CrowdStrike Fal.Con 2025 | Kevin Urbanowicz & Chris Richter, Deloitte & Touch LLP

Clips
More from CrowdStrike Fal.Con 2025

Kevin Urbanowicz

Principal

Deloitte & Touch LLP

Chris Richter

Senior Managing Director

Deloitte

play_circle_outline Shift from human capacity issues to reliance on AI and automation in cybersecurity.

play_circle_outline Evolution of Managed Detection and Response: Adapting to Changing Client Expectations in Security Operations

play_circle_outline Importance of predictive analytics in identifying potential cybersecurity threats before they happen.

play_circle_outline The impact of top-down pressure from CEOs on cybersecurity AI adoption.

play_circle_outline Striking the Perfect Balance: Integrating Human Insight and AI in Cybersecurity for Enhanced Threat Detection and Efficiency

Info
Transcript

Kevin Urbanowicz & Chris Richter, Deloitte & Touch LLP

Kevin Urbanowicz

Principal Deloitte & Touch LLP

Chris Richter

Senior Managing Director Deloitte

In this Fal.Con 2025 segment filmed live at the MGM Grand in Las Vegas, theCUBE’s Rebecca Knight and Dave Vellante sit down with Deloitte leaders Kevin Urbanowicz, principal, and Chris Richter, senior managing director. The discussion zeroes in on how managed detection and response is evolving as AI reshapes the SOC. Urbanowicz explains how AI is easing human-capacity constraints and enabling proactive threat hunting with “shift left” practices. Richter tracks the move from indicators of compromise to indicators of attack to early predictors of attack, with l... Read more

explore Keep Exploring

What changes have occurred in the approach to cybersecurity human resources over the past few years? add

What is the current state and evolution of managed detection and response (MDR) in relation to traditional security operations centers (SOCs) in the U.S. market? add

What advancements are being made in predictive analytics for cybersecurity to anticipate threats before they become issues? add

What impact is the AI revolution having on the role of Chief Information Security Officers (CISOs) and the adoption of cybersecurity measures? add

What are the roles of people, processes, and technology in the context of AI integration into threat hunting? add

bolt Powered by CUBE AI

Kevin Urbanowicz & Chris Richter, Deloitte & Touch LLP

search

Rebecca Knight

>> Hello, everyone, and welcome back to theCUBE's live coverage of Fal.Con 2025 here at the MGM Grand. I'm your host, Rebecca Knight, alongside Dave Vellante, my cohost and analyst. I would like to welcome two guests to the show, Kevin Urbanowicz. He is a principal at Deloitte. Welcome, Kevin. And back to the show, Chris Richter, senior managing director at Deloitte. Thank you so much for coming on the show.

Kevin Urbanowicz

>> Thank you, guys, for having us.

Chris Richter

>> Good to be here.

Dave Vellante

>> Thank you.

Rebecca Knight

>> Yeah. So I want to start by asking you both, because you both have sort of different spheres of influence and where you work, but how have client expectations around managed detection and response changed in terms of what you're hearing about today, what the concerns, what's keeping them up at night versus, say, four or five years ago? Kevin, let's start with you.

Kevin Urbanowicz

>> Yeah. I think what's interesting is, for a long time, we had a human problem. Right? Human capacity. Do we have the right people? Are they trained? Because cybersecurity is a lot of data, a lot of threats, a lot of alerts getting thrown out. And as we've seen the AI revolution take over, there's a light at the end of the tunnel that, "Maybe I don't need as many humans. Maybe I can actually do more with less." AI had to kind of get there and improve that value, but we've seen that catch on. And so, there's, I think, a pivotal moment where it's, "I don't need as many humans now, and I can actually start trusting AI and automation and those types of things to enable my capabilities, MDR or otherwise."

Rebecca Knight

>> Okay. And you're really focused on the U.S. So this is what-

Kevin Urbanowicz

>> My primary focus is the U.S. market. Correct.

Rebecca Knight

>> Okay. And Chris, you are more global. So what are you hearing?

