Clips
News
More from mWise Conference 2024

Chris Boehm

Director, Global Field CISO

SentinelOne

The power of behavioral AI: Inside SentinelOne and Mandiant’s dynamic collaboration

The intersection of cybersecurity and artificial intelligence is expanding and becoming more dynamic. SentinelOne is toeing this intersection with Purple AI, a platform that aims to leverage behavioral AI to transform how security analysts interact with threats and vulnerabilities.SentinelOne’s Chris Boehm discusses behavioral AI with theCUBE.“It’s a generative AI capability based on our data set,” said Chris Boehm (pictured), global field chief information security officer of SentinelOne Inc. “It started as an LLM technology based on endpoint security telemetry. It could do emails, do summarization or build code — it’s quite amazing

play_circle_outline Exploring Purple AI Technology: Capabilities and Real-World Uses

play_circle_outline Relationship between SentinelOne and Mandiant

play_circle_outline The Evolution of Autonomous Security and Generative AI in Cybersecurity Trends

Info
Transcript

Chris Boehm | SentinelOne

Chris Boehm

Director, Global Field CISO SentinelOne

The interview took place in Denver, Colorado at mWISE. Savannah Peterson and John Furrier were joined by Chris from SentinelOne. Chris introduced Purple AI, a general AI capability that enables users to ask questions about their environment and receive mapped out information. The feedback on Purple AI has been positive, with many pre-orders before the product was even developed. SentinelOne values partnerships, especially with Mandiant, whose threat intelligence is integrated into their platform. The goal is to create autonomous security, but this is still a ... Read more

explore Keep Exploring

What is Purple AI and how does it benefit security teams, partners, and analysts? add

What is the relationship between SentinelOne and Mandiant like? add

What levels of autonomy are possible in security systems, similar to autonomous driving technology? add

bolt Powered by CUBE AI

Chris Boehm | SentinelOne

Savannah Peterson

>> Good evening, cybersecurity community, and welcome back to Denver, Colorado. We are on our second-to-last interview here at mWISE. My name is Savannah Peterson, joined with John Furrier and our guest, who you haven't seen yet, but he just did a sweet fist bump that I cut off saying. John, man, this has been rad.

>> Well, day two's coming to a close and great event. A lot of great new content, a lot of new data. The payload, as we keep saying, is really strong here. Front lines with all the top experts have been great.

Savannah Peterson

>> I really love it. Speaking of top experts, really excited to welcome up Chris to the stage for SentinelOne, thanks for joining us.

Chris Boehm

>> Of course, I'm happy to be here. I mean, who doesn't know theCUBE? Seriously.

Savannah Peterson

>> I mean, that's music to our ears. We also gave, and your marketing team, just before we dig in, we gave your marketing team a shout out for your SentinelOne bags. They were on my swag segment earlier this afternoon.

Chris Boehm

>> Awesome. Thank you for that, we appreciate it.

Savannah Peterson

>> So you're getting all the coverage.

Chris Boehm

>> Awesome.

Savannah Peterson

>> From swag to the front lines.

Chris Boehm

>> I'll let them know all the way up. They love that.

Savannah Peterson

>> Great, good. Well, they should, and the segment's online, they can even see it.

Chris Boehm

>> Yeah.

Savannah Peterson

>> We are going to be talking about something we haven't talked about at all this week, AI. I'm kidding. We've talked about it a lot this night.

Chris Boehm

>> We can't see you not talking about AI.

Savannah Peterson

>> However, we have not combined AI with my favorite color, which is Purple AI.

Chris Boehm

>> I see that.

Savannah Peterson

>> Yeah. Oh, my lipstick is a bit of a tell, I didn't even think about that. And being a UDub Husky, that's actually probably why I went to Washington and had everything to do with color preferences. Tell us about Purple AI. What is Purple AI?

