Building the partner ecosystem with Sophos

0:08 I'm delighted to be joined by by JP and if Matt mentioned the post afternoon

0:14 post lunch slump I think of all people JP probably has the excuse to maybe

0:18 have a little bit of a slump uh having traveled from the east coast

0:23 at the start of the week to the west coast to arriving in London last night.

0:27 Yes.

0:28 Uh so please go easy on them.

0:30 Um with that JP would be great to introduce yourself to the audience

0:34 um and to tell us a little bit about Sophos please.

0:37 Hey everybody it's great to be with you here today.

0:40 I'm John Peterson.

0:41 I'm chief technology officer at Sophos.

0:43 And Sophos, for those of you that may not know us

0:46 we are one of the largest cyber security companies in the world.

0:49 We have about 650,000 customers that are spread across the you know

0:54 with a global footprint and they really

0:56 span every segment every sector and as such

1:00 we see a huge variety of different attacks and we've cultivated you know vast

1:06 expertise in combating them over four decades

1:08 of being in the cyber security business.

1:10 So it's great to be with you here today.

1:13 Thanks JP.

1:13 Yeah great to have you.

1:15 Sophos is a Daybreak partner and we're speaking

1:18 a lot today about the narrowing defenders window.

1:22 What does the defenders window mean for Sophos

1:25 um and how you protect your customers?

1:28 Yeah, that's great.

1:29 So, the we think of the defenders window in terms

1:32 of the the pace of acceleration in frontier intelligence.

1:36 So, the leading frontier models are

1:39 developing more and more sophisticated cyber capabilities.

1:42 those are working their way down into the openweight models as well

1:46 and that's driving you know a faster

1:48 exploitation paths more vulnerabilities we're seeing

1:51 that in the CVEes as well um just the level of CVS has

1:55 gone up massively in the last few years and so we think about it

1:59 in terms of we have an opportunity to take advantage of the frontier

2:03 um frontier intelligence through programs like Daybreak that allow us to stay

2:07 a step ahead of the attackers um and we we look at that in terms

2:11 of protecting ourselves at Sophos because as a large cyber security company,

2:15 we're obviously a target,

2:17 but we also have 650,000 customers who and it is our obligation to protect them.

2:22 So, we have an opportunity, I think,

2:24 with programs like Daybreak to stay a step ahead of the attacker community.

2:30 And I guess that protection takes a combination of technology and expertise.

2:36 So how do OpenAI, Sophos, and the customer each contribute to making

2:42 this essentially work for the entire ecosystem?

2:44 Yeah, that's that's a good question.

2:46 I think the way that I think about that is Sophos

2:50 is Sophos contain we have lots of cyber security domain experts, right?

2:53 We've been in the cyber security business a long time and we've, you know,

2:58 it's our business to protect our customers

3:00 and that that domain expertise takes a variety of forms.

3:04 So threat intelligence um you know

3:06 response playbooks when we're managing incidents

3:08 on behalf of customers um and also just the expertise of our people.

3:12 So I look at it as Sophos brings the domain expertise

3:17 and the knowhow to actually combat attacks at scale but then the programs like

3:23 Daybreak and companies like OpenAI bring

3:26 frontier intelligence that allow us to take

3:29 that domain expertise and then scale it to support all of our customers.

3:33 And that's what's been so powerful about

3:35 the program and what it's allowed us to build.

3:37 It's been fantastic to see that partnership go

3:40 from from strength to strength in recent months.

3:43 Absolutely.I guess we're joined by some of the leading

3:48 uh security leaders across EMEA here today.

3:51 Maybe let's give them a little bit more of a a practical example here.

3:56 um can you walk us through an example of how

3:59 a Daybreak powered agent helps your team investigate a threat?

4:03 Yep, absolutely.

4:04 So, I think the the place that I would start

4:07 in explaining that is by just explaining the Sophos Fusion system,

4:11 which is the system that powers the managed detection response

4:15 service at Sophos and all of our EDR and XDR products.

4:19 So these systems are built um leveraging sensor data from over 500

4:25 different integrations with third-party security products

4:27 but also our own products as well.

4:29 Those sensors are producing like trillions of events every day.

