Everyone, including us here at Channel Insider, has had a lot to say this year about the ways that AI demand and cyber security requirements are converging, offering new threats, new complexities, and for service providers, helping customers, new opportunities to show up deeper in the business, embed with leadership, and find new ways to keep companies secure. And that is the focus of today's episode with Optive. I'm joined today by Kathern Hall, the senior vice president of services, and Steve Fielder, the VP of engineering and AI solutions at the cyber security focused MSSP to talk more about how they've restructured and reworked their own offerings to customers, the ways that they're operationalizing AI, not just in the ways that they deliver services, but in how they're thinking and structuring the work that their analysts do internally.
We talk also about what cyber security and other technical leaders need to know at end customer organizations to make the most of an MSSP partnership with a group like Optive. And along the way, plenty more about what the future has in store for AI enabled threats and for AI enabled defenses against them. As always, thank you for watching and let's get to the conversation. Okay. And I am joined now by Katherine and Steve. Thank you both so much for taking some time. >> You're welcome.
It's great to be here, Victoria. >> Yeah, thanks for inviting us. >> Absolutely. Before we dive into the topics we'll talk about today, if you could each take a moment just to introduce yourselves to the audience and and what you do at Optive. >> Sure. My name is Katherine Hall. I currently serve as senior vice president of services, which ultimately means that I own our services organization, the portfolio, and all of the practitioners that deliver day in and day out to our customers. >> I am Steve Fielder.
I am the vice president of engineering and AI solutions. Effectively, what that means is I own the platform. >> Simple enough. >> Yeah. >> Well, thank you again both for joining me today. I know we're going to dive into a a wide range of cyber security topics. Of course, AI will come up as it I think at this point has to in tech conversations, but before we get into specifics, I wanted to to pick both of your brains a bit about how Optive does approach security and those services.
Uh, Katherine, obviously, as you highlight them. So, if you could walk me through a little bit about how Optive approaches security for your customers and how that's probably evolved, I'm guessing over the past few years as security has. >> Yeah, absolutely. The landscape is changing a lot and as a services provider, we have had to evolve too and for the better quite transparently. Um, Optive over the years has solidified its position as an end-to-end security solutions provider.
Sure. So what that really means is when we're interacting with a customer, we are there from day one advising them on their technology selections. We have obviously a very large resell business where we have access to a number of technologies. But from a services perspective, that advice piece can start with not only the evaluation of technology, but assessing maturity of a current security program. Um and then we also do deployment work. Implementing technologies has been a necessity for a number of years but that over the years has really evolved into more transformational engagements and that's where we've really centered our focus in transformation work that leads to operations.
So today the the majority of our services business is focused on that operations piece. Um because what we've learned over the years is once the customer has the technologies required to see what's going on and secure the environment, they really do need um a provider that can act as an embedded partner in their environment to not just be there for a point in time project but there for an extended period of time. So that that's been a major shift for us in how we deliver.
So you'll see kind of optive in the market really positioning more of those long-term services engagements like managed security services, staff augmentation, subject matter, expertise services because that's really where our customers are struggling today. >> Steve, I'll maybe bring you here and now and then Katherine obviously would love your perspective as well. I think it's probably a safe assumption to make that AI and AI related conversations have also shifted what customers are asking of you and and what they're thinking about.
So walk me through if you could how the kind of wave of AI adoption and I know that means many things to many people but what that has meant to to Optives approach internally and how you structure that and then how you bring that to customers. There's a lot there, right? First and foremost, there's >> it's a lot to unpack >> there. I'll I'll just kind of start with the AI powered security tools, right? So, every security vendor um in the market for the most part at this point is making some type of claim around their ability to detect faster or perform an action leveraging their um embedded AI um tooling.
So part of the work that we do as an organization through our research and development arm is evaluate those claims and really assess the sustainable um technologies, the emerging technologies that have legitimate use cases and have strong um foundations from a product perspective. Uh so we do a lot of work um in that space and Steve's team you know has the ability to get their hands on these tools to evaluate you know whether these technologies are fit for largecale uh enterprise services right um and then there's actually securing and governing the AI that exists within our customers environments um you know I think the challenge that security leaders have um is business the business units and the marketing teams and the sales teams like all of the enterprise um business units have been empowered to use these tools and it is the security leaders job to reduce risk and ensure that these tools are used safely but the former typically is far ahead of the ladder.
