Good morning, my friends. Pretty incredible to see
everybody here and and on behalf of everybody
at recorded future. Thank you for making it here. We have people who have
traveled from afar, and we've traveled when people
have traveled through the London traffic, which
I'm sure could be equally exciting. So I'm the co founder
and CEO of recorder Future. As you can imagine, this is sort of the day of
the year for us when when we sort of get to interact with you
guys that we sort of otherwise all
kinds of different places
a part of, around the world, but being in a room
together, it's quite special, quite special. So, in this room, we have
some incredible people from across intelligence, across security, cyber
security, of course, We've got journalists,
we've got analysts, we've got we've got a
lot of smart people here. So I think we're gonna have a
lot of good chances to both in this room, but also
out in the breaks. To have some
some pretty incredible discussion. So that makes me super
excited. And and please, as part
of that, gonna really do that. Interact with the people you
don't interact with on an everyday basis and and
grab those recorded future people that you see. And ask
us the most difficult questions and and challenges you can you
can put in front of us. The, I want to sort of start
off by saying thank you. For, for, the work you do. Obviously, we're all trying to use
intelligence in clever and ingenious ways. To try to
secure the world. But, you know, really thank
you for the work
you do as as part of that. So That is for sure something
that that we feel every day, and, and thank you. I'll be talking about
securing the world with intelligence. And I think maybe the part
that sort of really stands out here for me in this age or this
this day and age here, which the prior
speaker spoke about, how artificial intelligence
is influencing all of this. I sort of put it
this way to reimagine intelligence in the
age of artificial intelligence. The guys that the c
ompany was
making fun of me for not being able to spelled the
word, re imagining. So now I'm all messed up on
how to even say it. But that said, I do like the word because I do
think that we as we think about intelligence, Imagine just like
even, you know, we're already seeing a glimpse
of where this is going, but assume and imagine that
we have incredible artificial intelligence in front of us
What does that make intelligence? What does that make
intelligence in itself? Does the adversary win
o
r do the good guys win? There's a lot to
sort of unpack that. And I hope I'm unpack there, and I hope that this
conference will be, have a good chance of
sort of, you know, get, get your brains going in
some, some good ways of that. Our very good
friend, Micahirov. He's, vice prime minister of Ukraine
that sort of owns a lot of their cyber and, and IT and,
and just like a broad remit there. He's sort of an
up and coming ricer in, in the government. In Ukraine, again, really good friend
of record
of Future. He tweets here about, the
army of drones that's his sort of making, I guess, It's sending to the front line,
almost two thousand, blah, blah, drones here. These drones are
equipped with AI. Which automatically detects and
tracks targets. And, you know, at some level, after two years,
we're like, no, no big deal. It's like drone equipped
drones equipped with AI, and they're gonna go killed
not so smart Russian tanks. And, you know, but,
man, five years ago, this would have sounded
pre
tty wild. Wouldn't it? And and it sort of tells us
I think where the world is going, and and it's it's gonna
happen fast in front of us. And and let alone the fact that
you look at these and they look like they're out of some
Star Wars movie or something. That's that's the other part. The the And then on
top of that, when this government official is tweeting this, he's sort of doing psi ops
at the same time versus an adversary. So this sort of mix, and I'll come back and talk
more about this sor
t of mix of of different types of warfare that
I think we have going on in in in front of us. So
pretty, pretty interesting. For sure, we are in this
sort of AI frenzy here. And and I liked it when Time
magazine sort of put all of this in front of us, and and instead of talking
about the most clever algorithm, they put up
the people behind it. And I think that's compelling because
it there is a risk that we get too excited about AI
in the sense that It's about the algorithms? No. It's people. We
're shaping it. We we're proud of record future
to be part about shaping our little part of this.
