Clips
News
More from AWS Summit Washington, DC 2025

Danielle Ruderman

Sr. Manager, Worldwide Security Specialist

AWS

Inside the AI shift in government: 11 perspectives on public sector ops transformation

Public sector transformation is entering a critical phase, driven by the rise of agentic AI and digital labor that doesn’t just automate, it adapts. But the biggest obstacle isn’t the technology. It’s the systems, silos and culture built for a slower, pre-AI world.TheCUBE’s John Furrier discusses public sector transformation.What’s really holding back progress in the public sector isn’t a lack of innovation — it’s the difficulty of adoption. From aging infrastructure to deeply rooted bureaucracies, systemic inertia remains the biggest obstacle. Meanwhile, AI is rapidly reshaping the role of government, raising the stakes for timely transformation, according to theCUBE’s John Furrier

play_circle_outline CISO Circle Program for sharing among CISOs globally.

play_circle_outline Working backwards with CISOs for customer-centric solutions.

play_circle_outline Sovereign cloud and digital sovereignty discussions.

play_circle_outline Future direction and product insights from CISO Circles.

Info
Transcript

Danielle Ruderman, AWS

Danielle Ruderman

Sr. Manager, Worldwide Security Specialist AWS

Danielle Ruderman, worldwide security specialist at Amazon Web Services Inc., joins theCUBE’s John Furrier and Scott Hebner during the AWS Summit Washington, DC event to discuss evolving security priorities and the rise of collaborative leadership models. The segment centers on AWS’s global CISO Circle Program and how it’s creating new pathways for knowledge sharing and peer support among top security leaders.

Ruderman outlines the structure and reach of the program, which operates across more than 30 countries under Chatham House Rules to foster open ... Read more

explore Keep Exploring

What is the purpose of the CISO Circles that were started in 2020? add

What process has Amazon been using to gather input from CISOs and prioritize solutions based on customer feedback? add

What are some of the challenges CISOs are currently facing and how are they addressing them? add

What is the coolest aspect about the passion of CISOs in improving the industry for everyone and their ideas for secure by default measures? add

bolt Powered by CUBE AI

Danielle Ruderman, AWS

>> Welcome back everyone. We are here on the show floor at AWS DC Summit. I'm John Furrier, the host of theCUBE with Scott Hebner, the research analyst from theCUBE Research, breaking down all the action here. It used to be formerly called Public Sector Summit, but the commercial private-public partnerships, all the action of the cloud converging around society and technology. Danielle Ruderman is here, worldwide security specialist at AWS who also runs the CISO Circle Program, which is super interesting and super valuable for CISOs and for AWS. It's kind of a joint kind of community effort. Danielle, thanks for coming on theCUBE. Appreciate you.

>> Absolutely. Happy to be here.

>> So I've got to say, the little pre-conversation we just talked before we came on camera about the CISO Circles really resonates because the vibe of the show here today, as we heard, I was in the executive forum, I was sharing, I learned something from this customer. So the art of sharing in trusted circles is a huge organic and also data-driven process and that's what you work on. So explain what you do because it's really fascinating.

>> Sure. So we started the CISO Circles in 2020. Steve Schmidt, the then CISO of AWS was our first keynote speaker. And the idea was to create a place where CISOs could get together and share. And that sounds easier than it actually is. So what we've ended up doing is we've expanded to more than 30 countries so that we can meet the customers where they are. It's one thing to come to events like this, we can all get together, but really it's important to go to where your customers are based and try to create community where they are. So we've been able to take our service team executives and our security leaders out into the regions to meet customers directly. And we do these discussions under NDA and Chatham House Rule so people can take what they've learned and use it in their business, but not attribute it back to a single person or a single company. And we really try to foster this open dialogue. And we often get asked if we have industry-specific circles or anything like that. And we have found we do have a few, but mostly CISOs have found that they can learn from each other. We have found things, we had one interesting story where a financial services CISO was able to learn from media and entertainment. They had similar challenges around zero trust and were able to trade ideas. We also had a pharma executive figure out how to secure their supply chain for producing drugs by talking to an automotive executive. And she said, "I never would've thought about talking to someone like this if it wasn't for this environment." So I think when you think about that idea of creating community crossing different industries like that-

>> A lot of pattern matching going on in the cloud at scale. So I have to ask you, first of all, very trustful environment, a lot of good conversations come out you wouldn't have normally heard. What are some of the things that you're hearing from CISOs, especially now more than ever? Because the confluence of this waiver on is almost, I say a hundred x bigger than SaaS, but people think that's a little bit over the top, but CISOs are still under pressure to innovate while maintaining their security posture. So there's a lot going on, the pressure is still on, it's not a gravy train for them. They've still got threats, they've got to protect. What are some of the things that you're hearing?

