From the endpoint to the edge: Simplifying security in the AI era

My name is Tyler Greenfield. I am with Sentinel One and I'm going to be talking about from the endpoint to the edge simplifying security in the AI era. We're going to talk a little bit about how we can make security easier, especially with the integration that Cloudflare and Sentinel One have been building over the last couple of years. Again, I'm Tyler Greenfield. I am the manager of our partner solutions engineering team. In the Americas, that means that we work with a lot of the people who resell technology to people to help them understand what they need in their IT stacks. Specifically, I focus on that security resale motion. I've been in security for about 15 years, been at Sentinel One for it'll be five years in May. Cybersecurity, a lot of things are changing obviously because of AI. The way things are changing are similar but different. In cybersecurity, we're seeing a trend that's continued for probably the past 20 some odd years. The attacks that last year were targeted at large organizations and nation states are being targeted at smaller organizations. AI is helping to accelerate that. It's making social engineering easier. It's making privilege escalation easier. We've all read about what's been happening with some of the frontier models and how they've been hacking things. There's a strong argument to be made that that is due to a lack of responsibility in the testing being done. But regardless, these capabilities are making it much easier for attackers to carry out sophisticated attacks against a larger array of targets. That doesn't necessarily mean that security as a problem space has got easier. It's something I talk about very commonly. Security is a complex discipline. It's not an entry-level discipline in IT or technology. You have to understand the surface you're managing before you understand how to secure because you have to understand how it might be exploited. Especially when you're at a smaller organization or an organization that is not inherently focused on technology. I don't know how many of you work for non-pure tech companies where you might be the tech people maintaining your infrastructure and all of that, but it is not the focus of your organization. Getting the resources even in very technically focused organizations to deal with this complex sector that's not necessarily making money for the business can be difficult. But we all have to manage this. We can't ignore it. We are seeing that again, these attacks are ramping up. Everybody is having to pay more and more attention to it. Sentinel 1 has been built from the beginning to make this problem easier for people. When we were founded 14 years ago, our vision was the autonomous SOC. We are not fully there yet, but I'm sure you guys have been hearing a lot of that talk recently. We are getting to a place where we have a lot of the technology in place to make it possible and to make it possible at scale to bring enterprise -grade security to the masses. The people in the process to put that in place is really the difficult part that we're seeing these days. Cloudflare is very similarly, making management of complex infrastructure, Cloud infrastructure, SaaS infrastructure, Zero Trust, a lot more accessible to everyday companies and IT teams. How have we been pursuing this together? Again, a couple of years ago, we've always had an integration with Sentinel 1 and Cloudflare. Going back, it was very simple, Zero Trust integration. Powerful, important, but they had the Wolf Client on an endpoint. We had our endpoint protection agent on an endpoint. They would check with us to see whether something was clear before it could connect into the broader environment. We were the gatekeeper. We were the source of that signal because we are one of the best EDR companies in the world, so we could see whether or not a device was infected. There's a lot more that we could do because we built more at Sentinel 1 over the past few years. We have a full data lake and security SIM, if you know the term, but security incident and event management system as well as an automation harness that allows you to go out and do things. We are also an AI security company going back 15 years. I know that term has meant a lot of different things over the last 15 years. For us at the beginning, it was let's put behavioral learning, deep learning, behavioral analysis on the endpoint where compromise happens to see things where they're going to happen and automatically take action. As AI and automation has advanced over the last decade and a half, we've stayed at the forefront of that. We've stayed at the forefront of researching it, developing, integrating it into the security solution space. A few years ago, I was actually in Chicago with a few of the Cloudflare essays and we were at a happy hour. We were sponsoring for a partner of ours and we started talking about what we could do with some of the new stuff that we'd been building. Over the last few years, we have massively improved how we talk together because again, Cloudflare owns that edge. They know what's going on in the transport layer, they know what's coming into the network, they know what's crossing the boundaries. Sentinel One knows what's happening on the devices that