Cyber Resiliency Summit Encore Presentation | Perry Carpenter, KnowBe4

Clips
News
More from Cyber Resiliency Summit Encore Presentation

Perry Carpenter

Chief Human Risk Management Strategist

KnowBe4

Cracking the code of human risk in cybersecurity

Even as cybersecurity becomes ever more high-tech, KnowBe4 Inc. knows that companies cannot stay completely secure unless all the humans are on board as well.About 70 to 90 percent of data breaches come down to some level of human involvement, according to Perry Carpenter (pictured), chief human risk management strategist at KnowBe4, which helps organizations reinforce their human firewall and build a stronger security culture.“To really make a difference with all the data breaches that we’re seeing, awareness is not and it has never been enough,” he said

play_circle_outline Transforming Security Awareness: The Crucial Role of Human Risk Management in Cybersecurity

play_circle_outline Integration of AI in both attack and defense strategies

play_circle_outline Technology as helper and attacker in security

play_circle_outline Need for programmatic approach in security

play_circle_outline Human element critical in defense against data breaches

play_circle_outline Revolutionizing Cybersecurity: Enhancing Behavior Change Through Human-Centric Security Awareness Programs

Info
Transcript

Perry Carpenter, KnowBe4

Perry Carpenter

Chief Human Risk Management Strategist KnowBe4

The conversation at the Cyber Resiliency Summit continues as theCUBE Research's Christophe Bertrand talks with Perry Carpenter, chief human risk management strategist at KnowBe4. Carpenter emphasizes the need for a shift in focus from awareness to human risk management in addressing data breaches. While technology is important, it is not enough to protect against human vulnerabilities, he added. KnowBe4 takes a three-pronged approach with outreach, training and simulations and a focus on individualized, adaptive learning tailored to each person.

Find o... Read more

explore Keep Exploring

What is the importance of the Chief Human Risk Management Strategist title in the context of security awareness and data breaches? add

What are some positive uses of artificial intelligence in cybersecurity, specifically in terms of defense agents and generative AI, as exemplified by KnowBe4's program? add

What is the speaker's opinion on using technology as a helper in security measures and the importance of considering ROI in security investments? add

What is the misconception in the security field regarding technology's ability to prevent data breaches despite advancements in security technologies? add

What is required for an effective defense strategy against attackers? add

What is the key to effectively addressing data breaches and improving security measures? add

bolt Powered by CUBE AI

Perry Carpenter, KnowBe4

search

Christophe Bertrand

>> Welcome back to our continuing coverage of the Cyber Resiliency Summit from theCUBE. My name is Christophe Bertrand, Principal Analyst here. I'm focused on cyber resiliency and I work for theCUBE Research. I'm very pleased today to be joined by Perry Carpenter, who has a great title, Chief Human Risk Management Strategist. I had to look at my notes because that's the first time I've ever seen such a great title, but it means quite a bit. And you work for KnowBe4. So Perry, if you could tell us a little bit about yourself, obviously about KnowBe4. It's a great company name with a great history, which is very interesting. But also, tell us about your title. Tell us about what you do.

Perry Carpenter

>> Yeah, so KnowBe4 is a very well known brand in traditionally what was called the security awareness space. And so, that was all about understanding where the major focus for all the breaches tends to happen. It tends to happen at the human layer. And what the industry and what the discipline of security ended up training CISOs to do was to equate awareness with reduction of risk. And that gets into the second part of your question, which is, why a title like Chief Human Risk Management Strategist? And that is because there's been a reckoning and it's been a long time coming. And people like me and others in the industry have been championing this for a long time. Is that to really make a difference with all the data breaches that we're seeing, awareness is not and it has never been enough, and will never be enough. Awareness just means you've told somebody about something. But anybody who has been on this planet for more than five minutes knows that if I just tell you something and you don't care, you're not going to follow through. Or if I just tell you something, and even if you do care, you might not follow through. I mean, we're just a few weeks after the new year right now, and how many people that are good, well- intentioned people have already forgotten or discarded all of their New Year's resolutions? They had good intention, they knew the right thing to do, and life just takes over. Same thing with awareness. There's always something within human nature that will take over. And so, human risk management is all about understanding human nature at its core, and building programs and even technology-based guardrails and measurement systems that understand humanity at its core, and work with human nature rather than against it.

