Building Trust in the AI Era

Clarke Rodgers:
I'm Clarke Rodgers, Director of Enterprise Strategy, and I'll be your guide through a series of conversations with security leaders.

My guest today is Matt Saner, Senior Security Solutions Architect Manager at AWS, who leads a team of security specialists across the globe. Join us for a conversation about all things generative AI, from using generative AI to secure your workloads to securing generative AI inside of your enterprise. Please enjoy.

Matt, thanks so much for joining me today.

Matt Saner:
Thanks, Clarke. Excited to be here with you.

Clarke Rodgers:
So you are a senior manager of Security Solution Architects. Can you tell me a little bit about what that role is about and what a security solution architect is?

Matt Saner:
Yeah, I think the SSA role is pretty unique in the way that we kind of think about it at AWS. We really like to think of how do we go in with a customer alongside them and say, what is your actual business problem and how do you want to solve that with technology?

So my team really goes deep into security and that could be all of cybersecurity; risk, governance, compliance, etc. And tries to say, okay, CISO of your organization, what is it that your business is asking you to do and provide? So we try to just think about what can we do to get their outcomes to help them achieve their business outcomes through acceleration, through compliance, governance, risk, and compliance.

Clarke Rodgers:
What brought you to AWS, and what about your background either prepared or didn't prepare you for your job at AWS?

Matt Saner:
Well, I spent almost two decades in financial services and very large banks, very conservative in many ways, but also deep innovators. And technology is one of the main enablers that financial institutions achieve those outcomes. The luxury that I had working at these very large institutions was if the technology existed, it was probably somewhere in that environment. And I had the privilege of having many roles wearing many hats over my tenure in those institutions, but I was always solving that organization's problems.

And so while I did get a lot of exposure and growth through that in my own career and exposure to new tech, one thing that I think that was missing for me was getting to see other industries. And that was really appealing to me, to my journey to AWS coming in and being actually joined as an individual contributor, as a SSA on the team that I lead now. And it was great because I got to see what folks were doing in automotive industries, what folks were doing in manufacturing, healthcare and life sciences, media and entertainment, and the risks and the challenges that were unique to those industries and how to approach those using different technology solutions.

Clarke Rodgers:
So what has kept you here at AWS?

Matt Saner:
I think it's the constant evolution of new challenges. We have threat actors out there who are trying to poke at the defenses and the defenders trying to do everything they can to make sure that they're proactively defending the estates. And at AWS specifically, we really do live the motto of security being our number one priority, right? This is something that we feel very strongly about and we have an amazing group of talented technologists, scientists, engineers, business-oriented people, the whole gamut.

And so while the technology aspect of it is really exciting, none of this is possible without the people behind that. And being surrounded by these people, day in and day out, brings an enthusiasm that you thrive off of, I thrive off of. And when you have a mission to achieve, such as securing a global infrastructure such as the cloud, we are driven and we have a must-succeed mission mentality in that way.

I always tell folks that might not be cybersecurity professionals, that we're keeping people out of grandma's bank accounts. Grandma wants to go buy her dozen eggs at the store and she wants that transaction to just work and we need to be there for her and the end user.

So when we think about that Amazon customer obsession, I try to think of it all the way to the end user, not just the customer that might be using our products and services or having our team consult on that, but what are they really trying to solve for and how are they really driving that end user customer obsession for themselves through their solutions.

Clarke Rodgers:
You've mentioned your SSAs are deeply embedded with your customers solving security problems, building out architectures for them, etc. I know another aspect of their job is to sort of get customer feedback back into the service teams. Can you sort of walk me through how that works?

Matt Saner:
We really try to think about trends and we are industry-aligned. So I have security essays on my team that are not just great at identity or great at building out SOCs or threat modeling or whatever it might be that a customer needs to talk about. They're also really great at understanding those industries and the particular needs and threats of those industries as well.

Someone on my team has been working with gaming customers recently, have very unique edge security needs around CDNs and the like. And there's some feature requests that are in the pipeline. But what we have said is these customers really are looking from their own roadmap perspectives to be able to achieve these outcomes using features that might not right now be aligned with where our roadmaps are.

Clarke Rodgers:
Interesting.

Matt Saner:
And so what we try to say is, what is the risk to our customer for that? Not what's the risk to AWS, what's the risk to our customer?

Clarke Rodgers:
Sure.

