为智能体时代构建防御体系：凯文·曼迪亚

他们的反应就像真的发生了安全事件一样。

They respond as if it's an incident.

这可不是一次普通的渗透测试。

And that's not a pen test.

这是真正的对手在向你发起攻击。

That is a real adversary coming at you.

在我看来，红队演练和渗透测试的区别在于，渗透测试更像是一种基础的安全检查步骤。

And the difference between red teaming and pen testing is pen test, to me, is a hygiene step.

我觉得随着时间的推移，如果条件允许的话，大家都会一直进行红队演练。

And I think over time, everybody would've red teamed everything all the time if they could.

之前因为成本太高、人力不足，根本做不到。

It was cost-prohibitive and people-prohibitive.

现在有了AI和智能体来执行，或者说在我们这个案例里，我们有各种不同类型的智能体各司其职，所以现在完全可以做到这一点。

With AI and an agent doing it, or in our case, we have lots of different types of agents doing different things, you can now do that.

所以我认为，久而久之，它会取代渗透测试。

So I think it'll replace pen testing over time.

那只是红队攻击你时会做的一小部分。

That's a small portion of what a red team coming at you would do.

你之前提到过，显然那是Armadin Red。

So you mentioned earlier, obviously, that's Armadin Red.

你还提到了Armadin Blue。

You mentioned Armadin Blue.

说说Armadin Blue吧。

Talk about Armadin Blue.

Armadin Blue就像，我们不能，David，直接出现然后说："嘿，你有漏洞。"

The Armadin Blue is like, we can't, David, just show up and say, "Hey, you're vulnerable.

"回头见。"

See you later."

而且，每个CISO的终极目标应该是有效的自主响应。

And, hey, the true north for every CISO should be effective autonomous response.

我们必须建立这个。

We got to build that.

我们一直都知道，你不能只是说“嘿”。

And we knew all along you can't just say, "Hey."

我们想成为全球最擅长发现可利用风险的公司。

We want to be the best in the world at finding exploitable risk.

对。

Yep.

这是第一个目标。

That's goal number one.

但第二个目标，就是成为全球最擅长应对这些风险的公司。

But then goal number two, and be the best in the world at doing something about it.

这就意味着Armadin Blue。

And that means Armadin Blue.

Armadin Blue会获取关于可利用风险的信息，并与防御层合作，无论是终端EDR还是防火墙，快速创建补偿性控制措施。

And Armadin Blue will be take the information about exploitable risk and work with the defense plane, whether it be endpoint EDR or firewalls, and create compensating controls at speed.

是的。

Yes.

所以如果我们比其他人早五分钟发现攻击，你就已经受到保护了。

So that if we find an attack five minutes before someone else using a model finds an attack, you're already safeguarded.

这些防护措施一开始可能会比较简单，甚至可能刚推出时就是这样。

And these safeguards are going to be rudimentary, potentially out of the gates-

对。

Yep

……在接下来的几个月里。

... over the next few months.

一年后，它们就会很成熟了。

A year from now, they're just going to be there.

对。

Yep.

因为整个网络安全领域发展得太快了，不管好坏，你都得进行自主防御。

Because the whole cyber domain is progressing at a speed where you're going to have to defend autonomously, for better or for worse.

对。

Yep.

我宁愿用一个不太完美的补丁挡住坏人，也不愿意被入侵。

I'd rather have a bad patch stopping a bad guy from getting in than have an intrusion.

你明白我的意思吗？

You know what I mean?

所以你得在两害相权中取其轻，而其中一个要好处理得多。

And so you got to take your lesser of two things, and one's much more manageable.

你绝对不希望一个陌生人随意访问你的网络。

You never want an unknown person with arbitrary access on your network.

对。

Yes.

非常——

Very-

所以你要想尽一切办法去阻止这种情况。

And so you want to prevent that any way you can.

我觉得第一代产品我们正在和CrowdStrike合作开发，他们也知道这东西必须存在。

And I would say the first generation is we're working with CrowdStrike on it, and they know it has to exist.

我们正在和Palo Alto Networks合作。

We're working with PAN on it.

他们很清楚这项技术必须存在。

They know that it has to exist.

他们也希望能全面迈入AI时代，实现自主防御。

They want to all shift into the AI age with autonomous defense as well.

所以我们需要给这些防御平台，比如Fortinet和其他厂商提供指导，告诉它们具体该怎么做。

And so we need to inform those defense platforms, the Fortinets and everybody else, "Here's what you can do about it."

我把它比作战场上的紧急包扎。

And I likened it to field dressing in war.

有人中枪了，你给他简单处理一下，但这可不是去医院。

Someone gets shot, you patch it up, but that's not the hospital.

这相当于说：嘿，我们止住血了。

That's a, "Hey, we stopped the bleeding."

但接下来你可能需要投入更多时间、人力，甚至在未来采用更智能的自动化方式来进一步处理。

But then you got to maybe do something else with more time and humans, potentially, or even agentic approach to it down the road.

所以你会看到这种情况发生，即使……如果你是CISO，即使你不要求，你也会看到自主防御的出现——

So you're going to see it happen even in... If you're a CISO, you're going to see autonomous defense happen even if you don't ask for it-

……因为你已经投资了那些防御平台。

... because of the defensive platforms you've already invested in.

你之前提到过……网络安全内部不同类别之间的界限变得模糊。

You mentioned earlier- ... some of the blurring of the lines of different categories within cyber.

好的。

Okay.

我觉得你开玩笑说，你以前的日子，你那30——

And I think you joked that your old days, your 30-

……年的经验已经过时了，或者没用了，或者类似的话。

... years of experience is out the window or irrelevant or something like that.

那么SOC的未来是什么，然后——

What is the future of the SOC, and then-

好的。

Okay

那网络安全里的各个类别是怎么融合或者变化的呢？

... how do the categories within cyber blend together or change?

如果我是CISO，我确实相信我的终极目标是有效的自主安全。

If I'm a CISO, I do believe my true north is effective autonomous security.

