How Security Leaders Are Meeting the Agentic AI Threat

00:09 Welcome, everyone. I'm Blake Thompson Heuer, head of communications at Synack, and I'm very excited to jump into this timely webinar discussion on how security leaders are meeting the agentic AI threat. Joining me today are two such security leaders: Sharon Mandell, most recently chief information officer of Juniper Networks, and Mark Kuhr, Synack CTO and co-founder. Thank you so much for joining us to discuss this urgent topic. We've seen AI-enabled cybersecurity breaches start to

00:39 claim headlines. It's clear that the state-sponsored threat is ramping up, and cybercriminals have started to weaponize AI to scale up the speed and devastation of these attacks. Jumping right into the questions: how are attackers leveraging adversarial AI agents and generative AI in their attacks? Mark, maybe we'll start with you. Mark Kuhr Good question, Blake.

01:09 Think back 10 or 20 years ago. People used to talk about script kiddies and how scripts were enabling everybody to scale up attacks, carry out large-scale internet attacks, cause outages, or take advantage of recently released vulnerabilities. It's really that on steroids. These AI agents are able to have business logic inside them that is as simple as a prompt, and people are going to take advantage of that to scale up attacks.

01:39 They're also getting really good at using tools and taking advantage of instructions you give them to use a tool, have a path to implanting servers, and think on the fly about what attack to run next. You don't have to explicitly program your attacks, which I think is the most interesting piece of how agents will change the landscape. Blake Thompson Heuer And, Sharon, how about you? And thanks again for taking the time out to join us today. How are you seeing attackers leverage these AI agents and

02:10 new technologies? Sharon Mandell Yeah. Well, agents are the newest kind of animal on the front, but, we have this, like, increasing inability to trust what is reality. Right? With, generative AI able to create content and deepfakes, you don't necessarily know who you're talking to. There are many other forms of attack in addition to the velocity of attack.

02:43 You're getting your user community or employee community to think about all the things they never really got perfect at thinking about before, such as phishing. There's a whole new set of vectors that we're having to think about. In some cases, there are tools to help, and in some cases, there aren't. You're one mistake away from pretty significant impact. AI for pentesting and vulnerability management Blake Thompson Heuer

03:13 I am glad you mentioned tools that help because the other side of this coin, of course, is that it's also increasingly obvious that AI technology is an enormous asset or certainly should be for defenders hoping to maybe match the adversarial speed and scale that we're seeing, and has the potential to revolutionize really many aspects of cybersecurity in particular. But, today, I really was hoping, each of you could hone in on the pentesting and vulnerability management space and the potential for AI to disrupt what's happening there.

03:44 And maybe, Sharon, this time, we'll start with you. Sharon Mandell First of all, we hope that, through the use of AI, we can get broader, more complete penetration tests, where maybe you can feed in everything you know about your environment. But the AI can help you see what you don't know and create areas of testing we might not think about.

04:15 I find, again, I'm the IT leader, not the CISO, but spend a lot of time thinking about security. But any kind of testing, we tend to think of the kind of straight line normal cases. But we're not necessarily always good at finding those edge cases. And it's those edge cases that attackers take advantage of. So I'm hoping that the AI will make us better at getting that kind of more complete picture as we go in and we try

04:45 to simulate the kinds of things attackers might do to us. Blake Thompson Heuer Mark, your thoughts on the defensive piece? Mark Kuhr Nothing to disagree with on that. I think it's a natural dual-use technology. It's long been discussed as a double-edged sword. It's going to serve defenders and offensive folks alike. The focus really has shifted on both sides to automation and using AI to patch things faster and get ahead of vulnerabilities.

