Name: Sophos Insight: Strengthening Security, Controlling Costs – The Power of Prevention
Uploaded: 2025-10-08T19:46:14.106Z
Duration: 1 h 30 min 12 s
Description: Sophos Insight: Strengthening Security, Controlling Costs – The Power of Prevention

Transcript for "Sophos Insight: Strengthening Security, Controlling Costs – The Power of Prevention": Yeah. Hello, everyone. Thank you for joining today's webinar, Sensing Security, Controlling Costs, The Power of Prevention. We are joined by Sophosiso, Ross McArthur, and VP of Product Marketing, Eric Kokonas, who will be talking about how prevention is one of the more important layers of defense today. As a reminder, this session is being recorded, and you'll receive the link to the recording by email. And during the session, if you have any questions, please, feel free to put them in the q and a section to the right, and we will try to answer them. With that, over to you, Eric, and Paul. Thank you so much, Devyani. Welcome, welcome, everyone. Really appreciate you all taking the time to watch this Sophos Insight webinar that we have today. And the topic that we're gonna be discussing, as Devyani noted, is strengthening security, controlling costs, the power of prevention. So we're gonna be covering a topic that, in my opinion, isn't talked about enough. Really, the emphasis on preventative controls in cybersecurity. And in particular, we're gonna be talking about the economic impact of having really strong prevention. So So these are the two elements that I think are have kind of gotten lost in recent conversations, and we'll get into that a little bit more in a bit. I'm very excited to be joined by by a really great expert on this topic, Ross McKercher. He's CISO at Sophos. Ross, why don't you, why don't you introduce yourself to the to the group here today? Yeah. Yeah. Thanks. Thanks, Eric. So, yeah, my name is Ross McKircher. I'm the CISO at Sophos. I've I've been here at Sophos for eighteen years. And that's two life sentences, basically. And and, as well as my, you know, kind of my day jobs protecting Sophos. As you can imagine, the CISA of a security company gets get I get my fingers in all sorts of things here. One of my recent, recent new responsibilities is I spend a lot of time with threat intelligence teams and and helping them communicate some of our threat intel insights externally. Excellent. Yeah. So Ross is responsible for the security of a security company, and you've been here for eighteen years. Remind me, Ross, what's the normal timeline of a of a seasonal lot of roles? Sometimes you you have to be an outlier in terms of, tenure in a position. It tends tends to correlate with, average time to breach, I find. So I love And the reason we wanna have, Ross on on today, you know, we're gonna be kind of looking at Sophos as as as kind of an example use case. So we're gonna be talking a little bit about how we do things and, from a preventative from a prevention standpoint. Also, how we how we correlate that with the work that we do on the security operations side of our business. So Ross is really the perfect person to to be leading this discussion here today. I'm just here to help him. My name is Eric Kekonis. I'm our VP of product, marketing and market intelligence here at Sophos. In terms of this conversation, the most relevant part of what I get to do is work really closely with the analyst research community. So, you know, the Gartners and IDCs and Frost and Sol and Ambien, you know, list goes on. And this is a topic that even they will say doesn't get enough attention, really thinking about prevention. And that kinda leads me into the first question that I have for for you, Ross, here today, which is, you know, it's it does seem like endpoint protection, endpoint or or preventative security controls has taken a back seat over the past number of years to detection and response technologies. Prevention is is is, you kinda hear it as, well, it's a commodity, and everyone kind of has it. It's all more or less the same, isn't it? And obviously, that's that's a fallacy. But why do you think that notion exists? Why do you why do you think people are are spending less time thinking about prevention and protection, than than maybe they used to? Yeah. I I think it's I think it's actually a lot a bit of a function of what's easy to measure. So, you know, there there's some very common metrics in the industry are kinda mean time to response, mean time to detection. Detections create tickets in queues. And when you have tickets in queues, you can measure how quickly they change status and, and and and get resolved. But sometimes we miss the wider picture, which is the less tickets that hit the that hit the queue, the, you know, less time that we have to do a detailed and heavy lift on the on the response side. We actually that's that's effort avoided entirely, but it's it's kinda one of those, you know, trees falling in the forest problem. If it never, you know, if it never happened, then how do you how do you measure it? Yeah. So it's a it's a really good point. And and maybe even work, you know, one of the things that, you know, we we find with our webinars is is we have people who attend who are, you know, battle tested, incredibly talented, operators who, you know, are notching winds all the time against nation state attackers. And then we also have people who attend our webinars who aren't as as as close to the day to day operations of cybersecurity. It's something that they know that they need to be thinking about to manage their business, but, you know, maybe they're not in in the fight every single day. So maybe maybe just to make sure that we're addressing the audience, you know, maybe give us a definition of what what when we talk about prevention and protection, what what does that mean relative to detection and response, tooling or or operations work? Yeah. Absolutely. Absolutely. So when you're talking about detection, it's usually about an analyst investigation. So there'll be there'll be an alert, and whether that's automated or by a triage process, there'll be a determination that the attacker got far enough into the environment that you need to ask the question, what did they what, you know, what did they do and what are they gonna do, you know, you know, from from that from now on. Because when you've detected something, that's literally all you've all you've done. There's no there's no positive impact to detection unless a human comes in and result you know, resolves that incident. So so so that's that's detection, and it's very commonly measured just because of the, as I said before, the the time required to, to to spend on it. You know, you're in a you're in a console, you're investigating, you're you're pivoting on indicators. It can be a pretty, you know, a pretty serious serious list. Prevention is and it it's it's kinda gray here, obviously, but