マシンスピードの脅威にセキュリティ責任者はどう対応するか――MassMutual Sridhar Boddula 氏

Welcome, everyone, to the Emerge AI in Business podcast. Today's guest is Sridhar Boudina, Head of Security Platform Engineering at MassMutual. Sridhar discusses how the cost and skill required to mount a credible cyber attack have collapsed, driven by widely accessible AI tools that let low-skill actors run convincing automated campaigns. He explains why adding more tools or more analysts isn't enough on its own and what it actually takes for a security team to shift from periodic testing to continuous validation built for machine speed threats. Today's episode is sponsored by Expo. A quick note for our audience that the Views and Opinions Express site-feder on today's program are his own and do not suspect those of math mutual or its leadership. According to Nielsen, 91% of podcast listening happens alone, indicating deep, undistracted attention, ideal for complex B2B messaging.

To learn how leading brands and AI startups connect with enterprise AI buyer audiences at scale, download our media clips at emerge.com.ad1. That's E-M-E-R-J.com.ad1. Now the conversation with Frida. Shida, welcome to the Emerge AI in Business Podcast. Thank you, Alindi. Thanks for having me. Yeah, very interesting conversation today. And I've been really thinking about how strange it is that the barrier to being dangerous has basically just completely disappeared. It used to take real skill and time to threaten an organization. And now it sounds like it's, you know, you can basically just go and rent AI for a while.

And it's going to cost you less than your dinner bowl will and start probing for weaknesses and start becoming dangerous. And I want to start with what that shift actually feels like from where you sit. How would you describe the way the threat landscape has shifted for security teams like yours over the past year or two? Great place to start because I don't think a shift fully captures how quickly the environment has changed. So in more than 20 years in technology, especially in cybersecurity, I've seen major transitions, transitions, you know, from perimeter security to cloud, from individual hackers to organized ransomware, and from, you know, lighter oversight to frameworks and regulatory, such as in New York DFS, the European regulation DORA, and SEC regulation special publication. Now, those changes were significant, but organizations could see them coming and plan for them. You know, the past

two years feel different because the economics of attack have changed. Now, attackers still want, their motto did not change, right? Attackers still want, you know, money, they want data, and they want to gain access. But the expertise and cost required to pursue those goals have fallen significantly. So, you know, historically, you know, a sophisticated attack against any, you know, a reputed institution required skilled people who understood the environment, you know, wrote custom code, created the pretext, and operated quietly. So that expertise was like at a large, which limited the number of number and pace of serious attacks. So in today's world, that skill barrier has largely collapsed. So especially with, you know, the AI enablement and advancements in the AI, You know, AI-enabled probing, automated phishing kits, voice and video synthesis, and code assist tools can turn, you know, plain language instructions into credible attack campaigns.

So, capabilities that once required deep expertise and a substantial budget and money are now inexpensive and widely accessible. So a low-skill actor can create a convincing phishing campaign, you know, clone an executive voice and generate expiry code. So, you know, the threat is not simply that attackers become smarter. It is the fact that it is that far more people can now behave like sophisticated attackers or adversaries. So we have moved from defending against a relatively small number of highly capable actors to facing a much larger population equipped with automation that amplifies reach and speed. For regulated industries, the stakes are especially high. You know, we operate under obligations such as, you know, European regulations or Asia PAC or the, you know, US financial regulations.

A breach is not just a technology incident. So nowadays, you know, it can trigger regulatory scrutiny, disclosure requirements, legal exposure, and lasting reputational damage. So the final shift is the combination of speed and scale One actor can now test the same technique against hundreds of organizations at almost no additional cost Much of that activity is broad and automated The tool they use probe widely, you know, identifies softer targets and then escalates successful attempts quickly. So that creates, you know, far more noise at the perimeter with a smaller number of dangerous signals are hidden inside it. So one in one sentence, the barriers and cost of launching a capable attack fall in sharply, while the consequences of the one successful attack remains extremely high.

And under tighter regulation, maybe even higher, that widening asymmetry is the defining feature of today's threat landscape. And it sounds like the threat is real. And whenever something feels this real and this dangerous and, you know, a lot is at stake, I always wonder, did we predict it? Is it even possible or was it possible to predict it? So has this changed a lot in the last few months or has it been building up for a while and it just exploded? I think it was kind of bubbling up in the last especially two years. But in the last six months, it's kind of exploded, became a reality, especially with you know some of the AI companies you know I do not want to put any company's name in this conversation but you know with the you know advent of the franchise AI models you know those models have you know capability of you know attacking enable like you know just you know spin off the number of requests bombard the companies with the cybercrase so that has changed significantly

in the last, I would say, six months since April of this year. That's where, like, you know, people, just $50, they can buy a model and then they can attack a number of companies at the same speed simultaneously. They don't need an army of people to do that, and they don't need a huge money to do that. That has changed in the last six months. Before we get to talk about the solution for this, the scariest thing is I had a guest on the other day that told me about this event where a few hundred agents escaped out of their sandbox and all for evil. And then they were even trying to recruit other agents. Mind going, so it's not even just being aware and building your security for humans. It's also building your security for the agents that go rogue, apparently. And I think one thing that I keep coming back to when we have these types of conversations and brainstorming about these ideas is the speed problem. And I think you also brought that up now in a very nice way.

