Welcome to the Washington AI Network podcast. I'm Tammy Hadad, the founder of the Washington AI Network, where we bring together official Washington policy makers, DC insiders, and AI experts who are challenging, debating, and just trying to figure out the rules of the road for artificial intelligence. Welcome to the Washington AI Network.
We are back at the House of 1229 for a conversation that's at the very heart of national security. And as regular listeners know, we have been honored to host Trump administration officials who are working so hard in the fields that we cover. Of course, Howard Lutnik joined us for the AI honors. We've had most recently Scott Cooper, Tech Force, Patrick Wick. I think you guys know Patrick Wick. And tonight we have a very special guest. Please join me in welcoming Sean Karen Frost. He is president national cyber director. He's a longtime Washington important man. And there is no more important issue Sean. Although I don't know you need to learn how to duck this job. I got to say welcome Sean Karen Cross please.
And I also want to invite you to help me welcome Sanjay Punan who is the CEO and president of Cohesidity. Thank you for being here.
That's the Sean Karen Russo. Okay, Sean, you released your cyber strategy. Okay, now I want to read, if you don't mind, your pillars, if I may, just so everyone can write it down. Shape adversary behavior, promote common sense regulation, modernize and secure federal government networks, secure critical infrastructure, sustain superiority and critical and emerging technologies, build talent and capacity. Sean, that's a heavy lift. Oh my goodness. So, please take us through not all of them, but how you going to get started?
Sure. Happy to do that. First, thank you Tammy for having me. I appreciate being here and thank you everyone for taking the time to listen and Sanjay great to see you.
Good to see you again. We've seen each other quite a bit the last few weeks.
We've seen each other quite a bit. Looking forward to this conversation. So the first thing I would say is we did put a lot of work into the strategy but it is President Trump's cyber strategy. It's not mine, it's the administration's and the president's. And I think I make that point because I think it's an important one. What we're really trying to do here and what the president is signaling for the first time is from the top of the chain a strategic direction for cyber as its own strategic domain. And for so long this is an area that has developed with different authorities and different agencies operating on a tactical level in this area but the USG haven't really pulled back to say what are we trying to achieve in this domain holistically. How can we lever every component of the USG to get done what we're trying to do in cyber and how can we use cyber to help on a strategic level with what we're trying to get done fundamentally elsewhere. So that's what this effort is all about.
Okay. So adversarial behavior, how do you shape adversarial behavior?
Yeah. Well, the first thing I'd say is right now the incentive scheme here is way out of whack. So we have seen this for decades now develop and scale and become more sophisticated both on industry on government networks and capabilities whether it's espionage, nation state related criminal organizations, scam centers, ransomware actors or the like and it's asymmetrical. It's a huge payoff for very little cost and there are so many points of defense. Defense just doesn't get the job done alone. And so if you're on the adversary side of this, why would you slow down? Why would you stop? And as AI, you know, artificial intelligence tools are infused into this mix, the pace picks up, the speed picks up, and it becomes even more rewarding. So I think it's incumbent on the policymaker set to say the government has a role to play in defending US interests, US citizens and industry. And I should say I know we've got international allies in the room here. I see the British are here, the Irish are here. I'm sure there are others. And we work in close partnership because we're facing the same threat actors and this threat doesn't know borders. So what we're trying to do is impose costs on those who engage in this behavior. Figure out a way to do that using the whole of government. Some of it's cyber on cyber but not all of it to send the message that this behavior carries risk and that calculus to engage in it maybe should be revisited.
And Sanji what's the role of private industries?
Well, I've been in the security industry 15 years and when I first met Director Canross, it was at a conference last year, he came out to visit Kevin Mandandy or myself. I hadn't met him before, but I'd heard a lot of good about him. He has a legal background, but he was very common sense and he was asking our perspective as industry leaders. We had another meeting that he initiated this time. Kevin, myself, Nikesh Aurora, CEO of Palo Alto was there was again a really good dialogue between his office and the private sector and how we could help in partnership. And you know if you think about us we can play cyber defense really well but we have ideas on cyber offense. You don't want all of us going on offense against a country like what can we do to go on offense and we know it's a nation state a particular cyber offense. And on his first point what I was really delighted about was the point in the paper that talk about the government now playing a lot more on cyber offense. We're also very excited to play our small role in helping him write the Trump administration paper. But one of the other points that I articulate you read out was modernizing the government with appropriate secure infrastructure. That's where we played Cohesity secure and critical infrastructure. There were a couple of those six pillars that really resonate with us. He mentioned the fact that every NATO friendly country and every democracy is going to see the same attacks that the US is facing. We're the biggest GDP. We're one of the biggest democracies. And typically the bad guys attack us first. But what we saw in the UK with the retailers last year, what we saw in Japan with the breweries were mirror attacks of what we saw in the United States. So we'd love to first off keep America safe, but then use that to help the world stay safe.