Matt Saner:
And we built these trust relationships with our customer because, at the end of the day, that's what matters the most. But we built the same level of trust relationships with our service team, PMs, and GMs, the people that run and build these great services. And they absolutely love having this direct voice of the customer, especially when you think about the size and scale. So some of these customers that we align to are, again, leaders of their industry. And if they can say, well, if I can unblock it for this big use case, I can now unblock this for every use case within an industry. That's a powerful story for them. And so they very much are willing to invest that time and opportunity with us and we act as that two-way conduit into the customer. And the other thing is, with that trust relationship built with these service teams is then they come to us when they are brainstorming their roadmaps, even years out.

Clarke Rodgers:
Would a customer be interested in this feature or that feature? That kind of thing.

Matt Saner:
Yeah, and can you help us find one?

Clarke Rodgers:
Oh, that's great.

Matt Saner:
Can you go talk to them? Our customers absolutely love when they don't just get to turn on a feature that went GA. Right?

Clarke Rodgers:
Right.

Matt Saner:
They love it when they're like, I shaped that feature.

The reason that it does the thing it does is because I directly asked for that thing. And this is not unique to security. We have specialists in network and gen AI, actually, cloud operations, all of these specialists in general have these relationships too. But it's very unique because it is that direct amplification, bi-directionally where people are achieving the outcomes they want through actual targeted use cases and examples.

Clarke Rodgers:
And when you're hiring for people to join your team, what are you looking for? Is there a specific trait or background or maybe a skillset that you're looking for, for that next great SSA hire?

Matt Saner:
Yeah, we really want someone that is demonstrated to know the domain well. But beyond just the basics, how deep are you in the technology aspect of this is the construct of making sure that you're raising the bar on the capability and the solution and the why in earning trust.

We want folks that can go in and say, I know exactly what you're trying to drive and that outcome and I'm here along with you. We're not trying to come in and necessarily pitch a product or service. We're trying to actually say, here's a business outcome, and here's the solution, here's how we get there. And I think our customers really have appreciated that relationship. It's very strategic.

Clarke Rodgers:
I love that. You mentioned that the security SSAs work very closely with the customers, almost embedded with them at times. Generative AI has been all the rage for the last 18 to 24 months or so. When did you first start getting signal from your teammates that this was something big from a security risk and compliance perspective?

Matt Saner:
AI/ML is not new, but when we think about the new transformer-based architectures that hit the consumer marketplace, it really is one of those things that felt more of what I call a revolution than an evolution. We've lived through many evolutions in technology and the natural progression of things over time, but this was certainly a, “Oh, we're kind of interested in this as consumers ourselves.” We're playing with the apps on the phones and we're learning and then we're like, whoa, we actually are now also the producers of this thing and our customers are going to be the consumers of these things and their customers are going to consume them.

So it was very quick. It was very quick there. When we started having these customers with conversations, we realized that everybody across the industry was kind of new to it as well, other than maybe the ones that were deep in the data scientist aspect of it. And then immediately we started having CSO's, other leaders of our customers kind of reaching out saying, Hey, what is this thing? What do I need to think about? And we do pride ourselves on trying to be tip of the spear in helping our customers understand how to approach things and secure things.

So we've created tiger teams very similar to the Amazon two-pizza team model and also extended communities across the internal field made up a variety of different folks, including not just technologists and data scientists, but legal and marketing all coming together to say, “Hey, let's make sure that instead of being a few months ahead of where the customers are asking conversations, how do we widen that?” How do we get far enough ahead that with confidence, we can say this is not just thought leadership, this is actual pragmatic, practical advice and guidance and building that for customers to deploy? And that's been a strong mission of not just my team, but really the extended team across the AWS.

Clarke Rodgers:
So if I understand you correctly, not only were you answering questions and perhaps predicting what the questions would be from our customers, you also took it on to educate our field, our account managers, all those folks so they could have cogent security conversations with those same customers.

Matt Saner:
Yeah, I don't-

Clarke Rodgers:
Is that right?

Matt Saner:
That's exactly right. I don't think there's a security leader anywhere in the world that wouldn't want more great security people working with them. We realize that I can't always send a member of my team into every cluster conversation. My team does have the privilege of serving some of our most largest and most complex customers across the globe. We hear some amazing stories and learn a lot of thought through that, but we can't go to every single customer that AWS services, but we want that thought leadership to go to every single customer.

We built internal mechanisms that we call Maven's Courses. We worked with peer teams of mine to build those. A lot of great people across the greater gen AI community to help build those and deliver those. And we've scaled that out to hundreds of folks across the globe now, across dozens and dozens of our global offices. And then that Train-the-Trainer model also then scales and grows that wildfire of knowledge as well.