05:16 But it means that our mean time to remediate is going to have to get reduced dramatically. In a world where agents are constantly on the hunt, they're constantly there looking for the latest vulnerabilities, looking for your changing attack surface, waiting for that moment to exploit. That is going to be the case. Lots of sharks in the water. How do you defend yourself when the sharks are numerous? And they're going to grow. They're not going to have the same attacks. You can tell Grok 4, for example:

05:49 "Here's a vulnerability. Create an exploit script. Give me five variants of that, and put them on all these different nodes so it looks different on the wire." So you're not necessarily going to have the same signature to defeat all the time. It's going to be constantly moving around. Then also leave the agent instructions: "Every three hours, rotate your nodes, rotate your scripts, rotate your payloads, and make sure you look different to any signature defeats." It's going to be next level in terms of randomness and, I think, effectiveness too.

06:22 The only way to defeat that is to find the vulnerabilities faster and remediate them quicker. It's going to push us into a world for pentesting that's not a point-in-time test anymore. I think Synack has been doing continuous testing for a while, but everybody's going to realize continuous is where it's at because the attack surface is constantly shifting. And we're going to have to move everything to constant patch, constant assessment, and it's just going to go in a cycle, and it's going to be much faster than ever before. Prevention and the pace of software change

06:52 Sharon Mandell Blake, I'd like to add, on the positive front, as a company that also develops technology products: as a CIO, I think we're going to be pushing a lot harder on the quality of the work that gets done by our vendors. But as one of those vendors, we're also looking at how we use AI to recognize when we're creating vulnerabilities as we're creating the new features and functionality everybody wants to consume from us.

07:23 Hopefully, we can get many of those resolved in the products to reduce that attack surface before the product goes out the door. The notion that we're going to write bug-free code is probably extreme. But we have technology to help us be better at it than ever before. And I think prevention should be top of mind for all of our technology partners and vendors. Knowing that we'll never be perfect,

07:53 then I agree a hundred percent with everything Mark said. Nothing is going to stay consistent long enough. Even just the way we're releasing software requires us to make changes at just a different pace. So whatever you thought was true yesterday or two hours ago probably isn't true now about your environment. So I don't know any other way but continuous to really get us to where we need to be. Mark Kuhr It's really interesting because we're setting new records for

08:26 the speed of identification of vulnerabilities. You had 40,000 vulnerabilities identified with a CVE assignment last year. I fully expect that to be even greater this year, and that's just the stuff getting a CVE number. That's not the full gamut. That's not all the custom apps. That's not the custom code. That's not the AI-generated slop from vibe coders that's introducing vulnerabilities faster than we're realizing.

08:56 It's going to put additional pressure on the ecosystem of software, especially third parties. When you think about your risk, it's growing. Unfortunately, it's not getting reduced. We're going to have to figure out how AI can help us identify and triage vulnerabilities much faster. What I've been telling our security team internally is that we need to go from detection to remediation in minutes, rather than a week-long or multiweek process.

09:29 It needs to be that fast because the offensive guys are going to be throwing everything they've got at it, and speed is going to be the name of the game. Human judgment, validation, and accountability Blake Thompson Heuer Well, to push with your shark analogy from earlier, any oceanic white tip, great white shark is going to be able to outswim your Michael Phelpses of the world. Right? It's just not even a contest, and I think we're starting to see that in AI era. How will the role of humans change with AI on security technology teams? Is there still a need to keep a human in the loop with these

10:00 new AI tools and technologies out there? Mark Kuhr Automation is going to come a long way, but you're not going to eliminate humans from the process. Eventually, I think you're going to have humans validating what the AI is doing. You're going to have humans managing teams of agents. It'll shift around a little bit, but we're going to need that human in the loop to verify that these LLMs are doing what we want them to do. The reality is that we have nondeterministic execution through the LLMs, and we need to verify that they're following the rules.

