Esti Pashin: “AI doesn’t just help – it can destroy your organization”

Einat Miron: “And within all this risk management, the elephant in the room cannot be ignored – artificial intelligence (AI). How does AI change the balance of power between the defenders and the attackers?”.

Esti Pashin: “That’s exactly the point. AI has two very clear sides. On the one hand, it helps us a lot. In the past we were limited in our ability to process information, we were limited in our manpower and cyber experts – what is known as the Skill Crunch. Today we have ‘little agents’ who can work for us. The expert who now sits in the SOC (control and monitoring center) and receives information, can receive it after it has already been processed by AI, which is great.”

“But, and there is a big ‘but’ – on the other hand, AI also introduces new vulnerabilities into the organization. You have to remember that it is also used by the ‘bad guys’. Over the years, we have learned that the Bad Guys use new technologies much faster than the Good Guys. This means that attacks that are currently based on AI are more common than AI-based defense tools.”

Einat Miron: “This again raises the question about regulation. I always say that regulation is a big ‘draft’ because it always lags behind technology.”

Esti Pashin: “I don’t agree that regulation is a blueprint, and certainly not in the context of AI. I think it is essential. If I look at what AI has brought us today, then first of all AI is data-based. Once everything is data-based, the data becomes a ‘Single Point of Failure’. You can attack the data itself. It is no longer just a question of ‘will my information be stolen’, but ‘will my information be poisoned.’ Poisoning (data poisoning) is already a very significant event.”

Esti Pashin: “This is exactly where the CEO and the CISO (Information Security Manager) must meet. Most organizations today are introducing AI into their business processes. For example in human resources – many organizations scan resumes using AI. The AI ​​decides who passes and who doesn’t. AI is used in legal advice, in preparing financial reports, and in the interface with customers.”

“The same CISO, who needs to protect his AI-based defense systems, must now also protect the business processes that are powered by AI. The CEO may decide that he waits with the implementation of an artificial intelligence-based ‘SOC agent’ until the technology matures, but he must protect the corporate AI systems now. You can’t stop this train. An organization that does not implement AI today is simply not competitive. It’s a dramatic moment.”

Einat Miron: “It sounds quite pessimistic – the attackers are faster, the information is poisoned, and the competition forces us to run forward. Is there any hope at all?”.

Esti Pashin: “I promised that there is light at the end of the tunnel, and it exists. One of the central areas that I deal with today is investments in the world of Defense Tech and Aerospace Tech. The light that I see comes from the amazing technologies that are developing in the Israeli market. I see a lot of money that is channeled into the development of these technologies. Almost every day I sit with companies, with young entrepreneurs with bright eyes who understand the depth of the problem and have phenomenal solutions.”

Einat Miron: “And how long will it take until we see these solutions on the market?”.

Esti Pashin: “That’s the beauty – I estimate that it will be a matter of months, maybe a year, and these technologies will already exist and be available. I see mature products that answer many of the problems we talked about. The answer comes through Governance (corporate governance) and through defined frameworks that allow AI activity within the organization under clear limits and policies. It does not close all the openings 100%, because in cyber there is no 100%, but it makes the attack much more difficult”.

“But let’s give a tip to CEOs. Your awareness is important, and it is important to have regular discussions with the CISO. He is usually asked ‘what did you do?’ or ‘What are the trends?’. But there is one question that many of you are not asking today, and you should really start asking: ‘What are you doing to protect your AI?'”

“Ask the CISO how he regards the integration of AI within the business processes. If you introduced a resume scanning system two days ago, the CEO needs to make sure the CISO knows how he protects this system. How does it prevent data poisoning? How does he make sure that the processes there are ethical and clean?”.

Einat Miron: “And maybe also define what is allowed to be uploaded to AI and what is not?”.

Esti Peshin: “Unequivocally. Not to open up everything, but to define what is okay and what is not. This is my tip for CEOs: take an active interest in how the cyber protection of your AI is carried out. Make sure your CISO is aware of this, so that AI does not become the main attack vector through which they will disable your organization.”