Kyndryl's State of Modernization report shows that security requirements are one of the biggest challenges for organizations modernizing their technology. Frontier AI increases the complexity. The new capabilities also expand organizations’ ability to detect threats and recover from incidents. In this episode, Canadian passenger rail service, VIA Rail, joins us to look at what AI means for enterprise cyber resilience, and what it takes to scale AI securely with trust and accountability built in. Featured experts Janna Dewar, Director, Cybersecurity & Architecture, VIA Rail Kate Yamashita, VP Global Security and Resilience Lead – Kyndryl Consult
Kyndryl's State of Modernization report shows that security requirements are one of the biggest challenges for organizations modernizing their technology. Frontier AI increases the complexity. The new capabilities also expand organizations’ ability to detect threats and recover from incidents.
In this episode, Canadian passenger rail service, VIA Rail, joins us to look at what AI means for enterprise cyber resilience, and what it takes to scale AI securely with trust and accountability built in.
Featured experts
Kate Yamashita 00:00
Security has always been seen as a blocker in an organization, and especially now when AI is enabling organizations to move really fast, nobody wants to stop and think about security controls. But really, at the end of the day, I think what we're starting to see is a shift in this understanding that security can be an enabler to the business because security can build that trust.
Tom Rourke 00:24
Hello, and welcome back to The Progress Report. I'm your host Tom Rourke. With Frontier AI so much in the news cycle today, we're exploring some of the questions and choices it raises about enterprise security. Kyndryl's just released State of Modernization report shows that security requirements are one of the biggest challenges companies face in keeping their tech stacks current. In fact, that's only part of it. We're in a moment where AI is moving faster than the operating models meant to manage it. I'm joined today by two people who are working very actively in the management of these issues: Janna Dewar, who is the Director of Cybersecurity and Architecture at VIA Rail, and my own colleague Kate Yamashita, who is the VP and Global Security and Resiliency Lead here at Kyndryl Consult, Janna, Kate, you're both very welcome to The Progress Report.
Kate Yamashita 01:07
It's great to be here, Tom.
Janna Dewar 01:08
Good to be here.
Tom Rourke 01:09
Okay, so I wanted to just jump straight in, and you know, today we're going to be talking about the implications of Frontier AI for cybersecurity. But you're both, you know, professionals that have been in the industry for quite a while, and if maybe just for our listeners, you might just give us a little introduction to your own journey to this moment, as it were. And maybe if we start with you, Janna.
Janna Dewar 01:28
Sure. So my journey started a long time ago when I was in university and didn't really know what to do, and I was working at the help desk, and there was a little help needed on the IT security side because it was a time of viruses and worms, and that's really where my career started. Really, I have been in cybersecurity for 20 plus years, and the last 11 years at VIA Rail Canada, primarily in a cybersecurity role, and just in the last year taken on enterprise architecture, which gives me a larger view and more interesting discussions.
Kate Yamashita 02:01
Yep, I too have been doing it for a long time. As Janna, we've both, I think, seen the industry really evolve over the past couple of decades. I started off more on the national security side, where I truly believed I can save the world and also protect the country, and so I started thinking about security very much from that lens. But was also a tech geek, and so a lot of my career started to dovetail with what we would now call cyber threat intelligence and cyber security operations. And so I started to dabble in that, and I started to realize that this was something that was exciting, and it very much fit into the broader security narrative and figuring out how we can solve these problems.
Tom Rourke 02:39
I am interested, actually. I think Janna, your framing was was perfect in the sense of like you started at a time when you know the cybersecurity threat was viruses and worms. But I guess, there feels to be like there's this more than just simply a continuum here. It feels like we've we've taken a kind of a we've hit a fracture line, as it were, in the impact of you know Frontier AI and cybersecurity. And Janna, you you live in a world where you're protecting information security, but where there's like big important physical things moving in that space as well. What is that kind of fault line looking like from your perspective?
Janna Dewar 03:12
It's a lot different now. I mean, even just in the last few weeks, as we're talking about new initiatives and sort of meeting the business and their needs, there's a lot more considerations. And by the time you finish discussing it, your controls that you thought or the guardrails you needed are no longer sufficient. So I think it's that adaptation, or sort of what what do we need to prepare for, and how could we be more future looking? That's really difficult right now. And as fund it is from from our perspective, because it changes, it's hard to see if if we're doing the right thing in this moment and planning for for what's next.
