Taming Shadow AI: A CTO’s Guide with Andrius Buinovskis, Head of Product at NordLayer

(Mindaugas Bartišauskas at 00:00:00) And in 2015, actually, was my first time when I started to work for cybersecurity. I discovered what is happening in the business world, fighting against advanced persistent threats. I saw what

(Joel Beasley at 00:00:12) has happened and how it is happening, how it is easy to hack into your phone and

(Mindaugas Bartišauskas at 00:00:15) so on and so on. I got so paranoid that I was avoiding to use a smartphone for half a year.

(Joel Beasley at 00:00:28) I wanted to give a special thank you to Nord Security for sponsoring today's episode. And Nord has been kind enough to give us a discount link for their newest product, NordLayer Browser, that we have put in the show notes below. If you don't know, NordLayer Browser gives IT control over browser sessions so that work data stays protected where the work actually happens. Well, man, I'm excited to be talking about this. I haven't done an episode on Shadow AI yet. Right? We've done so much Shadow IT stuff in the past, and you've spent a lot of time thinking about Shadow AI. I was hoping you could just start with giving me an overview of what it is.

(Mindaugas Bartišauskas at 00:01:07) Yes. So first of all, we have to return to a couple of years ago, probably if we take one decade ago, right? So how the whole environment looked like? So most of the data was still residing on devices. Actually, employees were using tools and software to process the data which was on device. Okay. Maybe some data was on servers in a local network, right? And the transition was only starting to happen, right, to cloud and so on. So, and at that moment, to get that data for bad actors was taking some time. Right? They had to hack into the device itself or into the company's network, right? And one of the ways it was to spread some malicious software, which will land into device. And if an employee is actually hooked on this software, at that moment it was Shadow IT, right? If somebody's using software which is not provided by the company, and actually they download a new malicious software at this stage, so they can, you know, spread the virus or malicious application script running around in the network. And that was the consequence of Shadow IT at that moment, right? And that data was being stolen from the company's environment, from the device, from the network. Then the transition went, and it exploded, right, to all the information going to SaaS applications, right? So it means that the data itself is less on a device or company network or on premises, but more on SaaS applications, right? In this situation, you don't need to hack in, right, to company's network, but you need just to log in to SaaS application. So it means you have to trick a user to provide the credentials to log in to that SaaS application, right, which is most often accessible via browser. And this way, all data goes to cloud environments. Then if you want to manipulate the data in cloud environments or just to adjust, right, more tools are built to work in a browser. The second point, you come into the situation that you can do everything via browser what you previously did only on your device. You can do everything. You can edit photos. You can edit music. You can do video changes and so on. All that part was just connecting tools on SaaS level, right? So you are connecting one tool to another. You are allowing access to your Google Drive, Office 365 document. And these tools, if they are not tested, if they are not evaluated by your security team, they tend to be malicious, right? And if you are using a nonsecure tool, this is a kind of Shadow IT because organization admins don't know what actually you are using. And this way, you are creating a kind of attack vector here, a space window, right? So you are providing this extended access to your documents, to your data, and this is how the data is being leaked. And then, the explosion of AI, right? So we're not only... At least not us, but bad actors or hackers, right, go to acquire credentials, but we are actually exposing all the data. We are giving all the data and sensitive data to these AI models to be trained, right? So we are not evaluating the importance of, you know, leaked secrets, tokens, right? Or a list of clients, you know, with social ID numbers that might be leaked unintentionally, right? So I mean, just you are providing too extensive access to the documents, to your environment. That might be even in SaaS application. And all the data is just transitioned to that. And this is how the rise of Shadow AI comes into play. There are always more trusted models and less trusted models. There are providers which actually provide zero-day retention models, right? That means that on your specific data, it will not be trained. No other companies will be capable to use that data, and so on. There are others who actually just spread that data around. There are also malicious, right, which are just waiting until you will post more sensitive data. And this is how, you know, Shadow AI comes into play. And the companies and the organization needs to understand, you know, what kind of tools they are using and what kind of data AI, you know, they're providing to these AI tools.

