Sponsored: SpecterOps on the impact of AI agents on BloodHound

0:05Catalin Cimpanu: Hello, this is Catalin Cimpanu and this is a risky business sponsor interview with Justin Kohler, Chief Product Officer at Spectre Apps. Welcome Justin.

0:13Justin Kohler: Hi, thank you.

0:14Catalin Cimpanu: Justin, obviously people are quite familiar with your main product, Bloodhound. We're here to talk about the rise of AI in enterprise networks. We're obviously seeing AI agents being adopted at workplaces on a regular basis now. It's not just a one-off employee in a corner somewhere automating some tasks or testing something out. You can now find hundreds of agents, sometimes multiple types of agents inside any company network these days. How is this new evolution of the enterprise and work environment impacting your main product, Bloodhound?

0:49Justin Kohler: So great question. So we see agents in kind of a couple different factors. Most early on, it was I'm using like Codex or Cloud Code or whatever, whatever, you know, Frontier Lab or whatever model. And that is just using my identity, right? So there's no other agent necessarily associated with that or there's no other identity. It's just Justin working a lot faster than he does normally. What's interesting now is the rise of native agents with their own identity or acting on behalf of or with the credential or identity of another user or another identity. And that's actually what we just brought in with Bloodhound Enterprise, support for Azure Agent ID.

1:34Justin Kohler: So I can expand, but that's kind of the first foray into mapping exactly what an AI agent looks like in a graph.

1:43Catalin Cimpanu: Actually, let's expand on that. When it comes to these AI agents, how much visibility does Bloodhound have? Can you give us a walkthrough about the type of data and details someone can expect after a Bloodhound scan?

1:56Justin Kohler: Yeah, absolutely. So today, we just announced this at around the Black Hat time. So we announced AWS and Azure Agent ID. And Azure Agent ID is something that Microsoft is still building, and we are building right alongside them. So this covers Azure Agent ID, Copilot Studio, Power Platform, Power Automate, Azure AI Foundry, yada, yada, yada. There's a bunch of different places where you can create things in Azure that relate to AI agents. and it can be confusing I think right now for a lot of Microsoft customers to understand how all of these different components within the Azure ecosystem kind of combine and really like what can you do with an agent or how is that agent being utilized or who is it acting on behalf of so that's what Bloodhound brings so it doesn't matter where it comes from within Azure we just model it and importantly we don't model it in a silo like it doesn't it's one thing to kind of look at an agent and what it can do and maybe what mcp servers it's connecting to and that kind of thing but what it's really interesting is when it connects to the rest of your enterprise so how are agents able to influence other service principles in azure and how could that connect further in your graph right so if i'm federating id to like a github can i in theory use an agent that manipulates the service principle that then gives me access to something else.

3:23Justin Kohler: So the visibility into agents is interesting, but what we are curious about is how can an agent or anything for that matter be used against me as a security professional or a company? And how can I fix that problem or how can I understand that blast radius?

3:39Catalin Cimpanu: One thing that AI agents are often known for is their unpredictability sometimes. how much can a customer trust bloodhound results when it comes to agent graphs and paths that you are describing or is it the agent behavior you are tracking something that's somewhat set in stone

3:57Justin Kohler: yeah so that's that's a really interesting question and actually we're doing this too with bedrock so we announced aws we're building support for bedrock too so not just you know ai agents in azure but in aws as well and it's funny because an agent itself is non-deterministic but what it can do is deterministic. So whatever choice it makes to arrive at its destination, you're going to have an identity that either has the ability to do something or does not. And that is always deterministic. At least now it is. So however it gets to its decision is kind of irrelevant. What I want to understand is what could it do?

4:43Justin Kohler: Whether somebody was going to coerce it or whether a user just asks the right question what could it do in theory with its privilege and its access today in the environment and how could that be used against me so like i'm kind of i kind of get to avoid the question because we don't have to deal with that problem i don't have to understand how a model works i just have to understand how it connects in the environment and what bad things could happen so it's basically not really that different

5:10Catalin Cimpanu: between human identity and the agent because they take the same pathways just faster, right?

