AI and Endpoint Security, Prevention is the Path Forward

In this Q&A article with Emily Heath, we dig into the most prevalent issues that security leaders face: AI and Endpoint Security.

Cyber Security Tribe: There’s this balancing act that has always been around, but it is so prevalent now because of AI, and that's that balance of business enablement and innovation, while also risk reduction. How do you continue to reduce the risk, but also allow the organization to move forward at the pace at which they desire, especially in the AI Era?

Emily Heath: We cannot get in the way of it, especially with AI. AI is fun, it's exciting and it does amazing things for us. The fact that we have this technology to enable business is absolutely mind-blowing. But you do have to have that balance. Having a way to frame risk is really the first battle, because as CISOs, we need to be exceptional storytellers. Having some level of risk is okay and it’s inevitable in any company that you will be carrying risk at some point.

Risk is ok if it is conscious, it's agreed upon, and it's documented. It's really that straightforward. How you get the buy-in to that risk is how you tell the story. How you tell the story is by anchoring it back to the first question about why this risk impacts what's really critical to the business. That framework has always worked well for me, but I haven't been a CISO since the explosion of AI, so I now see this whole other world come into play. I see it from the other side of the table now. Enablement has to happen; CISOs don't want to get in the way, they genuinely want people to do their jobs, but risk is completely inevitable, and I've had my mantra for many years that I'm okay with that, as long as it's conscious, it's agreed upon, and it's documented.

Cyber Security Tribe: Shifting gears a little bit, we're talking a lot about the AI explosion, how have you seen that change the expectations for CISOs?

Emily Heath: There's a whole new attack surface that just exploded. We've spent years and millions of dollars trying to protect this world that used to be on-prem, then the cloud came along; now we've got this entirely new attack surface that is moving like a juggernaut. It is going so fast. Having this entirely new attack surface and trying to understand it, while still keeping our eye on the day-to-day job has been really tough. It's a great opportunity for CISOs, because they have the vantage point in the company to understand the entire company. It's not just to understand a slice of it, you don't just understand marketing, or sales, or operations or manufacturing. You have to understand all of it. So, oftentimes, CISOs are the go-to people to think about, ‘how do you help us govern AI’? Many CISOs now are taking on AI governance roles, because who else do you give it to? There is no AI governor in the company, so a lot of times this function leans towards the CISO, and I think that's amazing.

It adds to the expectations and the role getting bigger and bigger, and you're seeing CISO roles being combined with CIO roles, or with CTO roles, and that's because the lines in-between are just becoming marginal. I think it's great for careers for CISOs who want to continue to grow, but of course, everything comes with the price, and the price has increased expectations.

Explore this subject further at our online fireside chat on August 27th: How to Build an Endpoint Strategy Ready for the AI Era

Cyber Security Tribe: Much of what we just talked about lends itself to why Glow is doing what it does, so let's talk about that. Tell me what the problem they’re solving is, and why you felt this was the right place for you.

Emily Heath: Obviously, it took something pretty special to pull me away from my VC life, right? To come into the fast lane and build from the ground up is certainly not for the faint-hearted, but I've never been accused of being lazy, that's for sure. Being a hard worker is a part of my DNA. I would say, first off, the older you get, the more that you genuinely want to work with people that you love, and I mean really love and care about. These are people you're in the trenches with, you're working very, very hard with, you don't always agree with, and you find ways to tackle problems differently; for me that’s top of the list. Perhaps younger in my career, it wouldn't have been top of the list, something else would have been, but the older you get, the more that working with the people that you genuinely respect and love and care about is number one, and this founding team is absolutely phenomenal. The talent is incredible. They've been around the block a few times, we've got some incredibly experienced, talented people, but number one, they've got huge hearts, and they're just my kind of people. I don't say that lightly, because there's lots of other reasons why people go into a business like this, but for me, I'm a ‘what-you-see-is-what-you-get’ kind of gal, and I need to know that I'm in the trenches with people who are like-minded. That was checkbox number one.

Secondly, we anchor ourselves at the endpoint, and there's a reason for that. This industry hasn't really been disrupted in the last 15 years. CrowdStrike was probably the last one, and they're a terrific company who have continued to evolve in so many different ways, but endpoint has been very difficult over the years, because we've relied on detection and response, because prevention was too hard and we didn't have the skills or the technology available for us to do that.

In this world and this opportunity that we find ourselves in, detection and response is never going to be able to deal with the sheer volume that's coming to us unless we go back to basics and start thinking about prevention. I genuinely believe in this wholeheartedly because I've lived the pain.

Now you start to overlay not just AI, but what these frontier models and Mythos-type things can do to the existing landscape, as well as the new one and it’s really frightening. When you're a mission-driven person and you genuinely care about your organization, the anxiety that comes with that is pretty high.

I really wanted to build something that I have a genuine connection with and something that is here for the long haul. We don't want to be a point solution that gets acquired 6 months from now. We're all experienced people who want to have the opportunity to build a long-lasting, meaningful company that really transforms an industry, and we’re at the very beginning of that journey. When you combine the people with the opportunity that's in front of us here, now that we've got the technology, I can't sit on the sidelines and watch somebody else do this. I can't, I'm hungry still, I've still got too much energy, I don't want to sit on the sidelines, this is too much fun, we've got this amazing technology, let's put it to good use. Those were the genuine reasons why I thought now was the time, and it happened pretty organically. I didn't go around interviewing with a whole bunch of companies, it just happened on its own, and sometimes you believe in your instinct, and that’s done well for me throughout my life. So here we are at Glow!