Chris Richter

>> So managed detection and response or MDR has been on this long evolutionary cycle. It's a typical wave where you have individuals and organizations ahead of the wave that moved from traditional, internally managed SOCs and MSS to MDR, which is really a standardized platform, standardized technology back end, to improve automation. But that wave has a very long tail, and on the back end of that tail are individuals that still have disorganized SOCs. They have multiple SOCs within the same organization. They're using traditional MSS, traditional SOCs, which aren't working anymore, and those back-end individuals are realizing that they need to catch up quickly. The ones at the forefront beat the wave, and they're the ones that are realizing... I think they're the ones that are most concerned and excited at the same time about artificial intelligence. So in terms of how expectations are changing, it depends on where you are on that evolution. The ones out here want AI now. The ones back here just want their mess cleaned up and want to move to a standardized environment.

Dave Vellante

>> Chris, when you last came on in 2023 here at Fal.Con, you said at the time that CrowdStrike enabled you to go from an indicator of compromise to an indicator of attack, and I'm curious as to... And that was only, it was less than 12 months in to the whole GenAI wave. What have you observed since that time, and how has that, what you said back then, affected your business and your clients' businesses today?

Chris Richter

>> Well, first of all, you've got amazing memory. That's really good, but-

Rebecca Knight

>> AI helps.

Dave Vellante

>> We got to ask AI. That's it. My AI.

Chris Richter

>> IOCs, indicators of compromise, basically are going into a log, looking into the past, and discovering you've already been compromised. Indicator of attack means that you're currently under attack. I think we're moving to more of a predictor of attack mode now. So we are beginning to use large language models, baseline analysis to look at network traffic and network flows to see what can predict an attack. So an indicator of attack says, "I'm under attack right now. I need to stop it," which CrowdStrike is really good at, but they are also building tools that help with predictors of attack.

Dave Vellante

>> So I was hoping that the answer was something along those lines. We were just talking to Elia, who is the CTO of CrowdStrike, and he was talking about their graph and their map and their abstraction layer and all this cool stuff. And the takeaway, and to tie it into this conversation, is, generally speaking, we've been pretty good with analytics at what happened and why did it happen, but we haven't been really good at what's going to happen next or what should we do next, and that's where, I think, you're headed. I don't think we're there yet, but-

Kevin Urbanowicz

>> Predictive analytics, right? And we use the term shift left. Right? We want to find something that's happening before it becomes a problem on the network. Right? If it's already compromised or an indicator of compromise, that's sort of further right than we want to be. So we now have access to all this data. Technology has caught up. AI and other things have helped. Our ability to do that predictive analysis, the modeling to understand, "This looks like it might be headed in a bad direction. Therefore, I want to investigate it sooner, proactively do threat hunting," or those types of things to kind of find those earlier in the cycle.

Dave Vellante

>> The marketing is always ahead of the customer adoption. In theCUBE, we get excited about things like agent builders and security AGI. The reality is that the clients move a little slower. So what are you hearing from customers today? What are their main pressing concerns in the context of cybersecurity?

Chris Richter

>> So like Kevin, we walk around the show floor. We have a lot of dinners and meetings with CISOs at the show and elsewhere. One of my favorite quotes was at dinner last night. I was speaking to a CISO of a major services firm, and I said, "What keeps you up at night?" His answer was, "Yes," which I think is... And things haven't changed. The attack surface is broadening, but the types of attacks, even though they're getting more sophisticated, it's the same issues that kept CISOs awake five years ago. They're just happening faster, and they're happening with greater accuracy and more destructive capability.

Dave Vellante

>> I mean, I heard Jamie Dimon on the Acquired podcast, and the guys asked him, "What keeps you up at night? Is it credit risk? Is it overvaluation?" He said, "No, cybersecurity." I mean, that's-

Kevin Urbanowicz

>> It's still a CEO, executive-level challenge. I think what's changed, I mean, pretty recently, I'll say six to 12 months as we have these conversations, is the pressure from the CEO is down to be progressive about adopting AI, to lean into it. And if you're not doing something in AI as a CISO right now, you're going to feel behind, and you're going to get that pressure. And so, the adoption push is happening top-down, which is different. Right? Cybersecurity, you used to have to go to the board, ask for money, beg for new capabilities. That's coming downwards now, because the AI revolution, while it affects the business and they're using it to enable business, they realize it's a way to not only do better cybersecurity, save money, find those things. So I think the adoption's actually increased quite a bit.

