Name: All Sessions
Uploaded: 2026-04-08T06:16:04.565Z
Duration: 1 h 8 s
Description: All Sessions

Transcript for "All Sessions": Hi everyone, and welcome to Beyond the Perimeter twenty twenty six. I'm Kiari Kendrick from CrowdStrike, and I want to thank you for joining us today. This event is now in its sixth year and is built on long standing partnerships between CrowdStrike, Okta, and Zscaler. We've been on this journey together for years, helping customers secure identity, endpoint, access, and beyond, and continuing to evolve how we do that as the threat landscape changes. And right now, we're at a real inflection point. AI, especially generative energetic AI, is moving from experimentation into real business workflows. That's changing how organizations operate, but it's also changing how attacks unfold. That means faster execution, more automation, and less room for error. So today is about cutting through the noise and focusing on what's actually happening, what we're seeing for real customers across their environments, what's working and what the security leaders should be prioritizing right now. Before we get started, a quick note is this is an interactive experience. So drop your questions into the chat as we go. We'll do our best to address them with our team of experts, so please keep an eye on that. To kick things off, let's hear directly from our panel of leaders on what they're seeing from the front lines and what this moment really means for security teams. Hello, everyone. I'm excited to bring together leaders from across our three organizations to share what they're seeing from the front lines. Joining me today is Ilya Zaisa, who is the CTO or the Chief Technology Officer at CrowdStrike. Also Eli Khan, who's the Chief Product Officer at Okta and Daval Shorma, who's the EVP of Product Management and AI Security at Zscaler. I want you all to have a moment to introduce yourselves also. So Eli, take my play. All right, once again, my name is Eli Khan from Okta honored to be here with this esteemed crew. You know, I've been doing security my whole career. I started off doing cybersecurity in the federal government and intelligence community, did a startup as you spent time at SentinelOne and AWS and now as CPO at Okta, welcome. Thanks for having me, Ilya Seitzov, Chief Technology Officer at CrowdStrike. Among the different hats that I wear, a lot of my time is spent on our product strategy, on our data science and AI strategy. I don't mean this sarcastically, I am excited to talk about AI, it's what I spend a lot of my days doing these days. It is the cause of and solution to all of our problems. That's a bit of a joke, I think it also breaks down the two big buckets that I spend a lot of my time on these days, which is how do we leverage AI technology to enhance our security operations, but also how do we more broadly secure this new technology transformation that every enterprise is looking to adopt out there. Nawal Sharma, EVP of Product Strategy and AI Security at Zscaler, been at company for forty plus years now. So, a lot of time spent in Zscaler building this zero trust architecture and, extending that for users, workloads and you know branches now. Yeah, security is the new frontier that we are going after. I have worked a lot of startups as well as, you know, big companies focused on networking and security. Happy to be here. Amazing. Gentlemen, I'm excited to have you. Let's dive in. So in the last twelve to eighteen months, Davo, what's materially changed as generative and Agenci AI have moved from experiments into real workflows that you see customers using today? And also, second part to that question, what are you seeing in customer environments that proves that security is a need for that world? Yeah. So I'm going to take a step back to like four years ago, we were at RSA and chat GPD came out, right? Everyone has run four years. It's been four years. And everyone rushed to saying, hey, we want to block this, right? The world has evolved. I think now there are thousands of applications that are generative AI applications. There's a lot more AI getting embedded inside SaaS application. And we have seen an explosion of AI apps and infrastructure in last twenty years, like models, MCPs. And I think we are now at gust of agents going mainstream. Most of the agent traffic that we see today, like in Zscaler, is coming embedded in such SaaS application. But having homegrown apps that will be primarily agentic in nature, gonna go mainstream, primarily because we did have a good authorization framework and identity framework for agents. And also, agentic protocols, which were sitting in Linux Foundation, are now become ITF standards. So, we'll start seeing that hockey stick growth this year, in my opinion, in agents being everywhere. And when we talk to customers, the main challenges that they are seeing, and then if you think about the security controls that security teams are thinking about, is on the realm of, first of all, where AI is being used in our environment, where is the tentacles of AI in terms of data identity application access? What is the posture of AI application? It's not just, you know, posture of infrastructure, but posture of the data pipelines that are coming to AI, a posture of the open source gates that are connecting to your AI. And, how do you inspect that traffic? Now, most of the AI traffic that we see is still over HTTP, web traffic, but one fundamental difference in agentic traffic and AI traffic is you need to learn the intent of the applications and AI. And with agent, and we'll talk a lot more about agent, I guess, is that, the authorization framework is one thing, but these agents, what are their role based access to applications, data, and how do you build governance framework around them? And the policy engines we have built to govern thousands of users, now you have millions of agents, how do you scale those links? A lot of focus in my opinion, and I would love to hear from my peers is, it's around visibility and how do we know where AI is sitting and how we start building controls around that. I totally agree. You know, we're seeing enterprises move beyond, hey, we've got some toy prototypes that look cool in the demo to serious enterprise adoption, workflows at scale, etcetera. I think what's kind of interesting is that, when we've had other technology paradigms in the past, often security has been the laggard. I'm seeing, from my