Eva Benn Interview - Next 3 years

It's hard for me to predict what the next 3 years look like, but for sure we're going to see identic adoption really overpopulating the mainstream workflows across industries. And also, I think we're going to see an increase in identic used for both defense and offense. The future is not humans versus AI. I I really hate when people frame it this way. The humans and the the future is AI with humans who haven't forgotten to be humans and still think critically. Why I said that the humans are still the best defense is because we are the ones that have the ingenuity. We're the ones that see the bigger picture. As any other technology, we need to embrace and the fancy

defense in depth mindset, okay? So, what it means is as humans obviously we can implement technical guardrails at the different layers of the system. At the model layer, at the application layer, at the data layer, we can implement technical guardrails. From the human layer, we can implement human in the loop. We can also reinforce good judgment by security training. But none of these controls on their own are sufficient. I think that we need to think about there's we need to acknowledge that there is the possibility of error. And I think especially for critical decisions, humans in the loop is something we need to think about. It's up to us to have to first understand our ecosystem, to

understand where are the critical decisions made. Are they made autonomously? I mean, I don't know if you're remembering my keynote, I did talk about agents installing skills and transferring crypto funds without any confirmation, right? That's to me is pretty critical, but it's not like there's no human life involved, right? There are agentic systems and the rule agentic systems would make a decision. Decisions that could impact real life. And I think these are really the use cases that we need to be concerned a lot. The AI systems that we know today are no longer just summarizing text. We've got you know, systems that are quite literally evaluating somebody from for a loan, right? I mean, like one mistake

could certainly result into somebody's life-altering situation and it's very hard for individuals or small businesses to dispute that. I think big organizations can absorb that kind of risk because they do have the means to actually, you know, to go back and dispute that. But I think that we need to be very careful when it comes to downstream impact. I think from my talk, what I would like people to realize is that we're no longer dealing with just traditional human social engineering. That is still very much a problem, but we now have social engineering at machine speed to machines, from machines, and machines to machine. Okay? So, we've got much larger attack surface with new attack

vectors that we've never had to deal with before. So, I think that when I go back to my organization today, I want to know where are these decision points where these interactions could happen and what controls do I have? What layered controls do I have to think about these new risks? One thing that I didn't mention in my talk was that a lot of these deep relationships start off by people using AI's productivity tools and then that end up evolving into intimacy. So, we need to just make sure that we layer education, technical controls, awareness, as well as emotional regulation. We don't have all the answers. We don't even have all the questions yet, but what we do know

is that the people here and the people from the cybersecurity community coming together are the ones that are going to shape how we approach the new social engineering era. >> Awesome. Thank you so much for being here. >> Thank you so much for having me. >> Awesome.