微软副首席信息安全官谈AI代理的安全保障

头条新闻一直是AI模型很开心。

The top story has been that the AI models are happy.

这些模型在互联网上活动，测试了好几个组织的安全性。

The models went out under the the Internet and tested the security of several organizations.

这值得害怕吗？

Is it something to be scared of?

是的。

Yes.

那是不是该举手投降、担心一下？

Is it something to throw up your hands and worry about?

不。

No.

这些事情你以前都做过。

You've done all of these things before.

我们已经创造了容器化和工厂化。

We have created containerization and factories.

我们已经用漏洞保护了应用程序。

We have secured applications with vulnerabilities.

这些代理的特性，它们是不可预测的。

The qualities of these agents, they're unpredictable.

它们是不理性的。

They're irrational.

它们容易突然发作。

They're prone to lashing out.

当你逐一审视这些特点时，你会觉得，天哪，这听起来就像实习生。

And as you go through this list, you arrive at the point where you're like, Jesus, these sound like interns.

如果你一开始就想，哦，好吧，它就会像我一样运行。

If you just start with, oh, well, it's just gonna run as me.

那结果会很糟糕。

That's gonna end poorly.

是的。

Yes.

你得回到基本原理，但还得再深入一点，重新定义容器化对你来说到底意味着什么。

You're going back to first principles, but you also have to go even a little deeper and start to redefine what does containerization even mean for you.

问题从来不是CISO不知道系统有问题。

The issue was never that the CISO didn't know it was broken.

当CISO难就难在知道该修什么，因为你只有有限的资源，也就是程序员，而现在看来，这个资源似乎也不够了。

The issue and the difficult part of being a CISO was knowing what to fix Because you had a finite resource, which was a programmer, and now that seems that the math is gone.

我们离NASA供应链事件只有三周了，但是等等。

We were only three weeks out from NASA supply chain chain, but Wait.

那个大规模供应链事件是什么？

What's the massive supply chain thing?

哦，

Oh,

天哪。

man.

当它第一次出现在微软内部时，安全团队的反应很熟悉。

When first appeared inside Microsoft, the security team's reaction was familiar.

我们怎么禁止这个？

How do we ban this?

结果下一个问题才是更重要的。

The next question turned out to be much more important.

我们怎么让它跑起来？

How do we make it work?

本期节目来自黑帽大会，a16z的乔尔·德拉加尔萨与微软游戏部门副首席信息安全官亚伦·佐尔曼坐下来聊了聊如何保护那些能访问数据、使用工具、写代码、替员工办事的AI智能体。

In this episode from Black Hat, a16z's Joel De La Garza sits down with Microsoft Gaming Deputy CISO Aaron Zollman to talk about securing AI agents that can access data, use tools, write code, and act on behalf of employees.

他们讨论了为什么智能体需要有自己的身份，当模型能找到意想不到的路径连上互联网时，“物理隔离”到底意味着什么，以及为什么保护新一代软件既需要新的控制手段，也需要一些非常传统的基础安全知识。

They discuss why agents need their own identities, what air gapped means when a model can find unexpected paths to the Internet, and why securing this new generation of software requires both new controls and some very old security fundamentals.

他们还聊到了安全团队内部正在发生的更大变化。

They also explore a bigger shift happening inside security teams.

随着AI让企业无法忽视，首席信息安全官的工作越来越不只是防范风险，而是要想办法安全地说“行”。

As AI becomes impossible for companies to ignore, the CISO's job is increasingly not just to prevent risk, but to figure out how to safely say yes.

今天我们请到了微软的亚伦·佐尔曼，他是那边的副首席安全官，负责的事情可不少。

So today, we've got Aaron Zollman from Microsoft, the deputy CISO over there responsible for a whole lot of different things.

而且你一直处在最前沿，像所有人一样，我想，现在大家都在应对AI在环境中的部署。

And you've been at the forefront, like everyone, I guess, at this point, dealing with AI AI rollout into an environment.

而且你所在的公司可能比大多数公司更深入地拥抱AI，每个人都在积极拥抱。非常感谢你加入我们。

And you're probably at a company that's leaning in a lot more to AI than probably most companies, and everybody's So leaning in thank you so much for joining.

我们想聊聊过去几周，有趣的是，几周感觉就像狗年一样，对吧？

We'd love to talk The last couple weeks It's funny, it's like weeks have become like dog years, right?

就像每周都相当于旧世界的七周。

It's like every week is seven weeks in old world time.

过去几周，头条新闻一直聚焦在AI模型被黑客攻击上。

The last couple of weeks have been very focused on the top story has been that the AI models are hacking.

