Black Hat USA 2025 | Grant Bourzikas, Cloudflare

Clips
More from Black Hat USA 2025

Grant Bourzikas

SVP & CSO

Cloudflare

play_circle_outline Grant's Leadership in Threat Intelligence at Cloudflare: Safeguarding 20% of Internet Traffic from 250 Billion Daily Attacks

play_circle_outline Understanding Link Wrapping: Simplifying URLs or Creating a Tool for Deceptive Online Practices?

play_circle_outline Building Trust Through Transparency: Grant's Approach to Security and Customer Relationships

Info
Transcript

Grant Bourzikas, Cloudflare

Grant Bourzikas

SVP & CSO Cloudflare

At Black Hat USA 2025, theCUBE’s Jackie McGuire sits down with Grant Bourzikas, Chief Security Officer at Cloudflare, for a candid discussion on trust, transparency and the evolving threat landscape. Bourzikas breaks down Cloudflare’s latest research into link wrapping, revealing how the inherent trust in security technologies can be exploited by attackers. He shares insights from the company’s collaboration with Proofpoint, illustrating how seemingly “safe” wrapped links can be weaponized to deliver malicious content.

The conversation expands into w... Read more

explore Keep Exploring

What is the role and responsibilities of the Chief Security Officer at Cloudflare? add

What is the role of link wrapping in enhancing perceived security and trust in online links? add

What challenges do Chief Information Security Officers (CISOs) face regarding transparency and disclosure in their organizations? add

bolt Powered by CUBE AI

Grant Bourzikas, Cloudflare

search

Jackie McGuire

>> Welcome back Cube Community. This is Black Hat 2025 at the Mandalay Bay in Las Vegas, Nevada. I'm Jackie McGuire, your Practice Lead and Principal Analyst for security, your favorite security media host. And I am exceptionally excited today because I'm joined by Grant Bourzikas. He is the Chief Security Officer at Cloudflare. And I was able to just write up a summary of the report you released last week. So I'm really excited to talk about it. Welcome Grant. Thanks for joining us.

Grant Bourzikas

>> Thanks for having me. It's wonderful to be here, Jackie.

Jackie McGuire

>> Awesome. So the report you released was about link wrapping, and I think my take on it was the inherent trust in some technologies and then how that trust can be weaponized. So we're going to get into the whole thing, but I think maybe we should start with a really high level. What do you do at Cloudflare? What does Cloudflare do? And then we'll get into the report.

Grant Bourzikas

>> Great, great. And thanks for having me again. So I'm the Chief Security Officer for Cloudflare. I also manage all of the Cloudforce One threat intelligence, and so I think that's a very interesting part of my job to see 20% of the internet transverses through Cloudflare. So that job is key because we get to see all the telemetry across the world. CloudFlare, I think is the largest global security provider in the world, with 20% of the internet traffic coming through us, 250 billion attacks a day we see. And so we do things from zero trust, to web application firewalls, protecting the internet, protecting employees. And then we have this amazing compute platform on the edge, which is amazing running artificial intelligence and GPUs.

Jackie McGuire

>> Yeah, I think you're one of the most ubiquitous things on the internet. And you go to a website, you click on something and you get the little orange spinny, we're going to verify you're not a bot, Cloudflare thing, so I'm sure most of our viewers are familiar with it.

Grant Bourzikas

>> Yeah, that's my favorite thing. Somebody will text me once a week of, "Hey, thanks for securing my online transaction."

Jackie McGuire

>> Yeah, it makes you feel better.

Grant Bourzikas

>> Yeah.

Jackie McGuire

>> All right, so this report is really interesting. Let's start with what is link wrapping?

Grant Bourzikas

>> Yeah, so link wrapping is relatively...

Jackie McGuire

>> It's not like when you spit a verse about a URL, right? 16 bars on...

Grant Bourzikas

>> Maybe.

Jackie McGuire

>> Wrapping with a W for anybody who's.

