The n8n Masterclass
Welcome to The n8n Masterclass. I’m Dylan Watkins.
Each week we break down real business wins using n8n and AI automation. You’ll learn what worked, why it worked, and what broke along the way. Founders, automation experts, and AI agencies share how they use n8n to simplify operations, scale delivery, and move faster without adding more people.
The n8n Masterclass is not about tutorials or tech jargon. It focuses on the real business side of automation, the frameworks, decision patterns, and creative problem solving that turn workflows into results.
You’ll leave every episode with one principle, one pattern, and one action you can apply this week to grow your business, reduce manual work, and unlock the potential of automation.
If you’re building a business that runs on smart systems, AI, and no-code tools, this is your playbook for scaling with n8n. Follow The n8n Masterclass and start using automation as your competitive edge.
The n8n Masterclass
Mythos & Fable Can Weaponize Cyberattacks. This n8n System Fights Back
Use Left/Right to seek, Home/End to jump to start or end. Hold shift to jump forward or backward.
Get the open-source incident response workflow here: https://go.n8n.io/incident-response
Anthropic's Mythos AI just found a 27-year-old security bug in OpenBSD that no human ever caught. Days later the US government pulled both Mythos 5 and the public Fable 5 model, worried that same power could be weaponized into cyberattacks. The threat is no longer theoretical, and if your defense isn't automated too, you're already behind.
Dylan sits down with Viraj, a former n8n team member turned forward-deployed engineer, who now helps enterprise companies build AI-powered security systems. They walk through a live demo of an open-source cybersecurity workflow built with n8n and backed by real incident data.
The conversation covers how to bring AI into SecOps without letting it run wild, why historical incident data and playbooks matter more than the model you choose, and how Anthropic's Mythos is changing the threat landscape by chaining multiple vulnerabilities in a single attack. They also dig into real-world social engineering scams, phishing tactics, and why good data hygiene is the unsexy foundation that makes any AI system actually work.
The bigger takeaway: the models will keep getting smarter, but the companies (and individuals) who win are the ones with clean data, solid playbooks, and a workflow harness that can plug in whatever model comes next. This is a practical blueprint for fighting AI-powered threats with your own AI-powered defense.
🎙 Chapters:
00:00 - AI Found a 27-Year-Old Bug
00:37 - What the Demo Covers
02:43 - Test Incidents, Playbooks & Data
06:11 - Live Phishing Workflow Demo
07:08 - Three Branches of Analysis
09:35 - Threat Intelligence Explained
12:31 - Mythos and Zero-Day Threats
15:20 - Why Data Hygiene Matters
16:36 - Workflow Results Walkthrough
21:07 - Social Engineering and Scams
25:07 - Actionable Remediation Steps
30:53 - Data Ingestion for Companies
34:50 - Forward-Deployed Engineering
38:51 - Local Models and Personal Security
40:41 - Where to Find Viraj
Get 30% Off n8n Cloud Starter or Pro Plans!
Want to get started with n8n? Visit n8n.io/pricing and use code 2025-N8N-PODCAST-729C416E at checkout for 30% off your first month or year.
Anthropic's new AI model, Mythos, just did something insane. It uncovered a security bug in OpenBSD that has been hiding in one of the most secure software systems on Earth for the last 27 years. The concerning part, no human caught it. AI is now automating attacks faster than any human team can respond. So I got my former NAN colleague, Viraj Manalika, who now deploys these defense systems for enterprise companies to show us how to build one. Your attackers are already automated. And right now, your defense probably isn't. Viraj, welcome to the show. So what are we learning today, brother?
SPEAKER_00Hey Dylan, great to be here. Today what I've got for you is a bit of a demo around a cybersecurity workflow. More precisely, it's how do you add AI into your cybersecurity or SecOps workflows? They're super sensitive. There's a lot of uh often quite sensitive data running through it, and it's the kind of thing which if you have an AI agent running wild, making random decisions, it's just going to create chaos. So some of the more general topics we'll look at is how do you, what's the infrastructure, what's the harness that we're building, then how do you keep the AI in line? Uh, how do you give it some sort of ring fence and, you know, give it a bit of a boundary in terms of what it can do? And more broadly, I guess some of the experiences I'll be I'll be bringing out are from my time at NA10 uh working with enterprise customers. So anyone running an agency or you know working with businesses implementing NA10 will probably find a couple of things here that they can apply.