你想让你最优秀的人保持投入。

You want to keep your best people engaged.

你想自动化那些对你的组织有效的流程。

You want to automate the processes that work for your organization.

但你绝对在问：“在AI时代，什么能存活下来，什么不能？”

But you are absolutely saying, "What survives in the AI age and what doesn't?"

我觉得我们还在摸索这个过程中。

And I think we're still working through that process.

我认为SOC里有很多流程会直接消失，而且不管出于什么原因，我们现在正在自动化它们。

I think there's whole processes in the SOC that'll just go away, and for whatever reason, we're automating them right now.

随着时间的推移，我可以告诉你这一点。

Over time, I can tell you this.

如果检测和响应环节还靠人来参与，那速度肯定跟不上。

If you have humans in the detect-and-respond loop, you're going to be too slow.

对。

Yes.

你明白我的意思吧？

You know what I mean?

这样根本行不通。

It's just not going to work well.

所以有预防、检测和响应这几个环节。

So you have prevent, detect, respond.

预防会由AI来主导，检测和响应也会由AI来完成。

Prevent's going to be governed by AI, and detect and respond is going to be done by AI.

网络安全的目标一直都是预防为主。

And the goal in cybersecurity has always been, you want to prevent.

是的，那当然。

Yeah, of course.

你明白我的意思吗？

You know what I mean?

你不想去检测和响应。

You don't want to detect and respond.

所以我看到每个阶段的窗口都在不断缩小，到最后我们真的做不了多少检测和响应，因为那个窗口已经——

So I just see the constant narrowing of the window of every phase to the point where we're really not doing a lot of detection and response because the window to do it-

一切都发生得太快了。

It all happens too fast

——几乎……

... is almost...

你说得对。

You got it.

确实有点太快了。

It's a little bit too fast.

但你还是得有一定程度的层层防御，系统之间相互备份，并且假设某个环节会出问题。

But you still got to have that onion peel to some extent of systems backing up systems and assuming failure somewhere.

就算阿玛丁造出了力场，迟早也会有人绕过它。

Even Armadin creating the force field, sooner or later, somebody's going to get around it.

总会有人在我们发现之前找到漏洞，不管用什么方式，在某个我们还没评估过的平台或应用上。

Someone's going to create an exploit before we find it, somehow, some way, on a platform or an app that we just haven't assessed yet.

它还没在客户现场投入生产。

It hasn't been in production at a customer site.

所以我们还没检查过，结果别人先发现了。

And so we haven't looked at it, and someone else finds it.

一旦他们这么做了，你就会希望后面有个陷阱，说：'我们检测到了未经授权或非法的系统访问。'

And when they do that, you will want to have a trap behind saying, "We've got unauthorized access or unlawful access to a system."

这些陷阱是……

Those traps are...

你不可能靠人工来盯。

You just can't have a human there.

因为我们在阿玛丁已经这么干过了。

Because we've already done it at Armadin.

当我们攻进去，并且拥有具备代理感知能力的内部指挥控制时，它的扩散速度快得惊人。

When we break in and have agentic-aware internal command and control, it proliferates at a speed that is shocking.

我记得作为人类，你在键盘上打字说：“我想用这个口令从这里横向移动到那里。”

I remember as a human, you're typing on your keyboard, "I want to go laterally move with this passphrase from here to here."

而你动作很慢，一次只能做一件事。

And you're so slow, and you're doing one thing at a time.

而这东西能同时做一千件事。

This thing just does a thousand things at once.

它无处不在，你会觉得：“哇，好了，完成了。”

It's just everywhere, and you're like, "Whoa, okay, done.

应用已经启动了。

Got the app up."

所以，这个过程每一步——

So, each one of those steps of the process-

都必须自动化。

... has to be automated.

不能有人在中间插手。

It can't be a human in the loop.

情况就是这么糟糕。

It's as bad as this.

我没什么特别好的比喻。

I don't have great analogies.

就像气球突然爆了。

It's like the balloon popped.

有人一进来，就像“噗”的一下，人就不见了。

Someone gets in, it's just like, pff, they're gone.

没了。

It's gone.

你整个防御体系一下子就崩了。

Your whole defense apparatus just popped.

所以你得把预防做好，然后一旦检测到问题，立刻封锁，不管用什么方式应对。

So you got to get prevention right, and then an immediate lockdown on detect and respond, however you want.

而且这几个阶段之间总是存在模糊地带，因为有人会说，如果你能自动且快速地检测并响应，那就算作预防。

And there's always gray areas between those phases because people say if you detect and respond automatically and fast, that is prevention.

对。

Yep.

所以一切都会发生改变。

So all of it's going to change.

每位首席信息安全官都在审视这一点，每个供应商也在评估自己在向AI转型中的角色。

Every CISO's examining it, every vendor's examining their role in changing into the AI shift.

所以一切现在都要变了，但我没法确切告诉你具体会怎么变。

And so it's going to all change now, but I can't tell you if anyone's positive on how it changes.

他们正在审视自己的员工队伍、人员编制和业务流程，也就是说首席信息安全官们也在这么做，他们在问自己："在新时代，我需要变成什么样？"

They're examining their workforce, they're examining their headcount, they're examining their processes, meaning the CISOs are, and they're saying, "What do I need to look like in the modern era?"

但现在下结论还为时过早。

But it's too soon to tell where it lands.

对。

Yep.

所以现在说他们长什么样、他们的防御体系什么样，还为时过早。

So too soon to tell what they look like, what their defense-

……防御体系长什么样。

... apparatus looks like.

是的。

Yes.

所以你有一批财富500强的客户。

So you have a bunch of Fortune 500 customers.

你和其他很多公司关系密切——

You're close with a bunch of others-

……那些不是客户的公司。

... that are not customers.

他们现在的漏洞状况如何？

What is the state of their vulnerability today?

正在迅速缩小。

Rapidly shrinking.

每个人都很担心。

Everybody's worried.

顺便说一句，现在双方都有一种紧迫感。

There's a desperation in the moment in both directions, by the way.