(Joel Beasley at 00:06:03) That's wild. You've been in security IT stuff. Was it just IT for 20 years, or were you always in security?

(Mindaugas Bartišauskas at 00:06:10) It was generally IT and, specifically... Yeah. It was, you know, it was in telco, in aviation, in banking. So it was always software, the development of software. And in 2015, actually, that was my first time when I started to work for cybersecurity. And I can share a short story here that once I discovered what is happening in the business world, and at that time, we were fighting against advanced persistent threats. And then I saw what

(Joel Beasley at 00:06:42) has happened and how it is happening, how it is easy to hack into your phone and so on

(Mindaugas Bartišauskas at 00:06:45) and so on. I got so paranoid that I was avoiding to use a smartphone for half a year. And, you know, for me, an IT guy to not use a smartphone for half a year, so that was kind of interesting experience. But later on, I became more conscious and, yeah, and started to use that again, understanding the certain threats.

(Joel Beasley at 00:07:07) Yeah. It's interesting too how, like, the other day, one of my good friends, he lost his X account because he didn't have two-factor authentication installed or he wasn't using two-factor authentication. And so I was like, man, like, very modern guy, like, a good friend of mine. Like, you know, you would think that... And then you still have these people. They're not doing basic hygiene. And it's like, oh, like, I told him. I said, I love you, but I don't feel bad for you. Like, you need... This is one... We need to teach this to kids in school, you know?

(Mindaugas Bartišauskas at 00:07:40) Yeah. True.

(Joel Beasley at 00:07:41) But if I went to you 20 years ago when you first started your career and I said, hey, there's gonna come a day where we're gonna have this software essentially that can help you with a lot of things and you're gonna give it all, like, your production keys, your SSH, you're gonna give it everything. What would you say? Would you say it's a possible future?

(Mindaugas Bartišauskas at 00:08:00) At that moment, probably, it was more like conspiracy theories, right? But what we see, well, a part of that is already happening. So at that moment, we saw, you know, fantastic movies about the hackers and so on, about, you know, talking machines. So what? So we are having a part of that. But still, let's see how it will move on.

(Joel Beasley at 00:08:23) And for people who don't know NordLayer, what is NordLayer? What does it actually do?

(Mindaugas Bartišauskas at 00:08:28) NordLayer is... We have a set of different features, right? First of all, we're starting from the network security perspective and covering such use cases that secure internal browsing. First of all, we have to reduce the likelihood, right, of the breach. So blocking malicious websites, blocking downloads, IP masking, right? So all that what is hidden under the buzzword called the Secure Web Gateway. The second part is protecting company resources. And here we... It is about, you know, Zero Trust Network Access functionalities, device posture security functionalities, cloud firewall functionalities, or even connecting, you know, remote devices like they would be in a local area network. So this is all about network security part. And then, as we talked a bit earlier, so all transition went from devices and network to SaaS applications, right? And now we just have released an enterprise browser, which actually helps to target SaaS environments. So threats related to SaaS environment, because that what is happening in TLS level or encryption level on a browser level, you can't, you know, absorb enough and act on certain threats. So here comes another layer of browser interaction, which helps to do even more security and controls, like, you know, data loss prevention elements, smart routing, also enterprise policies, which can be, you know, achieved with Chromium-built browsers. So all the next level of security comes into play, and this is our portfolio.

(Joel Beasley at 00:10:17) So we're moving a lot more of the security to the browser now?

(Mindaugas Bartišauskas at 00:10:20) Yeah. Yeah. Yeah. And even in the browser, so most of, you know, Gen AI currently is used in the browser, and you can control what kind of tools are being used, also reducing that Shadow AI part. And not only Shadow AI, but also Shadow IT part, which is transformed from legacy Shadow IT, which was on device, but now it's in a browser. So we are targeting kind of two use cases at the same time.