Grant Bourzikas

>> Yeah. Link wrapping started many years ago when you had these long URLs that if you went to Cloudflare/product/zerotrust/CASB/ you don't want to send this big long URL. And so companies like Bitly and there's various ones out there, we have a service that does the same thing, to make it into a very small URL so you can see it. You don't have to look at this big long thing. It doesn't take up all of your email address. Sometimes you'll copy a link and paste it to somebody, and it's half a page on your email. And that's what link wrapping is, it is to make that smaller. Somebody else just translates it to a shorter URL. That's all it is. Simple.

Jackie McGuire

>> That's pretty easy. And then there's also a security aspect sometimes to link wrapping. So at this point I think it's Proofpoint we're talking about in this report. And so Proofpoint wraps links also to verify the domain. So there's almost like they make it seem like the link is safer when they wrap it, and usually it is, right?

Grant Bourzikas

>> Yeah. You just talked about Cloudflare, if you see a turnstile application that blocks bots, you think, "Hey, this website is secure from bots." And so in this scenario that we wrote the report last week with Proofpoint is they were wrap linking, that's hard to say. I should say it 10 times, I don't think I can do it. And then putting their name behind it, but the URL actually was malware or suspicious content.

Jackie McGuire

>> So it's like trustedlink.qz.whatever, and the person's like, "Ph, it's a trusted link. I'm going to click on it." Right?

Grant Bourzikas

>> Right.

Jackie McGuire

>> So I always say that the number one currency in security is trust. It's the easiest thing to lose. It's the hardest thing to gain. And it's really interesting in this report, because it's an example of how that inherent trust within this service was weaponized against people, because there's an assumptive safety there. And I think you see this broadly across security. I did an interview earlier today. We were talking about a lot of the most common compromises happen through security tools, or through tools you're already using, Living Off the Land and things like that. So how do you think about trust, especially as a Chief Security Officer, and we've both worked in finance, so we've had security jobs there where you're dealing with literally people's livelihoods and retirement. How do you think about trust in security?

Grant Bourzikas

>> I think trust in security is the most important thing you have. One of the things I think is important, I am the CISO, but I also talk to a lot of customers. And I think it's important that they trust the organization. They trust me. They trust me to protect Cloudflare. They trust Matthew and our founder to make the right business decisions around what we're doing. And I think I've always said for years, I want to do business with people that I trust, and whether it's a name, a brand, but often it's people when you come down to it. Who is behind that has that issue? Or who is that that I can trust? And sometimes we've lived in the Zoom world, and the Teams world and everybody's web conferencing. And I did it today. I met somebody, I'm like, I should have known who you were, but I didn't actually know who you were because I've seen you 50 times on Zoom, but I didn't actually recognize you as a person. And so you end up and instantly you trust that person just a little more. And so I think when you get into security companies and what we do, it's important to trust your inputs. It's important to trust your network. It's important to trust the partners and vendors you choose to do work with.

Jackie McGuire

>> So how do you preserve trust as a CISO?

Grant Bourzikas

>> Maybe a story. And so we had this incident Thanksgiving Day of 2024 where we had an incident. And we wrote a 12-page blog. I was not legally obligated to do anything. It was something that's happened to me in every job I've ever been at. Every CISO I've ever talked to has had this problem, but nobody's disclosed it. And I think from a trust, we went out and said, "Here's what happened. Here is all of the mechanism. Here's the timeline, here's the IOC's, here's what we do." Now, a few people, probably 1% of the people will look, CloudFlare had an issue. And I said, "No, no, you missed the point. We are transparent and you can trust me." If I'm telling you the truth on this, of something that no organization wants to disclose, then you should be able to trust us as an organization. And this is something that from the beginning of CloudFlare, sometimes people say we're a blogging company that had to find some technology.

Jackie McGuire

>> You're a content company with security services.

