see all the time. The advent of, you know, tools such as chat GPT that use AI and generative AI to create conversational prose. These are tools that a lot of us benefit from our day-to-day lives, but they're tools that attackers benefit from. Like we're seeing phishing emails being crafted using these tools. The linguistic complexity of those emails has got far broader as it becomes much easier for people to communicate in a way that feels much more natural and human. It might not be their first language, but suddenly they're able to talk in a much more convincing way.

10:22That means you're more likely to click on that link or do that thing that they're trying to get you to do that you wouldn't do otherwise. So extrapolating that further, as we think about, you know, future innovations, making it much easier to create these deep fakes, whether it's an audio or audio visual, whether it's your Slack or your Teams or your chatting interface, whatever it is, all of which broaden the footprint that an attacker could potentially find their way into an organization via. So it's a really complicated and expanding challenge. And like, even on this call, how do I know that you are really you?

10:59And how do you know that you're actually talking to me and not someone who's pretending to be me? One of the things that we try and look for is the outcome rather than motive. So often what attackers are trying to do is to create a quick response that if you had time to think about it, perhaps you wouldn't do. But if you're under pressure, they're trying to create an urgency so you respond before you've had the chance to think. So it's not about saying, how do I authenticate this image that I'm receiving necessarily? But what is the behavior that is being trying to be driven out of this communication?

11:36Are they trying to create a sense of urgency? Are they steering you to a behavior that is unusual for your organization or you and your behavior? So what we tend to look for is not saying, is this a threat? But what is the outcome of this? And could that be threatening to the organization or something that's indicative of a behavior that you'd want to control? And when you find yourself that it maybe is that to sort of pause and try to find the right way to confirm that this is actually something that... Because business does move at a much faster pace than it ever has. And so we are being put on under pressure to act quickly in ambiguous situations in a different way.

12:18Let's take a step back. Cyber threat comes wherever we mix people and technologies. And the gap between those two is what an attacker is trying to exploit. And if we had businesses that had no technology, there'd be no cyber threat. And likewise, if we had businesses that were just technology and had no humans in it, they'd be much, much, much easier to protect. So it's that combination that attackers are constantly trying to push their way between. But technology is a huge enabler for so many businesses. And cybersecurity is the thing that allows people to embrace that technology. If we really do our jobs properly, they shouldn't be having to see that through a cybersecurity lens.

13:04You shouldn't be having to have a conversation with me thinking, can I trust Poppy? Technology has the power to be able to take care of that and do a lot of that understanding and dissemination itself. The way you describe it, it's like the people are the problem. Like if it were just machines talking to machines, we wouldn't have the same risks. Without people, there would be far less cyber attacks. I think that's safe to say, but it's also safe to say that people are an essential part of what makes our businesses brilliant. And at Dart Trace, we want to let the people in the business focus on what it is that they do best.

13:41I mentioned the congressional testimony from the security folks earlier. One of the things that was brought up was almost an admonition to business that in the push to get things to market quickly, that security is sometimes being de-emphasized, almost like there's an underlying vulnerability throughout the tech business because people are rushing too fast. My colleague, Reid Hoffman, talks about the need for blitzscaling, that it's important to go faster than you think you can and let some fires burn and, you know, put products out that may not be perfect yet. In the lens of cybersecurity, is that just like a bad idea?

14:23This is the idea that software should be secure by design. wherever possible, people should be building products that have inbuilt security such that it makes the attacker's job far harder. And I agree with that. Let's make the attacker's job harder wherever we can as a first port of call. But a lot of this is based on the idea that the attack will be known and it will be in some way predictable or repeatable. And the reality is the vast majority of these attacks are novel and unpredictable. And so you can never eradicate all risk by building in that secure by design. That pressure to bring products out quickly is very real.

15:10And there's some very real benefit to people bringing things out to market in an accelerated fashion. So the reality is, it's a compromise between those two. But the idea that we could eradicate all risk, I think is unrealistic. And for you in running your business and running Dark Trace? Like you are having to respond to new threats, novel threats. So there's a certain pressure on you guys to get products out quickly that can do that. But at the same time, how do you manage that sort of push to get there quickly with the need to make your own products secure and safe in that way? This is the brilliance of what we do at Dark Trace.