(Joel Beasley at 00:10:46) Yeah. You know, that's an interesting explanation of the Shadow IT in the browser. I hadn't heard that explained that way before. It was pretty interesting. The Shadow AI in the browser, is that mostly just like... Let's provide some context because there's so many types of companies. There's companies that have 10 people and they're all engineers. There's companies that have 100,000 people and 50,000 of them are workers in the sense that they are just commonly using the desktop and the web browser and all of that. They're chatting with ChatGPT. Can you explain to me, like, the user base that you're seeing the adoption for the browser?

(Mindaugas Bartišauskas at 00:11:23) Definitely. Even we are talking about browser and browser security. So we are targeting people who are not actually deep in tech. They are not developers. They don't use SSH protocols. They don't use development environments. They are not connecting directly to certain infrastructure services and so on. Here, NordLayer network part I talked about is for them designed, right? And then we are talking about extending to people who actually use browser on a daily basis for 100% of their work. For example, me, right? I'm using just the browser, and I don't need any other applications at the moment. This is why it is a perfect use case, right? Because it is lightweight to install. You also can cover BYOD, right? It is way much easier to give to contractors to download the browser and access resources, which are SaaS resources, and you don't need any additional levels of security because you keep the data where it belongs. You know, they can't download, they can't do extended screenshots, and all the other measures that is needed to leave the data where it belongs, within a company's SaaS application. Part about SaaS environment. So this one, as I mentioned before, for more salespeople, marketing people, now even designers because they're using SaaS tools, then engineers, which needs network level. But also, when we are talking about company-wide tools like Jira, like Confluence, and so on, so this is also applicable for engineers as well. And you also want to apply these measurements to them as well, right? Even moving forward, right? So when we are talking about Gen AI utilization, so all these AI tools, these rules are applicable for everyone. And maybe for engineers who want to use one tool of AI, for salespeople, another tool. And from control perspective, from organization perspective, you need to see what kind of tools and who are using. Because you can invest a lot into tools that are not being used, for example. You can pay for 200 licenses, but just 50 people use them, right? So, and you don't understand why this, you know, business case is not working. Another part is that if somebody is using the wrong tools, right, to build applications, so they might leak information. For example, if a person is using his personal account for company data processing, so it means that all the history and so on stays in his personal account. And this is not designed behavior for a company, right? This company needs to have the data in case, you know, they get into a big argument and that employee might be fired and so on. So data should stay in the company. So there are multiple angles I could discuss, you know, for hours.

(Joel Beasley at 00:14:30) Curious about... You mentioned salespeople. One thing that I've personally seen just out there in the world, I saw a salesperson take a customer list, copy it out of the company CRM to help organize their workday. Makes sense. They had good intentions and then they paste it into their personal $20 a month Claude or whatever it was. And that... I don't think they realized. Like, is that something that the Nord browser would catch?

(Mindaugas Bartišauskas at 00:15:01) The next in the line solution will catch that. Okay, right?

(Joel Beasley at 00:15:05) Did I jump ahead? Yeah.

(Mindaugas Bartišauskas at 00:15:08) Right. So, enterprise will do that as well, right? It is one of the main use cases to do all this DLP and sensitive data detection. But just combining all these solutions what we are talking about, we have, you know, a closed loop. So we are going not only to data itself, sensitive data itself that might, you know, be used in any kind of SaaS application. But then the next part is going specifically to AI tools, which deepens all analysis to understand which models are secure, which not secure, what kind of data was provided, and if organization admin can actually do more protection.

(Joel Beasley at 00:15:54) My first thought when I was hearing about the NordLayer browser was, like, how would you deploy that across an organ... Is it a whole new browser? Is it... Can it plug in to the Chromes and the Internet Explorers or whatever the current Microsoft browser is? I don't follow Microsoft products. Can it... I'm sure it's not Internet Explorer anymore. But can it plug in to existing browsers, or do you have to deploy a new thing enterprise-wide?

(Mindaugas Bartišauskas at 00:16:22) Yes. So, again, we are quite flexible, and we are trying to build tools which are flexible for our end organizations. So when we are talking about NordLayer browser specifically, so, yes, this is another browser completely. Then we are talking about AI Scout, NordLayer AI Scout. I'm just disclosing the naming already. So it will be extension-based also.

(Joel Beasley at 00:16:50) Okay.