Dave Vellante

>> What's Deloitte's operational protocol? Because you guys are in the security practice. You've got another side of the business that's like, "Yeah. Let's go build agents for clients." How do you guys work together to ensure that when that side of the house is driving that innovation with customers, we make sure we're not just bolting on agentic security, but it's inherent?

Kevin Urbanowicz

>> One way we've looked at this is the same way that we think about ERP security. Sorry. We do large SAP implementations, Oracle implementations, and we always do them secure by design. Right? So we don't go do them without bringing cybersecurity to the table, because we don't want to build something for a customer that's not going to be secure. As we're building our own AI platforms, we have our own agentic platforms. We go to market, and we have different things and different industry verticals. We're always bringing it with security or with the guardrails in place that we know our customers either need or are going to ask for. In many cases, they're not asking for it, because they don't realize it yet. We want to proactively bring that cybersecurity message to them.

Rebecca Knight

>> So we are in, as George Kurtz said, the era of the agentic SOC, and CrowdStrike has come out with so many AI-driven products and services and announcements this week. Where do you see the balance between the expert-led threat hunting, the human, I should say, threat hunting, as well as AI-driven detection? How do you see those working hand in glove? Start with you, Kevin.

Kevin Urbanowicz

>> So the first place AI starts to do things are the lower-hanging fruit. The threat hunting is a more advanced skill set. A lot of those people have 10 to 15 years of experience. And so, that human has experience that's not usually easily replicated in AI. But I think the thing that we see people starting to recognize is we divide things into people, process, technology. People, humans have a limited capacity of what they can do, eight-hour working day, the brain itself, how much it can process, and the technology was a limiting factor. Now we have hyperscalers. We do this compute at large. So large datasets are now accessible. So the technology has changed. The people can now be augmented with AI, whether that's GenAI or gen whatever. So we now changed the people side. The process though, it hasn't changed. And so, we look at the process. We say, "We built these process based on the people and the technical limitations. Why don't we rethink the process?" Right? So the idea of a threat hunter, the idea of an L1 SOC analyst. Those were human-defined roles and processes. Now, we're rethinking the whole people, process, technology, because the ability for an agentic AI to say, "I'm not just doing threat hunting. I'm doing threat intelligence. I'm doing detection engineering. I'm forking out all these different processes," reimagining actually how the SOC works.

Dave Vellante

>> So that says we're not just going to... I call it paving the cow path, and say, "All right. We're going to automate processes that were decades old."

Kevin Urbanowicz

>> And we're starting there, and that's where people are getting comfortable. You're getting the quicker wins. But quickly, we're realizing, the long road of where this is going is actually rethinking the whole people-process-technology paradigm.

Dave Vellante

>> Okay. So you're hitting a few singles, to use a baseball analogy. So get some quick ROI, quick hits, get some muscle memory going, and then the hard work begins. So I love the message that Michael Sentonas laid out this morning, and George yesterday, on the agentic SOC. Rebecca and I were talking, a lot of these practitioners are going to go back. They're going to be excited. They're going to talk to their managers, and then they're going to have to do a business case. It's going to take some time. They have to get it funded. They have to look at the assets that are on the balance sheet. They may be not fully depreciated. The process has gravity. And so, our assumption is this is going to take some time, maybe the better part of a decade, and then we'll look back and say, "Wow, look how far we've come." And it won't feel like that, like mobile. How do you see the road map? Because you guys sit down with clients and say, "Okay. Here's where you are today. You do the maturity model. Here's what's possible based on best practice." What's that bell curve look like? Take us through the journey and the evolution. How long do you think that's going to take? Does AI make it different? I think there's an assumption out there, "Oh, AI is just going to happen like that." And then everybody is sort of, "Is there a bubble?" And so, we go back and forth. What are you guys seeing? Because you're close to customers here.

Kevin Urbanowicz

>> Sure.