perspective, I wonder if you all agree, something a little bit different that's transpiring with the way that enterprises are adopting AI and agentic technology, which is that security has actually become not the blocker, not the friction point, but it's actually what enterprises are craving so that they can accelerate their AI adoption. Instead of security being viewed as the thing that's slowing innovation down, it's being viewed as, I think the missing piece of the puzzle that is actually holding back enterprises from adopting these technologies and getting all the productivity gains, the efficiency gains, etcetera, that they want. They're really good manifestation of the challenges that people are facing. And just recently, we've had this kind of viral explosion of things like OpenClaw and similar technologies that are these, hype is, they're these personal digital assistants, right? We're seeing tools like Cloud CoWork really grab the attention, and not just the technical crowd that's been adopting these technologies for some time, but non technical individuals that want to automate their day to day workflows. I think this is a really good example of what I just mentioned, because fundamentally, if you took a strictly security driven perspective of this, you would say, hey, we got to put this all isolated, sandbox it, don't give it access to anything, everything is default deny. But these technologies, because when they work well, they operate like a human in many respects, Just a human that operates 20 fourseven, it doesn't really do anything useful, if you don't give it access, give it privileges. So, there's this, really, like kind of a devil's bargain here where you want to give it as much capabilities as access as possible, because that's where you see the real value. But that's also where you introduce the most danger, the most risk. And these are non deterministic systems, so it's difficult to apply some traditional concepts of things like default to die, then deal with all the exception policies related to that. We were designing our Okta for AI agents products. We did a pricing analysis in October. And we did a lot of customer conversations and we assessed that on average, a large enterprise would have around 25 production agents. Total or per person? That was total for the company. I think that was actually a decent estimate in October. In October, yep. And in the last five months now, it's changed dramatically. I ask this question to every customer executive briefing that we do, how many agents in production do you have? And there's a range. I talked to a large financial services company two weeks ago, and they said 2,500. That they know of. That I they know talked this week to a large technology company, and they said they're planning for a million agents. Can we maybe all stipulate that? I think we would all agree that identity is going to be a fundamental aspect of how we address agentic security? I think it's going to be one of many layers of security we're going have to add, including detection and response, including shift left, secure development of agents, but yeah, it's one that certainly we're planning on. You go across the entire life cycle as well, right? Because people are building apps. And one of the things that is fundamentally different in AI ecosystem is that's very dynamic. Your new models come, you connect things to new MCP servers, your posture of entire ecosystem changes immediately. So you need to know which, as I said, like identity is not just identity, but permissions roles in public cloud that tie to those identities. Cloud is creating sub agents, What permission those sub agents are inheriting for a specific task? So, will go multiple levels deep in my opinion compared to how we are handling user and the workload identity today. You had mentioned prompt injection, you were talking about intent earlier. What can we really do at that intent instruction level versus where do we need to look at compensating controls and minimizing privileges? Because let's remember that, what are our prompts? I mean, most of the time we're dealing with large language models. Yes, there's other types of models, like, think about that concept of language, right? Language inherently contains in it, the ability to lie and deceive, right? If somebody attempts to deceive an agent, how can we tell an agent that it's doing the wrong things? Social engineering is in many ways, one of the key techniques of prompt injection. I'll come to it from a data security problem perspective. One of the favorite use cases that I implemented when we built our Guardrail product was, hey, I want to make sure that employees had a lot of data sources that connect. But with a tool like Glean or a more, federated search, you are able to see a lot of data. Like, you have a natural language interface to get that data. Now, can get that data. Now, some of the things that these models are doing well in the new world is that you can build a model for this topic detectors with 40 different languages very quickly. There will be false positives still, but I think the likelihood of that reduces very significantly. Well, and let's not forget, we also can take a different approach. Maybe let's talk about false positive rates in general with agentic systems. We also now have tools to be able to address them in some cases, in a much more robust, economically feasible manner. Things that we were talking about internally, one biggest of successes we've had thus far with our Charlotte AgenTeq SOC product, is our detection triage system. We had a 98.6 agreement rate when we released it. And what I mean by that is, we run it alongside our human teams, our Falcon Complete managed services teams, doing the same problems, and we can compare how often does the agent agree with the expert humans, it was 98.6 when we released that. And when you think about that for Triage specifically, that actually has some really significant implications to how we deal with detection engineering in general, the historic trade off that you have to have as a vendor. If I had something that is say 50% false positive rate, that's way too high to throw to a human team to deal with, right? Too much time and energy and cost. But if it's around half the time, that means it's right half the time. So, you have this delicate decision, like, do I throw the baby out with the bathwater? But if I have a system that can operate 20 fourseven and have