Yeah. And just two follow-ups on that. So specifically, it was no accident that the president signed the cyber crime EO at the same time as he signed the strategy. That signaling is we're now treating these organizations as transnational criminal organizations. So that opens up the ability for us to say how can we proactively get after this problem in a way that's not always reactive. So we're not waiting to do the remedial side of it and fix things but say how can we deny them the benefits of what they're doing, make their life hard and deny them safe haven where they go hide out. So that's the first thing and the second thing is to your point what the president has directed I think the administration to do is to be forward-leaning with industry to make sure that we're viewed as partners with our terrific innovators and the private sector that we have which is responsible and handles the critical infrastructure defense and operations for this country largely. First time I met this guy I said look this is what we're thinking about this is the direction I think and others want to go. I kept looking for someone to say, 'No, you guys are nuts. Don't do this.' And the universal response was, starting with Sanjay, it was, 'Yeah, what are we waiting for? This needs to happen. It's been waiting for from the top direction, and we're excited to have it.'
Well, it sounds like both of you are saying you're going on offense instead of waiting for something to happen. Is that a fair way to say it?
This is a proactive administration and we believe in not letting problems fester and find their way to us.
But also even the engagement of the private industry because you know while watching our friend Phil Mattingly on CNN something happens and then we hear that government steps in and industry it's almost like this tick tock after. But it sounds like you're coordinating in advance to maybe stop some of these cyber attacks or not attacks but just put this policy in place that would answer some of these questions in advance. Is that fair?
I think that is fair. I think there are two parts to that. There's the front end part of that which like I say what can we do strategically to get after these actors and that involves the private sector allows us to really scale in doing that and there's so much work that you all do. They have great insight into this battlefield where half the time they're taking down networks right as part of their standard operations and so it's aligning those priorities and figuring out how we can allocate resources to best get at this. Second part of your point is the remediation side sort of once something happens what do we do about that. There I think we've got great interagency colleagues now FBI DOJ CISA the NSA who are terrific at helping identify and remediate those things once they happen. Now what we're doing is saying great once that happens what can we do in response how can we better prevent this from happening again.
If you look at the security industry, there's like 5,000 companies, but for the prominent ones, we're the leader in data security. Nikesh's company, Palo Alto is the leader in network security. George Kurtz's company, endpoint security. We all get along and we like each other and even if there's overlap, we talk a lot together and we all have a common interest which is keeping the country safe. Many of us also have operations in other parts of the world. For example, Israel is a good example of a country which has got really good security technology. We often have played with companies there, acquired them. We work with the UK MOD. So, I think when we look across the entire world's substrate and landscape, we want to make sure that we're sharing best practices among ourselves and when the government's willing to work with us, we are in an active dialogue with them because this requires a collaboration from both sides. And typically all of us who are prominently involved have major companies in every industry. So we study the attack whether it was Colonial Pipeline or what happened United Healthcare Group or what happened in the Las Vegas hotels or most recently at Change Healthcare and we have a very good view of what's happening there that we could then feed the intelligence agencies and we need help then from the government to say okay now here are the facts we're seeing. I think it may be time to go on offense as an example.
It has to work together. People may sleep on how important the private sector particularly companies like Sanjay's and Cohesity are in protecting daily life in America. And so if we're not sharing information in a way that's at relevant speed at the right tempo and it's actionable then I think it's a disservice to everyone.
Okay. So Sanji I'm going to turn to agentic AI because the strategy also makes a bold commitment that AI can actually detect divert and deceive threat actors in real time. Cohesity already uses AI to protect customers the data. How do you see Agentic playing into all of this?
Well I think it's a little bit like the age-old debate about any technology could be used for good or bad or even going back thousands of years ago to fire. Is fire good or bad? Keeps a house warm but it could burn down a house. The printing press, good books have been written, bad books have been written. The internet. I think when you think about AI and agents there's a lot of productivity. Entire aspects of publications now are being transformed through the ability to take an entire Leo Tolstoy and summarize it at half page. But when we think about agents in the future, just the same way that we're battling these Shahed drones that are coming at us that only cost $10,000, the ability to create a new ransomware attack or a new agentic attack gets cheaper with agents. And that's an example of agents being used for bad. And as we've always talked about in the security industry, we've got to be right all the time. They've got to be right only once. So if the ability to attack us, the cost goes down because they're agentic and so on. We have to build a resilience framework for agents. So these are agents that could be potentially maliciously deleting data or unintentionally deleting data and we have an entire framework of how we think about that. I think this now requires our research in the security industry to cover not just data and applications and identity but also agents.