我们看到OpenAI披露说他们在做红队测试，但实际上，就在十五分钟前，又有新的披露说这些事件基本上都是因为一次红队演练，有人正在测试这些模型。

And we saw there was a disclosure from OpenAI that they were doing a red team Well, actually, turns out now, just fifteen minutes ago, there was another disclosure that these have all essentially happened because there was a red team exercise where someone was testing the models.

所以他们说，嘿，模型，你处在一个封闭环境中。

So they were saying, Hey, model, you're in this closed environment.

我们需要你去测试这个组织的安全性。

We need you to go test the security of this organization.

结果发现那个环境并不是封闭的，所以模型就跑到了互联网上，测试了好几个组织的安全性。

And it turned out that the environment wasn't closed, and so the models went out under the internet and tested the security of several organizations.

所以，对于那些没接触过这些东西的人来说，听起来确实挺吓人的。

And so I guess to people who haven't been working with this stuff, it sounds very shocking.

想想看，本·霍洛维茨今年在RSA大会上做了一个很棒的演讲，讲的是我们在a16z内部用OpenClaw做的一些工作。

Think Ben Horowitz at RSA this year gave a really great talk on some work we had done internally at a16z where we were using OpenClaw.

我们发现，用OpenClaw的时候，至少对于Opus 4.6来说，那些安全护栏基本上就消失了。

And we found that with OpenClaw, the guardrails, at least for Opus 4.6, kind of disappeared.

所以，我们好几个人都特别着迷于那些不可能完成的任务。

And so you'd be I think a number of us got really obsessed with impossible tasks.

就像，嘿，OpenClaw，我想让你帮我做这件事，但这件事没有一条清晰、合法的路径去完成。

So like, Hey, OpenClaw, I want you to do this thing for me, but there's no clear, legitimate path to do it.

这基本上就像是在说，嘿，迈克，我想让你去给我弄一枚钻戒，但迈克没有信用卡，没有钱，也没有办法筹到钱。

So it's like basically saying, Hey, Mike, I want you to go get me a diamond ring, but Mike has no credit card, no money, no ability to raise money.

那迈克要是没钱了，他会怎么做呢？

And so what's Mike going to do if he has no more?

那他就会去抢。

He's going to go rob.

所以我们注意到，这些模型基本上会不惜一切代价去达成目标。

And so we noticed that these models would essentially basically do anything to achieve their objective.

然后我们会说，嘿，你能从零开始给这个数据库加个超级用户吗？

And so we'd say things like, Hey, could you add a super user to this database starting from zero?

它做了什么？

And what did it do?

它找到了一个SQL注入漏洞，控制了整个SQL数据库，然后添加了一个管理员用户。

It found a SQL injection exploit, it took over the SQL database, and it added an admin user.

所以现在这个问题越来越受关注了，我知道你在OpenClaw上很活跃，大概两个月前它还是大家最害怕的东西，现在都没人提了。

And so it seems like this is coming more into focus now, and I know you've been very active in OpenClaw, which I think two months ago was the number one thing everyone was afraid of, and now no one talks about it.

可能六个月前吧，现在好像大家都在用。

Maybe six months ago, and now it seems like everyone's using it.

我很想听听你的经验，以及你是怎么思考这个问题的，因为这个问题很相似。

Would love to hear maybe your experiences with that and kind of how you thought through that problem because it's a very similar problem.

我的意思是，

I mean,

我们一开始确实被它吓到了，对吧，大家都一样。

think we were terrified of it at first, right, as everyone was.

这东西一下子就火了。

This thing explodes.

每个人都想一夜之间装上它，而且它没有任何防护措施。

Everyone wants to install it overnight, and it has no guardrails.

它没有任何防护措施。

It has no guardrails.

更糟的是，它完全开放远程拉取，什么都能从网上下载，供应链上问题很大。

And worse than that, know, it had fully open remote pull whatever down from the Internet supply chain pain.

所以我们第一反应就是，我们怎么禁止它？

And so our immediate reaction was how have we banned this?

然后紧接着的反应就是，等等，大家都想用这个。

And then the immediate reaction after that was, well, wait, everyone wants to do this.

我们怎么才能找到办法让它运作起来呢？

How do we find a way to make this work?

对。

Right.

然后

And then

产品团队的人看到了，说：其实这里有个非常好的产品。

the product people saw and said, Actually, there's a really great product here.

是的。

Yeah.

确实，对吧？

I mean, absolutely, right?

这里真的有个非常好的产品。

There's a really great product here.