Chris Boehm

>> Yeah, so Purple AI, for those who don't know, it is a general AI capability based on our dataset. That's how we started. It started off as a LLM technology based on endpoint security telemetry, and it allows you to ask as a stock analyst what information is going on. I can ask what are the China APTs in my environment? It'll map the APTs, coordinate it for you, it maps it out for a SOC analyst to follow through, real easily. They could do emails, it could do summarization, it could build code. It's quite amazing. We use our own expertise and knowledge and TI feeds that we leverage with partners to enrich that experience to make it an amazing coordination for security teams, partners, and analysts.

Savannah Peterson

>> That's pretty rich. You're telling me I can use natural language to identify the threat landscape based on this incredible resource of data behind?

Chris Boehm

>> Yeah, and then you can map it based on your own segment of what you want to look at. If you picture a large organization, there may be emerging acquisition occurred or multiple different, whatever you want to call them, based on each organization. I can look at each branch or firm you could say and say, "I want to know what's going on in this landscape, and is there anything that I should be worrying about"? This new APT just came out, or this new CVE. They can say, "Well, this is what the CVE means for you. This is what we found based on your data, that's in your volume set, and based on your threat intelligence, we found mappings or we didn't find mappings for you." It coordinates it all right there really smooth and easy for you. And that's live today. It's not something vaporware, it's actually, even at Black Hat, we did a live demonstration for anyone in the audience to come up and put their hands on a keyboard and go against analysts with Purple AI versus a security analyst.

>> What's been the feedback so far?

Savannah Peterson

>> Oh, that confidence.

Chris Boehm

>> Yes, yeah.

>> What's been the feedback? Give us some update on people using it, how you guys see it. What are some of the early returns look like?

Chris Boehm

>> I've been in the vendor space for some time. Previous experience of mine, I worked at Microsoft. It's always hard to start the journey of a new product and then this is one of those few products that when we showed the idea of it was pre-ordered before it was developed and designed. So just they liked it so much, it's very popular at this moment in time, I'll put it that way.

Savannah Peterson

>> Whoa, that's like Apple level pre-order status.

Chris Boehm

>> It's a very ambitious thing. We're so proud of it, we want to let people touch it at a live conference with thousands of people.

Savannah Peterson

>> We understand the risks that come with live.

Chris Boehm

>> Yeah.

>> here right now.

Savannah Peterson

>> Yeah.

>> Talk about the relationship with Mandiant, because obviously the front lines, the defense is a big part. Obviously there's a lot of governance behind it, there's people for that, but where the threats are, the defense has to be there. Obviously maintaining security posture while bringing in some tools to make the efficiency work and ease of use, the UX to consumption, SOC innovation. What's that look like? What's that relationship? Can you share a little bit of that here?

Chris Boehm

>> Yeah, I mean I would say one thing about SentinelOne, we love our partnerships. It's something that we pride ourselves on. We work, coordinate, and make it as efficient as possible. Every partner is a charm for us, but Mandiant is something special. We actually, they're the only OEM threat intelligence we offer that is built into our platform, for example. I always say that's a chorus saying that we trust Mandiant so much that we want them to be something available to all of our customers, and that's an easy way to show how SentinelOne is working with Mandiant and Google Security or however you want to say it today.

Savannah Peterson

>> A little cloud security, that's all. I wrote the notes on what to say. Oh, goodness.

>> Well, maintaining the Mandiant culture and you see that still here.

Savannah Peterson

>> That's a great point.

>> Big vibe here was will this show, and again, they've earned that. I mean, Mandiant has been the leader, gold standard on first response, threat detection, recovery, consulting with partners. And as the ecosystem grows and becomes more connected, how are you guys seeing that play into the data set? Because again, sharing, having those TI feeds becomes critical. How do you see the landscape and the ecosystem evolving? Who makes it, who doesn't? From your perspective, what's the key success? What are the drivers?