prevention is is typically where a fully automated control has kicked in and hit, hit an attack early enough in its life cycle that you are, you know, you're in a confident position. You may still wanna come in and investigate because it may still be far enough in your environment that you've that you have concerns around how it got that far. It depends. So, for example, in one that if you if you get detection on your domain controller or some sense of environment, you're not just gonna pause there and say, oh, I'll prevent you know, if it's been prevented, you're not gonna pause there and say, okay. Our job is done. But you're still on the front foot because you've broken that kill chain. The attacker at that very point in time is sitting there and saying, oh, okay. What am I gonna do next? That didn't work. They're they're they're regrouping. So that's that's kind of that's that's prevention, for instance in a nutshell. Yeah. So to use a a way too overplayed analogy of this, this would be, like, if if someone was trying to rob a bank and they got into the bank and they got to the vault door and the vault door was locked and they couldn't get in. So you've blocked that threat. You've prevented that robbery. But you still have a robber who's in the bank and and and maybe something needs to happen about that next. Is is that a very dumb analogy, but yeah. Yeah. Yeah. Yeah. Yeah. That's that that that's fair. So so we're we're not we're not saying that any of, any incident that you fully prevent or protect against means that you haven't having to do any investigation, but it's just that you're the the the playing field already tilt in your advantage. You're already, you know, you're already winning at winning at that point. And then that's good not to mention, you have to use a bank analogy. There's also, you know, the the the locked door on the front of the on the front of the bank. You know, you're obviously not gonna initiate a full scale response when every chance to come by and just check whether whether whether the door's locked or not. So there are also a whole set of of events that that if you prevent outright, it's just you don't do much more. You know, someone comes knocking and the door doesn't, you know, the door if the door's not open, you can probably just move on with your day. I really appreciate you, Ross, indulging my analogy. I'm sure that was painful for you, but I appreciate you making I wouldn't be making it. Our analogy. It's it's it's just a little bit different. It's you you know, you it's usually about about cars and driving, isn't it? The classic IT analogy. Yeah. Yeah. What are what are some of the examples, tactically where prevention, might might need to be, augmented with detection and response? Can you mention certain things that attackers do might require a bit of both and there's a bit of interplay. So maybe describe those types of scenarios. What are the things that prevention can really take care of everything without any human intervention? And what are those scenarios where you do need that, subsequent investigation and response work? Yeah. I mean, I think I think if you look at the, you know, the micro attack stages, for example, or think of you know, if if you think of an attack as a a series of actions and objectives, the simple rule is the earlier in that attack life cycle that you manage to prevent, the less you have to worry about what happened and and run run running a full investigation. So the extreme examples of that are, you know, if a if a malware is blocked outright even at the domain stage. You know? So you don't even get the the the you don't you know, you you visit a malicious web page. You don't even get to see the malicious web page. That, that happens thousands, millions of times a day potentially potentially. And, actually, you do get you kinda get this pyramid, basically. You know, you get these, like, these these very kinda high volume simple blocks. So your firewall block in a packet, I guess, you could argue is the extreme example of of of of prevention. And then as you go up that stack so the next the next one would be, you know, maybe a bit of malware got blocked before it was ran on your machine, but they actually hit hit your machine. Now depending upon your risk tolerance, you might still go, oh, so someone downloaded a bit of malware. How did it get there? But, you know, a lot of bots, it depends on how much, you know, how much they wanted to resource this. They might then go, well, that's probably that's probably fine. And then the other extreme example, the one I used previously was, you know, if you've got an internal asset, in your systems that's very high value, so, you know, attackers will commonly go for things like like domain domain controllers. If you have a, you know, execution on that, even if it's even if it's prevented, then you're still gonna wanna run some kind of investigation off the back of that to to figure out what happened either directly or or, you know, working with your your NDR provider. Right. Okay. So, I mean, yeah, there's there's clearly interplay between the prevention upfront left, and we'll talk about kind of the notion of shift left here in a bit, and then the reduction of of downstream workload, which is where your investigation and and triage work and ultimately response remediation efforts would would occur. So naturally then, to get back to the economic piece of this, which is, again, sometimes, not emphasized enough in conversations about preventative controls. How do you measure whether that prevention is truly effective in reducing that downstream workload. I mean, it is it is difficult. You're trying to measure the the value of something not happening. This is the the kind of classic challenge in ROI and cybersecurity. But kinda help us understand. How how would you how would you know? And if if you're running a security program, how would you know whether or not your prevention is doing an adequate job or if you're doing an important amount of time spending an inordinate amount of time on the detection investigation response pieces? Yeah. Yeah. I mean, it it it's all about how you have to make some assumptions. Like like, you you know, you you you can't tell how far an attack would an attack would go down your down your stack, but you can make reasonable assumptions. And you often don't have to you don't have to kinda over egg this to get to some very, very compelling use cases. So, you know, let's take the the domain blocks, for example. You know, if if you you can measure how many domain blocks you're seeing across across your your your organization, and let's say you don't have that layer in your in your products, it can make a reasonable judgment maybe based on the results of your phishing assessment, for example, of what percentage of those domain blocks. So let's say you're at, you know, 3% click rate in your phishing