do compute. That's where we live, that's where we start. Anywhere that compute happens, we consider an endpoint. Doesn't have to be a laptop, could be Kubernetes pod, could be a sensor in a SCADA system. But by having that unified visibility and being able to share that data back and forth in near real-time, we can start unifying our visibility of that complex problem space. That's really a lot of what security has always been about. How can I get visibility into this complex infrastructure and it gets more complex every single year? Then how can I take from that complex large picture, the things that actually matter and put them in front of the people who need to take action or automate those actions? Since then, we started out, like I said, up here. We have since expanded to a large number of other use cases. I'm going to be talking through specifically these two today, and I'll show a little demo on that. One of the main things that we started doing was we said, hey, you guys have a lot of data and a lot of different products that do a lot of different things. We love data and we love correlating it and using our specific expertise on security to be able to analyze what's going on and take control of the environment. We worked to get log push from all of the various products. I think there's 20 some odd today that we have that natively go into Sentinel-1, go into your Cloudflare console, you point it at Sentinel-1, we will ingest it, parse it, detect on it in real-time. We also built out a wide array of detections based on the things that we see in environments and we see attacking environments. Then further, we've built a bunch of automation workflows. Our automation platform, and I'll show you a little bit about that at the end here, but it's incredibly powerful. It's a no-code, low-code version, which for those of us who write code, you start getting a little, your hackles raised, but you can write the JSON objects and just upload them if you want to do it that way. But what that does is it makes for an incredibly flexible and powerful framework. If you've ever worked with something like Torque or Tynes, they're great products, but you have to have a lot of investment and technical resources to manage them and to manage those workflows. Because we're an AI security company, we've had LLMs embedded in the products since they started coming to market commercially available. We were one of the first to bring an LLM SecOps assistant to the generally available public, and we've continued to iterate on that. That also increases the flexibility we have in how we can build automations. Again, when we're seeing, when we're looking at that first phase of do I know that a device is clear before it comes into my environment, whatever that device is, that's a critical portion of your workflow. Once something is inside past your controls, no matter, and the more you can put micro-segmentation and additional layers of checks, the better off you are, but that becomes complex. Once you're past the control point, it becomes not trivial, but easier to flow these days. In fact, it's almost becoming trivial. We're starting to see privilege escalation go from minutes, hours, days, weeks to milliseconds. Because we're using agentic workflows to just hammer at things and get through it. This is one of the most powerful and simple ways of doing an integration security, right? Sentinel One protects the endpoint, protects where people are logging in, where compute is happening. It communicates with the SASE layer so that Cloudflare knows when to allow devices into the environment to access broader corporate resources. But beyond that, and this is a little bit more of a complex architecture side, we're trying to make it somewhat simple, but we have all of this information that's coming from Cloudflare, right? So Cloudflare is sitting there protecting a web application. I'm gonna pull one of those up in a second here and we're gonna attack it live. That information is going in real time in Sentinel One. We have a highly performant, highly scalable data lake that is incredibly quick to parse data and start doing detection. So it'll detect almost as the logs are coming in. Like everything, there's gonna be a few seconds or milliseconds delays, but we'll see that it really quickly then moves on to that second phase where we can start running automated workflows. And one of the things I've been talking a lot about the last year again is we're trying to make security a little bit more autonomous because that makes it easier to manage this complex space. I think in my sector of the world, we've been talking for about 25 years about alert fatigue and not enough resources. And I finally started like acknowledging in the last three years, like it's not gonna change guys. Like nobody's coming over the hill to save us, right? We need to make our tools work for us. Hyper automation is part of how we're addressing that problem. Because once we can look at workflows and we can understand how they're gonna happen repeatedly, a lot of what our analysts, a lot of what our people that are overwhelmed are doing is they're doing complex tasks, but tasks that are the same over and over and over again. So if we can automate that and we can go hands off and we have a workflow we can trust, we