SPEAKER_01Great. And uh this is actually great timing because recently Mythos has come out, which is from Anthropic. And this is one of those things that these AIs are getting incredibly sophisticated when it comes to penetrations and cybersecurity issues and things like that. And so if if you are not aware, if you're somebody who's just unaware of all of the cybersecurity threats, especially with AI floating around in the surface, this would be a good podcast to listen to so that you can be aware of the possibilities of what AI can do to both penetrate and protect your own sensitive systems and data. With that, please share your screen. Let's get into it, shall we?
SPEAKER_00Let's jump in. All right. Why should I just jump in and take it from the top here?
SPEAKER_01Yeah, so talk to me a little bit about this. Like, yeah, what is this system? What are we going to be learning? And what do you have going on in inside of here just so people can understand it?
SPEAKER_00Yeah, sure. So, you know, the workflow is a part of it, but this is gonna be, you know, when we launch it, it's it's part of a much bigger repository where the workflow is just one tiny bit of that repository. I'll tell you a bit of context here. So, as you probably you know inferred, this workflow helps cybersecurity professionals bring AI into their incident management workflows. It's something that I'm seeing a lot of companies want to do, but there's a big gap between the not the ones that want to do it and the ones that actually are doing it. So I want to really bridge that gap, handle those companies, and give them a little sort of base to start with. Rather than just give them a workflow where you've got to load up your own data, it takes hours to configure. We've created a bit of a repository with uh, I guess, well, docs, but also three uh really interesting bits of data here. So one is test incidents. So there's a uh a library of around 15 typical, you know, very common test incidents that you encounter in the wild, formatted very much. If you're a you know a Cyclops practitioner, you've probably recognized a few things here, like the MITER TTPs. If you're not, don't worry. Basically, this is what uh a lot of detection systems will put out once they detect something that could be a threat or an attack on your on your company infrastructure. Second layer, we've got reference playbooks. So often a lot of enterprise companies, if you're a 10,000 person mobile network or if you're a 200-person finance company, you tend to know, or your SOC team will know, what the most common attacks you face look like. And what they then do is they write a playbook that basically is like a super you know useful guide that goes through, okay, whenever we get an incident, let's say a phishing incident in this case, what's the first checklist? What are the typical indicators of compromise? Basically, how on earth do we look at this thing and what do we do once we get it? So this is you know also fairly common, and we provided a few of the examples there, and you'll see why in a second. And the third, and this is really important, we've got a library of uh, you know, in this case, 30 resolved incidents. So it's really important that you have your the the stuff that you've seen before and the notes on how you resolved it. That's a really key component of how this AI agent is gonna figure out what to do with new threats, new tickets coming in.
SPEAKER_01Got it. Yeah, and it would be really helpful as we go through this, and I know we're gonna have some time uh while this workflow is gonna be processing, talking about it, is to actually go over uh what are some of the most common ways that people try to penetrate uh your systems? Like it would be very interesting to know that okay, what kind of phishing attempts are happening, what are the common ones, what are the new ones? What are things that people should be aware of? I mean, we all know like those phone calls that you would get from people that would say, Hey, your your friend's in trouble, or like, for example, like I know like a lot of social um hacking, people will clone your friend's voice, call them up, and and then say, Hey, I'm in trouble, please send money. So, I mean, those ones are somewhat common or well known. I'd love to dive into these ones so people are aware of them, not just in the cybersecurity world, but any company, whether you know, SMBs, mid-market, or enterprise, are aware of some of these different types of tactics that people are using to penetrate their systems.