>> Absolutely. So the biggest challenge we're hearing from CISOs is that they're under increasing pressure. This is pretty universal. They have to do more with less, and how do you do that? So you're under budget constraint, headcount constraint. And we've noticed in the last year that we've been getting a lot of questions about how you make decisions on what to centralize in security, so to hold on and do yourself when it comes to risk management and security, and what do you federate out to the business. And finding that balance can be very challenging. And so we've had a lot of very interesting discussions around that because obviously the more you can federate out to the business, you can do more with less. And that's where this conversation around culture of security comes up because this is where we can learn from each other. How have you enabled this idea of a culture of security across your entire organization? And what mechanisms can you put into place so your business units, your product teams feel comfortable taking ownership of their own security risk?

Scott Hebner

>> So when I hear do more with less, that's like a trigger for a question about how aggressive are they being around AI, not to protect but to actually use themselves, and thinking about agentic AI where you start getting into obviously more intelligent decision-making, goal-oriented sort of behavior here.

>> Absolutely.

Scott Hebner

>> So that's the way to do more with less, right?

>> It definitely is. And I will say for the second year in a row, AI and security is our number one topic globally. That's no surprise to anyone, is it?

>> It's funny, I saw Matt Garman last week on my interviews that we streamed out on July 9th. I asked him about do more with less. He said, he goes, "No, do more with more." That's a little bit of play on words. No, but his point is that there's more now with AI for the benefits on both sides, adversary and CISO. So there's a lot more to manage and more goodness too on the AI side. Steve Schmidt was talking about some of the things they're doing with agents around threat hunting and defense that's very interesting, I never would've thought of. So things like that are coming on. Are you hearing that within the CISO circles or are you guys more advanced on the Amazon side, or how advanced are they compared to what you guys are doing?

>> There have been some really interesting discussions about how each other are using it so they can try to get ideas from each other. And I think a big theme that came up earlier this year was don't just have your teams use AI to go faster, use it to learn. And so if you think about the gap in knowledge between your more junior folks who are coming on board and your more senior, you want to kind of close that knowledge and experience gap and AI is one way to do that. But they've asked, and this is kind of an ask to all the vendors who produce these tools, have the AI explain why it's recommending you do a certain thing. Think about it as a teaching tool. Don't just do the task, explain the logic behind it so that the human using it understands that reasoning and they can improve their own knowledge back. So that's a real big ask from our customers.

Scott Hebner

>> And that's a huge problem in the industry because these LLMs are based on correlation models, statistical probabilities. They're black boxes that aren't really capable of explaining themselves. So that's where you start getting into the world of agentic AI and you compliment those LLMs with things like semantic reasoning, causal reasoning to be able to do that explainability.

>> Right, exactly.

Scott Hebner

>> I think when you start getting that, you start elevating the trust factor and then they can allow more of these agents to do more things autonomously, which I think would be interesting if you're hearing that vision about more autonomous security agents where there's not always a human in the loop.

>> At least the CISOs we talked to were not quite there yet, but yes, that would be the goal. Again, and I think that goes back to that idea of how can you federate more responsibility out either to your business units or to your tech to allow you to do more with less. And the nice thing about community is that when you have topics like this where you're really on the bleeding edge of what's happening, you have CISOs who are very forward in their mindset and they figured out ways to do this and they can kind of bring along their more reluctant peers. And I think if we think about this evolving responsibility of the CISO today, one of the things AI has done in agentic AI is CISOs who take a stand for their company can be seen as a leader. They're truly an enabler. And they can say, "I will help you figure out how we're going to use this new technology." And that changes your visibility in the organization. And so if they let their more reluctant peers know, build sandboxes, create ways for your business to use this so that you can be seen as an enabler versus that department of no, which was traditional.

>> I got to ask, because this comes up a lot, you mentioned the CISO and some things you're saying about being a leader. One thing, and I wonder if this comes up in the circles conversations, organizational structure has always been one of these. The CIO used to run everything. The CISO came in, and now Steve Schmidt was the CISO at Amazon, now he's the CSO. So roles as organizations evolve, does that come up in the conversation?

Scott Hebner

>> Yes, it does.

>> How are they framing it? Is it an opportunity? Is it more confusion? Is it expanded? Because CIOs might have a different focus. Are roles changing and if so, how?