Kate Yamashita 03:45
Yeah, you know, you called it a moment, and a lot of people initially started this whole narrative around the mythos moment, but it's really not right. It is really an absolute shift. I think you called it a fracture, Tom. You know, but it's you know there's been a couple times I think in our careers where we've seen these fundamental shifts in the way we need to think about security. So Janna mentioned the guardrails, right? Like we were thinking about controls and guardrails, and we were trying to figure out how to close as many windows as doors as we could to limit the attack surface. But now our attack surface is fundamentally changing, not just on a day-by-day basis, but by on an hour-by-hour basis. So addressing the challenges Janna mentioned is how do we start now not just doing point-in-time capabilities in this space to reduce the risk, but how are we really thinking about continuously sort of managing our attack surface as well as continuously validating identities and access across the environment and really focusing on continuously building trust. We can't just certify a system once nowadays. Now we have to really think about you know not just that forward-looking thing that Jenna was talking about, but how are we really changing our operating model to enable this continuous monitoring, continuous validation, and continuous. Continuous risk reduction across the environment, so that we can manage this new sort of frontier that we are entering. Not to use a pun, but.
Tom Rourke 05:08
But I get a sense that it's not just about the CISO anymore. That this is now about a much broader audience of interest and people we need to talk to. And again, Janna, within your organization, you have a dual head of security and architecture, but like, what is the audience for that conversation about security?
Janna Dewar 05:25
It's really the business owners. It's the executives. It's at all levels of the organization. It's no longer just a conversation of cybersecurity, and it's it's always easy to punt to us, right? But it's really about understanding what goals and objectives the organization has, and how can we help them along the way? And again, a lot of time, cybersecurity, we came from a place of "no". So how do you show that you're really partnering with the business and listening to them, allowing them to do more, but at the same time keeping things safe? And we talk about trust, right? Trust is very important for our organization. Obviously, as the national passenger rail service across Canada, we move people coast to coast to coast, so that trust it doesn't really start at the in the train. It really starts in our systems and how we're managing our customer information, and the expectation is a lot higher as well. So there's a lot at stake.
Tom Rourke 06:15
So Kate, we talked a lot about the changing roles and the change of responsibilities with regard to cybersecurity, but how has that sort of stakeholder landscape changed for you over the course of your career?
Kate Yamashita 06:24
Yeah, I mean Janna's exactly right. You know, I think when I first started out, we were just trying to get business owners and executives to care about security, and they now do so in a way they never did before. We are now at the table where we're risk advisors, and we're advising the business on true risks to them, and we're also accountable for helping to reduce those risks. And so I think that puts the CISO in a completely different sort of conversation at companies across every industry, but in particular in ones like Janna's, where it's not just security we're talking about, but security and safety are commingled. And I think that's a really, really powerful, influential, and impactful role that CISOs are now entering into as a result.
Tom Rourke 07:06
Yeah, I think that's really interesting what you both said there. But can I just, Janna, at least one of our customers that I did some work with recently has done something where they've actually brought the the chief technology officer and who essentially owned architecture and the CISO roles much closer together. They've shifted their mindset into essentially the way they would describe it is architecting in security and resiliency from the outset. Is that something we're seeing in the industry where it's bringing the CISO role and the architecture roles closer together or to a point of equivalence, or how are organizations dealing with that?
Janna Dewar 07:43
I think, from our perspective, it's really helped. Just because you know, if you look back, we talk about privacy by design, security by design. How do you build in that that security and that safety into whatever you're developing, whatever you're building and offering to your customers?
Kate Yamashita 08:00
Security by design and getting security included upfront is the absolute hardest thing we've had to do because we have to win over usually business owners and application owners and we have to be everywhere at once. I think the other place where architecture and security has been really powerful, and I've seen a lot of companies invest in this org shift, is thinking about resilience architecture and making sure that we're not only doing security by design, but we're doing recovery by design, and we're thinking about it from an infrastructure perspective and a data perspective to make sure that companies can come back online sooner. So I think the marriage of those two architecture sits right at the middle, and that to me has been not everyone is doing, not every client I've worked with, but the companies who have have been able to move security from you know backline defense to something much more proactive in the organization have been very successful.
Tom Rourke 08:50
You know we've been talking a lot in recent podcasts around what differentiates the pace setters from the laggards in the deployment of AI. I mean, are there characteristics of organizations that help set them apart in terms of those who are more effective at establishing trust, or you know, and having a sense, you know, a strong sense of security and safety, you know, effectively embedded in their organizations. Like, are there stereotypes or models beginning to emerge, or is it still very different across organizations?