SPEAKER_00Yeah, for sure. And you know what? I would love to have this as like a personal sock as well. So looking at more of the you know, personal kind of attacks, social engineering and so on. And I think this will get there at some point. We'll we'll have people forking this and doing that kind of thing with it. Um but I'll say before we jump in, a lot of the the kind of the focus here is on what smaller, you know, small to mid-sized company all the way through to an enterprise would typically be seeing. And it does skew more towards the enterprise end of the spectrum. So a really common uh attack factor would be, for example, a phishing attack. For those of you that that that aren't familiar with the term, that's when an attacker will send an email that generally pretends to be something it's not. For example, an email from Google with a link, and you go into the link and it looks like a real Google page. You enter your login details, but actually you've just given them away to someone else.
SPEAKER_01Yeah, that's a that's a great point. I know that a friend of mine recently got hit with that. It was with a service where there is roads, highways that you had to pay for. They're toll roads. And so he got a notification saying that, you know, he had a ticket, he had to go pay it on this specific toll road. And he's oh dang, went in, put in his credit card, and then realized after he put in his credit card that this was not the right site. They just were able to look up his location, understand that he's inside a certain toll road radius, and then generated these automatic messages to go out to everybody inside this radius about this toll road. And so these are things that seem very natural and innate that if you're unaware of it, can be very dangerous. So yeah, exciting and also terrifying. So let's let's dive into it. I'd love us to get started with some of these uh these test runs. And as this thing gets performing, I'd love to have you walk us through how it works.
SPEAKER_00Let's jump in. So, what I've done is um I'm just you know, using my favorite vibe cutting platform, Replit. Uh, I just made a little UI. So rather than just go through and you know, create a webhook in a bit of a bland way, what I've got here is this is pulling in all of those test instances that you saw in the GitHub repository earlier. Let me pick, I mean, I've talked about phishing, right? So let me see if I can find the phishing one again. And what we can do is using this, we can actually send this into uh into our workflow. So I've got everything here. By the way, one cool thing we can explore later is obviously these are my tests incidents. If you're a company, if you're a you know, if you're an analyst, you'll probably have your own bunch of incidents that you think are pretty typical of what you're getting. In that case, you can just go in here and edit the payload, right, to make it read, to basically be whatever you need it to be. And if we get some time, we can dive a bit deeper into this. But for now, let me send this uh in. So this will now have triggered the N80 workflow. If we go here uh with a bit of luck, we'll see that it's just started running. And in the meantime, you know, all this is gonna do, I'll use this time to explain what's gonna happen as that workflow is running. And once it's done, we can dive a little bit deeper into it. Great. So let's go. So the webhook, obviously, that's where you receive that JSON payload that we just talked about. And then it's really gonna go into three branches uh and in this priority as well. So speaking with a lot of people that work in this space, the number one thing that's useful when you get a new ticket is to say, hey, look, have there been any past tickets that match this? Are there any uh any properties, let's say IP addresses or you know, countries where something is originating from that we've seen before that we can try and look at what happened there and correlate to that? So the very first step is looking at those historical incidents. And that, again, we can dive a bit deeper into this later on. To allow this to work, what we've done is we've basically vectorized all those tests, those historical incidents that I showed you earlier. So they all live nicely in the superbase uh vector database, and we're just using embeddings here, so it's it's you know rag driven to get that first bit of historical context.
SPEAKER_01And for anybody that wants to know more about the rag vector, all that stuff, uh, there was a previous podcast with Cole Medea. If you go check that one out, we dive into how rag works. We won't go super deep in exactly how that works. You can watch that episode, super deep dive. Uh, this one we're gonna focus more on the cybersecurity, just so anybody that is curious and is unaware of what that means.
SPEAKER_00You know what? I think Cole said something like um he teaches NA10 through a rag workflow, and I love that because I think if you understand what's happening when you're generating embeddings, that is like a huge chunk of understanding you'll build in LLMs and how to use AI just through mastering that one skill.
