AI and Shrinking Workforces: New Realities in Cybersecurity

00:00 This FedGov Today program is sponsored by Synack. Welcome back. The cyber force at the Department of Defense is about to get smaller. The director of the Defense Information Systems Agency, lieutenant general Paul Stanton, tells congress his cyber team could shrink by ten percent. Katie Bowen is senior vice president of global revenue at Synack. Katie, welcome. Thanks for joining me today.

00:32 How is that shrinking of the workforce at DISA potentially going to impact the way the department secures itself and the way that it interacts with the DIB to secure the DIB? Yeah. Great question. Thank you for having me today. I think, you know, we're gonna see some far reaching effects. They'll look to more bringing in more COTS solutions as well. We've seen a few zero trust options come to market for DOD organizations in the last couple months. I think that begs the question around the efficacy and and adoption of those solutions. And from our point of view,

01:02 the the testing of those solutions as well. We're seeing some other, testing and evaluation workforces be cut too. So that's something on our minds for sure is, you know, how do you how do you do some of that testing, in a more modern way, in a more modern approach? What are the ways that you would like to see the department go about doing that testing? And and CMMC, as we, will talk about later in this program, is here to stay. There's a whole lot of of moving parts with cyber in the department right now. Absolutely. We wanna see, you know, an integrated security testing fabric.

01:33 Dynamic application security testing and tools have have largely failed us over the last, you know, ten, fifteen years. I think, you know, that's why bug bounty programs have become so prevalent as those vulnerabilities have made their way to production. And those DAS tools were only as, you know, as good as what was known or out there at the time. We're gonna see with the rise of agentic AI the ability to focus, really significantly on that preproduction and and efficacy, and security of those, those pieces of software before they make their way to production. Randy Resnick was on the program last week talking about

02:06 the zero trust solutions, the three that are on the market now. Mhmm. There are more he promised coming to market by the end of the year. Is there a risk that people could start to think of those as plug and play solutions when in fact, he said they're not? Exactly. They're not that. Exactly. He clearly outlined that, you know, organizations within the DOD can can acquire any of those solutions, and they really have to look at where they place them. And then, you know, from our point of view, test the efficacy of those solutions as well. Artificial intelligence is playing a role in everything.

02:37 Yes. What is the integration of AI into the cybersecurity defenses of the department look like in your view? What are the risks and the potential benefits that you see? Yeah. I think, you know, with agentic AI, we're gonna see what used to be workforces of hundreds now be, you know, very significantly smaller, but managing a team of AI agents, to accomplish a number of tasks, security tasks or otherwise. I think we're seeing a very large rise in the AI SOC, where, you know, when when some of those the initial,

03:09 machine learning logging capabilities came out years ago. It created alert fatigue, so we're always looking at how do we how do we get the cleanest signal in the noise. And that's a lot of what we do as well. We wanna get you the cleanest signal, from an exploitable vulnerability standpoint, and that that is gonna happen much faster. We have time to exploit being managed, or or reported now at an average of two days. It's gonna be hours with the rise of agentic AI, but on both the adversary and the defender side. Yeah. And that's their kind of the risk versus reward calculation,

03:39 I guess, that people were thinking about. Right? What is what can we do, the good guys, versus what are the bad guys gonna try to do to us? Absolutely. Which, you know, you're gonna see a lot of attack surfaces continue to shrink. But for the government, we're, you know, in the mission, we're providing and offering services to, the people. Those attack services can't always shrink. So we have to do a better job before that software gets to production, in securing those applications. We have about a minute and a half left. What's the what are the the things that you will track and

04:10 that you would like to see the department track among all of these issues that we've discussed in kind of the out months, year, two years from now as as these solutions really start to deploy and be used? Yeah. Absolutely. I think, you know, a big question on many people's minds is what is the true cost of of security testing and security across the DOD? And so to be able to manage and talk about that in a way that is outcome driven versus output driven, I think is gonna be very powerful, as some of these new solutions come to market. There's also the question of, you know, these air gap networks.

04:40 There's an there's an assumed breach there. Right? We need to make sure that we're securing those just as we secure, the software that's on the open or Internet facing. So those are things that I think, you know, you can manage efficacy, MTTR on a continual basis and really implement that security testing fabric into your organization. Katie, it's great to have you here. Thanks for joining me today. Thank you. My pleasure. You