有基础，有社区，还有那些东西，如果我们能证明可以安全运行，那对大家来说会非常有用。

There's the foundations and the community and the kind of things that if we can show that we can run it safely, then it's gonna be really powerful for people.

所以这是一个持续数月、跨学科的大工程，就这样启动了。

And so it was this big multi month, multidisciplinary effort that kind of kicked off.

先透露一下结局，几个月后，OpenClaw 的创始人 Peter Steinberg 和我们一起出现在微软 Build 大会上，谈论我们如何将安全引入这个流程。

And to preview the ending a little bit of it, Peter Steinberg, the founder of OpenClaw, is on stage at Microsoft Build with us a few months later talking about how we're bringing security to the process.

那么，这件事值得害怕吗？

And so is it something to be scared of?

是的。

Yes.

这件事值得让你

Is it something to throw up

举手投降、忧心忡忡吗？

your hands and worry about?

不。

No.

对吧？

Right?

这些事情我们以前都做过。

We've done all of these things before.

我们创造了容器化和Docker技术。

We have created containerization and Dockeries.

我们保护了有漏洞的应用程序。

We have secured applications with vulnerabilities.

我们建立了企业环境，通过人们想要的各种应用来传递污点和数据保护，也许我们安全人员希望他们不要这些应用。

We have created corporate environments that carry taint and data protection through a number of different applications that people want and that maybe we as security people wish they didn't.

只是我们必须同时做所有这些事情，而且要快得多。

It's just that we have to do all of those things together and a lot faster.

所以，是的，我觉得这真的是一个很好的故事。

And so, yeah, I mean, I think it's been a really good story

关于孤立地思考所有这些部分。

of thinking about all of those pieces in isolation.

真的很有趣。

It's really interesting.

如果你往上一层，更抽象地想想这些东西的行为方式，一般大家会叫它们代理，但其实就是一个框架加一个模型，对吧？

If you step up one level and you think through kind of more abstractly the way that these things behave, and I guess generally people would refer to them as agents, but it's like a harness and a model, whatever, right?

就像番茄和西红柿，一回事。

Like tomato, tomato, potato, whatever.

这真的很有意思，因为当你做威胁建模，思考怎么保护这些东西的时候，你会开始描述这些代理的特性，然后你会发现，它们是不可预测的。

It's really interesting because as you work through the threat model, as you think about how do we secure these things and protect these things, you start to articulate the qualities of these agents, and you're like, Well, they're unpredictable.

它们是不理性的。

They're irrational.

如果不如意，它们很容易发脾气。

They're prone to lashing out if they don't get their way.

当你列完这些，你会突然觉得，天哪，这听起来就像实习生。

And as you go through this list, you arrive at the point where you're like, Jesus, these sound like interns.

有点像那种，前一天晚上喝多了，第二天还来上班的实习生。

Sort of like, These sound like interns maybe after they drank a little bit too much the night before and they come into the office.

有意思的是，我们团队内部一直在开玩笑，我觉得我们其实有很多好工具来管理公司里那些不理性的事情，因为我们平时要跟人打交道，对吧？

And it's funny, internally as a team, we've been joking about, I think we actually have a lot of great tools for managing the risks of things going irrationally inside of a company because we work with humans, right?

所以我很好奇。

And so I'm curious.

我越深入了解，越觉得这听起来不像魔法。

It sounds to me, like the more that I double click on this, it doesn't sound like magic.

听起来你只是在回归基本原理，做好基本功。

It just sounds like you're going back to first principles and basic blocking and tackling.

嗯，其实不止这些。

Well, it's more than that.

对吧？

Right?

确实有一些特别的东西需要做。

There is some special stuff you have to do.

因为我觉得这些工具之所以这么强大，对吧，故事是这样的：当微软的Scout——也就是我们面向企业的OpenClaw——最初开放内部使用时，采用曲线简直惊人。

Because I think what makes these tools so powerful, right, the story is when Microsoft Scout, which was sort of our, like, OpenClaw for the enterprise, was initially released to internal use, the adoption curve was, like, phenomenal.

对吧？

Right?

这真的很有趣，作为安全人员也很有成就感，而且我甚至都不在试点范围内，对吧？

It was really fun, really validating as a security person, and I'm not even on the pilot curve, right?

那是因为每个人都想用它，而且他们都想用它来连接一切。

And that's because everyone wants to use it, and they all want to use it to connect everything.

所以我觉得，当你带一个实习生的时候，你的想法是，我会给他们两三个他们需要的东西。但要让OpenClaw scouty发挥最大效用，你得给他们所有东西。

And so I think when you bring in an intern, your perspective is, well, I'm gonna give them two or three things they need But to do their to make OpenClaw scouty, far as effective, you wanna give them everything.