can reduce some of that burden. We see a lot of people now moving into, Sentinel One has kind of charted it out as phases zero, one, two, three, and four for autonomy. Phase five is the holy grail, fully autonomous, right? Basically our version of that would be, you log into the security console and it's like a happy face or a sad face, right? That's not here yet, but we are seeing people in phase three, which means partial autonomy. We're seeing somewhere between 40 and 50% of the workflows that they're using in a given sector are either partially or fully automated. And we're even helping some people move into phase four, high autonomy, where they're getting into around 70% of their workflows are automated. And that automation can still include human-in-the-loop decision-making. I'm a very big advocate of this. We're doing a lot of this because it's a complex and growing problem, Sace, and the experts that we have to manage this are not growing at the same rate the problem is, right? So we still need those experts. We still need that strategic decision-making, but we're turning into a place where we have those people working as orchestrators and managers of workflows as opposed to just somebody who's getting an alert, chasing it down, and then going on to the next one and doing that again and again and again until they go home and cry into their pillow because they've got an on -call page. So getting into the demo and the interesting portion, what we built out over the last year, and I'll show you what this kind of looks like, this is our OneFlare lab. This is not the official marketing name for the Alliance, but we thought it was fun and we made a cool little joint logo up here. So please don't tell our marketing. But we have this architecture. We have all these attack scripts that are gonna run. And what we have over here is our Cloudflare infrastructure. We have a fake e-commerce website that we built. If any of you are fans of like really nice sneakers, you know that they do like drops of special editions and there'll be bot swarms, just like with concert tickets, snatching all that up, selling it on the secondary market. So we're gonna fire one of those at our fake shoe drop website. And then what's gonna happen is all of the logs from everything here as this multi-phase attack rolls out is gonna get pushed over to SentinelOne in real time. While that's happening, we're gonna do detections on those logs across multiple different sources, correlate that data, see what's going on. We're then going to fire off our hyperautomation, which the hyperautomation in this case is going to be detecting attacks that are bypassing the WAF because the WAF rules are not updated for this particular scenario. It is then going to send a Slack message to our SOC to say, hey, here's what we found. Here's what we're suggesting. Do you want me to go ahead and block this at Cloudflare or is this a false positive, right? Is this maybe a penetration test that's being run and we don't actually need to do anything? And then you're gonna see the hyperautomation will kick out and it updates Cloudflare. So again, we've got our little fake sneaker website here, which if you want any of these highly sought after shoes, you're gonna have to contact the engineer on my team who built this website and he will get into his 3D printer and make you a very uncomfortable pair. So we're gonna go in here and we're gonna go to our scenarios. And you can see we've got a whole bunch of different attacks but we're gonna do our little campaign here. We're gonna go ahead and run this. So this is gonna start out and it's gonna go through a progression of things that you'd see from someone attacking an e-commerce website. Denial of service, privilege escalation, cross-site scripting, session stealing, all those kinds of fun things that we all love to have happen against our production websites. And as it runs through this scenario, which we'll start in a second here as it queues up the script, we're gonna see that data start streaming into Cloudflare and I did run earlier so you can see there'll be starting to be spikes on requests, visitors, right? We'll start getting DDoS and again, all of the information that we're taking action on in Sentinel-1, it's in Cloudflare, right? You could go through individual screens here, you could start sorting through this but the reality is Cloudflare has a lot of great security built into its product. Cloudflare is not a pure security company, right? That's not what they're doing. It's an infrastructure company. There's a lot of things we don't do. You can't build an application and manage it in Sentinel-1, right? You can protect it. But once this comes through and let's see where we're at with our attack here. So yeah, we've already got some of these coming through and if I go here, that's from this morning, should be coming through in a second here but we'll start seeing in a minute some of these same alerts that I have from the morning run here come through. And again, what's going on here is if I click block, it's gonna go ahead and I can actually do this now because I didn't click on these earlier but it will go ahead and block at Cloudflare and then we will get a response here that will tell us whether it was successful or whether this rule already