A Conversation With Matt Muller From Tines

an alert. They have to go research that alert in a whole bunch of different places. Uh, and, you know, take a number of manual steps just to decide if that's a true positive, right. They have to do work just to decide if they have to do work. Um, which is an enormously frustrating place to be. And so they were looking out on the market for some kind of automation tool, uh, that could help them ease that burden and not seeing one that they wanted. They ended

up building Tynes. Uh, and, you know, starting out sort of first and foremost as this tool to solve a lot of the SoC, uh, problems around, you know, inefficient, uh, you know, alert management and, you know, burnout and all those sorts of things. And what we've discovered over time, which I think has been really cool, is that the SOC is not the only team in cybersecurity that needs automation, right?

Turns out there's inefficiencies everywhere. Um, another really fascinating thing that we've that we've learned over the years, uh, is that, uh, automation is actually a lot easier than I think a lot of people give it credit. Right? Like a lot of traditional automation tools, required learning Python, learning coding languages, having very, very deep systems knowledge in order to be able to get automation done. Um, and so with the rise of AI, what we're seeing is, you know, people

that have automation ideas, right? Like, I think if you ask almost anyone, they have ideas about how they can make their job easier, right? They just haven't in the past necessarily been able to express that. Um, and now with, with tools like, I like no code. Uh, no code. Workflow builders, these folks are able to, you know, build

those automations like like they haven't before. Um, so, yeah, I would say the pain point that that Tignes has been trying to solve is, you know, everybody who has ever had to, you know, push a file from point A to point B manually has a pain that Tignes is, is trying to solve.

And so, you know, again, what we see is, you know, these these people that are experts, they free up all this time. Great. Maybe I know exactly what I want to do in AWS, but we just acquired a company that has a GCP environment. Um, and now I have to learn an entirely new, different cloud provider. Right. And

I'm just not going to be as good in that. Yeah. Um, and that's where I think AI tooling has been really, really helpful, uh, to make that context switching less of a cognitive load for people.

So the time that it would have taken them to find our mistake goes from like days or hours to like maybe minutes. And so we have to be doing something on the defense side to counter that.

And so there was a lot of concern that I was going to invent all these brand new kinds of attacks. And that really hasn't happened. Right. Instead, what we're seeing is attackers are using AI much the same way defenders are. Hey, make my email sound a little better, right? Um, you know, uh, make my phishing page, uh, you know, generate 14 different varieties of landing page for me. Um, and so where we're seeing attackers start to use AI a lot more

to your point, is increasing their velocity, right? Um, and so to my mind, you know, again, as defenders, you know, there's only so much time and attention that you can that you can afford to put into problems. Um, let's not worry about, you know, types of attacks that haven't been invented yet, right? Let's worry about the ones that are occurring today and how those are evolving. Um, you know, our our security teams, uh, can really build defenses against

attacks that don't exist yet. Um, but we can sort of see how those attacks are becoming faster. Right? How, uh, the the, you know, the translations are becoming better and better. Uh, and so the bar for fooling our employees is, is getting lower. Um, it means we need to be able to react faster. Uh, we need to be able to react, uh, in a more, uh, you know, we need to be able to adapt a little bit better, right? Like, we

can't just apply rigid playbooks to every single security scenario. Um, and so, you know, to me, it's a little bit of an AI arms race. Um, and, you know, I think for us as, as defenders, in my view, applying AI in the places where attackers are also applying it, that seems to make, you know, make the most sense, at least today, right, with today's models. And that that answer could change in, you know, three days, right, when some new foundation model gets released that, uh, that changes

the game. But at least with today's models, I think that's that's where I sort of see things evolving right now.

they going to do something about it. And like these basic workflows are like everything. And if you look at like a ciso's job, it's managing the budget. It's managing this basic workflow of like logs and processing and, you know, uh, workflows coming through the security operations. Um, and it's politics and stuff like that. And it's like, it's not hacker movies. It's really just these fundamentals that we have to do more consistently and at scale. Um, so I really like

that point. What do you see as like the, the biggest challenges for CISOs right now?