所以，我确实认为，你是在回归第一性原理，但你还得再深入一点，开始重新定义，比如，容器化对你来说到底意味着什么？

And so I do think, yes, you're going back to first principles, but you also have to go even a little deeper and start to redefine, like, what does containerization even mean for you?

隔离是什么意思？

What does air gap mean?

隔离是什么意思？

What does air gap mean?

什么是身份？

What is an identity?

因为如果你只是从‘哦，它就作为我来运行’开始。

Because if you just start with, oh, well, it's just gonna run as me.

它会直接从我的浏览器缓存里拿走我的令牌，然后想干嘛就干嘛，那样肯定得出事。

It's gonna take my token directly from my browser cache and do whatever it wants to do with that token, that's gonna end poorly.

但如果我能给它一个独立的身份，如果我能描述容器的边界，嗯。

But if I can give it its own identity, if I can describe the bounds of the container Mhmm.

如果我能把代理、工具、模型或会话的行为绑定起来，对。

If I can tie the actions of the agent or the harness or the model or the session Yeah.

其实要搞清楚你想绑定什么挺难的，但先不说这个。

Actually quite hard to figure out what you wanna tie to, but put that aside for a moment.

如果你能把它绑定到一组特定的日志和事物上，那你就能做到基本的防御和应对，这时候你就要考虑，对手有没有机会做这件事，哪怕这个对手就是模型本身。

If you can tie that to a particular set of logs, set of things, then you can get to the place where you are just doing your basic blocking and tackling, where you're thinking about, okay, what is the opportunity for an adversary to do this even if that adversary is the model?

我怎么监控它？

How can I monitor it?

我怎么响应它？

How can I respond to it?

我怎么控制它？

How can I contain it?

我怎么能推理出潜在的入侵路径呢？

How can I reason about potential breach paths

然后把它烧掉？

and burn down?

而且这也挺有意思的，因为如果你想想看，我觉得——虽然我已经不再操作了，谢天谢地——

And it's funny too because if you think about it, I think and I am not operating anymore, thank God.

但我觉得如果我和我的操作员们一起想想，我觉得这很奇怪，只是我们基本玩了一下OPUS 4.6，在一个我们认为它是云容器的环境里，所以它没有互联网访问权限，但它还是想办法通过Cloudflare挖了一条隧道出去，绕过了我们的控制，然后它开始通过DNS传输数据。

But I think if I think through it with my operators at on, I think that it's a weird just with our basic playing around with OPUS 4.6, in an environment that we thought was it was a cloud container, so it had a policy of no internet access, but it still figured out how to get a tunnel out to Cloudflare, how to get around our controls, and then it started tunneling stuff through DNS.

这真的让我想起很久以前，当我还在构建高安全环境的时候。

It really reminds me of a long time ago when I was building more high secure environments.

你总是要过一遍威胁模型清单，就像，攻击者可能做所有这些事情，然后你总是会说，好吧，这里有20件事，但实际上，攻击者可能只有耐心做其中五件，因为我们在现实中见过这些。

You would always have to go through the list threat model, which was like, there's all these things an attacker could do, and you would always be like, Well, there's 20 things here, and realistically, attackers only have the patience for maybe these five because we've seen them in the wild.

而其他所有事情都可能做，但我们从未真正见过。

And all this other stuff could be done, but we've never really seen it.

看起来这些模型真的很擅长去尝试那些可能做到的事情。

It just seems like these models are really good about going after the stuff that could be done.

所以如果原来那五个现在变成了二十个，那你基本上什么都得修。

And so if the list of five now became the list of 20, and you kind of have to fix everything.

不过话说回来，

To be fair,

它们通常会先试那些显而易见的方法，这确实给了你一个机会。

they often try the things that are obvious first, which does give you an opportunity.

就像实习生一样，如果简单的方法能搞定，他们就不会去费劲做难的事。

Like interns, they're not gonna do the hard thing if the easy thing will suffice

大多数情况下是这样。

in most cases.

窗户开着的话，谁还会去撬锁呢。

Don't pick the lock if the window's open.

对吧？

Right?

没错。

Exactly.

所以，你知道，这样做的好处是，如果你有良好的监控、日志记录和容器化，你很可能有机会在事情变得一团糟之前做出反应和控制。

And so, you know, the advantage of that is if you have, you know, good monitoring, good logging, good containerization, you will probably have the opportunity to respond, contain, you know, before things go horribly awry.

但你说得完全对。

But you're absolutely right.