SPEAKER_01Yeah, yeah. I mean, AI has got a couple of uh uh buckets to focus, uh, their skill sets, and you know, memory is one of it. Memory is one of those big buckets, right? Processing power, memory, and the you know, the ability to um make these connection points. And but if you ever if you ever look at it, uh especially like if you look at say cloud systems, right? There's always like cloud MD, who am I, what am I doing, and memory. And that's like the two quincible pieces intelligence and memory. So absolutely, yeah, 100%. It's it's an important thing to dive into. Nice.
SPEAKER_00And just maybe a quick thing to call out here is you'll see that in all the branches we've we're using structured output passes. Again, super useful when you when you have a you know bit of a, I guess, an application like this, it's really important that you're not just letting the AI output anything and you know whatever it wants to, you're really constraining in terms of the format and the feels that it's outputting. And so we make a lot of use of those through all the different branches here. Going into the second branch, I think I mentioned at the start that a lot of companies have these reference playbooks. So typically you'd write these up for the most common attacks, the ones that you face all the time, the ones that have the largest potential to really disrupt business. So the second step is to look at those playbooks, and really the AI is saying, well, okay, if I already have instructions from a human or from a, I guess, from a best practice guide, it makes a lot of sense to look at that when I when I look at how to respond to this particular incident. That's the second step. And the third step is threat intelligence. So a lot of companies have what's called a tip, a threat intelligence platform. We obviously have simplified it a little bit and we've just used a Google search, but really this is where your brand new latest knowledge is going to come from. As long as the tip is updated regularly, you'll have all sorts of things where new vulnerabilities are discovered, they will be logged here. You know, it could be anything, and I guess in its most basic form, maybe it's just a Google search, uh, which is what we have as this third branch. This is the lowest priority, by the way. And I think a lot of companies that I've worked with certainly would probably say we don't want this at all. We're happy with the first two. Uh, but it's always nice to have this option for the companies that want this sort of external lookup before before that response is created.
SPEAKER_01Got it. Okay, so that's the that's the tip of the tip. Uh, not going super deep on that one, but at the top, let's go let's go dive into them a little bit deeper. Uh, I don't know if the system's ready yet. But so we talked about historical rag data. That is, we talked about it, it sounded like shady locations was one of the places, okay, IP addresses, uh, known bad actors. Uh, what are some of the other historical data points that you're considering?
SPEAKER_00Yeah, um, so I guess quite a few things. So one is um let's say if we we have like, I mean, if you if you're a big, let's say, telecoms company, you probably have a bunch of countries where a lot of attacks originate from. So you might be looking for, okay, let's take the IPs, uh, let's enrich them. Do we see that it belongs to a certain country or an IP range that belongs to an ISP that we know is a little bit dodgy, whatever it might be. There really is there's so much rich data coming in in these tickets. Um, and this is just pattern matching and seeing you know what what it's gained from that. What I can do is let me see how this is progressing. Um, so I think the workflow is still running. I can actually jump in in a second and show you the exact output from this step so we can talk a bit more in depth about that.
SPEAKER_01Got it. Okay, so you're looking for the locational data and then the playbook. Is there any places uh you talked about this is the company playbook? Are there any places that where people can actually find like best practices playbooks, like someplace where there's like, okay, this is what's known or updated of what people do. So they can kind of, instead of starting from scratch with their own playbook, maybe like leverage some sort of community group source version one.
SPEAKER_00Yeah, absolutely. So there's a bunch of these published online, but you know, you can just look through and it'll have the basics of creating one for yourself. I believe there's also companies that that whole kind of, you know, the purpose of the company is to provide and create these sort of playbooks for you. Any, you know, security operations center or uh MSSP will probably have some ready-made playbooks uh off the shelf for certain kinds of attacks. And I think there are now newer companies that that are really zoning in on this particular bit of the challenge.