really trying to enable the business. Um, we definitely saw, you know, when when, you know, for like ChatGPT first launched, for example, there was some team of no, uh, mentality there, right? And what happened? Every single employee just worked around the constraints that the security team tried to throw up. Um, and so now what we see are CISOs starting to, you know, I think the CISOs that are that I see that are least stressed about AI are the ones

that have, you know, started to adopt frameworks around usage, right? Helping, you know, not just setting barriers for their organization, um, but working with them to understand, like, hey, what are the risks that we're taking on, right? And like, honestly, even just showing where AI doesn't necessarily succeed as well today. Right? It's not saying no, you can't use it. It's actually working to demonstrate. Okay, this use case seems interesting, but

may not actually be the most helpful output, right? We're actually, you know, if we have a chatbot, can it be fooled into giving away free airline tickets, for example? Right. Um, yeah. Uh, and will that be held up in court? Answer is yes. Uh, so, you know, I think when it comes to securing AI for the business, um, you know, it's it's been actually almost a little bit refreshing to see CISOs adapting more quickly,

I think, than they have to to other technology stacks. Um, and sort of saying like, hey, this is our this is our next big frontier chance to serve as a trusted advisor to the business, right? Like, we can reset a little bit on, on some of the other, you know, technology shifts and and just say like, right, we're we're now helping the business, uh, and helping the business understand what and when and where it wants to take on risk. Um, when it comes to applying security within or applying AI

within the security organization. That's where I think there's going to be a very interesting balance. One of the things that we're starting to hear now is that boards are mandating that teams within an organization figure out how to use AI. And, you know, when it comes to cybersecurity defense, AI is useful for a lot of different scenarios, but

not necessarily every scenario. Right. You have to balance the fact it's, you know, I sort of, you know, if you're if you're building the plane while flying it, you have to make sure a wing doesn't fall off when you're adding, adding a different technology. Right. And so I think for CISOs who are, who are adapting AI for cybersecurity defense, I think that's going to be a really interesting sort of balance to strike of saying, yes, we

need to go experiment with AI. We need to go figure out where it's useful for us, but also recognize that the consequences if you know, if AI fails for defense, it may be a little higher stakes, right? Because now we're talking about actual like, you know, data protection, right.

And potential data breach issues. Um, and so I do think that CISOs have their work cut out for them, uh, you know, in that regard, uh, when they when they have to go be the ones that are applying and using AI versus setting guidelines for other teams.

some of the grunt work that teams have to do. Um, you know, again, I don't think most people at this point are seriously contemplating replacing the bulk of their staff with AI. You know, it's it's, you know, it's a fear that certainly has been heard and talked about a lot. But I think the reality is the focus now is, hey, give your, your team access to these tools. Um, see what they can do. Right. See if they can increase their,

their own efficiency here. Um, and so to me, what this translates to is we will ultimately be more effective as a business, not necessarily by replacing our staff, but by making it so that, you know, their individual productivity, uh, extends a little bit further. Right. Um, or, um, you know, another lens of this is we know that the business of doing business inherently involves a lot of toil. What

would our designers what would our security professionals? What would our HR people be doing, uh, if they weren't just, you know, sort of doing daily, daily document processing tasks, right? Like what creativity could we unlock for the organization? Um, so I think it's it's fair, honestly, for boards to, for boards to push companies on these things. Um, yeah. I think the only failure mode is if they say

you must adopt AI. No exceptions. Uh, even if you find a use case that models today's models aren't necessarily ready for yet, right? Like that could be the the only danger there.

