Name: AI, Resilience, and Transformation: Insights from Gartner on How IT Security is Evolving
Uploaded: 2025-06-18T16:01:10.647Z
Duration: 37 min 16 s
Description: AI, Resilience, and Transformation: Insights from Gartner on How IT Security is Evolving

Transcript for "AI, Resilience, and Transformation: Insights from Gartner on How IT Security is Evolving": So hello, everybody. I'm Tori. I'm our vice president of marketing here at Thrive. Welcome to our webinar today. Time to Optimize AI, Resilience, and Transformation, Insights from Gartner on How IT Security is Evolving. Hopefully, by the end of this webinar, you'll have a more complete understanding of what these major cyber trends are, how they're affecting the real world IT landscape, and how Thrive clients are adapting to these changes. So today, we'll be covering, working towards cyber resilience, clouds, devices, and machine access management, how AI changes the security landscape, Thrive's holistic approach to security, and then, of course, like I mentioned earlier, we're gonna get into some q and a. So with that, I'd like to hand this off to the real experts and stars of today's webinar, Kevin Landt, who's our vice president of product cybersecurity, and Audy Bautista, who's our executive vice president of security operate. And thank you so much for being here. I'm gonna hand it off to you both. Thanks, Doreen. So, thanks everybody for for joining. What you're looking at here is a Venn diagram in the latest Gartner, cybersecurity trends report. They broke this down into three different areas. On the left, trends that are related to enabling transformation. And I saw in the in the poll questions there, a lot of you are looking at new products and innovation as the way that you're going to increase, your your business goals this year. That aligns with what what Gartner's seeing. On the right side, they talk about embedding resilience into everything you do. And, of of course, this is something that's that's been a trend for a while. It was a trend in their 2024 report as well, and that's because nobody has tolerance for downtime anymore. It really impacts the business. And then in the center here, the the overlapping area, and we saw this in the poll question as well, a lot of you are looking at at implementing AI as a way to transform your business, when we look the left side, but, also, we need to consider how those trends impact resilience. So these all come together in in Gartner's report this year. If you're not familiar with the report, Gartner is a a well known consultancy. They put out this report every year. We've got a copy of it that you can download, and and we'll give you the link to that. But we also know a lot of you are are are busy and don't have time to to really dig into the report. So the goal today will be to, give you some takeaways, some best practices that you can take back to become more cyber resilient and and really, keep up with these trends. I've got Audy here with me as well. So, Audy manages our SOC and our incident response team, so I'm gonna call on him as well a few times here, to give his perspective on on what we're seeing and and how that relates to what Gartner's eating. So the first trend we picked out to dig into a little bit more is working towards cyber resilience. This is this is interesting. So Gartner found that 66% of IT leaders are responsible for business continuity planning, and that's up 12% year over year. So, this this matches up with what we saw in our poll question at the beginning. I think we had over 80% said that IT and IT leaders are responsible for business continuity planning. This is a shift from years past. A lot of times business continuity was a domain for, site managers or or business operations people because they had to think about questions like, what if we have a natural disaster and people can't get to the office? What are we gonna do? How do we how do we stay in business? Obviously, things have changed, particularly after COVID, and now a lot of that continuity is it's through technology. That's how people work today. So we're seeing shifting responsibilities. What are we talking about here? Resilience. Dictionary definition, it's the capacity to recover quickly from difficulties or toughness. When Gartner is talking about resilience, they're specifically talking about cyber resilience, and they're talking about a shift in mentality where it's when and not if. And this change in mindset also changes how we prepare. It changes how we measure success. We're not necessarily trying to stop or or well, we are trying to stop cybersecurity attacks, but we know that that is not how we're gonna be measured at the end. What we're really gonna be measured on is how do we recover, how does the business, rally, and and how do we minimize that impact? Because they are going to happen, and that's something we accept now. Why is it trending? A lot of this is being driven from the top. So in Gartner's research, they found, with the clients they talk to, 84% of board of directors now view cyber risk as a business risk, and that's up from just over half in 2016. So, again, this has shifted over the last, ten years or so. It's now making its way down through the organization, shifting responsibilities, and and really impacting how we do, planning. So when we look into the report, one thing they emphasized, resilience, it really needs to be holistic. And so, what I'd like to point out