When Attackers Have AI, Verify the Person Each Time

Episode Summary

Everything good about AI is what makes it hard in security. Kris Bondi, CEO and co-founder of Mimoto, starts with the asymmetry: attackers innovate and automate at scale while enterprises implement slowly, so a step behind can quickly become ten. Her answer is a different question rather than a higher wall. What she calls anomaly detection on steroids tells you an account is behaving oddly. It cannot tell you who is using it. Her company matches patterns at the person level instead, on habits as individual as how somebody builds a Unix command line, and keeps checking after login, which she calls continuous validation. That matters most after a deepfake succeeds: an intruder in an admin account touches what an admin touches, so the anomaly may not show up. She closes on the question to put to any security tool: how adaptive and dynamic is it, and can it act in real time rather than send one more alert.

Key takeaways

  • Her opening line is one half of the asymmetry in one sentence. Everything good about AI is a part that makes it difficult in security, because everything good about it also lets bad actors change their approach, innovate on it, evolve it, and automate at scale

  • The second half of that asymmetry is speed, and it is the one enterprises control. Enterprises tend not to implement or innovate as quickly as the people attacking them, so an organization that starts a step behind can quickly end up ten steps behind

  • The first benefit she names for defenders is a capability many companies do not have at all. A red team tries to breach you and a blue team tries to stop it, some companies run a purple team that does both, and many organizations do not have the ability to have either

  • The second benefit is inside the process rather than at the perimeter. Running the same analysis internally shows a team how to take touchpoints out of a process and where the checks belong, and she says the automation of reading signals and responding is what was not possible before

  • She dates her own product to the same shift, and says plainly what it does. Data streams come in, the algorithms are picked according to which streams they are, and a composable model is created on the fly to make a determination and take action in real time, none of which was possible three years earlier

  • The distinction she stops the conversation to make is the center of the episode. Analyzing what is happening inside systems is anomaly detection on steroids; the pattern matching layered on top of it identifies a person, which is a different job

  • Stated as the difference between two alerts, it is unmistakable. The anomaly says there may be something odd with Christina’s account, and the person-level match says with certainty that the person using it is somebody else

  • The capability she is waiting for is intent, and she puts a horizon on it. She expects LLMs to develop to the point where they can be queried about intent, so a system could ask what it looks like someone is trying to do rather than only that the behavior is unusual, and at recording she expected that potentially within the year

  • On deepfakes she refuses to describe a solved problem. Deepfakes are an arms race, attackers will continue to get better, and detection will have to keep innovating in response

  • Detection at the door is a category with several members. Outside organizations focus on identifying deepfakes at the authentication step, companies using government-issued IDs often run something else behind the scenes as well, and visual and audio systems look for glitches that suggest the face or the voice is not the right person

  • Past the door, her word for the second layer is the one that names the control. Continuous validation expands beyond the face to how somebody interacts, which is the other place to catch an intruder

  • The consequences she lists are not a single risk. On the anti-fraud side deepfakes can cost companies a lot of money; on the other side, a deepfake used to get into a system is where a ransomware attack may happen or data may be stolen, and those often run through an account takeover

  • Her worked example is why the account matters more than the entry. A systems admin account touches admin things, so an intruder who used a deepfake to get in touches exactly what the real admin would touch, at hours the real admin might also be working

  • Her one-sentence account of where the standard control fails is the sharpest line in the episode. The anomalies may not show up, because the intruder is touching the things they would normally touch

  • What replaces the anomaly is a set of habits nobody chooses on purpose. At the person level the signals include how somebody uses a mouse and a keyboard and what they do at a web level, and she declines to list the rest

  • Her illustration is two people who agree on everything except muscle memory. Her two technical co-founders, one with a computer science degree and one self-taught early, build their Unix command lines differently, which is the kind of thing that is inherently specific to a person

  • She upgrades the fingerprint metaphor Christina offers rather than accepting it. It is a multidimensional fingerprint, and her illustration is her own left pinky on the caps key, which she immediately disqualifies: she has said it in public often enough that it can never be an identifier of her