a no code workflow builder. Um, we took a look at some of the early AI pushes, and we ended up with something like 50 failed experiments, uh, to integrate AI into our platform because we didn't just want it to be yet another chatbot, right? That looks cool as demoware, but doesn't actually add any value for anybody. Um, it requires some thoughtfulness to make sure that, you know, you can't just slap AI on something and say, oh, great,

this is now a better product, right? Like, it actually requires deep thought and integration to make AI useful.

integrations we built was, uh, we called it an automatic transform. Um, and basically what this was, is, you know, a lot of what people use times workflows for is to, you know, take data from one system, transform or manipulate it in some way, and then move it into another system automatically. Um, and, you know, if you don't want to learn the necessary, like all the ins and outs of some arcane like JSON schema. It turns out AI is actually really good

to understand. You know, given a JSON input you tell AI. I would like to extract these four fields, transform the data in this way, and then output it in this format. Um, and so the first, you know, so one of the first integrations we built was this was this automatic transform where I would actually, uh, generate Python. Um, and uh, you know, so now your workflow, it still looks like the same, you know, deterministic workflow that you built by

hand before. But now you've got one additional piece here that you didn't have to build by hand. Um, you're still having you know, Python is deterministic, right? If you give the same input to a function, it'll produce the same output. Um, and, you know, so we, we balanced the kind of what we saw as the best of both worlds there where, yes, you don't have to write that Python. You don't even have to know, like what

Python does. You just need to validate that when you put out, you put the input in, you get the output that you expect. And so, you know, for teams that are sort of nervous about integrating AI or uh, maybe really early in their their maturity journey, we wanted to give them a first step. Right. Something that had a lot of guardrails on it that was safe to

play around with. Um, we also have the ability to just integrate, uh, a straight up AI prompt, uh, into into your workflows as well, um, where, you know, if you're maybe more comfortable with, you know, prompt engineering or using those sorts of things, um, you could actually then go, uh, you know, give it almost any input you wanted and get any output you wanted structured, unstructured and so on and so forth. And then more recently we launched a

tool called workbench. Uh, and workbench is basically our way of addressing the fact that most chat tools are their best when they have access to your data. Right. Um, there's this inherent tension between, uh, sending your most sensitive business contextual information, uh, to a third party vendor, um, and also making sure that AI is useful for you.

So when we launched workbench, uh, we made sure that the AI models that we were using were actually completely private, uh, to the, you know, the tenant that was running them, right? There was no logging of the data. There was no sending the data across the internet. Um, and it enabled teams that had previously had constraints around sending data to third parties be able to say, oh, right now I can actually connect my uh, my AI models to the tools that I use, uh, in a way that's safe

in a way that complies with my policies. Um, and now we can finally take advantage of that true combination like that, that that ideal combination of large language models that have the context, that have the business data and feel good about it.

that we see. And often it's simply, you know, somebody impersonating your CEO or impersonating somebody at your organization. And, you know, I mean, I get these all the time from from the times CEO, allegedly. Right. Saying, hey, Matt. Right. It is me, your CEO. Uh, please provide your phone number to me. Right. And they're they're looking for for additional context there. Um, and it turns out that's a really hard problem for traditional tools to be able to solve.

A human can look at that message and sort of instinctively understand that this is phishing, right? Your tier one SoC analyst can look at that and be like, oh, right. That's that's obviously not the CEO. But how do you explain that to code? Right. How do you explain that to a very strict workflow tool? Because asking for a phone number is something people do all the time, right? It's the context of this conversation, uh, that results in that not being, you know, it results in it being

malicious versus versus benign. And large language models, of course, are pretty darn good at understanding intent, understanding, you know, the nuances of some of those things. Um, and so for security operations teams that would get, you know, reports of phishing that they would have to go analyze. Um, you know, there was a certain bulk of them that had to be done by humans just because, like, the rules that they set just couldn't catch them, particularly in

the Bec case. And so now what we're seeing is, you know, these AI analysis tools are being able to, you know, you can use them for a verdict. Um, or you can just say, hey, I actually want you to extract the intent of this message, and I'll combine that with some other signals that I have, right? Like mix and match AI and, you know, maybe a threat research or a threat intelligence database that I have to say, oh, this sender is actually in our database, as you know,

being potentially risky. Uh, combine that with, uh, you know, the intent of this message being asking for contact information and now you instantly have not just a yes, this is malicious verdict. You also have insight into the intent of the threat actor. Right. And um, with workbench in particular,