assessments, then that gives you kind of, you know you could assume that if you had no technical controls that, like, two or 3% of the of the domains that were hitting users in email were getting, you know, were were were were getting clicked on. And then you might find that you have of that two or 3% ticket. Actually, to be honest, most docs, it's it's a fair bit higher would be my would be my would be my guess. But let's say that half of those are, you know, inputting their credentials potentially. What and then you've got and then you've got a simple thing you can measure. Speak to your your IT help desk, and what's your what's your cred cred reset time? How quickly does that take? So even if you assume that at that point, they get caught and you do a credential, you you you've immediately got a cost. You know, you've got something that you can you can quantify, and that alone might be compelling enough. But if you wanna strengthen the kind of business case for, like, you know, building out those those early stage controls, you take it a step further. Let's assume that, you know, your your help desk might not be 247365. So let's assume that, you know, I don't know, a third of the time, a quarter of the time that those those those credential rotations take a take take take a long time. So then you've got an attacker potentially with, you know, with an authenticated attacker in your environment, and that's where the cost start to really go up. And it's again, you don't have to be you don't you don't have to take a massive leap of imagination to imagine that an attacker in your environment with credentials for a few hours could have gone to all sorts of places, and you enter, like, quite deep investigations there. So you can assume a, you know, forensic. You'd at least wanna review the if it if it's Microsoft, you know, the o three six five logs to see what files they accessed. Or if they're in your network, you're into kinda basically into full hunt, you know, hunting response. And and conservatively, you know, you you can estimate a few days per incident on that, and that's that's a conservative estimate. And all of a sudden, you've clearly found yourself in a in in a position where, where even, yeah, even for some relatively small things can get very expensive very, very quickly. Yeah. Very good. Alright. So that I mean, I I I that that's helpful context, Ross. So the the next topic that we have is kinda dovetails with what we just discussed is that role of prevention in maximizing security operation center efficiency in in ROI. So if you have prevention on one side and you've got detection and response, security operations work on the other side, If you have weaker protection, you might gonna see, you know, more detections, more cases, more investigation workload for for analysts on on the other side of things. This is one of the things that we do see in in sometimes in in third party tests where, you know, there there could be kind of an overemphasis on the number of detections generated and people will sometimes think, like, well, look how many detections this tool generated. Well, that might be good. It might also be evidence of poor prevention. Yeah. I mean, it's got, you know, funny funny story about, our micro evaluation a cup cup cup of years back when we start when we start participating in the micro tests. Because Sophos has always had a strong, you know, protection layer, strong prevention in it in in its prod in its products, we were actually killing attacks too early, and we weren't producing the signal for the micro for the micro evaluation. So we're actually turning turning off capabilities in our products so that we can, you know, so we can hit some of the, some of the MITRE criteria. It's a it's a, it's a concept that that is, you know, kind of dear to us because we've had we've been doing it doing it for so long. And then sometimes it's I don't think it's given the credit it's worth. I mean, let's take the the kind of you can call it the dumbest thing, which is, like, atomic IOC. By atomic IOC, I mean IP addresses or domains or or hashes. They're sometimes kinda dismissed because they're so brittle. You know, they change really, really regularly, and that's a very valid criticism. And it really stems from the days when people were kind of taking threat intelligence feeds that would be like a list of, you know, hashes and then manually loading them into the the SIM or the firewall or or or or whatever. I mean, that that honestly, that approach never really worked. But it's, I mean, it's complete insanity nowadays because stuff, you know, can take changes so quick. But it doesn't mean there's not a ton of value in blocking those. You just need to do it in a fashion that is extremely automated and extremely quick. So we have these, you know, we we have, for instance, in our cloud database in FXL. We, you know, we have these huge distributed low latency databases, which are full of these atomic IOCs, but we're updating them, like, continuously, and the products are referring to them continuously. So it's actually a lot of kind of, you know, secret sauce and magic in maintaining that globally available low latency list of all these atomic IRCs and blocking stuff at the door. And if you run the numbers and you look at the the number of just the sheer volume of, frankly, mainly junk, like, most of it is not you know, we're not claiming that these are that these aren't bypassable control measures. But you just look at the cold hard stats of, you know, the 90 plus percent of attacks that are blocked to that very early layer. Not only are you saving, you know, any effort for, you know, manual effort as well, you're actually it's actually performant it has performance benefits as well because you're not having to, you know, scan for behavioral detections or or use you know, where everyone knows that AI is expensive. Right? So you don't want your, you know, your ML engine having a look at something when you already know just with a simple checks and lookup that it's that it's, that it's malicious. So there's there's there's a ton of value in just lopping something's head off really, really, you know, really early in that in that attack chain. Yeah. I appreciate that, Ross. And I'm I'm so a couple couple things. So you mentioned, the MITRE attack evaluations for for enterprise products. I wanted to kind of name those. Those are an independent testing group that that conducts these annual evaluations where they're looking at prevention and detection response capabilities. It's Sophos as a participant. Most of the leading vendors in cybersecurity participate in participate in those evaluations. So if you're interested, go to MITRE ATT and CK website, click on the various rounds of evaluations, and you'll see what what Ross is is is is talking about. We also have some content out there that just helps kind of orient people