at the marginal level virtually no additional cost to triage one more detection and see if it's a true positive or false positive, I'm going to take advantage of that as a detection engineer, I'm going to throw really noisy, low quality things at the system, because now I know I can have an autonomous system at extremely low cost and high speed weeded out, not really suffer from much of any of the downside, but now I'm increasing my catch rate. So, it's endpoint detection or cloud detection or data classification false positives, it also gives us these really powerful tools asymmetrically of responding and dealing with that extra noise as well. So when we look at that, I want to get into the adversary thought mindset between us. So as organizations adopt AI across their businesses, right, where are attackers having the most impact across the security lifecycle and what's still underestimated? So, Ilya, I'm going come back to you and let you start, and then we'll let Elad answer. Every year since we've started doing the Global Threat Report, it's been several years now, adversaries have gotten faster and faster every year. One of the common questions we get at CrowdStrike is, are adversaries using AI, how are they using AI? Sometimes you don't know for sure, if you're not shoulder surfing the adversaries, you can sometimes infer. When you see twenty seven second breakout times, I don't know exactly what kind of AI tooling or what assistance they're using, but they're operating at machine speed, that's for sure. There's no doubt about that. Now, the methods that they're actually using, some of it is actually, it's just augmenting what's already been working, it's accelerating and enhancing what's already been working. I mean, getting back to the topic of identity for a second, and this has been a trend we've seen in general, in our global threat report for years now that malware is becoming less and less popular, A bigger and bigger focus is on adopting legitimate user identities through credential theft and harvesting, social engineering, and these are actually things like social engineering, things like phishing, these are all old, well known techniques that generative AI in particular is dramatically enhancing adversaries, making it much easier, cheaper, faster for them to do so. We're seeing increases in everyone knows that one of the areas that AI agents are having the most success at is code assistance. They can write really good code, that probably means they can reverse engineer really good code. Again, we don't know sure yet, there's some examples, but I think you can infer that we're seeing a huge amount of activity commits, AI systems committing new code to open source repositories everywhere, faster than humans can review and keep up with them, that also probably means that that makes it easier for adversaries to do things like supply chain attacks and inject malicious code into those systems. You know, we're not seeing much difference in terms of how AI agents are compromised. One popular way is prompt injection, but I'd say the other most popular way of compromising an AI agent is getting access to the credentials that those AI agents are using. Especially, look, you want to give AI agents a lot of tooling so that it can work autonomously, do like good goal seeking, but still giving an AI agent a god mode service account or access key is really risky and is the classic way you're going to get more largely compromised as you build out your agents. So, I mean, we've got to do a good job of not only ensuring that that agent has least privilege, but also ensuring that they're using ephemeral tokens and not long standing or long lived access keys. One stat I want to show you, we do AI reg teaming and one of the things that we are doing is, you know, you build the business context of what really is the problem a app agent or app you have built is trying to solve. So some of the attacks that we have simulating on the application, we actually see within the first five seconds, if you use multipath attack prompting, you actually see that these models are giving up information they shouldn't. So actually, the detection time is less than five seconds in some of these scenarios. But I think one of the things that we are also seeing is the attacks are becoming very sophisticated. We actually have seen in our customer environments, were like, Hilla, you were talking about this, but the entire help desk of a customer was taken over by nation state, exactly same script, exactly same voice tone and asking, encouraging users to click something from a help desk person to update their PC because attacker has been able to shut down one of their application on their device and then saying click here if you want to unlock getting access to the environment. And then lateral movement happening, data exfiltration happening, the standard playbook of ransomware. Now, I do think that, a lot of work that at Zscaler we have done working with CrowdStrike and Okta over the last few years is building this concept of adaptive access. Right? So, I create a user risk score. I know what user is doing, like India is sitting here. And if this traffic is also coming from somewhere in China and then there's a workload which is emulating India, probably this is anomalous behavior. So, you can one of the bigger challenges that when you get access to a mission critical application, and that will be true for agents too, you get long lived access. Right? SAP is a good example. So if India's risk profile has changed and we have seen anomalous behavior, let's say the Okta device events have given us some signal saying something wrong is going on this device or we see a CrowdStrike incident that is coming to us via API so we actually bump up the risk profile in a few seconds instead of revoking access I can induce Multi Factor Auth right and then you don't step up right away and not wait for the access to be, like, reestablished later. When you are established access to application, revoking that access. And the same applies to an agent too. We actually are able to do that on behalf of, AI agents that are inheriting the user identities. And another thing, by the way, practice I'm seeing is a lot of people using API keys, but it's much better to use job tokens or block tokens. So still a lot of what we are seeing, which creates compromise and hard coded API keys that are being reused. So there are definitely lot of bad things we