Transcript for "Webinar Edited":
Alright. Hi, everybody. Welcome to our webinar. I'm really excited to kick this off. My name is Amy Tom. I'm the community manager here at d three Security. I'm joined with Philip Beck. Philip, do you wanna introduce yourself before we get started? Yeah. Sure. I'm the director of sales engineering at d three Security. Lead the engineering organizations, spend a lot of my time working directly with the security teams, right, trying to understand how they approach automation, AI, and kind of the challenges currently right now within SOC. So background is primarily in cybersecurity and security operations. Was an analyst working my way up to manager, etcetera, then jumped to the vendor side after that. So pleasure to meet everyone. Looking forward to it. Awesome. So we're gonna get started here in a minute with the actual meat of the discussion. But before we get started, I just wanna let you know that we are going to be running a giveaway for this webinar, which is very exciting. So we are giving away a couple of swag packages, two swag packages with the hats that you see Phil wearing. So... And that's gonna be for you and your team. So if you wanna enter the swag giveaway, all you need to do is use the chat functionality that's on the side of, the screen here, as well as ask a question in our q and a. We'll be addressing all of our questions at the end of the discussion, and then use that chat functionality. Let us know, and participate in in the discussion. And, at the end of the webinar, we'll be announcing the winners and getting in touch with you to send out those swag packages. So just so you know, that's happening while we're doing the webinar. And then... Yeah, we'll run it... We'll be running a few polls as well through the webinar. So if you, vote in those polls, that will increase your chance to win, the swag package as well. So, yeah, the the... Those polls, the chat, and the q and a, if you wanna participate in that. And then we also have a docs section in the sidebar here too. So a lot of the, research that we're gonna be referencing, has been kind of linked in in this doc section here. So you can go ahead and check that out if you want that too. But today, what we're gonna be talking about is a very exciting discussion about the first fully autonomous agentic attack against Hugging Face, that was done by OpenAI this summer. Very exciting in the security world of, like, what's to come and what we're dealing with today in today's threat landscape. And I just wanna caveat this discussion as well by saying that neither Phil or I are experts on this discuss... On this topic for for sure. We've just consumed the postmortem and, a lot of the interviews, around this discussion. So definitely check out that docs section, for the, links to the actual research, that we're referencing here. But we'll just get right into it. So, yeah, this summer, OpenAI was behind that first fully autonomous agentic attack. It was against Hugging Face and its own internal, research infrastructure. And by OpenAI's own admission, the actions of the models were unintended, fully unintended, and just a byproduct of the, models attempting to solve a cybersecurity evaluation. So during the incident, a 100 a... 1,200... During the incident, 1,200 agents, began unexpectedly communicating with each other, through Artifactory, which is how they just chose to set up this messaging board with each other, kind of hidden out of plain sight and trying to hide the, tactics that they're... They were using. They were also using tools spoofing to hide some of those tactics too, which was very interesting. But the agents exploited multiple zero day vulnerabilities to escape that sandbox that they were operating in, access the Internet, and then found publicly exposed credentials belonging to Hugging Face users, use those exposed credentials against Hugging Face, to access their information, and all for the pursuit of their goal to solve this evaluate... Cybersecurity evaluation task. And to give you a scale of the actual attack itself, over 7,000,000,000 logs were looked at to investigate this incident. And to me, that really brings up kind of two frames of discussion here. One is, like, how we can defend against these AI fueled attacks that are obviously on the rise and getting more powerful, and then how we can verify the actual AI tools that we are using are working. Right? So, Phil, like, let's start start off the discussion with the the first bit there of, like, how we are defending against these AI fueled attacks. I'm just gonna share share something. This is, just like a screenshot from the talk that, OpenAI did at Black Hat. Everyone should definitely go and watch that talk. I thought it was really interesting. But he... At the end of the talk, he discusses a little bit more about, like, what the future is going to look like and what the recommended actions are that people take to... In order to combat against attacks like these in the future. And I think, like, something that was really interesting that he said, and I'll just read this as a quote of, what he was talking about during that talk. And that link is in the doc section as well. But this style of incident with so many