And it's people. It's humans. It's all you. And and let's not forget
that because I think otherwise we might take us we might even
help taking it to a, to a place, which is not so great. But it is interesting when you
put this versus sort of the backdrop of what's going
on in the world, where I sort of and and I'll
take it two different ways. So last year, when I was here, I think I talked about sor
t
of the this theme that I've been on to, that the world is
slowly migrating on to the internet. And over the next
twenty five years, we can expect the world to
sort of become a reflection of the internet, be it sort
of profound parts of the, of of society being at
power and currency and democracy and identity. And
when these things, reflect off the internet onto
society and off onto the world, we're in for a ride. And and if you take
that plus the geopolitical tensions we we're seeing in the wo
rld,
it could get pretty interesting. Just pretty interesting in
some ways that I don't think we really have understood yet. And
I also think that, you know, so even just a month ago, when I started putting together my
about what I wanted to talk about here. I was like, okay. So geopolitical
tensions are high. But it's probably not much
higher than it was a year ago. But now, obviously, after the last month with
what's going on in the Middle East and in Israel and Gaza, things are at a whole
dif
ferent level. And you yet another Tinder box
that that's on fire, and it it's getting pretty
uncomfortable. We'll come back and
talk about that. Alright. So, this spring, I had the chance to to take
the long train ride to Kiev, to meet our friends there. We have a large deployment
of recorded future in Ukraine. And, you know,
for the, you know, sort of with my own eyes to
be able to see very, very, very far from any front lines,
but still having the chance to, to see how a country had
been, you
know, invaded brutally by a dictator who more
or less woke up one morning and said, I want that country.
I want to take it over. And and the way that
that went about, and we've talked for years
at recorded future about this idea that we're gonna see a
confluence or a convergence, maybe it's the better word,
of of cyber and geopolitics and disinformation. And here, it really became a convergence
of war and cyber and disinformation. And now seeing the same
thing repeated in Israel and Gaza, It is
just pretty sort of
amazing and the sort of a school book example of where, where that sort of
convergence was going. So they're in oh, let me
see. There we go. So so again, we've been lucky being able
to work with something credible people in Ukraine on the left.
We have the guys from the SB. You might have seen
Ili of the Took, the guy on the right in
that picture to the left. Incredible mountain in,
in, in cyber on the right. We have their national
cyber directorate, and there's a whole bunch
of other authorities They've sort of also quickly just like
many other countries in the west ended up with many
cyber authorities. So it's a little
bit to navigate. But we've had a good chance
to work with them on some pretty incredible stuff. You might have seen this
piece where we worked with on taking down this blue delta, infrastructure that was targeting a
set of let's call it, communications infrastructure
both for the government, as well as the military.
And, obviously, this sort of stuf
f
is very identifying. This one was in particular
satisfying because it used a particular part of our sourcing
that we're very proud of, and it sort of was able to
sort of get to something that the Ukraine Indians had not been able
to see on their end, and then when we dove
into collaboration that happened across like, some five days or
something like that, where the data sharing was going
on in a way that I've never seen in any country where
recorded future has a good luck work in many countrie
s
around the world, and everybody's always
talking about public private information sharing, and it seems like it's
like moving in glue. But here, where where things
are happening at a pace of, I guess it's the pace of
war. But, you know, pretty incredible, and you might
have seen this also here. But but which was sort of
the of the official report cover of that. But to be honest,
that part is interesting, and it's, you know, when we we are
part of doing the work, The part that it really
has bee
n sort of compelling, I think, in Ukraine is how
we've been able to equip hundreds, not thousands, but hundreds
of of cyber professionals, intelligence people, both in
military and civilian agencies, as well as critical
infrastructure, So equipping hundreds of people
would record a future and and just seeing their work that
they're they're able to do. So very, very, you know,
compelling and And it is good. It's good for everybody in this
room too because as they're doing that, when they're uploa
ding malware
or when they are finding correlations on those data points come back to
record a future through. I'll talk more about that,
our collective insights set up, and you benefit of from
that. So, you know, some some real goodness there. And I think that this invasion
here demonstrated to all of us that we'd live in a new
world, and where it is just very, very interconnected in a way that
I sort of think might have sort of been surprising to to
many And and if you think about it, sort of,
whether
it's sort of companies, you know, there are
supply chains around the world, be it sort of, IT outsourcing that reaching
to places that you might be surprised about food shipments,
supply chain brit large, all kinds of
interesting angles, companies doing business in
Russia unwillingly or willingly seeing their goods
showing up in in Russia. All kinds of inter things.
