A company can hold every certification, ISO, TSARCS, SOC2, you name it, and still end up in the headlines on Monday morning. Welcome to The CSO Perspective to another episode. I'm Berthold Kerl from KuppingerCole. In this series, I sit down with security leaders who are responsible and run cybersecurity in the most demanding organizations globally. And this is actually the second part of an episode which I run with Thomas. Thank you for inviting me to Deutsche Telekom here in Bonn. Thanks again for being here.
And yeah, at the beginning, for people who have not had the chance to watch Part 1, I'd like you to introduce yourself. You should go there to Part 1. Exactly. Yeah.
Thank you, Berthold, for having me in your podcast. So I'm Thomas Jasich. I'm responsible for security at Deutsche Telekom Group for a couple of decades now. But this includes not the cyber part only, but also the physical and personal security. And as a hobby, so to say, I'm also a responsible manager for Deutsche Telekom Security, which is a separate entity providing digital security services to more than 700 clients. So I started with sort of a provocative statement like you have all, you are satisfied, you passed every audit, but you are still hacked. Is this actually really possible?
Yeah, for sure. And this is part of the story. When I do trainings, I do from time to time trainings for supervisory board members, not only ours, but also in different companies. I got invited there and I do speeches there. And what I typically then do is, this is how you typically do security in a company. And then I show a slide with all these manuals, with these policies, the certifications and the like. And then the following statement is, I never met a hacker being afraid attacking Deutsche Telekom because we're certified. I never met those guys.
It's too dangerous to hack that organization, we're certified. So and it shows there is a theory, but there is a practical reality. And don't get me wrong, I'm not saying it's useless to have a policy. You have to have a documentation, you have to do your job there. Also for compliance reasons, you need to be compliant with regulation, but it will not help you to be a secure company. It's only showing in principle you're able to run this company in a secure way. That's a very good point. So you're not questioning the need for compliance for doing what is required by regulation.
But what about the proportionality? So especially the smaller organizations, they really have a hard time to implement a regulation like, let's say, NIST 2. So that they almost have no capacity left to do anything else. So are they really working on the right things?
Yeah, most likely not. We're really focusing on building real implementing or implementing controls or really avoiding or at least alarming when an attack is going on to make a difference, to reduce the risk exposure of the company. I think regulations or certifications as well, they of course follow a one-size-fits-all approach. So everyone has to do the same. On the one hand, it's often a minimum standard, but often it's also more than what is actually needed as well. And maybe it can become dangerous. So if you think about organizations like ours, we do have experts.
They know about all these things. So they can sort them somehow in. They can decide what needs to be implemented, what needs to be documented and the like. But think about companies who don't have those many experts on that. And then you're taking that few experts, chaining them in policies and in development of policies instead of doing real defense for your company. And then it's become a threat to the company more than a helping hand. But I respect the intention behind.
But we need to care that we don't fall into the wrong measures with the good intention into bad implementation at the very end. Bad implementation. That's a good keyword. Auditors often check what is documented and what is implemented versus attackers actually check. They don't care. They just check whether it works. And that's a very different story. Absolutely. And we need to as defenders. First of all, we need to think like an attacker. How can you defend yourself when you don't know how an attacker is working on you and looking on you? Yeah. So how do you do that?
Is this testing or how do you close or address that gap? It begins with threat modeling. We really sit down at a table and start thinking about how would we attack the company? And then trying to build countermeasures and detections. And it ends at the very end with red teaming. So we do have for our own purpose a red teaming. I don't know what they're actually doing right now. They're always informing me when they found a weak link into the company again. And in between, they just try to find vulnerabilities. Really working like an external threat actor.
And we're also providing that as a service to our clients. So people who are following you or have heard you talking at some events, they often heard you speak about something what we call in German Haltung. So I would probably translate it in terms of mindset or attitude or perhaps even culture. So what's your better explanation of the word Haltung? I would say the attitude. It's all about the attitude. And if your attitude is pure documentation defense of attitude, you will not succeed anymore in this landscape.
Because with new threats coming out of AI, not only on the defenders but also on the attacker sides, we need to move into a different notion. So you're responsible for a, is it correct, 200,000 people organization, roughly. How do you implement something like the right Haltung into the organization? What do you do for that? The good news is I'm not responsible about the 200,000 people, but I'm responsible to help to defend the size of an organization.
