This transcript was generated automatically by AI. If you find any mistakes, please email us.
Announcer (00:02.84)
Hello everyone, you're listening to Cloud Next, your go-to source for cloud innovation and leaders in s***t, brought to you by Global Dots.
Ganesh(00:14.821)
The CISO's role has never been more complex. Balancing broad expectations, tightening regulations, and now the rapid adoption of AI across organizations can feel like walking a tightrope. Our guest today knows that balancing act better than most. Jonathan Javi, CISO at Lemonade, the tech company reinventing insurance, has been steering security through hypergrowth, regulation, constant change, and a fast-evolving AI landscape.
He's here to share how the CISO role is evolving, what truly builds trust with vendors, where AI fits and doesn't in security teams, and some more personal takes. I'm Ganesh, awesome solutions architect at GlobalDots, where we research innovations every day so you don't have to. As always, we invite you to join the conversation on LinkedIn. Let us know your thoughts. Jonathan, first of all, welcome to the show.
Jonathan Jaffe(01:03.192)
Ganesh, it's a pleasure.
Ganesh(01:04.568)
really happy to have you. Let's jump straight in. You're a CISO. The CISO role has clearly evolved, but from your perspective, what challenges are still the same and what new pressures have emerged that companies should or could prepare for?
Jonathan Jaffe(01:19.288)
There's a lot, there's a lot. And unsurprisingly, it revolves around AI and the introduction of generative AI into companies. If you're a smart company, I think you want to use AI as much as possible throughout the organization. It's the way to stay competitive. But from a security perspective, because the threat landscape hasn't been well-defined, we haven't seen what the attacks are going to look like. And now you're giving what amounts to
You give me what amounts to children, the controls of a 747 that has autopilot and they think it'll land itself. And if you're at traffic control, you're just beside yourself and how you're going to make sure this plane lands safely.
Ganesh(02:04.802)
Yeah, I definitely, it resonates with me. Just generally speaking in the world of the CISO, always the same, like the attack vectors obviously come first and then the solutions come afterwards. And there used to be a little bit more time to think about the attack vectors. But as we seem to progress through technology over the decades, everything happens so quickly that you can't possibly have the tools in the pocket to stop the new thing that's there.
You know, it's a very stressful thing, always on the back foot it feels like.
Jonathan Jaffe(02:37.664)
You're absolutely right. Just today I was thinking about how am I going to deal with the introduction of 15 new tools that non-developers are bringing in because now they can code and hit the return key after every time AI suggests something with no security controls. The way that we approach it at Lemonade is to keep up with new technologies that try to solve new problems.
which invariably means using a lot of security startups and working with design partnerships of companies that need live data to make marketable products. And then from my perspective, we get to test out solutions that are the Vanguard solutions that are preventing the Vanguard attacks. That's how we do it.
Ganesh(03:29.582)
They're pretty cool to be at the Vanguard edge, as well as I imagine fairly risky. And on the topic of AI, know, it's quickly become the part of like every security conversation, both as a risk and as a tool to be used from your side. But from your perspective and where Lemonade are, what security teams getting wrong with AI today? Well, like where do you see the real practical opportunities?
to use it inside your security organization.
Jonathan Jaffe(04:01.666)
I don't know if I know where teams might be getting it wrong with AI and security or with AI in general. Perhaps people are focusing on the simplistic things like prompt injection and they're not really thinking about the low cost of non-technical attackers who now have tools that can...
amplify their skills so that they become super attackers. I don't know what my peers are doing. can't criticize what they're doing because I don't know what they're doing. I know my fear is that I just don't know what the attack factors are going to look like. And without that, without having initial observability, I'm always afraid I'm missing something.
Ganesh(04:51.17)
Yeah, I saw a piece on LinkedIn actually just yesterday, which put to bed the idea that you can red team your AI. it's essentially the mathematics of AI mean that it's impossible to stop people doing prompt injection and various things. It's a mathematical equation that basically says you cannot stop it because there's too many vectors, too many different ways that it could happen.
Jonathan Jaffe(05:21.078)
And don't send that to me. I don't feel like getting depressed.
Ganesh(05:24.334)
It's bad. It made for bad reading if you were a see-saw. That's for sure. You know, I think you can put things around that. You know, can try and stop at least X percent of prompt injections or, you know, use some sort of AI gateway firewall, something like that. But it's made for gloomy, doomy reading that basically, know, open AI admitted themselves basically that, listen,
Jonathan Jaffe(05:30.57)
Yeah, I'm back.