5:16Justin Kohler: Yeah, exactly, actually. And that's been our kind of mantra for a while, actually. People asked us a couple years ago, what do you do for non-human identities? And we'd be like, well, they're just another identity. We do the same thing. We've been mapping non-human identities since the beginning of Bloodhound Enterprises' existence. we just didn't silo them off into a specific thing because we think that needs to be in context with the rest of your organization again like i don't necessarily care if it's a non-human identity if it's an ai agent or if it's an actual user i want to understand how any of these things could lead to compromise in my organization what i can do to to solve that you're basically calling them service accounts instead of agents right yeah i mean an active directory right has had service accounts for years but like not just service accounts i mean it could be service principles in azure it could be tokens in github it could be uh you know lambda functions in aws like there's so many different iterations of a non-human identity to us you know it's kind of funny i'll i'll even go one step further and say identity itself is kind of a like a an arbitrary box that we put around these things really what we're talking about is just any entity that has privilege over a different entity and how do those privileges cascade across other entities to lead to something bad that's kind of what blowdown is known for so you've said you've released this

6:44Catalin Cimpanu: feature this year so what's the most common thing it is surfacing for now like what is the main finding the main problem inside networks with agents well i think i think it's twofold again

6:57Justin Kohler: Again, Azure Agent ID is kind of in early preview or it's not generally available, right? So it's being built as we see it. Same thing. Well, Bedrock is a little bit further along in AWS, but the same kind of process exists. I guess the key takeaway is people just understand that this seems like a really hard problem. And I think the hardest problem right now is just the disparate views that a lot of vendors give you. Like I mentioned, Microsoft, and I'm not throwing any judgment over to them. I think they're trying to centralize this all into one kind of view. But right now, it's kind of spread across what I'm going to call blades in the Azure console.

7:37Justin Kohler: So if anything, it's just kind of the clarity of, oh, I can just see all of it in one view and understand how it's either threatening my organization or not. I wouldn't say it's enormously alarming yet, but it's still somewhat in early adoption. So I think that's kind of the main takeaway is just the clarity of I don't have to look across multiple things to understand. And importantly, I could be talking about just looking at multiple views within Azure, or I could be talking about my agents in Azure or my agents in AWS. us what i really care about is i don't want to look at different things i just want to understand how is my environment at risk right now regardless of the platform regardless of the type of identity and you know again what can i do to fix that bloodhound is obviously a pretty loved tool

8:28Catalin Cimpanu: for defenders are there ways to take these ai agent specific graph results and provide quick and actionable advice and how to patch things in their networks and limit the agents what's the best way or true to take the bloodhound open graph and just feed it into something yeah i

8:48Justin Kohler: mean so the other half of our announcement that we just did uh is the support for bloodhound hunter which is the name of our mcp server that we just released for bloodhound enterprise so bloodhound enterprise already like crawls through all these attack paths at scale across you know multiple different platforms at this point and kind of shows you you know what's bad where you can fix it the mcp server that we just released uh we're particularly proud of i mean mcp servers have been out for a while but usually when people uh bolt on mcp servers are kind of on top of the api set that the product already has we built ours from the ground up like through the application so you can actually do some really interesting things that you can't do in the api and that gets to your question of like what can i do in terms of like defending my organization we we've again we've had findings and choke points and all that kind of like exposure analysis for for years but what an agent brings is the ability like one thing agents lack a lot of times is context and it's extremely difficult and expensive to build up that context however the attract graph is the perfect context for an agent to use so we kind of think about this in layers like at the bottom is the is the bloodhound attack graph right and all the findings at the middle layer is the agent and the highest layer is the human, you know, approving things where necessary or automating things where possible.

10:11Justin Kohler: So I can say, I could just ask a question, like what's the biggest risk in my GitHub environment today? And it can spit out, you know, it can just answer that question very quickly. Then I could say like, what one action could I prioritize today to solve that problem? And then what bad things could happen if I changed this permission? The really cool thing is when, you know, if you're using agents that are approved internally, it probably has access to different systems. So why did we provision that user with that level of access? It can comb those records internally and then provide that information.