to how to interpret the results of MITRE because it can be a little bit difficult if you're not familiar with it. So be sure to check those out. And then the other one that you mentioned, you said IOCs, just because I'm always a member of the acronym, please, indicator or compromise. And and and then I would ask you, Ross, maybe kind of deconstruct, the components of prevention. You know, we hear a lot about, you know, signatures. We hear about behavioral, you know, prevention. Now we hear about AI. So maybe you can help kind of distinguish the relationship between these different elements that can be used as part of a preventative tool. Yeah. Yeah. Absolutely. Absolutely. I I I I really like talking about the the multiple layers of of of defense that we have in in our products because there's this very kind of legacy perception that, you're kind of there's antivirus and that equals signatures, and then there's EDR, and that just equals, you know, kind of behavioral detections but not preventions. But the real the reality is there's this kind of full gamut of technologies in our products that do a combination of prevention and detection. And it's awful because we got kind of that kind of long storied history of, you know, really deeply understanding these threats and having, you know, huge, huge databases of threat intelligence are just kinda churning all the time. We've really been able to dial our products such that where whereas other vendors might have, you know, kind of detective controls in places because you don't have the confidence and the quality of the data, We've managed to kinda dial them up to eleven and actually have a lot more of our components can operate in that prevent mode without having, you know, dumb stuff like blocking one two seven dot zero dot zero dot one or google.com and all the kind of stuff that goes wrong if you, if you try and instrument kind of, you know, detect, you know, a kind of lower quality threat intelligence in a in in a prevention mode. So I I so I'll start kind of and I'm gonna try and do this. Hopefully, none of the Sophos Labs guys are watching me because I probably gonna breach you exactly how this all works, but I'll I'll I'll try I'll try my best. So I think the the bottom I think it was a pyramid where you've got this kind of bottom layer where the atomic IOCs that I that I talked about. You know, they're they're very brittle, but they change a lot, but there's a ton of value if you block, you know, if you if you block really, really regularly. So that's domain, you know, the domain's IP addresses are the are the main ones. The kinda next level up you've got, I'd call it it's still something I see, but maybe when you take your disk, so it's a little bit further into your system. You've got the checksum, you know, just the the hashes the hat hashes match. It's a known bit of bad bad malware. There's actually another interesting thing, though. We don't just have we don't just have large databases of hashes of knowing bad. We actually have huge databases of also knowing good, and they're actually as important because, particularly, as you move up the stack and I'll I'll get to, ML in a second. Those those those hashes of knowing good is act are actually really, really important. But before I get to that, you've also you you've got our, you've then got your exploit prevention techno technology. This is one of our most, you know, advanced and powerful pieces of, piece piece of technology in in in the whole industry, frankly. I I'm going back a long time here, but I'll never, this is very signatureless. So it's very kind of a next gen trend trendy stuff, if you will. I'll never forget the demo that, that that Mark who who who who runs our I am who runs the team that builds that builds his exploit prevention technology showed back in when WannaCry came out. He he loaded up a copy of Sophos endpoint. You can remember this. It was a year out of date, and it turns out that a year out of date, so a year before anyone knew about the OtonaBLUE exploit that was used as part of the WannaCry attack, we could block it with this, with with with this behavioral with with this exploit prevention technology. So that does all sorts of really cool stuff, by kind of monitoring memory and injecting stuff into processes to spot the way that, to spot kind of common techniques that malware uses to kinda gain access into systems. So that's that's a super cool piece of, piece of piece of tech. Alright. And then if you move up if you move up again, we've got our kind of behavioral detections. The behavioral, you could kinda call them you can call them signatures, but they're not signatures in terms of again, people think signatures. They think, you know, oh, it matches this hash or something. Really, all that work is done much earlier nowadays. The the behavioral detections I'm talking about are the types of things that will that will like a sequence of events on the on the system. You're right in this registry key in this in this way, you know, followed by popping up and then killing another process at, you know, shortly after, etcetera, etcetera. That that's our that's our kind of behavioral, you know, behavioral detections layer. And then and I think this is the way they run. It might there might be slightly might I might have got to be slightly out of order. Then you've got our ML our ML engine, of course. So our ML engine so we've, we were the first industry to use machine learning to to identify malicious and malicious PEs, some malicious Windows executable, particularly, I think, must have been twenty seventeen ish, I think, or twenty sixteen ish, around around that time frame. Really promising new approach, in the industry. We, we were one of the very early adopters of that approach, but it had an Achilles' heel. And it still has to be honest. These behavioral these sorry. These, these ML detections, the fact is they're really quite noisy. They take a lot of, they take, they they detect a lot of legitimate software as malicious, which brings me back to to to Sophos because we've been around for a long time. We've got a very mature, and very well resourced labs, soft of labs function inside of the ex ops group. We've got all these known good checksums, and that allows us to actually suppress a lot of the ML, a lot of the a lot of the ML false positives because the ML might take malicious, but we've actually got high confidence it's not because we've got all this we've got all this understanding of all these, this kind of knowing good. And, of course, that's not static. Like, we have to we have to do a lot of automation to continually update and curate that database of, of of of knowing, of of knowing good. So those are our kind of our endpoint detections, prevent protections. Then on top of that, we have our cloud detections, and this is where we really go from kinda that prevention first approach, which