Google Cloud Next 2025 | Sean Joyce, PwC & Peter Bailey, Google Cloud Security

Clips
More from Google Cloud Next 2025

Sean Joyce

Global & US Cybersecurity and Privacy Leader and US Cyber, Risk and Regulatory Leader

PwC

Peter Bailey

VP/GM SecOps

Google Cloud Security

play_circle_outline Security and AI-driven security in cybersecurity operations

play_circle_outline Transition to AI companies in security consultancies

play_circle_outline Empowering Young Cybersecurity Professionals: The Benefits of Curiosity, Data Science, and Analytical Skills in a Mission-Driven Industry

play_circle_outline Real-time data analysis for threat detection and remediation

Info
Transcript

Sean Joyce, PwC & Peter Bailey, Google Cloud Security

Sean Joyce

Global & US Cybersecurity and Privacy Leader and US Cyber, Risk and Regulatory Leader PwC

Peter Bailey

VP/GM SecOps Google Cloud Security

Exploring the future of AI-driven cybersecurity at Google Cloud Next 2025.

Join Peter Bailey of Google Cloud and Sean Joyce of PwC's cybersecurity division as they delve into the intricacies of AI-driven security at Google Cloud Next 2025. This engaging discussion illuminates crucial topics and pioneering technologies that shape the future of cybersecurity.

In this insightful dialogue hosted by analysts of theCUBE Research, Savannah Peterson and Dave Vellante, Bailey and Joyce share their extensive expertise in cybersecurity. They examine th... Read more

explore Keep Exploring

What are the key advancements in security operations that are currently being discussed, and what challenges do they face? add

What is the perspective on security companies and consultancies needing to evolve into AI companies in order to adapt to rapidly changing technology? add

What are some tips for getting into a career in cybersecurity at any level? add

What are some methods and strategies for improving data security and analytics in a network environment? add

bolt Powered by CUBE AI

Sean Joyce, PwC & Peter Bailey, Google Cloud Security

search

>> Good afternoon, CUBE community. And welcome back to fabulous, sunny Las Vegas, Nevada. We're here midway through day two at Google Cloud Next. My name is Savannah Peterson, bringing you all the best and brightest from the show floor with Dave Vellante this week. Dave, we're talking about security.

>> Yeah, one of my favorite topics.

>> This is one of your favorite topics. Security's really grown on us a lot lately I feel like.

>> It is, it's because it's so difficult and an impossible problem to solve.

>> You know why I like it? I think it has some of the most earnest people in the industry because they truly are the quiet, good guys out there fighting the good fight.

>> Yeah, superheroes, for sure.

>> Yeah, they are definitely superheroes. Speaking of superheroes, we have two to my right. Sean and Peter, thank you so much for hanging out.

>> You bet.

>> A couple of CUBE alumni. Peter, you and I even got to sit down about six months ago. I'm feeling it's becoming a regular gig.

>> I know, I know. It's a regular gig.

>> We'll put you in the host seat next time.

>> Let's do it.

>> This is going to be great.

>> He would be a great host.

>> He would be a great host. Honestly, you all-

>> Photogenic. He's much better looking.

>> Oh God, here we go.

>> everything.

>> But the sense of humor-

>> He's got the whole ....

>> is got to be from both of you because that's very clear. So I won't take all that self-deprecation on this segment, Sean. Don't you worry. I'm excited because we are agents, agentic, definitely the hype and buzzword bingo of the moment right now. However, no one on this stage has talked about agentic-driven security yet at the show. And I think this is going to be awesome. Sean, I'll open with you since I haven't had a chance to interview you before.

>> Okay.

>> What is agentic AI-driven security and what does that mean?

>> Well, I think it means many different things to people, but-

>> Which is why I'm asking you to define it once and for all....

>> I know. I'm trying.

>> No pressure.

>> I'm trying. Listen, I think so many things in security operations over the past several years, we've gone to the automation phase and how we're doing it, now we're really moving into agents. We're not talking about just prompts, we're actually talking about agents that are acting independently, reasoning across systems that are actually making decisions. So Peter and I have talked about this, where I do think with unified security and what Google is putting out that they announced during the conference. But it is a way to bring, I think, all these disparate pieces of security operations together in one place, that's going to actually help defend against the adversary. Now obviously the opposite side of that is the adversaries are doing the same thing coming from the other side.