10:41Justin Kohler: Or, you know, like we're, you know, we on this podcast might be familiar with Bloodhound, but a lot of people may not be. So how can I explain the risk or explain what an attack path is to a different user? You know, like if I'm going to talk to my GitHub admin about, hey, we need to fix this branch protection. Well, I need to explain it in terms that they can understand using specific GitHub terminology. I can't just say like, hey, Bloodhound said this because they probably don't know what I'm talking about. So the agent just makes all of those things possible and it really unlocks a lot of really cool workflows.

11:17Justin Kohler: I'll give you one more example. So think of any issue that's surfaced by any other product. You could ask Bloodhound, what's the blast radius of that problem? So I have an alert here. ask Bloodhound, how far could this user impact my organization? What systems can it touch? And what platforms could it compromise? So there's some really, really awesome things that this enables. And quite honestly, it's like our favorite way of interacting with Bloodhound data today.

11:47Catalin Cimpanu: Can this MCP server, there's obviously people who use Bloodhound for offensive security work. can this MCP server help them also integrate Bloodhound and its results into their own offensive AI tooling?

12:02Justin Kohler: So this is specific for Bloodhound Enterprise. Now there is an open source contribution of a different MCP server that's like just done by the community. That's available for like the community edition. And that is again, bolted kind of on top of API. So not quite as powerful as the one we're talking about here for Bloodhound Enterprise, which has the defensive use case but for internal like red teams or internal you know penetration testing teams if they are bloodhound enterprise customers they can use this and hook right into their offensive security work as well so you have to have a model that you bring to that conversation that is uh able to take action so like if you're just using frontier models with kind of the restrictions in place i mean we do we work with a lot of the frontier ai companies you know if you ask like certain questions you're probably gonna it's probably gonna tell you no because it thinks you're an actual attacker but if you're using some of the approved models if you're in like that trusted access or cyber program or daybreak or any of those kind of like programs from those companies uh yeah i mean those teams could absolutely uh start hooking those things into offensive operations if nothing else it it allows you to understand where you should focus your campaigns or your objectives for like an internal red team but the the main use case again of this is is more on the defensive side but yeah absolutely has utility on the attacker side on the on the on the approved attacker side i will say where do you see this ai agents trend going

13:32Catalin Cimpanu: do you think we're still in an experimental phase where we're seeing broad adoption because people are just testing it out are we set for a contraction of ai agent use or on the contrary

13:44Justin Kohler: you expect even more use i would i would say uh i would say it's going to expand so if you see it

13:52Catalin Cimpanu: expanding how do you see the future of enterprise networks evolving then are we heading to a place where human linked identities and actions will be close to non-existent and agents will be most of

14:04Justin Kohler: the bloodhound graph um well today i mean human users are probably the smallest portion of the bloodhound graph today i'm not talking about ai agents but there's a lot more in terms of entities or objects or or or you know non-human identities that comprise the bloodhound attack graph than there are users so that's that's already the case i would say that the reason i think ai use is going to continue to expand at least for security is the attacker is already adopting this like all of the stories that we've seen from the, you know, March when it came out with Mythos to, you know, up to Hugging Face.

14:44Justin Kohler: I mean, the adoption is there from the attacker side. I mean, fortunately, Hugging Face was actually, you know, not a malicious actor, but the opportunity and the capability was presented. And so I think if organizations don't adopt it, it's going to be really hard to keep up. You just have to do it in smart ways, right? We can't necessarily, like if you use an agent to find paths and to execute them maybe having the same strategy of having an agent do the same thing on the defensive side is probably going to spend a lot of money right like there's a lot more work on the defensive side and so that's where i think like products like bloodhound enterprise but not just on blood and high enterprise can enhance uh internal ai operations to take action and shut down those opportunities for attackers before you know somebody actually maliciously uses something like that.

15:36Catalin Cimpanu: Justin, that was a very interesting conversation. Thank you all very much for your time today.

15:40Justin Kohler: Thank you so much. Awesome to be here.