SPEAKER_01I wonder how much this is going to be updated if there's a playbook, because again, a lot of things we were talking about before the podcast, uh, we were talking about mythos. And so I know with mythos, some of the things about it was the fact that it was, it's been able to find a whole bunch of like unknown, what do you call it, like zero-day discoveries. And it says that basically vulnerabilities including a 27-year-old bug in open uh BSD that human developers had missed. So I wonder if there's any things that are gonna be updated with the playbook now that mythos has kind of come out. It's not fully out to the public yet, but has been shown to have real ability to penetrate systems.
SPEAKER_00Well, you know what? I think on this, mythos me at its core is gonna do two things. One is that it reduces the cost of basically creating and running an attack, or at least creating an attack for, you know, and sort of having the idea behind what you're doing. And then two, it actually will lead to more sophisticated attacks. So we're talking about zero days, things that generally, you know, you're not gonna have anything in your historical tickets or your reference playbooks for a zero day. That's really where the tip component might be something that a lot more companies start taking seriously now because you're getting, as soon as you know, it's first reported, within hours, within a day or two max, you then have that knowledge to benefit from from an attack that's taking place somewhere else. So I think that that tip element is really important. But ultimately, I think where the pain is gonna be felt is there's gonna be a lot more incidents created. So the the the data that we're throwing into this workflow is gonna be probably 10x in you know uh six months' time compared to what it was like six months ago. So you've got to fight AI and automation with your own AI and automation. You can't have a human analyst, like thinking they probably physically couldn't review all these incidents themselves.
SPEAKER_01Yeah, and that's the important system. And we're kind of getting there a little bit with what you have right now. I mean, we're using automation, something that you have pre-programmed to run a battery of tests against this threat detection system to figure out what's going on. It's it's a bit more automation. It's not necessarily an AI coming up with different different vectors of attack, but this is something that we are starting to do right here, right now, and that um ideally people will be able to replicate on their own so they can stay safe and protected.
SPEAKER_00Absolutely. And maybe just to go dive a little bit deeper into that, I think one of the the scariest things perhaps with mythos that I'm reading, and by the way, there's a lot of debate out there. The customers that I work with generally say that look, you know, it's scary. Yes, LLMs are now going to be very useful uh for adversaries and for creating attacks like this, but it's it's probably not as kind of nightmarish as as it might initially be suggested. But one of the things there that I think could be the scariest is that Mythos is actually chaining multiple vulnerabilities, right? So it's not just doing one thing, it's powerful enough and large enough to now look at five different things and run those attacks, if not at the same time, than within minutes or seconds of each other. And this is where having, well, you know, one, having a workflow like this where you have those historical tickets, even if they're just a few minutes all to look at, is gonna help anyone, a human analyst, but especially an AI analyst, look at that and take that into consideration when deciding, when figuring out, hey, what's going on here, what are the next steps. But two, when you implement something like this, you need to have good data, right? This is basically a harness in terms of industry speak. You can plug whichever model you want into it. If you have mythos, you can plug it in. If you have something else that's equally as powerful, as these models develop, this is evergreen. This stuff isn't really gonna drastically change. Yeah, you'll have to update it, but the the the core infrastructure is there. But it also forces a company to get their data in order, right? For this to be effective, you've got to have a repository of your past incidents. You've got to have maybe a couple of playbooks. That the richer your data, the cleaner it is, the more effective the system will be. And I think you need to have that, that posture to be able to now fight uh more complicated, more sophisticated adversaries that are going to be looking at attacking your company.
SPEAKER_01100%. And the thing is that like it's all these buzzwords that are going around like uh my AI OS system, right? Or my, you know, uh my AI that runs my business for me. All those things are really basis of how good is your is your data hygiene? How good are you at organizing your information? Right. It's all based on best practices. It's like, you know, this is someone who runs an agency, some company gets super excited, they're like, hey, I know I need AI, I need to have AI in my business. You're like, great, where are your SOPs? And they're like, I don't have SOPs. You're like, okay, so you have no standard operating procedure whatsoever, but you just want AI to come in and solve your problems. That's like having you have a very messy household and you're having AI trying to figure out to be more efficient, but you need to have all your data in order. So this the same thing, like there's good coding practices, there's good cybersecurity practices, there's good data management practices, there's good business practices. All of these things are all all based upon AI runs off of data and it uses that data plus its memory and intelligence. Now we're putting those three pieces together is data, memory, intelligence together to be more effective. And so I just, yeah, I think people get super excited and also terrified at the possibility of AI, and they they skip that first step of like, is your data in order? So I really want to double-click on that because I think it's super important.