And yeah, with the attitude, it starts with enabling people to do the right things. So we can come from that vector. And we talked in our earlier podcast as well on that, that we see every employee is a threat. Or we can also come with the attitude. We just need to teach them how to behave and how to react right on an attempt hacking them not to fall into the trap. And I prefer the later one. I prefer really to provide your helping hand to the people. And then my experience is over more than 20 years, the people are not the problem.
The problem is how we build systems, how complex we build systems, or how easy we make it for the people and how good we educate them. Yeah. All right. So I think we are in the year 26. Yeah. And obviously we can't not talk about AI. And it's incredible what happened this year already, right? So in spring this year, the new model from anthropomorphic mythos arrived. We've now seen a similar capability from JetGPT 5.5. So how does this change the security picture?
Yeah, so that's a romantic change. So we're one of the few companies on this planet where access to those models. And so in our case, we tested the last couple of weeks, our infrastructure with GPT cyber 5.5. So this is really a breakthrough moment if we introduce that to a company. Because with these models, you can fully automize kind of a red teaming on your infrastructure. And you can be sure you will find thousands of vulnerabilities. And the problem with those models is, well, let me describe the other way around.
What we usually do in organizations, we do have vulnerability notification processes and patch management processes. And, you know, there is a scale between zero and 10 on the severity of a vulnerability. 10 means it's high critical, you need to act fast. Zero means don't care. So the result of that is we're focusing on the high critical software updates. And if we have it under control, then more or less in that space. But typically, we don't care in organizations about the minor critical ones.
But these new foundational models can create harm out of the combination, out of minor critical ones. Out of a sudden, a couple of minor ones become a critical one. And the problem with AI, it's not deterministic. If you run it once, you get different results, then run it again and again and again and again. If you run GPT cyber, you get different results, then you run MISRs. If you run MISRs again, you get again different results. So that's one of the problems here. So we need to fix the known stuff.
But then the next challenge is, those models are good in inspecting source code and finding new vulnerabilities. So we know the numbers released by Anthropic and by OpenAI, how many X thousand vulnerabilities they found in a couple of days and weeks in certain stacks. And the result of that will be our vulnerability fixing processes won't work anymore in future because they're depending on a single CVE number. So unique number on a vulnerability. But imagine you're a company providing an operating system, network component, whatever.
And if you check your software stack, finding out of a sudden 10,000 vulnerabilities, you can't name them all anymore. So what we will get in the near future is what we will call these super patches. So one single software update fixing a couple of thousand vulnerabilities in one step. So this per se is not the problem. But here is the problem. If a vendor is today releasing a critical software update, we see minutes after, just minutes after, attackers trying to abuse the vulnerability just fixed.
And nobody is releasing how the vulnerability looks like and how the exploit code looks like, which suggests that bad actors inspecting that update are figuring out what vulnerability is being fixed and how an exploit will look like. And then automizing the attack to search the internet for vulnerable system. So think about now you have a software update with many thousands vulnerabilities being fixed in one time. So this will create a big problem for all, not only the security organizations, but also for the operational organization.
This is, of course, a core security issue, but it has other complexities as well. Because if you fix so many, or if you introduce so many changes at once, all these things are very much interconnected. It may have also side effects. So in theory, you have to test the whole environment, which is almost close to impossible. I'm not that worried about all the testing. I'm more worried about the fixing and the speed of fixing. So we need to rocket booster the way we fix those vulnerabilities. But this is only one part.
So then imagine you're developing software and you're running those models against your own code base, and you get 10,000 results of vulnerabilities in your code base. Do you have enough developers for fixing all of them? Yeah. So most likely not. So when we talk about the use of AI in a company which is developing its own software, imagine about scanning your stack with those foundational models, you will find a couple of thousands, even 10,000 plus vulnerabilities in your code base. How can you fix that? Do you have enough developers to fix it? Most likely not. So what is the answer here?
And the only answer in my view is you need to build agentic workflows here. So you need to have agents who are testing. You need to have other agents who provide the fix. Maybe you then end up in a human in the loop who has to commit the fix, but then the fix is provided automatically in the CICD chain. So this automation needs to happen in the future, in the very, very near future.