>> And how do you combat then from an adversarial perspective? Peter, I'm going to ask you. How are you insuring that you stay one fingernail ahead of the competition? Because everyone's innovating the same time.

>> First of all, we don't say insuring in cybersecurity.

>> Yeah, I guess that's true.

>> Trying our best.

>> There is no insurance.

>> There's no insurer. There's no insurer.

>> That's so true. And we did have the cybersecurity insurance folks on yesterday so this is all very topical because you can't say that it's insured. Anyway, carry on, Peter.

>> Yeah, no, so listen, I think on some level, cybersecurity is very basic in terms of there's a bunch of best practices. If you follow those best practices, you're going to reduce the size of the problem. And then you're going to point a bunch of your technology at the remaining problem. And what I mean by that is even today, companies that aren't doing an assessment of their posture, they're not doing multi-factor authentication, they're not doing micro-segmentation of their networks. These are things, like motherhood and apple pie, you have to go do. And if you aren't doing those basics, you're just going to put yourself in a much, much worse position. And so for the customers that have done all those things, then they get into much more advanced ways they can defend themselves by looking at specific parts of the attack surface. You can analyze that. In the old days, before agents, it's people and spreadsheets and analysis and maybe some ML in there, which is more of a rules-based AI. But this next step is to what Sean's point is, now you're introducing reasoning and more intelligent analysis. And so we're imagining that there's an automation of those functions in the security operation that are looking at threats, trying to analyze and do a threat analysis, to turn that into a detection to go chase something that looks bad. And by automating that, you can go much faster, much more often, and spend more of your time strategically thinking about your risk posture. And the next thing, which might be zero trust or something else you want to go chase. And so that's a huge opportunity.

>> The other thing though, Peter, I would say is, I think when people say security operations, they think of the security analysts at their desk dealing with alerts. And I go back to, I think it's security operations like defense in depth where you start at the browser level, you're also looking at the threat intelligence, what you have. Going into the security operations, how are you orchestrating that? So it's not the old SecOps that I think the normal person thinks of. And then I would say that to me, the big differentiate is how are you going to push that value upstream? So you got the SecOps here, everyone's saying, "We're going to do managed services, we're going to do this." What's the value you pushing up there to change business process or the way you're doing things? I think that's a critical point.

>> You remember one of the first interviews you and I ever did with Lena Smart who-

>> Who's one of my-

>> Do guys know Lena? She's the CISO of MongoDB. She's like, "Just don't ever click on links."...

>> Yeah, no. She-

>> I'm like, "What do you mean?" She goes, "Don't ever click on links, period."

>> Remember my first comment, it's actually, it's very simple.

>> It's very simple.

>> On a simple level, just don't click.

>> That's what made me think of that, Peter.

>> Yeah, totally.

>> Okay. There should be shirts for that.

>> We need them.

>> So I had an opportunity to sit down with Nir Zuk a couple of weeks ago and he put forth the premise, and I've been wanting to ask Google about this. And Sean, I'd love your thoughts as well. He basically said, "Forget everything we've done with cyber security, throw it out. AI and automation render all our existing security useless." I'm going to explain that. He goes, "Well, previously we could stop 99% of the attacks, but in that 1% humans could sort of deal with. But now with AI and automation and gen AI, attackers can overwhelm us with better phishing emails. And it's just at scale. So humans can't handle it. So the only way to fight AI attackers is with AI." So my question is security a do-over? My context of that is, a couple of cloud service providers, I would say Google and Amazon on your end, I think you got it covered as well as anybody can be expected. But there's that shared responsibility model.

>> Of course.

>> So from that standpoint, and based on Nir's commentary, is security a do-over?