here on this slide is a lot of great technologies that can help us do that, but that's not really what we're looking at here. It's not just technology. That's not gonna solve all our problems. And, actually, it needs to be a combination of technology, of policy, and of outcomes. And when thinking about this, it it often helps to start with the outcomes and work backwards. If we know our our service levels and and how quickly we need to have certain, business functions back online, if we know our compliance requirements and what we owe our stakeholders, and then we can start to figure out what policies do we need to put in place in order to make sure we achieve those outcomes. And then once we know what what our policies are, then we can go back and look at at technology options and figure out where do we need to make those investments in technology to, make sure we can implement these policies. So some best practices here when it comes to cyber resiliency. We've got, backup and storage strategy at the top of the list here. But we could expand this in general to preparing, the level of of preparedness really makes a difference when it comes to cybersecurity incidents. Audy, we were talking about, an example of this with with a client just recently where it really came into play. I think that would be a great example to talk about here. Yeah. For sure, Kevin. So we see the impact of cyber resilience every day in security operations. And it's not just about preventing attacks. It's about an organization's ability to bounce back when a cyber event hits. So a big part of that is preparedness. So without cyber resilience, a company's reputation and ability to function is at risk. So we saw recently the Paradis in action with one of our customers who faced a critical security incident with a compromised account. Now this kind of incident could lead to a ransomware event, which could cripple any organization, but this customer was ready. So they had our digital forensics incident response solution preinstalled. They had their incident response plan. We had their backup strategy fully documented, and the information was readily readily available to our twenty four seven incident response team. So our EDR caught the suspicious activity leading up to what could have led to a ransomware event. Now the activity was detected before any data was encrypted, and our incident response team moved fast to pinpoint the source of the activity. But because of the customer's preparedness and our coordinated instant response, we were able to restore data from a clean backup. Now there was minimal business disruption, and we got them back online quickly. So it sounds like without that backup in place and without that that being prepared ahead of time, this really could have turned into something much worse. And so perfect example here of what we're talking about with our best practices. And and so some other some other areas here to hit, cross organization training and awareness. This is really important to develop that culture where everyone should know, how do I report an incident? What steps do I need to take? It's sort of a see something, say something attitude. Everybody in the organization should be involved and not just the security team. And then lastly, you really need executive buy in if you're gonna make that cultural change. And as security leaders, have to be able to communicate the benefits to the business of of why this is important and and translating it into that business continuity, mindset and how that that affects the bottom line. Next one we wanted to dive into, this one is is really downstream from transformation, all types of new technologies being brought in, innovation is increasing, the the number of identities that are in the organization. So identity management, nothing new here. But as we start to implement AI, and other technologies, we've really seen a proliferation of identities tied to machine accounts, service accounts, and, of course, our our our user accounts are are things we still need to worry about. And so this is this is a trend that Gartner identified that's gonna be really important this year. And some reasons why here, they found that 54% of organizations have seen an increase in identity related breaches. So it's really important, and and this just came up in the example Audy mentioned with a compromised account, where where we see this type of thing. And this other stat here, eighty five percent of those identity related breaches can be linked to a compromised machine account, which I thought was was pretty crazy. So Audy, these are the what Gartner's seeing. What are we seeing with our our customer base, in terms of identities? Yeah. So so my security teams, they see the risks of machine accounts firsthand every day. So let me tell you about a customer, actually, the same customer I mentioned earlier with the security incident. Now from what I described, you might have thought that they did everything perfectly. They had their incident response plan. They had our incident response solution installed in their endpoint. They had a solid backup strategy. But despite all the preparedness, they missed an important preventative control. So the account that was compromised had no multifactor authentication enabled. So once the activity was detected by our twenty four seven security operation center, our incident response team was able to take action quickly to contain the threat and