is when we do work on the endpoint to this more kind of detection, you know, this detection first approach, which is where we do our work in the in the cloud. And that, of course, has some advantages. We can bring together signals from, you know, you know, from multiple devices, from the network to to give you that kind of more, you know, global view of a of a of a threat. And that that's exactly you know, if you're talking about, you know, software NDR service, you know, they're primarily operating on those, you know, on those cloud on on those cloud detections. For the precise reason that threats got that far, that's where you wanna be spending your spending your time. And, typically, those are the the more advanced threats. Right? They're not they're not they're not the simple they're not the simple ones. The simple ones we've blocked, yeah, five steps ago, basically. Yeah. That will that that's a that's a lot of layers. I'm sure the SalesLabs team will fact check you, at some point on on on any of these to to make sure that you had the right ordering. But, yeah, the point being, I mean, there's there's a ton of pieces in place, and I think some of these go a little bit underappreciated again as as some of the conversation has gravitated around detection response and security operations tool tools. But bringing back around to that soft efficiency piece. So so yeah. I mean, the the the the negative impact is you have prevention tools which aren't as effective. They're either letting things through or they're creating too many, you know, false false positives and it's creating work on the back end. What are some of the metrics that can be used to to measure that SOC efficiency piece? Because that also gets back to the cost control. Right? If if if if we have poor prevention, you know, we're gonna have to hire more people or or invest more in, agent tech AI to to do this work on the back end. So maybe talk a little bit about those pieces. Yeah. So so the first thing, the the the the one thing that you never wanna do is measure an operations team on volume of tickets, either opened or closed. That's just, you know, that that that that's always gonna result It's it's always gonna result in, in bad in bad outcomes, basically. The, the metrics that we the the metrics that we do like to use are so we use, you know, mean time to triage. So we wanna make sure that when something does get through, that it's picked up quickly. Now that will naturally kind of incentivize having less alerts because if your mean time to triage pops up, it might be because you're basically bubbling too much stuff up. You know, you're not preventing enough and and and your analysts are getting, get, you know, getting over overwhelmed. Mean time to resolution is another one. That one can be kind of a careful one because if you overfocus on that, it can be low for the wrong reasons. It can be low because it again, you you know, you're looking at really simple. You know, it's you probably have really simple simple threats that aren't, you know, aren't a real risk because you're being overly overly noisy, but but managed carefully. You know, mean times resolution can be, can be a really, you know, really important one. I also I really like the, the this kinda come back to the if if you've got an analyst, like a real person spending time on something, you wanna make sure that they are really using that kind of human brain and in engineering to its full, you know, to its to its full effect. I actually really like metrics around RCAs and how your you know, how teams are getting better at preventing you know, seeing it. I mean, the ideal you know, to I also to my team. You know, the ideal kind of offset up is almost like you get, you know, one low every three years, and it's a major incident. That's because the highest, yeah, highest signal signal to noise ratio. I don't I don't think we're ever gonna get there, but, we should drive towards that. So that's why I you know, as best as you can, and this really requires you to essentially have a lot of time on your hands and not be doing a lot of busy work, is to spend a lot of time on your RCAs, so your root cause analysis for as many of your as many of your incidents as possible, even things that yeah. The the the the NIST definition of an incident, by the way, is tiny. You know? It's I can't remember exactly, but it's essentially something that causes you to take action to defend yourself, basically. So you can argue that almost anything that comes through as a detection in a well functioning system is basically an incident. When you have an incident, you wanna you wanna say, well, how can we how can we improve our preventative controls to stop that thing bubbling up again? You know, you want your you want your instance to not be repetitive, to be kind of different things every time because it shows that you closed off the whole last time. You want to be as rare, you know, as rare as as rare as possible. So tracking all that work and ensuring that you're getting better over time, for me as a is is probably the number one kind of way to show that you're you've got, you know, well functioning a a well functioning system that that isn't just focused on tickets and busy work to demonstrate value. I I I love that. I mean, that that's something that's particularly close to my heart, you know, having I mean, come up in cybersecurity from a from an MDR kinda centric background as as I have. One of the things I think that people don't always appreciate is the amount of work that the that an MDR operations team or an in house security operations team spends on the refinement of of of detection and and detection engineering. Right? Everyone kind of focuses on, well, tell me about the incident that you stopped and and the and the threat that you, you know, removed from the environment. Because, you know, those are those are cool. Those are the things that, you know, sound cyber ninja y, and they're fun. But that that kind of feedback loop, that system or virtuous cycle of taking what we learned from the incident and applying it back to the front end so that we can prevent that type of thing from occurring or requiring more human effort, when it when it inevitably happens again. That Yeah. Detection and engineering thing, absolutely essential for driving up SOC efficiency. So I love that you brought that up as look at it as a system. Don't just look at the individual metrics and their component parts. Look at it as as a collective. Yeah. I mean, don't don't get me wrong. We all we all love kind of hands on battling the bad guys. You know, that's that's it I mean, it it's kind of, it's it's not always fun in the moment, but, you know, reflection sometimes, you know, you look back and look back. Some of the most fun fun kind of parts of any anyone in operational security kinda career is always when they're, like, hands on keyboard