Black Hat USA 2024 | Jason Lamar | Cobalt

theCUBE.net

Clips
More from Black Hat USA 2024

Jason Lamar

Senior Vice President of Product

Cobalt

play_circle_outline Navigating Cybersecurity Challenges: AI, Downsizing, and Evolving Technology Trends in Deprioritized Companies

play_circle_outline Expansion of offensive security services at Cobalt (code reviews, LLM AI models, red teaming)

play_circle_outline Importance of proactive approach in offensive security

play_circle_outline Customer feedback loop and updates on market trends

Info
Transcript

Jason Lamar | Cobalt

Jason Lamar

Senior Vice President of Product Cobalt

The cybersecurity community is shifting focus due to technological changes and downsizing. Reports show that many companies have deprioritized security, and the demand for AI has surpassed security team capabilities. Cobalt now emphasizes offensive security services, including code reviews, AI model testing, and digital risk assessments. Their diverse team of experts helps customers plan tests and automate the process. The company aims to improve security posture by being proactive rather than reactive. Automation and a proactive mindset are crucial for stayi... Read more

explore Keep Exploring

What was the finding in the recent OffSec Shift Report regarding the deprioritization of cybersecurity by 35% of companies and why do you think that might be the case? add

What services does Cobalt provide in the realm of security testing and how have their capabilities expanded in recent years? add

What is the importance of having a proactive approach to offensive security in organizations? add

What are the key elements in maintaining an active community of customers and incorporating their feedback into a platform to help them understand their attack surface and improve security measures? add

bolt Powered by CUBE AI

Jason Lamar | Cobalt

search

>> Good afternoon security community and welcome back to Black Hat. We're here in sizzling Las Vegas, Nevada, where it is toasty, not just because of the temps, but because of the conversations around cybersecurity. I am absolutely delighted to be joined by our next guest, Jason from Cobalt. Jason, thanks so much for taking the time.

Jason Lamar

>> Hey, thanks for having me.

>> It's a busy week for you guys.

Jason Lamar

>> It is insanely busy. It's a great time to be in security.

>> It really is a great time to be in security. Do you feel like the conversation and energy is different the last couple of months or even the last couple of weeks than it's been historically?

Jason Lamar

>> I think so. I mean, people are leaning into conversations that maybe they put off before because of the craziness that's going on in the world, and so it's good that we as a community, as an industry, as focused as we are right now.

>> Yes, definitely. Speaking of craziness, you just dropped a stat when we were chatting before we went live, that absolutely blew my mind. You said something like over 30% of companies have deprioritized security?

Jason Lamar

>> Absolutely. We did this report, it was called the OffSec Shift Report recently, and it was one of the findings in this report that 35% or so of companies had deprioritized cybersecurity. Now, think about all that's going on in the world. That's kind of weird.

>> How do you remedy that data? Do you have any ideas why that might be the case? Do you think it's cost? Do you think the fact that it can be a labor-intensive transformation, maybe they don't want to know what they don't know?

Jason Lamar

>> Well, there's a few technological shifts going on at the same time. We have all of this AI LLM the hype and the promise of that, and then we also have just so many things that are hitting organizations who have been downsized in the last 24 months, this kind of thing. So it's logical that some folks would make these decisions, but it's also like, whoa, they made this decision.

>> Yeah, I mean, it was jarring when you told me that. It seems like-

Jason Lamar

>> For real....

>> such a stark thing to do. It's like driving a car without brakes or seat belts on. It's, "Hey, we'll see what happens. Could be interesting."

Jason Lamar

>> Yeah. No news is good news, right?

>> Bold play. But to your point, the competing priority is AI obviously being one of those. Your data also showed in one of your more recent reports, that 57% of respondents say the demand for AI has outpaced the security team's abilities. How much of attention is that within organizations? Is are we excited about AI to help make us more secure? Are we afraid that nefarious actors are going to be able to penetrate more?

Jason Lamar

>> Well, you're not surprised to hear the answer is both, but what we see is an increased attention on folks that are bringing new experiences to market. They want to test, and because the established tool chains that are out there aren't covering these capabilities and there's a lot of new things coming out, but they want folks like Cobalt to come in and help them understand how good the security is for what they're building, especially since they're deploying it for the first, second, third, however many times it is.

>> It's early.

Jason Lamar

>> Recently. Yes, it's brand new. So brand new things should be tested the most in lots of ways.

>> Yeah, I think it's really exciting. Cobalt historically known over a decade old now, very successful company historically known for pen testing, but when you and I were chatting yesterday, I was really struck by the focus, the sage focus on offensive security. Can you explain what that means within Cobalt?

