 Good afternoon, CUBE community, and welcome back to stunning Stanford University here in Palo Alto, California. My name's Savannah Peterson. Delighted to be celebrating International Women's Day with all of you here with our live coverage of Women in Data Science Worldwide Annual Event. We have had a power packed day so far. We are about halfway through the day and I am super excited for our next conversation. We're gonna be getting technical and we're gonna be getting a little dark talking about AI and cybersecurity and the threat landscape. Please welcome Nicole to the show. Nicole, thank you so much for being here. Thank you for having me. It's a great way to spend International Women's Day. Isn't it? I really, we were talking earlier just the energy and how, I feel like the energy is both really high but also very calm. Yes. With it being just a room full of super confident women. Yes, which is lovely. And also just getting to see the spectrum of women. Like in diversity, but also in age, like early in the career, advanced in their career, and really just building together, collaborating together and just supporting one another. It truly does feel like a culture of support. How long have you been a part of the WIDDS community? This is our first year. Oh my gosh, well, welcome. Thank you. It's exciting. It's my first year, I know, that keeps me around for, I think at least five or six years, maybe seven with them. They've been doing it for nine. Very impressive organization. I was just thinking about women who were part of the original founding of this organization now 10 years farther down in their career. Imagine how it's changed. Yes, drastically. We actually did like a retrospective yesterday internally with Dark Trace and just, there's an aspect of how incredibly it's changed over the course of my 25 plus year career. And at the same time, like learning from those lessons, opening up the feedback to those who are younger than us because they have like a different perspective and not trauma sharing what we've had to go through. And really just continuing to push it forward and making it a better work environment for everyone. Yeah, absolutely. And may the next gen not go through any of the trauma that we went through. I think that's a really good point. You were a total baller in cyber AI. Tell us a little bit about your role and what you're doing right now. Okay, I have a really cool position at Dark Trace. I'm the VP of Strategic Cyber AI. It is a strategy position. So I basically get to touch every aspect of the business. I work closely with our go-to-market teams and our customers and helping and consulting them in their best security solutions. I also get to work with marketing and changing our technical messaging. I get to work with R&D and really like dive deep into our machine learning models where we are, where we're going, where our gaps are. And I also get to work with obviously the product teams. And then I get to do lovely events like this, which is thought leadership in our capacity. So I get to do community, corporate sharing and all that kind of stuff. Oh, that's great. So you really do get a cross-functional, cross-vertical look. Yes. Not only across your team but at the landscape at large. Yeah. So given your perspective, what's the threat landscape like right now? Oh, goodness. So obviously AI has made a drastic impact on the adversary threat landscape in the last 18 months. So when generative AI hit the scene, those large language models very quickly adversary started innovating and jail-breaking them through prompt-based injection, manipulating them, turning them into autonomous agents that could augment their attacks on demand. So we saw the rise of warm GPT, auto GPT, broad GPT, hack GPT. And it really made a big impact on the email security landscape in the last year. So it drastically changed how adversaries were able to effectively fish organizations through novel social engineering attacks, as well as also hit organizations that happen to not be hit prior because of their local dialects and their local languages. Oh, that's a great point. But generative AI now has given adversaries access to be able to craft very sophisticated emails in those languages. Wow. So last year when the generative AI tools hit, within two, three months, we saw a 135% increase in novel social engineering attacks. We decided to revisit that at the end of last year. And between a course of two months in December, we saw another increase, an additional 35% in novel social engineering attacks. And we saw, even across our customer fleet, near 3 million phishing emails in the December alone, which was a 14% increase over the last two months. So email was hit hard. But we expect that this is going to transfer to all the other domains, like cloud, SAS, ITOT, network endpoint, really because of a lot of organizations lack of visibility across those domains and how they interoperate. Adversaries kind of ping in on that. But then also, we're seeing a lot of research being done on multi-hop reasoning and complex decision-making of autonomous agents. So we expect that the threat landscape is only going to change dramatically over the next 12 to 24 months. It's so interesting to talk to you because we think about the opportunities