Ganesh(05:53.698)
that's not a bug, that's a feature, which in brackets means we can't fix this. Interesting from a CISO perspective, because if I was in your boots, I just wouldn't sleep, knowing that that was on my head. How do you cope with that? What's process around that to limit that or to survive that?
Jonathan Jaffe(06:15.374)
I often arrive two hours before everybody else at the office. Some of that comes from the stress of thinking about there's so much to do. But as I alluded to before, the strategy that we've taken to try and deal with emerging threats is to work with emerging technologies. There's another benefit to that and that there are a couple. One, of course, is just fun to play with new shit. Like it really is, right? And because I'm in Israel, where you get...
probably the best, certainly a lot of the best technologies developed. It's fun because you see stuff that you know your peers are not going to adopt for two to four years. But the other benefits are in addition to getting solutions that might actually prevent these threats, you're helping out startups and people with new ideas build their product.
better. So by the time the Delta Airlines and the JP Morgan's of the world get around to catching up to these threats, which they're always laggards and dealing with, you have had a hand in shaping the quality of hopefully what's a really awesome security tool.
Ganesh(07:27.694)
And a big shout to the Israeli tech community because having worked alongside those people for the last eight years, it's very cool to see that drip feed. You say two, three years, sometimes it's five years. It's really, really, really bleeding edge stuff that especially a very regulated Europe generally isn't ready for. People in Germany having conversations about things that you...
sort of make your eyes water like guys, never going to get to the forefront of technology with all that regulation.
Jonathan Jaffe(08:04.106)
I always, whenever I hear Europe and regulation, think there are three things you can count on in life, know, death, taxes, and EU regulation.
Ganesh(08:11.854)
Yeah, 100 % sure. I saw something again on the internet that Google has a line item now in their main budgeting forecast to pay EU fines. It's 10 billion. They put aside 10 billion a year.
Jonathan Jaffe(08:27.922)
I've always I've always I thought a fun pet experiment would be to see how much time humanity waste clicking away cookie banners Clicky banner notifications. Yeah, I'm sure it's probably you 100 million hours a year, you know humanity
Ganesh(08:43.054)
You could build Rome with the amount of time that was spent clicking those things, no doubt about it. I want to come back to more to what we plan to talk about in this episode. In our prep talk, you spoke about the importance of board communication and how you bridge the gap between technical risk and business priorities, particularly around the dreaded AI topic, both from the uncertainty and the hype aspect.
What do you wish that vendors understood better when supporting you in that process?
Jonathan Jaffe(09:17.038)
The quality of dashboards. So in reporting up to management or to a board, you don't need technical details. You need reliable metrics that show how you're doing and ideally how you're doing against your peers in industry so that the board can make an educated decision about where to allocate money. And they can do that if they know comparatively what is our risk.
against other customers, other competitors or just industry.
Ganesh(09:52.556)
Yeah, I also highly resonate with that and that sits me through a very nice way because some of the features that I do see in those tools, particularly when you're looking at kind of CASB tools, you do get that feedback loop sometimes where it says, hey, we've looked at all of the settings in your Octa. Here are the 30 things that you should turn on in Octa as an example. And then sometimes you get this little side pane that says,
Here's where you sit against all the other people that using the platform. And then basically the aim of the game is just not to be at the bottom of that pile.
Jonathan Jaffe(10:29.615)
You just need to be faster than the slowest person in that race away from the bear.
Ganesh(10:34.83)
Yeah, that's exactly it. There's the old proverb of the bear chasing people in the woods and then one guy stops to put on his trainers and the other guy says, what are doing? And he's like, well, I just need to be faster than you. then again, in our prep talk, I want to come back because we talked about regulations and compliance frameworks generally tightening globally, which sort of ties back into anybody who wants to work in Germany or Europe. And AI is moving faster than the regulation, obviously.
So how do you balance the ticking of the boxes with the real world practical resilience? And where do you see either yourself getting it wrong or other companies or anyone getting it wrong?
Jonathan Jaffe(11:14.026)
I think there is a desire to overregulate when you don't understand something. And we see that coming out of the EU. My focus is security. And so I don't first look at regulations to see what I have to do. Sometimes it helps. Sometimes having a framework helps when you either you don't know exactly how to start, but regulations are typically a laggard. I am afraid, as I've said, I am afraid that
Regulations are going to be put in into place that actually would prevent us, for example, from using AI to stop attacks. Regulations.
