Cofounder, Cylance
Achieving Artificial Intelligence, Not Artificial Security with Ryan Permeh, Cylance
Ryan Permeh, Founder and Chief Scientist of Cylance®, examines the redemptive role of artificial intelligence (AI) in a beleaguered cybersecurity industry. AI can address the security personnel shortage and outpace rising malware attacks – but like any tool it must be used properly. Only great AI delivers great results.
Learn More: https://www.blackhat.com/us-18/execin...
About Ryan Permeh
In a June 2018 interview at Black Hat, Ryan Permeh, cofounder and chief scientist at Cylance, discussed the role of artificial intelligence in cybersecurity. Permeh stated that cyberattacks have become more public and carry greater reputational and business consequences, citing examples such as state actors, ransomware, and WikiLeaks. He argued that the security industry faces a shortage of skilled personnel, describing a "negative 200 percent unemployment rate" in security, and said that scaling the problem requires tools and technology rather than relying solely on human capital. Permeh described Cylance's approach as using machine learning to offload tasks such as malware protection and incident response from humans. He emphasized that effective AI requires world-class data scientists, subject-matter experts, and engineering, and cautioned that without these elements, organizations face significant challenges. Permeh also promoted Cylance's "compromise assessment" service, which he said allows the company to test networks for potential threats.
Transcript (20 segments)
I
Interviewer0:11
Founder and chief scientist at Cylance. Ryan, it's good to see you.
R
Ryan Permeh0:16
Thank you. It's great to see you as well.
I
Interviewer0:18
First thing I just want to ask you is, would it be fair to say that we're facing not only an increasing intensity of attacks, but also those attacks, if they're successful, have greater business consequences for us than ever?
R
Ryan Permeh0:32
So over the last several years, attacks have become much more public. And because of that, we've seen a lot more involvement at board level and even in the media. So the reputational damage of an attack can be significant. We've seen everything from state actors to crime. As more companies start to realize this, they're seeing a significant uptick in what must be done about cybersecurity. It's moved from sort of a back office technical discussion to a real-world business continuity and risk calculation. And that affects both Fortune 500s down to mom-and-pop shops. The threats are real and they can actually do a significant amount to take your business offline.
I
Interviewer1:44
There's also, I think, a sense out there that attackers are getting increasingly sophisticated again, whether they're state actors or whether they're criminals.
R
Ryan Permeh2:10
In some ways, yes. There are new ways of being a bad guy. But the majority of attacks, while they have one or two interesting new facets, fundamentally still use a lot of the same tactics and techniques. For example, if you take the WannaCry attack, it had a brand new disclosed zero day and it used a worm-like mechanic. Both of those are pretty interesting and unique in the concept of ransomware. But the ransomware portion was pretty standard. So the vast majority of the code could have been from any other piece of ransomware out there.
I
Interviewer2:49
That's an interesting take, that despite this veneer of increasing sophistication, somewhere at the heart of these attacks is some variety of threat that we've kind of seeded the ground in terms of prevention. And that increasingly we have to focus on intervention after there's a breach, to keep an attack from moving laterally and getting to our crown jewels. How do you feel about that narrative?
R
Ryan Permeh3:26
So prior to starting Cylance, I spent a long time at a very large antivirus company. And every year we'd get the drumbeat of 'AV is dead.' The reality is that a lot of our approaches have lost efficacy over the years. But to that point, taking a quote from Ben Franklin, an ounce of prevention is worth a pound of cure. It's very important for us to consider things like forensics and incident response, but those can't be our only approaches. Attackers are constantly evolving, so we really had to consider different approaches to prevention.
I
Interviewer4:17
I think there's also a sense that we're somewhat under-resourced, not from a technical point of view, but just in terms of human capital, number of bodies and skill sets among the people who are on teams.
R
Ryan Permeh4:29
Yeah, I hear this often when talking with CISOs. It's really hard to find people. I read an article a couple months ago saying that we're at a negative 200% unemployment rate in security right now, that there are two jobs effectively for every open potential candidate. This is a problem with training. But even if we train a bunch of people today, they're coming out very green. A lot of the problem is that we're going to need the right kind of tools, the right kind of technologies, and the right types of processes to keep us ahead of the game. Because this isn't a problem where we can just throw people at it and make it go away.
I
Interviewer5:27
So tell me a little bit about how Cylance then addresses this issue of increasing attacks, limited headcount, and potentially really bad consequences.
R
Ryan Permeh5:37
Absolutely. So Cylance takes a pretty different viewpoint here. What we found was that internally we have a concept around what machines do well and what humans do well. What we found is that you can't get enough people to fundamentally solve this problem. The more you can offload from your humans, the more humans can focus on those truly unique threats. The cleverness that humans bring to the game really starts to make the difference.
I
Interviewer6:29
There's a lot of talk in the industry about AI and machine learning. So maybe you want to tell me a little bit about how Cylance differentiates its approach to the application of AI and machine learning to the challenge.
R
Ryan Permeh6:42
AI and ML are transformative technologies right now, and they're being seen across the board, not just in security but all over the place. That being said, it's the approach that you take that really matters. To deal with the problems we face on a daily basis, you really do need to have real data scientists solving real data science problems. That's the fundamental difference. Machine learning and artificial intelligence are our platform. They're the approach on how we solve problems, rather than a band-aid that we slap on top of potentially failing products to try and give them a new shiny veneer.
I
Interviewer7:41
So I think what you're saying is that there's a difference between applying commodity machine learning algorithms to security and actually building something that's natively designed, specifically purpose-built for the kind of problems we face.
R
Ryan Permeh7:53
Absolutely. Real machine learning and AI face some pretty significant challenges in solving problems. So if someone is listening to this and they find what you're saying somewhat compelling in terms of value and possibility of reducing their risk, what would you suggest as a next step?
I
Interviewer8:19
Well, we're going to be at Black Hat, where we show real-world attacks happening on a daily basis and show how the concept of a predictive advantage using AI and ML to get in front of attackers, to understand those patterns of badness, can really fundamentally change the game. We'll be performing it at Black Hat as well as all around the country. Just check our website and find out the date and the time. We also have a free tool that allows you to leverage our technology to smoke test your network in a very lightweight way, to understand if there's a reason for you to be worried.
R
Ryan Permeh9:21
Great. Ryan, thanks so much for your time.
I
Interviewer9:23
Thank you.
N
Narrator9:23
Lenny Liepman of Black Hat here with Ryan Permeh of Cylance. Thanks for watching.