SPEAKER_00Absolutely. Hey, should we check if that workflow is finished running? And yeah, let's take a look. Cool, let's do it. Let's let's see. All right, looks like uh it succeeded. I'll let it load up for a second, and we can then jump right in to this question you asked, which is okay, well, what does it actually do or what does it look for with these historical tickets? Let me quickly go here. So, one thing I love to do first is just say, okay, how many past incidents did it find? So it found it found three that were relevant. I think they're actually pretty strong matches. So they're they're fairly, you know, they're fairly similar or that they share a lot of characteristics with this test incident that we we threw in there. If I just maybe make this a little bit bigger. There we go. So it's looked at, okay, from the similar tickets, what is the most common root cause? In this case, it's the lookalike domains that were registered before the attack. And then it's looked at looked at, okay, from from what we know and how these these past tickets were resolved, what are the proven remediation steps? And it's it's extracted that. But it doesn't just stop there because it just uses this as one of the ingredients. It doesn't just output that. If I go into uh this actually it'll be here and go back into my table view, you'll see that you've got the the past instance search that we talked about, but we also have a playbook that it's found. And then we also have sorry, this is markdown, right? So it's not doesn't look the best in this view, but we can see it a bit later. And then we also have a external threat search. It's found a few things here that it you know that it thinks are relevant, and it's gonna then pass all those three things in to this report synthesizer agent who basically is briefed to look at all these three things. Uh, we've given it some some sort of guidelines, you know, it's a little bit opinionated in what it should and shouldn't do, and what it's gonna output, and I'm gonna jump into this tab here because the markdown is gonna be much neater. This basically is just the markdown version of what you saw in the NA10 window earlier. Uh, it obviously has a nice exact summary of okay, what exactly are we dealing with here? Quick summary of you know uh what's what triggered the alert, uh what it thinks the root causes are. And this comes up a lot. So going back to your question earlier of what does it look for in past tickets? Most professional um SOC or security operations centers, SOC, uh, what they're looking at is there's a framework called mitre attack and that has techniques, tactics, and preventions. Each of those are numbered. So this is really powerful because if your incoming ticket has actually has already categorized what the TCP uh references are for that instant, it makes it much easier to cross-reference with the previous ones.
SPEAKER_01So these are all these are all known vectors of attack, and they they've been uh because I'm not familiar with this as much. And so with this, they they're they're able to label it so this is the type of attack that's happening, and there's a standard process for that. And so it knows to catalog that, organize that, and then there's probably some sort of general best practice ways to handle that.
SPEAKER_00Kind of, yeah. But rather than looking at like an attack, it even looks at techniques. So, what is like a technique that's being used, and maybe that technique could be used in different ways, that core technique remains the same, right? So it'll be it's quite an you know fascinating mapping. It's it's all public and it's all free to have a look. But it's it's worth just having a quick glance at how that that sort of hierarchy works and how the relationship is.
SPEAKER_01And how do people find that?
SPEAKER_00Um, just search for miter attacks, or M I T-R-E, attack, but there's an and sign in there. So A T T and C K, I think. That's what you'd search for.
SPEAKER_01Got it. Okay, please continue.