Jason Lamar

>> Well, we provide offensive security and Cobalt is the founding vendor in a category of vendors called pen testing as a service. But over the last year, we have been expanding our capabilities to cover much more than just traditional pen testing. So we're doing code reviews. We're testing LLM AI models, we're doing digital risk assessments, red teaming, all these kinds of things, and we do it from a platform, it's enabled by 450 of the world's best security experts that have been vetted by us, tested by us. And they assemble as small teams to execute engagements that customers commission within our application in our SaaS delivered application. Which also has now many capabilities for attack surface and scanning to complement the human manual testing with automated machine-assisted testing.

>> And really providing that holistic health across the board, which is so important right now. I want to talk about... You call them the core, right? Those 450-

Jason Lamar

>> The core. Yeah.

>> Yes. Those 450 core community members. I loved our chat about this. This community is such a passionate community. You told me that only 10% of folks who apply to be a part of that core actually get in, so this is basically the Harvard of testing.

Jason Lamar

>> Yeah, it's quite hard to get in. If you've ever tried to get a kid in school, in college, that's a very elite amount. Unlike a lot of competitors who have a one-dimensional view of how good their folks are with a bounty leaderboard and this kind of thing, we're much more thorough. We understand the true breadth of capabilities of individuals and figure out how to put them together as teams to produce great results.

>> And those 450 folks are all quite different in their backgrounds. So if I was coming to you, you can test a menagerie of things for me.

Jason Lamar

>> Yes. Diversity and security is good. We have a very diverse core, so many geographies, many backgrounds, many technical abilities, and if you need a test, we can do a test pretty much for any tech stack. So it's very diverse. Yeah.

>> That's awesome. What are some of the most common tests that customers need right now? What are the trends you're seeing?

Jason Lamar

>> Well, a lot of organizations, they're starting out. They've just maybe even developed their start-up. They developed their first application. They want to get SOC II, so people will come to us for a pen test for use in their comprehensive test for their SOC II. And then there's other customers who are becoming more agile. They're further along and they're more mature in their security journey, and so they want to test more frequently. And they come into the platform to commission different tests. And then recently we've got customers, they've never even done a digital risk assessment, right? So there's new capabilities that they're doing because times are changing, and new tests are needed to understand out what's out there.

>> Yeah, I can imagine that It allows you to grow with your customers too. What do you wish more people knew about Cobalt?

Jason Lamar

>> I think Cobalt is just a founding vendor. It's a pioneer and we want to make customers better, not just busy. So that's what offensive security is about. It isn't just finding a bunch of bugs and saying, "Oh, fix these by whatever." It's how do we work together through these different series of tests and automated capabilities to make you better.

>> Which I can imagine is well received.

Jason Lamar

>> Yes. It's exciting-

>> Especially this week.

Jason Lamar

>> It's exciting. I've been in security a long time. This is an exciting platform. It brings together people, human capabilities and machine capabilities to really help organizations get better.

>> Yeah, absolutely. It's very clear on the product side. Cobalt's got a lot going for it. It sounds like an outstanding solution. I can see why you're excited about it. Something that struck me when we chatted at lunch yesterday, you joined Cobalt for the culture.

Jason Lamar

>> I did. I love this company. The founders are from all over the place. They're not the traditional thing that we think of in security. They brought a fresh mindset to cybersecurity, and then the culture of the company is much like a Midwest company. And I say that with pride because it cares about people. It cares about diversity. Over half our company is women, we have a different DNA that makes us who we are. And I'm quite proud to be part of it.

>> You should be. I loved that Midwestern analogy yesterday. Midwest having a week depending on where you are on the political spectrum as well. So it's super exciting time. I love it. I brought it up. Founders two, the founders are Danish, full disclosure, friends of mine, Jacob. Shout out to Jacob and to Jen in Berlin right now. Thanks for making the magic happen and introducing me to Cobalt. It's always fun to connect the dots. Where do you see the biggest opportunity for growth or development or even transformation within these companies to be more offensive in their security? I feel like a lot of folks tend to be defensive. This is kind of a mindset shift. What are the biggest steps they can do outside of obviously hiring Cobalt to help evaluate?

Jason Lamar

>> I think the key thing is to have a mindset of a proactive approach. Offensive security is about being proactive, not like the 35% we talked about earlier.

>> Still, I'm like shook by that. To be really honest, I'm shook by that.

Jason Lamar

>> This is so important to organizations to try to get ahead, because there's a hamster wheel of vulnerabilities and fixing, and even when automation helps us. If we don't understand the root cause of why we're having those problems, then what other problems are we creating that we don't know about, maybe, with new technology and changes. So what we want to do is be more proactive, and that means making a shift from the reactive kind of one-off ad hoc, almost like a drive-by test that so many people do to becoming more comprehensive. Our platform allows you to plan a whole year. It helps you think about the different kinds of tests you're going to need, explore them. And we don't make you go through the whole process of the horrible statement of work. We'll let everyone goes through with traditional approaches. So we're trying to take some of the effort out of it to help people who want to make that journey to be more proactive and less reactive.