你知道，有很多敞开的门，我们确实需要回头想想它们是什么。

You know, there are a lot of open doors, and we do have to go back and think about like what are they?

对。

Yeah.

你知道，所以这……

You know, so it's

我们过去接受了很多风险。

We risk accepted a lot of stuff.

过去几年我们接受了很多风险。

We risk accepted Over the last couple of years.

那只是个P2级别的问题，你知道吗？

It was just a P2, You know?

对。

Yeah.

对。

Yeah.

对。

Yeah.

多亏了AI，我的P1问题处理得飞快，但那些P2问题，真是头疼。

I'm burning through my p ones at great speed, thanks to AI, but those p twos, man.

不。

No.

但你知道，我觉得这归根结底是要掌控全局。

But, you know, but it it it I think it's based to, you know, the need to to be on top of things.

对吧？

Right?

所以这是怎么回事？

So this is what?

现在应该是星期二了吧？

It's Tuesday now, I think?

拉斯维加斯时间。

Vegas time.

拉斯维加斯时间。

Vegas time.

对。

Yeah.

那不算数。

It doesn't count.

可能是星期天。

It could be Sunday.

完全不知道。

Have no idea.

是的。

Yeah.

昨天，昨天应该是星期一。

Yesterday yesterday was Monday, I think.

这个镇上没有时钟。

There's no clocks in this town.

这是对拉斯维加斯的一个著名观察。

Famous observation about Vegas.

而且是一样的，是一样的。

And it's the same it's the same.

你知道，每天都是120度，全天阳光充足，天黑后还有105度。

It's, you know, it's 120 every day, full sunlight, and it's a hundred and five after dark.

对。

Yeah.

不。

No.

但除了昨天，还有Leo Meyerovich（Graphistry的）的一个演讲，他几个月前通过未经提示的TFP提交了，那时候这一切都还没发生。

But so besides yesterday, a talk by Leo Meyerovich of Graphistry that he had submitted through the unprompted TFP months ago before any of this had happened.

嗯。

Mhmm.

那个演讲的前提是大家都在作弊，评估结果都是假的。

The premise of which was everyone's cheating on their evals.

他讲了怎么作弊，以及他自己怎么做的。而且这个演讲非常有先见之明，因为他基本上把这件事会怎么发生讲了一遍，还特别指出，你可能会觉得自己能把这个系统隔离开来。

Here's how and here's how I And it was incredibly prescient because he basically kind of talked through how this would happen, really pointing through that, to be clear, you can think you're gonna air gap this.

但当你隔离系统时，第一件事就是给模型打开DNS和网络接口。

But first thing you do when you air gap that is open up DNS and network endpoints to the model.

而模型本身就有网页搜索工具。

Well, the model has those web search tools.

那这样还算真正的隔离吗？

So are you really air gapped anymore?

但即便如此，我的意思是，很多实验室，我的意思是，有很多过拟合的情况，比如“我们不提取邮件”之类的。

But even then, mean, the models I mean, lot of the lab I mean, there's a lot of overfitting going on for for for Oh, we're not taking emails out.

哦，是的。

Oh, yes.

有人就是在教模型怎么应付考试。

There's there's there's People are teaching the test.

我觉得我会是……好吧，再说一遍，蠢人就是这样。

Think I would be the Well, again, idiots are.

他们就是在教模型应付考试。

They're teaching the test.

有些模型的评估指标，在没有工具的情况下就已经出现在模型发布里了。

They're the flags for some of these are in model releases without any tools

完全同意。

Totally.

拼写问题。

Spelling.

所以，是的，有很多方法可以改进。

So, yeah, so there's a lot of ways to improve it.

对。

Mhmm.

但你知道，作为安全人员，这对我来说一点也不困扰。

But, you know, as a security person, that doesn't bother me a little bit.

我总是假设每个人都在作弊。

I always assume everyone's cheating.

对。

Yeah.

但当需要思考新端点的时候，确实会让我困扰。

It does bother me when they're you know, when I need to think about, you know, new endpoints.

所以，我觉得我们尝试思考并列举的传统轴心，就是解决微软所有SFI支柱的那些。

And so, you know, I think there's there's the the traditional axes that we try and think about and we enumerate, you know, solve our all of Microsoft's SFI pillars.

对吧？

Right?

比如，先从身份开始，然后是网络，接着是工程系统和软件，等等。

Like, let's start with identities, then we'll do networks, and then we'll do engineering systems and software and so on and so forth.

列举控制措施，列举端点。

Enumerate the controls, enumerate the endpoints.

然后你会回头想想，在这个模型生态系统中，我希望存在哪些控制点，而这些控制点今天可能还不存在？

And then you kinda go back and you think, well, what are the control points that I wish existed in this harness model ecosystem that may or may not exist today?