4:33 And those events get distilled down really

4:35 into a small set of about a thousand to 2,000

4:38 cases a day that are you know nine different

4:41 security operations centers are investigating on behalf of customers.

4:45 And so that process of taking a case,

4:49 conducting the investigation and then remediating whatever the threat is.

4:53 Historically that was driven primarily by human expertise.

4:56 And you know in the before time right that human expertise and the processes

5:02 that we built around it allowed us to have around a 38 minute average response

5:08 time for or average investigation time on those cases

5:11 which is you know at the time like 18 months ago that was better

5:15 than 96% of professional security operations centers.

5:18 But now because of the agents that we've

5:22 been able to build leveraging the Daybreak program,

5:25 the average response time for cases that are leveraging

5:29 the agents that we've built has reduced to about 89 seconds.

5:32 So that's about half of the cases that we handle are

5:37 now being automated by agents that we've developed using the Daybreak models.

5:42 And that's obviously that's been transformative in terms of the effort

5:47 that it takes for us to actually conduct those investigations,

5:50 but it also results in better customer outcomes.

5:53 And to to provide a little more

5:55 detail about how that actually works in practice,

5:58 we have these cases that come into the security operations team.

6:04 And the cases themselves are now handled primarily by a investigation agent

6:09 that we've developed that takes all of the information from the case.

6:14 Customer context detections, indicators of compromise, um you know,

6:19 knowledge of the um the the threat landscape.

6:21 And it feeds that into a planning model which then creates a kind

6:26 of plan execute um review loop

6:29 and goes through it creates an investigation plan,

6:32 conducts the investigation steps and then creates a summary

6:35 for the analysts to review and then a set

6:37 of recommended response actions and then we have agents

6:40 that we've built as well that handle some of the response.

6:42 But that's a little bit of background

6:44 and to how the whole thing actually functions.

6:46 And it's been transformative because it allows us to respond more quickly,

6:50 but it also gives customers broadly a more consistent outcome,

6:54 which is what we're really in the business of doing.

6:57 And I guess given that you're halving that time to response,

7:00 where where are those efforts then being placed?

7:02 Where are you putting th the additional time and effort?

7:06 And how are you as a a leader making

7:08 those decisions and and where that time is spent as well?

7:11 Yeah, I mean the a big part of the value

7:14 is is that well let me take a step back.

7:17 So the cyber security expertise has always been in short supply.

7:20 One of the the reasons that our MDR business

7:23 has been so successful and why other MDR businesses have

7:27 also been successful is because it's actually hard to find

7:31 security operations analysts that have the expertise to protect customers.

7:34 it's hard to staff your own sock um you know and have 247 response capabilities.

7:40 So you know what this has allowed us to do is help with that talent

7:45 help help to use the talent that we have in the in the organization more

7:48 effectively and more efficiently so that we can we can scale our we can scale

7:52 the compute in ter as opposed

7:54 to the personnel that are supporting the MDR business.

7:57 Yeah, I think that's great to hear JP.

7:59 I think there's not a person in this room that probably doesn't

8:02 feel that skills gap in in terms of cyber security, I'm sure.

8:08 Finding a threat, right, is is is one thing,

8:12 but deciding how to respond is really where trust and judgment matter.

8:17 So, how do you decide when to act on what an agent does find?

8:22 That's a great question.

8:24 Um so at at Sophos the way

8:27 that we've structured our MDR business from the beginning

8:30 um kind of takes this problem into account

8:32 because it's a problem if it's humans doing it.

8:34 It's also a problem if it's agents doing it.

8:36 Um so the way that we've approached this is by starting

8:39 with we have three basically basic operating modes that we operate within.

8:43 First is called notify and in that mode um our sock will investigate

8:47 a case fully on behalf of customers

8:50 but we'll never take a response independently.

8:52 um we guide the customer and we recommend

8:55 response but we never take that on their behalf.

8:57 Second is collaborate and in that mode

8:59 we conduct the full investigation but then

9:01 we will work with the customer and never

9:03 take a response without their direct involvement.

9:06 And the third is um authorize and in that mode

9:09 we are fully authorized to take response actions

9:12 on behalf of customers and keep them protected and we're

9:15 comfortable operating with customers in any of those different modes.