Otherwise, we got lost. But then you enter up in the next problem. If you take these foundational models, these new ones, GPT, Cyber, or Mythos, they cost a hell of money for tokens. So if you just run it bluntly, you most likely ended up in millions of US dollars for token costs. And is that then worth the effort? So it immediately becomes an economic problem. So how to deal with that? So what we need to find here is also kind of, like we do in regular workspace, we need to have lower-skilled experts who are doing some jobs, and we need to bring the higher-skilled ones just for specific costs.
And it's the same with agentic here and with those algorithms. So not every single problem should be solved by these high-evolved algorithms, but we should use them wisely and not to end up in a totally financial disaster. So it seems even in the era of AI, we still need to do proper risk assessments and we still need to prioritize the topics accordingly. That doesn't go away, right?
Yeah, and like we discussed at the beginning with certification versus a real implementation, here it's again the same. So what we learned in the real world, we can also adapt to the virtual world here. So you have now had the luxury or are having the luxury of being able to use these models. Is this now a standard capability each and every Caesar on this planet must acquire, must have? The challenge here is that these advanced models are highly regulated at the moment. So it's really tough to get access to that and you need to have a good purpose.
If you just go to the vendor and say, I want to have access, they would most likely say, oh, we're sorry, it's highly regulated, you can't get access. One point in time, you will get access. This isn't really the problem in my view. So if we now start complaining about that, we overestimate the capabilities of those models and underestimate the capabilities of the existing ones. Even with existing ones, take in case of Entropic, the Opus model, even Opus brings you real benefit. So better start with that before complaining about you can't start with the latest one.
And gather your experience on that. And once you have your experience, you might be then able to get to the more higher evolved models. But the real problem is another one. The real problem, once they're being broadly available at the market, also bad actors will make use out of them. And I think of state-sponsored actors, they most likely have the capability to develop their own models, which are obviously not governed by anyone. And does this not then cause a difference in the weapon strength between attackers and defenders? Yes and no.
Yes, of course, it's dangerous. And we, especially as critical infrastructure operators, need to concentrate on defense in that space as well when we talk about nation-state threats. But if I count all the attacks happening day by day, more than 80 to 90% is driven by organized crime. So what should we focus first on? The 10% problem or the 90% problem? Kick your point. So once we have the 90% under control, we can complain about the 10%. That's my simple view.
All right, I think the AI topic will not leave us alone for any time soon. And will help us. So we will certainly follow up on that topic in one of our upcoming episodes. Let me just take one example. In our cyber defense center, it's just the floor underneath us here. If we would run the cyber defense center without those AI capabilities, we won't be able to discover anything because we have millions of locked data. And with the help of AI, we can sort out the good and the bad stuff there. So it's not all evil. It will bring us great benefit, but we need to use it in the right order.
So we started the session with this notion of certification versus real security. I think that the AI capability as such rather belongs to the real security section. Absolutely. Yeah.
All right, as part one, a couple of short, quick-fire questions. Brief answers appreciated. So number one, trust a fresh certification or the last Red Team result? Which one tells you more about your actual security? Compliance work as a share of your team's time too much, too little, or about right? I feel too much driven by regulation. One security investment you consider essential that no regulator requires? Smart people. That was a good one. I think you covered that already, but nevertheless, a dashboard your board loves or metrics your attackers hate? Pick one.
A dashboard my board loves I have no idea to answer that in a short manner. Obviously, the background is the real security. I get the background, but I can tell you my board loves real security and not just melon reporting.
Okay, that's a very good answer. Culture through training or culture through architecture? Both. Both. I think we had that topic earlier anyway already. It's not an either-or, but we need to bring the people's perspective always in. One thing every CISO should start doing and should stop doing because of Mythos and GPT-5. Fix your shit now. All right. After all these years, and security, why are you still doing this? It's fun. It's still fun. That is a very good answer. Thank you very much for your time at the end of this episode. It was a pleasure talking to you.
As already mentioned, people who missed part one, please go there and watch that as well. But nevertheless, thank you all for watching this episode. If you find this helpful, tell your peers, tell your colleagues, and visit us on LinkedIn. We will see each other soon in one of our next episodes. Until then, thank you very much and have a good time. Thank you very much. Bye. Microsoft Mechanics www.microsoft.com