This is where analysts can now iterate on that. Right. And, you know, going back to like what would you do with the additional time that you can that you can save now they're able to, you know, pivot into additional investigation, right. And say, okay, if I know this was the attacker's intent, what else can I learn about the attacker? What else? You know, what else would this attack look like? Right. Maybe, you know, maybe we received this one report. What would

it look like if it had succeeded with a different user? Right. And can I go investigate that now? So, so much less time spent on triage, more time actually spent asking the questions of like, who is attacking me? What can I do about it? How do we know that we're safe, right? And moving beyond to the things that actually require some some human thought and creativity?

you got to focus. But, um, quality checks and security checks, you kind of have the same sort of vibe. You have things coming in and you're moving through a set of steps for checking, for validation, for quality, for whatever you could do. And if you add AI to that, you could have like judgment in there at any of those steps. So, I mean, um, it seems like you're

very much focused on security. Um, but are you seeing people use it for, um, more like broad use cases, like quality and stuff like that, because, I mean, this is everywhere in it. It's everywhere in business. This is just business in general needs these sort of workflows at scale?

you know, just managing those, those pipelines, everything from, um. Hey, what do we expect this log source, uh, to be, you know, like, producing, right? Like, do we actually, you know, uh, AWS, uh, loves to subtly change the shape of CloudTrail logs.

around hot and cold. Uh, you know, data stacks. Right. And like, you know, in the context, you know, of doing, for example, a security investigation, um, you know, you may only have 30 days worth of logs that are that are like hot, hot, right? And, like, actively accessible. And, you know, you have all the rest in Amazon S3. And, um, you know, you need to be able to pull them. This is something where tines can help make that retrieval process, uh,

and rehydration process a lot more, a lot more simple. Um, and so yeah, we're absolutely seeing people using tines as sort of, you know, the meta orchestration and monitoring layer on top of these data pipelines that they're building because, uh, yeah, at the end of the day, you know, there's the number of people that have data pipelines that don't have a data engineering team is a lot larger than, uh, yeah, the teams that do, unfortunately. Right.

that sort of stuff. Um, but then when you are actually producing, reporting, uh, there's a lot of different consumers of that, some of whom are human and want a PDF and some of whom are computers and can't read a PDF, right. Uh, and so being able to use these capabilities to produce multiple different kinds of, you know, intelligence distribution, I think has been a really to me, that was sort of an unexpected but really fascinating use case to see, um, of like, oh, right. It's not

just about reading data, right? It's about producing the data that our, you know, translation of data. Really, uh, for for the right audience. Um, so.

everyone thinks, right? Like you still, as the human, are putting your creativity into this report and developing the nuance and understanding, and then AI is helping you translate that into a different context.

data and most importantly, your other tines, workflows. Um, and so the way we're seeing people now start to use workbench, uh, is, you know, sort of almost like dipping in and out of using deterministic automation and also using a chat interface for their, for their analyst. So in an incident, um, you know, an analyst may go into workbench and say, I received this alert, please analyze it, recommend some next

steps for me. Right. And one of those next steps might be, you know, this account looks like it's been compromised. You should probably lock this account. And you say okay, great. Uh, workbench allows you to trigger other workflows that have been built within tines. And so I don't have to worry about I maybe hallucinating the endpoint, uh, of our identity provider. Right. Or, uh, mistaking, you know, like, if, you know, there's a bunch of other people in tines named Matt, I don't have to

worry that it's going to grab the wrong Matt. Right? Like I can actually delegate that task to a deterministic workflow, and then it comes back to workbench.

a co-pilot sort of use case. Um, one of the things we're really excited right now is excited about right now is, uh, you know, some of the agentic AI capabilities that, um, you know, we're we're starting to see some, uh,

people using tines for sort of basic agentic AI stuff. Um, and, you know, in the same way that we didn't necessarily want to rush and be the first people to integrate a chat interface just to say we had AI Agentic AI, I think has had, uh, maybe an evolution, uh, in terms of our understanding of what an AI agent actually is, right?