back, you know, adversaries. But you don't wanna be doing it all the time. You know? When you do wanna be doing it, you wanna be against the worthy adversary. You don't wanna be doing it against junk. You know? That's that that's no fun. Just putting kinda junk out your environment that could have been avoided when, you know, on a Friday evening when you wanna be at, you know, spending time with your kids or out with your friends or or whatever. Yeah. It gets it gets old really, really quickly, which, again, I think this is an important thing to understand about these, these preventative controls. I don't think anyone's and this is maybe comes back to the the genesis of, you know, prevention being seen as a bit legacy maybe. We we all realized, you know, probably over ten years ago now, that prevention isn't the be all and end all. It's not perfect. But that misses that that really misses the point. When nobody's calling prevention perfect, a determined attacker will get around preventative controls, but they buy you a ton of time, and they save you a ton of effort. And even against the most determined adversary, you know, even some pretty kind of dumb preventive controls, if they get in the way of that of that attack, if they slow that adversary time down, which gives you time or gives the end your MDR team time to come in and actually get that hands on keyboard response to that adversary, that is worth so much. You know? So I I love, I think Joe uses it quite a lot, our CEO. The the idea of these tools is a shield. You know, shield that a a a a shield that really gives you that defensive advantage versus something that you can just put up and forget about forever. I was gonna bring up Joe's, yeah, shield shield terminology around, you know, the the best shield under a kind of persistent attack eventually, you know, will break. The point of the shield is to build give you time so that you can counter. You know, you don't you don't defeat any any, enemy with with the shield alone. So so yeah. I I I absolutely love that. Alright. So we made it pretty far into a webinar, you know, can considered the times that we're in without getting deep into AI. You know, you mentioned AI. You talked about machine learning a little bit. But, of course, this is the thing that everyone is talking about is how is AI augmenting prevention and and is, you know, part of the overall you know, everything now is can be infused with with AI, which which yields a ton of benefit. But it also creates some confusion among buyers of, you know, what's what's real here? And then you mentioned the the various layers of prevention that go into this. Where does AI exist? Is it is it one of those layers? Is it surrounding all of them? Kinda walk us through, you know, what what how is AI being used, and how can you as a as a buyer, as someone who's evaluating products, know what's what's real versus what is maybe marketing hyperbole. Yeah. Yeah. But yeah. I got you. I just gotta bring this up first, but but but before we go this, we talked about kinda mean time to triage and, mean time to detect. I heard a great new metric the other day, which was mean time to AI. So how long do you have a conversation before a before a a AI comes up? We've got quite a high mean time to AI here, which is, which I'm quite impressed at. I don't know if that's good or bad yet, but it's the it's observation because it's usually about thirty seconds. So, so, yeah, so so so a a I I mean, look, obviously, it has a huge promise across, you know, across the industry, particularly in security operations to take away a lot of the kind of drudgery and just, you know, busy work that we all that we that frankly is is there's too much of in, in in security operations work. Now that's, that's exciting. I think the reality is we're still figuring it out as an industry how to how to fully automate that life cycle, and it's gonna take quite a long time. The challenge is that so and I think a lot of people will have, will will have kinda maybe experienced this in their in in their day in in their day to day lives. So LLMs, particularly, they're great when you are querying public data that doesn't require any particular amount of context. You know, they're just they're they're better search engines. They have this great view of of the kind of world based on the public data that they've been trained on. Where they where they struggle a bit more is when they have to incorporate a ton of kind of organizational context. Now there's approaches like that. Obviously, we had kinda, you know, RAG, early on, and now we've got kind of the m MCP, which is kinda way of plugging in, you know, plug plugging in models to each other so that they can provide maybe provide provide context to to to these to these models, and they're getting much better. Right now, I think, really, the true value, though, for, for for LLMs particularly is about is about providing that automated context and making the analyst better. I think it's it's risky to assume that a LLM can make kinda high value, highly consequential decisions in a in a complicated organization without fully understanding the context and having no human in the loop. I think we're, you know, frankly, quite a long time away from that. I think we're just gonna be getting better and better as you know, it's just gonna make humans and and their SOC analysts better and better for quite quite some time. There are some exceptions to that. You know? I mean, it's it's not as kinda trendy as LLMs, but with the right as I referred to earlier, with with with the right amount of kind of false positive, suppression, I think, you know, kind of convolutional neural networks, you know, the kind of the the machine learning classify you know, classifiers that we've been using for some time can you know, you can trust them to to to block a lot of threats, you know, you know, at an acceptable FP level. If you've got the right suppression in place, and that's been a really successful approach that we frankly probably don't talk about enough anymore. You know, I think every you know, we everyone's kind of over rotate it towards LLMs because that's the really, you know, exciting exciting use case. But we've seen huge advantages in, AI and machine learning, you know, over the past kind of fifteen, fifteen years, and LLMs is just kinda one, you know, one one one version of that. So that's that's something that we shouldn't, we certainly shouldn't lose sight of either. Overall, I think the key is LLMs are great at making human humans better, helping guide helping guide them, but the ultimate decision, I think, always needs to be needs to be coming from a from a human. If you just look at a if you actually look at an analyst in an organization making a decision about something, it's it there's actually there's so much organizational context required. It's it's, you know, what is that person's