The Time is Now: Redefining Security in the Age of AI

The Time is Now: Redefining Security in the Age of AI

Speakers: Jeetu Patel, Executive Vice President and General Manager, Security and Collaboration, Cisco; Tom Giles

Conference: RSAC 2024

YouTube: https://www.youtube.com/watch?v=znrX0B6ucqw

Overview

In this compelling RSAC 2024 presentation, Jeetu Patel, Executive Vice President and General Manager of Security and Collaboration at Cisco, along with his colleague Tom Giles, articulated a vision for a radical transformation in cybersecurity. Titled "The Time is Now: Redefining Security in the Age of AI," the talk posits that humanity is on the cusp of transitioning from an era of scarcity to one of abundance, particularly in terms of digital capacity. This shift, driven by artificial intelligence, is not merely an incremental improvement but a fundamental reimagining of how security is conceived, built, and operated.

The core message of the presentation is that the cybersecurity industry is poised for a "seismic change," moving beyond traditional, often manual, and resource-intensive approaches. Patel and Giles contend that three convergent technological shifts—ubiquitous AI integration, kernel-level visibility via technologies like EBPF, and advanced hardware acceleration through GPUs and DPUs—now provide the foundational building blocks to solve long-standing, intractable security problems. These problems, including complex network segmentation, slow vulnerability patching, and cumbersome critical infrastructure updates, have plagued defenders for decades but are now within reach of automated, intelligent solutions.

The speakers highlight that the traditional security architecture, designed for a different era of computing, is no longer adequate for the hyper-distributed, microservices-driven, and AI-powered environments of today and tomorrow. Instead, they advocate for a completely reimagined architecture that takes security directly to the workload, operating with unprecedented speed, scale, and autonomy. This article will delve into the critical background, key findings, technical specifics, and defensive implications presented in this forward-looking talk, emphasizing the practical applications of these transformative technologies.

Background

▶ Watch: Introduction: Cybersecurity's seismic change, entering era of abundance (0:00)

For millennia, human existence has been characterized by scarcity—limited resources, time, and capacity. In the context of the IT industry, this has translated into constrained budgets and an ever-present demand for teams to "do a little bit more but just a little bit less." However, Jeetu Patel argues that the advent of AI signals a profound departure from this paradigm, ushering in an era of abundance. He illustrates this by suggesting that AI can augment human capacity dramatically, turning 20 developers into 100 digital workers or 40 customer service personnel into 250. This expansion isn't limited to IT; individuals could soon have multiple AI assistants for personal, HR, healthcare, and financial planning needs, effectively making a world of 8 billion people feel like it has the throughput of 80 billion. This immense new capacity will reside in "digital cities" – public and private data centers – which themselves will require fundamental reimagination to accommodate the scale of AI workloads.

This transformation extends directly to the underlying infrastructure for security, which must evolve to protect these reimagined data centers. Patel identifies two fundamental shifts in the nature of computing that challenge traditional security models:

1. Application Architecture: The shift from a three-tier architecture (web, app, data, each on dedicated hardware) to a hyper-distributed environment with thousands of microservices running on hundreds of pieces of hardware. This distributed nature makes securing applications far more complex.
2. Infrastructure Computing: The transition from general-purpose CPUs performing sequential processing to GPUs and DPUs enabling parallel processing and vector/matrix math. This allows for managing workloads 1,000 to 10,000 times greater than before, but also introduces new security challenges at this unprecedented scale.

Against this backdrop of rapid change, Jeetu Patel outlined three persistent and acute tactical concerns that the cybersecurity industry has historically struggled to overcome:

1. Segmentation is Hard: In a hyper-distributed environment, containing an attacker through lateral movement prevention is extremely difficult. While simple in a three-tier architecture where segmentation rules could be tied to dedicated hardware, it becomes exponentially complex with thousands of microservices running on containers and VMs that all need to communicate.
2. Patching Takes Too Long: The window between a vulnerability announcement and its active exploitation has shrunk dramatically to "single-digit days," and is "soon going to be in hours and minutes." Conversely, the time to patch a vulnerability typically ranges from "20 to 45 days," creating a critical period of exposure. This problem is exacerbated for non-data center assets like oil rigs, drones, MRI machines, or robot welders, which were often not designed for easy patching.
3. Updates to Critical Infrastructure are Difficult: Much of the infrastructure powering critical systems is "very dated" and challenging to update due to rigid change control windows (often only twice a year). Missing a window means waiting another six months, leading to significant overhead and delays in deploying crucial security updates from software manufacturers.

