Meet the experts who power Synack’s strategic security testing platform. Our Synack Red Team unites over 1,500 of the world’s most skilled and trusted security researchers, who work with patented technology to deliver best-in-class offensive security testing on a continuous basis.
Mark Kuhr on AI pentesting and the Synack Red Team
Guest:
Mark Kuhr
Published:
Updated:
Duration:
36 min
Episode summary
Dr. Mark Kuhr, a former National Security Agency employee, faced a host of challenges when he co-founded Synack with CEO Jay Kaplan in 2013. As CTO for the security testing company, Mark has led Synack through dramatic growth while working to shift the mindset of some cybersecurity practitioners. For instance, the Synack platform, featuring access to security researchers around the globe, initially faced skepticism—a group of essentially strangers pentesting enterprise networks? Not the most convincing argument for CISOs. But through a trust-but-verify approach, Synack’s take on security testing has risen to prominence in the industry.
In this episode of WE’RE IN!, Mark explains how he recruited a community of global top hackers to join the burgeoning Synack Red Team – and what’s at stake as AI capabilities ramp up for attackers and defenders alike.
Listen to hear more about:
Mark’s predictions about the use of AI for offensive operations, including selecting targets and applying exploits
Synack’s FedRAMP Moderate Authorized status and how other organizations can secure approval to work with sensitive government data
How the integration of AI in cybersecurity is increasing the pressure on organizations to patch and mitigate vulnerabilities faster
Listen to the episode
S3 E7 · Mark Kuhr on AI pentesting and the Synack Red TeamWE'RE IN! Podcast · 36 min
Key takeaways
Enterprise networks fail at the basics Mark's NSA experience showed that large networks are easy to break into because organizations do not patch, and their penetration testing falls far short of what adversaries bring. Synack was founded to close that gap with an offensive force for good.
Trust but verify enables crowd testing Synack captures researcher traffic through LaunchPoint to see what is tested and confirm testers stay within the rules of engagement, combined with background checks and interviews.
LLM apps have many unhandled edge cases SRT researchers are finding ways around prompt-based protections in chat interfaces, made harder by agents that route requests across multiple models through frameworks like LangChain.
FedRAMP is costly and manual Mark said Synack's FedRAMP Moderate authorization took two years and easily cost over a million dollars. He advises companies to hire experts, pick the right audit firm, and choose a cloud provider carefully since many controls are inherited.
Speed of patching is the key defense Against nation-state prepositioning, Mark stresses doing the basics well and fast, while noting that critical infrastructure devices often cannot be rebooted or patched without risking downtime.
Topics covered
AI & LLMs
FedRAMP
Synack Red Team
Notable quotes
…it's incredibly simple to get into large enterprise networks, because people don't patch. They don't follow the basics.
That trust but verify approach has been key to our growth and key to to trusting these resources.
…the important thing there is to do do do the basics, but also do the basics really well and really fast.
So it'll be very important for us to design software systems that are AI based, that are predictable, that stay within the rules and do what we want them to do, not unilaterally make their own decisions.
Questions this episode answers
How did Synack recruit its first security researchers?
Synack landed customers before it had researchers, then recruited penetration testers on Elance and oDesk, hired people to find top bug bounty hunters, and used LinkedIn, email, and social media outreach. It soon had more researchers than work. Read this section
Can AI carry out effective pentesting?
Mark said we are probably already there, with AI agents able to select targets, use tools to run recon and exploits, and iterate in multi-agent frameworks. He expects this to grow quickly and urges defenders to use AI too. Read this section
What does FedRAMP authorization involve?
It is a highly manual accreditation process with checklists, compliance questions, and documentation of development and security processes. For Synack it took two years and cost over a million dollars. Read this section
How should critical infrastructure respond to threats like Volt Typhoon?
Mark pointed to public-private threat sharing through ISACs and other groups, plus hygiene: patching, tightening infrastructure, tuned monitoring, and faster patch cycles. Read this section
What is the quantum computing threat to cybersecurity?