Chris Richter

>> Well, it is definitely a journey, and it begins with, and this is based on client feedback, what do they want to achieve with AI? They want outcomes. So you start with, "What outcomes are you trying to achieve?" Because you can automate just about anything. The quality of that automation is another matter altogether. And there is one AI agent that's going to do everything. It's usually a series of agents that have very specific, bespoke functions. They've got to communicate with each other. Those agents have to be protected. You have to watch out for shadow AI. So what this means is all of this has to fit within an AI governance model that helps you plan based on the outcomes that you're looking for, and then you build an AI plan to deliver on that, protect the AI, and manage it and sustain it going forward. And there's one of those processes for every type of outcome that you're looking for. There are new governance frameworks that are emerging. NIST came out with one, the AI Risk Management Framework, about three years ago. The European Union came out with an AI framework that has very strict, big teeth associated with that, like penalties that are tied to sales. So I think we advise our clients, like, "Let's stay within those boundaries and take a methodical approach," keeping governance in mind.

Rebecca Knight

>> Excellent.

Kevin Urbanowicz

>> You mentioned maturity models when we think about traditional consulting, like, "Where am I today? Where am I going to go?"

Dave Vellante

>> Right.

Kevin Urbanowicz

>> That's based on a knowledge of what good looks like and where two to three years down the road. I think AI has blown up maturity models a little bit, to my comment earlier about we got to rethink the whole process. When we look at the maturity evolution of a company, yes, we don't know where we're going to be three or five years from now. We know things are moving fast, but I think it's now a foregone conclusion. AI is not a thing that is just going to be fancy and shiny for a while. It is the future. And so, putting the building blocks in place to get there. AI only works with data. Right? So do I have the right data? Is it centralized? And so, getting some of those foundational components in place, knowing that those are going to be the stepping stones to actually getting to those AI evolutions that they're looking for.

Dave Vellante

>> But you're suggesting it's a nonlinear journey potentially, which is important. I mean, we're always theorizing. Is this like the internet? What are the similarities? What are the differences? And it seems to me that there's a premise out there that AI-native companies are going to emerge with much more streamlined workflows, one-tenth the cost, 10x the value, one-tenth the number of employees. Probably true, really disruptive. But based on what you just said, Kevin, companies have the opportunity to sort of cut the line.

Kevin Urbanowicz

>> A lot of disruption. There's a lot of existential risk for small, large businesses alike. Right? When we look at our business, we're a human company. And I think AI, it disrupts humans. And so, looking at, where is AI going to be able to take over a particular human role? That was different than the internet. Internet was just a technology. And so, now, we're using both technology and human augmentation in ways that we've never thought about before.

Dave Vellante

>> I mean, Andy Jassy is hardcore on this. He talks all the time about how he's cutting layers and rethinking the organization, trying to change the culture. It's hard for a $100 billion company-

Rebecca Knight

>> Indeed. Indeed....

Dave Vellante

>> especially if you're entrenched, especially if you're doing really well, to say, "Okay. We're going to pivot to be AI-native as opposed to riding the wave." I mean, how many times have we seen companies just fall behind because of this?

Rebecca Knight

>> Exactly.

Dave Vellante

>> But you are vested in helping your clients, because you've got large clients, not get disrupted. I mean, that's the real opportunity for you.

Rebecca Knight

>> And not be disrupted themselves, as Deloitte, as the human-

Kevin Urbanowicz

>> Which is my comment earlier. That's where you're getting the top-down pressure. Smart CEOs, boards realize that. They're asking those questions, and they're saying, "We have to stay in business. What could disrupt us, and how do we make sure we stay ahead of that?"

Rebecca Knight

>> Right.

Kevin Urbanowicz

>> Right? That's not a cyber thing. Right? That's a whole of an organization.

Rebecca Knight

>> And what is our value beyond the human value?

Kevin Urbanowicz

>> And again, most human companies, they were built by humans. The functions, the way they organize themselves were based on the way humans worked and the capacity of a human. You have to rethink that entire concept across the entire business.

Dave Vellante

>> Michael Dell told us this. A couple years ago, he called the whole company together and said, "Look, we're going to be out of business if we don't disrupt ourselves. So as of today, we are disrupting ourselves." And by all accounts, they've started to do that. So they're a big company, a $100 billion company.