10:31 It's going to be important for humans to understand the guardrails, understand how to implement them around AI solutions, and further validate that the proposed solution is correct and accurate. Sharon Mandell Yeah. I also think, from a pragmatic standpoint, we can sit and talk about how quickly we can automate patching, automate OS upgrades, software upgrades, but there's still this validation process you

11:01 have to go through that the thing that you're changing doesn't break something else in the ecosystem. I think humans will, for a while, be involved in understanding that big picture and that strategic aspect: if this is coming my way, I have to look out for these three things. No two environments are alike. The enterprise architecture at Juniper isn't the same as the one down the street at

11:32 Extreme Networks, Cisco, or HPE. But, whether it's scale, set of products, types of customers, things drive us to do things much less consistently than we'd all like to and much less simplistically than we'd all like to. And I think there's still going to be some human navigation in that process because you can't read that in the manual. There's never enough documentation. There isn't the data for the AI to consume about that,

12:02 at least not yet. As systems get better, it's throwing off exhaust. And maybe you have those tools that can kind of suck that in and learn about the system. But I think we're a ways off from that. I just do. As smart as they're getting and as quickly as things are changing, I still think we're a ways off from that. Mark Kuhr In addition, somebody is responsible at the end of the day. The person who's accountable for those systems, whether for compliance with standards such as PCI, HITRUST,

12:33 or whatever it may be, is going to sign on the dotted line: I assess that my controls are valid, they're working, and I'm the one who's getting fired if they don't work. That's not going to be an AI agent anytime soon. Right? So humans are going to be in this process verifying that those bots did exactly what we wanted to do, and we did our best effort to make sure things are secure. Sharon Mandell Mark, that's my standard answer for the media question of when is AI going to replace your job, Sharon, as the CIO? I'm like, there's always gotta be somebody who's, like,

13:04 making the risk decision and accountable for it and who's going to fall if they get it wrong. Right? Mark Kuhr Well, you said you work closely with the CISO earlier. Right? Blake Thompson Heuer And, maybe you can always blame the CISO on some level, Sharon. Sharon Mandell It's a funny relationship. Right? In my case, it's a very good relationship. But, they define the policy and the standard, but it's usually my team who does the execution. So I'd say we probably go up or down together, not one or the other. Triaging critical vulnerabilities Blake Thompson Heuer Well, to that end, I'd be curious,

13:35 and I'm sure many of the webinar listeners here would be curious to hear as well. How are you triaging critical vulnerabilities today? And are you feeling that pressure that we spoke to a little earlier to respond more quickly? Sharon Mandell Yeah. Yes. Constantly. First of all, to the extent we can get the data, we try to understand how we do relative to others, and we report on that regularly to the board.

14:07 Invariably, it's tough to keep up. Right? So you have these events that happen or things that go on in your company, and suddenly your numbers spike higher than they were. And the board's looking at you constantly for that because there's just some basic things they expect you to do as part of your job. So there's a ton of pressure. For us, we provide critical infrastructure. So our customers put a ton of pressure on us

14:39 to be good because we're we could be the weak link connecting the bad guys to them. So the pressure is high. I think it's constantly a game of prioritization: trying to understand what your most critical assets

15:09 are and matching the vulnerabilities coming in, because there's way more than you can consume. This is where AI can help: here's the environment I have. "Here's my CMDB and all the versions of everything I have. Here's what's coming in on the threat feed. How do you triage that for me? Help me say, this thing over here looks like something you have over there, and put it together for you." And you go after the things that you think are the most important.

15:40 You put a lot of protection around them. Despite the fact that we sell network security products and still think they're very important, we know the network alone can't secure the inside. So we run a zero trust architecture. We do a lot of things to try to minimize the visibility of any piece of the attack surface to the outside world and understand who is using things.

16:11 But it's a constant race. If I thought about it as much as I should every day, I probably wouldn't sleep at night. By staying focused on that core set of things that are most important, and trying to minimize the attack surface by creating microsegments between the user and any given application they're using,

16:43 we're hoping we can stay ahead of them. And that the other thing is we always like to say that, these guys who are out there attacking, some are going after some very specific things. And so there's a certain set of threat actors that are interested in us for a certain set of reasons. But we just have to be that much harder than the next guy to break into. And so we're trying to stay ahead of our peers on that too. Right? And really be at the forefront of

17:13 where security architecture is going so that there's, as they say, people closer to the bear to be caught. Blake Thompson Heuer Right. Go ahead, Mark. Mark Kuhr It's quite a heavy burden to triage all that, especially with the massive infrastructure a company like Juniper has. It's a lot to triage. At some point, an analyst has to dig into the findings that scanners are turning up, or the security bulletins you're getting, and see whether those are applicable.

