D (15:52)
There we go. All right. I see some familiar faces. This is a great crowd. It's great to be in the spy museum. I've never been to this location before, so really good to see so many familiar faces, so many folks talking about these important topics on cybersecurity, artificial intelligence. I am sure that you've heard quite a bit on the threats and opportunities of artificial intelligence, its convergence with AI. I will spare you some of that. I just learned I'm between lunch and an awards ceremony, so I will be brief. But I'm happy to speak with you after my remarks today. I think whether you consider this to be an inflection point or a wake up call or just the next kind of iteration of technology across our landscape, I think we have clearly crossed that threshold threshold of panel discussions and hypotheticals and experimentation to actually kind of an operational reality in cybersecurity when it comes to the use of artificial intelligence. And it's a reminder that we are long past the point where we can start considering our next step. We have to be here at this point. The decisions that we're making now have to consider agility and resilience as this environment continues to evolve. And this really is a pivotal moment. I'm probably saying the things that many of the speakers and panels have already said today, but I think it's important to reiterate, emphasize the point that we're in Our foundational cybersecurity policies have largely been shaped over the past decade in response to significant cybersecurity events. I'm sure many of you reference these on a daily basis. As you're pointing back, remember when we responded to X, Y and Z, Remember what happened when we didn't have this or that? Those policies were not designed with AI and the risks inherent to this new era in mind, nor do they fully harness the potential and the opportunity that we have based on where we are today. And yet good cyber policy has to be enduring and adaptable to whatever is thrown at us. We have to react but not be volatile. We need to be forward thinking and vigilant, but not overwrought. We need to make sure that what we are putting in place now can endure in the future as we consider the future environment as it changes now. Fortunately, a lot of those core principles that we've been working through and implementing over the years still largely apply. Zero trust. Know your environment, operational visibility, you know, reducing your attack surface, prioritizing high value assets, hardening your cloud environments, all still extremely important for us. And our roadmap favors decisive action with these existing constructs while deliberately adapting those policies over time. It should reflect what we've learned as we proactively take action, not when we are picking up the pieces. We should be thinking about what policies are necessary based on the capabilities, the threats, the issues that we're seeing now, and ensuring that we've built that policy apparatus, this mechanism in place now so that we can move forward confidently, focus our people, our processes, our technology on where we will be going and where the technology is leading us. Importantly, as we enter this new era defined by AI interconnections, the expanded dependencies that all of us have, we can't wait for the next crisis to inspire our action. And I think that's the call that you've likely heard from many of the speakers today. This is not the time to wait. For the next thing, we need to resource coordinate, orchestrate what action looks like, put those policies in place, take immediate action, decisive action to get ahead of this threat and move forward confidently. Now, the administration has been clear on its goal to leverage technology to better serve the American people. Faster services, more secure services. And in fact, the President's management agenda also has a cybersecurity specific cross priority goal. This is a very important step, the administration taking this responsibility seriously to ensure that we are not only modernizing the services to the American people, but we are adequately securing them on their behalf. Now, our roadmap is shaped by three priorities that I've discussed in forums similar to this one. The first being focusing our enterprise cyber defense. That's really making sure that we're operating as a federal government, as a cohesive unit, as a unified front. We're making best use of our cyber investments across the board to act more efficiently and to work with each other moving forward. Second is improving operational resilience. That's continuous mission delivery regardless of the persistent threats and risks that we're facing. And third is securing the modern United States government. The modern government in the sense that as all of us are thinking of ways that we're modernizing how the government serves its people, we know that new technology and new approaches will require us to consider security in different ways moving forward. Now, all three of these priorities converge when we're looking at ways that we are optimizing cyber defense for the enterprise, both within agencies and across all agencies, to ensure that we are fully coordinated against these AI enabled attacks, that we can make strategic decisions based on the threats that we're seeing in our landscape and we can rapidly respond as they come. I'll mention three of these initiatives that we have ongoing right now with agencies to give you a sense of sense of where our focuses and our priorities lie. First, we have to consider the impact of emerging technology and the