(Mindaugas Bartišauskas at 00:16:51) And there are certain things that we have to keep in mind. All functionalities which are based on extension, they have certain limitations, right? They do lots of use cases. They resolve lots of use cases.

(Mindaugas Bartišauskas at 00:17:06) They can see lots of... They can do prevention and so on. But if you want to go to even harder environment, you need to have controls on browser level. So this is why we have network parts and browser and then extension.

(Mindaugas Bartišauskas at 00:17:20) Right? So these all levels of security, we can say layers. That's why we are a NordLayer company. Right.

(Joel Beasley at 00:17:28) And I wanna talk a little bit about that too. Like, when I first started talking with Nord, I knew you guys because of the VPN. I had no idea that you were providing all these other enterprise business. It's like... That's only one small part of the business, the VPN thing.

(Joel Beasley at 00:17:44) But for me, that's the one I was aware of. Can you explain to me the portfolio of products you guys have?

(Mindaugas Bartišauskas at 00:17:50) Yes. Talking specifically about B2B, so I was heading towards. Right? We have a couple more. So it's NordPass.

(Mindaugas Bartišauskas at 00:17:59) Also, it is for B2C and B2B, so it's credential management part. And one of also very important parts in our environment, in our ecosystem, and we are talking about threat mitigation part, is NordLayer Intelligence. Right? So that dark web monitoring and external asset management, or we can say external threat exposure management part.

(Mindaugas Bartišauskas at 00:18:26) So in this station, we have quite a closed loop. I'm repeating myself. Understanding what is happening outside your company, so there are leaked credentials, there are misconfigurations on the other environment, or in other words, threat exposure management part. Right? So you're just checking your organization setup.

(Mindaugas Bartišauskas at 00:18:50) Then if something is happening, you can notify our system, and we can prevent access to certain company resources by blocking an access. And this applies on a network level, on a browser level, or, you know, upcoming any other implementations. SaaS environment, whether it's SaaS environment, whether it's development environment, you can act immediately. If you are using, you know, not compliant device, also, you know, detect and respond. And there are multiple triggers based on what we can immediately act and prevent possible threats.

(Joel Beasley at 00:19:28) Because you have so much experience in IT and then you move into security officially, I wanted... Over your career, I wanna talk about bans because that's something that I've experienced. I've been building software for twenty years. And I remember when I first started and I was doing integrations into mid-level companies, like a thousand employees or so. This concept of, oh, we'll just ban it.

(Joel Beasley at 00:19:52) We'll just ban... That was like a really popular thing, but it's changed over the twenty years. It's really hard to be... Tell me what your experience has been like over your twenty-year career history with the concept of bans.

(Mindaugas Bartišauskas at 00:20:05) Throughout all the transition, there was a concept of banning that we need to ban. Right? If it is flagged, we need to ban. In this AI moment, we have a different scenario. We are not about the banning, but overall we are about enabling, but enabling to use it securely.

(Mindaugas Bartišauskas at 00:20:27) So that, for example, if you're trying to paste a certain sensitive data, it would not, like, abandon pasting it, but it would redact to something, you know, what is unusable. On the other part, when we are talking about tools which are used for organization. For example, if we have two different tools and the organization is buying one of them, and they are buying, let's say, 10 licenses, and only five licenses are being used. But we have another tool with another five licenses used on a personal account. So probably you don't need to buy these 10.

(Mindaugas Bartišauskas at 00:21:03) Let's buy these five and these five. Right? Because this tool actually doing a better job here. But make... Let's make it, you know, secure in that way, so we're not pasting any sensitive data or, yeah, providing too broad access.

(Mindaugas Bartišauskas at 00:21:17) So here we have... The goal is not to ban, but to see an adoption and even ability to calculate the right ROI of the tool itself, not in a wasting. And seeing if not, you know, no data is being leaked personal accounts, or even there are cases when personal projects are being built on a company account. Right? So this also could be prevented in this state.