>> It's a great question. It's probably not a total, but it is a big, big, big, big change. And what I mean by that is, to use the comment you were referencing earlier, you were up against one individual trying to make their way through your network through a kill chain. And maybe a good analogy is denial of service attack where you're trying to really go take down a website. In a kill chain, you've got all these points where the hacker's trying to go laterally and find a server and find a target and get you XYZ. Imagine that happening like a denial of service attack where at every point you're getting just massive flush of activity across the whole attack surface. And that's where it's like no human can deal with that. So you have to have AI that's on the other side of that that is dealing with that. And I think the other point is that if perimeter security's not going to be helpful anymore, and micro segmentation only helps so much and all that, at some point there's this shift left thinking where it's how do you get closer to the problem? And are we just shooting telemetry into AI itself that's going to be able to go off and resolve those issues of machine speed? And I think that's probably what he was referencing, is that there's a longer term view of like, "Hey, we're trying to build a model that can predict the weather, that can go out there and look at a massive data set, understand it, understand the attack paths someone would take, patch all those up and actively be able to defend that environment." And so down the road 20, 30 years, there's the scenario that machines defend themselves. That's the science fiction thing is something people are thinking about today.

>> Sean, my takeaway from that was that security companies and security consultancies actually have to be AI companies.

>> Yes and no. So obviously we're all adopting. We said we weren't going to say AI, but of course. So on the do-over, I'm not a total buy-in because the fundamentals stay the same. If you look at the MITRE ATT&CK framework, it's still going to stay the same. What's my entry point? What's my reconnaissance? All the way to how am I going to move laterally? But it's just going to be done differently. So to me, it's looking at how do we face off against, I think, Peter, what you were saying, that machine speed to machine speed and you get all into self-healing networks. So I'm not worried, security's the last thing that-

>> It's not a do-over, it's a do different....

>> It's a do different. I like that, Dave. It's definitely a do different. Consultancies. If I had to say, security consultancies are the only things that are going to last. I mean that because as technology evolves even quicker, we are going to evolve with the technology. So of course I'm turning into, I'm not big on everyone's an AI company. You do what you do, but you're going to use the latest technology.

>> And I think Sean and his firm are critical in this transformation because we don't want to ask every company on the planet to become an expert in the new thing and have to manage it on their own. That's crazy, right? They're selling their widgets, making their thing, whatever. Sean, his firm, they have to be that strategic partner that is guiding that company through that transition, and driving the transition and all of that. And any big change is going to require that.

>> Dave, as you were saying, and Savannah, it comes down to risk. We're all talking about this stuff. It comes down to risk. And I always say every company has a digital backbone. Every company today has a digital backbone. How are you protecting that? I don't care where we are, agentic AI, what's the next thing after that? How are we going to actually defend against that? And as you two probably know, the big thing now is offensive security. What does that mean? It's a whole nother topic.

>> Each time, one more time, right? The whole deal. So every year before RSA, our partner ETR and we do a survey and one of the things we ask is, "Are you able to reduce the number of tool sets?" Because the platform guys say, "Too many tools, you got to consolidate." When you talk to practitioners, very few will say, "Yes, we're reducing the number of vendors in our security stack." So I ask you guys, is too many tools part of the problem or is it going to continue to be part of the solution? Because new threats come in, some new startup comes in and it fills the gap. What do you guys think about that?

>> Well, I have an answer, but this isn't your bread and butter.

>> This is your wheelhouse, Sean.

>> I hope so. I am actually, if you asked me that same question three years ago, I would say we needed a lot of those point solutions. I think when we look at the work that Peter and Google are doing in unified security, listen, is every part of that best in breed? No. But are they getting better and better every day? And when you look at threat intelligence, that's the best in the business. So there are certain parts of it, but then you get to the point of how complex do I want my security fabric? And I would argue, I am leaning more and more towards going to what's a simplified platform that I can leverage?

>> You can't talk about Wiz, can you?

>> I cannot.

>> No. Okay.

>> What's Wiz?

>> There's an army of lawyers standing over here, all ready to tackle me.

>> I can comment. But that was a great example of a startup that came out of nowhere and focused on, they made it really simple to do posture management. And customers said, "Wow, that's going to solve a problem. I'm going there." And it worked.

>> So to build on that though, simple is really powerful, right? Simple is powerful. Think about also trying to bring people in your organization to become proficient and protect that organization. How hard it is to train people if your environment's incredibly complex.

>> Oh yeah.