did in the user identity world, and then we did in the workload identity that are also bleeding into agentic identities as well. And that is bleeding into the access of these applications to data. So the intent is to say, how do we make sure that as these ephemeral identities are created, how do you make sure the right authorization format framework is able to push those policies right away, not waiting for when they are coming up and connecting to something, but when they are created. Yeah, yeah. And I think that leans really closely into the piece about guardrails, right? I think guardrails are very important as customers are getting into the space of understanding how do they use Agentsi workflows in their environments, discovering and maintaining them, right? I want to start with Eli. So as more organizations deploy AI agents and AI becomes more agentic, what guardrails are essential so organizations can move fast but stay secure at the same time? Well, when I think about guardrails, I think about them in multiple different categories. The one type of guardrail goes back to the prompt injection discussion and having a good semantic layer of inspection of every prompt to look for any malicious or suspicious prompts. It's one type of guardrail. Another type of guardrail is securing the identity of those agents. So ensuring that the identities are least privileged, bound to a human, ephemeral tokens, that'd be another type of guardrail. Another one which I'd say is emerging is this idea of intent based security. Now there's a lot of ways to think about intent based security. The simple way I think about it is looking at the agent to tool invocations and assessing which ones are unusual or not aligned to the intent of the agents. Yes, I want to be able to secure and understand intent. It's also a language problem, I don't think it's a fully solvable problem. That doesn't mean, again, going back to lessons of the past, that doesn't mean it's not worthwhile to pursue. I think when we talk about guardrails, I want to almost like maybe up level that even more, and talk about the classic defense in-depth approach. Is prompt based security going to be foolproof on its own? No, neither is identity, no guardrail is, but it doesn't mean we don't pursue it for the sake of it. Think about endpoint security, for example, long ago everyone realized that IOC based, signature based security was kind of an outdated concept. It doesn't solve the problem, right? It doesn't deal with novel attacks. But we didn't get rid of it as an industry, because it actually, it still helps you very cheaply and quickly, weed out the obvious known bad, and then you could go focus more complex, more sophisticated, maybe more expensive systems on the remainder that goes through. So, I think we need to be thinking about AI and agentic security as a defense in-depth concept. We got what we can upstream, put good guardrails in place on the prompts, on the identities. I think, candidly, one area that hasn't gotten as much attention yet, but I suspect that's going to change this year in particular, is the idea of focusing more on the runtime security of the agents themselves. I would love to be able to divine from the input to the agent, what its intent is, what an adversary might be trying to do, but I won't always be able to succeed in that. I want to be able to put guardrails on the tools that can call the data it has access to. This topic is pretty close to my heart because we started building AI guardrail. What we realized is that the guardrails are sitting in line when you have a model app just talking to a chatbot or things you're building. Right? So, from a LLM proxy, your model proxy, what we realized is that you also want the same guardrails detectors in the direction when users are going to these AI systems do. Now, I think, Eli talked about, different kinds of guardrails. I agree. I broadly look at four broad categories and that will expand. Like you have basic access control guardrails. Every model provider will have their access control guardrails built by default, right? Like every hyperscaler has the basic firewall built. There's no structure. Crane to the model. Then where the interesting stuff comes is when you start building more, data security, content moderation and, cybersecurity centric guardrails. And, you need to be very vertical aware. And also remember, our strength is to push zero trust everywhere as we call it. Right? So we were trying to say that if you have users or apps through which users are going connecting to your models and when the response comes back, you want to make sure these detectors are very relevant. To your point, these understanding the intent of the agent is very important. That's what I was thinking of. Delayed it to give you an amazing discount. Exactly. So I think there's definitely that, intent based policy that I do think is I have seen it working now in a lot of environments. There's a lot of learning and fine tuning for the required. Attackers will get more and more sophisticated too, But our goal is always to stay ahead of it and use a as I said, like, we have been saying that for a long time at Zscaler that a true zero trust architecture is built with a strong endpoint layer, with a good identity layer, and then a policy engine that says what you go. So that collaboration that we have worked as a company for with Okta and CrowdStrike over the last ten years for user identities will also bleed into agent identities down the line and how agents are used on different, form factors. All right. So gentlemen, this has been good. We have one more, which is honestly probably my personal favorite, to be honest. So let's dive into it. We're going to talk about priorities for our security leaders that are chiming in right now. So if a security leader can focus on only two priorities in the next six to twelve months to keep pace with AI driven adversaries or threats, what should they do first, and what can we do? I think, one of the biggest problem we are seeing that security leadership focus right away is to understand where AI is being used in their environments, whether and build mechanisms to detect AI usage, whether it is happening through inline traffic, whether it's happening on the endpoint with apps that people are downloading, skills they are building, local MCPs. Understand your cloud environments where you are actually going to start using models and MCPs and agentic