Janna Dewar 09:20
I think a lot of us are trying to figure out what that model looks like, so it's not very easy. But what's worked for us is to really partner with our legal team, just because we do have personal information as part of our data set. Really working with our enterprise risk team so that they can kind of bring that conversation as well. And we're also seeing a shift, and before we had all of these different distinct committees, right? So we had our infosec committee, we had our data governance committee. We're unifying those committees because we see the importance of bringing all of this together at once. So you're talking about data, you're talking about security, you're talking about privacy all at once. So I think, and and as well as. Architecture, so I think that's a winning combination for us, and we just see that it's going to be setting us up for being a lot more adaptive as we see governance needing to sort of respond to the ever-changing landscape.
Kate Yamashita 10:12
I think that there is a push in the industry to figure out how to simplify that technology landscape to make it easier. I think in addition to looking at the technology layer, there's also a view of the data layer. And now, thanks to AI, how can we actually, instead of consolidating all the technologies and tools, but can we actually get, you know, like a unified data lake and enough orchestration and automation on top of that, and that can help us make sense of it, and the AI that can actually help us make it, you know, useful and actionable in the organization. So I think it's always going to be a big data problem on one level for security, and I think AI is helping us unlock that. You know, but being able to get access to all the data is going to still be continue to be a hard problem. And I do think that we'll continue to see technology vendors trying to figure out how to add more capability into their suite.
Janna Dewar 11:01
You know the consolidation, also the reduction of complexity, especially when you're trying to protect all of these different systems. That consolidation really helps us as well because you have sort of at least a smaller or sort of like the view of what you need to protect versus having multiple systems, multiple third parties. Some of them integrate, some of them don't. Some of them are supported, some of them are not. There really is a push, both from a cost optimization perspective, to simplify what your architecture needs are, so that you can properly protect. And I would agree. We love seeing some of these vendors kind of offer more capabilities because a lot of times they'll come in with just like a licensing, so you're able to benefit from them very quickly, versus having to integrate all the time. That also kind of slows it down a lot of times.
Tom Rourke 11:48
You know, what seems to be the emerging pattern with the successful implementation of AI is that you need to infuse AI literacy or fluency into a much broader, you know, range of people within the organization. It's not simply about having your, you know, your deep specialists, your forward deployed engineers, even your human systems architects. It's about everybody, me, everybody needs to have a fluency. I mean, is there an argument for we really need within organizations to go beyond, you know, the fairly basic security awareness programs that we run for our organizations into having people with a much deeper, you know, set of skills, even or just their sensitivity to security, but also like how they make their own business processes resilient?
Janna Dewar 12:34
So some of the discussions we're having as we're we're talking about AI literacy, right? And and it's something we've been doing for a while for cybersecurity. How do you bring everyone sort of understanding of what the current threat landscape is, so that they'll be able to at least identify and then question? It's a lot of things that we look at because, again, you're asking someone to to learn their job and then learn more and do more. You have a lot of individuals that are very much interested in looking at how do I redesign my processes so that we can automate a lot of the stuff that I find is boring. That it takes me like 40 minutes to do a report, which should be taking an agent a couple of minutes or seconds to do. So there is that willingness for some individuals, and we're trying to like look how we can leverage that within sort of a champions program, so that so that the others in the department can see what's the art of possible, but I think it's really looking at different skill sets. That it's really about process redesign is I think one of the big things that's going to be important because there's no AI without data, and there's no automation without good processes.
Kate Yamashita 13:37
You know, we're not just talking about upskilling people and making them aware about security, but we're introducing agents who are now going to have access. You know, at the application level, the infrastructure level, the process level, and they're going to be doing some of the work, right? And so, when we think about it from that perspective, can we, again, can we infuse security into the modeling that we're doing on these agents to help kind of drive security at that level. Can we talk about data handling best practices and making sure that you know, in addition to trying to uplevel people's awareness around those controls and policies in the company, but are we also doing that in the way that we automate and that we build these processes? And I think that's going to be really key too to help offset some of that risk because you know human behavior is human behavior. I mean you can only kind of control that so much. I'm seeing a lot of clients start to invest in a multi-model approach where they are able to pick open-weight models, open-source models as well to offset some of the cost so that they could put some of these tools in the hands of the security team, so these are really significant changes in the way that our defenders and the people that are working for our companies to protect our companies are going to be able to do their job faster. The challenge, I think, is going to be having an operating model that will enable them to do that continuously, and the investment to be able to sort of take on these tools.