Quantum computing could enable record-now, decrypt-later attacks, so moving to quantum-safe algorithms from NIST is a good step. Mark sees the bigger issue as quantum computing combined with AI producing much more capable agents. Read this section
About the guest
Dr. Mark Kuhr co-founded Synack with Jay Kaplan after both worked on offensive cyber operations at the National Security Agency. At the time of recording, he was Synack's chief technology officer and had helped recruit the Synack Red Team (SRT) of security researchers from the company's start. He also brews his own beer.
And welcome to WE'RE IN, a podcast that gets inside the brightest minds in cybersecurity. I'm your host, Blake Thompson-Heuer, and I'm thrilled to be talking today with doctor Mark Kuhr, chief technology officer and cofounder of Synack. Mark won't really dive into his background at the National Security Agency, but he is set to unpack the latest trends in artificial intelligence, nation state, cyber threats, and so much more. I might even ask him about quantum technology for good measure. Before we learn how Mark built the Synack Red Team of global security researchers from the ground up, let's hear a word about what Synack's been up to recently.
Confusion in the marketplace about which is the best method of security testing is so real. Bug bounty, pentesting, pentesting as a service, what do they all mean? We break it down in our latest playbook, navigating the security testing landscape to demonstrate the strategic value of third party security testing. We cherry pick the best elements across the security testing market to incorporate into a strategic, comprehensive pentesting solution, the Synack platform. Learn more at synack.com/playbook. That's synack.com/playbook.
Of course. Of course. So so as Synack cofounder alongside Jay Kaplan, you were really in the in the front lines of founder types who actually came from the government space and really brought a lot of their experience to bear. I'd be curious with your background at the National Security Agency, how did that inform your early experience standing up Synack?
Yeah. So Jay and I were at the at the National Security Agency doing offensive cyber stuff. We can't really go into much detail beyond beyond that. But one of the things you realize doing that work is that it's incredibly simple to get into large enterprise networks, because people don't patch. They don't follow the basics. You look at how they're defending their networks and the types of penetration tests that they're doing, and it's just woefully insufficient compared to what the adversary is able to bring to bear against those those targets. So, you know, Synack is founded to really solve that problem at scale and give you an offensive force for good. It's a way to to harness an offensive platform that will highlight vulnerabilities ahead of the adversary. And we do that, of course, with our Synack Red Team. And we go out and recruit the best hackers from all over the world, bring them onto the platform and and incentivize them to find these exploitable vulnerabilities.
And the goal is to accelerate that discovery time to be as as fast as humanly possible. And, of course, they'd be aided by, you know, automation and and AI as well.
Now back in in 2013, so Synack launches, you started this exciting company, have a great, you know, early investment. Have then you need to attract these hackers, the Synack Red Team you just alluded to. I I would imagine that that presented something of a a chicken and egg problem. I mean, you you obviously wanna have the hackers, these, you know, ethical security researchers vetted, ready to go to to help customers, but then how are you gonna attract them when you might not have as many customers? And how are you gonna attract customers if you don't... You know, you could see it going back and forth. How did you deal with that?
Yeah. Very much so. We landed a few customers initially without a single researcher on the platform, and then we scrambled at the last minute to find a few researchers. We actually went out on, well, at the time was Elance and oDesk, and we interviewed a variety of penetration testers and security researchers and found found a few there that we were able to recruit. We also hired some people to scour the internet and find the top bug bounty players. And we did LinkedIn outreach. We did email. We did a variety of social media outreach. We basically marketed to these researchers that we had an opportunity available. And so it quickly became the case that we had more researchers that work for them to do. And so that that created the other problems. How do you get enough work to satisfy the community of researchers that you have? So that's something we're always evaluating. And, you know, we're in eleven years of running this business now.
And we're always looking at that balance between the researcher community size and the number of customers and particularly the number of assets that are under management, whether that be, you know, host infrastructure or applications that need testing. And we're always finding that that balance. And if we need to retrieve more researchers, we'll do that. And if we need to, you know, dial dial up activity on certain assessments and tests, we'll do that too.