And it's led, we we can notice this. It's led management teams
or boardrooms to start asking geopolitical questions
in a wa
y that I, at least for as long
as I've done this, which now adds up to a bunch
of years, have never seen. And I think probably true for
many people here in the room, that geopolitics have sort of
suddenly become a core part of cyber, which is, you know,
very, very interesting. I'm a big fan of this picture
because it sort of shows this interconnective interconnectivity between the world and the
internet. And, and, and, again, this point that I was making
about slowly the world sort of migrating
on onto the internet. And I think we're sort of
seeing maybe three things in all of this that are
particularly interesting or, I don't know, compelling,
maybe compelling, but depending on
how you look at it. So take a company like Record
Future where I like to say that, you know, we have a
lot of compute in our hands. We we take in a lot of
data, and we process a lot of data. We do a lot of things with
it. So we're a lot of compute, on our on our hands. But at
the same time, we own just about ze
ro servers. We own no, no servers. Probably
not really true. I'm sure of our engineers in the room
will say, we do own a server, you know, whatever. More or less. And and it
sort of pretty telling that be it sort of the business systems or
the technical systems, what have you, are of of all organizations are
just being spread across the internet. Maybe I can say spread as
marmite instead of spread as peanut butter here being in
England. And and sort of, as that's happening, for sure,
we, we star
ted seeing this. Everybody always
talks about, you know, stronger than your
most vulnerable part. And this is happening in in
an an incredible fashion. Number two, these parts
as they're being spread out, We do have a chance of
collecting data from them. So, so that's compelling.
That, that's exciting. And, and I think what we're gonna
see here is sort of Instead of receiving security alerts from
these systems as they're gonna be spread out, we need to sort of switch
to a mindset We're we're act
ually collecting data. Data in a way the
data streams data points, what have you. And where we can actually think
about this as something that we can do math on. You
call it math stats, analytics, AI, whatever you want to call
it, it doesn't really matter. But it can't be any
more about consuming alerts and people sitting clicking on alerts. We're gonna transform
this into math, and I'll just use that word
without being pretentious about it And I think it actually
promises sort of a world where
that math can be used
for both analysis. It can drive automation But
maybe that math on on what we're collecting could
actually become controls, security controls themselves
in in them, in themselves. Pretty exciting, I think. So Hopefully, we'll be able
to keep that discussion. And then thirdly, of course, the the sort of the third
observation here ends up being that in this sort of world
where everything is spread out across the internet, spread out
as Marmite, again, if you want. In in that w
orld, we, we're
sort of seeing the, the difference between what's
inside and outside just sort of goes away. There is, you know, the idea that there is a
hard firewall between my the inside of my company, and the outside
goes away. So now till internal telemetry and external data
collection intelligence, the difference might go
away. And, and, you know, I'll come back and talk a
little bit more about that here today. And and I would love to sort
of have any discussions in the hallways around tha
t. Because I think that that takes
us to a very interesting place. Now the good news in all
of this is, of course, that, the internet in itself,
it might be complicated. It might be spread out in
all these different places. But the good news is we
can collect data from it. And and that was obviously the
sort of the the very reason we started recording future back
in in depending on how you count two thousand seven or
two thousand nine or, you know, whatever you want. A long time
ago, in a galaxy
very far away, we started the company, it
was sort of the, if you want, that we could collect data
from the internet originally from what was sort of
written at the top, and then every year drilling
further and further down. And and there is a promise
there to be able to do something very, very good. The internet is sort of
becoming the sensor of of of things, which is quite,
quite compelling. So Now, again, remember that I said the
theme for the conference is securing tomorrow, the future
of i
ntelligence. So let me talk a little bit
about where we're going. Sort of set the stage for
a few things here today. And then we're gonna have
a couple of sessions, here this morning and and on
sort of more detailed product roadmap. But I wanted to sort of
lay out some points here. And and in general, I think we're both have been
lucky at recorded future, but also are quite proud about
how it's worked out for us to be able to, I call it
just produce new stuff. Maybe I should
call it innovate, bu
t I don't sort of cringe
on that word always, but, just, you know, cook up new stuff.