So we are working with our customers to help um really like get a sense for what is out there um and what are these agents interacting with, what do they have access to, how has this evolved our customers attack surface. So those two major areas that we're um leading in conversations with our customers and then obviously I can defer to Steve. He is his team is really the one that is building solutions that are not only enabling us to deliver um with an agentic workforce so that we can you know keep pace with AI powered threats but he is also evaluating those tools to ensure that we have the ability to secure that new attack surface.
Right. >> It's a lot of fun right now. It's a new convergence of the same tool but across so many different departments and workflows and requirements. So like it it's not just a it's not just a services tool. It's not just a marketing tool. It's not just a legal tool or a security tool, but all of those teams need to be involved for us to be effective using it both internally but also for our clients. So, it's kind of new because it requires more collaboration across an organization than probably ever before, at least if you really want to be effective with it. >> When you think about the way that customers are coming to you, Katherine, you highlighted there a point around the fact that security leaders are not necessarily the ones deciding AI tools are getting implemented and then do have to manage that risk kind of once that's been in place.
Have the conversations that you're having with customers, with security leaders, do they feel different maybe this year than in years previous as these kind of risks come to the forefront of their minds or or do you think the conversations are largely the same just about a new set of tools? >> I think it's shifted like everything is happening so fast, right? >> So fast. 18 I would say like 18 to 24 months ago the conversations we were having were very fear-based um and were very centered around is my enterprise environment ready um what can I do to prepare for the implementation of these tools to ensure that we don't have overprovisioned users we don't have payroll data being exposed you know there's a number of like very commonly used um nightmare stories that have happened um out there that that really kind of came to the forefront of the conversations that we're having.
I would say the comfort level with AI has really taken shape in that um security leaders now have accepted that this is inevitable. Organizations are under a tremendous amount of pressure to not only automate lowhanging fruit administrative work across the business, but they're also expected to transform their businesses and generate new revenue streams and and new products and services around these extremely powerful LLMs that are available to all of us.
So um that conversation has shifted to okay um this is happening um how can I immediately um not only take advantage of these tools because we're we know that the AI powered attacks are here they're happening we've seen them so how can I arm myself because I don't have time um and also how can I act rapidly to implement um some type of tooling and there's a lot of options out there to understand what I have in my environment, what those risky agents are, and really start to be able to articulate what our risk posture is given this new attack surface.
Right? So it's it's really trans transitioned into more of okay help me harness the use of this and help me um understand the risk conversation because ultimately that's what our security leaders are responsible for managing and reducing risk >> and like a key thing that I want to highlight here is time people can move so much faster now than what they could in the past so like the business's expectation like security always had trouble keeping up with making sure that the organization was secured.
We had the appropriate tools and things in place. Now there's this new really shiny tool that's really really good and everybody wants it and they can move faster far faster than ever before. So having a security team that can keep up with new layer of governance and new processes to ensure that we're discovering the things that we need to discover and people are using the tool safely for the organization. It's hard. It's really hard. >> Well, and Steve, that kind of transitions into the next thing that I wanted to talk about.
So, thank you for the segue. I appreciate it. But I know one of the the common refrains we also all tend to report on talk about is the idea that you will need AI to fight an AI powered attack moving forward that it's not enough to use a traditional defense because to your point everybody's getting faster and more efficient when you think from a a tech perspective as somebody who works with the tech quite frequently where do you see the real kind of exciting opportunity for security leaders to your point to get faster and to use AI while at the same time defending against a threat actor who also can use the AI. >> One of the interesting things and like we we've gone from this is a scary new tool, we shouldn't use it because we can't control it.
All of those things like some of that does still exist today. But over the past year and a half, attackers have been able to use AI to move very rapidly in whatever it is that they're trying to do. So, prior to AI attacks could take months, weeks, maybe days if they're lucky. Now, we're down to hours and minutes. It's it's very, very quick now. And the nice thing is security teams and tooling and everything is now starting to adopt AI into their platforms, into their processes, into the way that they handle and respond to threats.