SPEAKER_00Nice. Um going through the report. So again, some of the things that we say is okay, that we we again don't want the AI to just give one conclusion that's often not helpful, that there's more chance of it being incorrect. But really, you you think of this as a companion for your cybersecurity analyst. It's saying, well, hang on, there could be other reasons that that that this is happening. So just look at this stuff and rule it out first. Or maybe not first, but but have that in your decision, your decision mix when you're looking at how to resolve this. So, for example, something's a benign, right? So false positive, so maybe there's just an internal system that's not been configured properly. It's possible that that could generate an issue like this, for example. And then you have a whole host of uh it's extracted IOCs, and this is going to be in JSON as well. So, what you might actually have is for certain low-risk actions, for example, um, I don't know, doing a search against an IP address here, you might actually have an AI already do this for you. So again, saving a bit more time for the analyst. So not only is AI doing your level one, your first primary analysis of the incident, it can also do, you know, complete a couple of the investigatory investigatory steps, uh, if I'm saying that right, uh, that the human analyst would do as well.
SPEAKER_01Got it. Yeah. So it's it's servicing, okay. I've done the preliminary report and then basically delivered it to you all the data that's needed to make a decision about anything just on a silver platter so that you don't need to do any research. You can be really that human a loop to make those critical decisions.
SPEAKER_00Exactly. And just zoning in on that, what a lot of companies want is again, you you really can't hold an AI accountable. So they don't really want to have an AI running, I don't know, for example, turning off somebody's email address or, you know, I guess quarantine their account. That's probably the sort of step that you want a human to just check things and you know, make sure everything is in order before they do it. So it's really flexible enough where on the remediation side, you can set, like you can build the workflows that you want to be automated with AI, but you can also build the ones that need a human in the loop element and some sort of review and approval before that action is taken.
SPEAKER_01That makes sense. Uh it makes a ton of sense. I'm thinking about all the different scams online that have happened and uh thinking about times that people have fully automated it and times that people have uh have not. And so I'm thinking about like people, so like what happens uh to some people, if you don't know this, so I have a TikTok and a marginal amount of followers on there. Um, and so what happens is when you get that, someone will clone your they will make a copy of your actual TikTok. They will take all your videos, they'll upload it, and then what they'll do is they'll intentionally block you so you can't see them and interact with them. And then they'll start messaging all of the people that follow you. Hey, I've got some cash app, I've got some crypto services, I've got some sort of thing. And there's no way for you to see them. And the only way that you see them is that people that follow you will take a screenshot and they will then send you, Hey, is this you? Hey, you're asking for money. Hey, what about hey, I gave you that cash. What happened to that thing? And and I'm and I'm thinking about like there's probably some sort of like AI algorithms that they've been able to kind of detect. Oh, how do I, how do I spin something up and then avoid detection and then block that main user from seeing me, and then it makes it very hard for you to report and visualize that thing. So I think there's when you have these algorithms, there's bad actors figuring out, okay, if these algorithms are by choice setting these things in place. Like for example, the block is an automatic action, right? It's an automation. You hit block, you don't see me. And so I'm thinking about what other systems are in place like that in the where these bad actors learn to learn these automations and then exploit these automations for their own personal gain. I don't know if you've seen that. Yeah.
SPEAKER_00Yeah, I love that example because when you're talking about it, what I'm thinking, well, I guess I'm going straight to the solution a little bit here. Um let's say you're a creator, you know, you you're you know, you've recognized, hey, this is a risk that I have. Obviously, if you're doing this properly, you'd write a playbook outlining, okay, what's the risk? Some examples of when it's happened, maybe some news articles there, pull that whole thing out. But if you want to just go and build something, I'm thinking, get onto API file, some sort of TikTok scraper, type in some search terms, maybe for your username, maybe for some common scam words. And actually, I would pass that into an AI agent and say, hey, turn this into JSON, turn it into a payload that I can pass into this workflow. And that way, something, you know, that's sort of more of a personal, I guess, attack vector, you could still put that through a, I guess, what is an enterprise workflow like this, with a bit of tweaking, I'm sure. But I think I'd love to see some people try this for their own uh personal security because the ingredients are there.