and the applications of AI for good, right? You know, in health care, in space, we were just having a conversation in combating human trafficking, whatever that might be. On the flip side, these tools have also made it more cost-effective, faster, and easier to your point to do these very novel, personalized attacks on a variety of different people. How do you, as a cybersecurity professional, stay as ahead of the curve as you can or in an anticipatory way so that you can help your customers defend against this increased velocity? Yeah, so the good thing is we started off as an AI research and development center out of University of Cambridge 11 years ago, so we're AI-leaning and forward to begin with, and it was founded by mathematicians and cyber defense experts on how do we perform intricate advanced threat hunting autonomously with the use of AI so that we can contain incidents, mitigate the damage, and machine speed. Buying human defenders time to come in and actually perform a more complete investigation and remediation, but as adversaries are innovating with AI and really going to change the landscape with autonomous agents, we too, as defenders, should be doing the same thing. We should be able to uplift our security teams with AI so that the AI makes hundreds of micro-decisions that are needed for the detection and response, allowing the security operators to kind of take a step back and look at all the data that's being presented and being able to look more strategically across multiple different domains, what does the entire incident look like, and also if we can stop it earlier in the attack kill chain, we've now mitigated the damage, we've now reduced that and that now allows our human defenders to go in and perform a more complete remediation before it's spread thoroughly. And is this a shift from how cybersecurity was approached before we had this kind of technology? Yeah, so traditionally, and this is a lot of my background, so traditionally, when we started applying AI or supervised machine learning to the cybersecurity problem, we were looking at troves of big data. So we were taking in known and historic and reported attack data and building out predictors and classifiers to be able to find those trends so that we could maybe identify in real time within a customer. So this takes a much more macro big data approach. A lot of it ended up being very dependent on rules, signatures, and IOCs, which is what we share very freely within the cyber threat intelligence community. Dark Trace's approach is very unique and special because we use unsupervised machine learning techniques. We have an entire engine with over two dozen different types of techniques that can adjust the raw data of our customers on whatever domain they're on. And we learn the organization from each of its assets, how they interrelate with one another. They're pattern of life. You're training actively per customer. Yeah, and it's continuously learning. It's not static or pre-trained. Right, and it doesn't have to have been already set up. Yeah. And then we look for like the true anomalies because if you already know the pattern of life and how the assets are supposed to operate, then those anomalies are misuses, abuses, and misconfigurations. So it's either either an active threat already or it's something that you should probably get eyes on because it could be an active threat later. Wow. What are some of the biggest mistakes you see people making right now that are preventable? So some of the biggest mistakes I see specifically, oh goodness, this is a great question. I was like, there's a lot. I can't understand, but you see a lot. So it's important, yeah. So with some of the AI tools that have hit the market publicly, one of the biggest deficits is data integrity. So your machine learning models are only as good as the data you're training it on, good data in is good data out. If you don't have an exhaustive data integrity process, which is where data science comes in, then you're not going to have accurate output of AI. So it'll never be any good. Exactly. And then you have to talk about an exhaustive testing evaluation, validation and verification process. You need to be able to exhaustively test your machine learning models to ensure that they're behaving the way they're supposed to and that you're getting the intelligence and the insight that you need and that you also can operationalize it and actually use it. That's what we assign value to AI. And so I feel like we need to really buffer data science around the edges of AI in the beginning and the end. Even in our case where we use unsupervised machine learning techniques, which is inherently human out of the loop, that means the humans need to encompass it. Yes. And they need to be able to control it and they need to have explainable, privacy-preserving, accurate AI that uplifts them and helps them in their data-driven decision-making. Yeah, so the data scientist's role in this is not just the criticality of data integrity, but it's also holistically making sure that the system that's going to go off and learn and execute and defend your entire business and your customer's data and everything else is as optimized as it can be. Yes. And so it's going to be us making the systems better, not