And, and in many ways, we did some good sort of architectural choices
that record a future way back. We were, you know, we got on some good bandwagon
in two thousand and nine. I'm sure there would have been
good ways to end up on the wrong bandwagon as well. But when you interact
with recorded future, at the core is our
intelligence graph. That's where we are trying
to connect the world. So Here are these
threa
t actors, be it criminals or nation
states or activists. Here are the tool sets
that they're using. The TTPs they're trying
to take advantage of. Here are the vulnerabilities
that they're, you know, taking advantage of. This is the infrastructure
they're running. This is the communicate
these are the communication patterns we can observe in
network intelligence from these bad guys operating
the said sort of, command and control
infrastructure and have you. And then finally, here are the potentia
l
targets they're going after. Here are the companies. We
mapped out five million companies. We would like to think that
we have pretty good handle and what are the IP space and
the domains and the products running at these companies. In that graph, in which we don't necessarily talk
a whole lot about it, quarter future, but that is sort of
the underpinning of everything. And, and, yeah, maybe we should
talk more about it. But The key point maybe is
that the way that we get to that is sort of tw
o things. We
built an API on that, and you, you guys have access to that, and sometimes we do hard
built sort of integrations, be it splunk and the
like that builds on that. And when you access that
graph, through our API. It's the same APIs that we
use, powerful choice where we sort of make that symmetrical. We'll come back and talk more
about collective insights, which is sort of how how
we're finding a new way of of building interesting data.
But then on top of that, whether it's recorded fut
ure AI
or the data visualizations you worked on for a long time
or worked with for a long time, or the playbooks is on
them feeding this into the various modules and applications, this all connects together in a way
where things can flow up and down. Now, some of the choices we made
here was was already back in two thousand and nine. We
thought about this as a graph, and there, you know, There's
other classes for sure of, of problems and, and, and companies where people
think about their problem
as a graph. But I think that is
the way to think about intelligence. We put this on AWS. It could've been another,
multi tenant architecture, but this fundamental idea
that Everybody in this room interacting with the recorded future
and beyond would be on the same instance. And
that was controversial. I remember in two thousand
twelve, two thousand thirteen, being both large
banks and government, clients of ours who would
be like, I will never, ever. And people use whenever it's
always exciting
when people say never, because never
is a long time. So they say, I will
never use some, you know, sort of a shared or multi
tenancy sort of cloud infrastructure and, you know,
low and behold, they did, eventually. And it sort
of built it, you know, in a very interesting way
that, in in that sort of way. The fact that we've sort of
built on elastic and a couple of other sort of core data
structures that we've sort of been able to build around, Another point to interesting
point is this pipeline
piece here and without getting
too much into it, recorded future originally sort of
consumed mostly text data in a bunch of different
languages. Now we consume everything from sort
of malware and in network sort of Netflow type data to
images to video So sort of truly, sort of from all kinds
of different data that goes through one
pipeline. And again, the choice there to think
about that is one pipeline. Ended up being
very, very powerful. And then maybe one more point
that I will make is that
being willing to then both think
about it as one big database, but than having specialized data
stores when we have data that is unique to a
particular domain. So this without, you know,
and and and in most cases, you don't even really you really
shouldn't even have to hear hear about all these details, but I think it's sort of
maybe compelling just to think about it as sort of like,
this is wide works. And so this year, there are sort of two things
that have sort of stood out in what we've been
doing. So, so one side is, of course,
on AI and, you know, be crazy if we weren't doing AI,
and we were, in fact, proud. So Stefan, where are
you sitting, here, stuff on my cofounder here, and our CTO, go talk to him.