Tom Rourke 15:01
We, I guess, have always been aware of the issues that can arise inside the organization. So the individual that goes rogue, you know, either accidentally or deliberately, causes some harm because they've done something inside. But I guess there's a new threat surface which is our own AI, you know, that effectively, you know, how do you secure the organization against essentially your own AI, like poor designs in your own AI, or is that is that seen within the remit of the security organization within an organization, or or is that still in the land of well, that's just like your application broker didn't perform, you know? So I'm kind of curious about is there now a role for the security you know, function to be actually more actively concerned about the internal design of internal operating models because actually they could become the greatest source of threat?
Janna Dewar 15:52
Definitely, and obviously, you're seeing and you're hearing a lot about some of these companies that are actually developing these larger language models and themselves having difficulty containing their AI agents. So for us, it's pretty top of mind to figure out like how can we actually look at this. And if you think of like an insider threat program, you kind of have to have the same thing for your agents. Whether you have your identity management to manage these agents, right? You have the controls around them, and then monitoring to see what they're doing, and then following up if there's anything that's off course.
Kate Yamashita 16:24
I mean, this is going to be top of mind for people like me and Janna, and CEOs and board of directors. It is hard because you now have non-humans in the environment, and I think what's really interesting about that is, you know, they're not just getting access to the system, but they're also in some cases able to make decisions and take action on those systems, right? So I think some of this goes beyond just looking at securing AI, but thinking more broadly around digital trust. How do we trust what's happening in our environment? How do we know that the things that we want, the people and the non-people, that we want to have access to certain systems and data have the right access and then the right authority, and more importantly, on top of that, whether or not there's agents that are taking action on these systems, do we still have the right accountability in place to make sure that there's the quality control? So we can't just take people out of the loops, even if we're automating and identifying certain processes. So who is still accountable for all of that?
Janna Dewar 17:22
Yeah, and one of the discussions a lot of us are having in our domain is about governance, the importance of governance, and not governance is what you can't do, but what can you do? And I think that's the way we have to sort of change the narrative, and bringing in all of the different components that you have for your systems will have to apply to your agents as well. And then what's funny is that you know humans, as we monitor humans, you know that they come in a few at a time. You're talking about hundreds, potentially 1000s of agents that are being deployed that you'll have to manage. So it is expanding what we as a team, and it's not as if we're expanding our teams ourselves. So how do you do with what you have when the landscape keeps changing? It's definitely a challenge that we're all trying to figure out. It is a cultural transformation, I would say, for any organization because when you talk of governance, governance is slow. You got to build your policy. You got to have it approved. You got to roll it out. You got to implement it. We don't have that time right now, so it has to be quite adaptive. Dare I say, agile? And I think that's a challenge for governance specialists because you normally will have that time to figure out what that looks like, and you don't. So it's important to have the right people at the table and to have the right input as well. So that's one of the things that we notice is that we wanted to bring in those practitioners within our governance as well, so that we can see what is the reality of today. So that when we're designing different governance, it makes sense for the people that it's actually going to apply to.
Tom Rourke 18:54
I want to just focus maybe a little bit now on on the resilience side more than even the security piece. We all know that for AI to be effective, we need to be able to completely redesign our workflows, or our organizations, or our processes. And I guess is this either a moment of just huge threat, or is it also a moment of great opportunity that as we are redesigning those processes, maybe for different motivations because we're implementing AI, but with the right mindset, we can also take the opportunity to redesign them in a more resilient way, and are people embracing that opportunity case?
Kate Yamashita 19:26
The answer is yes, and to me, I've been really passionate about resilience for a long time because when you think about just the broader security conversation around, "it's not if but when", and Frontier AI now takes that to a whole other level, so the not if but when paradigm is really forcing us to rethink the role of resilience in an organization, and I think our clients are starting to figure that out. Whereas, you know, when we would think about resilience, it was typically an enterprise resilience conversation, and where it sort of overlapped with security, it was really basically business continuity or disaster recovery. It was a very operational, reactive role that security had in that conversation. Whereas now, I think what we're seeing is that security is making resilience a core part of its strategy, and enterprise resilience is considering security as a core part of its success as well. Because it's not as simple as saying that we are going to recover from this disaster anymore. It is about how do we bring these systems back online. What systems do we need to bring back online? What are the dependencies? And of course, the reason why those systems matter is because they support processes that we need in order to operate, and that we need to serve our clients and we need to serve our stakeholders, et cetera. So we call that minimal viable company or minimal viable business. What are those systems that we need? What's the data that we need in order to come back online and achieve that minimal viable business? So I think that's been a conversation that, especially since Frontier AI models, we have seen a lot of clients really focus on that and understand that resilience is a core part of this story and there's you know overall security strategy.