existed in Cloudflare and thus there was no change made to the environment. But all of this is being done in the hyper-automation layer and the integration between Sentinel-1 and Cloudflare and the reason that this is so important is again, some of these things could be done purely in one, purely in the other but the integration of the two is what allows us to do it easily, right? These workflows, they take a little bit to build out. We build them for you, right? We built them with Cloudflare to understand what is needed for most environments. Now, if you wanna go and build your own, it's very easy to build custom workflows. So this is our hyper -automation template and again, as I said, no code, load code. So we can go in here, drag in our different blocks, conditions, do our different decision trees, right? Very flexible. You can build these out from scratch. You can make them as complex as you want, as simple as you want. We did a exercise earlier this year with a group of engineers that I work with where we had a contest to solve a problem with hyper -automation and there were two prizes. One was for the quickest, the other one was for the most Rube Goldberg solution they could come up with, with making a complex, unnecessarily complex workflow which is obviously not what you wanna do in production but to show kind of the flexibility and the power. And you'll see that we have things like our AlienVault integration here. We have, I think this is abuse.ch. Yes, it's a little small there. And then we have VirusTotal. There are known integrations that we have as part of our hyper-automation platform. What's really flexible about it though is, if I go and look in this library, you'll notice all these like A, AA, 123. This is us just building random integrations with random applications that we built in AWS because this hyper-automation platform can touch anything that it can reach on the Internet. And later this year, we will be building on-prem connectors to do the same kind of workflow with on-prem software. But as long as I understand what the connection is, where the endpoint is, what the authentication method is, and I know what the API is behind it, I can build a integration for an in-house custom application that you guys are using. And then I can build a hyper-automation workflow to pull information from it, to do things on it, right? It depends on what the API that sits behind it is allowed to do. But the flexibility of this and how you can build these workflows out to automate that whole environment is an incredibly powerful portion of that alliance that we've had with Cloudflare. And again, this is a result of us kind of sitting down and saying, hey, we have a great integration with this Zero Trust, the client-to-client stuff, but what else could we do? And the reality is a lot of the workflows that we're building and that we see and that we have out of the box, they're things that we came up with at SentinelOne because we are security people and that's how we look at the world and the lens we have. Cloudflare has come up with some ideas looking at the problem from their view, managing the SASE infrastructure, everything on the Internet. What we really have here though is we have a data lake, we have an ingestion pipeline and we have an automation alliance, all of which can be interacted with through an LLM assistant so you don't actually have to know all of the query language. That means there's a lot of things that you guys can build off of this that we will never think of, right? We actually had a customer come to us and say, they have retail gas stations, they wanted to avoid people using fraudulent credit cards to pay for gas and then ride off into the sunset and not actually get any money from that. So they built a loop where we're processing credit card transactions, again, not something you usually do in a security tool. We are comparing that against a list of fraudulent credit cards, something security adjacent, but really more of a finance and risk and compliance control. And then based on that match, we're reaching out to their video management system, not something that has anything to do with either of those, it's usually physical security and we're grabbing the video of that pump at the time that that's happened. All of that has to happen in less than a minute for us to be able to grab the evidence of that person. And we're using that across the nation with them now. And again, this is not something that we thought up, it's something they came to us and they said, hey, is this possible? It was. So we have a lot more of these kinds of things that we'd love to figure out how to build with you guys. But again, the ideas for some of those are gonna come from you. For the security though, Sentinel One and Cloudflare are working hard to make sure that we have out of the box workflows that you guys can just put and plug and play so that all you have to do is you point your Cloudflare at Sentinel One, you go into Sentinel One, you turn on the relevant detections and workflows, and then it just works. So with that, I will pause. And if there's any questions, and it looks like we started getting our first of the new alerts in here. Yep, six new messages in my Slack. We appreciate you guys showing up and thank you for coming to my talk.