>> Yes, so we've had these conversations about does the reporting structure affect your ability to do your job. And what we found is it is very industry and very company specific because it really depends on some of the dynamics and personalities in your organization. Some report into a CFO, which they find beneficial because it gives them more visibility and accountability to a budget. Others report directly to the CEO, which is more our model, kind of signaling that security truly is a top level priority. But then yes, sometimes you have the friction of reporting to your CTO or to your CIO where maybe you're in the business you're trying to protect and that can cause a little bit of friction. So there's many different models. I don't see us clarifying around one at this point. It does seem to be organization specific.

Scott Hebner

>> When they're sharing and having these discussions, are they generally leaving their competitive flares behind and not worried about secrets?

>> Correct.

Scott Hebner

>> Competitive advantage?

>> Yeah, we had one CISO say that we're all in this together. We're all trying to protect the security of our customers and our data. And one of them actually said, he's like, "I will call one of my peers at our company we compete with." He's like, "He and I don't compete. We are both trying to do security as best as possible."

Scott Hebner

>> It's a team sport.

>> Yes. So I don't care the fact that our businesses might be competitors, but we can help each other.

>> What's the biggest surprise in the circles that you've seen, like a moment, situation, any things that caught you off guard around just the conversation space? Just could be comment, thread, discussion topic.

>> Yeah, I think what always surprises me is many CISOs come from a very technical background. Often they come into their role because they're very good technologists. And when they get to this level, the biggest challenge, and we hear this again and again, is that the people and process side of things are so incredibly difficult. And that's why probably our most enduring topic in the circles has been that idea of a culture of security. How do you create that? Because that's how you think about organizational structure, your influence as a security executive on the rest of the business and how you can affect that. And I tell you again and again, we've had CISOs say, "Don't focus on the tooling. That will not solve your problems. You've got to understand people and learn to like people and communicate with them and really speak that language of the business." It sounds cliche, but it comes up so often.

>> No, security is a whole other breed. And I always said on theCUBE, security is the first area that I think is a tell sign for GenAI because they're dealing with real time, they're dealing with data. The security has to be defended, security's built into the data. So I think there are proxy for behavioral change and change management. So I think I would agree with you that there's a team sport. The question I would ask is that, okay, what's next? Because as CISOs become proliferated through all impacts to the organization, the data models are coming. You see Iceberg wrote a story yesterday on Iceberg and how S3 tables, for instance, are coming into play with metadata. So you have a whole other app wave coming. So are these GenAI apps getting through? Are they feeling pressure to approve into production or they don't care because they're security guys?

>> There's always that tension. You want to help the business move fast, but you also need to be mindful of the risk. And I think they're looking to hyper-scale cloud providers, looking to their vendors and their partners how can you help simplify security. Because as the landscape gets increasingly complex, it's on those of us who build these things to build in that secure by default, that secure by design so that we can help make their job easier. So that's what we're hearing more of those kind of conversations.

Scott Hebner

>> Where do you see the boundary in all these conversations with security and then regulatory compliance, which in some cases, most cases overlaps? Are they also involved in regulatory compliance?

>> Yes, definitely. And again, that does vary. The degree to which they are varies by industry and certainly by region of the world. In EMEA, hear a lot more about regulatory compliance because of digital sovereignty and data residency. And again, by industries, financial services, things like that, definitely much more of a concern.

>> Yeah, I think that the security, writing reports, AI will help. On the compliance side, I've heard of CISO say, "Yeah, thank God for AI." I guess my question looking at Circles is can you explain how it works? Because if I'm a CISO, I definitely want to be involved in this. So where are you guys at on the program? Is it invitation only? Do people just join? What's the protocol? Is there a method, a mechanism that you can share?

>> Yeah, so we do have a public page. You can search AWS CISO Circle and learn more about the program. And then we suggest you talk to your account team. It is invitation only, but we do try to be very welcoming. We're able to scale to meet demand. And so reach out to your account team and find out if there's one nearby. Like I said, we operate in over 30 countries. And if we don't have one near you, if there's enough interest, we're happy to look into starting another one.

>> I guess this reminds me going you have to be this tall to ride the rollercoaster. Is there a certain criteria to ride into the circles? Is it scale or scope or expertise? Is there a general filter?

>> We like to have a good mix. Because I think there's a benefit to having CISOs at large enterprises with the smaller businesses. The other thing is you know tenure is short for CISOs, right?

>> Yeah.

>> So one day you might be a CISO at a large enterprise, the next time you're helping a startup. So if you gate by size, you're going to miss out on those super experienced CISOs who are doing something new.

>> So it's very subjective, basically like a portfolio.