help the customer recover. But even though there was a positive outcome, if MFA had been enabled, the incident likely would not have happened at all. So it it goes to show, Kevin, that even the most prepared companies can have one simple gap, and this definitely highlights the need for vigilance with the basics. Right. So it's it's a continuous process. Nobody's ever there. It's a journey, that that just needs constant attention. So some some best practices here around identity management. The first one is is is not a technology solution. Again, that's kind of a theme here. It's all about working with your your colleagues in different parts of the business to understand what teams are creating user accounts, machine accounts, what do they have out there in the cloud, what what applications are they using. This is, sort of a knowing is half the battle situation where once we get our our our arms around that, then we can start to move down the list here, identify a strategy, for machine accounts and how we manage them. Thinking about our our our firewalls and other other perimeter controls and security controls, if you've got machine accounts and you don't need to log into them from the outside, then don't provide access to the outside. Right? Everything we can lock down there, helps us reduce that attack surface so that we can focus on some other things. And then, of course, gotta pay attention to privileged accounts. Make sure you've got clear policies for those, how you manage them, who accesses them, and why. Do constant audits there and and make sure you're cleaning that up. And then the third trend we wanted to dig into, it's a hot topic. It's it's AI and how it's changing the security landscape. And, again, this kind of touches on both the the enabling transformation and the the cyber resiliency here. And and a quick definition, when we're talking about AI here, we're talking about generative AI, and that's, where we're using deep learning. We do a date data analysis on a on a lot of content, and then it can generate its own content based on that according to user prompts. And this can be used to automate many of, our security tasks that we use today because it is fast, and it and it can, do a lot of those repetitive tasks very quickly. But for security teams, important to keep in mind, obviously, you're you're not the only one using a AI here. Your employees are definitely using it even if even if you're not aware of it. Your suppliers and partners are using it. The attackers are using it. So we need to understand, GenAI from all of those different perspectives. So a lot of good stats here in the report. Again, invite you to to to download it afterwards and dig in. But we we pulled out a few here that that we thought were interesting. The big one here and this relates to, again, to compromised accounts. That's why we focused on on identities. Gartner found that there's a 50% reduction in time to exploit those compromised accounts because of AI agents. So that really shortens the time between when a when an attacker gets those compromised credentials and when they can start doing things like installing ransomware or exfiltrating data, and so that really shortens our window of response here. Another one I wanna pull out here is is the second one here. 30% of organizations will consider biometric authentication unreliable because of deep fake attacks, which is which is really scary to think about. 40% of social engineering attacks will target the broader workforce with deep fake and counterfeit reality attacks. That's that's wild. It's it's something we we really didn't have to worry about a few years ago, and now we really need to do a lot of training. Luckily, the same the same techniques work in terms of security awareness training. Were you expecting this person to contact you? Are they trying to create urgency for you to do something that seems unusual? We can still train our users to detect these, but the the idea of a deep fake, obviously, makes that more challenging. So some some best practices here in from Gartner really focused on on tactical AI. They emphasize this a lot, and they're talking about smaller, projects. Don't don't try to rip and replace everything with with AI, but, look for small incremental improvements. For security and risk management leaders, in particular, they have three areas here, securing third party AI consumption. And then second, if your if your company or organization is developing your own AI applications, make sure those are protected. And third, look for ways to improve your cybersecurity by using AI. Audy, let me go to you again here. I'm sure this is something you're you're thinking about with your teams. How are you starting to use AI and what are you seeing there? Yeah. My my teams are constantly thinking about AI, and we're already using AI in several ways, and our clients are already getting the benefits even if they don't know it. So let me give you a couple of examples. So AI is used in our autonomous penetration testing where we take the perspective of an attacker to find the weaknesses in our customer's environment. So the AI and the solution, it changed together multiple vulnerabilities and exploits, and it does in minutes or takes a human hours or days. So as a result, it identifies critical attack paths much faster. So we also use AI with our case management system. So it ingest data from multiple sources, for example, alert logs, analyst