So, not only can we plug the holes faster, but we can identify when an issue has occurred much faster. In addition to that, detection and response, though, think SIM and traditional alerting, that's historically been a, you know, find the needle in the haststack. There's always so much noise and the operational constraints that come with that. The only way you could overcome that in the past was with more people. And security is historically underfunded.
Granted, like I work for a cyber security company. We like selling tools, right? But like it's it's not as funded as say traditional IT because it is treated as risk mitigation and a cost center. It's not it's not a revenue center. So having a tool that allows security teams to one check all of those needles in the haystack and reduce that hay stack down to something that is far more manageable allows them to transition their staff into more meaningful roles.
So think of a traditional tier one analyst. That person can very easily move up into being a tier three, tier four analyst. like they'll need the reps for sure, but they'll have more time to be enabled and to learn and grow on the job versus this is all I have time to do and it's never going to be enough time. So allowing teams to have more time to improve and offloading some of that human requirement to AI allows everybody to be more effective. And I'm not saying offload all of the decision-making.
And there should always be a human in the loop coming back and going, "Hey, I agree with this or I don't agree with this. This is how we should move forward." We're not saying replace that level of decision-m because that's not a great idea. But allowing that person to really have the time to be able to understand truly what's going on is so nice. We haven't been able to have that before. >> Yeah. I think if I could simplify what you said like I in our world where we are running global security operations for hundreds if not a thousand customers um it has enabled our analysts to get their jobs back.
Um and and what I mean by that is um and any anyone who has run a sock like before these tools were available and we've we've had soar available to us for many years. We've made a lot of progress in terms of what we can do to take quick actions on alerts, but this is the first time we can confidently say that we can address 100% of all alerts that are coming into the sock without expanding, you know, your analyst footprint by 10x, right? because there that has diminishing returns for a security team um in a typical like mid-market enterprise that's just not realistic.
You've really only previously had time to look at your your criticals and your highs and everything else was just we'll get to it when we can >> and you never get to it >> and you don't get to it, right? >> And that's the risk that most enterprises accept. The other kind of really amazing thing for us is beyond giving the analyst back time to focus on not pulling together information, not doing investigation work per se, it really brings them back to making authoritative decisions on all of the information that has been brought to them that they are no longer spending all of this time seeking out. so that you know the meantime to respond can be dramatically reduced and that just kind of creates a richer job experience for our security analysts.
And then from like a detection engineering perspective like the the opportunity for coverage is just exponential now because we have the ability to generate detections so much quicker and easier. And there's a lot of conversation around the proliferation of AI powered threats which is very real like time is not on your side but you know what we talk about with our customers is that that's a consideration. However, you and we as your service provider have far more context um from than the outside.
So, you know, we can still defend um but we have to defend differently and you'll, you know, that's reflected in how we're shaping our portfolio. Um because detect and respond isn't enough anymore. You know, we really need to be pushing more into understanding our exposures, our vulnerabilities, um and addressing those in a more continuous fashion. and and that is what we're seeing in the market where our customers are focused in terms of how can I continuously evaluate what my uh most exploitable vulnerabilities are and that's you know really kind of the mythos conversation um how can I ensure that you know I have total control or at least visibility into what my most vulnerable exploitable assets are.
So um it it is an exciting time. I think there's a little bit of fear-mongering going on um out there, just a little bit. Um and you know, I think for for us, like in particular at Optive, it's very important to us that we help our customers kind of parse out what's legitimate and what is fearbased marketing. Um because at the end of the day, like Steve and I, we're entrenched in the day-to-day with our customers. Um we're like living and breathing with our customers. you know, it's we do have like a very robust resell motion and we have incredible tools available to us, but sometimes it's so much more than that. >> On that note, I did want to ask to your point on the fear-mongering, right?
