Testing Cyber Resilience Before an Incident With SolarWinds

[00:00:00] Your agentic AI might not be secure even with real-time data and proper guardrails. But Denodo makes sure your business has every avenue covered. By placing all your data platforms under one AI data layer, your business can reach semantic consistency safely and securely. So get your agents on the same page by visiting denodo.com and you can learn more about how to

[00:00:29] stop trusting your agents to make business decisions. But now, back to today's guest. What happens when a cyber incident forces leaders to make a business decision before the technical team has all the answers? Well, today I'm joined by Justin Henkel. He's a CISO at SolarWinds. We're going to talk about why cyber resilience depends on preparation, judgment and recovery.

[00:00:59] Every bit as much as prevention. And he also has a fascinating backstory drawing on 22 years of Air Force experience across intelligence, cyber operations and special ops. But today, he's going to explain how leaders can act when information is incomplete. And then assess risks created by AI agents and separate meaningful intelligence from just another big headline.

[00:01:27] And we will also discuss why recovery plans need to be tested in real operating conditions. And how security, IT, legal, communications and all the other business teams can work together under pressure. And why cyber risk cannot simply be handled but to the CISO to make it all go away. So enough scene setting from me. Let me bring on today's guest now.

[00:01:57] So thank you for joining me on the show today. Can you tell everyone listening a little about who you are and what you do? Yeah, so my name is Justin Henkel. I'm the CISO SolarWinds. Prior to being a CISO here, I had various leadership positions across the industry, not only in the intelligence space, but also in the public and private sector. I got 22 years of Air Force experience doing intelligence cyber operations and special operations. And I live in the Los Angeles area.

[00:02:26] Wow. I mean, not only have you got the incredibly cool backdrop there of guitars and space shuttles, and you've also spent nearly 25 years working across military intelligence and cybersecurity leadership. I've got to ask what, what lessons from all these experience, most influencers, maybe how you assess risk when the information is incomplete. There's got to be a few synergies there, which you probably didn't see initially, but it's only when you look back and you join up those dots.

[00:02:54] Yeah, definitely having an intelligence background where you're kind of responsible for making decisions in an incomplete information environment is definitely helpful in the cyberspace. You're never going to know everything that is going on. You're never going to know every single risk that is out there, but being able to identify like big impactful events, understanding that decision delay is worse than not making a decision at all. And then moving forward so that you are not only flexible in decision-making, but also communicating kind of the impacts of the

[00:03:24] various options to the business leadership. And of course, when we're looking at things like cybersecurity as traditionally focused on the prevention of attacks. So can you, you'd have to name many names here, especially the background that you have there, but can you share a moment that might have convinced you that recovery speed and operational resilience maybe deserve equal attention? Yeah. So you will, um, living in the cyber environment, you're never going to know kind of

[00:03:52] where the next attack is going to come from. The goal here is really about prevention and preparation for the event when it does take, does take place in the air force. They tell about the probability of a kill, a probability of a hit for us over time, the probability of being impacted by a cyber event is a hundred percent. So you really got to prepare for that event to take place. And for us internally, we spend a lot of time from the intelligence point, looking at, uh, actors in the space and what they're

[00:04:19] doing. Uh, we spend a lot of time internally looking at our attack surface in areas that we could be vulnerable or areas that we can need to bulk up our response for protections or contingencies around. And then really the most important part is after the event takes place, how do you react internally? Are you waiting for a technical team to come up with a technical response prior to having a business kind of decision made, or can you make those two decisions in parallel? As an example, you know, in the past we've had, I've worked at companies that had, you know, database related

[00:04:48] issues that were tied to customer information. And it was like, do you make the decision of let's leave the product available to the customers? Or do we make the decision, the risk-based decision, say, Hey, I'd rather have one problem than 400 problems. So let's take the product down as we figure out what's going on. And then let's move forward and communicate what our media, what our remediation path is forward. And cyber security has always been a game of cat and mouse between

[00:05:15] defenders and attackers and organizations. Now they want the productivity benefits of AI, but of course, on the flip side, attackers are still using the exact same technology against them. So what does responsible adoption look like when both sides are moving so quickly? Right now it's, it's a very, um, it's a very interesting place to be in. It's just like when the internet, when the internet came out years ago, uh, email came out, uh, exploited kids came out,

[00:05:45] the availability of information and availability of targeting, um, really was really on the side of the attacker. It always will be, um, for us, uh, responsible AI adoption really comes down to, do you know what the use cases of the tool are? Do you know what it's doing internally in your network? Do you know what it's designed to do? And in cases of agentic AI and, you know, your own employees being able to develop agents to do their job is what's the risk of those agents?