agents attacking infrastructure in different ways, moving laterally, changing tactics, it can be quite overwhelming in the data volume that it generates and very forensically dense in comparison to traditional incident response. And so OpenAI recommends that teams invest now in looking at defense, at how defensive agents can help your incident response team scale. And if you're doing manual effort with linear inactivity, then you're going to now see attacks in the future where that activity will be ramped up dramatically because AI will be accelerating the, offense in such a large degree. So we need to invest in our own defensive agentic work to scale out the human to scale out the human factor of incident response. I think that's so interesting that he says that we need to scale out the human factor of incident response. So, Phil, what do you think about this? What what does this mean for the future of the SOC? Well, I mean, like anybody else that's been here for a while, the landscape changes and it changes daily, it appears. So initially, what was our problem, you know, ten years ago, it's different five years ago. Now one month ago is a much different landscape. So from a defending against AI driven attacks, I think in that post mortem, right, they definitely talked about at least an initial playbook you can think about that kind of, like, at least addresses this problem. I know OpenAI proposed basically its own infrastructure, and some of those same fixes might apply to your own, right? So an independent review maybe before some type of execution. Obviously, if you have AI agents on board, OpenAI most certainly on purpose, right, put the guardrails off and then let it kind of run wild. So I would say, you know, don't let agent... Agents kind of privilege... Be privileged access or maybe actions that it has to do. Make sure they don't go unchecked. Right? Like, somebody needs to obviously be monitoring that if you do have it in an environment that allows it to run kind of out of control. So... And then, obviously, human review. You know, from that last part of that quote, you know, obviously, the automation of the the analyst, you know, that can... That's kind of like the scary portion that happens all the time. And, again, I think, it kinda reads, in my opinion, it kind of makes it like now the human is very much important because, again, someone needs to review this, someone needs to flag it, obviously, defense in-depth. Right? There's no single control that's going to be trusted. They got as far as they did because no one had a foothold, right? Escalation passed. There was no gated kind of a layer there. So things need to be checked. You need to understand, like, okay, the trustworthiness of AI, what you're allowing it to do, what you can control to do, what you can fine tune it to do. That's gonna be kind of the next phase from at least a detection standpoint with, you know, hey. Once these AI driven attacks start to come, you know, much more rapidly, probably, I'm assuming at large volumes, these are some of the things we initially need to do now to kinda get ahead of it. Yeah. For sure. Let us know in the chat if you watch that talk, that black hat OpenAI talk and and what your key takeaways from that were because I I thought it was incredibly interesting. And so then then there's there's a second half of the question, of the discussion of, like, what... How do we verify the things that... The the AI that we are using to defend? How do we verify that that's working? Yeah. Yeah. Well, I'll talk about what I'm seeing at least now. It's, there's kinda like two ends of the story, which is, like, you trust it blindly, which we agree that's fairly dangerous. So you're reinvestigating everything yourself, which kinda defeats the purpose. So, basically, kind of the same demand as you're asking your junior analyst. Right? Show your work. What's been proven? What's gonna be inferred? Is there a gap that's missing? Are we missing telemetry, etcetera? So I think we need to think about AI as, right, since we're doing... At least we're talking about from, like, an AI soft kind of umbrella term that's used most of the time. Talking initially with that initial triage phase, like, if that's what AI is going to most certainly on the defense help you with. Need to make sure we can sit it down, do some QA, audit what it's doing, etcetera, act it like it's a new person sitting in the seat. Typically, you're gonna have someone that's a trainer, maybe somebody that looks over your shoulder. Hey. Okay. This is what we do. This is how we do it. I would say to perform the same things with your AI soft tool in general. Just make sure you can understand what it's doing, how is it doing it, you know, what are the things that you can control. Like, if you don't like that it's performing a certain action or maybe it's making a query out to your SIEM and it looks for seventy two hours when you think, okay, we just need a 12 lookup. You know, if you can make those changes, I think that's kind of where we go to start verifying, okay, AI is helping me, and then I can go ahead and start to make those decisions down the line to how much do I trust it, where can I now maybe turn on the response efforts to, you