I imagine in those days too, it was... The conversation was very different. I mean, remember even in my early days covering cybersecurity in 2014, the notion of an ethical hacker was still somewhat new. And, you know, companies were wary of this, like, letting researchers just try to find these really sensitive vulnerabilities. Now I feel like it's a it's a pretty accepted facet of a of a solid penetration testing, red teaming program that you wanna... That... That's a that's a desirable thing. But you, you were probably on the front lines. What was dealing with that culture, that sort of more conservative corporate culture in looking at what Synack brought to bear?
It absolutely is a is a culture shift over the last decade, Blake. I mean, when we initially pitched this idea, I recall many investors telling us that that's a crazy idea. You're never gonna be able to do that. Who would trust these researchers with, with testing their enterprise assets and their customers' data? It was very much a negative feeling on, on the sentiment of involving a crowd. And, and so what we had to overcome was a way to build a technology platform that allowed the crowd to be harnessed, but also provide the insights and the analytics. So people started to trust what was happening with that crowd testing. And so we early on, we introduced what we call LaunchPoint. And LaunchPoint allows us to capture the traffic and do analytics around what researchers are testing and how they're testing and and making sure that that people are staying inside the rules of engagement as the tests are going on.
That trust but verify approach has been key to our growth and key to to trusting these resources. The researchers, you know, also come from a variety of backgrounds, but, you know, to get that trust level up, we also implemented background checks and interviews and and really try to get to know the researchers as best we can. And, you know, working with large enterprises, it does require you build that trust as a trusted process to do testing for someone. And that trust once eroded is hard to get back. So we try to try to bring that trust factor forward from the initial conversation all the way through the testing process with our researchers. And and it's ingrained in that culture of of the Synack Red Team to always stay within the confines of that rules of engagement so that we maintain that trust with customers.
Synack Red Team is growing into a variety of variety of areas. I mean, lately, it's been on the AI front testing LLM based applications, you know, the boon in the last year with ChatGPT launches every, every large company or even small companies are launching ChatGPT based apps or LLM based apps with a lot of chat interfaces. And the chat interface is is not as simple as something that's just a well defined API interface. So, you know, what we're finding is that researchers are testing these LLM apps and finding ways around the prompts and finding ways around the protections that that people are putting in their apps. And essentially the protections are, you know, prompt engineering to make sure that the prompts aren't are that the LLMs are not giving up information that they shouldn't be giving.
So that's a... It's a really interesting cat and mouse game that's going on right now with the developers of the applications and the researchers. What we're finding is, you know, there's a lot of edge cases that are not being handled yet as people are very new at developing applications around these these AI ecosystems.
It definitely seems like a greenfield area for... I I remember reading there was some research, I think some Google researchers released with, like, prompting one of these large language models with the word poem over and over again, and then all of a sudden, yields data that it shouldn't. And I'm just like, how does that happen? Like, what is going on here?
And we've got a we've got a myriad of those cases that are similar to that that I that I can't go into here, but it's... There's a lot of prompt manipulation and prompt escapes that are happening on these chat interfaces. And it's it's really interesting stuff because the underlying models are also very different. So you've got a variety of models from an Anthropic open API... OpenAI and Google's Gemini that all behave somewhat differently under the hood. And and then there's the open source models as well. You've got Llama out there. You've got, of course, Mistral and and a variety of of models on the Hugging Face ecosystem too. So it's a it's a really interesting time as people, you know, build agents that are chat interfaces, but also interface to multiple models back in the back end as well. So if you use a framework like LangChain to develop out your AI agent, you can you can have it include a variety of models.
You can have it go down different paths based upon the prompts. It's really an interesting time, but the complexity is such that we are finding ways around the protections in some cases.
Speaking of AI agents, do you think that AI will grow powerful enough to carry out some effective red teaming pentesting activities? And and and what timeline would that play out, and what might that look like?