Tom Rourke 21:01
The other thing we talked about very right at the beginning, Janna, you used the word about trust, and I guess without being too esoteric, it feels like there is a layer here which is around how we innovate with AI in a way that is secure in like in an absolute sense. You know, we haven't corrupted or or lost our data, but there's also this extra layer of how we haven't, in any way, damaged the trust of our customers. So that it feels like, you know, on the one hand, there's a lot of things you could do, but there's a lot of things that you maybe should not do, right? Because you have to maintain that trust. And I guess you know, to what extent do we feel like people are beginning to develop the right sort of judgment skills in being able to balance that?
Janna Dewar 21:41
I think it's important to be transparent about how you are using AI in your operations. So I think it starts there, and then we kind of try to see, you know, is this something that we'd want to do? Is it something that our customers would be okay with us doing? So it really comes just back to basics about what's the problem you're trying to resolve? Will it provide better experience for your customers, for your employees? So I think that's really at the core of all of it.
Kate Yamashita 22:11
Security has always been seen as a blocker in an organization, and especially now when AI is enabling organizations to move really fast, nobody wants to stop and think about security controls, but really, at the end of the day, I think what we're starting to see is a shift in this understanding that security can be an enabler to the business because security can build that trust, right? So if we can, you know, leverage not just the transparency, you know, but that we're putting in the right controls and we're effectively able to make you trust the AI agents, and you're able to trust the actions that are happening because they are also secure. Then the business can move faster. So the concept of security being an enabler has sort of come into a different light than it used to be before because it is, I think, being able to demonstrate results on you know helping enable a business to innovate faster and really adopt some of the AI at the enterprise level because we trust the models that we're putting out and I think that that is key and that's a good shift that we're starting to see.
Janna Dewar 23:12
I'll just kind of reframe how the trust it really has to serve a mission, so it has to serve the mission of your organization. It has to strengthen sort of the promise that you give to your customers, and it has to make your mission stronger. So at the end of the day, they they have a better experience and they receive a better service from the organization. So I think that's really important.
Tom Rourke 23:34
Super, and we're getting towards the end of our time, and it being The Progress Report, we always like to ask our guests, you know, to look forward a little bit and to talk about what what does progress look like for them in their in their space. So I'm going to start with Kate because I can see Janna is just exploring the possible answers to that question. But Kate, what does progress look like for you?
Kate Yamashita 23:54
What I'm hoping is that we will continue to see either parity of cybersecurity defenders, people on you know the good guy side, what we'll call them, you know, and that they were able to sort of adopt AI to increase the speed that we can identify, detect, respond, recover to these types of AI risks that are being thrown at us, or even exceed you know the adversary's capabilities. For a long time, the defenders have always been trying to play catch up, but I think we're at a point where, with the right investment, we'll start to see where the defenders are going to also have very similar tools to meet this the the speed of AI risks that we're going to have to deal with. So I think this is a really good flashpoint that's going to catapult us into a new level of security that will be more embedded across the organization instead of sort of siloed off in an operational corner.
Janna Dewar 24:46
That was a great answer, Kate. I think yeah, if we could be ahead of the adversary, I think that we that's a win. Always being behind, always seeing okay, what do we need to put in place? Are we actually protected against this? Can we actually identify if something happens to be able to say, hey, okay, we're already here, we're already like you know developing new capabilities faster than the adversaries. I think that's a really good position for defenders and for any organization trying to protect its information assets at the end of the day. So if we can get there, I'm all for it.
Tom Rourke 25:21
As always, there's more to talk about than we could possibly contain in just one episode of The Progress Report. What's clear is the threat landscape is changing very rapidly, but what's also clear is that the industry is stepping up and responding to deal with it effectively, changing organizational models, widening the education that's provided to all of our colleagues, but also the emergence of new professionals and new technologies to deal with these threats, but as Janna reminded us, while also remaining very focused on what is the problem we're trying to solve and what is the experience we're trying to deliver for our customers. I hope you enjoyed today's episode, and if you did enjoy it, please do share it with your colleagues and like and subscribe for future editions of The Progress Report.