These long-standing problems, previously deemed unsolvable, are now the target of a new wave of technological innovation, which the speakers assert will fundamentally change the cybersecurity landscape.

Key Findings

▶ Watch: Data centers as 'digital cities', security infrastructure reimagined (2:40)

The central finding of the talk is that the confluence of three specific technological advancements—AI, kernel-level visibility (specifically EBPF), and hardware acceleration (DPUs and GPUs)—has created an unprecedented opportunity to fundamentally redefine cybersecurity. These building blocks are enabling the industry to move beyond incremental improvements and construct a "first version of something completely new": a hyper-distributed security architecture that takes security directly to the workload.

The speakers demonstrated how these technologies collectively offer solutions to the three acute problems that have historically plagued security practitioners:

1. Dynamic, Continuous Learning Segmentation: Instead of static, manually defined segmentation rules, AI agents coupled with EBPF can intimately understand application behavior, even asynchronous ones. This allows for the creation of self-adjusting, progressively tighter segmentation policies that automatically adapt to changes in the environment without human intervention.
2. Automated and Prioritized Vulnerability Management: Traditional vulnerability scanners often produce an overwhelming number of CVEs (500-2,000 weekly). By applying AI and EBPF, organizations can filter this noise, prioritizing vulnerabilities that are actively running in memory and being exploited in the wild. This enables the automated deployment and lifecycle management of compensating controls in the infrastructure while patches are being qualified, dramatically reducing exposure time.
3. Self-Upgrading and Self-Managing Security Infrastructure: Critical security devices, like firewalls, suffer from slow update cycles due to their inline, high-performance nature and rigid change control windows. The proposed solution involves deploying "little tiny baby network enforcement points" everywhere, utilizing digital twins and local AI engines to perform continuous, zero-downtime upgrades and policy verification in a "shadow data path." This results in security systems that write, test, qualify, and lifecycle manage their own rules and upgrades.

These findings collectively point towards a future where security is not a bolt-on or a human-intensive reactive process, but an intrinsically intelligent, automated, and proactive layer woven into the fabric of the digital infrastructure, operating at the speed and scale demanded by the age of AI.

Technical Deep Dive

▶ Watch: Applications, infrastructure evolving: microservices, GPUs, parallel processing (4:00)

The technical foundation for this reimagined security architecture rests firmly on the three technological shifts introduced by Jeetu Patel and elaborated upon by Tom Giles: AI, kernel-level visibility (EBPF), and hardware acceleration (DPUs/GPUs).

1. AI as a Core Enabler:

Patel emphasizes that AI must not be treated as a "bolt-on" but rather integrated "numerically in your core infrastructure." This means AI models are not just analyzing logs or alerts but are fundamental to the defense mechanisms themselves, anticipating and countering AI-reworked attacks. Tom Giles further expands on this, describing AI agents that can intimately understand asynchronous application behavior, creating dynamic segmentation policies. For vulnerability management, AI bots are envisioned as continuously monitoring "chat boards, the dark web, Git" to identify if a vulnerability is actively being exploited in the wild, providing critical prioritization. In the context of infrastructure updates, local AI engines compare performance metrics (memory, latency, jitter) between digital twins to qualify new software versions and verify policy changes in shadow data paths.

2. Kernel-level Visibility with EBPF:

EBPF (Extended Berkeley Packet Filter) is highlighted as a critical technology for achieving kernel-level visibility. In an environment where endpoint traffic is increasingly encrypted end-to-end, EBPF allows security systems to "look in the heart of the server and the operating system and see what's happening without actually in fact being inside the operating system." This capability is crucial for understanding application behavior, detecting anomalies, and verifying the state of running processes.

• Dynamic Segmentation: EBPF provides the granular insight needed for AI agents to observe and learn the true communication patterns of microservices, even those running on containers or VMs. This allows the system to build and continuously refine segmentation policies based on actual, observed application needs, rather than static, predefined rules.
• Vulnerability Prioritization: EBPF is instrumental in answering the question: "for the vulnerability in question, is it running in memory?" This direct insight into the operating memory space allows defenders to instantly determine if a known CVE represents an immediate, active threat, enabling highly targeted and effective remediation efforts.

3. Hardware Acceleration with DPUs and GPUs:

The shift from general-purpose CPUs to specialized hardware accelerators like GPUs (Graphics Processing Units) and DPUs (Data Processing Units) is presented as vital for handling the massive scale of AI workloads and security operations. DPUs, in particular, can provide a "massive capacity for security operations" by offloading tasks like connection management and encryption, performing them "thousand times faster than what you could do before." This acceleration allows for security processing at a scale previously unimaginable, essential for hyper-distributed environments.