know, let it handle some of those actions? So that's at least some of the thought process behind how we verify AI in general is going to kinda help you through your soft environment from start to finish. For sure. You know, I think that one of the things too we need to remember about this Hugging Face incident is that OpenAI was using these agents and these sandboxes, like, purposely without guardrails to test how well it could exploit vulnerabilities. Right? So, like, that's what they're doing without guardrails on purpose. So you you need the guardrails to secure, like, what the AI is doing when you're on the defensive side of using that, as, like, your tool to defend against these AI fueled attacks. Because on the other end, like, imagine a bad actor using this technology. They will be more intentional about the prompting of, like, you know, we're trying to get into the system, do whatever you can to get into these systems, exploit whatever vulnerabilities you need to. And so it will... Those kinds of attacks will just grow in complexity, and and that'll be really interesting to deal with. Okay. So let's take a quick pulse check right now. I'm gonna put up a poll here, with the audience. Hopefully, you can... I think I can share that on the screen too. Yeah. Cool. So, vote in that poll in that side panel there. And then just let us know, like, where you're currently at with the agentic, SOC, kind of solutions and platforms here. Are you already evaluating that? Are you using it already? Have you not explored that at all? You're building your own thing? Like, where are you at in terms of, you know, kind of the the general, stance of AI SOC right now? I think there's a lot of, people who are evaluating, it seems, and a few people who are already running that. And then very interestingly, no people who have yet to explore that agentic stock solution. I think, you know, the more times that goes on and and especially from this hugging face incident a couple months ago, you know, like, even in the last six months, like, it's it's not a option to not be evaluating AI, SOC solutions, just to be able to combat the sheer amount of, attacks that are happening or just the volume of, alerts that are coming in. Alright. Cool. So I'm gonna stop sharing that, now, and then we're gonna move on. And that poll is gonna continue to be open in that side there if you didn't get a chance to vote on that. Okay. Cool. So... Yeah. I mean, I think, you know, where does the AI SOC kind of environment fit with this new threat landscape, Phil, do you think? Yeah. Coverage, I would say depth and probably speed and control. Coverage, obviously, you know, this has kind of been a a staple of, you know, the pain points within a SOC. Right? You know, humans can only work so many alerts per day. Right? And I think kind of from an AI perspective, that's the initial kind of, like, low hanging fruit, if you will. Right? Everything can be investigated and then routed to the proper channels. Right? A low priority alert that may not be looked at then gets turned into maybe a higher priority one based on the different context that it can pull in. So it doesn't just sit in the queue where, you know, nobody gets to it. So I think at least coverage wise, AI is most certainly able to to help that. Secondly, like, the depth standpoint, we talked about the speed of these alerts. Right? They're gonna get there. They're gonna get there fast. So we don't need necessarily single worker access to admin level controls. Right? Shower is something that's kinda shallow at glance. Doesn't necessarily have to obviously roll through the entire chain. So I think depth of what the AI is able to do, is a lot faster at the machine speed, from an analyst standpoint where we might do a little bit more manual triage to grab this, then grab that, then grab this, think about it. I think AI is able to make that determination. Right? If it's... Like, in our case, right, an alert comes in, queries out to, let's say, a SIEM for more information, it's able to take that information as soon as it sees it, understand, okay, this is what I have, this is the query I need to run, and then it runs it, pulls that information back. So, I think the depth at which it can go based on the information it sees and then obviously at that speed, in controls kinda like that third one. Right? So it's not necessarily missing an alert. Right? It's making that call, making that judgment really quickly. So, from how it's gonna help within your environment certainly, is, right, the AI soft doesn't replace the judgment layer, if you will. Right? So it's still gonna remove the, basically, excuse for skipping the investigation, and then the judgment now depends on that person. So that's kind of at least the change and kind of how I see AI within a SOC environment, kind of how the new environments are gonna look like once, you know, AI SOC is adopted. Yeah. And that's, you know, the inter... Other interesting thing is that's too just from the defense point of view. Right? And and from our point of view of, like, how the AI SOC is going to fit into this puzzle piece of the greater picture. But there's so many avenues of AI for security, and and that's such a growing and interesting