Yeah. It's getting to that point. I... I'd say we're we're probably already there. And, you know, if you're not using this for defense, you should be. You should be using AI for defense, especially because the offensive side of the house is gonna start cranking up the use of AI for offensive operations. And that could be, you know, selecting the best target, going through a lot of data on an organization's assets and finding the best target and the optimal, you know, entry points, the optimal application of exploits, the optimal way to to to come at an organization and and exploit it quickly. And then the AI agents, you know, can also get to the point of using tools. So they're also using tools to throw exploits, to do recon, and and gain access. And then they're... If you have a multi agent framework, you can even start to get these agents talking to each other and iterating on their techniques for gaining access.
So it it's certainly an exciting research angle. If you read the latest research on this, there have been papers published on, you know, agents, AI agents finding vulnerabilities and breaking into applications. This is just the start, but I have a feeling, you know, we're gonna see this explode in the next couple years.
I wonder too what can be accomplished with like a centaur chess type model. I don't know if you've heard of centaur chess where you have the top chess players pair up with the AI engines, which, of course, have been able to beat humans for many years now. And it makes actually the... Basically, the strongest chess player out there because you have the long term strategic vision of the human paired with the tactical genius of the AI. Do you see that something similar evolving in the pentesting space where you have Synack Red Team members, for instance, leveraging AI to become more effective?
Absolutely. Absolutely. We're seeing that. We're seeing people use use that AI agent as... I call it human in the loop AI, and that lets you get the best of both worlds, like, as you're as you're talking about, Blake. But, yeah, that's that's super important, and that's where that safety mechanism is gonna come in as well. Human in the loops as making those critical decisions around should I go forward and throw a certain exploit? Should I do this or that? Making ethical decisions, if you will. But yeah, this is this is certainly an evolving space. And I think you're you're gonna see a lot of offensive tech come come forward very quickly, as it makes it more efficient to carry out attacks at scale, if you're just automating it. And so we've we've got a long history of the usage of worms, and automated worms that propagate themselves and exploit and spread right all on their own.
That coupled with AI though, can yield a very powerful weapon in the cyber domain that that is more intelligent than what we've seen in the past and makes decisions that are on the fly very, very smart. Whereas in the past with these worms, they were very dumb decisions. They were just, you know, they get access, they'd scan, they'd jump to the next hop if it was there. These are gonna get much, much smarter, especially as we look at, you know, how agent and AI embedding tech comes along. So you'd have to carry the whole model with you. And you can start to embed pieces and and logical logical pieces with it so that your your malware is bringing along all that intelligence along with it. So you've essentially got what is what is pretty close... Gonna be pretty close to a human operator along the way, but at scale, probably doing more more effective exploitation than we've seen in the past.
So as as attackers leverage AI to carry out some of their breaches, you know, your CTO, Synack, your... The buck falls with you for the defense of a lot of these networks as well. How do you prepare a platform, you know, against these threats, especially a platform that's designed specifically for essentially hackers to operate on? So not only do you have... I know I know Synack Red Team also constantly probes our own network for vulnerabilities.
So Yeah. I think there's there's two sides of this for us. Right? So we want to enable those offensive workflows. We're we're leveraging a crowd of offensive security researchers that are out there to find vulnerabilities ahead of the adversaries for our customers. And we wanna enable them to operate at scale using AI technology where they need to, but do it in a safe manner. So we're looking at how that can be applied and what frameworks and toolkits we can provide that allow them to build upon that and operate within our ecosystem so we can leverage AI in a safe manner to accelerate that discovery time. And then on the flip side, on the defensive side of just, you know, you're you're gonna see AI embedded into all the SIEMs. So your your security incident and event monitoring systems are gonna be embedded with AI technology that allows them to mimic what a SOC analyst would do.
So when an alert comes in or they see a certain pattern in the logs, the AI is gonna take certain actions for them. And and so what you're seeing is that the acceleration of the pace, and that is gonna put pressure on to organizations to patch faster, mitigate faster, just everything in the SOC is gonna accelerate. And so it'll it'll it'll eventually get to a place where AI will be taking the first action on most things, and then escalating to a human if needed.