(Mindaugas Bartišauskas at 00:21:44) From my perspective, what I'm trying to say that ban is okay when a certain trigger is received and for that moment to ban an access, to understand if it is an actual threat or is it kind of false positive. So you act, you ban access, but later on you again open an access after, you know, clearing up all the situation and you understand that it is secure to use that tool forward.

(Joel Beasley at 00:22:12) Yeah. Because it's hard. Like, how would you actually... Like, if your instinct was to ban something and you didn't... AI came out, let's imagine it's three years ago, and you just block ChatGPT on a corporate network.

(Joel Beasley at 00:22:23) But then you have engineers who actually need to be using it or there are people that... There are use cases for it. So how did that actually roll out in companies?

(Mindaugas Bartišauskas at 00:22:31) Probably, I will say that the change is that we can go now into content and analyze the content itself. Previously it was just an access. You are acting on an access, not on a content. And now the... All the tools that should...

(Mindaugas Bartišauskas at 00:22:47) Which is provided even by this AI, right, or even more advanced and fast machine learning engines. So you can actually go into content and understand if that content is malicious, not necessarily the site itself or the tool itself.

(Joel Beasley at 00:23:03) So then the goal becomes securing the use, how they wanna use it and putting guardrails around it versus just blocking.

(Mindaugas Bartišauskas at 00:23:11) Yeah. True. Absolutely true.

(Joel Beasley at 00:23:13) You've got to explain this to me because it caught my attention a great deal. Human AI versus nonhuman AI. What does that mean? What are the diff... What are those things?

(Mindaugas Bartišauskas at 00:23:23) Yes. Human AI is about how an actual human is writing a prompt, to simplify it. And nonhuman AI is when your actual agents are doing something. And, like an example, you are copying and pasting company clients' data. Right?

(Mindaugas Bartišauskas at 00:23:44) It might be sensitive data into, let's say, ChatGPT. This is a kind of not approved behavior. Another when we are talking about nonhuman AI, so it is when you set up your environment. You have an agent. You can even have...

(Mindaugas Bartišauskas at 00:23:59) Can have nonhuman identity, right, that is used to provide access to certain agents, to AI agents in the situation. And they are doing something that you are not expecting. Yes. You are expecting that this agent will read only the folder which is for this project.

(Mindaugas Bartišauskas at 00:24:22) But that agent starts reading, you know, some data around from other folders that might be, you know, sensitive data. And this is two different approaches that you have to provide certain measurements, so how to prevent all these activities.

(Joel Beasley at 00:24:39) That's interesting. And so that's one of the things your set of tools does.

(Mindaugas Bartišauskas at 00:24:45) Yeah. So we are building our toolset to provide, you know, all visibility of this.

(Joel Beasley at 00:24:50) For people who are just at step one, they're just at the beginning and they're like, hey. We want to start securing employee AI use tomorrow. We've talked about so many things, different tools, different attack vectors. But where do they even start? Like, what is step one?

(Mindaugas Bartišauskas at 00:25:06) Step one is understanding what tools are being used. Because overall, in all security areas, so first of all is being able to observe what kind of tools they are using and not jumping into blocking itself, but just understanding the use case. Second level would be to understand how much sensitive data is being, let's say, submitted to any of the tools and then applying certain measurements, so how to prevent all the data submission but not stop adoption of AI. Because if we will start since day one blocking an access, you will, you know, you can lose a competitive edge because of those companies who are not still trying to secure the usage of AI.

(Joel Beasley at 00:25:56) It's wild to me because there's so many moving parts. It's really hard to wrap my mind around. Like, I'm still building applications today. I'm using a lot of MCP. I'm using a lot of Cursor, and I'm noticing that, you know, if you don't have experience, some of the things it'll do is crazy.

(Joel Beasley at 00:26:17) Like, I did a webhook with a service that I used, but it was just the most basic URL pattern that anyone could guess. And it didn't add any authentication header. Like, the... So it... It's amazing that the attack vector is growing so much by these systems building these applications that, you know, are just missing things.