role? Is this pattern of activity, you know, normal normal for for for their role? And often, they're actually reaching out to people and, you know, asking them about asking them questions and thing and things like that, working very cross functionally across multiple tools to, to arrive at that final final decision. So if I if I'm a buyer, and, you know, 99% of organizations have some sort of endpoint prevention tool already installed. It's one of the most ubiquitously used cybersecurity tools out there. So but people are continually evaluating them, potentially looking at opportunities to upgrade. So if I'm a buyer and a vendor comes to me and says, I've got AI powered prevention, and it's, you know, it's in their marketing materials, in their slide decks, it's on their website, and then probably is for for a lot of vendors. What questions do you ask? You know, as how would you evaluate that? What what do what do you what do you ask that that that that salesperson? Well, tell me what that means and what that's doing so that you can start to get to the root of what is the capability here that's actually being proposed. Yes. I mean, I mean, I I think I think that's exactly the question to ask. Like like, you know, there's there's nothing worse than kinda AI being kinda presented as, like, you know, mystique, just magic, you know, magic. All these models okay. You you you don't have to understand the the kind of the intricacies of how an LLM works or or, you know, kind of machine learning, you know, classifiers or any anything like that. They're all plugged into, like, IT environments that, you know, most people or everyone on this call will will understand. So, yeah, what are the integrations? Like, how does it, you know, how how does it plug in? What data is it taking in? What decisions is it make is it is it operating on when it makes, you know, when it when it makes those decisions? Yeah. I mean, it's the absolute basics. Are you talking about blocking, you know, executables, or you are you talking about kinda anomaly detection across multiple data sources? Just basics basic stuff like that. Then I really like to dive in on how they're measuring efficacy. Like, if you like, the the vendors that really understand AI have data science teams that have a lot of rigor around the way that they prove that their models work under specific constraints in certain situations. So, you know, a a a kind of crude analogy might be, like, regression testing, kind of test cycles in software you know, in in software development. You, you know, if anyone if you if you understand software engineering, you know, you're pretty reluctant to buy from a software vendor who hasn't got good test coverage because they're gonna have really big quality problems. The same applies in, in in AI. Data, you know, data science teams will be able to give you a really good or companies with good data science, teams will give a really good answer around how they're approving and analyzing the efficacy of their of of of their models. That would be where I'd really hone in. Yeah. Yeah. And I think in most cases, that's gonna be a a follow-up call for a lot of vendors because I think, you know, that that frontline salesperson who's been told to kinda AI wash, everything and just append it to every statement, probably isn't gonna be that well equipped to answer some of those those questions. But that I think that's what you have to do as a buyer right now is evaluate that, and on both ends. Right? Because you mentioned, you know, the the prevention piece of it, but also in terms of how AI is being used to augment a human analyst, operation workflow. You know, is it serving up data to them in in a way that makes it easier for them to assess the situation and make a decision, versus claims to fully remove, the the human from the loop. So I I think, yeah. That that those those those should trigger, you know, ask follow-up questions in any anytime, a vendor is positioning some of these things. Yeah. Alright. Absolutely. We've kinda danced around the topic a little bit. We've even used the term shift left. So, Ross, can you kinda give us the the the the origins of this term shift left and how we're applying it here to endpoint security and preventative controls? Yeah. Yeah. So so, I'm obviously responsible as well as security operations internally in protecting Sophos. I, obviously spend a lot of my time on product security, application security. It's a really critical part. Yeah. Obviously, we like to we aim to build very secure products, obvious reasons, but but you all. And, this concept of shift left is very common in application security and engineering circles. It's, yeah, it it's the basic concept that the earlier you fix a bug in product development life cycles, the the less costly it is to make that fix. So the extreme example of that is if it's caught at the IDE phase or, you know, literally the the moment the the engineer writes a bit of code, if the IDE pops up and and and spots a little bug, you know, it's often just like an autocorrect type fix. Takes almost no time no time at all. Then you go through the pipelines, and, basically, every step gets more expensive. So you might catch it at commit time. The engineer still, you know, the engineer still written however many hundreds of lines of code before they commit. So now now they're having to reload that bit and try and figure it out, but still tolerable. You might catch it in your pipelines, in your testing. Sometimes that means you can block a release. That's expensive if you're blocking a release because it basically means that you've slowed down the entire engineering team much as the engineer made the bug, but the real cost comes in if it's in production. And there's been a ton of studies done on this, but, and I wouldn't I wouldn't try and I I I I wouldn't try and guess guess the stats right now. You'd have to find them online. But we talked about, like, orders of magnitude difference in terms of fixing a bug, preproduction versus in production, especially if it causes a causes an incident. So shift left has been a very it's it's what's very strange to me, shift left has been a I mean, it's an obvious concept, but it's been a very trendy concept in over the past couple of years or the past past few years. The the terms really gained prominent, and it makes a ton of sense why. But the weird thing is no one applies it to security operations. It's exactly the same it's exactly the same concept concept. The economics behind it are identical, but shift left is super trendy in in AppSec, but it's almost not trendy. It's almost the opposite of trendy. Prevention is seen as something that's, kinda old school in in endpoint security or security operations. It's the there's a very strange dissonance in my in in my head around that, basically. Yeah. I mean, certainly, how many reports do we see from from from