  • The reason she started the company is a loss that has not happened yet. She says society has been lucky that nobody getting into a system unseen has yet caused a larger loss of life or a disruption in how people live, and that this is why the company exists

  • The idea came from a product that pointed the other way. She had been with an Israeli company that built a neural network predicting what people were doing offline in real time, which showed her what a digital double could do, and she says privacy protection is what her current company fixed this time around

  • On the Social Security change Christina raises, she moves the problem off the technology. It goes beyond voice, because somebody calling a clerk who knows neither party would not need to clone a voice at all, and her question is whether you have to talk to a person in the first place

  • The number she puts on moving everybody online instead is the one to remember. A bank will get 200 million bots in a relatively small amount of time trying to set up accounts or make distributions, which she calls a large number but not an unheard of one

  • Her first piece of advice puts security inside the AI program rather than beside it. Companies on a journey of implementing AI should extend that innovation into their security, rather than trying to use old security for new problems

  • Her second is a question to ask of any tool, and it is the one to take into a vendor meeting. How adaptive and dynamic is it, meaning can it respond to the problem as presented today and as presented tomorrow

  • Her third turns the answer into a test the buyer can apply. Real time has to mean taking action, not sending an alert, because a tool that only alerts is putting more of a tidal wave on top of the team it was bought to help

About Kris Bondi

Kris Bondi is CEO and co-founder of Mimoto, a security company that identifies people rather than credentials, matching patterns at the person level so a system can tell that the person using an account is not its owner. She works with two technical co-founders. Before Mimoto she was with an Israeli company that built a neural network to predict what people were doing offline in real time, which is where she saw what a digital double could do if you truly understood somebody, and she says privacy protection is what her current company fixed this time around. Her argument on this episode is that anomaly detection cannot answer the question that matters after a deepfake gets through the door, because an intruder in a stolen account touches what its owner would touch.

 

In this episode

00:41 Welcome, and who Kris Bondi is
01:24 Everything good about AI is what makes it difficult in security
02:06 Why enterprises fall behind: a step behind becomes ten steps behind
02:48 The other side of the ledger, and whether AI helps the defenders
03:00 Red team, blue team, and the companies that cannot have either
03:51 The second benefit: reading signals and responding inside a process
04:36 Her own product as the example, and the composable model built on the fly
05:43 No, two different things, and anomaly detection on steroids
06:23 From something odd with the account to certainty it is somebody else
06:59 The next capability: querying an LLM about intent
07:40 A stolen password, and what AI can tell you without person-level matching
08:08 Switching to deepfakes
08:26 Deepfakes as an arms race that will keep escalating
08:53 Detection at the door: IDs, and the glitches in a face or a voice
10:14 Continuous validation, past the face and into how somebody interacts
10:45 What a successful deepfake leads to: fraud, ransomware, stolen data
11:17 The systems admin case, and touching what an admin would touch
11:41 So this is monitoring behavior for anomalies
11:47 Why the anomalies may not show up
12:24 The signals: mouse, keyboard, and the ones she will not name
12:52 Two technical co-founders who build Unix command lines differently
13:24 A fingerprint, and why she calls it multidimensional
13:41 The left pinky, and the quirk a deepfake cannot know
13:52 What inspired her to start the company
13:58 The luck society has had so far, and why the company exists
14:17 The Israeli neural network, the digital double, and the privacy fix
15:06 The Social Security change in that day’s paper
15:39 Why it goes beyond voice, and the clerk who knows neither caller
16:26 Voice cloning, and what the Social Security office is not doing
17:06 Her worry about moving everybody online instead
17:22 200 million bots at a bank, and why that is not unheard of
17:49 Where does this fit: industry, use case, size of company?
18:01 Manufacturing, financial services, online services, cybersecurity
18:21 250 to 15,000 people, and the CISOs, CIOs and CTOs who buy
18:55 The closing question: advice, and where to look next
19:17 Innovate your security the way you are innovating everything else
19:41 The question to ask any security tool: how adaptive and dynamic is it
20:01 Real time has to mean action, not one more alert
20:22 Close

In Kris’s words

“everything good about AI is a part that makes it difficult in security”

Kris Bondi   (01:24)

“they start a step behind the bad actors and then quickly could end up 10 steps behind because they haven’t evolved and they haven’t innovated”

Kris Bondi   (02:06)

“I can tell you with certainty that’s not Christina using it. That’s David using it.”