>> So simplicity. There's very big power to that. And the other thing Sean said, which is I think is just super critical, is we're ultimately trying to create a security data fabric that can grab all the data, all the telemetry, all the visibility, and put it in a place that you can normalize it, enrich it, and analyze it. Whether it's humans or AI that's doing that, that's what we've got to enable. And so tool consolidation is to some extent solving that problem. It's also solving some toil and those sorts of things. But I would tell you also when you talk to a CISO, that's not the first thing on their list. Their first thing is making sure they have a strong risk posture, regardless of the tool sets. And then they start looking at the costs and the toil and those things can go from there. But fundamentally, that risk posture is ...

>> 100%.

>> Yeah, it's much more outcome-based in that circumstance, which makes a lot of sense. Offensive security is something we talked a lot about at MYs. I think that came up in every interview or just about. I'm curious, you talked about bringing people into the organization and that simplicity, that unification, that user experience quite frankly, of whatever they're looking at in terms of the threat landscape and attack surface is really important. I'm curious what your advice is to a young and ambitious cybersecurity professional or someone who just is listening to this conversation and thinks you guys sound really cool. What would you tell them in terms of this skill set to position themselves for the cybersecurity companies of the future? Sean, I'm going to you first because you're sitting there in my hot seat.

>> All right, Savannah, I'll take it.

>> You were warned about me.

>> No, no. I am telling you, I think we're in a place where we're all aware of what is it? Four-plus-million shortage in cybersecurity professionals, right? I'm not concerned about how they know about cyber security as how much aptitude do they have? What's their curiosity about that topic? I don't actually even care if they have a degree. I don't.

>> Good on you.

>> No, I think it's more important about, hey, the willingness to jump in there and learn because as Dave mentioned, talk about that redo. We're all learning now about how are we going to change this stuff? So it's not like they're so far behind. So to me, anyone listening today, we all come from very different backgrounds. And I just think it's real important that if you're worried about job security, come do cyber security.

>> Yeah, baby.

>> For sure.

>> It's always going to be around. It's exciting. You're doing a good thing for the companies, for our national economy, for our national security. I think it is a mission-driven type of focus and I think it's very rewarding.

>> This is why I said I like the cyber security.

>> It's kind of like golf. You can never master it, right? You know what I'm saying? You with golf, you think you got it and then all of a sudden. I want to ask you guys about-

>> Well, I was curious-...

>> Oh, please. You had ....

>> I wanted Peter to give us advice on that and answer that question as well.

>> Please.

>> Well, something we talk about all the time at Google is the mission because it's why we get out of bed in the morning. It's why we're working weekends. It's because there is a real mission there to help our customers, the community. And it's really cool to be able to wake up every day doing something that has real purpose and impact. So I would echo that and it's a wonderful career to get into. I think that you can absolutely enter cyber security at any level, but you got to be curious. Things that you may want to start thinking about are even data science, analysis, being an analytical person. We have people that come in through the threat intel side, which is a very analytical side. We have people that come in from the CS side. We also people that come in from being really great at dealing with the customer and coming up that chain too. So I would just say, if you take an interest in cyber-

>> That's a good point actually....

>> and you do some reading up on cyber, it is an industry anyone can get into. And we need a lot of people. We need people that are motivated and the sky's the limit because there's tailwinds. And the one thing we always have job security, and an addiction to caffeine, those are the two things.

>> And alcohol.

>> Okay.

>> This would be a good topic.

>> Caffeine as code.

>> See how slow I am?

>> But this would be a good topic to end on, but I don't want to end. I want to go back to do differently. So pick your data point in terms of exfiltration times, hours, sometimes minutes. It used to be weeks or months. So my question, as it relates to do differently, is a data question. There's always a data problem. So in thinking about real time analysis, threat detection, and remediation. How do you approach, because attackers are compressing the time it takes to exfiltrate data. How do you approach doing things in real time from a data standpoint? Is it consolidating the data? Is it having access to the right data in real time? How do you deal with the real time imperative?