field, in general outside of defense as well. And the other thing that OpenAI was suggesting, in that talk on you... On YouTube, the black hat talk, was autonomous red teaming. So that's another avenue of, like, AI, for security. Not necessarily AI stock, but, you know, AI for security, and, you know, general... Generally, like, how we're combating these in, incidents and growing speed for sure. So, lots of interesting things to to think about, for the future. I don't... Definitely don't envy the CISOs out there who have, like, many different aspects of security to think about, for sure. So on that note, like, let's take another pulse check quickly here. What what are your biggest perceived benefits of the AI SOC for your team? Is that gonna be faster cross back investigations, greater alert coverage, AI generated playbooks, querying tools in plain language. And if it's something else, put that in the chat for sure. Let's, like, have an open discussion about what the... Those benefits are gonna look like for, your SOC team. Wait. Maybe I need to close the other one first and then open this one. Open. Is it open? Okay. Cool. So, yeah, that poll is open now on the side there, for you to vote on. Okay. Greater alert coverage. Yeah. That makes a lot of sense. And we're seeing that a lot, like, when we're having conversations with customers. The cross stack investigations going across all of your tools and then having coverage for all those alerts, especially when you're dealing with, like, such a a large amount of alerts that you're needing to orchestrate. That's that's a lot too. And, yeah, like I said, if you have another option, that your team is hoping to benefit from or is already benefiting from ASOC, on your team, let us know in the chat too. Alright. Cool. I'm a close... I'm a stop sharing this, but it'll still be open again in the... In that side panel there. Alright. Great. And then... Yeah. I mean, like, the other thing too with the AI, for security is that we need to be able to trust that too to make sure that it is actually working and and defending, the way that we want it to. Right? And so how can we trust that the tools are actually getting it right and it's actually saving my time? It's not just like another thorn in my side of, like, weighing me down for, you know, actually getting the investigation done. Yeah. And that kinda goes back initially with the coverage, depth, and speed. Right? I need to be able to understand, like, as the AI's junior analyst, right, what's this doing. Can I audit it in any kind of way? And then if I can't audit it, can I make changes to the potential mechanisms or procedures that started in front of it? So, yeah, that's definitely... I hope that's definitely a part of it. Right? You don't wanna create a bottleneck that, okay, AI did all this information. I sent all these alerts. It's generating all this information. Again, we talked about blindly trusting out the gate. It's probably not the the best issue, but again, right, you're gonna have to juggle, like, verification becoming now kind of the the bottleneck where it's like, okay. Now I have to basically walk through all these steps. And, again, how long is that gonna take? So, yeah, we definitely, a 100% need to... That's kind of the building of confidence, though. At least from what I'm seeing, that's kind of almost a learning curve initially. Right? It's in there, and then it's like, okay. How much can I trust? How much confidence do I have? So I know many of y'all probably go and see, right, POCs, POVs, etcetera, pilot programs with different vendors, etcetera. That's kind of that initial learning phase, that initial, like, transparency, that initial, like, adoption and trust that's going to be there from any product that you're looking at. And for me, that's a 100% where it goes. Like, okay. Can I trust the AI to perform the way it's doing? And, also, can I verify the results? What did it do? Can I also? If it did something I need to change, can I do that as well? So those are definitely kind of steps within, okay, how do I go ahead and now verify what's happening? So... Yeah. That's Yeah. Definitely big within the the industry right now for sure. It's verifying and then be able to change if possible. Yeah. And where do you think people are at with, like, the response part of it? You know, that... That's all the investigation part, which is great. And I think, like, you know, autonomous investigation makes a lot of sense. Getting all that information just presented to you so you don't have to go and dig for that. That makes a lot of sense. But what about autonomous response? Where do you think people are at in adopting that? And also let us know in the chat too, where you're at with actually get... With get... Getting the AI to actually do some of the response action. Yeah. Yeah. That's definitely a great question. Things that we do definitely approach here. And I always tell them, you know, let's start at least in phases. Right? Let's start in phases so you can understand, again, from a trust standpoint because, again, AI, we saw once the guardrails are off, potentially, it can do something crazy. And there's not saying from, like, a defensive or even the investigation side of the