Black Hat USA 2025 | Jon Kuhn, Delinea

Clips
More from Black Hat USA 2025

Jon Kuhn

SVP Product

Delinea

play_circle_outline Understanding Identity in Cybersecurity: Addressing Non-Human Identities and the Risks of Compromised Customer Credentials

play_circle_outline Challenges of shadow IT as teams use AI tools without proper security checks.

play_circle_outline Enhancing Visibility and Intelligent Authorization for Effective AI Tool Usage in Diverse Environments

play_circle_outline Iris AI tool to provide visibility and manage AI security risks.

Info
Transcript

Jon Kuhn, Delinea

Jon Kuhn

SVP Product Delinea

At Black Hat USA 2025, theCUBE’s Jackie McGuire sits down with Jon Kuhn, SVP of Product Management at Delinea, to unpack how AI and non-human identities are reshaping the security perimeter. Kuhn outlines why identity security is at the center of today’s threat landscape, with compromised credentials driving data exfiltration risks, and how Delinea is helping enterprises reduce their “blast radius” through visibility, governance and advanced authorization controls.

The discussion explores how AI’s rise is accelerating shadow IT challenges and why sec... Read more

explore Keep Exploring

What is the current focus or area of interest in cybersecurity according to the speaker? add

What challenges are organizations facing with regard to shadow IT in the context of AI implementation? add

What are some of the implications and challenges of using AI in development and testing environments? add

What are the steps or tools needed to gain visibility and govern the risks associated with AI tools in an environment? add

bolt Powered by CUBE AI

Jon Kuhn, Delinea

search

Jackie McGuire

>> Welcome back CUBE community. This is Jackie McGuire, your principal security analyst and favorite security host. I am at Black Hat 2025 in the Mandalay Bay in Las Vegas, Nevada. It has been a fantastic day already, and it is about to get way better. I am joined by Jon Kuhn, he's the Senior Vice President of product Management at Delinea. How are you today, Jon?

Jon Kuhn

>> Very good. Thank you, Jackie.

Jackie McGuire

>> We are here to talk about, I think what is probably the most frequent topic that I have talked about for the last three months, which is identity and more importantly, the role of non-human identities in the rapidly changing landscape. So thank you so much for joining us.

Jon Kuhn

>> Absolutely.

Jackie McGuire

>> So what are you hearing about identity right now? What are your customers telling you? And I guess you're in charge of product, so I assume you're always the conduit between customer and outcome. So what are you hearing in terms of what they need, what they're struggling with?

Jon Kuhn

>> I got to say I joined early in my career into the cybersecurity bandwagon because maybe I was altruistic or so, but I want to save the world. And I've done various things in application network security when it came to endpoint security, when it came to security or cybersecurity in general. But the thing that's most exciting I think today is identity security, because if we believe the stats, most of what customers are struggling with is compromised credentials. Those are one of the key risks that people are dealing with in terms of exfiltration of data. And so this is the subject that we tackle at Delinea is to really look at how can we help our customers reduce their blast radius from identity threats. Our customers, obviously, one of the biggest topics right now that is at this conference, but I'm sure that a lot of people are talking about is AI and its impact on identity security, as well as AI brings this non-human or machine component to things. And when you're dealing with AI and the frustration that our customers have, the first problem is visibility. They don't really know what's lurking in their environment, and that's the first question that we get from customers is that.

Jackie McGuire

>> Yeah, I find the shadow IT part of this AI boom is really, from a lot of the CISOs I talk to, what they're really, really struggling with because teams either don't know that they should check with security before they just spin up a bucket to dump a bunch of AI stuff in. They don't know that they're not supposed to just connect to APIs without asking. And so I think that's, from what I'm hearing in the field, absolutely top of mind is that, we don't think people have bad intentions, it's just that it's really hard to understand the full impact of what you're doing when you're creating data and people think they're just using a tool, but that tool is actively creating sensitive data. So we saw a huge acquisition, Palo Alto picked up CyberArk an identity play, and I wrote an overview of that as we do as analysts. And I said, "Identity is the new perimeter." We kind of snarkily were talking about that before we started filming, but really, I mean if you think about overnight during the pandemic, we went from most people had a terminal or a laptop that only belonged to the enterprise. You could only access enterprise stuff on it. And then all of a sudden over the last five, I guess maybe 10 years, everybody's using their personal MacBooks, everybody's at home. So really overnight we went to remote work, we went to this need to merge personal accounts and personal devices with enterprise devices, and that was a nightmare. But now you talk about agents and agents doing probabilistic things. And if we had sat down 10 years ago and I was like, "Hey, so for our cloud environment, I'm basically just going to set up this detection that if it's over 95% probable something's bad, we're just going to shut it down." And you would've been like, "You're out of your mind." The 5% is a huge... But that's what agents are doing. And so how do you think about that? How do you think about containing that chaos?