Cyber Security Tribe: To your point, prevention is critical today. You’ve got to switch the way that it’s been done for years; what's been done for years was great at that time, it’s just not enough in today’s environment. How do organizations need to rethink endpoint security today?

Emily Heath: At the end of the day, everything's coming back to the endpoint. We've spent years trying to get everything off the endpoint and into the cloud, and now all of a sudden, everything's coming back to the endpoint. You can't build data centers fast enough, and now everybody's using AI tools from their machines and doing all kinds of fun, crazy stuff. People were suddenly going to SaaS, and everything was cloud and now everybody's installing new stuff at the endpoint. When you're using things like Claude, or ChatGPT, or you're using any of these kinds of AI tools, those AI tools have one job and that is to give you what you asked for. How they get that, and what's happening in the background, is absolutely mind-boggling. It's ungoverned, It's unregulated. They don't care whether if you've asked it to create a video or image for you, or connect to 17 different systems, they don't really care which packages they're installing on your machine behind the scenes. It's not looking at whether any of those packages are malicious or not; they don't care; their job is to give you what you asked for, nothing more, nothing less. How that happens is really a jaw-dropping moment, when people realize how much is actually being installed just by you asking a machine a simple question. On the new side, the AI side of the world, you could say that the risk is in code, or the risk is in a browser by somebody putting something into a prompt, and I'm not disagreeing with that. That, to me, is like a DLP problem that's been around for a long time. It's just a different vessel. It’s important, but what's really happening at the endpoint now is where the actual risk is, and that’s what the industry is still learning. It really is a jaw-dropping moment when we show our customers what they have installed on their machines.

I'll give you one quick example. We had one customer who we plugged Glow in, and we found over 60,000 unique pieces of software that they had in their environment. There's no way that humans can actually see what all that is. You put Mythos on top of that and think about the vulnerabilities that could be exposed. This is why prevention is so important, because even with the best detection and response in the world, the noise ratio that would come from something like this, combined with the new world we're entering at the same time, makes it impossible for people to think only about detection and response. I think it's definitely still needed, and it should be a safety net, but we must lean hard into prevention, or else we're just never going to be able to keep up.

Cyber Security Tribe: Back to Glow, you guys emerged from stealth with incredible momentum. You've got strong leadership, you had significant funding, and there's been a lot of industry attention. What was it about the vision of Glow that resonated so strongly with investors, customers, and the industry as a whole?

Emily Heath: First of all, we are very humbled by it, and believe me, we do not take it lightly. There's a responsibility that comes with that. There's a responsibility that comes with these crazy valuations, and that's not anything we take lightly. Having been in the industry for a long time, we all take this as our reputation as well. So, what we're building, we genuinely want to solve meaningful problems, and I think what the industry saw and what the investors saw is detection and response alone not being enough. Allowing people to enable their users, their employees, and their businesses to run toward AI and not away from it. You need to be able to do that, but you have to be able to do it safely. Companies know they'll get left in the dust if they're not embracing AI. So, as technologists, we need to be able to give them ways to do that and have them do that safely. I always say, if you're using any AI on your endpoint, you need Glow, because we're the ones that can actually protect you and enable you to go do that. I think that the industry is seeing this shift, and the investors see a massive opportunity in the market. We're very fortunate that it's not just the founding team that's been around the block a few times, but also the incredible people; we’ve got over 100 people in our team who have incredible backgrounds. We’ve also got quite a few practitioners sprinkled in there as well, so it’s not ‘old’ me who’s been around the block a few times, we've got people who've been in the seat who can help us shape a product that is meaningful. We keep a very close ear on the market because you might think that you've got the right idea, but there’s tremendous value as you listen and absorb the feedback, good, bad, or ugly, that people give. I was a CISO in certain industries, but you talk to other CISOs who think completely differently because their business model is different.

Cyber Security Tribe: When you look at security vendors, what do you think separates those that become trusted partners from those that are just another tool in the stack.

Emily Heath: First of all, and again, I'll come back to the feel-good factor. People want to work with people who they like. CISOs and security leaders are not sure of technology to go buy, there's lots of technology and there’s no short of that, but first and foremost, relationships are more important than ever, especially in this post-COVID world, when we're all sitting behind screens all the time, and remote work is now the predominant theme for everybody. Human connection is still needed and getting out and meeting people and sharing a cup of coffee or a cup of tea with them, a dinner or whatever it is, is really meaningful.

Secondly, people don't want just another point solution; I don't know a single CISO who's got more money and more people. Everybody has more responsibility, less money, and less people, and is challenged to do it even more efficiently. You must think beyond being a point solution, and that's why I say, for us, we're thinking about breadth, not just putting a ring fence around AI, we're talking about the old world as well. We've got the breadth, and then also the depth. And the depth for us is not just giving you visibility and giving you great context into things but being able to remediate and do the work for you. This is, what I think, differentiating from companies that will be short-lived, and companies that will embed into the day-to-day workflow. You have to play nice in the stack, you can't be selfish with your data, and you have to integrate it with everybody else.

I always say I like to be reasonable and practical. I've been in the seat, I know what it feels like, and you want really, really strong, solid solutions that grow with you, but have a breadth and a depth to them that is practical and shareable in your technology stack, not just something that solves one small slice of the pie.