15:51So cyber can be viewed through two lenses. And the first is just as you've described. So what's happening outside there in that big bad world? And who are the attackers? And what are all of the known attacks? And what do we think that the threats of tomorrow are going to be? And then lock all the doors and fasten all the windows against all of that known threat. But the reality is something's always forgotten or missed or the human whose job it was to lock the doors and windows had a bit of an off day and didn't quite do it. There's always something that goes wrong with that plan. And that's where Dark Trace comes in.

16:27And we see the problem through the opposite lens. So instead of saying, what's happening out there in the threat landscape and what are the baddies up to? We say, let's look at you and your business and your organization and just observe the daily ebb and flow of digital activity to learn your unique digital culture, your unique digital fingerprint, if you like. And once you know that, you can always spot when it changes. Could be, you can find the aberration that says, this could be a big alarm bell. There's something very different that doesn't normally happen for your organization is happening over here.

17:07Or it could be lots of small crumbs of evidence that come together. It could be a number of different things, but we spend our time learning and studying the business rather than the threat, which means when there's a big new ransomware attack, such as the ones that US water facilities are currently suffering from, when there is a big event like that, we don't have to come scrambling through and say, quick, now let's update the dark trace 9 ,000 customers that we're protecting for this new form of ransomware. It will just find it. By virtue of the fact it's not the business that it's studying, there's no update or push required.

17:44the AI learns on the job that by virtue of the fact it's not normal for that organization, it knows that it's a threat that needs to be intercepted and controlled. And of course, all of this done entirely autonomously, entirely by the software and without human intervention. And so each installation of Darktrace for each business is effectively different because it's learning from that business and understanding that business separately. With the passage of time, each of those installations becomes entirely unique and completely bespoke to that organization. But when it comes out the box, so on day one, when that license key is typed in, it's exactly the same software.

18:27whether you're protecting a global financial bank that's got offices all over the world, or whether it's one of my favorite customers is a small hospice down the road from near where I live, or anything in between. It's exactly the same thing, which is artificial intelligence that goes into that organization and learns its unique digital DNA. The unique digital DNA of an organization. That's pretty cool. What surprised me most listening to Poppy, though, was her description of cyber attacks enabled by software as a service providers. I never realized the dark web was so businesslike. Next up, Poppy's going to explain the challenge of running a business where best case for your clients, nothing happens.

19:15We'll be right back. Real leaders don't back down when the stakes are high. They innovate, they push forward, and then they take the stage at the Masters of Scale Summit. Join us in San Francisco, October 7th to 9th, to hear from the CEO of the New York Times, scientists using cutting-edge technology to find cures, the leader of crypto powerhouse Coinbase, a retired four-star general, and many, many more. Apply now at mastersofscale.com slash apply25. That's mastersofscale.com slash apply25.

20:19aws.amazon.com slash activate and start building. Expanding your business in the U.S. can feel like a maze. Every state has its own payroll, benefits, and compliance rules, which can pull your focus away from growth. That's why founders use Deal. Deal is the Professional Employer Organization, or PEO, that gives you a dedicated HR expert plus Fortune 500 level benefits for your team. The National Association of PEOs says businesses can grow twice as fast if they use one. So if you're scaling, make it simple with Deal. Go to deel.com slash M-O-S and get up to three months free. Before the break, we heard Dark Trace CEO Poppy Gustafsson talk about the rapid evolution of cyber threats and how AI is both an accelerant and a tool for defenders.

21:15Now we go into the odd psychology of running a cybersecurity business, plus cyber impacts on elections, handling problems that don't have answers, and more. Let's get to it. You mentioned sort of the traditional way that cybersecurity works. Does an organization need that along with Darktrace? Like, is Darktrace a supplement? You need a combination of approaches. So typically, an organisation will secure that first line defence will be on a threat base. You know all the attacks of the past. You've got that rear view mirror of what has happened historically. Let's not suffer those same attacks again.

21:55So at the perimeter, you will keep those out. And that's your antiviruses. That's your fireballs. But the moment that something gets through that, your next line of defence, by definition, can't be relying on the same approach. It has to see the problem from a different perspective. And that's what we do here at Dark Trace. And then once your group maybe identifies that, the firewall technology will then be adjusted to try to block those kinds of attacks, right? Then you're looking for the next one. Exactly. So the evolution of us as a business has gone really sort of through three chapters. And the sort of first phase was to say, we've identified an attack.