house, is it making an inference to something based on limited amount of data? Is there a gap? And then it makes it just decides, right, I'm gonna just put in this information anyways. That's kind of what we're gonna do. So I say, hey. Start in phases. You know, traditionally, within the automation space, it's been very deterministic logic. AI most certainly can help that here, and I think that's still important for what is actually deterministic. Right? If you already know something that's a clear cut, dismiss, it's benign, etcetera, right, it's on an allow list, etcetera, like, don't need to go any further with that. Right? You can go ahead and preprocess those out if you will before an analyst needs to see it. That can be done immediately. So that's kinda like the phase one. And then we talked about, you know, the triage portion. Right? That's kind of okay. The next... Once it comes in, it doesn't meet those certain flows. Let's go ahead and make AI kind of response standpoint. And then maybe the third phase is where and when to go ahead and automate the response. So, don't let it be improvised initially. Make it be very deterministic. That's kind of the human in the loop. I get the triage, maybe some recommended next steps and me as a human get to decide, yeah, I agree with this. I agree with that. Okay. I agree with this. And in many platforms, at least in ours for sure, like, that's a learning process that the AI uses as well. It's like, okay. Yep. Making the right fields, making the right. So it keeps that under context of, okay. I understand you and your working environment. You want this to happen. Okay. Maybe you like the endpoint being quarantined initially, maybe the user account being suspended for an hour, etcetera, whatever the case may be, and maybe that's been in its kind of learning model where, okay, on the next alert, if you do wanna move to the automated triage, you'll definitely have more confidence that this needs to happen than that. So then we walk them into the next stage which hopefully is sometimes customers will have certain network environments where they're allowed to run, you know, kind of like a sandbox environment, if you will. And so we would then, you know, if they wanted to, I'd say yes, test it on a fully autonomous from start to finish to include response in there. And then if you want to, maybe into actual network segments and etcetera before going, you know, full live within an entire network. So I definitely, break it up into segments to where you think and, you know, where I can... Okay. I trust it, move on to the next step, validate it, move on to the next step where response, I still think, should be human in the loop first. And then once you trust it, maybe on certain network segments or something like that, maybe with certain customers, VIPs, etcetera, yeah, you can go ahead and, like, say, okay. I want automated response here, but not here, and then start to trust it and roll it out in, in that kind of motion. I... I'm typically against the, you know, blindly trusting anything to go ahead and run wild in my network. That's just gonna create more problems, in my opinion, than the the good it's meant to have. Mhmm. Yeah. Yeah. Like, having that, automation process for the ones that are, you know, very... That you perform the most. Like, I'm just reading the chat now too. This is a... That's a great point of, like, having that automation for what you're performing the most and then having that human in the loop for those, edge cases where you you need to have that, verify what the actual action is before you're taking that action for sure, and making sure that everything's checked off. Yeah. Yeah. Alright. Cool. The approval base is pretty big for us to earn. Right? Yeah. For sure. Alright. Before... So we're gonna flip into a demo of Morpheus, which is what we're working on. It's very exciting because this is the first time that we're showing you the Morpheus two version of the platform. We just released a new version, so really excited there. But I've just opened that poll again. One last poll here before we flip into that demo. Are you preparing for AI driven attacks, or how are you? Are you running attack simulations? Oh, I accidentally have that in twice. Or are you automating containment actions? No specific steps yet. None of the above. You're doing something else. Let us know in the chat what you're doing. And, yeah, just kinda curious about, like, how people are going to be preparing for these AI Germany attacks, especially after the hugging face stuff. I mean, things happen so fast too. You know, like, you think about it. Hugging face was only, like like, not even two months ago. So, you know, things are happening so quickly, and, curious to see how you're, preparing for these attacks and and what you've spun up since then or, if you're working on it before then, let us know in the chat. That'll be... That's fun. Alright. Cool. So I'm gonna I'm gonna stop sharing this poll, but definitely feel free to vote in that still, in that side panel there. You need to vote in all of those polls in order to be eligible for our swag prize. And so, Phil, are you ready to flip over into that demo now? Hello, everyone. Thank you for tuning in to