如果你在伊朗或俄罗斯处于进攻方，你会急于趁现在赶紧行动。

If you're on offense in Iran or Russia, you have a desperation in a moment of get in now.

对，趁现在赶紧——

Yeah, get it before-

趁现在赶紧，趁你——

Get in now while you-

趁安全措施还在的时候

... the security is in place

还能行动的时候。

... can.

你说得对。

You got it.

然后如果你是防守方，你会急着去修补每一个漏洞。

And then if you're on defense, you're desperate to patch every window.

公平地说，双方的这种紧迫感都是有道理的。

And in fairness, both sides are accurate in their desperation.

因为在AI时代，短期内进攻方确实占优势。

Because we have near-term pain in the AI age that it advantages offense.

对。

Yes.

所以这没问题。

So that's fine.

这就是它的本质。

That's just the nature of it.

但双方都明白这是为了长远的利益。

But both sides recognize it's for long-term gain.

是的。

Yep.

也就是说，由攻击方AI训练、具备自主能力的防御型AI，在检测数据包方面会比人工盯屏幕做得好得多，也细致得多。

Meaning AI on defense, being trained by AI on offense, and being autonomous, is going to do a far better, more diligent job than humans peering at packets.

所以我们现在正处在一段所谓的‘暴露窗口期’，大家都面临风险，都在拼命补救。

And so we're just going through the window of exposure, let's call it, where everyone's at risk on defense, and they're all hustling.

我亲眼看到每家公司都在投入极其强大的努力，而且据我所知，没有哪家大型A轮企业不在实时扫描漏洞并采取措施应对。

I've seen incredibly powerful efforts at every company right now, and I'm not aware of any large 1A enterprise not actively scanning for exposure and doing something about it in real-time.

有意思的是，David，这简直成了团队作战。

And what's interesting, David, is it's team ball everywhere.

首席信息官、首席信息安全官、产品团队和业务线都像是发现了什么大事，整个公司就像进入了战时指挥状态。

The CIO, the CISO, the product teams, the business lines are all like, "Okay, we found something," and it's almost war roomed.

大家都觉得必须赶紧把这个漏洞补上。

Like, "We got to go fix this."

参与进来的团队范围其实挺广的。

And the composite of those teams are pretty broad.

所以接下来这一年恐怕都不会太平静。

So there's no way to make the next year pretty.

这么说最贴切了。

That's the best way to say it.

对，没错。

Yeah, exactly.

你懂我的意思吧？

You know what I mean?

现在外面就像个派对，数字派对，大家都在拼命往前冲。

It's a cocktail party out there right now, digital cocktail party, and everybody's in a race.

是的。

Yep.

我们最厉害的一家公司告诉我们，他们抽调了很大一部分工程师和研发人员，专门用来加固自己的防线。

One of our most sophisticated companies told us they took a large percentage of their engineers and research organizations and just devoted it toward fortifying their own walls.

那感觉就像全员上阵。

Which it was like an all hands on deck.

是的。

Yep.

而且最近警钟才开始敲响。

And the alarm bells started ringing very recently.

这是——

This is-

……就在最近几个月，对吧？

... within the last few months, right?

我觉得Mythos是最大的那个。

I think Mythos was the biggest.

我们在Mythos之前很久就预见到了，但从营销角度来看，Mythos这个时刻让所有人都意识到：“好吧，威胁变了。”

We saw it coming long before Mythos, but the Mythos moment, from a marketing standpoint, got everybody to go, "Okay, threat's changed."

对。

Yep.

很多人说，Mythos出来之后，要找出我们自己软件里的漏洞，如果你在做软件安全认证，你就必须这么做。

And a lot of people said, Mythos came out, find vulnerabilities in our own software, and you have to do that if you're doing software security attestation.

当然。

Of course.

所以所有供应商都赶紧去做了这件事。

So all the vendors ran out and did that.

但我对Mythos的回应是，它让AI攻击这件事变得广为人知。

But the way I respond to Mythos is that just made it very well known about AI on offense coming at you.

我觉得这就是加速的原因。

And I think that's what accelerated it.

那基本上算是板上钉钉了。

That was pretty much a firm stamp.

它要来了。

It's coming.

对。

Yep.

那Hugging Face事件呢？

What about the Hugging Face incident?

我想请你谈谈那个——

I'd love for you to talk about the-

你知道——

You know-

……从中学到的教训

... learnings from that

……

...

这个问题我想了很多。

I've given that a lot of thought.

我敢肯定在OpenAI，他们会说：“哦，我们本来在常规水平。”

I'm certain at OpenAI, they're like, "Oh, we're at a regular."

他们会说：“哦，我们本来可以这样做那样做，就不会发生了。”

They were like, "Oh, we could've done this and this, and it wouldn't have happened."

你懂我的意思吗？

You know what I mean?

所以他们已经想明白了。

So they've already figured it out.

根据我的经验，在每一次技术模式转变中，我们都低估了对手的能力，而这次我们低估了模型的能力，因为当你事后仔细阅读时，啊，他们本可以阻止那件事的。

It's been my experience, in every technical modality shift, we underestimate the adversary's capability, and in this case, we underestimated the model's capability because when you really read it post-facto, ah, they could've stopped that.

他们本可以加上护栏，一些确定性的措施，我觉得他们现在意识到了这一点。

And they could've put guardrails on it, some deterministic things, and I think they realize that now.

但我觉得当你处于竞赛中时，这几乎就像一场登月竞赛，对吧？

But I think when you're in a race, it's almost like a lunar landing race, right?

人工智能竞赛。

The AI race.

你有研发人员，他们在努力创造模型，以至于连那些CEO都说：“我们不能放慢速度。

And you have R&D people, and they're doing the work to create models in a way where even those CEOs are like, "We can't slow it.

让政府帮我们放慢速度吧。”

Let's get the government to help us slow it."

这意味着你甚至无法控制自己的创新，对吧？

That means you can't even control your own innovation, right?

