CrowdStrike Fal.Con 2025 | Shawn Henry, CrowdStrike

Clips
More from CrowdStrike Fal.Con 2025

Shawn Henry

Executive Advisor to the CEO, Former CSO & President of Services

CrowdStrike

play_circle_outline Introduction of Shawn Henry, focusing on his extensive career in cybersecurity.

play_circle_outline Discussion on the emergence of AI in cybersecurity and its impact on the industry.

play_circle_outline Empowering Boards: Understanding Cyber Risks and the Importance of Cybersecurity Education for Effective Governance

play_circle_outline Challenges CISOs face in adopting AI quickly in their security strategies.

Info
Transcript

Shawn Henry, CrowdStrike

Shawn Henry

Executive Advisor to the CEO, Former CSO & President of Services CrowdStrike

Shawn Henry, executive advisor to the CEO and former CSO and President of Services at CrowdStrike, joins theCUBE’s Rebecca Knight and Dave Vellante from the floor of the MGM Grand at Fal.Con 2025 for a deep dive into the AI-powered future of cybersecurity. With decades of perspective from the FBI to enterprise defense, Henry explains why agentic security marks a turning point in the SOC, where generative AI is closing the gap between detection and response and fundamentally reshaping how organizations protect themselves.

Henry explains how boards and... Read more

explore Keep Exploring

What is the current significance of AI in cybersecurity, particularly in relation to the evolution of agentic security operations centers (SOCs)? add

What is the significance of generative AI in the context of technology and security? add

What is the role of a CISO in relation to board directors and organizational risk management? add

What is the current perspective of CISOs regarding the integration and value of AI in organizations? add

bolt Powered by CUBE AI

Shawn Henry, CrowdStrike

search

Rebecca Knight

>> Good afternoon, everyone, and welcome back to theCUBE's live coverage of Fal.Con 2025 here at the MGM Grand. I'm your host, Rebecca Knight, alongside Dave Vellante, my co-host and analyst. I would like to welcome back to the show, Shawn Henry, Executive Advisor to the CEO and former CSO and President of Services at CrowdStrike. Thank you so much.

Shawn Henry

>> That's a mouthful. Thanks for having me.

Rebecca Knight

>> It is. It's a long title.

Shawn Henry

>> I've been doing a lot over the years.

Rebecca Knight

>> You have indeed, and that's actually what I want to ask you about first, because you have had a long and varied career from leading cyber investigations at the FBI to obviously now working at CrowdStrike and a lot in between there. We've been hearing that this is the moment for the agentic SOC, the era of AI and cybersecurity. Does this moment to you, Shawn Henry, who's a veteran of this, feel different?

Shawn Henry

>> There've been so many innovations on the internet essentially, right? We've had cloud, we've had mobile. Agentic is the next iteration. It certainly does feel different because of what we've seen, the impact on security just in scope and scale in just a relatively short time. AI itself has been around for a long time. We've been using AI at CrowdStrike for over a decade in our technology. GenAI, generative AI is that different flavor that really takes the power of this incredible technology and puts it in the hands of the layman and in the hands of the average user as opposed to pure technologists. So in that regard, it's different. From a security perspective, it has definitely changed the posture of the environment from an offensive perspective and a defensive perspective. And then for all of us as users, I mean, everybody has their AI moment, right? Where you did something like, "I can't believe that I just got this information in like 15 seconds and it saved me two weeks worth of work." So that's amazing. But when you think about that, how it's applied to security, it really is a new dynamic.

Dave Vellante

>> If you had to draw curves of the asymmetry over time within each of the eras, George laid out some errors, but let's say mainframe, PC and networks, cloud, mobile, social, big data, and now AI. If you had to draw a line between the asymmetry of attackers and defenders, I would imagine the line would be during the mainframe era, RACF, everything's pretty tight. I would think actually defenders might've even had the advantage back then. And then with PC LANs, antiviruses, malware started to diverge where the attackers gained advantage. And I would say that definitely widened over time with social, and cloud maybe had a little blip in there, and then now AI. What does that asymmetry line, those two lines look like in your mind?