Chris Boehm

>> Oh, that's a tough one. If there was a silver bullet out there, I think everyone would've made it by now. There's no perfect solution. I think we're trying to strive for that. One of the big ones that's popping up right now is autonomous security. You have a SOC that's built with generative AI. It's not 100% there. No one's really done it yet. There's some startups that are trickling that idea out there, but when you get down to it, the main goal usually goes to MSSPs or the large cloud providers or whatever, depending on their ecosystem for the most part. Then you can leverage a tool like ours and coordinate it with it appropriately and provide the right insights. Even ourselves, we work with most of the big providers out there and vice versa, so it's a two-way relationship. It all depends on the ecosystem. I would say some of the biggest companies in the world, they build their own thing. In the end, they have the resources, the capability. They'll leverage what they find relevant based on my tool, including if it was a little bit of Purple or a little bit of Mandiant's threat intelligence or whatever. But no one's really found that silver bullet I would say, even though we're all striving for it.

>> Where do you guys win right now? When you have customers, you have a good reputation, as you guys look at the landscape, when do they come to you guys? Why SentinelOne, what's the pitch? I guess what's the secret sauce? Not the pitch, but when you win, why do you win and how does that progress?

Chris Boehm

>> That's a good question. The pitch has been the same story for a while, I'm going to be honest. We've been so confident on our original story, it's now working. You can look at how CISA makes recommendations based on Volt Typhoon recently, one of the main things that recommends is behavioral AI capabilities. You might want this to catch things going forward. We've been doing that since the conception of our endpoint security. That's what made SentinelOne. Having the newer technologies and the integration of deep learning and generative AI is just adding the icing on the cake to make it easier for people to leverage us and use us because you don't have to be a cybersecurity expert that understands the language. You can ask it a natural language like you mentioned, comes back with it.

Savannah Peterson

>> Do I call it out, yeah.

Chris Boehm

>> Makes it really easy for you. It is interesting how the landscape shifted, but the pitch is actually pretty similar and we've been doing very well with it because it's becoming more recognized. 10 years ago, people were afraid of behavioral AI. They're like, "Do I trust it? Is it something that's actually working? It doesn't have the exact same patterns that I'm used to as a security professional." I still hear that today even though it's been allowed.

Savannah Peterson

>> I was going to say, "I thought that's still working as well."

Chris Boehm

>> Still going on today. But we have proven ourselves through multiple times. SUNBURST is an incident that we have a great documentation on. Not one customer was impacted by SUNBURST with us, and that was a zero-day vulnerability that the government still leverages today as an example of what to prevent. And behavioral AI is a big factor of it. Of course, they were afraid of us too, so that's another story altogether.

Savannah Peterson

>> It sounds like everyone's either absolutely stoked to be with you or slightly terrified, which is .

Chris Boehm

>> It could go both ways.

Savannah Peterson

>> I think it does that. You just mentioned the government. I'm curious if you could share any other real-world examples and case studies with us. That's Purple.

Chris Boehm

>> If it's with Purple. So Purple's a-

Savannah Peterson

>> Or anything else you want, now that we're here, right?

Chris Boehm

>> That's a good question. If there is a lot of use cases, I'm trying to think if I can share any, that's the problem. I can't think of any that it would be publicly accessible, although what we blogged about or talked about already. I mean, we tried to have advanced cutting-edge information about what is happening. We have caught some zero days and shared it out as our threat intelligence team is very innovative. I mean, even some Mandiant people come back to me and said, "Hey, that walkthrough you guys just provided around that threat actor. It was amazing and I loved hearing about it." It's a two-way relationship in this group. It is a tight-niche group. We work with major government organizations like CISA, DOD. There's a few segments that we work closely with, and it's all public. We make sure that we're working from the public sector and private sector perspective and it's all about sharing of information.

>> Chris, when you guys talk to your customers, a lot of IT departments, security departments, they work together. Some have different relationships, but in general, the trend now is I get a new tech stack, it's cloud native, it's cloud scale, but the processes aren't matching so there's some vulnerabilities built into the human side of the equation, which is building out and obviously the data center going gen AI, a lot more supercomputing's coming in, so a lot of change going on in the tech stack. Where's the process side? Do you see that piece impacting you guys at all ahead of it, or are you entering into that with your platform?