So to switch gears here for a second, Synack recently got FedRAMP approval at the moderate authorized status. Now, for those unfamiliar with the FedRAMP process, it might not sound like such a big deal, FedRAMP moderate author... Authorized, but it it really is quite intensive, and I I would be interested to hear your frontline thoughts about the work that went into getting that approval. What what had to happen?
Yeah. Oh, the FedRAMP process is the process by which companies go through to get their software accredited for deployment at certain levels within the US government. And then that is designed to have a standard level of of care from a security perspective. So there's a lot of checklists. There's a lot of compliance questions that are asked. There's a lot of documentation around your internal processes for software development changes and your security ecosystem. How are you keeping your products secure? And so, you know, it's a it's a complicated process. They're actually going through a modernization to make it more streamlined. But the current process is highly manual, a lot of paperwork. And I'd say for any company going through that, you've really got to have experts on staff that know that inside and out and can work with the government to get you accredited. It's it's quite a lengthy process.
As you mentioned, it took it took two years and it costs, you know, I'd I'd say it's easily over a million dollars. And and so, you know, I think there's two sides to that coin. One, it's effective. Is it effective, you know, to put companies through this so they can work with the government? Two, is it too burdensome and too costly for small business? And so I think there's a there's a happy medium there between that. We could probably spend an hour on on FedRAMP modernization, but there there does need to be some way for for companies small who can't afford that to work with the US government and do that in a safe way. And I think that that that's gonna evolve and change over the next couple years. But for any company right now going through the process, I would just say, strap in, get prepared, hire the right experts, get the right audit firm, and, you know, make sure your ducks are in a row.
We were asked by a customer to go through it. We're deployed in about 25 different federal agencies today. We do penetration testing at scale for a lot of lot of government agencies. And one of our customers said, hey, it'd be great if you guys could get FedRAMP so that you're more compliant with policies that are being put down from the administration to use more FedRAMP certified products. If you go to the FedRAMP marketplace, you'll see it's a very small list of products that are actually certified. And that's because the process is very arduous, and it's very difficult to get get accredited and maintain that accreditation. Part of this modernization process, though, is going to be, you know, how do we do this in a more automated fashion? How do we use the right frameworks, deploy to the right clouds to have the right compliance regime? Because if you're in a public cloud environment, you're going to end up inheriting a lot of controls from that public cloud, and you're going to share that responsibility of meeting your security obligations with your public cloud provider.
So it's really important to choose the right the right partner on the journey. So we could... We should probably do a breakout on that whole that whole FedRAMP topic.
More more to come. Sequel on the the FedRAMP situation here coming soon to a a podcast near you. I I did wanna share a quote from Miriam Grace McIntyre. She's executive director of the US National Counterintelligence Security Center. And at a conference in Texas recently, she said, quote, the People's Republic Of China today represents the broadest, most active, and persistent cyber espionage threat to The US. The PRC also remains the top threat to US technology competitiveness, end quote. It was a bit surprising to me given all the buzz around the threat posed by Russia and, you know, the hybrid war going on and Putin's invasion of Ukraine. What do you see as the biggest nation state cyber threat facing US interests right now?
I mean, they're they're both substantial. I think Russia and China both are substantial, you know, adversaries in the cyberspace. China, you know, and Russia both have unique capabilities. But I think the important thing here is that they're in cyber, you have to preposition a lot of your capabilities, right to it. So if you were gonna, you know, invade a country, you know, and you wanted to shut off their internet, You can't just do that. You can't you're not going to just just shut it off without some pre positioning activities. Right? So, you know, what you're seeing here from China and a lot of the alerts is that they're pre positioning capabilities, malware, if you will, into our networks at scale, finding ways to hide in the noise. And they're prepared to take action if if they need to. So I wouldn't say that there's an immediate immediate threat.