Jonathan Jaffe(11:57.518)
I don't remember the proposal right now, but it's something in the EU about some AI regulation. You can see AI regulation being so broadly described that it would also prevent the use of using good AI in a security solution, and that would be a bad move. This happens in the world of Sarbanes-Oxley, where the auditor will say you have a control, and that control says that you have to...
have a human review all code before it's submitted. You can see how that's gonna interfere with the idea of having code that self heals and uses AI to remove vulnerabilities. This is something that we're running into right now. So if somebody is going to introduce regulation that essentially prohibits me from using good security tools, that's harm it's done to industry.
Ganesh(12:50.542)
And on that level, talking about those frameworks, and let's say, I don't know what the current EU regulatory framework is, but I'm sure we're not too far away from some sort of NIST style framework that encompasses AI, if not this year, very soon.
with those things, like with ISO audits, like with SOC audits, there is an inherent ticking of the box, basically. You you know the whatever it is, 17 sections with their 20 sub questions. You do everything you need to do to solve that. And I don't think a lot of the time, I mean, I can give a real world example where I was part of an ISO audit once and it was full of red on the screen, like.
tons of machines that had at a date, no antivirus on there, or they weren't connecting to their antivirus server. And my boss was like, well, you can't show that to the auditor. So he had me filter them out. I just put, you know, filter the ones that are connecting. Screen goes green. Auditor sees it. Great. Green screen. was like, you know, I immediately lost faith in ISO audits. I was like, these things are a complete waste of time because if I'm doing it, everyone's doing it. I won't say the person or the company because probably there's legal ramifications of that, but...
Like that's the sort of the box ticking episode that I feel that happens. And what's your feeling on that? Like where do you see the balancing companies or people getting that right and wrong?
Jonathan Jaffe(14:30.222)
think that we get audited for SOC 2. And while I don't enjoy it, and I do think there is a lot of box ticking that goes with these things, what I found is at least for vendor to vendor relationships, like when I have to bring on a new vendor that's a service we're going to use, it really helps me confirm
that at least some minimum threshold of security is in place. If a third party auditor has come in, yes, the vendor can game the system and hide those red alerts. You hope that the auditor is a good auditor and knows how to make sure that doesn't happen. But at least a third party is coming in and saying, you have to have a higher level of security than what you would have if there was no third party looking at this. It's far from perfect, but it...
raises the bar across the board for security. I'll comment on ISO versus SOC though. ISO is about, you have a bureaucratic security program in place? Which I find much less valuable than at least something that looks at the actual controls like SOC 2 tries to do. So I don't value an ISO report from a potential partner, somebody we might do business with.
put weight into the sock too, but I also know that it can be gained, but at least it raises things up a bit. So I don't have to do something I can never do anyway, which is I would never go and audit another company. Nobody has a bandwidth desire or money to audit all of their partners. So it has a place. It has a place, but it's not great.
Ganesh(16:14.222)
For sure, nobody has got the time for that. ISOs are not for technical people, Different people are interested in ISO audits, that's for sure.
Jonathan Jaffe(16:27.854)
The ones who work 32 hours a week and take a lot of coffee breaks, usually at the top of every hour.
Ganesh(16:33.678)
You mentioned you get in two hours early every day. I meant to ask, is that so you can see if the lights are still on and then if they're not, that means you've got a two hour head start on looking for a new job.
Jonathan Jaffe(16:45.134)
No, but I should think of it that way though. It's a much better way to go. No, it's just, I have a number of dashboards I review every morning and those take focus and then as people come in, you just have to start to deal with OKRs and planning and projects and the things that require interaction with people.
Ganesh(17:05.902)
Hmm. Makes sense. we'd love for you to take part in our rapid fire questions. so on your Mark's Get Set Go. One tool or app you can't live without.
Jonathan Jaffe(17:20.75)
Well, I like my CSPM product. I have two and I'm not going to name them. I have two for historical reasons. I actually think enterprise browsers are a critical function. And I think anybody who doesn't use it is practicing professional negligence. I just think you're an idiot if you're not using some sort of enterprise browser. And then I do have a couple of favorites. I like this little tool out of Israel called Breeze Security. I really like it.
Ganesh(17:50.158)
Bree security, like the cheese br-
Jonathan Jaffe(17:52.334)
No, like the wind rushing through your hair if you have it.
Ganesh(17:56.066)
security. Nice. One tool or app you hate.