Chris Richter

>> That requires process and planning. We have a cybersecurity AI blueprint set of offerings. They cover specific, outcome-related journeys. One of them is governance. So we're beginning to introduce those to our clients to begin that journey and that process with them. But you can't just implement it and walk away. It needs care and feeding. The language models need care and feeding. If you feed them the wrong information, you can get a bad outcome.

Dave Vellante

>> So, Kevin, you're suggesting that a lot of your clients have top-down support for this. What about the fat middle and the bottoms-up? Is there as much momentum and enthusiasm there? How would you compare it to previous waves?

Kevin Urbanowicz

>> I see something very different here. Right? The bottom-up has always been, "We want new shiny tools. We want to adopt latest and greatest," because it makes their jobs easier. That's cool. And then they didn't have the support, the financial support or the management support. The management support's there now. There's a realization at top and bottom that, "We have to do this, and we have to do it together." And so, just the pilots, the POCs, the asks that we're getting now have changed drastically in the last six to 12 months.

Rebecca Knight

>> Excellent.

Dave Vellante

>> There's a big discussion as you see the MIT study. I don't buy it, by the way, that 95%. I think that's-

Kevin Urbanowicz

>> It was good news for us.

Dave Vellante

>> Yeah. Yes. But I do think it's a little bit overstated, but my question to you is, what are you actually seeing? We talked earlier about hitting singles. What are you seeing specifically in cyber? It seems to me that the ROI in cyber with AI is potentially like coding, more tangible than it maybe is in some other mainstream workflows. What are you seeing?

Kevin Urbanowicz

>> It starts in places that are obvious, but I think what we're quickly seeing is the application of the less obvious ones, and agentic helps that. Right? It is sort of like, "Okay. I needed to do a specific task. And then when it gets to the end of that task, then what? Then do I turn it over to a human?" And you start building out these workflows and automations around the AI and the agent, realizing that every step of the way, these are just decisions that humans were making that we now can trust an AI model to potentially replicate. So coding is a very logical thing. The SOC analysts, they have a playbook that they follow. But as we get into more philosophical areas where there needs to be a little bit more thought that goes into it, that's now going into the model as well. So to me, the point that we're starting to figure out is, what do I trust my AI to do? And there's a human in the loop. I got to watch what it's doing. But that trust is quickly going to grow to where we want them to do more and more beyond just basic tasks.

Dave Vellante

>> So if I translate that into financial terms, there is an ROI. The break-even period is probably pretty quick, but the net present value ain't moving the needle the way we want it to, and some of those big agentic initiatives are where that's going to happen, but they're more risky.

Rebecca Knight

>> Excellent.

Kevin Urbanowicz

>> Risky, but we're absolutely seeing real ROI, tangible ROI in our own business. Right? We run large managed security operations for our customers. So we have a lot of human resource that goes into that. And so, anytime that we can automate or add AI, which we've done, and we're seeing real tangible value, and then we're building those same capabilities in our client environments. It starts as, "Hey, we're going to pilot this. We've done it. We've proved it out. Why don't you try this?" And then they see the value, and that's snowballing.

Rebecca Knight

>> A virtuous circle.

Dave Vellante

>> Where are you seeing that? Sales, go-to-market, delivery-

Kevin Urbanowicz

>> All....

Dave Vellante

>> marketing, across the board, coding?

Kevin Urbanowicz

>> Across the board. Every function that we look at within security operations has an AI capability that is being built or has already been built.

Rebecca Knight

>> Excellent.

Dave Vellante

>> Very cool.

Rebecca Knight

>> Well, Kevin and Chris, thank you both so much-

Dave Vellante

>> Thanks, guys....

Rebecca Knight

>> for coming on theCUBE, a great conversation.

Kevin Urbanowicz

>> Thank you all so much.

Chris Richter

>> A pleasure. Thanks.

Kevin Urbanowicz

>> Appreciate the opportunity.

Rebecca Knight

>> I'm Rebecca Knight for Dave Vellante. Stay tuned for more of theCUBE's live coverage of Fal.Con 2025. You're watching theCUBE, the leader in enterprise tech news and analysis.