[00:06:12] Is it a agent that is just organizing their calendar, giving them an update of how they need to spend their time for that week? Or is it something more in depth where it's a basically non-human identity taking actions on its own behalf as it sees events taking place across your network. So having a little bit more controls around, uh, the agents that have more availability, more accessibility, more kind of responsibility is really where you, where you want to spend your time. And if we have a look down our LinkedIn news fees, there'll be many companies saying that they

[00:06:41] are prepared for AI enabled threats, lots of AI theater going on there, but what actual evidence should its customers, its board and employees, what should they really be expecting to see to prove big statements like this? It's, it's difficult because the evidentiary aspect of it, um, can be really interesting to interpret. One, you have companies that are full AI adoption where every employee has access to the latest foundational development AI tools. Uh, you have companies that are a little

[00:07:10] more restricted and they only allow certain development, you know, organizations within the business to have access to more capable tools. But for us, um, in terms of like a, a sock to an ISO audit, it's really about evidence. So how many people and what tools are they using across your space? What's the risk of those tools and what types of tools are they using? And then what tools do they have available that are using, um, non-human identities, basically

[00:07:36] just take actions on behalf, uh, of the, of the actor. And that's not necessarily under their 100% responsible purview the entire time. So just understanding the use cases for the tools, the capability of those tools have, and then the overall responsibility and, and, uh, logging that you have around those tools and how they are taking those actions. And of course, intelligence teams have always spent a great deal of times trying to separate

[00:08:03] meaningful signal from noise. We've all heard around the harms of alert fatigue. Very, very real there. So how can security leaders apply that discipline without becoming too distracted by every new alert or threat or headline they see on their news feed? Yeah, it's the, it's the kind of the bright, shiny object problem from an intelligence and business leader perspective. You know, you're always going to have executives that are looking at, you know, the wall street journal, start asking you questions around, you know, what attacks are

[00:08:32] taking place publicly and what's going on, but it really comes down to, you know, killing your intelligence picture specifically to your own environment and what your concerns are. So in the military, it's the prioritized intelligence requirements is kind of the baseline for all the collection for an intelligence professional commander has their own specific kind of commanders intelligence requirements that they want to look at. So it's about balancing that not only having the full coverage about what is taking place across the environment, but also being able to tailor those

[00:08:58] messages to the, to leadership as you need to. So if we're seeing increased activity on our, on our attack surface, interesting types of attacks, if we're getting indicators that specific, you know, malware is targeting us and we haven't seen it being targeted against anybody else, it kind of escalates the overall risk of that. Is it a target attack by a nation state or APT actor? You know, obviously the levels of concern really increase overall.

[00:09:23] And over the last few years, we have seen CISOs becoming increasingly expected to step up and act as almost business leaders too. So are you able to give an example of how you explain a technical risk in terms that maybe lead to a better commercial decision too? Yeah, I highlighted a little bit earlier, uh, previous example, we had a, you know, a database that wasn't quite acting the way we expected it to was providing larger responses than we expected.

[00:09:51] And it really came down to, you know, at the, at the moment within the first couple hours of the incident, we really didn't understand what was taking place across the database. We don't know why it was acting the way it was. We had customers that were asking us questions like, Hey, I did a query and I ended up getting, you know, much larger response with other customer data affiliated with it. And, you know, what's going on around the product. And for me, it was, I wasn't the one to get the first call. I wasn't the CISO at the time. I wasn't even the deputy CISO at the time. I was just a VP of information security and they were asking me what my recommendation was.

[00:10:21] And I was like, well, right now we don't know what's happening. We don't have control of what's happening. And we don't know what the extent of the event is. I was like, my recommendation right now to the product and to the CEO is to take down that product as we do the evaluation, as we get a better understanding of the overall impact of the technical event. In the end, it turned out to be a relatively minor timing where we were doing an update on the database where it was taking place

[00:10:46] at the same time. And there was, instead of defaulting to fail safe, it just failed open. So we had to make a couple of technical changes and corrective actions on the back end, but it really showed for me as like a business leader, understanding what that overall business impact was to the customer. When I was making a decision of, Hey, we need to take this down. I was looking at a enterprise level risk of, we now have one problem that customer has identified.

[00:11:12] I would rather have one problem than have four problems or 400 problems. And the sales and marketing folks were pushing the opposite. Like, Hey, you know, this is tied to a lot of revenue or it's going to look really bad. I was like, I'd rather look bad and lose a couple of million dollars than look terrible and lose a couple of billion dollars. And they're like, okay, that makes sense. So just being able to kind of communicate what that overall risk is. And any business that's had a

[00:11:36] significant cyber event, they know the pain associated with that. Not only the time spent, but the money spent, uh, the resources that you're pulling away from projects that can move you forward. Nobody really wants to go through that. And so be able to kind of communicate that, you know, using kind of tactical standards, using business language, uh, understanding the risk and the overall potential impact is kind of the new messaging for C6.