Christophe Bertrand

>> And that's a big program right there. It's a big task. And you think about it, I mean if you're a cyber attacker, you can try a brute force, passcode, password attack. And that's going to be very hard to do, candidly, and it's not going to necessarily yield a lot of value. Whereas going after the human very likely, will work pretty easily. And we'll talk about some of the literally technologies, especially with AI that are available now for attackers. And it's likely going to bring quite a bit in terms of value, whether it's IP or just conning someone into giving a bank account or transferring money for a fake invoice or so many dimensions to this. But what I like about what you said, Perry, is this, is that during this summit we've been talking quite a bit around technology that protects the environment, the infrastructure, the data. But really at the end of the day, it's also about people and processes. And here, we're going to be talking a lot more about people. So, it's not just awareness, it's not just behavior, it's really about a broader picture. So if you think about what you bring to the table, let's say watching this, I'm an end user here, I'm watching this segment. In my company, what does that mean for me as a leader for IT or leader for security, what does it mean for my company to be working with KnowBe4? What do you do that's going to be different that will help better train literally, and create better behaviors or repeatable outcomes from the humans in the organization so that I can make my organization more resilient?

Perry Carpenter

>> The first thing to realize is that security is a technocentric domain. So we live, eat, and breathe technology. And we typically believe that the thing that will either hurt us or the thing that will save us is technology. And what we've seen over and over and over for the past several decades, is that that assumption is fundamentally flawed. When you look at the Verizon Data Breach Investigation Report and all the other reports that come out every year, what we see consistently is that 70 to 90% of data breaches come down to some kind of human level involvement. And so, awareness or things like that are part of the answer. Now, before I get into what the fullness of the answer is, I think we need to dismiss something. And that is the fact that because we live in a technocentric world and live in a technocentric discipline, we typically put all of our faith and hope in technology to save us. And you can go to the show floor at any major conference and you see people selling black boxes that claim to solve this issue. And for decades, we've seen that those will fall short, because still, year after year after year, the human is the thing that data breaches get tracked back to. And so, what we have to realize is that technology, yes, may be part of the answer, but we do have to work at behavior. We have to think about culture, we have to think about social pressures, social dynamics. We have to think about where learning comes in, the right frequencies of that, what people will remember, what they typically forget. There's a lot of components in that. There's a lot of measurement that has to happen. There's a lot of understanding of what your fundamental risks are that have to happen. And then you have to build programs that address those fundamental human-based risks, have the right metrics, have the right technology- based supports, and really carries you in the direction that is going to result in less chance of a data breach. And that's really where KnowBe4 is going, where the market is going as well. And of course, what that means is there needs to be a reckoning within the market that we don't just talk about awareness, we talk about the fundamentals of what it is to manage human risk.

Christophe Bertrand

>> And let's talk about some of the programmatic aspects because there's quite a bit of a methodology behind this. I mean, if I understand it correctly, KnowBe4 really has a sort of a three-pronged approach here. There's outreach, which is obviously we want to outreach to the humans, the people involved here, training and simulations. And yeah, we've all taken the trainings and I have too. And you're right, I mean I'll probably forget about it in the next five minutes. But more importantly, I think combining that with that individualized sort of adaptive management at the individual level really is really what makes up a strong program. Can you walk us through this? And then I'd like to talk after that about the next level in human risk management. But let's start with the program, and what are those elements? What are those components programmatically?