17:44 Synack's approach is to launch a triage agent system that uses a multi-agent approach to see whether those are applicable. It's a first level of triage, then it surfaces those to the security engineers to say: "This is our first pass, but this is where you should start," and work the remediation angle from there. The reality is that there are too many to look at all of them in depth. We need more help and more analysts. We can scale these agent systems to

18:16 meet the need, so they can do many things in parallel. I think the real power is going to come in augmenting the existing security workforce. It's not necessarily a replacement story. Most security teams are underwater going through all this information. If they can have agents do the first pass and take a hard look at the criteria by which things should be prioritized, specific to that business and architecture and tailored to the

18:49 workflows enterprise security teams are used to, the agent will become an extension of the team. You can scale that team up at very low cost compared to hiring people. Visibility, automation, and guardrails Blake Thompson Heuer We heard it from Sharon earlier that, notion of keeping one step ahead of the bear. one step ahead of the next person also racing against that bear that represents the adversary in this case. And the prioritization piece that you mentioned as well, Mark, is just essential to that. If you know if you have at least a sense,

19:20 a starting point of where to really just start the real hard work that goes into securing large enterprises like Juniper Networks, that makes all the difference. And if an AI agent can help with that, well, I expect we'll hear a little bit more from that from our senior vice president of product a little later in this webinar. So, but what can organizations do broad based here to avoid falling behind in that race that you described, Sharon? Like, what are the steps that someone who wants to be more proactive, should take when assessing their security posture in the

19:52 AI era? Sharon Mandell Well, again, I think the first thing you need is always visibility. Right? So you have to understand what you're trying to accomplish, what your most important assets are, and then you need as much visibility to the events and the data that are going on as possible. This is the approach Juniper took with the network. Right? Was,

20:22 elevating that control point away from any individual device, but into a place, into the cloud where you can see what's going on everywhere, collecting consistent telemetry, being able to recognize things that are out of the norm. And I think all of those same steps that we did to make it possible to better manage your network are the same kinds of things that you're going to do to recognize

20:53 anomalies and behavior patterns in the security space. When things change, did they change because of an intended change, or were those changes unexpected? If you have that picture of what's happening with intent versus what's not expected, that helps with the prioritization Mark talked about.

21:27 You don't focus on things you knew were going to change; you focus on the unexpected things. It's figuring out how you get that definition and data of what normal looks like, and how you communicate the changes you're making into the systems and data, so the technology and these agents can help with the things

21:59 that aren't expected and first highlight them to you. Ultimately, this is where the human in the loop comes in. You might not trust a technology to take action on your behalf without human in the loop for a while. But if you find yourself knocking down that same alarm over and over again, then, you start to allow and develop that trust in the technology so that technology can take action and you get that scale that Mark talked about,

22:31 without adding more people, and get your people focused again on that more strategic work. Blake Thompson Heuer Right. Right. Mark Kuhr We'll get to that point where the rate of discovery is so high that you're going to have to automate. Look at what's happening in warfare. I think it's an interesting analogy. You've got the war in Ukraine going on, with drone-on-drone attacks and counterattacks. It's too dangerous a battlespace for humans to operate.

23:03 At some point, you're going to have to let the machines attack the machines. And, that's where cyber is going. And so if you look at how, organizations can stay ahead of this, they can automate remediation, they can automate detection, move to continuous testing, start to embrace AI initially for triage, then move to, full mitigation and then eventually remediation. But this is obviously going to take a lot of guardrails, a lot of testing, and a lot of final approvals.

23:33 Initially, start with a human in the loop. Eventually, we're going to get out of the way once our test cases are so robust that we're saying, yes, it's good. It's going to handle 80% of the problem. Great. Humans will focus on the 20% of edge cases. This is the way it's going. I think it's the only effective way to mitigate the changing threat landscape, especially if you believe all the hype around AI agents and what they can do from a discovery-of-exploitable-vulnerabilities perspective.