the on demand version of our webinar. If you're looking for the Morpheus two demo in this webinar, we have removed it. So we encourage you to book a demo with us on our website, and we are more than happy to reach out and schedule a demo with you to show you all of the latest and greatest with Morpheus two. Thank you. We do have a lot of q and a, so let's get right into that. And then, yeah, if you have any more questions, feel free to drop that into the chat or into that q and a specific section there on the side. Let's jump into it. What we can say with confidence right there, like, all our connections are most certainly customer owned, customer configured per site. Right? You can set up these connections to each ingestion. Right? Whether SentinelOne, rather Splunk yourself, like it's scoped to the specific site. Morpheus doesn't necessarily reach... It's not going to reach across sites. Right? It only runs on what it sees on that site's owned connections. From read access, it's kind of capped by d three's, like, allow list. Right? Your credentials aren't permission scoped, and, like, from ingestion and query standpoint. So different identity passwords, kind of naming here, like, a webhook intake. Right? It's side... It uses, like, a a per intake shared, like, secret key. Right? So to purely, like, authenticate the events coming in to d three. So it's not the same credential or the same governance model. So, again, so, like, when it queries out to, like, a third party platform during an investigation, that most certainly does happen. So 100% right there. No problems. Like I said, I wanna make sure I answered it again. So it's, like, IAM security architecture. Execute under... Okay. I think I answered all that. Steve, again, if I didn't, let me know. I know a lot of questions there to try to go through that whole life cycle. But, like, yeah, if I didn't answer that properly, let me know. Or if I need, like, send, like, some extra white papers out or something like that to break down technically all the the details, let me know. Yeah. What else we got, missine? Let's go for Steve's other question here. How does the defensive AI also keep up with the offensive platforms? I mean, that's tricky. Like, we're really in that time period of figuring that out. Right? Like, everybody's kinda in this boat of, like, what the offensive side is using with the AI and and figuring that out. But I think, like we said, you know, you just have to keep your security posture tight in general, to... So that, you know, they can't exploit any vulnerabilities. I don't know, Phil. What do you have... What do you think about that? Well, I mean, it is the big question, and it's one I most certainly don't have... Won't have an answer to. I think I think the good thing is that a lot of the the larger organizations, you know, we... You can think the the the CrowdStrike's of Microsoft's, etcetera, like, of the world from a defensive standpoint. I mean, like, really good researchers, really good... They're kind of at the cutting edge of what this technology is. So I would hope that they're able to use it from a defensive side first before sending it out on the offensive side. But, right, the CrowdStrike, the Microsoft, the Googles of the world, I mean, they're adapting really, really fast and they're moving really, really quick just along with it. But how, I mean, how are they gonna keep up with the offensive platforms? I mean, that is the big question. That's always been the question in my mind as well as this cat and mouse game now has gotten, you know, pretty quick, pretty fast. So it'll be, interesting to see ways to play the... The way it plays out because, currently, you know, I'm not sure I'm not sure how they're gonna keep up. But, again, hopefully, they're on the good point. I know there's so far, there's kind of some frenemy worker relationship with, like, language models and etcetera and what comes out. And, hopefully, the defensive teams are, you know, in the loop before the release and understand of what capabilities of potential, you know, basically, kind of nation state kind of APTs are out there and what could be used. So I'm hoping there's just clear cut communication between vendors and, you know, the next large language models that do get released even from an open source standpoint. I'm a share this next one. Cody is asking if anyone has a guide or use cases or framework for SMBs to get caught up with building out workflows and responses. I I don't think that we do, but I'm gonna put this up. If anyone has... If anybody else has any recommendations for Cody, put that in the chat, for sure. But I don't think I don't think that'd be specifically at d three d. Okay. Let's go to the next one here. No. I I can answer that a little bit, Amy, or or just shed some color. Yeah. There's no, like, a specific guide. Typically, what we do... I mean, we have, like, what I would call internal guides. It's just kinda like certain verticals. We've... What we've seen over the years, right, if you're in MSSP, if you're in health care, if you're financial services, even from an SMB standpoint, like, where do you fall within maybe one of those. Our team just works with you with kinda, like, starting with, like, what's