Kris Bondi   (06:23)

“the anomalies may not show up because they’re touching the things that they normally would touch”

Kris Bondi   (11:47)

“There are just things that people do that are inherently specific to them.”

Kris Bondi   (12:52)

“Anyone who’s building a deep fake of you is not going to know that you have this quirk of your left pinky caps on and caps off.”

Kris Bondi   (13:41)

“I would hope that if they are listening to your podcast and are on a journey of implementing AI, that they extend that into how they are innovating their security as well.”

Kris Bondi   (19:17)

“Is it operating in real time? And not just to send an alert, but actually to take action in real time.”

Kris Bondi   (20:01)

 

Resources

Ideas and terms discussed

  • Anomaly detection on steroids: Her phrase for what compute now makes possible in the standard control: analyzing what is happening inside systems, faster and wider than before. She uses it to mark the boundary of what that control can do, because it reports that an account is behaving oddly and cannot say who is behind it

  • Person-level identification: The half of her argument that anomaly detection cannot cover, and the reason she describes the two together. Advanced pattern matching identifies the individual from behavior rather than from credentials, so the alert changes from something odd with an account to certainty that the person using it is somebody else

  • Continuous validation: Her name for checking that it is still the right person after authentication, expanding beyond just the face into how somebody interacts. The company site uses the same words for the product

  • Advanced pattern matching: The technique underneath, which she is careful to say is not new. What is new is that it scales, which she credits to where ML and AI are today, and scale is what makes it fast enough to respond with rather than to review afterwards

  • A composable model built on the fly: How she describes her own system working: data streams come in, the algorithms are chosen according to which streams they are, and a model is assembled in the moment to make a determination and take action in real time. She dates her own product’s capability to about three years before the recording

  • Red team, blue team, purple team: The capability she says AI now puts within reach of companies that never had it. A red team tries to breach you, a blue team tries to stop it, and a purple team does a little of both, and the change is who can afford one rather than what one is

  • Querying an LLM about intent: The capability she is waiting for, and the only prediction she makes with a horizon on it. Rather than flagging that behavior is unusual, a system would be asked what it looks like somebody is trying to do, and she expected that potentially within the year at the time of recording

  • A multidimensional fingerprint: Her upgrade to the fingerprint metaphor Christina offers. The identifying signal is not one habit but many at once. Her own example is her left pinky on the caps key, which she then rules out as an identifier of herself, because she has said it in public too often; the point is that anyone building a deepfake of somebody else would not know their equivalent

  • The digital double: The idea she brought with her from an earlier company, where a neural network predicted what people were doing offline in real time. The insight was how far you can go if you truly understand somebody; privacy protection is what she says her current company fixed this time around

  • Account takeover: The mechanism that connects the two halves of the episode. A deepfake at the door often results in an account being taken over, and the damage is what the intruder touches afterwards rather than the entry itself

Named on air

  • ElevenLabs: Christina raises ElevenLabs as an example of how far voice cloning has come, including cloned voices carrying whole conversations that are indistinguishable from the real person

  • The Social Security Administration: Christina raises that day’s news that benefits enrollment and bank account changes could no longer be done over the phone. Kris Bondi’s answer moves the problem off voice cloning and onto the process

 

Frequently Asked Questions

 
 
 
 
 
 
 
 
 
 
 
Previous
Previous

From Clicks to Conversions: Pay Only for Measured Outcomes

Next
Next

Bridging Data Science and Generative AI