the systems taking something away from us, which is one of the things I think people fear. It is exactly that. It's meant to augment the security team, not replace the security team. If anything, in a lot of the Security Operations Center, you're working on very quickly trying to just get access to all the data from all the different tools, from all the different domains, as quickly as possible to make a decision. And a lot of it is just, I think it might be this. Right. And so what machine learning can do is it can provide insights and intelligence to large volumes of data integrated through different data products so that you're seeing a more complete picture that the human operators within the Security Operations Center can actually make much more complete data-driven decisions. How important is inference in all of this? Oh, goodness. I think that's always going to be an important part when it comes to data science. Especially with all these different nodes of data like you're talking about, we need to know what's happening in all the different places all at once. Especially across the system or different facilities or whatever might be going on when it comes to cybersecurity. I think it's necessary. I also think, especially in the data science process on both sides, it really takes a diversity of thought, a diversity of experience to be able to really fully do it well. Because I come to the table with my own biases. Mm-hmm. We all do. I have a ton. And I kind of love that if we can do it correctly, we can kind of remove some of those biases with machine learning. But also, that should be couched with a data science team that has different perspectives and different biases so that they're looking at the data and they're looking at the output in different ways, catching up on things that maybe I wouldn't catch up on. Oh, absolutely. We all see things differently. It's kind of one of those things when you see someone's marketing come out sometimes and maybe the word sounds funny when you say it out loud or my friend's place next door to her spot in Brooklyn is called Ify's Chicken Shack. And you can tell it's one of those things like who's going to tell him? You know who's going to tell him that Ify's is not the right brand? We're going to want my chicken to be Ify. No, exactly. And it cracks me up, it's such a good marketing example that says where this is where bias is a thing, right? If their nickname is Ify and all their friends love Ify's Chicken, well, then they're not seeing the fact that the rest of the world is going to look at a name like Ify's Chicken and think, I don't want my chicken to be Ify. That's actually the last thing that I want. So it's exactly what you're talking about. And it's not just trying to pretend that we don't have bias or trying to completely eliminate it. It's embracing the fact that we have it and then allowing ourselves to learn from that and making sure that the people designing these systems, the data scientists designing these systems are factoring all of that in so we get the best possible outcome. Curious since we have a lot of, you mentioned earlier when you sat down, we have so many different ages here today. And both online and in person, beautiful to see young students. A lot of stories here about when people got inspired early in their career. When did you know you were going to go down this path? Oh goodness. So I have a very interesting origin story. Let's hear it. I had modern dance scholarships to a couple dance programs in the nation. Amazing. And I had been coding a lot when I was younger. And as some of us were mentioning earlier, it was Fortran and Colbalt. So that's definitely dating me. Oh yes. And I had an amazing computer science teacher in high school and I'd spent four years with her. And she was like, hey, I really, I want to put you in for a job at NASA. And I was like, okay. And I was like, it paid really well. So I was like, let's do this. Oh yeah. I ended up getting the job. And so NASA, lovingly, was like, hey, we can keep you employed all throughout college. And after, if you get a degree and maybe some sort of a STEM background. I was like, dance is not sufficient for NASA. You don't think much. Yeah. Although I mean, if we're going to defy gravity, I can make a lot of arguments for modern dance as in the article, as a skillset for space. But I suppose they have their own rubric. Yeah. And so it was one of those things that I was like, well, I actually really do like computer science, engineering, I focused more on the mathematics and the AI side. I liked the logic, the probabilistic modeling, the patterns. I was like, you know what? Let's do this. And so that's kind of how I jumped into it. So I started off in this area. Oh my God, I'm noticing. And then let's just say I got recruited into the intelligence community. So that's how I made my detour into cyber. I could definitely see that. I'm coming from NASA. That makes sense. Do you still dance? I do. I do. But right now, I think it's to the extent of I just like to beat my children at Just Dance. To the extent, come on now. I'm not sure there's a more important performative stage than the one with your kids in the living room. So don't do not discredit that at all. You clearly were inspired young, as you