Chris Boehm

>> That's a good question. The data problem was a challenge for SentinelOne about four or five years ago, we acquired a company ourselves. It was actually a founder Google product called Dataset at that time, or Scalyr I think is the original name. We leveraged, we bought that product because we were the number one provider of that product, and now we offer that as customers at scale. You can actually leverage the same solution we offer on our backend to do mass-scale query algorithms. You can have 200,000 endpoints and ask 50 terabytes a day, get answers back in seconds. It's quite incredible how fast it is because we're leveraging cloud workloads. Someone's asked me-

Savannah Peterson

>> That is fast.

Chris Boehm

>> It's fast.

Savannah Peterson

>> I just want to sit in that for a minute. You just dropped quite a data point there.

Chris Boehm

>> It is very fast, and not to mention we're leveraging because we can leverage the cloud-native infrastructure itself. Now the challenge is everyone going in that direction? No. Some people want to go backwards a little bit. They are a little hesitant to keep adopting the cloud workloads. They want to pull back some of the reins and have more control over their infrastructure, more control over their data. Not every customer, even on the federal side is not the same. Everyone wants to go cloud first, but at the same time they're like, "Not this stuff over here." This is our proprietary information that needs to be shared out. You talk to a research firm, they're not going to have the research that's accessible in the cloud and easily leveraged or could be potentially compromised. That multi-million dollar research, they don't want that shared out, so it makes sense.

Savannah Peterson

>> Yeah.

>> Yeah, a lot of on-premise activity too with the GPUs, a lot more clusters beyond on-prem.

Chris Boehm

>> Very much so. We have that as our consideration, but our mapping is really the cloud workload because it's easy scalability. We still work with on-prem customers and we solve some of those challenges, but I would say growth is still going toward the cloud across the whole market.

Savannah Peterson

>> That's really interesting to think about, I'm actually really glad you brought that up. I'm curious, you get to see a lot of things you were, and I'm using my own words, you were a little early, which is why you're perfectly timed now as a solution in terms of behavioral AI for example, and I can see why people were tepid a decade ago, six years ago to be embarking on this investment and whatnot. So much hype around AI right now, what do you think is the most overhyped part of AI in cybersecurity?

Chris Boehm

>> The overhyped part?

Savannah Peterson

>> Yeah.

Chris Boehm

>> Actually, I'm in a product. I mean, it's true. I always say everyone, I think I did a research, I think 19 out of 20 companies say they have AI capabilities today. Ask them to show it. At what level are they leveraging generative AI? Are they actually using behavioral AI? Is it a cloud-based behavioral AI, or is it an agent-based? Or you start breaking it down. You're like, "Well, yeah, everyone technically has AI." I won't say the company, it was a manufacturing company. They're like, "We've had AI for 10 years." I'm like, "I've never thought about your product from an AI perspective." That's phenomenal that you say you have AI now, but it is a term that everyone says they have. So I always say the overhyped part is do they actually have AI and look into it.

Savannah Peterson

>> Is it real?

Chris Boehm

>> Is it real? Yeah.

>> Well, semi-autonomous is now hitting the scene, still not there yet. Autonomous is the dream. There we go. That's the north star, but clearly not there. To your point, where are we on that progress bar? Are we in a toe in the water with semi-autonomous? You guys obviously showing a great product. The value there is clear. Where does it go next? What's the progression?