对吧？

Right?

是的，我有各种形式的容器化。

It's, yes, I've got various forms of containerization.

也许我需要给这些东西分配独立的身份。

Maybe I need to give these things their own identities.

这可能是个好主意。

It's probably a good idea.

但现在，我该怎么使用钩子呢？

But now, you know, how am I gonna use hooks?

我该怎么使用追踪呢？

How am I gonna use traces?

我该怎么利用这些新技术来提升安全性呢？

How am gonna use some of these new technologies to improve the security of it?

即便如此，人们也不会用你给他们的工具。

And even then, people will not use the harness you give them.

他们会用自己想要的工具。

They'll use the harness they want.

对。

Yeah.

他们通常是为了完成工作，而不是为了安全。

It's a usual job to get their job done, not to not to be secure.

对吧？

Right?

所以，你越是考虑这些层次，就越有机会看到路径并打破它们。

And so the more you think in terms of those layers, the more opportunities you have to see the paths and break them.

这很有意思。

It was interesting.

我今天早些时候和另一位首席信息安全官聊过，他告诉我，大家都害怕“漏洞末日”，对吧？

I was talking to another CISO earlier today, and kind of what he was telling me was that everyone was afraid for Vulnpocalypse, right?

当时那种炒作的气氛基本上就是，哎呀，我们完蛋了。

The mythos hype was basically, Oh, we're doomed.

每个人都有漏洞。

Everybody's got vulnerabilities.

我觉得如果你在这个行业干得够久，你就会知道沙漠里埋着的东西多了去了。

I think if you've worked in this space long enough, you know that there's just a whole lot of things buried in the desert.

确实。

Sure.

这在我们行业里算是公开的秘密。

And it's like it's an open secret in our industry.

所以我觉得，我之前跟一个CISO聊过，他说，实际上，我们现在测试这些模型发现，虽然它们能更快地发现漏洞，但修补漏洞的速度也一样快。

And so I think I was talking to a CISO that was saying, Actually, what we found with these models now that they're testing them is that while they can discover things more rapidly, they can patch them just as rapidly.

所以以前，比如上周，以前你得找个开发人员来写补丁，那总是最卡脖子的环节。

So in the old days, like last week, in the old days, you had to get a developer to write the patch, and that was always the gating factor.

问题从来不是CISO不知道系统有问题。

The issue was never that the CISO didn't know it was broken.

作为CISO，最难的地方在于知道该修什么，因为资源有限，只有程序员，你得把他们只用在最紧急的漏洞上。

The issue and the difficult part of being a CISO was knowing what to fix, because you had a finite resource, which was a programmer, and you had to deploy them only to your sub-1s or your P1s.

现在好像这个限制没了，所以什么都能修。

And now that seems that the math is gone, and so, like, everything gets patched.

感觉我们可能真的快要拥有安全的软件了。

And it and it and it does it does feel like maybe we're on the verge of having secure software for once.

我很谨慎，但我希望你说得对。

I'm very hesitant, I but hope you're right.

你知道，有一点我确信这些工具让事情变得容易多了，那就是问题的诊断和分析。

You know, I one thing that I'm confident that these things have made much easier is the diagnosis and analysis of the problem.

对。

No.

而且，它们通常很擅长生成补丁，大概80%的时候都挺好的。

And, yeah, they're usually pretty good at creating a patch, you know, probably 80% of the time, it's good.

而且90%的时候不会引入新的安全漏洞，这也不是完美的记录。

And 90% of the time, it doesn't create another security bug, which is not a perfect record.

在部署这些东西之前，还是有很多测试要做。

There's still a lot of testing that has to go on before you deploy these things out.

但是

But

我觉得这确实让它更可行了。

it does, I think, make it more tenable.

而且，你知道，当你面对一份漏洞列表时，超过20个就根本处理不过来了，对吧。

And, you know, when you stare down a list of well, anything more than 20 is an impossible number, right, of bugs to go after.

这确实让事情变得稍微容易一些。

It does make it a little bit easier.

但我们还没到那一步。

But we're not there yet.

我想说的是，还是从那个角度想，你怎么才能接受像OpenClaw这样的东西，你确实还是得花力气持续扫描它，把它容器化，还得有人负责打补丁。

I will say that, you know, again, thinking through this lens of how do you take something like OpenClaw and get comfortable with it, you do still have you do have to put in the effort to continuously scan it, containerize it, have someone on the hook to patch it.

是的。

Yeah.