notes, and it analyzes all the information in real time. So it gives our analysts a clear summary of them a recommendation. So our analysts, they no longer have to sift through endless logs manually. So this has led to faster response times, and we can find the root cause faster, which means that our clients are safer more quickly. That's great. I'm sure this will continue to evolve, and and we're gonna find a lot a lot of new ways to work with AI. And, hopefully, we'll do it in a tactical way so we don't so so when something's not working, we can we can pivot quickly as well there. And so best practices here, stay grounded in the real world. Define your potential use cases. Start with a pilot program and make sure you have clear objectives for that program. There's we we won't know if it's worth investing more in AI unless we know that that what we've invested in so far is actually meeting our objections or sorry, objectives. Also, involve other parts of the business cross functional teams when you're trying to identify how to use AI. We wanna make sure that the AI we're implementing is actually helping those people do those real daily operations. Audy talked about how we can save time for our SOC analysts. That's something that's measurable. We can measure how many minutes it takes for them to analyze a case and decide if if AI is paying off. Should we invest more in it, or should we shift our our focus? For each of these projects, make sure you're identifying the data sources that are gonna go into the AI, because that's a that's a potential, risk that data could be exposed. And so we need to think about why are we feeding this data in? Has it been cleaned up? Is there, personal information that we're not allowed to feed into that? A lot of prep work goes into that cleaning that data before we just start throwing it into AI models. And then make sure you're you're you're communicating your AI policy throughout the entire organization. As these transformative technologies come into place, the one of the downstream effects is decision making starts to become more decentralized. So you have individual teams within the organization making decisions about their AI usage, and you can't necessarily supervise all these different projects, but make sure they know the policies, and they're implying them and they're enforcing them. And, of course, ethics in in AI, that could be a whole, webinar topic itself, but something to keep in mind as you're implementing AI. So those were those were three trends we we pulled out, and there's there's a whole lot more in there to dig into, but, hopefully, you understand the need for cyber resilience, how that's changing over time, and some strategies for dealing with that. We, at at Thrive, would love to partner with you to build that holistic security program. A little bit about us, we've been doing this since February, so a number of years in in the industry, over 1,400 employees now, and over 800 of those are in technical roles, helping our customers day to day solve their their technology problems. So we bring the expertise to help you. As we've grown, we've tried to to stay local. We want to, keep closely aligned with our clients so that we understand your business goals, and we can structure our programs to to meet those those goals with you. When it comes to cybersecurity and business continuity, we've got a full suite of services. We talked a lot about preparing today in this webinar. That was a big trend for Gartner in 2025, and Thrive has services to achieve that. We can do cyber risk assessments. We can do virtual CSO programs to help you develop an incident response plan, to do tabletop exercises to test those plans. We can do hardening, exercises through the pen testing that that that Audy mentioned. Of course, we also talked today about how it's it's when, not if. So we have detection and response services, detect those compromised accounts quickly, respond quickly before, it turns into a a a an incident that that that goes beyond containment and starts to impact your business. And we can help with those recovery strategies, whether it's backups or Doctor. We've got the engineers to to do it. So we would love to partner with you on building that holistic program and, really thank you for attending today. If you do have questions, we've got some time here. As Tory mentioned, you can put those in the q and a box, and we'll we'll pull some out and try to answer those. And as promised, we've got a link to the to the Gartner report. So thank you. As a reminder thank you, Kevin. As a reminder, while people are getting their questions into the q and a box and you both start to review those questions. The the presentation was recorded today. The slides and the recording will be sent out to you via email after the fact. You can also revisit this link, and and see the recording as well, but everybody will receive an email with those. Alright. I see some questions coming in. So whenever you guys are ready, you can choose one and answer. Yeah. Sure. So let's let's, take one from the top here. Is Thrive able to collaborate with companies to help create an AI policy? Yes. That's something we can certainly, assist you with with our consultation services. It's going to be a joint effort. Thrive and and no other service provider could could tell you what your AI policy is. It would be, asking questions about how you're using AI, what are your goals, what are the concerns