22:35And an alarm bell would ring and we'll say, and we think, yeah, great job, Dark Trace. But very quickly, we realized that that sort of reactive approach wasn't enough. Like you can't simply be another alarm bell ringing. And so we moved into what I think of as like the active phase, the middle period of Dark Trace's life to date. It's not enough for me simply telling Bob that he's been attacked. We need to help Bob by stopping that attack and kicking it out. So how do you autonomously make changes within that organization to stop the attack within its tracks. And that is done by the software itself.

23:11It's done by the way it integrates with the rest of the technology stack. But it's about saying, you have been breached, but we're going to stop it right now. So you might have lost a few files, but you're not losing a whole bunch of data. And then the most recent phase is what we call the proactive phase. So given we have this unique understanding of your organization, you very quickly gain an understanding of how this organisation is uniquely vulnerable. Where its crown jewels are, you know, there's a window that's been left that we can identify. That window's slightly ajar, but it only goes to the stationary room.

23:46That's probably not, you know, high risk. Whereas, you know, over here, this door is unbolted and that takes you to the crown jewels. How do we proactively wrap a blanket around that risk and actively harden against those? So you end up with this wonderful virtuous circle where each phase feeds into the next. And only because you have that really rich understanding of how best to respond to an in-progress threat, you then think, oh, we now know how to proactively harden against that in a way that's unique to that organization, which then means you're more uniquely able to understand when that business is breached and so on and so forth.

24:27So you end up with this lovely virtuous circle where each part informs and enforces the other. You really get excited about this. It's math. I love it. You just, you light up about this sort of the structure of all this. I think it's because I'm a mathematician. I studied maths at university and I loved my maths lecture. But in those days, it was a big overhead projector and people writing formulas and algorithms and projecting it onto this big white board. And it felt very ethereal and filled with people with leather patches on their elbows. And now I am here running a business where that maths, that very same maths that we studied all those years ago, is solving real life problems on real data for real organisations that all of us benefit from.

25:19And seeing that mass in action is just very exciting. It's kind of a strange business that Dark Trace is in because in some ways, and you mentioned the new threat report that came out, like bad news in the industry is kind of good news for you, right? Because the more trouble there is out there, the more people need what you have. No, I think very quickly you want to avoid any of that sort of ambulance chasing behavior. But I think for me, it's cybersecurity's got such a pessimistic view. Whenever you talk about cybersecurity, people imagine that person in IT that's wagging their finger and saying, don't forget to update your passport or else.

25:58And you feel like it's, you know, oh God, if I don't get this right and the world's going on. It always feels like that you're being told off and you have to do this or else. And it's a very sort of critical or negative perception. But for me, cybersecurity is such a huge enabler. Like we all love tech and we all love seeing innovation that's happening throughout society. And cybersecurity is the tool that enables you to embrace that technology into your business and explore it in a way that if the worst were to happen, you'll still be okay. But isn't it strange to be operating a business where like in the best case scenario, like nothing happens, like you prove your value by nothing happening?

26:44I mean, if we wanted a round of applause, we'd all go and work for the circus, wouldn't we? I do think it's, if we do our job right, no one knows that you've ever been there. We've got customers, we've got a wonderful neonatal unit where those doctors and nurses are doing a real job of caring for babies. And they're relying on a lot of tech in order to be able to do that properly. And if Darktrace does its job right, They can just take that tech for granted. There's a lot of discussion in the U.S. about the integrity of elections and whether results can be trusted and whether bad actors from Russia or other places can influence things.

27:28From your perspective, how much of that is sort of conspiracy theory and how much of it is real? I can't comment specifically on terms of the election. But when it comes to cyber threats, attackers are intentionally exploiting human vulnerabilities to their own advantage, trying to shape their behaviors in a way that is advantageous to them. I can see how that translates to another world when it's changing perceptions or influence. I can absolutely see that people will be driving to those ends. And the idea about sort of hacking into voting machines and tabulation data and things like that, that if that's happening, that is probably more happening through a human interface than a technical one?

28:21Again, it's always that interface between the humans and the technology. And attackers will be leveraging their influence to change human actions to gain an entrance into technology that they wouldn't otherwise have that access to. As a business leader, aside from the specifics of cybersecurity, is it getting harder to run a business and the role of what business plays, you know, beyond its shareholders? Running a business is always hard because you're dealing with stakeholders that are changing and their wants and needs are constantly changing. Sort of balance of like culture and principles. But business leaders thrive in that change.