我对此有看法，但我们——

I have views on that, but we-

……可以改天再聊。

... could take it another time.

这个我理解。

And I get that.

研发人员都在追求创新，很难把他们和有经验的安全人员搭配在一起，让后者有能力去控制那个东西。

R&D people are chasing that innovation, and it's really hard to package them within experienced security people that have the skill sets to cage that thing.

而且这两类人很难配合，因为安全人员对AI了解不够，而AI人员又没意识到……我们在自己的模型里做的一件事，毫不夸张地说，Armadin已经造出了我们大家都担心的那个怪物。

And it's hard to marry those two up because the security people don't understand the AI as well, and the AI people don't realize... One of the things that we did in our model, make no mistake, Armadin has made the beast that we're all worried about.

我们造出了一个会攻击的模型。

We've made a model that attacks.

我们造了很多个。

We made many of them.

我们有一个系统，能攻击生产网络，而且成功率很高。

We have a system that attacks production networks and is highly successful breaking in.

那，它安全吗？

Well, is it safe?

我们的人本能地知道，显然，我们得有一个安全的，我们得有一个虚拟机监视器。

Well, our guys instinctively knew we got to have, obviously, a secure, we got to have a hypervisor.

我们得把这个东西保护好。

We got to secure this thing.

我们得在主机层面把它锁死。

We got to lock it down host-based.

我们得有一个代理。

We have to have a proxy.

它知道代理。

It knows the proxy.

它支持代理。

It's proxy-aware.

那没问题。

That's fine.

但后来我们的人做了一件事，连我都觉得，干得漂亮。

But then our guys did something, and even I was like, "Nice job."

他们会被动地、偷偷地查看每一个完成的提示。

They passively, surreptitiously look at every single prompt done.

我们喜欢吗？

Do we like it?

我们不喜欢吗？

Do we not like it?

而且大多数情况下，如果我们终止一个代理，很可能跟安全无关。

And the majority of the time, if we kill an agent, it's probably nothing to do with safety.

而是因为那个代理在浪费钱。

It's that the agent's wasting money.

你懂我的意思吧？

You know what I mean?

对，有道理。

Yeah, that makes sense.

那就终止它。

So kill it.

它跑去干我们早就做过或者根本不想做的事了。

It's off on a goose chase we've already done or don't want to do.

但当时有很多层验证，确保代理在做正确的事。

But there were so many layers of validation that the agent was doing the right thing.

另外一点是——假设你的每一层安全措施都会失效，你必须要有确定性的规则来排除某些活动。

And the other thing was- Assume every layer of your security will fail, and you have to have deterministic rules that eliminate certain activities.

但我从那些事件中学到的是，要保护在特定领域运行的代理，确实需要领域专业知识。

But what I did learn, reading those incidents, it does take domain expertise to secure agents behaving in certain domains.

你明白我的意思吗？

You know what I mean?

是的，这很棒——

Yeah, it's a great-

所以我理解这一点。

So I get that.

对。

Yep.

所以，如果没有一个——

So, without a-

这很有验证性。

It's validating.

显然很有验证性。

Obviously validating

……网络安全的背景，我理解你怎么会去测试某个东西，然后发现“哦，没想到这一点。”

... cyber background, I get how you're going to test something and go, "Oh, didn't think of that."

是的。

Yes.

而且你得有一个经验丰富的团队来审视这些评估，然后说：“你知道吗？

And you would've had to have an experienced team look at what the evals looked like to say, "You know what?

它会做这个，还会做那个。”

It's going to do this, and it's going to do that."

所以这就是为什么在Armadin，我们把漏洞利用专家和红队成员与AI人员结合起来，因为我们的评估大多数时候是由红队成员制定的。

So that's why at Armadin, we combine the exploit developer types and red teamers with the AI folks because our evals, most of the time, are made by the red teamers.

你懂我的意思吧？

You know what I mean?

他们才是真正懂这些的人。

They're the ones that understand this stuff.

我们在Armadin创建了20条完整的攻击链，这些都是在真实世界中人类已经实施过的，而且我们的资深操作员在测试网络时也实际执行过。

And we created 20 full kill chains at Armadin that humans have done in the real world, period, at different victim sites and our experienced operators have done when testing networks.

结果没有哪个模型能完整走完超过八条攻击链。

And we had no model go through the entire kill chains of more than eight.

所以这就是……

So that's where-

20条里只有8条。

It was eight out of 20.

这很安全，对。

This is safe, yeah.

顺便说，奇怪的地方在这里。

And here is what's weird, by the way.

我们测试了开源模型和最先进的闭源模型，它们都找到了八个。

We tested the open-weight ones and the most advanced closed models, and they all found eight.

真的吗？

Really?

是的，所以关键就在于速度和成本。

Yeah, so it was all about just speed and cost.

对，当然，是的。

Yeah, of course, yeah.

闭源模型在发现可利用风险方面更快，但差距正在缩小。

And the closed models were faster to finding exploitable risk, but that's coming down.

但我们让开源模型运行更长时间，它们也达到了同样的结果。

But we let the open models run longer, and they got to the same place.

这很有意思。

That's interesting.

所以，在网络领域，闭源和开源之间的差异可能没有其他领域那么大。

So, in the cyber world, the differentiation between closed and open is not as great as in other domains, probably.

而且它被压缩了，是的。

And it's compressed, yeah.

我觉得这在一定程度上是一致的——

I would say that's somewhat consistent-

……至少在能力差距上有所缩小。

... in terms of the capability gap at least closing a little bit.

但有趣的是，它们的表现基本上是一样的。

But that's interesting that their performance is basically the same.

从我的角度来看，看到团队提供的图表，所有的线最终都汇聚到了同一个位置。

From my perspective, seeing the charts from the team, all the lines ended up in the same place.

当你观察时，主要就是时间、成本，然后可以说是效果或创造力。

And when you're looking at, it was immediately time, cost, and then call it effectiveness or creativity.

在它们所有操作结束时，当它们达到收益递减点时，它们最终都到了同一个位置。

They all ended up, at the end of all their operations, where they hit diminishing returns, they ended up in the same place.