your goal is, and then a 100%, it's like a guide that, like, helps you, like, step one. Like, after you answer a couple questions, basically, like, we have a PM team, and we onboard a lot of customers. So, yes, there's... Especially from workflows and responses, especially building them out, you don't have to be a developer, a coder, etcetera. With d three, you're gonna have a PM, right, that understands, like, the whole nature, but you're also gonna have a developer from our side that's with you as a client that understands the kind of nitty gritty of, like, the back end stuff if you need that. But, like, what we showed a little bit earlier today was you just kinda need to know our... Maybe I didn't show it, I just kinda selected an incident, but you can also natural language out what you want from a workflow. So you can always just say, hey. This is what I want. You know, use CrowdStrike. I have this. I want this to happen, etcetera. You can write it out in natural language and it will build that workflow as well. So you can do it on your own, but also, like, AI most certainly will help generate those. So from an SMB standpoint, we've seen much larger traction from the SMB market just because now it's... You don't need, like, a dedicated developer, basically, to build out these workflows. So, yeah, we definitely have... I I wouldn't say we have a a guide per se, but we definitely know how to guide you on those decisions and those kinds of stuff for sure. For sure. Alright. Cool. Let's move to the next one. James, is there an ability to build a confidence rating in the workflows so that they can run without errors, can increase confidence rating so that more flows through, are successful and can increase, to be used across similar environments. Yeah. Let me think about that one for a little bit and digest that. So the ability to build confidence rating. So, yes, I know you can build a confidence rating in the workflows that... Again, to talk about errors, there are some... Like, when it hits an error, a lot of times, like, there's... So, yeah, the... Or the flows, obviously, are successful. It is a learning. It is most certainly learning. It's just not like, hey. This is AI. The human portion of it is learning across your system as well. So, for instance, if you said if you didn't have a global list that says these are the deny list, right, no matter what, this IP you see deny or something like that. If you keep saying this is a false positive due to this is allowed or this is automatically denied, it will actually learn on that kind of AI portion where it says, like, these are my recommendations. It will probably say recommended, create global list to include these IPs. Right? So it is going to learn to where, again, it's just not confidence of AI, if you will. So let's go with the next rating. So more flows can... Okay. But my confidence is... Reissuing workflow across the visional. So... Okay. So reissuing maybe workflows across boundaries. So, like, you created a workflow and you want it to work in multiple environments. Yes. A 100%. You can you can build those workflows and then that workflow can be shared to basically any tenant within your environment, if you will. So, yeah, that won't be a problem. We don't need AI to do that. You can be very general in the talking to it. Like, if you want, like, a general, we'll say, like, the kind of golden workflow, if you will, where, hey. Use a SIEM off of a EDR alert, etcetera. You can build that out, and then when you share it to a different site, whatever EDR, whatever SIEM is connected, it will kind of, like, move into that workflow. So, yes, you can go across the visual boundaries. Alright. Next question. Are there ways to set limits on what a user group can do? Yes. Yep. Still full RBAC capabilities, but been within the platform. Again, if you're new to d three, d three has been around at least the last decade as kind of like a... In the traditional source space, or at least the last fifteen years like that. So, yeah, there's still full RBAC capabilities and case management within the platform. So, yes, you can set very specific limits on a user from a query standpoint, a user from an access standpoint, a a user from what AI tools they have available to them. So, yeah, you can get very specific on which user group or specifically, like, users in general as well. Okay. And we have one last question. If anybody has any other questions, we do have five more minutes left, so definitely feel free to answer that... Ask the questions. That will also give you a leg up to win the prize, which we will announce in a few minutes here. So let's get into this question, though, before we do that. Morpheus one and two launches have been very close together. What future releases can we expect? Okay. Yeah. Getting into the futures talks. Okay. So what I can say right now, yes, they are close together. It won't be a... I would say it's definitely working, not like a traditional release cycle, right, where it's like, oh, you know, end of quarter. It's like, when these things are ready and they're QA ed, they're basically being released. But, basically, some things you can do that are coming out will be you can now use, like... A lot of teams are