Perry Carpenter

>> Yeah, so really about, it was like 12 years ago or so, back even before I was at Gartner, I put out a statement at one of the companies that I was at, and then carried that through at Gartner Research when I was there, is that the next stage of security awareness is real-time and adaptive context aware, and really understands the learner at an individual level. And I think that carries through in these three circles that I put together, which is a circle at the very top is outreach. That is one to many communication. That's very much like the traditional security awareness. It is sending out a video, putting out a newsletter. It is me talking to a mass crowd. And then you get into something that's a little bit more nuanced. You get into training and simulations. And the fundamental thing about training and simulations is that it is participatory. It is working with something to see what your response is like. It puts you in a situation and you respond. Something like simulated phishing tests are a very good example of that. But a tabletop exercise could be an augmented or virtual reality game, could be. There's lots of things that are in that participatory bucket. And then the last one is where the market is really headed and all of these are part of it, but this is that real-time adaptive, learner-dependent, or learner-aware bucket where you're always doing something that is very individual, very targeted. Just based at the right time, for the right reason, on the right system, through the right channel. The cascading rightness that happens that's extremely targeted, that goes just to you or me, giving me what I need at the right time. And that is the fundamental thing that I think really pivots into where HRM+ is going to take us.

Christophe Bertrand

>> So, you've just mentioned HRM+. I'd like to double-click on that. And I think what I'm hearing, and I think the message here for viewers is very simple. One size doesn't fit all, it's not just a checkbox, it's an active individualized process that I assume is continuous or at least extremely frequent. That focuses on content, focuses on experiences, it focuses on relationships, and those are actually very key. So now, okay, we talked about human risk management, sort of the general definition, your view of it, and how you implement it. So, what is HRM+? What are you adding that's changing the definition a little bit here?

Perry Carpenter

>> Yeah, let me go back for just a second 'cause you mentioned content experiences and relationships. Those are really key because within each of those three bubbles, all of those three are present too. Everything is delivering content, whether that's one to many, whether that's a training simulation like the simulated phishing template is a piece of content, the landing page is a piece of content. That will then deliver an experience that somebody has, an emotion, a positive, negative or participatory with that. And then everything that we do will either build, maintain, or erode that relationship component. And the one thing that we really, really want to get as a security team is for people to trust the security team, people to see the security team as a point of refuge. When they have a question, when they have a concern, they go there. When they have something that they want to report, they click the right button at the right time that lets orchestration take over and so on. So, all of that is really key. And where the plus in HRM+ comes in is like you mentioned, continuous. Like you alluded to also, automated adaptive, which means that artificial intelligence and machine learning and all the other fun buzzwords that we like to use all the time start to come into that as well. It also means that it is aware and integrated with, aware of and integrated with other pieces of the security stack and IT stack out there. So, that would be API calls into different pieces of your infrastructure like CrowdStrike and awareness of different logging patterns that are happening coming in from your DLP system or your endpoint protection platforms and so on. And then intervening, going out to the end user based on what is being seen. Is there a behavior that needs to be modified? Is there something that's concerning or should I alert the admin of something so that they can make a policy change based on a behavior that we're seeing?

Christophe Bertrand

>> Right. So you mentioned behavior, but the truth is that the idea of what you're delivering is not to try to scare people or punish them. You're trying to just make humans better, when it comes to security. I think that's really the idea. Because I've certainly, just like a lot of people, have been through those training programs, and sometimes it feels like you're being judged. That's not the idea. The idea is to naturally build those sort of mechanisms and good reflexes, the muscle memory of what security is. And I like the fact you're mentioning integration into the other components of the technology stack that are maybe more traditional, but at the end of the day, can't work without the humans themselves. So, let's talk a little bit about the impact of AI, which is of course the elephant in the room. We've seen a lot of deepfakes, it's been an election year. There's a lot of social media stuff going on with deepfakes. What's going on with AI? What is your perspective on AI as a tool for the attackers, which I think is the first side of that imperial coin? And then the other side of it is, well, do you leverage AI yourself maybe through some automation, you mentioned that agentic AI, to help better train humans to be better with security?