I know security conversations this year have felt very everything is different, everything is worse, I have to talk to my customers so much more than than maybe I felt like I used to. What I'm hearing from you though is is the flip side of that coin which is also well we have these tools now too and we can do new things too and and we can support our customers. So what excites you now kind of moving forward in this new era to use the overextended metaphor but what excites you about continuing to as optive support your customers no matter how cyber security continues to evolve? >> This is actually the one that I'm most excited about. previously services like we are able to tie them together but you lacked contextual awareness across a lot of the different services depending on what it was that you were trying to do.
So if a client had vulnerability services or they have detection response or they have an identity program or manage PKI, a lot of different and related but independent services. Now we're able to contextualize a lot of that data that we never previously would have been able to pull in because it's just way too much to understand. But with the proliferation of AI, we're now able to pull in all of that context, additional business context, and create a much more meaningful offering for our clients so that way they can consume services in a way that actually shows either one, maturity or risk reducing down.
It's so cool. >> Yeah, the the integration piece for us is extremely exciting. We have been guilty of this, but a lot of the industry in the past has been let me go sell you this tool, this endpoint solution, this SIM, this sore. We're going to throw, you know, some implementation services on it, stand it up, configure it, and and maybe we'll manage it. We will we'll manage the configurations. We'll do upgrades. We'll monitor the alerts coming out of it.
But that deep integration with the entire security technology ecosystem that the customer has that has been a struggle. It's been possible but it takes an extraordinary amount of time um to establish that integration. Um but beyond that now having the immediate context available us to understand what's going on is is very very exciting because it it means that we can provide more meaningful value to our customers that have entrusted us with running their security programs.
So that kind of embedded partner that's nirvana for us, right? But at the end of the day, like your typical enterprise does not have the resources internally um or the time or the right talent to to make that happen day one. So for us to be able to provide that as a service um that is accessible to mid-market enterprise smaller businesses you know that to us is very very rewarding. >> Going back to the context piece because I do think it's important we talked previously about attackers having the advantage in minutes and hours.
Now the one thing that they lack is context. The one thing that a security team should have, maybe they don't, it depends on the organization, the maturity, where everything is at, but the one thing that they can very easily have now that the attackers don't is that context. >> It's an interesting point. I don't know that that gets talked about as frequently as as maybe some of the other kind of scary headlines that tend to come up. Well, we do we do like to figure out how to make people scared because it does make articles much more uh >> Well, so the other thing that I would say um yeah, I I have no comment on that because it it's just I think an ugly truth of the industry.
Um and you know, we over the years have really tried to steer clear of that um because it it really is quite unsavory. But at the end of the day, you know, for us, what is also very exciting and um this is really for our peers who are on the industry side trying to justify, you know, increase budget and trying to reduce risk for their organizations and and not be perceived as like the business disabler. this AI moment has created just a further necessity for security. um like this safe implementation and roll out of AI cannot happen without a strong data security program, a strong data governance strategy, a strong AI governance strategy, an understanding of what where all your data lives, who has access to it, um what the agents can touch and see and do to have meaningful AI transformation as a business that cannot be achieved without extremely strong partnership with the security teams.
And so that has been very exciting because security is often an afterthought. And in in a lot of the transformation work that we've seen over the years, cloud being kind of the more recent of them, security is just kind of like, oh, we got to, you know, work with our security team after the fact. But it feels very different now. Um and in terms of kind of the conversations we are having today like we traditionally have worked with the the CISOs the directors of security operations you know CIOS to an extent cloud leaders to an extent but it is very common place now to have the chief data officer to have the cloud leaders the infrastructure leaders everyone at the table um because they understand that we need to all be aligned in order to um accomplish the business objective of leveraging AI to you know fuel transformation work.
So I think that's fantastic and and you're kind of seeing that right in like the emerging technology the um in the the black hats and the RSAs of the world the the types of personas that are showing up to those events. It's it's quite different than than in the past. It's not just pure security anymore. I know we've talked about it throughout our recording today, but I'd be remiss, I think, if I didn't just ask directly when you think about how you've operationalized AI just internally with your own teams as OPED.