Shawn Henry

>> I mean, it's hard to describe it, right? That's something you really need to see in a visual. I think about-

Dave Vellante

>> I got one right here. So you can't see it people, but this would be mainframe. This is defenders. These are attackers. That's defenders. So mainframe, better. And then it's on dips. I don't know if these are right, but the implication is the gap is now, the asymmetry gap is now widening with AI. Do you buy that?

Shawn Henry

>> I don't know the sources of the data. From my experience-

Dave Vellante

>> I just asked ChatGPT and it drew it for me.

Shawn Henry

>> Is that right?

Dave Vellante

>> Yeah.

Rebecca Knight

>> It was his AI moment.

Dave Vellante

>> It was my prompt as a source.

Shawn Henry

>> We should put a ChatGPT agent up here and answer the questions. I don't need to be here.

Dave Vellante

>> No, but half of the stuff that's in here is crap.

Shawn Henry

>> I think that where I saw the biggest gap was actually kind of the advent of the internet in the very early 2000s when the adversaries absolutely knew there were vulnerabilities that could be exploited. And what was happening in the early 2000s that the average consumer, the average business had zero understanding of. The US government and other allied governments around the world were defending against it, opposing governments. Adversarial governments were attacking it, and we were seeing it in the government because of the classified environment and the way that the government collects data. There was a period of time, probably for eight years or so where the average person did not understand what was happening, and there was a lot of exfiltration, so there was a big gap there. I think in the recent years, last five years or so, companies have really gotten it. Boards of directors, CEOs, they get it. They've seen on TV what happens when a ransomware attack occurs, so that gap narrowed a bit. Maybe there is going to be a bigger gap now because people don't necessarily understand what some of the complexities are around AI. They don't necessarily understand the vulnerabilities that are there and they're not paying attention and they're pushing out the technology, the innovation. They're encouraging their folks to use it and embrace it, but they're not necessarily protecting it. So there is that gap, and that's what George has been talking about. This is that new frontier and why CrowdStrike has really moved all in on agentic security.

Dave Vellante

>> Can I just follow up with a test of premise? Because I know you'll tell me if you think I'm off base. So there was greater awareness, but also the adversaries realized the ROI was pretty good. And so there was a greater urgency to invest and skill up, and that maybe closed the gap a little bit.

Shawn Henry

>> But their willingness to scale up and to invest a lot more was because of their awareness of what the risk was, and the risk went up and their willingness to invest to narrow the risk gap was there. I think that with AI, they're investing in the technology because it's helping their companies, it's just completely changing the dynamic of business. And when adversaries, they are now, but as they continue to attack and target those technologies, you're going to see a willingness to invest in the agentic security.

Rebecca Knight

>> One of the things you said was that boards get it, that they understand. They've seen what happens on TV when a ransomware attack happens. But I know that one of your priorities is really working with boards on board education and understanding the importance of cyber leadership and the responsibility that boards bear. What is your vantage point there in terms of where we are in whether or not they do truly get it?

Shawn Henry

>> The word I just used and I continue to use, and whenever I go in and sit it up with a board, the very first word I use is risk. A lot of board directors are not very technical. They're not necessarily cybersecurity professionals. They're in retail, they're in banking, manufacturing. That's not their area of expertise. What I explain is that you don't have to be a technology expert to understand what the risks are. The risks are we've embraced technology as a society and adversaries recognize there are vulnerabilities in that technology and they're exploiting it because there's a gain for them. And if you realize there's going to be an impact on your organization, you need to invest to narrow that gap, to Dave's point earlier. So they absolutely get it. What they are doing now is they are seeing the CISO really as a member of the leadership team, and they're seeing the CISO as somebody who's not just a cost center, security is not a cost center, but they're somebody who's actually protecting all the investments they're putting in. It's somebody who is enabling the business by ensuring that the business is allowed to stay up, that the continuity of operations is there because there's not a vulnerability that's being exploited. So there's a different perspective I think about the CISO and what the CISO's role is and the role that security plays in ensuring the long-term viability of the company, so that has absolutely changed.