>> Yeah, so yes, yes, and yes. Yeah, it is a lot largely about data and analytics at speed and scale, and we're moving from human to ML to now more of an agentic approach. They can look at that, but there's various levels to look at, the perimeter, the interior. And so the trick is, and my judgment is, that visibility thing. Having data in a place where it's normalized that you can act on that data very, very quickly is really critical. But more and more, again, I'll come back to some best practice, things like micro-segmentation that slow the attackers down. There are things you can do that by the time they get to exfiltration, it takes them a long time to get there. It is something where you can also put sensors in the network to start seeing activity. And so it does come back to, it's a data problem. But the other piece is then also the knowledge of what to look for. And so the threat indicators, IOCs, all that good stuff. And again, that's also a data problem, but this game requires visibility, knowledge, and expertise. You got to have all three. And you got to put that together to operate at speed, and then it'll go faster and faster and faster as we're able to leverage AI.

>> But Dave, listen Peter, I agree with everything you said, but I do think it comes back to, are we talking about the data in the SecOps, which is usually metadata and those type of things. And then data. And I think people don't look at the data life cycle where, "Okay, where am I obtaining, creating, retaining?" Like going through the data life cycle, deleting, actually get rid of the data. And then what data am I actually going to encrypt or tokenize, make quantum resistant? I don't think people spend enough time doing that.

>> Crown jewels, crown jewels. Where are the crown jewels?

>> 100%. And it's risk space. We come back to risk.

>> Back to risk.

>> And then you get back to, "Okay, how do I then take that data? How am I protecting it?" And then I move to the SecOps where you're leveraging all the analytics in that space on metadata.

>> Since you mentioned quantum, somebody said the other day, somebody was asking about quantum the other day. And the person said, "Hackers don't need quantum. They're doing fine without it." Agree, disagree? What's your take on quantum is a threat.

>> All right. So I am definitely not smart enough to answer this question the right way, but I will tell you this. I think quantum computing being generally available to the folks walking around here is years away. Years away. However, I think doing quantum resistant encryption is here now. Because what we're seeing, and has done this with Google, we're seeing nation states hoovering up, vacuuming up all of even the encrypted data with the hopes of decrypting that at a later time. So I think it's really important on that quantum resistant encryption, that's the act now. Quantum computing, I think we got a little space there.

>> 1000%. If you have sensitive data, government, financial, healthcare, you should be adopting those advanced encryption methodologies immediately. Because for sure, what you just described, the hoovering up the data has happened, is happening, and is needed.

>> I'm very curious to see when Y2Q ends up showing up.

>> Y2Q, there you go.

>> It's been in the convo, a little bit of a whisper convo.

>> Can I just add something to advice?

>> Yes.

>> You want to get into cyber, you got to be really good at acronyms.

>> Oh my God, yes.

>> That is the truth.

>> That's for sure.

>> Okay, one final question, and I'll wrap us up here to keep you guys on time. When we're hanging out at Google Cloud Next or the next time I see you at a show because it's becoming more frequently, what do you hope to be able to say then that you can't say today? Peter, I'm going to go to you first since I had you recently.

>> So how far is this show from now?

>> A year.

>> A year? A year from now? Oh, gosh.

>> Or six months, whatever .

>> Or two years if you want.

>> Yeah, yeah.

>> I think my hope is that we have made a multiple, I was going to even say an order of magnitude, efficiency gain in the security operation through these agentic capabilities. That is our ambition. And that's a huge, huge help to CISOs and their teams, and those security operations. And so that is our number one goal right now. Let's

>> Let's go with 10x and maybe not in the year, but let's go with 10x. That's where we want to be.

>> Yeah. What about you, Sean?

>> I hope we can say that we've leveled the playing field as far as with the adversaries. I really do. I don't think we're doing enough in the public and private sector around the world globally. And there just has to be a little bit more transparency, and I think as we move at machine speed, we're going to have to get together to actually solve that issue.

>> All right, well we look forward to checking back in with you a year from now to see how those predictions pan out. Peter and Sean, thank you so much. This has been an absolutely outstanding segment.

>> Thanks, guys.

>> I know that Dave and I could have gone on all afternoon, so we appreciate your patience.

>> Thank you very much. Appreciate it.

>> Thank you.

>> Thank you as always. And thank all of you for tuning into our coverage here at Google Cloud Next in Las Vegas, Nevada. My name's Savannah Peterson. You're watching theCUBE, the leading source for enterprise tech news.