The Defender's Window at enterprise scale with Standard Chartered
Matt Weaver from OpenAI and Reuben Athaide from Standard Chartered discuss how the bank uses OpenAI Daybreak to address the shrinking "defenders window" by focusing on contextual AI analysis of attack paths, fostering cross-functional trust, and leveraging AI for proactive, scalable security in a complex global environment.
The Shrinking “Defenders Window”
Frontier AI models have significantly shortened the time required for attackers to understand software and identify exploits. For a global bank like Standard Chartered, this necessitates understanding potential exploits much faster than adversaries. The focus shifts from merely identifying Common Vulnerabilities and Exposures (CVEs) to comprehending exploitable attack paths that span across systems, APIs, identity systems, and trust boundaries, which attackers target rather than isolated assets.
Leveraging OpenAI Daybreak for Enhanced Security
Standard Chartered was among the first banks to evaluate OpenAI Daybreak. Their initial motivation was to gain deeper insights into risks that traditional security approaches couldn’t uncover, particularly in understanding complex interactions across diverse repositories, architectures, and trust boundaries.
A key observation from their early findings is that Daybreak, when provided with rich context, yields significantly more findings. The speaker emphasized that context is paramount, even more so than the specific AI model chosen.
The Importance of Context in AI Analysis
To maximize Daybreak’s effectiveness, Standard Chartered feeds the model with extensive contextual information, including:
- Architecture diagrams and deployment models: Visual representations of how systems are structured and deployed.
- Dependencies: Relationships between different software components.
- Connected services: Other services interacting with the asset under analysis.
- Solution intent: The original purpose and design goals of the system.
This comprehensive context allows the AI to identify truly exploitable vulnerabilities rather than just potential issues.
Building Trust and Fostering Adoption in a Large Organization
Integrating AI-generated security findings into a large organization like Standard Chartered requires overcoming significant hurdles, particularly in building trust with development teams.
- Beyond Demos: Simple demonstrations are insufficient. Hard evidence and collaborative validation are essential.
- Cross-Functional Collaboration: Standard Chartered fosters a collaborative environment by bringing together application security and development teams. This joint effort validates AI findings against actual code, architecture deployments, and production environments, ensuring accuracy and relevance.
- Shifting Security Mindset: The goal is to move security from being perceived as a “gatekeeper” or “blocker” to an “enabler.”
- Focus on Remediation Efficiency: Instead of just reporting issues, the emphasis is on understanding root causes and improving remediation processes. AI can even assist in proposing remediations.
- “Shift-Left” Approach: Integrating security tools and findings early in the development pipeline allows developers to access insights and test exploitability in a virtualized space. This proactive approach builds trust as developers see security as helping them “go faster, safely.”
Strategic Foundations for the AI Era of Security
To effectively leverage AI in security, leaders must re-evaluate foundational elements:
- Solid Foundations: Reduce technical debt and minimize technological complexities (e.g., standardizing programming languages).
- Up-to-Date Architecture: Maintain accurate and current architecture documentation, as this is crucial for providing the necessary context to AI models.
- Robust Identity and Access Control (IAC): Strengthen IAC because AI amplifies existing conditions, good or bad, within an environment. Organizations with strong foundations will best capitalize on AI’s capabilities.
Unexpected Learnings and Future Directions
- The Power of Context Reveals Gaps: The journey with Daybreak highlighted the significant importance of context, which in turn exposed gaps in the Software Development Life Cycle (SDLC), such as outdated architecture documentation—a previously “taken for granted” aspect.
- New Insights from AI: While many findings aligned with expectations, Daybreak also uncovered issues that traditional tooling had missed, proving its unique value.
- Scalability for Global Footprint: Given Standard Chartered’s global operations and diverse regulatory environments, scaling security analysis is paramount. The security team aims to empower developers with self-service tooling.
Feedback for OpenAI: The “Defense Factory”
Standard Chartered expressed a strong desire for OpenAI to enhance Daybreak’s scalability. Running scans “repo by repo” is not viable for a large enterprise. They envision a “defense factory” capability:
- Bulk Scanning: The ability to run large-scale scans across numerous interconnected applications.
- Sandboxed Environment: Performing these bulk analyses in a secure, sandboxed environment.
- Blast Radius Analysis: Critically, understanding the potential “blast radius” – if one application is breached, how far could an attacker move within the interconnected ecosystem.
This “defense factory” concept resonates with OpenAI’s future product direction, promising a more comprehensive and scalable approach to proactive security.