The teams used to test for weaknesses in their processes, in their technology, every now and again. Let's say once every quarter, maybe once every six months for some of these teams. And that obviously is not going to cut it anymore. They're going to need something that never stops. That's just from what I hear. So I'm curious, what actually has to change inside the team for this to even be possible? Is there a new capability, a different way of working? Is it something else entirely? That's a great question, Yolande. This is one of the questions I think about most of my day job as a head of security engineering here at MassMetual. The easy answer is not about buying other tools, another platform, or buying other detection tools. No, tooling matters, especially as teams evolve and evaluate the cloud native protection, the software supply chain security and identity controls for AI agents that can hold credentials and act on production systems.

But, you know, tooling is only part of the answer. The larger change is how the team operates, how often it tests itself, how quickly it makes the decisions, and whether it's, you know, workflows or engineered for speed rather than, you know, built around manual handoffs. So, first, I would suggest organizations to review their testing cadence. Now, their testing cadence has to change. you know annual or semi-annual pen testing or their exercises made sense when threats evolved more slowly but now you know those kind of you know semi-annual or annual cadence they are inadequate when a new a enabled credential attack can emerge in matter of weeks or could be matter of four days given that you know as we were talking you know now it's not humans are doing the attack it's actually the agents or the software robots are doing the attacks so now

security teams need more frequent exercises built around current scenarios for example like you know synthetic voice used to influence a help disk followed by compromise of a dormant service account and escalation through an identity provider so the best way to know whether an operating model works is to test it deliberately before an attacker does so second one is the operating model must move beyond the traditional you know gatekeeper approach now security cannot remain a review queue that slows down change while attackers operating hours it has to become an embedded engineering native function so that means you know security engineers are working you know alongside or inside DevOps or DevSecOps pipelines you know expressing policy as code and building automated guardrails that cache you know these type of issues or these type of risks when they are introduced

So it also means moving identity from static approval to continuous, you know, zero trust evaluation. a well-designed derotorist model assumes compromise is possible and it limits its blast radius by design rather than relying on every attack being stopped at the perimeter. The third one, I would say, you know, teams must be built differently, not simply, okay, now AI threats are increased or we need to go and hire more people. That doesn't work. When attackers automate, adding, you know, additional analysts is not going to help, you know, because those people, they will still do the manual process. And all they do is just that they just simply generate more alerts rather than, you know, automation engineering should be core security discipline. Finding should arrive within a prioritized context and, you know, proposed remediation path, allowing engineers to act quickly instead of waiting in a ticket queue.

And the objective is to engineer the workflow, not just add more people to it. So the answer is a threefold. You know, test continuously against current techniques more frequently. Maybe, you know, every day you test your security controls, make sure there's no gaps introduced with AI threats. And embedded security engineering into the development. That's basically security by design. And automate your process, not by hiring more people. That's how I would handle and that's what my suggestion, how to handle these new threats. That makes sense. So I'm thinking if we're going to do continuous validation, I'm sure that the noise will also be more. How do you personally decide when a finding is a real risk or just noise? Well, that's a great point. You know, organizations just identifying the risk is not going to help, right? You know, organizations should have a solid remediation plan. And, you know, with the AI threats, there's going to be hundreds, thousands of zero-day vulnerabilities.

Like, how do you prioritize? How do you risk rank? So that's when next comes another, you know, you need to build, you know, AI-based or AI-automated vulnerability management or patch remediation. So first, to your point, they have to risk rank those findings. and the way how organizations should risk rank them is first organizations should have a appropriate inventory maybe that's like you know i'm going to cover that in the next question but you know first what are the high asset values for the company let's say you know if you're a e-commerce site any systems that involved in your purchase and sales or e-commerce those systems are critical so any vulnerabilities or any findings on those systems those are the super critical that's the priority whereas like you know hey there are a bunch of vulnerabilities that are an internal system where it's not exposed to the internet yeah those are critical

vulnerabilities but priority can be low so that's how they should prioritize and enable automated patching and validation capabilities. That's interesting. I'm imagining now with obviously me not being as high level as you, but imagining that we're basically going to build something like a spam folder for the noise that's just noise when I think about your priority list. So I like that idea. The great part about this conversation is we're not leaving our listeners with just the conversation. We are also giving them a bit of guidance and a bit of a playbook as to what they should do next. So for other security leaders in regulated industries, which are so sensitive, and not only do we need to think about security and privacy, but also regulations and fines and everything that can come with it, where is the first real step towards being ready for that kind of speed, making sure that we are at the same level as the attackers? So the first real step is the practical governance,