Grant Bourzikas

>> We love to blog. We love to write these detailed things. And if you know we're writing that, then we're going to write everything, whether it's good or bad, we're going to write about it. But you don't see that. And I always think, and the hardest thing, if anybody ever, I just remember getting down on the computer and saying, "How am I going to write? We had this incident, somebody logged in, we fixed it. It's good." No, no, no, this isn't CloudFlare, and details. And it's true. We went through it. And then we had a lot of people that came to me. I probably talked to almost 100 companies wanting to understand lessons learned, what do you do? That just instituted trust not with me, but with CloudFlare and our customers. And we saw a lot of big contracts of just coming to us of if you say that, then we trust you to do the business, because how do you know you can trust an organization if they're telling the truth or not telling the truth? And I think that's such a big piece of telling the truth, being transparent, being open, being honest.

Jackie McGuire

>> I don't have any negative associations with CloudFlare. And I think that's probably a big part of it. So I briefed with a company a couple of months ago, very large company, and they asked me what my general impression. And I said, "My reputation is an analyst, is the person who will tell you there's spinach in your teeth. So I'm going to tell you honestly, the biggest things I remember about you from the last year is that you had multiple CVs and export vulnerabilities that were hanging around for days, and days, and days, on forums before you acknowledge them. And I think you probably are underestimating how much that impacted people's perception of you, and of their ability to trust you, and how many CISOs I've talked to that urged them to seek alternative because they couldn't trust you to be transparent." And that is a huge deal.

Grant Bourzikas

>> And this is something I talked to having been in banking most of my career, where I couldn't really, actually, I was telling you this before this, I can't really tell you my feelings in that world. I wasn't-

Jackie McGuire

>> I wasn't even allowed to have a LinkedIn when I was a stockbroker. We literally, because everything you put on LinkedIn is technically marketing material, and has to go through compliance and all of that, I wasn't even allowed to have social media much less opinions.

Grant Bourzikas

>> You're right. And I think even when you get into TLP red, and I've been very passionate, because I was also part of the HTTP2 vulnerability. That was this very secretive thing that was, I think if we wouldn't have drove this with a few other organizations, it would've turned into something bad. But we had to get the information out. And so a lot of people are preserving that information, holding that, using it to my advantage. And as a CISO, I've been a CISO for over 20 years, would infuriate me because you know something you're not telling me that can get me breached, because you're afraid of standing up. Or doing the right thing. And it's not doing the right thing for myself, it's doing the right thing for all of us. We always talk about knowledge sharing, and public partner private partnership, and we don't always do that. And I think the thing that's been interesting here is, trust me, if there's a problem, every cloud provider has abuse on the platform. But if you call, if you know the people, if you follow the process, it gets fixed. And I think if you ask me to do something, I do it. And I think this is this trust thing of you have to do business with that organization. Because eventually, maybe not today, maybe not tomorrow, maybe not in a year, there will be a problem you have with that vendor of non-performance or poor quality. And I think when you go to it's still who do you trust in the organization? Do they have your best interest in the mind? And I think it's very valuable to understand that.

Jackie McGuire

>> Yeah. So my wonderful strategist, Erica, who I work with, who keeps me from spinning off the rails, and keeps all my customers happy, one of the most common things I say when I get off the call with someone, if it's someone I like who's in the community, I'm like, "They get it." That is the highest compliment I can pay somebody after getting off a security briefing with them is I'm like, "They get it." And what I mean by that is they're in the community. Because I've unfortunately burned some bridges and friendships by disclosing things to people who needed to know about them, that other people were not going to disclose. And in some of the communities we're both parts of, that is one of the, that's table stakes for joining that community. Is we understand that there are definitely layers of confidentiality and sensitivity of information, but we are all on the same side and we are all fighting a very common adversary. And if you don't communicate, if you don't share information, if everything is a PR spin, and a press release and some massaged thing, it's like people can see through that. And you can tell the CEOs, the CSOs, the CISOs who have actually sat in the seat because they get it. And when you're like, "It makes you mad." I'm like, "Yes, same." And I think for our families who don't work in this, when we get really, I don't know if you have this experience, but my husband, I'll get so worked up about something. Be like, "Could you believe this zero day was out there and they didn't tell anybody." And he's just like, "Is this a big?" I'm like, "You don't get it." But that's it. So I really appreciate that perspective. So what do you have going on at BlackHat? What's your favorite events? What do you have going on yourself?