9:19 And we structured it that way so that we

9:21 could meet the customer where they are and align

9:24 our service with their level of expertise and comfort

9:27 level with us taking response on their behalf.

9:30 So all of those same um principles apply to agents as well as to humans.

9:35 And the the way that we handle automation and response is

9:39 you know we of course want to ensure that we're responding quickly.

9:43 We also want to make sure that we're

9:46 using our analysts as efficiently as we can,

9:48 but we also recognize the need to ensure that human judgment is

9:53 applied whenever there's potentially a destructive

9:55 response that an agent could take.

9:57 And so there's still anything that we don't

10:00 feel comfortable um you know with an agent handling,

10:03 we will pass off for human judgment.

10:05 So there's still a lot of human judgment in the response process even though

10:09 there's investigation even though the agents are

10:12 are automating a lot of the investigations.

10:14 And how how do you see that that evolving over time JP.

10:19 Excuse me I'm a little bit tired after last night.

10:24 I think you're doing great.

10:26 Yeah.

10:27 So the way that we see it evolving is basically

10:31 the the response capabilities are going to continue to to become more

10:35 sophisticated and we're going to continue to broaden the series of use

10:40 cases that we are addressing with the agents that we've built.

10:43 But we're always going to have humans at least at the moment I feel like we're

10:46 always going to have humans supervising anything

10:48 that could be potentially destructive in a customer environment.

10:50 Um because at the end of the day our mission

10:53 one is keeping customers protected and you know operational.

10:57 So keep customers protected keep them operational but also giving them

11:01 the control to decide whether that's full authorization or notification only.

11:06 Exactly.

11:07 okay great.

11:07 I suppose to to close let's bring it back

11:11 to the security leaders that that we have here

11:14 in the room and um what would the the first

11:16 step to getting started with Sophos really look like?

11:19 Yeah.

11:19 Well, I I think the way that I would um explain

11:23 that is just in this environment where the defender window is closing,

11:28 Frontier Intelligence is accelerating, and the the capability of, you know,

11:32 relatively novice attackers to make a real impact.

11:35 Doing the fundamentals well is more important than

11:38 it's ever than it really has ever been.

11:40 Um, and that means of course like having

11:43 patching programs to deal with the um the vulnerabilities

11:45 and the CVEes that are being released by by many

11:48 different vendors and by the open source community,

11:51 but also making sure that you have

11:53 good fundamentals in place across your infrastructure.

11:55 So solid endpoint protection like having having above having

11:58 the best endpoint protection is more important than it's ever been.

12:03 Additionally, having, you know,

12:04 basic things like MFA in place across all of your identity infrastructure,

12:09 having strong network segmentation in place,

12:11 and then having a strong security operations program that wraps

12:14 all of that is more important than it's ever been.

12:17 And Sophos, we obviously we play in all those different places.

12:21 And um you know, we're we would be happy

12:24 to to talk to anybody that's interested in learning more.

12:27 So really, you're not saying to throw out

12:29 the fundamentals here and forget all those basics.

12:31 I am not saying that.

12:32 No.

12:33 Okay.

12:33 Yeah.

12:33 And it's not it's not controversial what I'm saying, I don't think,

12:36 but I think we get distracted by the um the pace that the technology is moving.

12:42 Um you know, and of course we want to we want to do everything that we

12:47 can to leverage agents to help help

12:48 security operations teams deal with the increased workload,

12:52 but also like fundamentals fundamentals like endpoint protection are

12:56 just more important today than they ever have been.

12:58 Yeah.

12:58 Thanks a million JP.

13:00 It's been it's been great chatting and I'm sure there's many people

13:03 in the audience who'd love to to pick your brain this afternoon.

13:06 So JP is around.

13:07 Um he will be here for the remainder of the afternoon and available

13:10 if you want to buy him a drink at our open bar shortly.

13:14 Um but yeah, thanks a million for your time JP.

13:17 Um I'm going to be uh leaving stage shortly,

13:20 but uh next up I'm delighted to introduce

13:26 Tom Duff Gordon who's OpenAI's policy VP for EMEA.

13:35 Thank you.