And what constitutes agentic AI and so on and so forth. Um, and now that these have more stable definitions, uh, we're investing in figuring out what agentic AI looks like when it comes to tines as well. So that's something that, uh, I, you know, we're, we're starting to get some internal sneak peeks on, uh, and it's, uh, it's pretty exciting.

We dealt with incidents, um, you know, and, uh, you know, got got attacked all the time. So, um, let's imagine here that I, you know, have received reports that the domain Coinbase is, is phishing. And I'm looking to learn more. Um, can you tell me if Coinbase So.com is phishing. And it'll think for a second. But you'll notice here that because we are only talking to the LLM, it gives us a fairly generic answer, right? I don't have any specific information. Um, and so because.

is URL scan. Um, and so now, rather than just giving me a generic answer, it's actually going to use, uh, URL scan. Um, and because it's searched for URL scan and found a result, it actually knows to then retrieve that result as well. It's kicking these things off automatically because these are read only actions, right? Like no system is going to change because, uh, you know, because it

called these tools. Um, we also have the ability, you know, if there's a, you know, a write action or a, you know, potentially destructive action, it'll ask you to confirm, uh, before before it takes that action. But these are read only, right? And so now that we've pulled back, uh, some URL scan results, we can officially confirm that this is a phishing site, right? With the most up to date data. Um, and, you know, if you've been on URL, scan, com, you

know that there's a lot of data that they pull back. Um, and this sort of provides this very quick, uh, insight into URL scan. Um, and so, you know, this is this is something where, you know, security teams, uh, in the past, if they wanted to use all of these different tools, uh, they had kind of one of two choices. They could either have a lot of different panes of glass open, uh, or they could, you know, sort of do like a one time enrichment into, you know, a

case that came in. Right? Um, I may not know ahead of time what tool I want to use in order to investigate something. Uh, and so what workbench lets us do is say, okay, now, you know, we can pick some of the tools that are, you know, tools that are at our disposal, get the latest data. Um, and, uh, you know, ultimately, uh, you know, get that sort of much more dynamic, uh, you know, uh, interface without without ever having to leave workbench.

when it comes to chat assistance, right? Like, you can get the, uh, validated data from the latest, uh, trusted data sources. Um, you don't have to know any of the technical details behind it. You remain in full control over what sources are connected, when actions are taken, and so on and so forth. Um, but ultimately, you know, it just sort of removes that cognitive burden of having to, you know, contact switch between a bunch of different systems.

is coming very, very soon here. Um, and then, you know, the other thing, uh, and, you know, if I look at here at this, uh, workbench builder or, excuse me, this story builder, uh, tab, um, right now we have an AI action that includes just a prompt right where I can maybe generate some some output. Um, as we start looking, uh, you know, over the next few months at how agentic, I, uh, you know, interfaces with, uh, both traditional workflows as well as, you know, uh, copilot

chat workflows. Um, this is going to, uh, this is going to evolve, and, uh, I'll leave, uh, I'll leave the tease, uh, at, uh, you know, at, uh, you know, saying that there's going to be more than just workbench, uh, for sure, uh, over the next few months when it comes to AI.

I actually use for personal stuff outside of work as well. Um, we've had people use their, uh, tenants to actually, uh, build to do a fantasy football draft, which I thought was interesting. Um, and, uh, yeah, we want people to be able to experience, uh, you know, experience, uh, what's, uh, you know what? All we're building.