Clarke Rodgers:
That's fantastic.

Clarke Rodgers:
Have you noticed any specific trends as far as onboarding generative AI or interest in generative AI from specific industries that we support? So for example, are you seeing more of an interest in maybe financial services or media and entertainment or is there anything that really sticks out as this industry is really going after it and maybe some others are a little bit more cautious about it?

Matt Saner:
You know, I think every industry is exploring it one way or the other. Ultimately, a lot of them are coming through it with their own use cases. So media entertainment certainly is thinking about the creative aspects of generative AI and how that can augment gaming is thinking about things like NPC improvements to how they can make a virtual world very dynamic and things like that, right?

Clarke Rodgers:
Right.

Matt Saner:
We're seeing auto manufacturing thinking about how to use it for improving factory lines and efficiencies and gains of efficiencies. Coming from my financial services background, as I mentioned earlier, very conservative industry in some regards, but also very innovative in others. And I think one of the things that was a little surprising to myself even was the speed at which they have really leaned into it.

Some of the early use cases that were actually reaching production kind of came from the financial services industry. And one of the questions we kind of asked ourselves was what enabled them to move that fast? And it really came down to security as an enabler. They had such a great robust government's risk compliance and security infrastructure that from kind of that shift left mentality, they were able to then say, okay, we have this net new thing we want to explore, how can we do it while minimizing risk? They were able to lift that apparatus up and basically plug and play it into that R&D mechanism for them to do that.

So that's a great example of where sometimes security gets this reputation of the department of no or a speed bump that slows things down. In this case, security was the opposite of it. Security was the reason they could move as fast as they were.

Clarke Rodgers:
I picked up on that as well, that it seems to be the highly regulated organizations who have had to make the investment in security and compliance and regulatory regimes. So they already knew where all their data was, they knew how to protect it, they had the appropriate authentication and authorization in place, they knew what they needed to do. So gen AI was just another thing that they could then explore. So it wasn't doing a lot of the groundwork and then embracing generative AI, they had already done that, which is incredible.

Matt Saner:
Yeah, and one of our early questions that we asked ourselves was, does security need to reinvent itself to account for generative AI? And I mentioned that kind of evolution versus revolution. And the gut check at first was, oh man, this is a new domain. We're going to have to learn it all. In reality, it was an extension of many of those security domains that we're already really good at and really an extension of a data problem because what is AI/ML? It's essentially trying to take data and make something out of it or produce data. And so this is something that we said, “Hey, we don't have to go back to square zero.

We can just use the nuances. What are the things that make this unique?” And then apply those lenses to the questions. And that really helped us create some mechanisms that helped answer some of those gaps and helped drive the adoption a little faster on that.

Clarke Rodgers:
That's awesome. One of the most helpful pieces of documentation that I've had in this sort of gen AI world is something that your team helped create or co-create, and that's the generative AI security scoping matrix. Could you please walk me through that?

Matt Saner:
Yeah. This spun out of some of those early discussions of what do we do, how can we help. And some of those early conversations with leaders, security leaders in particular were saying, I don't know where to start. And it was very much these boil-the-ocean conversations. We came up with what was called the Generative AI Security Scoping Matrix.

And what we wanted to do was break down the boil the ocean conversations into bite-size chunks. We have five scopes that came out of it. Scope 1 is consumer grade apps, then enterprise apps. Then those are kind of the buy side of the model. And this is a mental model, right? So there's some flexibility in how you define these things. But the buy side of the model is a consumer grade app is something you're just picking up and you're using. It might be free, but we all know when things are free, nothing's ever free.

Clarke Rodgers:
There's a cost, yes.

Matt Saner:
There's a cost to it. So understanding what that might mean when you think about terms and conditions, legal agreements, and things like that. Versus Scope 2, which is enterprise apps, they're built for enterprises. You can have a negotiated terms and conditions. And so you're risking the way your data is managed and the privacy of your data and security of your data can be negotiated, managed, and controls can be demonstrated to you as an adopter of those.

But we also obviously live in a builder world too, and people want to build on these tools and make their own innovations. So that's where we get in scopes 3, 4, and 5, where things like Bedrock help expose models, whether that's a first-party Amazon model or third-party model like many of our partners provide through Bedrock into fine-tuning models all the way to training and building your model from scratch.

Clarke Rodgers:
Right.