He's the real smart guy, by the way, here. So,
the, the, so in, in, I think right at the, the
beginning of the year, like Jan three or something. He was like, we've
gotta get on this, these large language models and figure
out how we can put that to work. And I'm like,
okay. Let's
let's figure it out. And and, So we built this part
that many of you have seen where we can sort
of, in this case, post a query to record
a future and say, look, I want to know about
the Russian, black see fleet. And, and, but only
from Russian sources. And, you know, boom, the system writes an
intelligence report And I was hesitant to say that
in the beginning, but it it writes the report. It's sort of remarkable
that it does. And it does actually a pretty
good job. It footnotes to report. It
pulls in
the right images. It's tagged with entities, whether you click COM Black C
Fleet or FSB or what have you, or Sebastianpoll or
I can barely say. But, you know, you click
on any of these. You, you sort of can drill into the
data. In this idea that a large language model,
can write reports. And I think this is just
the beginning of that, is is pretty compelling. I was nervous about this. We put this out right
before the RSA conference, and we were proud because we
were sort of maybe the fi
rst to put, put out
something like this. And so I was a
little bit nervous about doing that because I worried that Intel
analysts would be like it's my job to write the reports.
Don't don't get into that. And but lo and behold, I
guess it turns out that, you know, we've done all this
work on collecting data, on processing data, and all
of those sort of things, and with the idea of
letting the analysts focus on analysis. But then the writing
part know, for sure. There are many analysts who who
wh
o wants to write and likes to write, but getting
help on this, especially when you're gonna
do quick turnaround things, turns out that there is a
room for for for AI there. I have no illusions that
the prime minister's daily brief for the PDB in the US is
gonna be written by a machine next five years or whatever. Again, no no illusions by that. But it is something
pretty compelling. And so that, that
was sort of step one, where you sort of summarize, and I guess it just turns
out that all his wo
rk would done over a long time. On collecting
data, you know, where we have decades of Russian hacker
forums and what have you, and you can just sort of
get the system to summarize it was was sort of a very
natural thing to go after. The second then is, and we'll be back up here
and talk more about that is how, so sort of won't do too
much with it, but where you instead say, look, can't we use
AI to interact with? Because many of you, you know, who are recorded future
users in the room, you know
, you might be like, oh,
it's too complicated. There's a lot of
clicks and da da da. It's just it's complicated
to get started. But so why wouldn't you be
able to just ask questions sort of like in natural language. And again,
it turns out there it is, and and we launched the first version
of this a couple of weeks ago. I'm sure some of you have
had your hands on that. It's still early. There's a
big beta sort of thing on it. So so we're sort of
being low key about it. But I think this is gonna
take us, first of all, just to make it sort of
easier to get started. But the other question here, and and I think about this as
sort of the This is maybe a what question. You know,
give me a summary. Like, computers have always been
very good about, like, this. Show me what, like, or a select statement in SQL
or whatever way wanna think about it. But I wanna ask questions
like, why is recorded future developing artificial
intelligence technology? Or what's the implication
of recorded future dev
eloping, or, you know, where you what
are the second order implications? Those are questions that
we typically haven't sort of pushed computers to do. My favorite example was when
Prigosin got shut down or whatever happened, bomb
shut down, you know, they were smoking too much
on the plane or whatever happened. The the but three hours
afterwards or two and a half hours afterwards, I asked to the
query to our AI, and I said, you know, what what are the implications
or second order implications of
Progyzian dying? And
And very rapidly, before anybody have written
long papers about it and so on, get a pretty
incredible answer back. In fact, this is actually
pretty good. Pretty good answer too. And then they, I actually suggest questions
for the potential risks of, putting AI chat bots
into intelligence. How are Microsoft and Google
competing against recorded future here? And what are the
implications of cyber vulnerabilities in, in putting that
in intelligence? So I don't know. I think, y
eah, you can hear my enthusiasm here
and it's it's it's it's pretty cool. So we'll see. We're being open minded
about where it takes us, and we'd love to hear your sort
of thoughts on on that as we, as we go through this
here, here today. The other side of
things, is on sourcing and collecting data. If you're
an intelligence, you know, you can imagine how this
referred to our data science team had this wonderful t shirt
at some point where it said, like, must have all the data.