Jon Kuhn

>> One of the most exciting thing that AI is bringing is this idea that you're becoming a force multiplier yourself, you can turn AI bots into doing more of your routine problems. But we deal a lot with privileged access, so we're dealing with a visibility problem in some respects of people utilizing their dev test environment, Anthropic, they're using GPT. They're using new models that maybe we haven't even heard of yet in those environments, and they're plumbing them into actual live data. And we've seen this... I can tell you, a financial services company who's looked across their dev test environments and found a hundred instances where they have an orphaned AI agent that an LLM that's actually pulling from live data for them to create some new application, but then they move on to a different project and that thing is still running within their environment. So we think visibility first, get the lay of the land of what tools are being used. The second thing that I think about is this force multiplier. We want people to be more productive. We want people to embrace this idea that IT moves from the no in every case to the department of yes. And so we think a lot about how do we help RT organizations become more the department of yes to allow much more aggressive use of AI, but not put the company at risk.

Jackie McGuire

>> Yeah, and I think that most enterprises are balancing this because I think a lot of CEOs are terrified that if they're not fully utilizing AI, they're going to get left in the dust by their competitors who are. So yeah, you want to take the breaks off. You want to just tell your employees, go run free. And we were talking about this because you were saying, I built the department of yes years ago. Because we always talk about, one of the hardest things about working in security is you feel like you're always the bad guy because you're always the person saying, "You shouldn't do that. You can't do that. Why did you do this? No, that's not okay. No, you can't spin this up." And I think one of the most remarkable transitions over the last year is we've accepted that, and I say this all the time, the horse is out of the barn with AI, you can't stop it. You really, really need to be a resource. And I think as the culture is shifting, I'm optimistic about it because securities having to become a collaborator, they're having to become an advisor, they're having to be a partner. And as we were talking, if you can take all of the shadow IT and all of these things that have historically been just a pain in the butt for security and just turn them into an onboarding pipeline. Into a, "Hey, we saw you spun this up, wanted to give you some tips on how we need to secure it. This is the action we've taken. This is what we need from you." That's really powerful. And I think you guys have a new tool to help do this, right?

Jon Kuhn

>> That's right. I mean, the first tool is really to gain that a greater visibility, and that is understanding what AI is lurking within the environment, and then helping to provide tools that help you govern the access to that tool in addition to how risky that tool is, or what data sources is it pulling from, what infrastructure is it connecting to? Does the identities that it's using have access to that infrastructure? And are they of the right access caliber? Are they reduced enough to reduce the blast radius of maybe an exfiltration attack. But we're going a step further. One of the great things we're talking about at this conference at Black Hat here is the ability to really focus in on the authorization piece of access. And so a lot of people talk about authentication, which is, does this person or this machine have access to this asset? We go a step further. For instance, we're looking within the session itself to look at what exactly, what actions are being taken by that individual, or as in the case much more these days since we started out, the non-human identities or machines themselves. And if you're going to this idea of the concept of IT being an enabler, yes. It's, let those scripts let those machines actually issue commands, maybe even in production environments, and actually be able to record and understand, are they malicious or not? Is this benign where you're maybe deploying a patch or is it something where you're turning off the commands and maybe dumping the log files and deleting the log files because you're trying to cover your tracks? We have the technology now with Iris AI, which is able to understand the authorization pieces, what is happening throughout that session, be able to flag that for the administrator to take action in an automated way, that may be destroying the connection, it may be stopping the access altogether so that the next time you're logged in, you can't access anymore, or it may just be for the audit capabilities of just flagging it for the administrator.

Jackie McGuire

>> So you're kind of trying to drill down to the actual intention behind what people are doing, not just what are they touching, and when, it's more why, why is this person doing what they're doing or this entity or this agent, whatever you want to-

Jon Kuhn

>> Yeah, I love that you said that because I think about that in four parts. It's, one, is what's the intention? And can you help automate the intention of, this is what I was intending to have happen to this machine. Two is the need. Does this person have the need to have that access? Maybe they are already qualified to have that access or not. The third is the risk. Is this a high-risky activity or behavior that has been exhibited by this identity before? And can we utilize that to make a smarter decision? And the fourth area is really, how critical is this asset? Is this very sensitive data or is this benign? Again, throwing out a patch there. And if you can couple those four things together, intent, need, the risk and the actual asset itself in terms of the sensitivity of the data, then you can make really smart decisions using Iris AI and actually automate the decision-making.