24:03 They're getting quite robust at doing this. And so I think we could really see this changing landscape in the next two to three years, and we're going to have to adjust. The way that we've operated the last twenty years is not going to work. You just can't keep up. People can't do it. Sharon Mandell When Mark talks about guardrails, you're going to trust AI to make changes just the way you trust people to make changes. You're going to expect it to be able to back out those changes,

24:33 recognize when it made a mistake, and adapt. To his point, this is no longer a linear system that only goes in one direction. You're going to have different types of agents: the ones that take action, the ones that validate that those things behave the way you expected, and the ones that can return it to a previous state if not.

25:03 Right now, we're so focused on learning how to do the action that you don't hear a lot of us talking about those other things. But just as we had to do that with software developers in the human world, we're going to have to do that in the agent world too. The next frontier for AI agents Blake Thompson Heuer Mark touched on this a little bit, and I did appreciate the analogy of the drone warfare that we're seeing really on the literal frontier with the battle between Ukraine and Russia, but also the, proverbial frontier for physical warfare. What is that next frontier?

25:33 And this will be the last question because I know a lot of our webinar attendees, I'm sure, are eager to get to the demo portion. But what will be that next frontier for AI technology in the vulnerability management space, say? Sharon Mandell I think it's getting to the point where humans and agents communicate with each other in the same way. When we were talking about chatbots before generative AI and I

26:07 started to become familiar with our technology, we had always had a chatbot in it called Marvis. I'm watching ServiceNow build this technology where different people can come in and be in the war room. I'm thinking: now you have the agents, the bots, as first-class citizens in that war room. I don't think it's long before we're literally being snarky and joking around with the

26:38 agent in one of those war room conversations. I think that's the first thing is, when does that agent become trusted enough that you expect it to communicate with you almost as if it's not different than who you are? But it's faster with a bigger base of knowledge than you can keep in your head, who can see things and offer you ideas faster than the people can come up with them. Because we just can't process the volumes of data that

27:12 security and networking use. It's just not within humans' capacity to consume it in real time. And so that's where we need that technology to help us out. And I think that's it's agent on human in a room like we are right here having conversations. Right? That's, for me, the frontier we're going to have where they're giving us advice. Blake Thompson Heuer Mark, any closing thoughts? Mark Kuhr Beyond vulnerability management, I think it impacts just about everything in cyber.

27:43 I think all these agents will be onboarded like an employee. They'll get a Slack or a Teams account. They'll get a full identity. They'll be trained in a certain job, maybe multiple jobs, and be given context about your business and how you operate: how your systems work, your architecture, your deployment process, your patch review, your QA, all that stuff. I can see shadow teams being developed that are agent teams with humans in the loop.

28:13 But at some point, some portion of those workflows will be handed off to the agent. When we build enough guardrails, enough trust, just like we do with automation today. Like, we have automated tests when we deploy code, and it somebody merges a change, it passes the test, it automatically gets deployed. All that happens. Right? So the next evolution of that is a higher level analysis, taking into account maybe multiple systems and multiple signals. It's a bit more sophisticated and requires less explicit engineering, which means more processes can be extended to it.

28:45 And as you as it doesn't require, complex coding and everything like that, and you can just chat with it and it takes actions, through tool connections, you're going to find lots of use cases. And we're going to we're going to be in a place where there's so many different AI systems and workflows set up. We're going to be wondering how the heck we QA all these things and how we validate them and secure those workflows too. So this is where it's all going. But, at the end of the day, we're going to have to move faster. We're going to have to make continuous testing a staple of

29:17 how we do everything because the world is constantly changing. When we find things, we're going to assess them with agents and push them up in priority if they're valid findings. That will eventually connect into remediation, and we'll find ourselves in a place where some things are fully automated from detection to validation to remediation. Blake Thompson Heuer We'll have to pick up the conversation again in a few months or years. We'll see. This technology moves so fast. Who knows? But, Sharon, Mark, thank you so much for joining the webinar.