Perry Carpenter

>> Yeah, so like you mentioned, AI is a double-sided coin. So everything, every tool that gets created has two uses. One is you can either build something up and do something constructive with it, or you can use that tool to tear something down. Every tool will mold to the hands and the intentions of the person who wields that tool, and AI is no different. The interesting thing about AI is it can take all of the different scams that we've used against other humans throughout history and it can do that. It can help somebody execute that scam with greater precision and at greater scale than ever before. So, there's not really anything new. The newness is the ease of use and the ability to target even more individually than ever before. The other thing though, there was an interesting study out of Harvard a while back that showed that when you give somebody who has very little skill, an AI tool, overnight, they can perform at the level of somebody who is highly skilled. And somebody who's highly skilled gets a little bit of improvement as well. But when it comes to cyber crime, I mean think about that. Now your a mildly curious type of person, your a person who just wants to try something, or the person who's on the other side of the globe that doesn't speak the language, that doesn't understand culture, can now use a tool. And they can speak very good whatever language they're targeting. They have very good ways of building out their scam, launching their scam, making that individual, having the right emotional hooks, and everything else. They can all of a sudden, overnight perform at the level of somebody who has been doing that devious job. Whether that's scamming people or trying to make people believe something weird like disinformation or so. They can do that like somebody who's been doing it for decades. And that's the difference. On the positive side, of course there's good uses for AI as well. And KnowBe4 is doing a lot of really good stuff there. We have a program, a set of what we call artificial intelligence defense agents. And we've been doing AI since back in 2017. And of course, generative AI, which is what we've all been hearing about since that ChatGPT moment at the end of 2022, that just increases the effectiveness. We have things like generative AI based templates. We have AI based targeting for training that is individualized to users. We have it to where you can upload your own policies and quiz people on the policies using generative AI systems. And created question sets and scenarios that they can place the learner in. Lots and lots of work being used to do positive things with AI as well.

Christophe Bertrand

>> I want to come back to the use of gen AI from the attacker standpoint. Because what you're saying, and I know the numbers are very interesting, even the top performers before the use of gen AI, get even better once they start using gen AI for attack purposes or scamming purposes. So, that's a big issue. There's no question about that. I think what I'm hearing is there's literally been almost like a democratization of scamming. And certainly we've seen ransomware as a service, we've seen all sorts of things out there. But this gen AI piece to try to deceive, again, that very prized target that we all are individuals. We are the target, let's not kid ourselves. With very little effort, lots of potential reward. That's who you want to go for. I think that's a very important point that I really want our viewers to remember. As much as we can put in place great techniques and technologies to protect the IT infrastructure, the perimeter, et cetera, your employees, yourselves have to also be protected in that way. Now, I'd like to go back to the second part of your comment here on KnowBe4 actually uses AI. And I like the fact that you're literally now empowering both the individuals and the people managing the programs with agents. So, is agentic AI in the context of what you do, really where you're going to keep investing? Are there other initiatives around AI that maybe you can allude to that our viewers should be aware of?