gateways. Understand all the resources that are tied to them, like your data pipelines, your identities and I'm permissions and, most importantly, your open source software packages that go there and, understand the whole ecosystem of AI and the risk tied to it. That's one. And second, as you are going to build AI applications, right, make sure that you look at the whole life cycle of AI to secure it starting with Red Team and making sure when you go to runtime, the proper guardrails configured based on the use case for which you build your, AI agent and AI application. Nice, appreciate it Al. That's good advice. Maybe I'll take a bit of a, back to the adversaries centric version of this. I'll go back to the stat we talked about earlier, The fastest adversary is now moving, being able to move laterally breakout time, less than thirty seconds. So to the CISOs, to the SOC leaders out there, can you respond to a threat today in under thirty seconds? I think for a lot of organizations, the answer is no. So, that's gotta be a priority, especially as adversaries are only gonna keep getting faster with adopting AI. Let me start by what I don't think they should be spending their time on, more fragmented niche tools on siloed, independent systems that don't communicate, don't interact well with all their other security investments, because that context switching, whether it's a human or an agent, as they have to go back and forth between these fragmented systems, that is the antithesis of speeding up your response. Kind of on the flip side, on what I do think they should be looking into and what they should be adopting. One, I think we've touched on this, I don't know if it was actually like said it out right, there are some novel aspects of agents, there's this unstructured non deterministic problem of prompts and maybe not even intent because as you said, kind of like that UVBA problem. One way you can not have to worry as much about being able to respond to a sub thirty second attack is to focus on your basic hygiene, right? The investments in building out robust identity, data access, runtime security programs, proactive security programs, to keep the adversary on the first post. Organizations do need to be looking at modernizing their SOC systems complete, end to end, they need to make sure they've got the right telemetry points feeding into those systems across all the different security domains, cloud, SaaS, identity, network, endpoint, etcetera. They have to have good sources of truth, they have to be able to ingest process and analyze that data faster than ever before. They need to be able to respond quicker, which is going to mean leveraging new cutting edge agentic technologies as well. I think those are two areas, on the proactive and the reactive side that will serve many organizations well, if they invest in those now. Yeah, so I'll echo some things that we talked about already, but when I think about how to keep pace with AI powered adversaries, two main sides to the coin. One, CISOs, SOC managers, security professionals need to be power users of AI. If I think about this simply, every single alert or finding coming into a SOC needs to be triaged using an AI system. There should be not a single one that's neither triaged nor investigated by AI system. So that could be something like Charlotte AI, it could be a homegrown tool, but like every single one should be looked at via an AI system before they're looked at by a human. That's the only way you can keep pace. On the flip side, AI is the new attack surface. And so we need to be securing AI. And as I was saying earlier, I think the lowest hanging highest ROI thing that a CISO or security professional could do to secure AI is to ensure that those AI agents have a lockdown identity management life cycle associated with them. They need to be least privileged to find in terms of the roles they have. They need to have ephemeral tokens and they should be bound to a human and they should assume that humans roles and permissions whenever possible. So gentlemen, I want give my heartfelt thank you for spending some time with me today to talk about all things AI and how executives should be thinking about protecting Jain and both Logistic AI workloads. So awesome time. I appreciate y'all. That was a great discussion. A lot to unpack around how AI is reshaping both attacks and defense. Now let's bring this into the real world. It's one thing to talk about trends, but it's another to see how organizations are actually navigating this shift day to day. In this next segment, we'll hear how a customer is aligning identity, access, and endpoint security to reduce risk and keep pace with AI driven changes. Let's dive in with Steve Tylan, Senior Director of Security Operations at Pegasystems. Hello everyone. I'm joined today by Steve Tylan, which I'm super excited about. He's the Senior Director of Security Operations at Pegasystems. So just a little bit on Steve and what he's going to do today. He'll be sharing his customer perspective on how AI is changing the threat landscape, in particular, how security strategies are evolving and what lessons Pega Systems has learned as they've modernized their stack with CrowdStrike, Okta, and Zscaler. So I want to get started Steve, but first I have to give you the honors of course, given some background on yourself and then we'll jump right into some questions if that's all good. Excellent. Thank you, Key. I have been doing security operations probably for the last fifteen years Before then, you know, developer background moved into operations. So, as you can see, when we discuss, I love to automate and make use of all the tools that we have. So, we don't have to necessarily increase headcount, but we can attack the ever growing endless supply of alerts and detections that are out there. Awesome. Awesome. Love the team here. And I'm excited. I know we've already met each other as we we prep for the call. But one of the things that made me so excited was your ear to your engineers, right? Your ear to your peers and how you've really thought through how AI can enhance the experience that Pegasystems is having from a security perspective. And so we'll start fairly open, right? I want to dig into dig into your brain a bit about AI, your thoughts on it. So to start us off, question one. We know that AI and automation have really changed the threat landscape, but I want to know what that means to you. So what are you