29:48 I'm sure the viewers really appreciated hearing, insights from the front lines of security leadership here, really. So thank you. Product demonstration: Active Offense and Sara Triage Following up on that fascinating discussion on the nature of the agentic AI threat and how security leaders are responding, Synack's senior vice president of product, Jeff Barker, will walk us through how Synack is tackling this problem head-on, with a demonstration of some of the technology Synack is deploying for our customers to help them meet this

30:21 threat at the speed and scale they need. Jeff, the floor is yours. Jeff Barker Today, I'm going to walk through and give you a real view into Active Offense: AI-powered vulnerability risk analysis. How can we use the power of AI, driven from this platform and continuous approach, to understand which of all our vulnerabilities are truly exploitable? So, again, it starts with attack surface, continuously discovering and monitoring your external attack surface,

30:54 and I'll walk you through this process in the product live. Next is integrating my scanned vulnerabilities. I have tons of vulnerabilities that have been scanned, ranging from really critical to low importance. I'm not really sure from the results whether a vulnerability is truly exploitable. I may have information from my vulnerability management platform that says there's some risk: it's on a KEV list, or it's being talked about in an online forum.

31:28 I'll have some indications of risk level. But then we add exploit and vulnerability intelligence into the mix and have Sara Triage autonomously attempt to validate the exploitability of those vulnerabilities. That's the key step. Now we're going from these thousands and thousands of vulnerabilities to hopefully a smaller subset. Right? We're looking for the signal in the noise.

31:58 Having the agent autonomously validate whether something is exploitable is powerful. I can get a shorter list that I can act on. When Sara Triage does confirm it, because it's built into the platform, you have direct access to humans to validate. You can push those exploitable vulnerabilities into the right processes and take the right action. That gives you a sense of how, when you take agentic AI and fuse it with humans in a

32:30 platform, you can start to build a solution that helps you get ahead a little bit. In today's world, I know that's easier said than done. Let's transition to the demo, and I'll show it to you in action. Discovering assets And like we talked about in the previous diagram, really, everything starts with a view of your attack surface. And so this is the asset view in the Synack platform.

33:00 And this is where you would initiate a discovery. So this is the configuration view. Once I've initiated it, I can run it manually or I can set it up to run continuously. So I'll show you show it to you in process. So what I want to do is create a seed group. I come here and name the group. I can apply role-based access control to this specific set of discovered assets. I can define what I want to discover.

33:31 I could start with a domain, an FQDN, a CIDR block, and so on. In this case, I'll start with a CIDR block, and I can enable this to auto confirm the asset. So I want to bring it right in. I want to confirm it's mine and get it into a spot where I can act on it quickly. So let's go ahead and run the discovery. Now this came back really fast. We did this for the demo purpose. Your results won't come back this fast. Depending on the scope you've entered in your discovery seed, it can take several minutes to come back.

34:02 Now I can view the discovered assets. I come up here and select the asset list, so I'll do that. And what you see here is the assets that have been discovered that were part of that CIDR block. And you can see there's additional information. This is the analytics that's been added to the discovery data as it comes in, trying to make it more actionable for you. So you can see we've looked for open ports, and we know what provider, in this case, GCP, etcetera, it came from.

34:33 So I have my assets in that I want to run Active Offense against. Importing scanner findings Now I want to go up to my settings and configure a vulnerability source. So I can scroll down. In this case, I want to connect to Tenable. So I want to leverage my Tenable scan results to run Sara against. So I can come here and enter the required information.

35:03 I can select which vulnerabilities I want to I want to import, critical, high, medium, low, etcetera. If you have tags associated with those with the Tenable results, you can filter on those tags. I can enable both a daily import or a onetime import. And in this case, I'll just run a onetime import. So I ran that import again for the purposes of the demo. It came back quickly. And, let's go back in and look at our vulnerabilities.