Matt Saner:
All of those have their own unique risks and security dimensions that you need to approach, but they're not all the same across. So if we can say, “Hey, tell me more about what you really want to do. Do you really want to go through the cost and time to build your own model? Is that really necessary?” Probably not. It's almost potentially like a bell curve where there are going to be people that is their business model and they're going to do great in building their own models, but not everybody needs to do that.

So maybe scope 3 is what you really need and that's going to be the most cost-effective, fastest, least-risk approach. But here's also the things to consider if you go that route. So you get down at least from all seven oceans of the world to a great lake, maybe a level of discussion. Still, you have some complexity and nuance obviously to deal with, but it definitely breaks it down.

Clarke Rodgers:
It's been very helpful to me. So thanks to you and your team for that. We've talked a lot about securing generative AI. What have you seen or what has your team seen about customers using generative AI as part of their security program?

Matt Saner:
So we recreated this concept, it's called the three-legged stool. Well, first is, how do I secure gen AI? I want a workload that's based on gen AI or gen AI itself, I need to secure that.

Clarke Rodgers:
And that's where that scoping matrix comes into play?

Matt Saner:
That's where the scoping matrix mostly comes into play. The second is, how do I use gen AI to secure? And that's the spirit of the question you're asking me now. And the third is, what do I need to do as a defender for AI emergent threats? How do I define it?

Clarke Rodgers:
So AI being used against me.

Matt Saner:
Right?

Clarke Rodgers:
Okay.

Matt Saner:
Exactly. And all are equally important for the industry as a whole to address.

And I think that ability for gen AI to do things like workforce augmentation. I do not see generative AI as the proverbial robot that's going to come take your job away or anything like that. What it is, it's the thing we've all wanted, it's the assistant next to you that's helping you do it. So I've written several demos recently of how you can use products like Q Developer, Q Business, and Bedrock to augment a security practitioner. And so this could be something like an incident response where you have maybe an indicator of compromise or some other thing that you're trying to dive in and you might have a ton of data. How can you quickly sift through that data, summarize it? These are some of the early use cases you saw.

But what we're also seeing now is, how do you take maybe a junior security analyst in a SOC and amplifying them to someone that might have years and years of experience of writing queries to dive in deep?

Or in my case, what I do is I write a bunch of scripts very quickly, things that might have taken me a day or many, many hours. And I'm like, “Hey, I really need a script real quick because maybe I'm in a security incident in the moment, I need something real quick to test, pop me out something, five minutes, very simple script.”

And then that script can be iterated on, kept and improved on over time as well. So I think you're seeing the me too aspect of getting security solutions there and just the way that any kind of business unit would say, is this something that I want to use to solve problems? And that's pretty exciting and a lot of our partners are now diving deep into this space as well.

Clarke Rodgers:
That's great to hear. As you know, security can be a very stressful occupation to be in. You always have to be on, you're helping customers, you're building solutions internally. What do you do in your off time to sort of refresh, relax, and reset yourself so you can really take on that challenge the next day?

Matt Saner:
A lot of what I do revolves around my family and my hobbies have spun out around that. The one I still keep to myself is I'm a general aviation pilot.

Clarke Rodgers:
No risk there.

Matt Saner:
No risk. Maybe there's a trend in my life I think we're seeing here as I lean into risk to some degree. But mainly because when you take on risky activities and you know you're doing it in a safe and secure way, it's very rewarding. My wife gives me a hard time because I love to read NTSB reports and there's some great shows out there on TV as well that re-enact things and she's like, "Why would you want to read about planes crashing? Does that not worry you?" I'm like, "No, we learn from that."

Clarke Rodgers:
Right.

Matt Saner:
And it's the same in cyber security, right?

Clarke Rodgers:
For sure.

Matt Saner:
We do these postmortems and we say, “What did we learn from that? What could we do better?” We obviously never want to have a bad day. That's goal number one. When the industry has an opportunity to learn from it though, it's one thing I think we're getting better at as an industry is sharing what we can when we can in sometimes open forums, sometimes closed forums, but we do share because we all succeed when we prevent failures and when we learn from things that happen.

And to be clear, not everything's a failure, right? I think sometimes it can feel that way in security, but threat actors can be good at what they do and we need to be better and that's always the goal. And so we get better by learning and that's just a fact of life. But looking at how that applies here, it's very much a core part of my identity is how do we solve these problems, these tough problems?

Clarke Rodgers:
Sounds like a great compliment to your day job.

Matt Saner:
Yeah.

Clarke Rodgers:
Matt, thank you so much for joining me today,

Matt Saner:
Clarke, it was a pleasure to be here. Thank you so much for your time.

Listen now

Listen now

Listen now