seeing today at Pega Systems that reflects that change in the threat landscape? Yeah, so I kind of group this into two main categories, right? There's the threat landscape as far as how AI can be maliciously used against Pega, whether it's malicious or honestly accidental is probably the main use right now. Plus, the threat actors are using AI themselves to enhance their abilities as well. And the other aspect is more around how can we use AI to enhance our abilities? Know, tying into that automation background, how can we have, I like to call it AI automation, which basically is kind of like having a core of 100 extra users that their job is to do something very specific. You can't have a full time employee staring at a dashboard waiting for it to turn red, but I can have AI do that. So that's how we're starting to use it on that aspect. I love it. I love it. I think one of the things that you toggled on was, you know, that 20 fourseven coverage that you can have by having those agents in place for you. When you talk about adversaries using AI, one of the biggest, what I would call heartbeat moments about them using AI is how quick they're moving. I think in the GTR report from CrowdStrike this year, we stated that the fastest breakout time was twenty seven seconds and that's faster than humanly possible. For you personally, Steve and the team, how is that speed affecting you all at Pegasystems? I mean, the fact that it's down to twenty seven seconds as the fastest breakout is it's insane, first of all, but the second is a human just cannot, it doesn't matter if I had a thousand, SOC analysts, 27, we're not going to catch that or take action. The chances of them getting the alert, reading it and deciphering what to do, you're already too late. So, that's where we're starting to look at using AI. Because not only will it see it in split second timeframe, but as you build out what AI can do and how it can respond, it can take action just as fast. I think the biggest piece that we're working on and learning is comfort, right? Getting comfort with what AI can do. Where does that human, you know, intervention piece need to sit still? Because I still believe a human needs to okay things. It may slow us down, but it's better to be slightly slower than just let AI do whatever it wants to do. There's too many movies about that, so we don't have to go there, but we know what happens. We'll just say Skynet. That's enough to say right there. So, but yeah, it's getting comfortable. Thankfully, that Pega, the company as a whole is very AI forward thinking, wants everybody to immerse themselves in AI, not just use it, not just go to the chat GPT type things, but really immerse how can you improve your day to day work. For us, our core tool is CrowdStrike. So, immersing ourselves in what CrowdStrike can do and how it can simplify and enhance our jobs is our key goal here. And I think it's going to be a really exciting year with what CrowdStrike is rolling out. There's been already some improvements over the last year. You know, just an alert fires and an analyst goes in and can see all your first initial questions are all answered down the side by the AI. So, that's a great first step. And now it's the agentic workflows. And again, we're treating those and targeting those to very, very specific events that we know with the right details, we can have high fidelity and a true positive. And then we're able to let AI do a little more. Yeah, no, that's great insight, Steve. And one of the things that rings a bell for me is you talk about CrowdStrike being the kind of like the first stop shop, right? When you're leveraging AI to get the telemetry that you need, the insights that you need to make those decisions faster. And that recalls to me about the endpoint session of this. But when you think about your strategy involving at Pegasystems, I know there are probably other areas too, let's say identities and networks. So we're going to venture down that a little bit too. So I want to talk a little bit more about how that strategy is involving also spending outside of the scope of endpoints. So what role has AI and automation changed the way you secure not only endpoints, but also identities and networks as well? Yeah, so I think there's a couple pieces to this. One, I mean, we have a few of those modules in CrowdStrike, so I'll get that. But the core piece is visibility of your tool, right? So, we have great endpoint and networking tools with Okta and Zscaler and by themselves, they're awesome tools. And they do their job. The hard part is you can have an alert fire in Okta that says, hey, they're logging in from a different country, all of a sudden, the norm, impossible travel type thing. Now that's generally high enough alert that maybe you do it. But for us being an international company with multiple VPNs, there's a lot of false positives that we hear for that alert. But by itself, again, not enough, but we've integrated all that data into CrowdStrike, through the Next Gen SIM platform. So now we see that alert, but we will also see an alert that, hey, maybe the account tried to access a couple of different servers while internal or or maybe, you know, Zscaler, it's starting to reach out to some maybe not so favorable websites. Again, by itself, it is an alert, but it's a minor one. But now you have Zscaler showing you, it's going to suspicious websites, you have Okta saying, hey, all of a sudden this person's logging in from China. And now you're like, okay, together, now it's much worse. So, that single pane of glass, even though we're using multiple different tools and companies and providers is really what's key. And the nice thing is the AI and you create the right correlation rules and detections can see and put this all together for you. That is awesome. That is awesome. So it definitely sounds like you all have a strong strategy of correlating the best of breed across all three. And I think when we think about beyond the perimeter, that combination, that team effort, that consolidation of telemetry is really powerful, right? And I think as you build that strategy, it couldn't have been easy at all, right? You're talking about three different brands, three different strategies. However, it's something that we found a way to collectively come together for the benefit of those who use us. All right, Steve. So the development and the overall maturity of the AI usage as Pegasystems has been phenomenal, but