35:34 We're dropping into the vulnerability view, which is a standard view in the Synack platform. This is the verified exploitable vulnerabilities view. This is what you really are interested in seeing. We don't see anything here yet. If you were running standard pentests from the Synack platform and had exploitable vulnerabilities, you'd see them in this view as well. We're bringing together the results of our human-led testing with the emerging agent-led testing

36:06 we're going to do as well. In this case, I want to come up to my scanner findings. And what I see here is the list of vulnerabilities that have been imported for the assets that have been discovered. So you see that correlation exists. The source is Tenable. Submitting vulnerabilities for triage And the current status is not triaged. So I can click on any one of these vulnerabilities and get more information on that vulnerability. In this case, I'll look at this PHP remote code execution vulnerability.

36:36 You can see the status, what it is, what threat intelligence exists on it, and other information. I'm going to submit this for triage. I'm doing this manually to show you all the steps. There will be capabilities to automate all of this so you don't have to click through each vulnerability. I just want to show you the flow. I'm going to submit this for triage. You can see the status

37:07 for this specific vulnerability moved into Sara review. The Sara agentic AI triage capability is reviewing this vulnerability to see if it's exploitable. Let's look back at the findings. For this specific vulnerability, we're in agent review now. There are some additional views into this. I can look at clusters. So one of the things that we'll do is we'll cluster, CVEs.

37:37 So this specific CVE is associated with, three assets out there. So I can also come here and select this cluster and submit it for triage. And, again, it's pushed, that vulnerability out to Sara to verify the three instances of that vulnerability. I can look at the clusters. The idea is that we can toggle between different views to give you more actionable ways to engage with this.

38:10 We can look at the kernel, or maybe I'm concerned about OpenSSL. We can offer those views. Let's go back to our unique vulnerabilities view. You can see some of the statuses have changed. So now we've got that PHP vulnerability we submitted as exploitable. We've got one that's in Synack review. Evidence, guardrails, and human review So I can go into this specific vulnerability. Here you'll see proof-of-work information on this vulnerability.

38:44 What did the agent do? What did it find? What was its assessment of the risk and impact, its conclusion, and its recommendations? We want to offer not just a statement that the vulnerability is exploitable, but evidence you can use to understand what the agent did and start that human assessment: do you care about it, and how urgent is it for you? We can go back to the vulnerability list.

39:14 Across the top is a general view of the status of all the vulnerabilities. You can see we have 365. We have 346 that are not triaged and 15 that are ineligible for triage. One thing we believe is important is having guardrails around exactly what Sara does. There may be vulnerabilities outside the defined rules of engagement.

39:44 For example, denial of service. You may have a couple denial of service vulnerabilities that you probably don't want Sara to go assess, and introduce a denial of service challenge for you in the infrastructure. So you'll see those things ineligible for triage. Once we go through an agent review process, it goes through a Synack review process. The Synack team will review it as well and provide that first level of human assessment.

40:16 Then that can optionally go out to our testers to take additional action. You can see I have one that's exploitable, and I can click on that to zero in on it. Let's click through this exploitable vulnerability. Sorry, let's go back. Remediation and verification Let's go back to the verified exploitable vulnerabilities. And so now you see here where we started, I have this, exploitable vulnerability in the list,

40:48 and I can click through that and get detailed information on the vulnerability. oftentimes in our industry when we have the results of a pentest come back, the information isn't always, helpful to a software developer to develop a patch. We want to really change that here so we offer very detailed views into the vulnerability. So what's its impact? What's its location? What was the HTTP request? What was the steps to reproduce?

41:20 What was the recommended fix, etcetera? So we're really trying to provide much more actionable information to your teams that actually have to remediate this vulnerability. Then we can look at the workflow. Maybe we want to transition this to a closed/fixed status because we've deployed a patch and remediated the vulnerability. I can select that and push it out to a human for verification. I can submit that verification request through that patch request.

41:50 It will go out to a human who will confirm that you've successfully remediated the vulnerability. That's a nutshell of what I wanted to show you: the process of going from discovery, importing vulnerabilities, and running through the Sara process to verify exploitability, then pushing it out to a human if necessary. Hopefully, this was helpful. Feel free to follow up,

42:21 and we'll be available to answer your questions. Thank you.

No lines match that search.