around data privacy, and working together on that plan, but we could certainly help with that. Let's see. Have you seen AI being used in any real attacks? Let me toss that one to Audy since you see the real attacks. What are what are we seeing out there? Yeah. We we see a lot of attacks. Now sometimes the attack itself, you may not see direct evidence that there's AI involved because you don't see the source code. You don't see what's happening in the background, but it's typically very evident that AI is used because the way that for example, if the cuss, let's say, if that actor threat actor in the customer environment, the way they're able to pivot internally between different systems and bypass endpoint detection software at times. So so we we've seen what we believe is is clear indication that there's AI, but sometimes it's very hard to say it absolutely was AI. Another one is a lot of phishing emails. You see, very legitimate looking communication, clear, perfect English. So those are that's another example of of pretty much an indication that more than likely AI was involved, but it's it's not very evident that it was AI, but just heavy suspicion and and the likelihood that there there was AI involved. So that that's just a couple of examples. Great. We've got one here. It's a it's a comment and a question. So so it's someone that's creating Python scripts using chat g p t to automate data downloads, and and then asking whether this could pose a risk. What I will I'll answer this more generally, because I don't know the the the details of of what you're doing, specifically with your scripts. But, AI, Gen AI is being used a lot to generate code. It's how developers are are are speeding up what they do and becoming more efficient. Gartner did find, in the report that some of that code could contain either vulnerabilities or even malicious code sometimes. So it is something we need to think about when when chat g p t or something else, you know, spits out some code for us. Make sure we're running that through our code testing tools, make sure we're securing any third party libraries that it uses, all those good things you would normally do for for application security anyway. Just just maybe step it up a little bit if you're using Gen I to to Gen AI to develop those. Let's see. We've got, who's currently winning in the attacker versus security vendor, defender war with AI? I'll I'll take a shot and then maybe, Audy, if you if you have anything to add. I would say it it's always, hard to know exactly who's up or down at any one point in the in the game because it is a continuous process. And so as attackers develop new techniques, we are either developing techniques of our own on the defense side or maybe we've got to start implementing different technologies to defend against those. Sometimes it's policy based and it's training based. So we're always playing catch up with the latest techniques. It will probably always be that way, whether it's AI or any other type of technology. But, Audy, where where do you think you're, you are on the scorecard right now here? Yeah. I I have to agree with, agree with you because there's no scoreboard where you can see who's winning and who's losing. But, yeah, it is a daily struggle. These threat actors are getting more sophisticated. They have they have better tools, but also the vendors are, always catching up and and building tools just as good. Or sometimes the very good solid tools the vendors are are making, the bad actors are taking advantage of those. So it's hard to say who's winning or losing, but I would say that the that the vendors are doing a lot to try to catch up and to stay ahead of the threats. Great. Let's see. We had a a question about Microsoft moving to passwordless solutions to stop phishing. I don't know that I can give a a a deep answer on that. I would say, obviously, passwords are one of the biggest attack vectors right now. That's clearly something we're seeing, Audy, is is compromised accounts. Our our Microsoft three sixty five monitoring service is is very busy, with with the accounts. Obviously, you can do things like adding MFA, which you man mentioned. Moving to passwordless solutions, where do where do you see that fitting in technology wise, Audy? Yeah. I I think anything that can be done to improve the quality of the, securing of accounts is a very good thing. So in terms of specifically Microsoft moving to that solution yeah. Just like any solution, you have to look at the pros and the cons to see if the technology that you support actually supports that solution integration for the passwordless solution. So, I think it's a good thing that that let's say we're moving to that direction, but, of course, it has to be thoroughly vetted to ensure that it could integrate with a customer environment because you could want to, add some add these, let's say, security improvement, but you have to make sure that the environment supports it. Mhmm. Question here about how to how to open a channel with us to discuss, privacy. Audy, what's what's the best way? Follow-up with the the link or the the email that we send out afterwards? Yes. Following up with that, we can I can also, for this person who asked the question, have somebody reach out to them directly? But if anybody else wants to get in contact with us, they can respond to the email that gets sent, with the slides and the recording or fill out, a contact us form on our