Perry Carpenter

>> Yeah. So we've been all in with AI since 2017, like I mentioned, when it was more machine learning and algorithm based. And generative AI just increases that. So when it comes to agentic AI, that is really, really interesting to us. And so we are releasing agent after agent after agent, as we move forward. We released the first four of these new agents just several weeks ago, right now. And throughout 2025, we're releasing more. It's going to ultimately culminate in agents that can be orchestrated and directed in different directions to really go to this goal that we've been talking about all along, which is very highly targeted, individual, context-based, adaptive learning and protection. And I think we have to think about both of those, right? So there's the learning piece, which is a preventative piece where you're equipping the person to do better as their own defensive agent, a human as their own defensive agent. And then you're also doing things with agents that are protecting that individual. And I think that the way that these purposes swirl around each other create a lot of interesting opportunities for vendors like us. And a lot of interesting opportunities at that orchestration layer. And then as we get into 2026, so we're talking a long way now, what we're going to be really focusing on is adaptive learning. That is all about really helping the organization target the parts of a learner where they are naturally a little bit more deficient. Where they might just need a little bit more help, a little bit more reinforcement. But then with the end goal of saving the organization time for that end user. Because lots of people are worried about ROI for everything. They know that any minute, any second that an end user is spending time on training that that needs to pay off in some way. And so, we're going to be very intelligent about the way that these agents assign training when they assign that, when the learner is going to be at their peak for both learning. But then also not working against the rest of their schedule. A ton of other things that are going to be going into that as well.

Christophe Bertrand

>> This is a fascinating topic. And I think what's interesting here, I mean you're focused on humans, yet you can see technology is really the helper here. Of course, we know it's the attacker as well, but really, it's using it as a helper. I think what you've just described is I think definitely the future. And I look forward to hearing more about it in the next few quarters, as you build up the agentic framework. And also this ROI question. To me in a sense, security should be a no-brainer. But you're right, every investment requires ROI. Look, there's also a tendency out there to block and tackle. Do we really need to invest all of this? Couldn't we just use technologies to block and tackle and solve for these issues? What's your take? Is that a valid approach, or isn't the programmatic approach a little better?

Perry Carpenter

>> I think that there's both, but I think as... We in the security field, we really like lights that blink. We're technologists at heart, and so we want to buy technology and throw it at the problem. What we've seen over decades is that that is a false hope, because we have really good firewalls. We have really good endpoint detection and prevention software. We have really good application sandboxing. We're good at network segmentation and everything else. Yet, a human action can still cause a data breach. So despite the fact that every technology vendor and all these layers of technology exist, and we keep saying over and over and over again, that technology will be the thing that saves us, we've seen that that is not true. Humans are always more crafty. The attacker is going to be more crafty. They're going to find a way around that. The person on the other end who's just trying to do their job may make a mistake and just fall through all those layers. Or they may be malicious and work through all those layers because they see the path through. But it has to be programmatic and it has to be a combination. This is not an either or discussion. It's not either technology or humans. It has to be humans as a critical layer of defense along with other technology-based layers.

Christophe Bertrand

>> Look, we've covered a lot of ground, and I'd love to maybe ask you for a closing thought. What should people do after watching this segment? What do you recommend they do? What should they think about? Is there a conversation they should be having with their bosses? What's your take?

Perry Carpenter

>> I think the thing that I would come back to over and over and over again, would be if we're honest with ourselves and we look at the reason that data breaches are happening. And then we look at the thing that we're spending money on year after year, when it comes to security, we have to conclude that what we're doing has been ineffective. And if people out there are running a program for security awareness that has just been lip service of getting butts in seats or eyeballs on screens, that is not going to change anything either. That's just checking a compliance box. The real work, whether you call it security awareness, or whether you call it human risk management, or whether you call it security culture program management, or whatever term you put to it, has to understand what human nature is, and work with human nature rather than against it. And that's always going to be programmatic and it's going to be human aware. And there's going to be, of course, technology with that, but technology will not be the thing that saves the day.

Christophe Bertrand

>> Perry, thank you so much for your time. This has been fascinating. I think yes, there's work ahead, but there's hope too. And there are some great tools and I very much look forward to see what KnowBe4 will be doing in the next few quarters with all the great investments, the great programs you have, and of course all of these years of experience. Perry, thank you very much for your time.

Perry Carpenter

>> Yeah, thank you so much.

Christophe Bertrand

>> And to our viewers, stay tuned for more in the Cyber Resiliency Summit from theCUBE. My name is Christophe Bertrand, Principal Analyst here at theCUBE Research. Stay tuned.