I'm sure it's been a little bit of a experiment as well as an experience. So I want you to talk to us more about what you've learned and also what's top of mind for your team this year in 2026. Yeah, I'll circle back to what we said at the start where there's kind of two aspects to AI, right? And I'll first cover what the security team is doing with AI. And that's immersing ourselves in it, absorbing, we're building out the workflows, the detections, the alerts, but we're now also starting to play with AgenTicWorks and the AgenTic AI in CrowdStrike. So again, we talked about it having that intern or those extra 100, you know, security analysts that are staring at a dashboard, the agentic works, I can have a very specific AI do that. So that's what we're learning and moving to now. So that not only can it watch and respond instantly, but now it can take action and but it's a very specific subset. And that's again, by immersing ourselves in AI, that's where at least we at Pega, we feel comfortable, right? It's very well scoped and defined and we can trust that in that execution. The other side is, you know, as a company, like I said, we're playing with AI. Our engineers are playing with AI. They're experimenting all over the place. So it's really hard to track who's using it, where they're using it. They wanna automate their daily life. Again, that's what our CEO said, go forth, immerse yourself in AI. So they wanna connect to Outlook, right? And not only just read access, but they want to write and send emails. They want to connect to, you know, our instant messaging chat systems and they want to have that do stuff. So we're trying to, we can't completely control it because again, culture, they want everybody to use it. Security can't stand in the way. But security has to be involved in some aspects. So we have a lot of logs, we can see what they're doing and then we go slow. Again, we give them read access as themselves to their email and get comfortable with it, read access to the chat messaging platform. We are now starting to expand that and give them some right access as the user, right? So, I think it'll be, and I'm waiting for the first incident that says, didn't do this AI did it. But it's AI as you. So Right. The user is responsible for what they're using AI to do. And we're going to keep looking at the tools and seeing, are we catching these logs? Again, because everything's moving so fast, you know, it's typical in the security world, we're going to be reactionary. So we're gonna respond, but hopefully we have AI built that allows us to be fast No, at our that's awesome. It gives me a sighted too, Steve, because it reminds me of, I'm sure we all went through this experience, those that drive. You kind of have to drive to learn how to drive, right? You need that experience. And so I think about the practitioners today who are experiencing AI, leadership doesn't want to be the point of stoppage or wants to be a barrier. However, we have to all know how to drive. I think it makes me think about George Kurtz and his expression of each individual, but will manage on average, let's say 90 agents or so. That So would be the average amount of responsibility for each and every individual in this space. So it actually charges me up. I know for individuals like yourself, it may be a little bit scared, but it's common. So I think the stewardship of agents is something we all have to adopt as individual contributors and leaders like yourself. So Steve, amazing, amazing content. Yeah, I think it's great. I think the future is gonna be exciting and terrifying at the same time, But, you know, we'll we'll continue to use the tools. You you have to to fight AI with with AI. We can't we can't compete, you know, just as the humans ourselves sitting in the sock. So we we need we need some assistance and I'm I'm I'm man enough to admit that we need help and the help is in form of AI. So let's go forth. Let's go. Let's go. All right. That was good. No, that was really, really good. I think that was a huge value add, Steve. So we're good. That's a good close. That's a great perspective coming from the front lines. It's always valuable to hear how these challenges play out in real environments. To show you what that looks like, I'll hand it over to Wayne Smiley, Principal Solutions Engineer for Alliances at Okta, for a quick demo. Wayne, it's over to you. Hi, everybody. My name is Wayne Smiley. I'm a Principal Solution Engineer at Okta. And today, I'm going give you a demo of Okta, CrowdStrike, and Zscaler all working together to keep your company and your data safe. You know, Steve said something really interesting, and that is that we're down to twenty seven seconds for a breakout. That's pretty crazy. I can't even unmute my Zoom call in twenty seven seconds. What we really need is automation and AI to make this work better and safer together. Even though we have three best of breed products that we're talking about, we still need them to work seamlessly in the back end using AI and automation to make this work better. So with that, let's get started. Let's start with a pretty average day for a user. They go ahead and they log in to Okta as they normally do. You can see here there's their Okta dashboard. And now they're logging into Salesforce, obviously, using single sign on and doing their day to day work. As you can see here, they've gone ahead and logged in. Now they're going over to Box. They need to upload a couple of files. Perfect. And now that that's done, they're going to go over to AWS and get a little bit of work done there. So as you can see here, they're fully authenticated into AWS, and everything's working as normal. What you're about to see is what happens when something goes wrong. Something's actually going go terribly wrong here. I'm going to fake this. What happens when something goes wrong? In this case, I'm going to run a script that's basically going to tell CrowdStrike that the machine has been compromised by going ahead and trying to get a credential off the system. What's happened is that things have changed on device, and the user hasn't quite figured that out yet. So they're going to go ahead and upload a new file to Box. And what you're going to see here is that it didn't actually work. Strange. Okay. Well, they got other things to do. Maybe Box is having a problem. Who knows? They move back to Salesforce. And when they do, they go to make some changes. Oh, wait. I completely