Dave Vellante

>> The guys on the Acquired Podcast were interviewing Jamie Dimon, and they asked him, "What keeps you up at night?" Sort of the standard question, and I figured he was going to answer with credit risk or evaluations. He said, "None of that bothers me. I can manage that. I can manage my balance sheet. Cyber security keeps me up." And then he went on to talk about critical infrastructure in particular. That was kind of interesting. What's CrowdStrike's role in protecting critical infrastructure? You don't hear a lot about that at these conferences, more of an enterprise focus, but what about critical infrastructure protection?

Shawn Henry

>> Well, when you talk about critical infrastructure, I guess you have to define what critical infrastructure is. There are a lot of sectors that are actually part of critical infrastructure. It's not necessarily the electric power grid or water systems. That certainly is part of it, transportation.

Dave Vellante

>> Yeah, so help us do that.

Shawn Henry

>> But the financial services sector is critical infrastructure. If the banks went down or one major bank went down, there'd be a cascading impact on the economy globally. That's critical infrastructure. So I think when CrowdStrike is involved in protecting enterprises globally, we're protecting major manufacturers. We're protecting major telecoms. We're protecting major companies that are involved in transportation, even retailers. All of that is combined, and you can't ... While the government classifies different organizations as critical infrastructure, the fact of the matter is because of the way networks are constructed, they're all interconnected. And when you think about the supply chain, you might have some small company that manufactures widgets, but that widget is critical for the next electric power system that powers a major city. And without it, the system goes down. So the interconnectivity is critical. From my perspective, every company that we're protecting is part of infrastructure one way or another. In many cases, they do merge into critical infrastructure. Our responsibility, our role, our mission as an organization is to stop breaches. And when we do that, we are absolutely protecting critical infrastructure every single day.

Dave Vellante

>> So because of the digital economy, virtually everything touches critical infrastructure. Even Adam Meyers said yesterday, China is going after even media industries, and I was poking at that. And he's like, "Yeah, because they want to know what's going on."

Rebecca Knight

>> Who's your source? Yeah.

Dave Vellante

>> "Who's the source? How can I influence this?" So that's even critical infrastructure in a way.

Shawn Henry

>> Yeah. Well, China, other adversaries, this asymmetric threat where they're able to level the playing field in a lot of areas through theft of intellectual property, through theft. It's electronic espionage. When Adam talks about information in media about who sources are, we see targeting of law enforcement agencies, targeting of the federal judicial system to see where cases are being brought, who's talking to whom, how that whole process is working. So the ubiquity of technology, the fact that all data rides on infrastructure, which is inherently vulnerable, it requires companies like us, I think, to be front and center working as partners with these companies to ensure that their data is protected, their physical structures protected, their identities are protected, their agentic security is protected. This just kind of all melts together at one point or another.

Rebecca Knight

>> So what in your experience is holding CISOs back from adopting AI faster, from moving more at speed from this? Is it technical concerned? Is it budget, what is it?

Shawn Henry

>> I think actually CISOs get it. So to the extent that they're being held back, I don't know necessarily that they're being held back. I think that this is kind of a plane taking off. It's a little bit of a runway and they're getting lift now. So I don't think they're holding back. I think it's just the way things work. You look around the room where we are, everybody has got AI. I mean, looking across at some of these booths, they all say AI because, again, it's all interwoven. You're not going to be able to extract AI from an organization. It's going to be part of the DNA. So from a security perspective, CISOs recognize that. They recognize it can be exploited, so there's a concern there. But they also recognize the huge value in AI. What we've done from an AI perspective is the ability to take week's worth of analysis and condense it into a few minutes, and then to have it automatically acted upon. So the ability, the speed, the time from detection to action is minimized, and there's a huge cost savings. There's a huge savings in liability by having that occur in an automated fashion. And CISOs know that, they recognize that, so they got to get people on their attorneys, their C-suite to make the investments. They've got to explain it so that education piece comes back into play. They've got to make sure people are on board, but the CISOs get it, for sure.

Dave Vellante

>> What's most misunderstood by people about cybersecurity, in your view?