(Joel Beasley at 00:26:40) And to me, I started thinking. I was like, okay. If I understand this deeply because I've spent my entire life doing it. And so I know where to look and check and to make sure. But if you're just a regular person and you're like, hey. I wanna access my HubSpot. You know? So I MCP my HubSpot, and then I wanna access this other data source, my email. So I MCP my email.

(Joel Beasley at 00:27:02) And now I've got this AI that has access to everything I have. How do you even manage that attack vector? It seems impossible. Like, it's all... It's hard for me to understand.

(Mindaugas Bartišauskas at 00:27:12) It is one when you are talking on a personal level. So... But even your personal data is very important. So... And if you go to a company, so...

(Mindaugas Bartišauskas at 00:27:23) Because it is a really difficult challenge for companies itself because the data is in various formats. If it is easy to detect an email, try to detect a name and send in all this environment, all the data that you are facing. Misconfigurations as well. It's very easy to write a simple prompt, right, to publish your demo project or maybe your personal project or, you know, you are building it for yourself, and you would not like to see anybody else.

(Mindaugas Bartišauskas at 00:27:57) But it is so easy, just a couple prompts away, and all the data is out.

(Joel Beasley at 00:28:02) Yeah. So, I mean, I don't even know... How do you think about it personally? Like, you're obviously very security minded. You even held off on the smartphone adoption at the beginning.

(Joel Beasley at 00:28:13) Are you giving... Have you given an agent access to your email yet personally?

(Mindaugas Bartišauskas at 00:28:19) I have different email accounts for different purposes.

(Joel Beasley at 00:28:22) That's what we're doing. You know, to be... That's what I was do... I took a nonsensitive email account that I had, and that was the first thing that I allowed AI into and started...

(Joel Beasley at 00:28:33) Just so I could play with it. And then there's other emails that I'm like, I'm not sure, but then it can creep in. And it can creep in because you can use Superhuman, which is just like an email platform, and they have AI built into it. And so now it's like, well, what's the service agreement they have with whatever model is providing this?

(Joel Beasley at 00:28:52) Are they training it on my email data? Is it the... What did you call it? Day zero? Is that what you called it?

(Mindaugas Bartišauskas at 00:28:57) Zero day retention. Yeah.

(Joel Beasley at 00:28:59) Yeah. Yeah. Zero day retention. It's... There's so...

(Joel Beasley at 00:29:02) If you're a security company, it's a good business to be in right now because it's the wild west out there.

(Mindaugas Bartišauskas at 00:29:06) It's the wild west. And... Yeah. So it is quite challenging and specifically understanding how threats are evolving in this part. I mean, not long time ago, I was in a conference in RAC.

(Mindaugas Bartišauskas at 00:29:20) It was quite a big conference. And they were telling how actually the time frame changed throughout the last ten years, and we are talking about finding vulnerability in your code. So if ten years ago, it was a couple months, now if you use a proper tool, it will be, on an average, twenty-eight seconds. So that's kind of blew my mind, just how we can target, you know, all of these, you know, so many different attack vectors.

(Joel Beasley at 00:29:49) Oh my goodness. I remember the fir... I did an interview a while ago, like, five years ago with a guy, what he did for his job is he negotiated with people who had stolen data.

(Joel Beasley at 00:30:03) So, like, he worked... He connected with the insurance company. So the insurance companies had policies for ransomed data and stuff. And then he would go negotiate with the criminal. He told me it was crazy. He was...

(Joel Beasley at 00:30:14) They have one 800 numbers. They offer support as they're negotiating with you. He go, it's... You can buy the business as essentially a turnkey thing. I'm like, wow.

(Joel Beasley at 00:30:25) And that was pre... That was five years ago. That was pre-AI. I haven't... It must be even crazier now.

(Joel Beasley at 00:30:31) Like, the agents are making other agents that can then go attack things. I don't know. Well, you guys gotta go get Nord NordLayer browser. The whole suite.

(Joel Beasley at 00:30:39) Just buy all the Nord products.

(Mindaugas Bartišauskas at 00:30:40) Whole suite. Yeah. The whole suite. I'm always, you know, trying to systemize all things. I mentioned that, first of all, it's reducing the likelihood.