Jackie McGuire

>> Yeah, and I think the intention part is really critical because I think we want to believe that in programming and engineering and security, everything is objective. There's one way to solve a problem, there's a best way to do everything and what you'll find is there's always the joke that if you ask three engineers how to fix a problem, you'll get five answers. And so I think getting down to the not just, what are you doing? Because there are multiple ways to do everything and you can't relegate people to just one way to do things, why are you doing it? And how risky is... To your point, if I'm playing with VPC logs or internal approved Firewall traffic, probably not a huge deal. If I'm touching customer data, if I'm touching API keys and private keys, that's probably a bigger deal. So I think we do have to, especially if we're using probabilistic agents, have to understand what that agent's, not just what it's doing, but why. And yeah, so I'm a big fan because I think that this is the right way to go. And I think when you... You guys were nice enough to quote me on your press release, and that's what I said is this is fantastic because one of the things that makes security so amazing is we're a community and it's all, I've got your back. And we feel that when we're together, but I feel like one of the things we need to do more is bring the rest of IT and the rest of the company into that fold. And Iris AI is a great way to be like, "Hey, we've got your back. We saw that this happened. We're taking steps to help you. We're not trying to... We just want to help you do things in the safest way possible, but do what you're going to do. Do what you're doing, innovate. Let's just do it safely." And I love that.

Jon Kuhn

>> Yeah. So just to tell you a customer anecdote about that too. You just thinking about the innovation that we can do with Delinea Iris AI and authorization to this point that an AI agent may do things unnaturally that are maybe outside the scope. We had a recent, very large-scale university that had a chatbot, and that chatbot somehow got access to the applicant data that was behind, this is the people who are trying to be accepted into the university. And inadvertently, the chatbot basically was pulling data about the incoming students and who they were coming into the university. And it's the speed at which we're trying to innovate with these new applications like chatbots, we need better authorization decision-making that can remove the human, but can make much more intelligent decisions that based on the data that's being accessed to and with the intention of that data, well, maybe we ought not have that returned into the chatbot. So we're getting a lot of really interesting use cases like that that allow our organizations to innovate faster, but put guardrails and not gates into it, back to this idea of being the department of yes.

Jackie McGuire

>> Yeah, and I think it's important to note that even the largest tech companies in the world are screwing this up. There was a, I'm not going to... Microsoft, Microsoft had a team of data scientists, and they pushed this model to a GitHub and they didn't realize that somehow a full machine backup had been in that model and it had things like unhashed session tokens. And so I think it's something that it's not because of expertise, it's not because of resources, I think a lot of it has to do with just things are moving so fast and data is exploding and you can't do it all. And so I think having the advantage of having a large company that sees massive numbers of transactions, that knows behavior patterns, that can, to your point, leverage the intelligence from the rest of the community and from your own environment to make really intelligent decisions, I think it's a much better way to bring people into the fold and to really demonstrate that we can help, it's not an overwhelming challenge where you should just throw your hands up. Because that's kind of where security teams were at last year is they were like, "We can't keep up with this, we just can't let people do this." And it's like, that's not going to be realistic.

Jon Kuhn

>> Yeah, that's right.

Jackie McGuire

>> So hopefully, I think there's a lot of hype around AI and silly things that people are trying to do with AI, but I think this is actually one of the really good examples of we can use this crazy community intelligence to do things that are very practical, not just novel.

Jon Kuhn

>> Speaking of the practicality, we had another large-scale, this is a healthcare firm, which I thought was a really interesting use case where for this new application they were developing, they wanted to understand in real-time what performance impacts parts of the application have, and based on that, deploy the right sized infrastructure to that use case. And so the engineer that was working on this basically created an AI bot that would be smart enough to then check the performance of various parts of the application and then understand what the cost factor was at that given time for maybe replacing the EC II instance or whatever instances were being utilized, and then was able to create a model which went out and actually made those choices. The problem was is that it was a manual... Because it's privileged access, there was a manual process of approving that, and so it really slowed down everything. We showed them that by utilizing the authorization agent that we developed with Delinea Iris AI, that they could actually automate a decision like that because we could check it against a policy for, this was benign. It was something that they could re-platform pretty easily, they could save this cost benefits, but they weren't really involving any sensitive data and so this is something they could reap the benefit of, which I thought was really cool. There's stories every day about people just reaping the productivity benefits of utilizing AI. So I thought that was a great one.

Jackie McGuire

>> Yeah, and in security we could always use more time to triage the 10,000 alerts in our sim, right?

Jon Kuhn

>> Right, exactly.

Jackie McGuire

>> Thank you so much for joining us. This was amazing. I know we going to have you back, I'm sure. You're one of my favorite guests. We spent so much time talking yesterday, I had so much fun.

Jon Kuhn

>> A fantastic time.

Jackie McGuire

>> But yeah, let's give a plug. Anything else you have going on at Black Hat? I know you have a booth, so we want to send people over there to come meet you guys.

Jon Kuhn

>> Yeah, we have a booth here. We've got an amazing energetic team behind that booth. We're spending each time, bring your problems around AI to us. That's what we really want to tell people is that come and let us help you solution a solution around authorization.

Jackie McGuire

>> Stay tuned for more coverage, Black Hat 2025 from Mandalay Bay in Las Vegas. I'm Jackie McGuire for theCUBE. We'll be right back.