website. But I would say replying to the email is probably the easiest. Kevin. We also did include both of your email addresses in, this presentation that everybody will receive. Yes. Feel free to feel free to follow-up with with us directly as well. Kevin. Let's see. And the questions how is AI used for attacks? I think we covered covered that. Where do we start with managing machine identities? What kind of tool is there for that? So it's it's it's a good question. We can treat machine identities a lot like we do human identities in terms of some of the tools we use and the policies we put in place. We shouldn't we should be looking at least privileges. So any account, whether it's a machine or human, shouldn't have more permissions than than it actually needs. We should make sure we're we're auditing that regularly. There are some tools out there, some vendors. I'm not qualified to recommend one over the other, but there are some some, identity access management solutions, and some of them do have modules specifically for identities. Audy, anything to add on that one? No. I I think it's spot on that one. K. Kevin, there's one question I wanna take. Let's say, what does cyber resilience look like? How do we how would we know when we get there? Well, it it's a journey. There's there's no way where at the very end, you plant the flag and say, I'm there. I am cyber resilient. That never happens. Like, it's it's a it's a journey, and it's not just the technology. Technology is a big part of it, but it's also the human element, security awareness training, educating your staff and your users, defense in-depth in-depth. I'm always promoting preventative controls. It's fine if, let's say, you wanna, put an alarm to monitor when a door is open or closed, but you you want to make sure there's locks in the door as well as monitoring the activity to the door. So so it it's a journey, and there's multiple steps. There there's never a time when you can say you're complete with your cyber resilience, but you the the goal is to add as as many layers as possible, defense and theft, preventative controls to make it much harder for a threat actor to to, get inside your environment or, let's say, to infiltrate and and get to what's important to you as an organization. We've we've got one asking how important is is it to bring in an IT partner like Thrive to help drive OOI ROI? I don't know if this person's trying to tee me up to say you should always use Thrive. But the way I would look at it is, really, you're making decisions about what you do well as an organization and where it makes sense strategically to bring in a partner to do areas of the business that that aren't your specialty. We see that a lot in security. We see it a lot in, disaster recovery where if you've got IT people on staff, you want them focused on those new products and innovations, or or implementing AI to help your teams. You want them focused on internal projects like that, and you can use a a service provider to complement them strategically in the in the areas where it makes sense. So I would I would say there. And then maybe a last one here, unless we get any any more in. What kind of RTOs are you seeing in the field under real world failover scenarios? I will say that is outside of my domain in cybersecurity. Audy, I know in some of the incident response engagements you've been in, we this has probably come up. So what what type of expectations do do companies have on the disaster recovery and failover part of the house these days? Yeah. A a very unsatisfying answer. It really depends. But, yes, my incident response teams have been involved in many incidents and many where we had to get to the recovery stage. And and it really depends on the technology used, the the BCP, business continuity plans, recovery plans. So, I can't say I I I can't just say one day, three days a week because, was quit for one what what what very fast for one organization could be a lifetime for another organization. So it's really hard to to say what what what that could look like. I've seen organization recover within days. I've seen, recovery within hours. So it really depends on the technology and and the recovery. Let's say the recovery technology, let's say, configured for the specific environment and, and, and the requirements of the customer. So it really depends. Very unsatisfying, but really depends. I I will say, unlike Adi and I, we do have some some experts within Thrive that that could talk more about that. So if there is particular RTOs that you need to meet when you set when you look at your outcomes and and your policies, we could absolutely, get the right person to to talk through that with you, have the right strategy in place, and then, again, work back to the technology. We could help implement the the the technology to hit those objectives for you. Great. I think we will call that the last question that we'll do for today. Like I said, if any questions did not get answered, we will follow-up with those via email. And anybody that asked for more information, we'll follow-up you with you directly as well. So, thank you, Kevin and Audy. This was an incredible presentation. So, informative. So thank you so much for your time, and thank you everybody that joined us today for spending your time with us. I hope you learned a lot today and that you have a good rest of your day. Thank you both. Thanks, everyone. Take care, everyone. Take care. Bye.