>> Yeah, that's why we push the ownership, that federated model out to the cohort leaders so they can make those decisions for their cohort.

>> And the cohort leaders are Amazon employees?

>> Yes, absolutely.

Scott Hebner

>> In the regions.

>> Yes, they are. Because they know their business, they know what their customers care about. They can manage creating and sustaining that community.

>> All right, so what's next in Circles? Is it a tour or is this just happens in regions? Who runs it? You?

>> It happens. It happens. We manage, we have the guardrails, right? Security, we love guardrails. And then yes, they run in the regions. The most fun thing we've had lately is experimenting with this working backwards process. You know at Amazon we're very customer-obsessed. We want to hear from our customers. So in the different circles, we've been experimenting with breaking CISOs into small groups to dive deep on a particular topic, Gen AI and security, zero trust, third party risk, and asked them, "Chat with our AWS executives here. What problems would you like AWS to solve on your behalf?" And then they'll come up at the end of the discussion with three, and then all the other CISOs get to vote on which of their ideas they like the best. And that's been a really interactive way for us without boundaries to say you tell us what we should be doing.

Scott Hebner

>> Market requirements process, market intelligence.

>> That is textbook working backwards document from the customers. We have proof.

>> It is. Working backwards from the customer, yes.

>> It's evidence.

Scott Hebner

>> They literally asked us to solve this problem for them.

>> And that must get fast-tracked on the Amazon system pretty fast.

>> Yes. We added, again, we have very robust feedback mechanisms. One of the reasons I love working there. And so we add that signal and it's been a very powerful lever for improving our services.

>> Yeah, there's so much cool things going on with AI. One of the things that I've been hearing were minus zero-days where they're starting to identify zero-day attacks before they even happen as kind of a mechanism starting to see the actors as is more data on them, organizing their runs and then seeing that first attack. So I think it's going to be very interesting to see. And I think if I'm a CISO, I definitely want to be involved in one of these circles.

Scott Hebner

>> Right, so that you can have these kind of conversations.

>> Yeah.

>> I know that in the UK we had some retail issues with certain retailers and it seemed to be a theme in retail. And so they were able to come together. Those CISOs were able to come together again under NDA and talk about what are you seeing, what are you doing about it. So you have that fast action network you can lean on to help.

>> Danielle, curious if you heard this in your circles, that sounds funny, but in your CISO circles, sovereign cloud is huge. We've seen regulation could cause, I remember when GDPR came out like no one even knew their stuff was stored never mind actually managing it, when you start seeing sovereign cloud become a reality that's happening now, the CISOs have to manage these clouds for their companies with requirements. And there's good reasons to do that. I'm for it actually. Does that make them more paranoid? Are they naturally more paranoid than ever before? How does some of these new changes globally affect the CISO in your data that you're seeing?

>> Yeah, I would say it's definitely top of mind, like I said, especially depending on the different industries and the different regions of the world. And it's a priority for the business, and thus the CISOs care. And I don't think they're any more concerned about any of the many other things they have to pay attention to. But they're trying to respond to the needs of the business and making sure they're accurately meeting those and protecting their own customers. So one of the benefits of meeting under NDA is we can have very candid conversations about where we are going and our thinking on this idea of digital sovereignty in the European Sovereign Cloud. And that's been very reassuring to many of our customers.

Scott Hebner

>> Are you sharing futures with them?

>> Yes.

Scott Hebner

>> Yeah, direction.

>> NDA and Chatham House Rules, always way to get the best data. I guess my final question to end the segment is what's the coolest thing that's come out of Circles product-wise or from Amazon's working backwards or insight or moment?

>> I think the coolest thing, probably how passionate our CISOs are about improving the industry for everyone. So we've had a lot of conversations recently about secure by default, what can we as an industry do better to secure things by default. And the CISOs have some great ideas. They've been in the trenches dealing with this for many years and that's something they can come back and say, "Hey, have you thought about this? Could you ask your partners about this?" And to me, that's the coolest thing because they're not just looking out for themselves, they're really looking out, they want us as an industry to do better.

>> I really love this Circles idea, trust networks. Micro communities are becoming a big thing now as digital connections and first-party relationships connect, physical and digital coming together. You're building a digital twin of the CISO network.

>> Pardon?

>> You're building a digital twin of a CISO network.

>> I love it. There you go.

>> All right, Danielle, thank you so much for coming on. Appreciate it.

>> Absolutely.

>> Okay, you're watching theCUBE. I'm John Furrier, Scott Hebner here from the shore doing our part. Thanks for watching.