not in another policy document. Now, leaders need to know what sensitive data they hold and which regulatory obligation apply to it, where it resides and how the data is being processed and who is accountable for protecting it. You know, in a regulated financial services, that might include the SEC regulation or any other European regulations or the New York Department of Finance regulations or it could be there's local state requirements. So if an organization cannot quickly identify which systems hold regulated data and which rules they have to apply, then every security investment rests on uncertain foundation. Now, data classification and regulatory mapping should be treated as a near-term priority, not a multi-year exercise. So the next step is to expose visibility gaps, especially, you know, around the identity.

Now, that is where risk often hides. You know, as I mentioned, dormant service accounts, you know, over-permission roles, unmanaged API keys you know having a you know the long or standing admin access and third integrations and the contract access So this is all the matters And now, the important part is not just to document the findings, but, you know, decommissioning, reducing, or governing the access that creates unnecessary exposure. The third step is to, you know, examine the team model. the answer is not automatically as I mentioned like you know don't don't bring too many vendor tools that's not gonna help come up with your inventory you know one of the basic principle in the cyber security is if you don't know what you have you cannot protect have a right inventory of all of your digital assets including your you know applications platform whether it's a

SaaS or managed including your hardware assets as well you know all the your switches routers make sure you have a full inventory that's part of the governance and then risk rank them what are the high risk assets and just focus on them and finally you know leaders often have reasonable reasons to wait you know an audit a budget cycle or evolving air regulation but you know the bad actors they do not pursue while organizations seek certainty and imperfect control operating today creates more value than a perfect strategy that remains on paper if i were to leave listeners with one action immediately it would be this you know choose the system choose at least you know one system that holds your most sensitive regulated data and run a focused test on that one and see what are those findings and the last one as i mentioned you know don't wait for you know we

need to wait for 2027 our board review board approvals just do what you have pick one system and see what are the findings and put together action plan how you can fix it and then with that information you could you can go to your board or your management committee and get the approval for 2027, but don't wait for that one. So basically in a simple way, governance, right policies, and the right inventory, and take an action immediately rather than waiting on a big initiative or a budget approval. I think all of this makes sense, and our listeners will, as they hear you say this, they'll take this off in their heads and be like, yes, this should be added to the agenda, definitely. And I think our overall message before we wrap it up for our audience is just that we need to rethink security because in the past, our attackers were human and we were able to combat that or defend with human capabilities. But our attackers are no longer just human. So we can no

longer just use the human defense force. We need things like validation, continuous validation, continuous security checks and pain tests. It's no longer a annual or biannual or quarterly event. It is an everyday 24-7 event that needs to continuously happen because I think something that Shira just mentioned, he said, you know, expose the visibility gaps. The longer you wait, the bigger those gaps and the more gaps will exist. Those gaps will come in a very short instance. So there's more to think about and definitely a lot more that needs to be done. Shira, is that the correct overall message that we want to send to the audience members? Yeah, yeah, that's correct. And one last thing, just wanted to reiterate that, you know, every organization, everyone is going through the cost pressure. Even with the invention of this AI threat and AI risks, you are bored. They're not going to approve like, you know, 10 million to you. So you got to operate with a limited budget that you have and how smartly and how you empower your team with automated capabilities.

That's what I would say. You know, otherwise, if you ask millions of money, nobody is going to get that money in this age of world. Tridhar, thank you so much for joining us today. I'm excited to hopefully have you back on the show in the future. All right. Thank you, Randy. Thank you. It was nice talking with you, and thanks for having me on the show. Wrapping up today's episode, let's look at the three key takeaways from our conversation with Tridhar. First, the constant skill needed to launch a credible cyber attack has collapsed, putting real attack availability within reach of far more people. Second, tooling alone cannot fix the speed gap. Tasting cadence, decision-making, and team structure all have to move to a continuous engineering embedded model. And finally, the first real step toward readiness is practical governance, knowing what data you hold, where it lives, and who's accountable for it,

then acting on one system now rather than waiting for a bigger budget cycle. According to Nielsen, 91% of podcast listening happens alone, indicating deep, undistracted attention, ideal for complex B2B messaging. To learn how leading brands and AI startups connect with enterprise AI buyer audiences at scale, download our media kit at emerge.com.ad1. That's E-M-E-R-J.com.ad1. For further executive level analysis and to join our network of leaders delivering workflow impact with AI, visit emerge.com. On behalf of the team at Emerge, we'll see you on the next episode. Thank you.