Application of Technologies:

• Dynamic Network Segmentation: AI agents, powered by EBPF's deep visibility, observe application behavior over time. The system initially separates obvious elements (e.g., dev from prod). As it gains confidence, it progressively tightens segmentation policies. If an application change or update occurs, the system automatically relaxes policies, recalibrates, relearns, and then re-tightens them. This continuous learning approach emulates human expert behavior but without human intervention, ensuring policies remain relevant and effective in dynamic environments.

• Intelligent Vulnerability Management: This process starts with existing vulnerability scanners, which often generate an overwhelming "500, 1,000, maybe even 2,000 CVEs every single week." The new approach applies AI to this output:

1. EBPF Check: Determines if a vulnerability (e.g., a hypothetical "Log5J") is actively "running in memory."
2. AI Exploitation Check: AI bots scour the dark web, chat boards, and Git repositories to ascertain if the vulnerability is "actively being exploited in the wild."

This combined intelligence prioritizes a manageable subset of critical vulnerabilities. For these high-priority items, the system automatically applies compensating controls within the infrastructure. Crucially, these controls are lifecycle managed: once the underlying vulnerability is patched and verified, the compensating control is automatically removed. This transforms vulnerability management from a reactive, overwhelming task into a proactive, prioritized, and automated defense.

• Self-Upgrading and Self-Managing Infrastructure: Addressing the challenge of updating critical inline security devices like firewalls, the talk proposes a radical model:
• Distributed Enforcement Points: "Little tiny baby network enforcement points" are deployed ubiquitously throughout the infrastructure, even right "up next to your Kubernetes cluster" or a "blood analyzer."
• Digital Twins: Each enforcement point runs not one, but two instances of the software (e.g., version 2.0 and 2.1) as a "digital twin."
• Local AI Qualification: A local AI engine continuously compares the performance of the two versions, monitoring metrics like "memory, latency, and jitter." After a qualification period (e.g., "three days, five days"), if the AI determines they are "exactly the same," traffic is seamlessly shifted from 2.0 to 2.1 "without opening a ticket or dropping a packet." This process repeats for subsequent updates (e.g., 2.2).
• Shadow Data Path for Policy Verification: When new policies or compensating controls are pushed, they are first applied to a "shadow data path." The system then tests and verifies that the policy will not have "weird unintended consequence" on live production traffic. Once qualified by the AI, the policy is automatically promoted to production.

This innovative approach results in a network security system that can "upgrade itself, writes its own rules, tests its own rules, qualifies its own rules, lifecycle manages its own rules."

Demo / Proof of Concept

▶ Watch: Tactical concern 2: Patching challenges, critical infrastructure exposure (6:36)

While the presentation itself did not feature a live, on-stage demonstration of these capabilities, Tom Giles explicitly stated that these are not distant future concepts but "real technology that when you walk around on the show floor, you're going to see demos of this today. This is happening in months not years." The talk served as a conceptual demonstration and articulation of how these advanced building blocks—AI, EBPF, and DPUs—are being leveraged to create tangible, deployable solutions.

The examples provided by Giles effectively functioned as detailed conceptual proofs of concept, illustrating the practical application of the proposed architecture:

• Automated Dynamic Segmentation: The description of AI agents using EBPF to continuously learn and adapt network segmentation policies, progressively tightening and relaxing them based on observed application behavior, served as a clear proof of concept for autonomous network control. This highlighted the ability to move beyond manual, static rule sets to an intelligent, self-managing system.
• AI-Driven Vulnerability Prioritization with Compensating Controls: The hypothetical "Log5J" scenario demonstrated how AI and EBPF could identify critical vulnerabilities that are both in memory and actively exploited, leading to the automatic deployment and lifecycle management of compensating controls. This illustrated a shift from reactive, overwhelming patch management to a precise, automated defensive posture.
• Self-Upgrading Security Infrastructure via Digital Twins: The detailed explanation of running two versions of security software side-by-side (digital twins), with local AI engines qualifying new versions and seamlessly shifting live traffic, presented a compelling proof of concept for zero-downtime, self-managing security updates. The "shadow data path" for policy verification further solidified the concept of an intelligent, resilient security fabric.

These conceptual demonstrations underscored the speakers' assertion that the necessary technological components are mature and ready for implementation, transforming what were once theoretical capabilities into practical realities for enterprise security.

Defensive Implications

▶ Watch: Tactical concern 3: Updating critical and legacy infrastructure (8:00)

The reimagined security architecture presented by Cisco has profound implications for cybersecurity defenders, offering a path to overcome long-standing challenges and operate with unprecedented efficiency and resilience.