But there's certainly prepositioning and being prepared to take actions against, know, critical infrastructure, whether it be power grids, water treatment facilities, those kinds of things. And they're not the only actor that's doing that. Right. There's a lot of actors in the space. But yeah, we're seeing a lot of those those activities. And it's it's important that, you know, companies start to look at, you know, how they're how they're securing all this infrastructure from the ground up, you know, whether it be supply chain attacks on the hardware, the software, or it'd be, you know, running the latest latest software from the infrastructure, your routers, your firewalls, all the way up to your apps. Adversaries are looking, they're probing all the time. And China is no different. They have a very both China and Russia have very professional offensive cyber units, very similar to, you know, The United States. And there are people that are paid to to break into these, these organizations, and that's their full time job.
And I I think a lot of people underestimate the power of that when you're you're putting thousands of people in employ to do this every day. That's that's their mission. There's dedicated resources at the nation state level of many countries out around the world now to do this type of work. And that raises the stakes for for commercial companies who have to have limited budgets compared to nation states and limited resources. And so, you know, I think the question remains, like, how do you keep up with a nation state? And I'm not sure that that's actually possible, but you can make the best effort. And the important thing there is to do do do the basics, but also do the basics really well and really fast. And that's that's what we're seeing these targets of opportunity are popping up, and it allows the adversary to get in. For example, you know, you've got the Avanti firewall VPN issue, where, you know, you've got CISA releasing guidance that this should all be all be patched urgently.
They didn't patch it fast enough themselves, and they became a victim. So I think there's, there's some lessons learned there on speed. And I think that's, that's really the takeaway for me as we introduce more AI into this whole cyber realm, is that the speed and the pace of operations is going to increase dramatically.
It's interesting too that CISA, you mentioned the cybersecurity and infrastructure security agency. They have also been sounding the alarms recently about this particular PRC sponsored cyber espionage group, Volt Typhoon, doing exactly what you just described about prepositioning preparation for the battlefield, trying to lurk in critical infrastructure networks, getting ready to pivot to some of those operational assets in the event, you know, for whatever reason, maybe China invades Taiwan, maybe The US relations sour to such an extent that that needs to be triggered. How do... You know, you alluded to this somewhat, but how do critical infrastructure organizations... How can they respond to that?
There's a lot of people focusing on, you know, the collective defense and IoT space. So you've got, you've got to share, you've got a lot of sharing agreements going on between the government and the private sector. I think that's a good thing. As much as we can get out to the commercial sector saying, this... These are the threats we're seeing. These are what the the techniques and the tradecraft of the actors. That's gonna be critically important. So government sharing with what they can with the ISACs and the different sharing groups out there, that's that public private partnership is going to be critically important, because they're going to see things from from the global Intel system that commercial companies don't have a chance to see. Beyond that, you know, I think hygiene, it's comes down to hygiene, you know, patching, getting your getting your infrastructure as tight as possible, and you're monitoring really tuned up and introducing, you know, and accelerating faster patch cycles.
For example, like I was just talking to a friend who works at a big bank this week, and, you know, we were talking about some of the ways that the adversaries are prepositioning in some of the infrastructure pieces, the routers, firewalls. And it comes up that, you know, some of these some of these devices, they can't be rebooted easily without an outage, and they can't be patched easily either without risk of downtime. This becomes a substantial blocker to, to people patching and staying current on latest software across that critical infrastructure. I mean, you're, you're the IT manager for, you know, a certain set of the data center, do you want to take the risk that you cause an outage when you reboot a firewall to apply a patch? How do you verify that you're running the right firmware version? How do you verify that that firmware hasn't been modified? How do you verify that that, you know, all of this traffic that's flowing through the network that looks innocuous is actually innocuous.
When the adversaries are known to hide in the noise. It's a very hard problem. This is this is very tricky. And this is why, you know, that we have the problems we have, like, just out of date software, you know, a lot of lot of that, but also a lot of trepidation with changing the way that we operate these networks, because we're trying to avoid downtime in these systems that manage banking, water, power, you know, it's a hard problem in IoT. Oh, absolutely. With a lot of critical infrastructure that is not designed to be rapidly patched and not designed to be patched without downtime. So we have a we have a challenge.