[00:12:00] You have so many great points there. And I think security, IT and business teams, they very often have completely different incentives and motivations. So I'm curious again, where, where do you see these relationships breaking down most during an incident? And is there anything leaders listening could do before that pressure arrives? Yeah. So it, it tends to break down because various business units have competing priorities.

[00:12:26] One IT wants to be a hundred percent uptime. So that's kind of their benchmark standard. Security wants to have a hundred percent tool coverage and have great response times for incidents. And then the business wants to be able to, to have the reputational consistency, product consistency that, so that when they are, you know, reaching out to new or potential customers, even existing customers, the customer knows what they're going to get. So this always tends to break down and it's, you know, the analogy is, you know, everybody's got a plan until they get punched in

[00:12:55] the face. You know, the adversary has a voice in what's going to take place in your environment, especially during an incident. So for me, it's really about, you know, establishing those, that trust across the leadership team, understanding what the overall business goals, when there is an incident, and then be able to communicate that as a group together in a way that we all know exactly what the playbook would be. So like first 24 hours, we're going to understand what the incident is, find the root cause analysis, do any corrective actions we need to,

[00:13:25] and then start communicating as we get a more firmer, consistent understanding of what the problem is to our customers to not only gain their trust, but also maintain a reputation of business. Understanding that it's going to be challenging, and establishing that trust across the organization, and then executing your plan according to what you have trained for before. Because that allows you to be like super flexible, if you see something that you can attack earlier, but it also allows

[00:13:54] you to run your own teams in the background where you know the response is going to be taking place, and you can just be the one communicating it to the business. Again, so many great points there. And I think recovery plans, they can look convincing on paper, like the Mike Tyson quote you mentioned there, everyone's got a plan until they're punched in the face. But is there anything else that organizations could do to better test before an event, whether their people, their processes, and technology will all

[00:14:22] work when that incident creates confusion and stress, and the business leads are coming and asking for updates every five minutes while the security guys are trying to get a grip on things? Anything else that they should be testing before that happens? Yeah, it's, it's, it's always a challenging scenario. And it really comes down to testing the most

[00:14:45] probable attack pathways prior to that, doing the lessons learned, not only from a technical perspective, but using those technical, you know, tabletops to feed into the management and leadership tabletop so they can get a varying experience across various attacks. But also, not just having a VCP DR plan on paper, you know, you really got to test it in the real world. If that means you have

[00:15:12] to take down a part of your product back end to test it and go to DR to do things like that. So that when you are actually going through a event, you have the confidence that your backup plan is actually going to work versus, you know, hey, let's move to the backup. And then, you know, the IT guy goes, what backup? You know, or, or we haven't done that before. It's like, are you sure you want to do this?

[00:15:38] Yes, I, we need to do this. This is part of our test, or this is part of the event and we have to do it. Having the confidence, preparing, doing the actual actions in the real world, right? You're flipping switches or taking networks offline and moving customers and, you know, doing a test with your third party PR teams if you need to just kind of bringing everybody in the trust tree around. How do you respond to an answer and getting everybody prepared around it? Listening to you today, what I find incredibly refreshing is we're not just talking about the

[00:16:07] technology, the tools, AI, et cetera. It really is collaboration, isn't it? Between security, IT, business teams. These are the things that are essential for managing any cyber threat. It's not about tools. It's about really about the relationships and how you respond. So it's the relationship between the, you know, your executive team. It's the relationship between your legal and the third part, third part legal, uh, organizations that come into support. It's

[00:16:35] about internal kind of expectations about how you expect each like business unit to respond to an incident. And it's also about collaboration. We need to bring everybody into the response that we need to having clear communication pathways, clear decision pathways, decision gates, and also, also understanding like, Hey, projecting, what is this going to look like long-term? How are we going

[00:17:01] to respond? Do we need to start taking people from other staffs to backfill and support? And also you really got to be careful when you are going through an incident that you don't burn everybody out within the first like 48 hours. So like, Hey, you've been working it for the past day and a half, you know, take eight hours off, come back refresh because, you know, it comes down to when you're looking at the same information, you get a little bit desensitized to it and you don't necessarily