building a lot of custom internal integrations, which is fine. We deal with that as long as there's, like, you know, documentation, etcetera. But there are a lot of teams building a lot of internal kind of tools. Just that's the way the nature of, kind of AI has helped development. So now you can actually use AI within our platform to create custom integrations from a prompt or just the API documentation to where you can go in. If it's not something we have, basically, we can use AI within the platform to create something. So... And then there will be kind of a Python and codeless playbook utility commands that you can generate. So we saw the deterministic workflow, like, kind of the drag and drop. If there's something that you want to be done, basically, you can go in now and say, hey. This is a command that I want you to use. This is what I want you to do, and now it will kind of create it. So it'll create the integration based on API documentation or, hey, we have this internal tool and AI will kind of look at it and go, okay, this is what I need from a connection standpoint. And then if it's integrated, you can create utility commands or commands based on that integration all using AI. Basically natural language, say what the command should compute, what later task you want it to be included in, right, find out those results and then use natural language for it. You can say, hey. I want it in Python, and then there you go. It will generate that command. So if there isn't something that you... Or there isn't something already being accessed, you can do so. So, Elise, I know that's, like, at least the two top of mind that will be coming out very shortly. And then the next release, man, I don't wanna get too far into the details. But those two for sure are coming up very shortly, but the next release, you know, I'm not too sure of the priority list there. But, yeah, the next... It's some small changes in the next couple of, like, at least short releases. Again, it's not like a traditional cycle where we wait for the end of the quarter. Yeah. We're gonna be pushing these out as soon as they're available. Okay. Great. Yeah. So let's... We we have our last question here, and we've got only a couple minutes left. So give me a quick answer on this one. Have you got any playbooks for deep fake attacks, or we're relying on external tech? I think we're relying on external tech. Right? Yep. I mean, you can, again, in your own language, say, hey. I wanna build a deep fake attack based on, you know, if you want to select those integrations. But... Yes. Oh, what was the second part of that, Amy? Sorry. On that share, just wanna make sure I answered that second part. So you're good. Or are we relying on external tech? So, yeah, the way it works is whatever you have, like, externally, like, we're kind of that layer above if you wanna look at it that way. Like, your external... Your other security stack tools are down here, and we're kind of that layer on top that it doesn't matter what you have, kind of, like, from an agnostic standpoint, very vendor unbiased. So, like, it doesn't matter. Like, we'll use that and that's what Morpheus is going to use no matter what. So if you wanted to... From specific for deepfake, I don't think we have anything very specific unless you wanted to write it out from a workflow standpoint. But, yes, we definitely rely on your external components to build that workflow if you were gonna give it that natural language prompt. Alright. Thank you. So we've got a couple minutes left. Thank you so much for, being with us for this webinar. We had a great time. Really excited to be able to showcase Morpheus two, and I hope you are excited about all of those features that are coming up in the future down our pipeline. I have just gotten a word from our team in the back end here about who won the, prize packages. So I'm going to put that in the chat right now. And so congratulations to our winners. What? What? We will be getting in touch with you via email, to to give you those prizes. And then if you want to register for our next webinar, which is... Oh, when is that date? It's on October 21, same time. And that will be about running a twenty four seven stock. So if you wanna register for our next webinar for another chance to win a prize pack, the link to register for that is in the doc section, of our of our platform here. So thank you so much for coming. Again, we're looking forward to speaking with you in the future. If you wanna get a demo of Morpheus for your team, you can hit that get a demo button as well up there. Oh, wait. I forgot. We do also have a a survey that I'm launching right now. If you wanna reply to that survey or or, you know, answer that survey in the last minute here, that is just gonna tell us what kind of topics we can, work on in the future and and if you like this webinar. So thank you so much for attending, everybody, and we are looking forward to the next section next month. Thanks, everyone. Oh, and if you happen to be at sector, we're gonna be at sector. We're also gonna be at ITSA, coming up in next... In that... In next month. And, today, actually, we're going to be at the, government conference in Toronto. So thank you so much, everybody. Bye.