你不能说，模型会解决这个问题，因为还是需要有人负责验证和部署，这可不是模型能替你做的，对吧。

You can't say, Well, the models will fix it, because someone still needs to be accountable for validating and deploying, which is not they think the models are necessarily going to do for you, yeah.

嗯，我觉得这反映了CISO这个角色的变化，对吧？

Well, I think that speaks to kind of the way the CISO role has changed, right?

我记得我刚入行的时候，有位挺有名的CISO开玩笑说，他能用80种语言说“不”，就好像他的超能力就是，即使所有人都让他说“是”，他也能说“不”。

I remember at the beginning of my career, was a relatively well known CISO who would joke that he could say no in 80 languages, and it was sort of like my superpower is saying no even everyone's telling me to say yes.

而且在防御方面，人们经常想做一些非常糟糕的事情。

And oftentimes in defense, people want to do really bad things.

那时候就像，对，那可能会把银行搞炸了。

It was sort of like, Yeah, that's probably going to blow up the bank.

现在再看，CISO似乎变成了推动者。

You fast forward to now, and it seems like the CISO is becoming an enabler.

我接触的每一家公司，除了金融服务，因为他们受监管，有自己的做法，还有国防工业，但其他每家公司，CISO都非常深入地参与这些技术。

Every company I talk to outside of financial services, because they're regulated and they do their own thing, and maybe defense industrial, but every company I talk to, the CISO is very much involved in all these technologies.

就像你自己用OpenClaw一样，在每个前瞻性的组织里，CISO似乎都在场。

Like yourself working with OpenClaw, at every forward leaning organization, seems like the CISO is there.

感觉CISO是不是正在变成技术推动者？

And it feels like maybe the CISO is switching to technology enabler?

我也不确定。

I don't know.

我的意思是，

I mean,

我希望是这样。

I hope it's true.

我不确定这是不是普遍现象，但我一直觉得我的工作本质上就是三件事，对吧？

I don't know that it's universal, but I've always considered you know, the nature of my job to really be three things, right?

那些把自己当合规人员的人，比如，对，我是做合规的，但我的合规工作就是让系统对所有人都清晰易懂，不管是监管机构、内部审计，还是想买我们软件的合作伙伴。

You know, people who think of themselves as compliance people, like, yeah, I'm a compliance person, but my job in compliance is making the systems legible to everyone, whether they're a regulator, whether they're an internal auditor, partners who wanna buy our software.

关键就是清晰易懂。

It's about legibility.

当然，传统CISO的工作是识别风险、排优先级、然后把这些风险消除掉。

Yes, there's the traditional CISO job of figuring out the risks, prioritizing them, getting them burned down.

这个还是得做。

Still gotta do that.

还没做完呢。

That's not done.

AI能帮上忙。

AI helps.

还没完全搞定。

Haven't figured it out yet.

但我觉得工作中越来越重要的一部分，是那个赋能的部分。

But the part of the job that I think is is increasingly important is that enablement piece.

我们怎么才能让大家有能力去做那些难事呢？

How do we, you know, how do we make it possible for people to do the hard things?

有时候那些难事就是，把我的邮件和日历都连起来，然后自动替我写回复。

And sometimes those hard things are connect all of my email and my calendar and automatically write responses on my behalf.

如果大家想要那样的话，我们会想办法让它更安全。

Then if that's what people want, we will find ways to make it safer.

完全同意。

Absolutely.

嗯，这也挺有意思的，因为我觉得这正好说明了CISO们之间一直以来的那种讨论：我们到底是做安全的，还是做风险管理的？

Well, it's interesting too because I think it speaks to sort of the there was always this dialogue amongst CISOs about, Are we security or are we risk management?

看起来你们更像是做风险管理的，因为我觉得如果你在一家科技公司工作，却不积极拥抱新技术，那对业务来说可能是生死攸关的风险，比邮件泄露严重多了。

And it seems like you're risk management, because I think if you're working in a especially if you're working in a tech company and you're not leaning into the new tech thing, that's probably an existential risk for your business, more so than if your emails leak.

从毁灭业务的角度来看，比如如果微软错过了云，那对微软来说就太糟糕了。

On the scale of business annihilating things like if Microsoft had missed cloud, that would have been very bad for Microsoft.

幸运的是，Saket 干得很漂亮，抓住了那波浪潮。

Luckily, Saket did a great job riding that wave.

这次的情况看起来也差不多，我们真的没法回避，必须得积极面对。

And it's the same very much it seems like for this, which is where we can't really hide from this and we kind of have to lean into it.

对。

Yeah.

我完全同意。

I would completely agree.

我们必须积极拥抱它。

We have to lean into it.