不过成本方面不是这样。

Not on cost, though.

对，成本不是这样。

Yeah, not on cost.

对，有道理。

Yeah, that makes sense.

对，有道理。

Yeah, that makes sense.

所以这正好可以聊聊你们在用哪些模型，然后——

So it's a decent segue maybe to talk about what kind of models you guys are using, and then-

你觉得实验室公司未来会扮演什么角色？

... what role do you think the lab companies play in the future?

嗯，其实我都不确定我有没有回答完你上一个问题，除了说安全领域的专业知识得跟搞AI的人合作，因为我确实读了那篇meter的论文，我当时就想，这些人虽然是搞AI的，但我不确定他们做过多少调查工作。

Well, and I don't even know if I finished answering your last question other than domain expertise on security is going to have to work with the AI folks because I did read the meter publication, and I was like, well, these guys are AI people, but I'm not sure they've done a lot of investigations.

他们缺乏领域专业知识。

They don't have the domain expertise.

这种情况肯定会发生。

And that's going to happen.

再说回模式转变，因为这里就有一个例子。

Again, the modality shift, because here's one.

当云刚开始兴起的时候，我正在处理一堆安全事件。

When cloud started emerging, I was running a bunch of incidents.

我们在Mandiant靠应对数据泄露为生，我们不得不学习云泄露是什么样的。

We were responding to breaches for a living at Mandiant, and we had to learn what's a cloud breach look like.

现在我们得学习AI泄露是什么样的。

We now have to learn what's an AI breach look like.

Anthropic或者那些被用来发动攻击的模型公司，他们手里有多少数据？

How much data is at Anthropic or the model companies that are being leveraged to do the attacks?

你希望他们记录什么，以及他们如何改变行为，以便有更好的审计追踪和取证能力。

What do you wish they logged, and how they will change behavior as well to have better audit trails, better forensic capability.

所以这项技术还处于早期阶段，我们都必须逐渐成熟起来，当这些系统出问题时，我们要能承担责任。

So it's early onset to the technology, and we all clearly have to mature into it in a way where we have the accountability when these things go rogue.

你可以说：“发生了什么，什么时候发生的。”

You can say, "Here's what happened and when."

不应该花两周时间做取证才能搞清楚。

And it shouldn't be two weeks of forensics to figure it out.

我不想这么说。

I hate to say it.

我们记录了每一个——

We log every single-

是时候了。

It's just time for that

我们代理做的每一件事，源IP地址、时间和日期，以及它做了什么。

... thing our agent does, source IP address, time and date, and what it did.

所以你得回溯并重放这些事件。

So you got to go backwards and replay these things.

我觉得他们吃了不少苦头才学到教训，现在可能比三个月前好多了，不管是OpenAI还是Anthropic，在测试方面——

And I think they've learned lessons the hard way, and they're probably way better today than they were even three months ago at OpenAI and Anthropic and testing-

这些方面。

... these things.

那些有正规实验室的人看到这个，就会说：‘好吧，我们得在这里收紧一点了。’

And whoever had a regular lab, they're looking at this going, "Okay, we got to tighten up a little bit here."

我理解他们很惊讶，因为他们低估了它。

And I get they were surprised because they underestimated it.

我们对付人类对手时也是这么做的。

And we've done the same with human adversaries.

这真是最奇怪的事情。

It is the weirdest thing.

我整个职业生涯中，每个人都低估了你所面对的最顶尖的对手。

My whole career, everybody underestimates the top tier of what you're up against.

因为你不需要每天都看到它。

Because you don't have to see it every day.

而且你不想害怕所谓的床底下的妖怪，所以不想有恐惧、不确定和怀疑，但你仍然要尊重你正在创造的技术，并以一种有意义的防护方式去测试它们。

And you don't want to fear the bogeyman, as they say, under the bed, so you don't want to have FUD, but you still want to respect the technologies that you're creating and test them in a way that is meaningfully guarded.

大卫，我们手里有只笼中的野兽。

Got a caged beast, David.

你明白我的意思吗？

Do you know what I mean?

笼中之兽。

Caged beast.

你明白的。

You do.

我喜欢这个说法。

Love it.

但我觉得，你把它关得太紧了，稍微放开一点。

And I would argue, you cage it too much, release a little bit.

找到那个平衡点，因为如果你做得过于确定，这里就是安全运行AI的艺术，至少在网络攻击方面，你想要利用前沿实验室的智能去做事，但不要做错事。

Find the line because if you do overly deterministic, here's the art form to safety running AI, at least in cyber on offense, is you want to leverage the intelligence of the frontier labs to do stuff but not do the wrong stuff.

所以你需要分类器。

So you need classifiers.

你需要一个模型来检查所有外发和所有进来的内容。

You need a model that looks at everything going outbound, everything coming inbound.

我们是通过人来做的，大家点赞或点踩。

We've created that with people and humans going thumbs up, thumbs down.

这个好，那个不好。

That's good, that's bad.

你得训练它，分类，然后观察它。

You got to train it, classify, and look at it.

但如果太死板，限制太多，可能就发挥不出它的创造力了。

But if you get too deterministic and disallow too much, you're probably not leveraging the creativity of it.

你得适当放开一些，所以这是个灰色地带。

You let it out some, so it is a gray area.

而灰色地带的问题就在于，这就是为什么没人敢说“我们百分之百确定能得到我们预期的结果。”

And that's the problem with that gray area, is that's why no one would ever say, "We're 100% certain we're going to get what we expect."

对。

Yep.

就是这样。

Period.

我们确实面临这样的挑战，但还没出过问题，因为我们能把人加进流程里，或者用分类器来提示："这事儿得让人来决定。"

It's a battle we even have, but we have yet to have an issue because we can put a human in the loop, or we have classifiers that say, "A human needs to decide this.

我们根本搞不清楚刚才到底发生了什么。"

We don't know what the hell just happened."

你明白我的意思吧？

Do you know what I mean?