Firstly, the shift towards dynamic, continuous learning segmentation fundamentally transforms network defense. Instead of relying on brittle, manually configured rules that struggle to keep pace with hyper-distributed microservices, defenders gain an autonomous system that understands application behavior intimately via EBPF. This means lateral movement, a critical phase for attackers, becomes significantly harder to achieve and sustain. The system's ability to automatically tighten policies and adapt to changes reduces the attack surface continuously, moving towards a truly adaptive Zero Trust model where trust is never implicit.

Secondly, the proposed approach to vulnerability management significantly alleviates the burden on security teams. By applying AI to filter the deluge of CVEs, defenders can prioritize vulnerabilities that are truly critical—those "running in memory" (identified by EBPF) and "actively being exploited in the wild" (detected by AI bots monitoring dark web and other sources). This intelligent prioritization allows teams to focus resources on the highest-risk threats. More importantly, the automated deployment and lifecycle management of compensating controls provide immediate protection against actively exploited vulnerabilities, bridging the dangerous gap between vulnerability announcement and patch deployment (which can be 20-45 days while exploits emerge in single-digit days). This dramatically reduces the exposure window and the likelihood of successful attacks leveraging known, but unpatched, flaws.

Thirdly, the concept of self-upgrading and self-managing security infrastructure using digital twins and local AI engines promises to revolutionize the operational overhead and resilience of critical security devices. The ability to seamlessly update firewalls and other inline enforcement points "without opening a ticket or dropping a packet" eliminates the rigid change control windows and associated risks. This ensures that security infrastructure is always running the latest, most secure software, closing vulnerabilities almost immediately upon release. Furthermore, the shadow data path for policy verification means new security rules can be tested for "weird unintended consequence" by machines before being promoted to production, drastically reducing human error and the risk of misconfigurations impacting business operations. This continuous, automated update and verification process drastically improves the overall security posture and operational stability.

Overall, these advancements empower defenders to shift from a reactive, human-intensive struggle against an ever-growing threat landscape to a proactive, intelligent, and highly automated defense. Security teams can move away from mundane, repetitive tasks to focus on strategic threat intelligence, hunting, and architectural improvements. The integration of hardware acceleration via DPUs ensures that these advanced security functions can operate at the massive scale and speed required by modern, AI-driven digital environments, making security an enabler of innovation rather than a bottleneck.

Key Takeaways

• Paradigm Shift to Abundance: AI is driving a fundamental shift from scarcity to abundance in digital capacity, requiring a complete reimagining of cybersecurity architectures to protect this expanded environment.
• Three Foundational Technologies: The convergence of AI, kernel-level visibility (EBPF), and hardware acceleration (DPUs/GPUs) provides the necessary building blocks to solve long-standing security challenges.
• Automated, Dynamic Segmentation: AI agents leveraging EBPF will enable continuous learning and self-adjusting network segmentation, moving beyond static rules to dynamically contain threats and enforce Zero Trust principles.
• Intelligent Vulnerability Management: AI-driven analysis of vulnerability scanner output, combined with EBPF's in-memory checks and dark web monitoring, will prioritize critical threats and automatically deploy/manage compensating controls, significantly reducing exposure windows.
• Self-Managing Security Infrastructure: The "digital twin" concept, powered by local AI engines, will allow security devices to self-upgrade and self-manage policies with zero downtime and automated verification, drastically improving resilience and operational efficiency.
• Security to the Workload: This is not an incremental update but a "first version of something completely new"—a hyper-distributed security architecture woven directly into the fabric of applications and infrastructure, operating autonomously at unprecedented scale and speed.

About the Speaker(s)

Jeetu Patel is the Executive Vice President and General Manager of Security and Collaboration at Cisco. During his presentation at RSAC 2024, he highlighted the exponential growth in the importance of cybersecurity over the past three years and expressed his excitement about the "seismic change" he anticipates in the industry's operational model. This marked his third appearance at RSA with Cisco, underscoring his consistent engagement with the cybersecurity community and his role in shaping Cisco's vision for the future of security.

Tom Giles is a colleague of Jeetu Patel, also presenting at RSAC 2024. With a history of speaking at RSA, having first appeared on stage 14 years prior, Giles brings a deep understanding of industry trends and technological evolution. His contribution to the talk focused on providing a detailed technical deep dive into how the foundational technologies—AI, EBPF, and DPUs—can be practically applied to transform network controls, vulnerability management, and infrastructure updates. His insights emphasized the real-world applicability and imminent arrival of these advanced security capabilities.