threat environment when it comes to the most basic processes, procedures and protocols of the government. We ask a simple question. Are agency teams prepared to respond to the next big thing? Can we across the interagency ensure that our protocols are in place and efficiency efficient and effective to counter the threat, but also respond effectively? This is where resilience is so important. Last month I convened over 60 cyber practitioners, leaders in both CISO positions as well as SOC directors to have a discussion on this. A tabletop for the first time across government to hear from the civilian departments and agencies, what are the protocols? What are the procedures? What might fall as we're Looking at faster attacks, scalable attacks, issues that we haven't seen before. What are the gaps, what are the overlaps, what are the redundancies that we might have in place today? It highlighted opportunities that we're already putting in place. This is the way tabletops and exercises are intended to work. We discuss it. It pushes us to the brink and we find ways that we can build the way that we should be operating better. The bottom line is cross agency teams can no longer respond to massive cyber incidents to the federal government with sharing emails and phone calls and PDF files on threat intelligence. This is a different time. We have to make sure that we're postured correctly to address that call. Second, considering the efficiency and optimization focus that I know many of the speakers have seen spoken about, we're working with CISOs to rationalize their cyber technology stacks over time. There's been a lot of bloat across agencies, a lot of different reporting across bureaus, and it's time now to consider how do we empower the CISO role to make strategic decisions in a moment's notice, both for budget, for resources, for strategic plans, but also when disaster strikes, do we have the information at our fingertips to pull together a response plan moving forward? And of course, in doing so, we'll consider things like redundant insufficient capabilities, the use of modern technologies and modernized enterprise wide capabilities and shared services such as continuous diagnostics and mitigation, the program from CISO. Now, this has been a top priority for CISOs for a lot of reasons as they undertake within their own departments and agencies, modernization efforts. So we're all kind of reflecting on the way that we are postured against this threat, making good use of the opportunity that we have ahead of us. And finally, as we're kind of scanning the horizon, considering what may be coming next, the opportunities that we have because of artificial intelligence and more seamless operations. We're working with agencies to transform the way that they're doing cyber defense, enabling faster detection, predictive analysis, targeted response at machine speed. We're identifying a small set of relevant cyber use cases in AI to move this forward. As I said at the beginning, our policy can't be shaped as we're picking up the pieces. We have to be proactive, piloting what might work, test it out, see if we can scale it from one agency to the next so that we can build the roadmap moving forward. This is a continuous, adaptive approach as we work. Recently, the Federal cio, Greg Barbaccia, has overseen some really positive progress in doing a federal AI sprint on more general technologies across the government. We're now turning our attention to cyber specific use cases to ensure that we are ready for the threat. We are poised and postured to move forward confidently into the future. Now, leading agencies, I know many of them I saw on the agenda. Leading agencies in the federal government are already doing this. They're tailoring highly customized threat detections, response capabilities. Others are demonstrating AI tools already and working with many of you in this room, I'm sure. But adversaries don't stop at agency boundaries. Those are artificial. We know that it's not good enough for a few really advanced federal cyber teams across government. We need to work cohesively as a unified front, ensuring that we are raising all capability and posture across agencies because we know that's how adversaries view the federal government. It isn't individual agencies. And we'll stop once we get to the end of this network. Now, across all these efforts, our model, our intent is to partner, to pilot, to scale and institutionalize as appropriate in policy and in practice. As I said at the beginning, this isn't about just finding a way to fix an old policy or to fast track a new way that we're looking at emerging technology. This is intended to inform the way that we develop policy, consider our roadmaps, build strategy, and adapt to the environment that we are currently in. I think it goes without saying that this is a defining moment for the federal government. I don't think it's enough for federal agencies to be a few years behind what the state of the art or leading private sector entities are doing. I think we need to be there at the front of that line, in fact, sharing those use cases, those lessons learned, those insights as we lead the way in certain areas and drive progress on behalf of the American people as we protect our digital assets. We're eager to demonstrate how the federal government can do this over the next year and be on the leading edge of what modern cyber defense will look like for the era ahead of us. So with that, thank you very much. It's great to see all of you and I'm happy to talk with you after the session. Thank you.