logged them out and sent them back to the Okta login page. Wow. That's odd. Alright. We'll go back to AWS. I don't know. Maybe there's an outage somewhere. Who knows? Now, when we look in AWS, we start to see errors in just doing basic things in AWS. The user can't really manage AWS at this point. In fact, they really can't do anything in AWS at all. Well, maybe it was going manually the other way, directly. Oh, no different. Everything still failed. Can't do anything. What's actually happened here? I'll tell you what's happened here. Okta CrowdStrike and Zscaler have worked together when this machine was compromised and made sure that this user was completely logged out of everything, and if we couldn't log them out, that we barred their access from it. And just for good measure, we also set them so that they can't upload files in Box for data exfiltration reasons. This is Zero Trust at its best. How is this all done? Let's start with CrowdStrike. First, you can see the detection. We can see that something was detected on this machine, and we need to do something about it. But we need to see what actually caused it. So let's go ahead and take a look at the detection. And you can see the actual command line that I ran to do this, so it knows exactly what it did. Next, in Fusion SOAR, we're going to see the actual workflow that was run. Now, in this workflow, we can see first that we detected the actual compromise. And then, we can see that we're looking at the severity of it to make sure that it was a certain severity or higher. And now, at the bottom, we can see that we're actually going to use Shared Signal Framework, or CAPE, to send over that signal on the back end, all completely automatically, over to Okta. So with that, let's take a look at Okta. In the actual user, we can see the log of what happened here. The first thing we can see is that CrowdStrike sent over a shared signal framework to Okta. We saw that before from the CrowdStrike side, but now we're seeing it over here. Then, we can see that Okta did a universal logout to log them out of everything that it possibly could. And then, Okta sets the user back to what we call low risk so they can log back in. Now, that's obviously optional, but in this case, that's what we've chosen to do. So after we've taken a look at that, we can obviously see that everything was successful. Now, if we go into the actual settings, we can see in Device Integrations where this is all set up. The first thing we're going to look at is CrowdStrike. And what you're going to see here is that CrowdStrike is actually sending that over, and what we see there is the setup of that, specifically here. Now, Zscaler is transmitting to us. In shared signal framework, there's a concept of things going inbound where you're receiving and outbound where you're transmitting. In this case, Zscaler is actually receiving from Okta and CrowdStrike is actually sending to Okta. Now, what's interesting about that is, in this case, Zscaler actually sent over this particular setting from their side to ours once we set up the service accounts to make all this work, which is pretty cool if you think about it. Made everything nice and easy to get all this running. All this, by the way, took maybe fifteen or twenty minutes to set up. It's really pretty impressive in terms of what it does. Okay. So, let's go ahead and take a look at the Zscaler side. Versal log. So, we can see here that the universal logout was sent from Okta and that Okta also sent a session revoke, which is the universal logout itself. Once those two things happen, Zscaler springs into action. We're going to dig into the profile here, and you can see that if we go ahead and edit the profile, we can see exactly how it was set up. Basically, it's set up like this. If Okta issues a session revoke to z identity, or Okta issues a credential change to z identity, then what I want you to do is run the different things that we're gonna see in just one second. So with that particular policy, it basically just stops web connections, and we're gonna take a look at the actual policy right here. I created this policy, which is no AWS after universal logout. And if you recall, AWS kind of broke because it just couldn't access it anymore. Now, what you're going see here is if we take a look at Internet services here, we'll see that that's where AWS falls. And so, we basically told it that you're no longer allowed to connect to those systems, period. So, that's why AWS stopped working at that point. Obviously, you can put whatever you want in here. Anything from inappropriate sites to anything can be put in here for different reasons, to do different things in ZIA. Now, we also created a Cloud App Control Policy, and this particular policy is what we used to stop Box from being able to exfiltrate data. In other words, we told it basically any sort of file sharing environment cannot be used. And what you see here is that you can see that we have allow viewing, but we have block uploading. And so, idea behind that is that were somebody to compromise this device, they have no way to exfiltrate data and send it off the device to any sort of system. In an AI driven world, we know we need AI driven products. Okta, Zscaler, and CrowdStrike, working together to keep your environment safe, both from threats, human and nonhuman, is really what it's all about. I've shown you in this demo how quickly we can stop threats cold in their tracks without you even having to raise a finger. Forget about taking the twenty seven seconds to get there. That's what this is all about. I hope this has been helpful, and thank you very much for your time. We've covered a lot, from how AI is reshaping the threat landscape to where is delivering real impact to what leaders should prioritize next. We also heard how these challenges are playing out in real environments and how integrated security across best of breed platforms like CrowdStrike, Okta, Zscaler, all help teams move faster and reduce risk without added complexity. That partnership is really what Beyond the Perimeter is all about, bringing together identity, endpoint, access, and beyond to deliver a more coordinated, resilient defense. If you'd like to go deeper, there are additional resources available on this platform, and we encourage you to connect with your CrowdStrike, Okta, or Zscaler teams to continue the conversation. Thanks again for spending time with us, and we'll see you next time.