And sort of the t
he mindset here at the recorded future
must have all the data. And and, I guess, as
long as it's legal, as maybe another sort of
add on to the, you know, just to does to be clear. But, so every year, you know,
look, we, as I said before, we start off with wood written
on the top of the internet. And then you have sort
of the whole messaging world telegram. We get like a hundred million telegram
posts every day into record a future. Dark web type stuff, you know, all the stuff that was
written in
many different languages that made it sense, all the
machine data, malware, DNS, Net flow, these types of things, images, video. There's obviously an infinite
amount of information or infinite is a big word, but there's a lot of
information to go or we're thinking a lot about how
we actually intersect or or connect those
whole collections. How do we take recorder
feature now gets an ridiculous amount of images every day. How do we make it so
that that's intrinsically connected to the
text colle
ctions? In ways that you can very
naturally jump back and forth through text and imagery in
a way where the two there shouldn't even really be
a difference. System modality. Still information. So how do we get those
two things to be intrinsically interconnected? But I think the question that
we really have been asked, though, by, by people like yourself in
the room and around the world, has been more of, okay, that's
all great with this, all this intelligence that I'm thrilled that
you got ten b
illion data points, but how's that relevant
to me? That's sort of like, if I think back to two
thousand nine with recorded future when we were barely started, That
was always the question. How's this stuff do you're showing me
relevant to me? And and, you know, we would would have do things
where we would set up so you'd have a watch list and
this is my tech stacks. And now I can give you the
stuff that's relevant to your tech stack and so on. But the
bigger sort of thing to go after, obviously,
has been What about if I
could actually make this relevant to what you're seeing in your EDR
in Crobs Strike, or in what you're seeing in Splunk, or what you're seeing in
Oxta or what you're seeing in cloudflare. What have you?
Any proof point, any of your, sort of security architecture. Now, service now, whatever
it now may be. That gets compelling. So, again, many of you have seen
these sort of visualizations that we put out earlier this year. It's our threat map and
what threat actors, in th
is case, coming out sort of a
generic software company. I see them prioritized by
the intent of these threat actors to go after this industry and on
the ax the x axis of their sort of ability to come
after specifically me. So that that's good. But
why shouldn't this be informed why by my own telemetry? What
I'm seeing in my systems? So that's sort of what we call, collective insights
at Record of Future, where we can now connect to,
and here's just a small set of the examples here. I think we're
connecting to
ten or eleven systems by now, and we're gonna aggressively go after
that to be able to sort of connect to all kinds
of different things. And and what that then allows
us is to make that threat map, not just be generic,
but actually generic not just sort of in theory
map map to your world, but actually based on what's who's actually
knocking on your door. And if we now know
who's knocking on your door, and we can see that in the
context of a threat landscape, now we can click on th
em
and say, now go hunt. For those. And so the sort of you've
seen our Sigma rules and our yaw rules and those sort of things
that we have in the recorded future. And we wanna make it so
that not just be able to download the those sort of
Sigma, your rules, but actually deploy them
straight into the operational system. And now I think we can
sort of really truly be intelligence led about how we actually
sort of not just sort of be informed about what these guys
are doing and trying to come into
our systems, but actually nail them and
and and really eradicate them out of the out of the system. So, Yeah. Pretty exciting. And, and, oh, and
then, of course, the other sort of question that we
can then do is to look at that from an anonymized or a
non attributable sort of way to say, what are other companies
in my industry seeing, or what are other people in
this particular geography see? Seeing. So, you know, there are some pretty
incredible questions that we can come after like that. Anywa
y, so so with that, I'm
gonna wrap up by saying that, you know, we've done a
lot of progress at recruiting future. We're just bypassed three
hundred million dollars of, of sales super exciting.
There's a thousand of us who work on nothing but
doing intelligence. I always like to
make that point. You can feel confident that
we're not gonna suddenly come along and say, let's create
a, firewall, or here's the recorded future, EDR, or
here's the recorded future. I don't know what you're gonna, you k
now, confidently know that we're
gonna focus on intelligence and, and keep doing that. We're gonna drill intel into sort
of what we can do in tell it is in every way there is. And and we're not gonna be very
lazy as you can get the sense from what I'm
talking about here. We're gonna very
aggressively go after it. But it's still a hundred
percent intelligence. And finally, I'll just say,
remember, put us to work that is, my has become my rally
cry whenever I meet a client or whenever it's sort of
in
front of a room like this. We're here to help you. And so,
put us to work and with that, thank you very much.
Comments