Chris Boehm

>> Yeah, so that's a great question. I did not expect that question. So autonomous security, I actually, the way I looked at it, if you guys are familiar with the car automatic driving right now, so you have the assisted braking capabilities. You're like, "Okay, that's assisting my driving. That's automatic." Then you have the lane correction, and then all of a sudden now the lane assist, traffic jam assist. Oh, now it's driving for me, it's looking around me mapping everything out, and then now I really wanted to Waymo, if you want to think of one for a second, now it's capturing everything as cameras and doing most of the work for me, and it's driverless. Then what's the next level? There's another level above that I can drive from Miami to Vancouver, it determines every scenario for me and it's perfect. It's not there. That's the goal, right? For the cars driving. Cyber security is going in the same direction right now. They're leveraging multiple different levels of ML, AI, behavioral generative AI on making it potentially as automatic as possible to enable organizations. For example, us, we are enabling an analyst. We're steering them in the right direction. Like I was saying, keeping them in the lane. Okay, well, you're looking at the information, you're bringing it back to what's relevant, but what's next is what if I start doing investigation capabilities for you and I can show you what I investigated and provide you that analysis? Oh, well, you know what? I noticed you're connected to these other data sources. You should maybe take these actions and connect it. And now we can not only help the analysts understand what's going on, but guide them in the right direction, and build it out through AI capabilities, or I should say generative AI functionality. And then it could even keep going further to the right where it's starting to do things automatically for you. Imagine an incident written out, done for you, collected and said, "Actually, we can confirm this is benign or real," and it goes through most of it to your comfort level and it based on whatever policy and configurations, I can easily see that happening in the near future.

>> You guys got the Purple AI, which is good beachhead, but then incremental improvement you see as the way.

Chris Boehm

>> Yes, yeah. It's going to keep growing. Generative AI, the natural learning language is what you're usually seeing at this moment in time of just saying, "I have a question. What is going on?" It's going to keep growing. Now, every company is at their own maturity level. I always say SentinelOne, we are very ambitious. We jumped on it right away. We've been working on it for almost two years now.

>> You guys have been pioneering with the data side of it, which is awesome, congratulations, big fan of what you guys do, what Ric Smith and the team are doing over there, how does that expand? Because data's going to be fed in generative AI. I call it taking your kid to school. The progression is I'm in school and I learn, and then I reason from what I learn, I infer. So with training, inference reinforced learning is the progression of AI. What's that look like in cyber? You got Purple, you guys have trained data. You're inferring from it, you're applying it. Where's that reinforcement data set coming from? Do you see other new data sources? Can you share, or is it confidential, or what can we expect from an aperture standpoint or data sourcing?

Chris Boehm

>> That's another great question, because depending on who you talk to, they all want something different. This becomes into the OS model. Well, I want the following for this to do the following. For example, a partner may want to influence that LLM model based on what they're offering. Imagine if Google's like, "I would like to influence what your answers are based on the following solutions," because it's more tailored to you.

Savannah Peterson

>> Right.

Chris Boehm

>> That's one angle you can look at. Another angle you can look at is, okay, we're leveraging what's allowed for us to access based on privileges, and then we can make, influence decisions. That's another direction that can go based on the connection. That's almost like the concept of XDR that's actually being implemented I would argue, where you're calling AI integration the communication. There's a few different ways that custom companies can look at it. I do know how we're going about it, I'm not going to share, but I can say that we are. It is something that we concentrated on.

>> Yeah, it's a secret sauce. There's still the sauce right in theCUBE.

Savannah Peterson

>> We love a little sauce. We don't mind doing sauce, but kidding. Last question for you, Chris, because this has been exciting, time flew by. When we have you on at mWISE, or it could be Blackout or anywhere else since we're SentinelOne fans, when we have you on next, what would you like to be able to say then that you can't yet say today, outside of revealing the secret sauce?

Chris Boehm

>> Yeah, I mean, the thing that I like about SentinelOne, and so far since I've been here, I'm pretty proud of everything that we've been launching. We're definitely thinking about the next thing that customers are asking for. We are a partner obsessed, customer obsessed company, and it's really proud to say, "Look at the problem we're solving," and if you keep doing that, you're doing the right thing. That's what I think. So hopefully I can tell you here's a problem that we solved, and that's the next thing I could talk about. That's usually the direction I like to go.

>> Nice.

Savannah Peterson

>> Well, we love it, Chris. Please keep solving problems, and sharing with us as much as you can.

Chris Boehm

>> Of course.

Savannah Peterson

>> It is fabulous. John, thank you so much.

>> Yeah.

Savannah Peterson

>> Yet another great segment here. Thank all of you for tuning in to our dozens of segments here at mWISE in Denver, Colorado. My name's Savannah Peterson, you're watching theCUBE, the leading source for cybersecurity news.