And we saw how costly an outage can be a couple years back with the Colonial Pipeline cyber incident. And, you know, in that case, obviously, it was a much noisier threat actor going in there with some of the ransomware angles, but it was... I mean, gosh, the amount of contracts that just went belly up from that with with oil and gas deliveries and... Well, particularly fuel, jet fuel and gasoline deliveries that were just all along the East Coast. I think it would supply something like 50% of the East Coast fuel needs, which is just absolutely ouchy on a on a on a financial dashboard there. And not to harp on China too much, but they are investing billions of dollars in Beijing into, you know, quantum research and development. And right now, China holds twice as many quantum related patents to the extent that that is a is is a is a good metric, maybe not, but as The US. And that, you know, includes quite a bit of military applications, but also has some security implications.
Yeah. I think the quantum quantum threat comes into two areas. One, people are thinking that, you know, quantum computing can help with decryption. Right? So if we can we can have more compute power, we can record data now and decrypt it later. Right? So there's a lot of people moving to quantum safe cryptography, and that's probably generally a good move. You need to you need to move to safer algorithms. And NIST actually has worked with NSA to to come up with a couple that they can they can broadcast and you can use. And then so there is a path to using quantum safe crypto already, and a lot of large organizations are moving to that. And I I think it's a good move for ever. You know, in general, though, you know, I think the bigger issue is quantum cryptography is gonna enable compute on a far more capable level. And if you couple the quantum computing with AI, you end up with very powerful AI agents that can handle a lot more processing than we're doing now.
And so you're gonna end up with think AGI, artificial general intelligence on top of quantum computing in the next ten years that that could change the landscape of of how capable the AI agents actually can be in real world scenarios. I think we can also see that, you know, the basic GPT-four models today are certainly, certainly smarter than any human given the data access that they have. They can they can conjure up. But if you couple that with the ability to reason at a large scale and multiple agents conversing and quantum computing to help process all this data and analyze, you know, questions that come up, you know, to do deep analysis on data sets, that's gonna be really powerful. And I think the military applications of it are really interesting too.
I mean, you're already seeing some of this deployed today with with the NGA and some of the spatial spatial data that we have. So for example, from a targeting perspective, if you have satellites, you have spy planes, you have different things taking imagery over over a country. You know, it's it's used to take human analysts with with magnifying glasses to identify tanks and planes and count them and all this stuff. And all that now has been, has been automated. And all that goes to image recognition software to pick out the various pieces. And the next leg of that is, you know, after you select the targets, you're gonna, you're gonna send them off to, to some operator and he's gonna click accept for a kill mission. And you're gonna be able to tie that right into the command and control systems of the drones and say, hey, you know, we've got identified, you know, 10 targets.
And there's gonna be some some military officer who's gonna click accept, accept, accept on all those targets, and the drones will go action it all through the command and control system at at, you know, really, really fast picks, really fast speeds. This is the next stage. And it's going to be to the point where I think with China and everybody thinking about what happens with Taiwan, you're going to get to the point where the battle space is such, such a fast paced battle space with AI driving target selection, target identification, prioritization, weapon selection, you know, identification of who's the best drone in position to take the strike. You're gonna get to the point where that battle space is so fast paced and so dangerous in the, in the, where the action is happening that humans can't operate in that space. So you're going to push the human operators further out.
So you're gonna end up with a bunch of standoff, you know, human planes driving drones. And if you look at, look at, look at the way this plays out, that pace of operations is going to accelerate dramatically. Just like I was talking about in the cyberspace, this is going to happen in warfare as well. And then combining the effects of not only the kinetic warfare, but also the cyber warfare, you end up with a very, very strange place where you're attacking targets, not only that are infrastructure targets, but military targets, and also space assets at the same time to take out communications that are driving all this intelligence at the same time. So it's going be a very interesting time. I do see a place where most of this is automated to a high degree, except for, you know, the point of clicking accept and taking a shot. I think we'll reserve that for human operators and human decision makers.