>> I love that. No one's ever been like, "Oh, I'd love to spend more time in an SFW talk." I mean, that's...

Jason Lamar

>> That's "they said no one ever" meme, right?

>> Yeah.

Jason Lamar

>> Totally.

>> Seriously, that's pretty savage. When it comes to making sure that your customers continue to feel confident, how are you updating them on what's going on in the market or maybe different tests you have available? What does that feedback loop look like?

Jason Lamar

>> Well, part of it is having an active community of customers that we listen to and spend time with and encourage them to give us feedback. And we've been taking that and putting into our platform. So we've expanded into helping customers understand their attack surface, helping customers do different kinds of scans to determine what's changed. So we want to arm them with information first, because if you can't see it, you certainly can't protect it. And then help them through our customer success management process. Help them understand what tests are appropriate and make the most sense for them where they're at in their journey.

>> Yeah, meeting them where they are and then holding their hand as well.

Jason Lamar

>> We're all on a journey in security.

>> We are all on a journey in security. You are not wrong with that. Actually, on that note, it's about public sector, it's about private sector, it's the government, it's all of it. How does that spread out for you in terms of your customers? I imagine they're cross verticals and kind of across the board. What's the breakdown? How many are huge companies? How many are governments?

Jason Lamar

>> We have a mix of mid-market customers. We have a lot of enterprise customers, and we have some SMBs. We have customers who are just starting out as tech vendors, startups. I have to say, that's exciting to serve them as well because the energy of that. So it's really all three of those segments and we focused a lot... In the tech area, you're not surprised to hear area where technologies are key to the customer's business model is where we're used a lot.

>> Yeah. What do you want to build next with the team?

Jason Lamar

>> What I want to build next? Well, I have some things, but I don't know if I want to give them away here. I would say-

>> Almost had you.

Jason Lamar

>> Yeah. The logical steps in having a comprehensive offensive security is... Like I said before, we want help customers be better, not just be busy. So there are some things we're putting into our platform to make our reports better, to give you better suggestions and to unify some of our information. We also have some interesting integrations coming up with some key partners that our customers will appreciate as well. So we have a lot on the plate. It's a very exciting time to be with Cobalt.

>> Yeah, it sounds like it, and very curious to see which of these segments grow. You're going to have to let me know when you're ready to talk about those things, because we would definitely-

Jason Lamar

>> I would love to come back and talk about this.

>> We'll have to make sure that happens. What's the most inspiring thing to you about the cybersecurity industry? It's such a passionate industry. You've been in the game for a long time and you're still here.

Jason Lamar

>> I think the biggest thing that's exciting to me about cybersecurity is the opportunity to do good. There's a lot of industries where maybe you have less chance to do as much good as in cybersecurity, but every day you're either doing good or not. You're either advancing the collective good or not. So to me, that's really important. That's kind of what drives my thinking.

>> No, that's beautifully said, and I think particularly in the tech sector, we're not always doing good. It could be selling ads or doing a lot of other things that are a part of that ecosystem, not that that's bad, but they're not always necessarily protecting our people and our communities and our companies.

Jason Lamar

>> It's also about having empathy. If you meet with a CISO and you understand the tremendous pressure and the crazy technical challenges of meeting different business models with technology and security personnel to be perfect every time, that is an enormous challenge. And I think everyone who supports them and makes them successful is doing good. Right?

>> Yeah, no, I think you're absolutely right. And it is a real sense of pressure. It's one of the systems within any business organization. If there's a failure on the security front, everybody knows everybody's staring at you, and it's not exactly the good news you want to be having all the time. Jason, this has been a total blast. I have one final question for you. When we have you back on to talk about those exciting announcements, whenever that might be, but let's just call it a year from now, next Black Hat, let's say that, what do you hope to be able to say then that you can't yet say today? And I don't mean in terms of secrets. Could be industry-wide, could be where Cobalt's at, could be anything.

Jason Lamar

>> What do I want to say then...

>> That you can't say today.

Jason Lamar

>> That I can't say today. I would like to say that I've convinced more of those customers who said, "I'm going to de-prioritize my security priorities." I would like to say that we've been able to move the ball forward and convince them to do more.

>> Well, I think that's important for them and for us as customers, who knows even who they are, that's pretty wild to think about. So we look forward to your next OffSec report and getting to analyze that data. And yeah, thanks a lot for having lunch and for coming to hang out with me today.

Jason Lamar

>> Oh, my pleasure.

>> This has been great. And thank all of you for tuning in. Again, special shout out to Jacob and the whole Cobalt team of friends of mine, and Jen and Berlin. My name's Savannah Peterson. We're in Las Vegas, Nevada at Black Hat. You're watching theCUBE, the leading source for enterprise tech news.

>> Clear.