所以，如果你要审查所有发出去的提示词、所有返回的结果，一旦发现有什么东西回来但我们完全摸不着头脑，那就先暂停，上报，然后由人来判断。

So if you're inspecting everything that's come, every prompt to the labs, everything coming back, and something comes back and we don't know what the hell it is, pause, escalate, judge.

在 Armadin 内部，那些顶尖的安全运营人员是什么样的？

What do those great security operators look like inside Armadin?

靠的是丰富的经验。

A lot of experience.

十五年的攻击方经验，还有十五年的红队演练经验。

Fifteen years on offense, 15 years of red teaming.

我觉得在我们职业生涯中，几乎把财富百强里的99家都做过红队测试了。

I think we've red teamed literally 99 of the Fortune 100 throughout our careers.

哇。

Wow.

我们没拿下那一家，我知道是谁，他们从来没雇过我，但我很喜欢他们的产品。

We didn't get one, and I know who it is, and they've never hired me, and I love their products.

所以说不定有一天，他们会雇我。

So one day, maybe I'll get hired by them.

那我们去搞定他们吧。

Let's go get those guys.

我们经常和他们聊。

Talk to them all the time.

但一直没谈成。

Never landed them.

没关系。

That's all right.

他们可能确实不错。

They might be good.

不过他们经验非常丰富。我看了一下我们那90多个零日漏洞，大部分都是由人工发现的。

But they are very experienced, and when I look at our 90-plus zero-days, the majority have been found by human.

之所以靠人工发现，是因为我们用AI搞定了90%以上那些枯燥的工作，比如渗透测试，都已经自动化了。

But they're found by humans because we're leveraging AI to do 90-plus percent of the tedious work, which is pen testing, done, automated.

Web应用的渗透测试，那种需要创意和表达力的环节，对于顶尖水平的团队来说也已经自动化了，但我们还是让人工参与其中。

Web app pen testing in creative, articulate way done, automated for the 98th, 99th percentile, but we're still putting humans on it.

不过有意思的地方来了，David。

But here's where it gets interesting, David.

最近几个零日漏洞，嘿，技术团队发现了。

The last few zero-days, hmm, tech found it.

真的吗？

Really?

哦，哇。

Oh, wow.

所以我们已经扭转了局面。

So we've made the turn.

而且大多数人已经转向了。

And most people already have made the turn.

他们就是技术。

They're tech.

如果你在进攻端利用AI，你的AI代理就能发现零日漏洞。

If you're on offense leveraging AI, your AI agents are finding zero-days.

我想现在换个话题，聊聊你建立公司的理念和心态。

I want to shift gears now to your philosophies and mindset in building a company.

你知道，这些都不一样。

You know, they're different.

对，这里有几件事。

Yeah, so couple things there.

我第一次创办公司是在2004年，那时候我不会说自己是个企业家。

The first time I built a company was 2004, and I wouldn't have said I was an entrepreneur.

我在04年2月创办了Mandiant，当时是自筹资金并且盈利的。

I started Mandiant in '04, February, and it was self-funded and profitable.

我们之所以成功，是因为事后回想起来，当时几乎学不到什么，但回头看时，你会说：‘哦，我当时确实学到了’，通常是因为经历了痛苦。

And we were successful because in hindsight, it's like you almost learn nothing at the time, and then you look back and go, "Oh, I did learn right then and there," because of the pain usually.

但现在回头看Mandiant，

But I look back on Mandiant now.

我们当时有一个没人相信的前提，因为我们的第一个网站写着‘安全漏洞不可避免’，没人相信。

We had a premise nobody actually believed in '04 because our first website said, "Security breaches are inevitable," and nobody believed it.

我自己都不知道我有多相信。

And I don't even know how much I believed it.

而且——

And-

这个标语挺不错的。

It's a pretty good tagline

……顺便说一句，我有点偏离了。

... by the way, I'm slightly off.

我们的第一个标题是‘你不能只依赖预防措施’，那太无聊了，但和‘安全漏洞不可避免’是一个意思。

Our first headline was, "You cannot solely rely on preventive measures," and that was so boring, but that's the same as security breaches are inevitable.

你知道吗？

You know?

不能只靠防御。

Can't rely on defense.

这个对你来说更好。

Better ring on this for you.

对，我搞错了，因为我不是搞营销的。

Yeah, I got it wrong because I'm not a marketing guy.

但不管怎样，安全漏洞是不可避免的，我们的前提是，让我们应对每一个重要的漏洞，这样我们就能掌握第一手情报，知道如何防止它再次发生。

But anyway, so security breaches are inevitable, and the premise was that let's respond to every breach that matters so we have first-mover intelligence on how to prevent it happening again.

所以，网络安全中第一个情报模型就是杀毒软件。

And so the first model of intel in all of cybersecurity was antivirus.

就像我们寻找恶意软件一样。

It was like we look for malware.

我们有它的签名，如果我们漏掉了，David George 就得找到恶意软件并提交给我们，这样我们才能改进。

We have signatures for it, and if we miss, David George has to find the malware and submit it to us so we get better.

对。

Yep.

这个模式不好。

That's a bad model.

我妈妈不会在她笔记本电脑上找恶意软件的。

My mother's not finding malware on her laptop.

你明白我的意思吗？

You know what I mean?

它只会把她的笔记本电脑搞坏。

It's just going to eat her laptop alive.

所以那个模式不好，我们决定换一个更好的模式，因为我处理过安全漏洞，而我处理它们的原因是杀毒软件很容易被绕过。

So that model was bad, so we decided a better model because I had responded to breaches, and the reason I was responding to them is AV was easily evaded.

所以我们想，既然杀毒软件不行，那就再加一层防护吧。

And so we were like, "Well, let's second layer AV because it stinks."

对。

Yep.

这就是乔治现在拥有的东西。

And that's what George now owns.

哦，当然。

Oh, of course.

是的。

Yep.

那我们就加一层杀毒软件。

So let's second layer AV.

不过，你还是得有杀毒软件。

You still have to have AV, though.