various vendors, us included, that that quantify here's how much it costs to recover from a ransomware attack or here's the average cost to recover from any number of incidents. And those are all, you know, quantifiable measurements of the the cost of of not having good prevention or or or good security operations as as a collective. And and so yeah. I mean, that's that's certainly part of it is how can we how can we stop more upfront left of of of of that investigation work that needs to be done or the the triage that needs to be done or the response that needs to be done, Prevent those things from working their way downstream, and that's gonna make you more more efficient. So it's it is an obvious application of the term shift left. But but, yeah, I I would agree. And this is kind of the the premise of where we started this webinar. There is this this kind of acceptance that all prevention tools are the same. And and that that thing that I should be focusing on as a as a as a buyer or an operator or or a leader is the detection and response capabilities because everything now is a is a Doctor. Right? Endpoint detection and response, identity threat detection and response, manage detection and response, extended detection and response. And so these are the the acronyms that have kind of, been center stage. But, you know, again, I work with the analyst research community. There's a reason why Gartner still cause calls its keystone report the magic quadrant for endpoint protection platforms. It's endpoint protection. It includes some of those detection response pieces, but they that's an acknowledgment that a lot of this does start with how can you how can you do things at the protection level, preventative controls first. Yep. Absolutely. Absolutely. The military the military uses it as well, actually. You might have heard this term, you know, less of boom. Again, it's, it's exactly, you know, exact exactly the same thing. Let's avoid the explosion, whether it's a real one or a or a metaphorical one on an endpoint. Alright. So covered covered a lot, Ross. You know, kinda closing thoughts. If we if we kinda go back to to the full list of things here that that we covered, maybe give the one or two sentence summary of of each of these points working from from top to to bottom here. The the takeaways that you think people should have, as as as as they as they walk away from this webinar and get back into the thick of things. Yeah. Yeah. Absolutely. So so I think the the first two, it's about building up the processes that ensure that you are learning from your prevention failures, essentially, which are your detections, and building out the RCAs to get to get better. Covers the first two. The hype from reality is don't be kinda wowed, and feel outgunned by the salesperson who's making these crazy, you know, complicated sounding AI claims. You understand how this works probably better than you think you do, and just ask the questions to figure out how that AI actually plugs in in reality, and that will give you a a real a real ability to kind of sniff out the the legit applications from the from the snake from snake oil. And then finally, don't, you know, let's just kinda, you know, collectively try and tackle this kinda outdated, weird notion that shifting left is only a concept that works for for software development and isn't something that we can apply, you know, really successfully to endpoint security, and security operations as a as a major, you know, major economic, you know, offering major economic value to, to every company that thinks that way. Very good. So I do I do have to ask one more question because you're a CISO and because CISOs and whether you're a CISO or you're an IT leader in charge of cybersecurity or you're a security leader, increasingly, you're having these conversations with other with nontechnical stakeholders in the organization, your c suite, your your board. And so if if if we're we're if one of our calls to action is, you know, let's kind of orient ourselves as as an industry to to shift left. How would you have that conversation, Ross, with with a board? Right? You you report to our board. You you you have these types of conversations. So what what what what guidance or advice would you give to someone who is, you know, gonna embrace this concept and and start to implement this in their program. How would you talk about this to to board or or or or c suite stakeholders? I would I would talk about it in terms of scalability and efficiency. So, you know, most businesses are seeking to grow, and they're trying to grow the top line faster than they're growing their expenses, obviously. But at the same time so you're trying you're all trying to do more or less. Right? But at the same time, the threat is also growing. Like, you know, attacks are getting are are are just increasing. This is an ever relentless increase in the volume of attacks. So you've got kinda got this double it's this double growth if you will. You're growing and the attacks are growing. So if you're not focusing on preventing earlier, then how on earth are you gonna scale your security team? It's just not it's just it's just it's just impossible. You've you've got you've got to get smart. You've got to get there. Yeah. Which gets back to the fundamental, you know, cost. Right? The economic case of it is it's about driving efficiencies, reducing risk, and being able to quantify that and use some of the measures that, you know, that Ross Ross talked about, that are based on how much time gets spent on some of those work that's based on the the economic impact of of incidents and and breaches. So there there are certainly a lot of ways to make this real for those stakeholders who are looking for improvements and and and and efficiencies. And and, ultimately, as you said, do more with less. You know, be more effective with with fewer resources or or with less less cost. Alright. Ross, thank you so much. Ton of insight from you. Really appreciate it. To everyone who's who's who's joined this, and and and listen to this, thank you for taking the time. Ross, how can people reach you if they've got more follow-up questions? How do you how do you want them reaching out? Yeah. Absolutely. Link LinkedIn is is is a great way. I'm available available on LinkedIn. I'm on Twitter as well. You you find me. It's very easy. It's my my my name is my handle. So, yeah, lots of ways of contacting me. Very good. Well, yeah. Certainly feel free if you wanna talk to to a CSO. If you've noticed, you probably have noticed, Ross is not your typical CSO. You can you can talk about things at a very technical level, but he can also talk, to things that at more like my level, which is really helpful for for me and hopefully, for some of you as well. So thank you again. Much appreciated. And, yeah. We will see you all on the next one. But thank you for joining. Thanks.