And Steve, I know this is probably a softball question for you considering it's in your job title, but um I'm sure you were figuring out how to get it internally working right as you were taking it to customers and helping them with those security conversations as well. So how have you as optive found the use of AI to to be improving your work? >> I think there's a couple of aspects to that question that are interesting. So a lot of the early adopters for you know we we need to shift to a more agentic workforce which do need to do that but the early adopters are finding that they steamrololled through a required component of that which would be governance.
Having the understanding of how everything interconnects, like Cat was saying, what it costs, what people are doing, all of that visibility allows us internally to have a program that is far more meaningful for the objectives that we're trying to accomplish. In this context, it's not just security the way we use it like we use it for security, but we also use it operationally to just be better at our typical day-to-day. So that governance program doesn't cost as much when it's not the afterthought, when it is at the forefront of how you move forward with an AI program.
What I you're very you're very right in that um governance has been an afterthought for early adopters and we've seen customers rolling back the um fullcale roll out of some type of tool. But I I think what's actually more there's two things that um we have learned on our own journey as an enterprise rolling out AI for our teams and we we've done all of the typical things. We have an AI council. We have a center of excellence. We have business unit teams.
We have approved tools. We are a managed security services provider. So, we have very very strong controls in place in terms of how we're handling customer data, what tools and LLM are able to access customer data, how that is segmented from the rest of the business. But with that all aside, um, you know, I think what we're more focused on is ensuring that the juice is worth the squeeze. Um, because in the early adoption of, you know, the co-pilots of the world and claude, etc. within the enterprise, it it really was just, you know, layer on an agent to support a task that we used to do.
Um, but that doesn't re really yield the the multiplier in productivity that boardrooms and executive leadership teams are drooling over. What's required to achieve like the 8 to 10x in productivity is really understanding all of the processes and workflows and things that you do across the organization day in and day out and and essentially spending the time re-engineering those workflows. understanding like how an agentic workforce fits into that.
And there's a lot of different types of agents. You have your agents that are analysts. They're doing research. You have agents that are orchestrators. You have agents that are guardians. So, they're the audit piece. But those agents need to be built and set up in a way that they are not just replacing human work. they are you're reimagining how that work gets done so that it can be done better, more efficiently, more accurately. So understanding every system that that agent needs to talk to, what data that that agent needs to talk to, what research that agent needs to do.
So that is really where the real transformation work happens. Um but the reality is is many organizations are not there. That's the transformation journey that we have been on and that Steve and his team are helping to lead. So it's actually like re-engineering the work that you do so that you can automate and augment you know bring new value. You know we're a services provider so we're constantly measured on the value that we're bringing to our customers and our customers expectations are going up and up and up because they just assume that every provider has every single tool enabled and figured out.
Um but the second piece of that is your workforce. The agents are one thing, it's the technology, it's great. Um, and you know, the re-engineering is the process piece, but your your people need to be reskilled, too. Um, and we're very fortunate in that we already have spent an inordinary amount of resource on ensuring our people are up to standard in terms of their technical certifications, their industry certifications, ensuring that we are continuously creating an and a learning environment so that we are all up to date on on what's going on.
Um so we have that muscle already but that team is now responsible for the reskilling and in some cases upskilling but mostly reskilling for our various security roles to be able to operate um with an agentic workforce. So like how do you you know creating a learning path so that a cloud engineer can now operate with an agentic workforce performing certain cloud engineering functions. that is a very different skill set. Um, and we are partnering with third parties to build um, out that curriculum.
But if you're not reskilling your workforce, you're leaving your people behind and your results will be impacted. Um, because and their ability to make the right decisions will be impacted as well. Security will always be our expertise. Um, but this is a new skill set um that that really requires time and attention to develop. So um those are two like learnings that we've had on this journey. Um and it's given us the ability to just kind of help our customers along the journey as well.
Like a lot of the conversations that we've had in the last six months like yeah they want to understand how we built our agent security operations like what the agents are actually doing how that architecture looks. It's very fascinating and and Stephen and his team have done a great job there, but you wouldn't believe like how many organizations are actually like where did you start in your strategy? What about your people? Training your people.