However, the AI AI is gonna get really good at recommending targets and priorities. And so I think we're we're not far off from models that are that are pretty high confidence on things that we should do. And if the pace accelerates to the point where we can't tolerate that human in the loop, I can see us pushing the envelope in certain cases to automate the target selection to target kill decisions and make that loop really tight.
May you live in interesting times as the old saying goes. Right? And there are a number of things that both fascinate and concern me about what you just said, not least of which is the notion of already we're struggling with AI black box scenarios where you don't necessarily... You can't necessarily audit or probe why a machine did what it did, or at least you can't with as much effectiveness as you may have once been able to. When you're talking about automating that entire chain and throwing quantum into the mix, I mean, that's just... The black box problem becomes seemingly insurmountable because no human's gonna be able to understand an AI operating on that kind of level.
Well, well, yeah, we're gonna need... Right now, there's way too much nondeterministic flow... Call flows in these agents. Right? So if you you ask ChatGPT a question, you know, and then you ask it another question a few minutes later, that's the same content mostly. It could take a wildly different path, right? It can give you a very different answer. You end up with hallucinations as well. So there's a lot of randomness that comes out of these models that's gonna have to get teased out. Right? So you're gonna have to eliminate that. You're gonna have to put guardrails around it either with prompts or challenges and or develop new models that are more that have the the controls baked into it. So I can see us developing out a lot more controls and wrappers around these these core models that make it a deterministic outcome and very predictable, something we can test.
And then I think you put guardrails around, you know, obviously kinetic action, any anything involving human lives. You're gonna, you're gonna want to keep humans in the loop for a long period of time. But, know, if the pace, if the pace accelerates, I can see us setting our, you know, cyber defenses on auto autopilot, for example, like, hey, you know, SIEM, go ahead, take whatever action you think is best. And then let me know how it goes. You know, I think there's we're getting close to that point with some of the copilot operations that are out there. And then I think in the battle space, that's going to be a fast evolving place. Defense tech is getting a lot of investment right now. And, you know, the pace at which drones and drone swarms and, and all the signals need to be correlated, combined, synthesized and actioned. Especially if you think about the speed of, of hypersonic weapons going at Mach 20.
This is this is going to have to be automated pretty quick and humans will not be able to stay in the loop forever. So it'll be very important for us to design software systems that are AI based, that are predictable, that stay within the rules and do what we want them to do, not unilaterally make their own decisions.
Well, I think we learned we could talk about FedRAMP or AI at some considerable length here, but I do wanna move on to the final question that we ask of all of our podcast guests, which is what's something we wouldn't know about you by looking at your LinkedIn profile?
Yeah. That that is... I'm sold. Sold. Well, thanks so much for joining joining me on the podcast here. Really fascinating discussion. I think certainly a lot, a lot going on in your world, so appreciate the time as well.
Appreciate it. If you liked what you heard today, I hope you'll give us a five star rating and review. It's a big help. And please share this episode if you know anyone who could appreciate a little info sec wisdom on their morning commute. We have a whole catalog of episodes well worth a listen, so you may wanna check out past interviews as well. Finally, if you know someone who might be a good fit to appear on the podcast or have any comments or feedback, drop us a line at we'[email protected]. That's s y n a c k dot com. Until next time.
WE'RE IN is brought to you by Synack. If you're looking for on demand continuous access to the world's most skilled and trusted security researchers, you can learn more at synack.com. Synack recently launched its Empower Partner Program so that partner organizations can more easily offer the Synack Pen Testing platform to their own customers. This approach helps optimize Synack partners' technical competencies and allows them to better integrate Synack into their portfolios. It's a way that partners can win new business by adding continuous best in class solutions to cybersecurity, cloud, and DevSecOps offerings. Synack partners with organizations around the world to make them safer, more resistant to cyber attacks, and more capable of finding and fixing dangerous vulner abilities before attackers are able to exploit them. Learn more at synack.com. That's synack.com.