我虽然批评它，但现实是，你还是需要它，或者用别的东西替代它。

I beat it up, but the reality is, is you still need it or something that replaces it.

所以第二层防御是必须的。

So the second layer of defense was required.

所以杀毒软件是想象中的防线，然后你再用能学习和思考的东西来延伸这条防线。

So AV was imaginal line to here, then you extend the imaginal line with something that can learn and think.

所以我们当时就想这么做。

And so we wanted to do that.

其实我把Armadin看作是情报的第三波，为什么非要等受害者出现然后从中学习呢？

And I actually look at Armadin as just the third wave of intel, like why are we waiting for a victim and learn from that?

这太荒谬了。

That's ridiculous.

你得先自己发现问题。

You've got to find your own problems first.

不要等着某个国防承包商被攻破，然后赶紧分享信息，确保这种事不再发生。

Don't wait for defense contractor A to be compromised and then quickly share the information to make sure it never happens again.

那种模式还是需要的，因为总有些东西能突破防线，让你措手不及。

And that model still needs to exist for the things that somehow get there, that beat you.

但我们现在已经有了那种模式，只是还不够好。

But we got that model now, and it's just not good enough.

回到你的问题，Mandiant是自筹资金的。

So back to your question, Mandiant was self-funded.

大卫，现在哪有公司能靠自己资金撑起来的。

I don't know of self-funded companies these days, David.

嗯，速度——

Well, the speed-

……要求——

... requires that-

这就是变化。

That's the change

……你必须得快。

... you've got to be fast.

这就是区别。

That's the difference.

我们创立Armadin时，理念已经不同了。而我创立Mandiant时，想法是：“嘿，这就是我们谋生的方式。

We started Armadin, the philosophies were different, and when I started Mandiant, it was, "Hey, this is what we do for a living.

让我们赚够钱，好继续做这行。”

Let's make enough money to do it for a living."

就是这样。

That's it.

所以我们雇了最优秀的人，我们的理念是：“我们会比竞争对手付给你更多的钱，但你要更努力地工作。”

So we hired the best people, and we had a philosophy of, "We're going to pay you more than our competition, but you're going to work harder."

所以我们一直觉得，我们人更少，但工作更努力。

So we always felt like we had less people working harder.

但人更好。

But better people.

我觉得我们以拥有优秀人才而闻名，这些人才也一直很出色。

I think we were known for having great talent, and that talent has prevailed.

大约一年前，有人给我发了条短信，说：“恭喜，RSA主舞台的主题演讲中，43%的演讲者是Mandiant的校友。”

There was a time about a year ago, somebody sent me a text, and they said, "Congratulations, 43% of the RSA main stage keynotes are Mandiant alumni."

真的假的。

Come on.

这就是我收到的短信。

And that's the text I got.

我从来没核实过，但那个人说得挺准的。

I never verified it, but the guy's pretty accurate.

如果那是真的，我就接受这个数据，而且我觉得很可能就是真的。

I'll take that stat if that's true, and I think it probably was.

我们长期以来吸引了很多人才，影响力也很大。

We've got a lot of reach over time with a lot of talent.

再看看Foundstone。

And look at Foundstone.

看看George Kurtz。

Look at George Kurtz.

2000年的时候，我和他在Foundstone一起工作过。

He and I worked together at Foundstone in 2000.

从Foundstone出来，很多人创办了成功的公司，也培养了很多成功人士。

From Foundstone, you've spawned a lot of successful companies and people.

Mandiant也是一样，但区别在于这些方面。

So same thing with Mandiant, but the differences are this.

第一，必须有资金支持。

A, got to be funded.

对。

Yep.

第二，要依靠增长速度，现在就要抓住市场。

B, owe your growth rate, get the market now.

我看Armadin的机会，感觉我们就像顺风每小时80英里，但我们没有销售团队。

I look at Armadin's opportunity, I feel like we have an 80 mile an hour tailwind, but we don't have a sales force.

我们没有市场推广。

We don't have a go-to-market.

我们还没有国际化。

We're not international.

所有这些都必须实现，而在当今经济中，要想击败大公司，唯一的办法就是把市场推广做好，在正确的时间用正确的技术，而且你最好已经准备好了你的第二步。

All that just has to happen, and the only way to thread the needle in today's economy to beat the bigs is get this go-to-market in place with exactly the right tech at the right time, and you better already have your act two ready.

是的，准备好了。

Yeah, ready.

是的。

Yes.

而且你的第三步计划也得提前准备好，因为你不想把自己逼到死角。

And your act three behind that ready because you don't want to get boxed into a corner.

所以Armadin有第二步计划，我们的第三步计划也已经规划好了，但我们正在建设市场推广体系，这需要资金，而且你必须提前建设。

So Armadin's got an act two, we have our act three planned, but we're in the process of building go-to-market, which requires the funding, and you have to build it ahead of time.

消费级AI公司创造了如此惊人的收入增长。

The consumer AI companies created such meteoric rises in revenue.

我认为在企业安全销售领域，这种增长是无法复制的。

I don't think they can be replicated in enterprise security sales.

但你刚刚看到了那种压缩效应。

But you just saw the compression.

Wiz从首次发布到年经常性收入超过1亿美元，只用了18个月，对吧？

Wiz got to over 100 million in AR in 18 months from their first release, right?

我们要努力超越这个成绩，这就是你必须做的，尤其是在你被需要、必不可少、必须存在的时候，而这并不容易做到。

We're going to try to beat that, and that's what you have to do, especially when you're needed, necessary, and you have to exist, and that's not easy to do.

所以你得拿到资金。

So you got to get the funding.

你得不断思考，怎么快速成长？

You got to constantly think, how do you rapidly grow?

你不能让车轮晃来晃去，意思是，怎么在高速前进的同时保持流程稳定？

You can't let the wheels on the bus get wobbly, meaning how do you go that fast and maintain process?