(Mindaugas Bartišauskas at 00:30:48) Right? So it applies to observability, and then you all these controls that we discussed a lot about, you know, preventing sensitive data leakage, preventing using nonsecure tools, encouraging using another tools, encouraging overall utilizing AI, but, you know, in a secure way. And the second part is reducing the impact of the breach. Right?

(Mindaugas Bartišauskas at 00:31:12) And as we discussed about having separate email accounts, but this applies to whole environment, including network environment, including, you know, separate... Separating the same agents running on the company, including different network access functionality, different network segmentation, you know, by department, by even roles in the department, and this is very important. If you don't need an access of, you know, SSH in a certain level, you should not have that access. You're just blocking that. And if something is, at the end, lands to your device, you can't access...

(Mindaugas Bartišauskas at 00:31:56) You can't spread that. You can't move lateral. All this threat can't move lateral. So these are also very important part. And the third one is don't forget to do a backup, especially today's.

(Mindaugas Bartišauskas at 00:32:09) We had multiple times, and I have had all these models, I actually, you know, deleting your data, what you have, and that might be a disaster.

(Joel Beasley at 00:32:21) Yeah. There was a popular one on X a couple months ago. It was like a travel system. Did you see that post go viral?

(Mindaugas Bartišauskas at 00:32:30) I know.

(Joel Beasley at 00:32:31) It was a database of... It was like a travel company. You know? They had a bunch of itineraries, and they put a whole thread on there about exactly what happened, where...

(Joel Beasley at 00:32:41) But, essentially, when it... The system decided to... And it was instructed not to, but it decided to delete the backup. And the way that it deleted the backup is it was like a permanent deletion.

(Joel Beasley at 00:32:55) And they actually were able to... It was... It got... It went viral. It went crazy.

(Joel Beasley at 00:33:01) And then they posted, like, three days later, a sub-company of a sub-company that had, like, a copy of it somewhere deep in one of their other backup archive systems. But they had considered it lost and were just like, this is what happened. But, man, you can just... Asking it to a basic request, and it can just determine, oh, yeah.

(Joel Beasley at 00:33:22) We should just delete this production database.

(Mindaugas Bartišauskas at 00:33:24) So we are laughing at the moment, but it's actually, you know... On the other hand, it's sad. It's dangerous. It's threatening. Right?

(Mindaugas Bartišauskas at 00:33:30) So we need to be very conscious of this part, how we are using all environment.

(Joel Beasley at 00:33:36) You know, and, like, regulatory pressure was something we wanted to discuss because you've got all of these different GDPRs. And can you tell me a little bit about the breach event, AI as a breach event?

(Mindaugas Bartišauskas at 00:33:49) So again, there are multiple levels, right? And again, these all standards and these all requirements, kind of, more about the guidelines for companies, how to protect their data. And at a certain point, of course, if you are leaking a Social Security number, you should not do that, and that might be treated very harshly, right?

(Mindaugas Bartišauskas at 00:34:16) And sometimes that might be done by one employee, one customer, or one... Even that station, and we are talking about health environment. Health sector, this is really not a pleasant thing, right? But then we are adding agents who actually can read the whole databases, so this might be a breach despite the fact that this agent was triggered or started by one single person.

(Mindaugas Bartišauskas at 00:34:47) So you need to have all these controls in place, at least for having a proper investigation if some bad thing has happened already.

(Joel Beasley at 00:34:57) And for CTOs that are listening, if you want to leave them with one takeaway on all of this, what would it be?

(Mindaugas Bartišauskas at 00:35:04) Reduce likelihood, reduce an impact, and have a backup.

(Joel Beasley at 00:35:10) Have a backup.

(Mindaugas Bartišauskas at 00:35:11) For these first two, you can definitely come and chat with me or colleagues from NordLayer. So we have quite smart people, and we are providing these solutions for our customers. And also, we are trying to build our functionality list in a way that would be easy to use. So what we are trying to do, we are trying to lower the entry point for organizations. They don't need to have their own SOC team, very big SOC team, so they could start securing their environment.