mentioned in high school, had a great science teacher. Shout out to your science teacher. Yeah. What would you tell? Mr. McKay. Mr. McKay. You're a queen, Ms. McKay. What would you say to a young woman curious about data science, cybersecurity, intelligence, anything that we've just talked about? I love it. This is my prediction for the next very near future. For their future, three areas are kind of critical at this point. We're talking about AI, data science, and cybersecurity. If there's any way that you can have a cross-section in two of the three of those, it will be gold for your career. You are needed, necessary, a unicorn. And so I think that all three of those are kind of criticality aspects of, as we embark on this AI tech revolution, we need to do it safely and securely, and all three of those are needed for it. So there's a whole bunch of online resources that help with that type of cross-skilling, because obviously you can only focus on one degree at a time, most of the time. WIDD's obviously offers some great workshops. There's a ton of free courses online. I'm constantly trying to recruit colleagues in the cybersecurity community. I'm like, jump on the AI bandwagon. Yes. Don't drag your feet. Let's secure it now. Right. Start taking the free courses online. Start taking the AI course here online at Stanford. That's amazing. There's plenty of ways to do it, and it's really kind of an exciting era, or I should say time, for people to be embarking on their career into this. But for those of the folks here who were later on in their career, like myself, I still kind of run by the philosophy of you should always be learning. It's necessary. I can never know everything about AI. I can never know everything about cybersecurity. I can never know everything about data science. There's always something new. Pick up the textbooks. Open up the generative AI prompt. Yeah. And just start digging. Yeah, absolutely. I love that advice. I was actually, it hurt my feelings a little bit, but it was also kind of fun to see. I was using Lama via Grox Chat to ask why there aren't more women in data science earlier today, and the speed at which 2.87 seconds, that it returned an answer to me. It was both sad, but also fascinating in the sense of what a time to be alive. What a time to be alive. No other time. Two questions left for you. We are clearly empowered women in this space. We're lucky to be here. But also there's a lot of folks who have been there supporting us along the way. Is there anyone from your journey outside of Miss McKay that you would like to give a little shout out to today? Oh my goodness. So many. I can't even say. I mean, now I will lean into Dark Trace, which is the current. I have the privilege to work for an organization where we strive for 50% gender equity, and our C-level execs over 50% are women. For an AI company and a cybersecurity company that is unheard of. Yeah, I was just gonna say we're listening at home. We're usually looking at about 12% to 18% on a good day in representation. That is wild. And so I call this my sabbatical because it doesn't even feel like work because most of my career has been the only female leader. Right, talking when I was just telling the boys about this. And it's just been lovely to almost like, I don't have to like put down the torch. By no means am I putting down the torch, but it's almost like a sigh of relief that I don't even have to constantly be pushing that barrier in this particular organization. So I get to focus solely on diving deep into our unsupervised machine learning engine, learning everything I can about those different machine learning techniques. It's just, it feels like a nice safe environment. That is a wonderful thing to say, especially when you're talking about being in security. I'm glad you feel safe in your job, absolutely. Last question for the allies out there watching today on International Women's Day. What is your advice to someone who has women in their life or there's a young woman they're trying to inspire and how they can better elevate and empower women like us? I love it. Oh gosh, there's so much. I mean, there are so many incredible allies and I just want to say thank you and I support you guys, but bring them along. Pass on the opportunities to them. Look to strive for diversity in your hiring practice. Gender, sexual orientation, LGBTQ, ethnicity, economic diversity, even neurodiversity. Like all just strive for, if you are in a position of power, if you are in a position of making decisions and hiring decisions, strive for that diversity and it will only pay off because you will get so many different solutions to a problem, which will ultimately end up being a better solution all around. Absolutely, couldn't agree with you more. I was just keeping my mouth shut so that I don't interrupt it when we cut that as a beautiful clip and a highlight because that was absolutely wonderfully said. Nicole, thank you so much for being here. I really look forward to having you on the show again. And thank all of you for tuning in from all around the world on this absolutely stunningly beautiful International Women's Day. Here at Stanford, my name's Savannah Peterson. You're watching theCUBE, the leading source for strong women in tech news. I love it.