Shawn Henry

>> What's most misunderstood? I think if you get down into the technology of it, I mean, some of these breaches are incredibly complex, but some of them are incredibly easy, and it's a matter of somebody just literally handing over their password to the bad guy. Not different than handing the keys to your house to somebody. That's the metaphor, and it's a direct correlation. I think it's just people having an understanding of the depth and the breadth of what this is. Look, we just were involved, or there's been ... Let me re-characterize that. There's been a lot in the press about targeting of telecoms around the world, not just in the US, but globally and including interceptions of communications. So where adversaries were able to listen in on calls, right? Well, most people I know don't think twice about picking up their phone and making a call. Some people are starting to move to encrypted apps like Signal and others to protect themselves. So what's misunderstood? I think that people don't really understand what their electronic or digital footprint is and where it can be exploited. And if they had a better understanding and appreciation of that, I think it would allow them to be better protected and would serve them long-term in a positive way.

Dave Vellante

>> We had Vodafone Oman on yesterday, and the gentleman was saying that in their region, there's a lot of zero-day threats that aren't picked up globally, because they're in this narrow region, and they got to deal with that. And they can't lean on global threat intelligence. And so to your point, it's-

Shawn Henry

>> People have to. They're getting there. It's slow, and it's unfortunate because it's slow in an area where speed is king. The faster you are, the better you are. The faster you are, you're going to be more secure. If you're not as fast, you're going to be victimized. That's the way it works. Speed is king in cybersecurity, and this is kind of full circle to AI. The ability as a defender to use AI is going to make you much stronger and much more resilient. The ability for the adversaries to use AI, which they're doing. I know Adam probably talked to you about famous Chollima, this North Korean group that's been getting hired into physical people using AI to get hired into companies. I talked to somebody yesterday here at the conference who talked to me about famous Chollima actors that were in their environment, that CrowdStrike identified and told the company-

Rebecca Knight

>> Human beings?

Shawn Henry

>> I'm sorry?

Dave Vellante

>> Yeah.

Rebecca Knight

>> Human beings?

Shawn Henry

>> Human beings. So, yeah, North Korean actors working remotely for a US company as a remote employee, but they were working on behalf of the North Korean government. But they used AI to get past the screening process, to develop resumes that looked legitimate, to make the websites.

Dave Vellante

>> Get hired.

Shawn Henry

>> And to get hired. And then they used AI to translate for language, to take documents and to translate them. But in this particular case, we were able to identify the actors just because we saw anomalous behavior in the customer's environment. They had no idea, and the actor had been there for several months.

Rebecca Knight

>> Wow, scary stuff.

Dave Vellante

>> So I was talking to one of your customers last night because this is what I saw last year in Adversary Underground, where they actually showed North Korean technical experts trying to get hired and using AI to respond to the questions. So what this company did was they asked the candidate to say something negative about Kim Jong Un, and they hung up. They use this technique. Now, that's not really a durable technique, but they were at least aware of it.

Shawn Henry

>> It was creative.

Dave Vellante

>> Very creative. Right.

Rebecca Knight

>> Yeah. Points to creativity.

Shawn Henry

>> It was entertaining to watch.

Dave Vellante

>> Yeah. I don't think that's a durable strategy that'll last, but I found it quite humorous actually.

Rebecca Knight

>> Indeed, indeed. Well, Shawn Henry, always a pleasure. Fascinating to talk to you.

Dave Vellante

>> We're done?

Rebecca Knight

>> Well ...

Shawn Henry

>> What else you got?

Rebecca Knight

>> We could talk to him forever, but we got five more interviews to get.

Dave Vellante

>> I get it. I get it. All right.

Shawn Henry

>> Well, thank you so much. I really appreciate the opportunity to be here. I think going back earlier to education, people being aware and a venue like this allows people to hear about famous Chollima, North Korean adversaries, how companies are able to stay ahead using AI and some of the other technologies here. So this vehicle is really helpful from an awareness perspective, and I'm glad I'm able to participate.

Dave Vellante

>> Thanks for your time.

Rebecca Knight

>> Well, thank you very much. Thank you for watching theCUBE. I'm Rebecca Knight. And for Dave Vellante, stay tuned for more of theCUBE's live coverage of Fal.Con 2025. You're watching theCUBE, the leader in enterprise tech news and analysis.