在Mandiant那种节奏下，我们是自筹资金、盈利的，而且没有竞争对手，因为没人相信这个前提——

At Mandiant's pace of we were self-funded and profitable with no competition because nobody believed the premise-

……我们并没有手忙脚乱。

... we didn't get that wobbly.

我们只是有出色的领导和纪律，所以我们能做到。

We just had great leadership and discipline, and we could do it.

要这么快成长，你得马上招到能规模化发展的领导者，他们得懂制度化流程。

Growing this fast, you have to hire scalable leaders right away that understand institutionalized process.

光靠拼劲、直觉和胆量是赢不了的。

You can't win with grit, gut, and moxie.

你实际上得把Armadin的方式流程化，甚至工业化。

You actually have to proceduralize, almost industrialize, the Armadin way.

对。

Yes.

你明白我的意思吗？

You know what I mean?

这正是我在琢磨的事情。

And that's what I'm trying to figure out.

就是怎么做到这一点，同时还能觉得自在。

It's how do we do that and feel comfortable doing it?

是的。

Yep.

这里有几个复杂的地方，咱们开始吧。

And here's complications, so let's do it.

第一，你得快速成长。

A, you got to grow fast.

第二点，在人工智能时代，以前的发展速度是，你在1月份的销售启动会上培训销售团队，然后这一年就搞定了。

B, in the AI age, it used to be- Development was at a speed where you train sales at the sales kickoff in January, and you're good.

对，没错。

Yeah, exactly.

所以我在想，等等，我们现在每两周就变一次。

And so I'm trying to figure out, wait a minute, we're different every two weeks.

变化太快了。

It's changing too fast.

对，确实。

Yeah, exactly.

那现在怎么让销售团队保持最新状态呢？

What is the modality now of having a sales corps that is right up to date?

这是我想到的一个挑战。

And here's the challenge that I thought.

我聊过的每个CEO都在问：人工智能怎么改变我们的业务？

Every CEO I've talked to is like: How does AI change our business?

我们都在解决这个问题。

And we all sort that out.

但它如何改变我们的人力呢？

But how does it change our manpower?

当我看到AI对销售的影响时，在企业安全销售领域，现实是人们仍然从人那里购买。

When I look at AI's influence on sales, the reality in enterprise security sales is people still buy from people.

是的。

Yes.

目前你仍然需要同样的市场推广结构。

You still need the same damn go-to-market structure for now.

实际上，这更加坚定了，因为技术变化太快，你不能把责任推给客户去弄清楚你们是怎么变化的。

And in fact, it's even more emboldened because the tech's changing so fast, you can't put that onus on the customer to figure out, how did you change?

它在哪里？

Where is it at?

所以我们必须建立一个制度化的流程，让销售每周都接受培训。

So we have got to create a process, institutionalized, where sales is trained every week.

我们现在进展到哪一步了？

Where are we at?

对。

Yep.

我们做得怎么样？

How are we doing?

这些流程能帮你赢得胜利。

And these are processes that will get you to win.

你想想看——

You think about-

对，再加上在安全领域的信誉，对吧？

Yeah, paired with the credibility on the security side, right?

对，没错。

Yeah, exactly.

顺便说一句，在我参与的任何公司里，这都无可替代。

And by the way, there is no replacement for any company I'm involved in.

我们从来不想着‘咱们就在自己的领域里当个老二吧’。

We are not ever aiming to be, "Let's be number two in our space.

那听起来挺有意思的。"

That sounds fun."

而是要在你所做的事情上做到全球第一。

It is be the best in the world at what you do.

说到招聘，我记得曾经有人问过我一个问题。

And when we hire people, I remember getting a question once.

有人问，"那你怎么知道自己是最厉害的呢？"

Somebody asked, "Well, how do you know when you're the best?"

我的回答是，"当你真的做到最顶尖的时候，你自己心里有数。"

And I'm like, "When you are the best, you know it."

你得在自己做的事情上做到世界第一。

You have to be the best in the world at what you do.

如果你还得去问这个问题，那你大概率还不是最厉害的，对吧。

If you have to ask the question, you're probably not, yeah.

你说得对。

You got it.

我敢肯定，勒布朗·詹姆斯职业生涯中有一段时间，他清楚自己必须更加努力才能保持最佳状态。

I'm pretty sure there was a time in LeBron James' career where he knew, "I'm going to have to work harder to stay the best."

是的。

Yes.

这就是我希望我们在Armadin感受到的。

And that's how I want us to feel at Armadin.

体育的比喻都挺贴切的。

The sports analogies all work.

汤姆·布雷迪上场时从来不会想：“好吧，我是这里第二好的四分卫。”

Tom Brady never walked on the field going, "Well, I'm the second-best quarterback out here."

没错，他一直都是。

No, always.

但这需要更努力的工作、更优秀的人才，而且你必须不断检验：我们是不是最好的？

But it requires harder work, better people, and you have to constantly test, are we the best?

我们是不是最好的？

Are we the best?

而且你会很快从客户那里知道，如果你需要做得更好。

And you learn very quickly from your customers if you got to do better.

所以，这个反馈循环，客户直接到工程师，也非常关键。

So, that feedback loop, customer straight in to the engineers, is critical as well.

所以长话短说，速度已经变了。

So long story made short, speed has changed.

必须进行资本募集。

Got to do a capital raise.

必须扩展流程，并且不断测试这些流程。

Got to scale processes and test those processes all the time.

我无法忍受的是混乱。

What I can't stand is chaos.

CEO的工作就是绝对要把公司里的混乱对员工隐藏起来。

A CEO's job is to absolutely hide chaos at a company from the employees.

就是这样。

Period.

你得确保他们不会觉得，"我们太随意了。

You've got to make sure they're not like, "We're so loose.

我们完全没头绪。"

We have no idea."

那就错了。

Wrong.

你得直接说，"这是流程。

You have to just say, "Here's the process.

如果流程太多你学不过来，那就去找那个人。"

If process is too much for you to study, that's the person you go to."

你只需要知道一个人的名字。

All you need to know is a guy or a person's name.

我就是这么看的。

And that's how I look at it.