Um did you establish a lab that was, you know, safe for your personnel to play around with without an agent going rogue and doing something really bad? It's really meaningful for us to be able to provide that um as a services provider and as just a a security group that cares a lot about you know the future of where organizations go. >> There's so many different aspects to this that like keeping it all straight. It's it's >> playing chess with people and processes and technology and getting them all into a spot independently where eventually it converges into something so much more meaningful.
But it's it's a lot of work. Rewarding work, but it's a lot of work. >> Well, as we kind of start to to wind down our time today, and thank you both again so much. We've covered a lot. Be that people, be that processes, be that tech, be that the future of the industry. What is one thing that you want every or at least most security leaders at and end customer organizations to think about when it comes to AI and security to know? What would be helpful to you as a provider and you think generally to the market if more leaders understood a specific aspect of of where things are headed?
First and foremost, I I think it's really important to acknowledge that every organization is at a different gate >> um in this journey and that's okay. It is very much an opportune time for an organization to lean on an organization like Optive to help navigate what other organizations are doing, what options are out there. There's the build first buy conversation. There's very overwhelming number of technologies that are making claims. But without a very thoughtful strategy, none of that is going to matter.
Um, and and having a reasonable time frame and plan for how to prepare for not only some of the evolving threats that are inevitable, they're out there. But how to thoughtfully prepare your teams, how to take that on, um, I think is a really good first step. This is a journey. like it's always been a journey and there's, you know, we've talked so much about the the claims, but none like the strategy work is is really important because they can serve as the guide for how to approach this in a in a way that is relevant for the industry that you're in.
Like healthcare is obviously very different from financial services. The stakes are different. The the actual consequences can look very different. So understanding what those organizational priorities are is is number one. Um and partnering with like an optive right not just to make a plug for us but we have invested heavily in groups that live in the field to help customers in this way. Um and a lot of the work that we do at this point with our advice is part of our pre-sales motion really because it we need to establish trust and credibility.
So by putting like we have an AI center of excellence. So we have skilled resources that have done this as practitioners in the field that are actually sitting with and walking through like recommendations for AI strategy with our customers. And that really does create a very natural um conversation around like okay which which tools might be a good fit for governing these agents and well maybe we have to take a step back because we don't even know what we're protecting. um we haven't quite figured that out.
So don't like lean on your peers because there's a lot of really um great conversation happening about this and and there are organizations that are pretty far along and are very willing to share because we're all learning this together, >> right? Like this is all so new that like it's a pretty equal playing field. It's a pretty level playing field for all. Um but it won't be for long. So I would also say don't sleep on it because it's it's here. >> Yeah.
Even if you're behind, plenty of people are behind. We see clients across a variety of different maturity landscapes for where they're at with AI today. Being behind is fine, but ignoring it is not. The way we learn, the way we excel, my teams, is by collaborating with our partners, our vendors, also our clients. We're all learning from each other at the same time. As Cat said, it was good opportunity. >> Yeah. and and assessing like what is reasonable to accomplish in house versus what needs to be outsourced.
We're seeing a a huge um increase not only in like demand for okay probably not going to be able to implement like an autonomous sock tool effectively. Um, but it I would love to work with an organization that already has built that and I can plug into it and then not have to, you know, upskill and reskill an entire workforce on that area. But maybe there's um another area where an organization wants to lean inhouse. But even like bringing on specialists for client, you know, directed work.
Um, we're we're doing a lot of staffing just for for deployed engineers, security engineers, architects, AI architects. There's maybe not a long-term need to hire for that resource because they're extremely expensive. But, um, a provider like Optive can drop someone into a customer's environment to help provide that thought leadership for a period of time and then help kind of accelerate initiatives so that it doesn't feel so overwhelming. AI security needs to be a program. >> Yeah. >> It's not just a tool or a person or a product. >> Well, I think that gives people lots to think about and lots to ponder.
Thank you both so much for the time. If that learning call to action has inspired people to go learn a little more about Optive, where would you send them to find out more? >> Directly to her. >> Okay, great. >> Probably.com. >> Send her email. >> Yep. Thank you both so much again for taking some time. >> Thanks, Victoria. It's a pleasure speaking with you.
This transcript was generated automatically from the
video's captions and may contain errors.