我们必须找到做好它的方法。

We have to find ways to do it well.

你说存在性风险不一定是所有邮件泄露。

You you say the existential risk isn't necessarily getting all of your emails leaked.

我建议还是避免这种情况发生。

I would recommend against having that happen.

不过索尼影业还在经营呢。

Sony Pictures is still in business, though.

不。

No.

那是最典型的例子。

That's the that's the go to.

对吧？

Right?

确实如此。

That's true.

对。

Yeah.

不。

No.

我更希望我的邮件不被泄露。

I would prefer that my email's not leaked.

是的。

Yes.

天哪。

Oh, man.

所以，你知道，安全肯定还是有作用的。

And so, you know, security definitely still has a role.

我们还是应该强调什么特别重要，什么是对业务最重要的事情。

We should still be highlighting what is particularly important, what are the most important things for the business.

但同时，我们也应该认识到，我们的职责是保护这些重要的东西，也就是支持企业最重要的资产和最关键的问题。

But, also, we should recognize that our job is to protect those things, so that's enable the business in its most important assets and most important problems.

还有那些长尾的，你知道的，乱七八糟的人和事。

There's this long tail of, you know, randos and slack.

你懂吧？

You know?

现在就先别管它了。

You've got to let it be for now.

对，就像别去招惹那些喷子一样。

Yeah, don't feed the trolls, as it were.

这挺有意思的。

This is interesting.

我知道，这不是你第一次参加黑帽大会了。

I know, not your first black hat.

我很想听听你对现在这个领域的看法。

Would love to hear maybe your thoughts on what you're seeing out there.

从湾区来，整天接触各种AI相关的东西，可以说站在这次变革的最前线，有时候我觉得自己就像十八世纪伦敦的工厂工人，看着烟囱冒起来，心里想，天哪，这真的是下一场工业革命。

Coming from the Bay Area, working around all the AI stuff and just being exposed, I'd say at the front lines of this change, there are days where I feel like a factory worker in eighteenth century London, and you see the smokestacks coming up, you're like, Oh my god, this is literally the next industrial revolution.

我们很想听听你的看法，你在Black Hat这边有没有感受到这种变化，或者这里的气氛怎么样？

And we'd just love to get you like, are you seeing that come across here at Black Hat, or what is the vibe like?

确实就是这种气氛。

That's the vibe for sure.

对吧？

Right?

大家都在讨论AI怎么帮助业务，AI怎么让攻击变得更快，我们怎么用AI来防御，怎么在AI使用中保障安全。

Everyone's talking about how AI is helping the business, how AI is making attacks go faster, how we can use AI for defense, how to secure our environment where in the use of AI.

所以这里的气氛就是超级AI。

And so the vibe is is Super AI.

我尽量不去评判Black Hat，是的。

I try not to judge Black Hat Yeah.

Black Hat的气氛并不能代表最重要的事情。

The Black Hat vibe as indicative of the most important things.

就是，这就像是……

Like, it's it's the

就像歌舞伎剧场一样。

It's like kabuki theater.

这里有很多东西，你看到的是正在发生的事情的影子。

It's There's lot of and you're seeing kind of the shadow of what's happening.

但通常，你能看出幕后操纵者是什么样子。

But usually, you can ascertain what the puppet looks like.

而且我们距离大规模供应链危机只有三周时间了，但你知道，我们录制这段对话时，其实只有三个小时了。

And we're only I was gonna say we're only three weeks out from massive supply chain pain, but, you know, three hours as we record this.

等等。

Wait.

什么大规模供应链危机？

What's the massive supply chain pain?

哦，天哪。

Oh, man.

我忘了它叫什么名字了。

I forget the name of it.

有一个

There was a

哦，是NPR。

Oh, the NPR.

有一个

There was an

今天NPR组织被接管了。

NPR organization takeover today.

对。

Yeah.

对。

Yeah.

对。

Yeah.

但DEFCON快到了，所以总得有人需要找点话题或者准备被抓吧。

But DEFCON's coming up, so someone needs something to talk about or get arrested for.

对。

Sure.

不深入那个话题的话，我觉得可以说，老问题还在，那些埋头苦干的人还在继续干活。

Without going down that rabbit hole, right, I think it's enough to say that the old problems are still here and the people who were nose to the grindstone getting the work done Mhmm.

如果这些人有什么情绪的话，那就是他们其实还是很兴奋。

If there's any vibe for those people, it's that, like, they're actually still really excited.

对。

Yeah.

就是，感觉不像是在熬。

Like, it doesn't feel like a slog.

对。

Yeah.

对。

Yeah.