[00:17:28] understand, you know, a new piece of information that comes in because you get anchored to like previous decision. So having fresh eyes come in every couple hours to look, review, ask questions, and kind of push everything forward as well. And I always like to try and give my guests an opportunity to bust a few myths or misconceptions that maybe you read on your LinkedIn newsfeed when you're scrolling down there and anything that frustrates you, is there anything we can lay to rest once and for all? Do you see anything like

[00:17:55] that? Does anything ever frustrate you? Yeah. The frustrating aspect of that is that, you know, organizations seem to think that the CISO owns all the risk and it's like, no, it's like, that is not my job is to take the hit for every single thing that is taking place across the environment in the business. It's like, my job is to consolidate and understand the risks that are across the business, you know, especially from a cyber perspective, but also understand the impacts

[00:18:21] of decisions as they're moving forward. So risk is really owned by the entire organization. Every executive leader should have a part of that risk decision and that risk understanding and be able to communicate that. So when I come to the table talking about, you know, cyber risk or decision risk or technology risk, they can incorporate that and understand how that's going to impact their environment or their own people in technology. So we can all kind of make decisions together moving

[00:18:48] forward. And one of the things I think is really important is, you know, when you're talking about an incident commander, you know, I might be the technical incident commander and understanding like in communicating to the business about how an action took place and understand the RCA and understanding how our corrective controls can compensate. But in the end, it's a joint decision, how we communicate that out to the business or out to our customers. And everybody kind of owning that decision is important.

[00:19:14] So for me, it's about decision authority, decision risk, communicating out to customers, and then, you know, maintaining and building trust as you are going to create a challenging time as a company. Fantastic. Well, maybe we can lay that to rest once and for all as well. And looking towards the future, what we're only literally months away from 2027, anything that excites you or anything that you're monitoring closely as it makes you want to jump out of bed in the morning? What's got your eye at the

[00:19:44] moment? You know, I always look at, you know, for me, coming from the intelligence space, like geopolitical risks, looking at events that are taking place across the globe, how they're going to impact US operations, our customers, our infrastructure is always kind of the larger existential threat that you kind of face as a CISO. Like, hey, I know what I control, but I also know what I don't control in terms of like how my business can operate. So understanding that building out, building out contingencies around that as much as you can, understanding, and this is a challenge that

[00:20:14] everybody is facing right now, how AI is going to change our lives. It's going to change how businesses function. It's going to change how work internally takes place. It's going to change how adversaries are their ability to target you. Where in the past, you know, you typically were worried about, you know, higher level CVEs, critical highs. Now it comes down to, all right, what's my SLA around mediums and lows. You know, in the past, it was something I wasn't necessarily as concerned about.

[00:20:42] I just knew that it would take place, but you know, as, you know, mythos and other foundational models kind of come out and they're more publicly available. Uh, I think that's really going to put a lot of pressure on the timelines for remediation efforts and incident response. Well, it's been an absolute pleasure chatting with you today for anyone listening, wanting to find out more information about you, about the work at SolarWinds and what you're doing there. Where should people go to get more info? Uh, for me, uh, the best way to contact me is through

[00:21:11] LinkedIn from the military. I didn't have a huge social media presence just because, uh, wasn't the smartest thing for me to do at times. So I'm not really on a lot of social media, uh, in terms of SolarWinds, you can go to our webpage. You can also go up our public affairs page and our trust center to get the latest and greatest information about how we're moving security forward across the company. Brilliant. Well, we covered so much today from cyber resilience, AI enabled threats,

[00:21:37] intelligent led decisions, the changing role of the CISO and the importance of that collaboration between security, IT and business teams. So anybody listening, if you go to the show notes, there'll be links to everything that you mentioned there, but more than anything, thank you for talking about this today in a language everyone can understand. Really appreciate your time. Thank you. Thanks Neil. Appreciate it. I think Justin's experiences leaves us with a useful test for cyber resilience. If the recovery plan has

[00:22:06] never moved beyond the document, leaders don't really know whether the backup will work. And his example of choosing a temporary outage over the possibility of a much larger customer data problem all show why the modern CISO must translate technical uncertainty into commercial consequences. And this same principle, I think applies to AI agents. Organizations need to understand what each system

[00:22:32] can do, which identities it uses and how its actions are logged. So massive thank you to Justin for joining me and bringing his intelligence led perspective to the conversation today. But over to you, when your organization is tested, will your people know how to act together before certainty arrives? As always, techtalksnetwork.com. I'd love to hear from you. I'm going to be on the road a lot up until

[00:23:00] Christmas. I'm going to be at seven or eight different tech conferences from Vegas to Orlando to San Francisco and Austria. Have a look at the event page over at techtalksnetwork and maybe we can meet in person. But that's it for today. So thanks for listening as always. Bye for now.