(Mindaugas Bartišauskas at 00:35:48) And we're ready to discuss what actual use cases they need to cover in their environment and provide a solution from our side.

(Joel Beasley at 00:35:56) Alright, so you're consultative in that regard.

(Mindaugas Bartišauskas at 00:35:58) In simple words: observe and start monitoring, then automate monitoring, so it means anomaly detection. Then do immediate response, block access, or invalidate users or whatever. And then add the preventative actions so it would never repeat again.

(Joel Beasley at 00:36:16) And are we allowed to talk about the new thing happening? I know... I think we touched a little bit on it, but what's new at NordLayer?

(Mindaugas Bartišauskas at 00:36:22) So the newest one is NordLayer AI Scout, which is coming out right now at the moment. And this tool is designed to answer what AI tools are used in your environments. So we are talking not only in the browser, but also on a device. Then understand what kind of sensitive data is being leaked or provided, submitted to these tools. Then to understand how many of these tools might be used for personal projects, and you can invest unintentionally to other projects.

(Mindaugas Bartišauskas at 00:37:04) And overall, you can even understand if your AI security trainings are working, right? Based on the amount of sensitive data being leaked to all these AI tools. If you educate, but this parameter is not changing, people are still trying to offload sensitive data, so it means you need another trainer here.

(Mindaugas Bartišauskas at 00:37:26) And overall, providing the ability to use all these AI tools in a secure way.

(Joel Beasley at 00:37:33) Nice. I like that. I like the personal projects one because I always used to think when Bitcoin was getting popular about ten years ago, I was always thinking to myself, man, if I worked at one of the major cloud companies, I would definitely have a cluster. I'd be like, no, no, no, we're doing some maintenance over here. Yeah, just direct it, grab some Bitcoin. Oh, man.

(Joel Beasley at 00:37:56) This is great. So I'm excited about this. It was a lot of learning for me about the new NordLayer products and all of that. So for people that are gonna reach out, the best way is to just go to NordLayer's website, or how would we like to ask them to reach out?

(Mindaugas Bartišauskas at 00:38:14) Nordlayer.com, or you can find me on LinkedIn.

(Joel Beasley at 00:38:18) And we'll make sure to put links in the show notes below for people who are listening. And then I like a leadership question. I always like to ask people, what is one piece of leadership advice that you got in your career? Maybe you saw it or someone told you and then you tried it and you were like, that works. And you've kept it with you for a while and it continues to work.

(Mindaugas Bartišauskas at 00:38:41) So if we are talking about specifically the business part... Ten years ago, one of my investors said that if you have money, you have to invest them right now because you will lose unreceived income, right? Because the time is extremely important here. And this is why when we are talking about building tools and building now, staging preventive... prevention tools, security tools, we are making them, and we have to move faster than the growing threat environment. We need to establish ourselves right now. We need to add tools at the moment. So with what is available, we have to start right now, not waiting until somebody will come and say, or force us to do. And this is a learning curve that if you will try to do it later, you need to learn way much more, and the entry barrier will be very heavy.

(Mindaugas Bartišauskas at 00:39:41) So you need to act now. So this is probably the short answer here.

(Joel Beasley at 00:39:46) So you're a person of action then in your leadership style.

(Mindaugas Bartišauskas at 00:39:55) Yeah.

(Joel Beasley at 00:39:56) Well, this is a podcast. We made it. How do you feel?

(Mindaugas Bartišauskas at 00:39:56) Me?

(Joel Beasley at 00:39:57) Yeah. How do you feel?

(Mindaugas Bartišauskas at 00:39:58) I'm good. I'm good.

(Joel Beasley at 00:39:59) You good? Yeah. I could tell by all the thumbs up gestures throughout the show.

(Mindaugas Bartišauskas at 00:40:03) So many.

(Joel Beasley at 00:40:06) Thank you so much for listening. And if you found this episode useful, please share it with a friend or colleague who you think would get value from it. And if you have topics that you'd like to hear discussed on the podcast, either add me on LinkedIn or send me an email, [email protected]. Every time I get an email or LinkedIn message, it absolutely makes my day and inspires me to keep going.