Jonathan Jaffe(18:02.478)
At the moment I kind of hate anything that does AI like Claude cursor Windsor They're making my life really difficult
Ganesh(18:12.524)
You're gonna have a lot of hate in your life. I don't see those slowing down, unfortunately. What keeps you up at night professionally or unprofessionally?
Jonathan Jaffe(18:22.548)
It's just AI. It's the onslaught of AI tools that lower the barrier to entry to making havoc.
Ganesh(18:30.478)
Can you share the worst ever experience of your career?
Jonathan Jaffe(18:34.148)
yeah, that's a great one. I was doing a job for the gap 20 something years ago as an independent consultant. And I was putting together there. put together their LDAP directories. and then I think one Friday evening, I just wanted to do an upgrade. And so I, I backed up the directories and I was a bit cocky working from home and I was sipping on some wine. It was, think Friday at 9pm.
There's a command in LDAP. There's, I think it's LDAP to DB. And then, so that goes from the LDAP to creates a database. And then there's DB to LDAP, which is how you upload a database back into a directory server. Stupidly. I started off with a DB to LDAP being a little bit drunk. I didn't know there was a problem because there was success. You know, the database was uploaded, but...
Of course, I'd overwritten an entire directory of all of GAP's employees. So Saturday morning, just before Black Friday, actually, it was a week before, Saturday morning, all GAP stores were unable to use their registers for the entire weekend without going to a backup local system of prior credentials.
Ganesh(19:51.424)
that's a good one. I think that might be the most wide impacting and best answer we've ever had to that question. We get some good answers for that, but that one is literally like thousands of people impacted.
Jonathan Jaffe(20:07.086)
Yeah, I think it was 200 and something thousand employees. don't know what the lost sales were. They didn't tell me that number before they exited me out of the engagement.
Ganesh(20:11.918)
Well
Ganesh(20:20.066)
Thanks for sharing. That's brilliant. We're coming to the close of the podcast. It's a pleasure having you on Jonathan. But before we let you go, we always like to give people the DeLorean question. And that's...
Jonathan Jaffe(20:34.16)
No, I don't do cocaine.
Ganesh(20:36.27)
If you could go... You know, I saw something today. Chorologics is having their SKO and they're creating a film of the SKO and it had a real
Jonathan Jaffe(20:51.584)
sign me up. I'm sure that's going to be exciting to watch.
Ganesh(20:54.728)
It had a zoom up of a line of powder and it said the Corelogics SKO gets wild. And then it was two lines of powder and as it zoomed out, it was flour and they were making pizza. But I just thought that's a crazy piece of marketing to put out there. I'm not sure you want your company associated with lines of cocaine. Anyway, I don't think they might be owed. No.
Jonathan Jaffe(21:17.39)
Are they public?
Jonathan Jaffe(21:23.522)
And they probably won't ever be public now because of that.
Ganesh(21:27.168)
I don't know. I saw it. just thought that's the kind of thing that got me in serious trouble when I did stupid shit like that like 10 years ago. That's story for another day. But back to letting you go before we let you go. If you could go back in time and give yourself one piece or more of professional advice, what would it be? What would you say to the younger you?
Jonathan Jaffe(21:51.884)
professional advice, stay curious. And if you're not yet curious, become curious, especially with the advent of new technology. Don't rest on what you know.
Ganesh(22:03.788)
Very sage words to end on.
Jonathan Jaffe(22:06.094)
and also sell high.
Ganesh(22:08.238)
Another piece of advice that is very easy to say but...
Jonathan Jaffe(22:14.056)
That's her personal experience having thought the stock would always go over 20 years ago and I was at a startup thought the stock would always go up.
Ganesh(22:22.126)
Yeah. doesn't. I feel like we could share a beer over that topic. I once invested pretty much my life savings in a startup and watched it crash. So, you know, you have, you've definitely got an empathy vote for that one. pleasure Jonathan, nothing more for you. be the great guest. Really. Thank you.
Jonathan Jaffe(22:41.786)
No, no, was a pleasure
It was my pleasure. Thanks for the honor.
Ganesh(22:49.72)
That's it for today. Thank you all for listening. If you're ready to rethink your cloud practices and cybersecurity strategy, then the team and I at GlobalDots are at your disposal. We've been doing it for over 20 years. It's what we do. And if I don't say so myself, we do it pretty well. So have a word with the experts, don't be shy, and remember that conversations are always for free. I'm Ganesh Leeawasam, and this episode was produced and edited by Toma Milvidson, sound editing and mix by Bren Russell.
Stay tuned for more episodes.