Grant Bourzikas

>> Of course, the Cloudflare events are the best event in the world.

Jackie McGuire

>> Yeah, go visit the Cloudflare booth.

Grant Bourzikas

>> What I enjoy at BlackHat is just running into people. And on the way up here, a person approached me. He worked with me when I was at ScottTrade in 2005. I don't think I've seen him in 20 years. And just bumping into him for 30 seconds seeing him. And then I was walking out and ran into another person. And what's interesting is just I would say I'm probably the traditional CISO that has had one too many CISO jobs, I think seven CISO jobs in 20 years, well over 20 years. So you're that average of three years. I've had a lot of people, I have a lot of people follow me. A lot of people that both of these individuals are great people, but you move on, and they move on and you don't see them and then you pop into them. And I think doing that, or seeing somebody in a booth, or just having those side conversations, they're just great. And I think that's one of the things. I also, I see some of my own vendors, which is always good to see vendors, and talk to people, and talk to the CEOs about what's going on. But I also enjoy, I've probably had five or six customers that want to talk to me and they usually, it's always like, "Well, what do they want to talk to you about?" I'm like, "I don't know. Why do they want to talk to me?"

Jackie McGuire

>> Because you've had so many CISO jobs and you actually because you get it. That's why they want to talk to you, because they can tell you get it.

Grant Bourzikas

>> Some can be like, "Hey, what's your perspective on X?" There's a big bank that I met with the CISO and she's like, "I want to meet with you every quarter. I want to know what's in your head, what you're seeing in the threat landscape, and just have a sounding board." And why me? I am just Grant. But I think these are things that you see, or there's been meetings where people will consult into me. But here it's good to meet new CISOs. Some CISOs have been around a long time that I happen to know, or people that are first time CISOs and trying to think about best of breed versus how you use CloudFlare. And so I think they're good. And we had had a call today, and the sales team was there, and then they left, and then he came back. And then he started asking me, I'm like, well, I thought you were done with this. He's like, "No, you are in the banking industry. I'm in the bank. I'm a British bank. You worked for a British Bank." Oh, well, I'm happy to just chit-chat. And I think those things are authentic.

Jackie McGuire

>> It also renews my faith in humanity, to be honest. RSA, this, there are a handful of security conferences that I walk away from and I'm like, "Okay, we're all still on the same team. We're all still moving towards the same objective." The world seems like chaotic and adversarial, but when I come into these rooms, I'm like, "The people doing the important work are all still on the same team. And that's important."

Grant Bourzikas

>> Yeah. I think sometimes the community, I think could be a little competitive and a little, why has that person got the job? Or why didn't I get this job? But I think you're like, we're all on the same page. It goes back to the same thing. It's trust. Are you being open, and transparent and are we collaborating together? And I think that just to me is as I did a call with some interns at Cloudflare, and I said, my first CISO job was in 2003. And I was like, "Was anybody born in 2003?"

Jackie McGuire

>> graduated high school before then.

Grant Bourzikas

>> Never should I have ever done that. And not a single person on the call was born before 2003. And I'm like, oh, I'm old. When did that happen? I still look good.

Jackie McGuire

>> Yeah, same. It happens to the best of us. But I wish we had more time. Unfortunately, we don't. Grant, I really appreciate you taking the time. I reached out. I really wanted to talk to you. This report's amazing. I love Cloudflare. So thank you for taking time out of your Black Hat experience to come talk to me today.

Grant Bourzikas

>> Well, thanks, Jackie. Enjoyed it. Have me come back. This was wonderful.

Jackie McGuire

>> Yeah. Yeah, I would love to. All right. And everybody else, Cube community, stay tuned. We have lots more coverage coming from Black Hat 2025 at the Mandalay Bay in Las Vegas. We have great guests and a whole bunch of awesome information. So come back and we'll be right back with you.