SPEAKER_01I would love to see that. I had I had friends of mine that are other like people that um make content on, like let's say TikTok and other channels, and it would become their obsession to try to track down who this person is, right? And so they would try to like get on calls with them, they would speak in a different language just to see if they would speak back in a different language. And it became a whole thing uh where it became an obsession because people, you know, they're taking your image, your goodwill. And by the way, for anybody listening, this is a I think this is a whole amazing concept. If anybody wants to help social media people that are influencers with a whole like like stop people being parasite accounts that are trying to do this, I think there's a huge opportunity for this because it is it is so frustrating. But like at the end of the day, it's just you feel like you're powerless and you the only thing you can do is just ignore it. Until you find a system like this, you can put something in place of it. So this is actually really I'm thinking about should I sneak the word banana into my my dialogues and like search for like AI with banana popping up to see if people are cloning and scraping it, or if there's other ways to be able to like trigger this in my system. It's just it's really getting me thinking about the possibilities of this system, right?
SPEAKER_00And you know, also for home labers. So I've got a like a very modest home lab setup. I've probably generally I'm okay. I don't expose many things to the internet. I, you know, I use sort of services that that use VPNs and so on, but I I would love to have almost like an enterprise grade SOC running on my home lab without having to pay enterprise grade fees to have that team running it. And I feel like what I'm excited about is something like this. I hope we'll start getting you to that point where even for hobby hobbyists, enthusiasts, whatever you want to call them, they can really improve their security posture by using something like this.
SPEAKER_01Amazing. So comment down below any other ideas or things that you're seeing around this thing. Where other places could you see this? I want uh Varaj, I'd love for you to carry on. This was just a little, like you sparked my interest, and I want took a little detour. I'm like, oh my God, we could do that there. That's great. But please continue. And anybody else, comment down below on any other ideas you have for this.
SPEAKER_00Yeah, I love detours. So, you know, happy that I'm really curious to see what you guys come up with. Anyway, let me finish off this report. So ultimately, what, okay, think of this as a bit of a uh a helper or an augmenter for that cybersecurity analyst. The main bit that's going to come out of this is okay, what is your your immediate next steps list? And these are often, you know, again, some of these things. So you probably don't want to, well, it depends on the company. You don't want to block a domain straight away. You want a human to look at this before it happens. Same with an IP. But then if there's something like, I don't know, quarantining for like a few hours, probably an AI could do this, right? It's not the end of the world in most companies if suddenly somebody can't get into their email for an hour or so, for example. And then these sort of contact workflows, so what I'm seeing in enterprises is they already are using NA10 to actually build out a modular system. So they will have a module that can just send out emails. Or in, you know, if you use Twilio, if you use Slack MS Teams, whatever it is, doesn't really matter in NA10, you know, it's pretty agnostic to that kind of thing. So a lot of these things are then surfaced for media action or in some cases done by done directly by an automation as well. Then you've got some containment. So like stop worst things happening. Uh that's within the first hour or so. And then the bit that I really like, and going back to your point on um data hygiene, you then actually at the end have a bit of a recovery plan and steps for okay, what do you need to do? What should you document after this to be able to catch these sort of issues better? And what should you harden, for example? So I think that's quite a nice way to end on this report for an analyst. So again, a lot of the reporting documentation side of things, I imagine there'll be more skills or sub workflows that enable this to happen without the the the amount of human time that currently is has to be spent doing this sort of thing.
SPEAKER_01That's great. So essentially your replic app here allows you to basically upload a payload of different typical styles of tactics or attacks that are coming through the system. It runs through NADN and then the output is really the report on the back half here. So you're basically getting AI automation uh versus AI automation to then get the output back on what is going on inside the system and then what you can do about it, and then how do you update your playbook so that you can have this ever-learning model? Because I think a lot of whether you call them like Ralph Loops or perpetually learning models, whatever the term of the day is, is you want a self-learning AI system that can get smarter and better over time. And it sounds like this is kind of a bit of that system that if you can run enough of this through, it it detects it, it catalogs it, it organizes it, and then it updates your playbook. Your uh your playbook is that source of truth. It looks at that and then it and then you run through that. So I ideally over time, it'll get more and more secure the more and more that you test the system, the more and more active it is.
SPEAKER_00And you know what? You're reading for my roadmap uh right there. So I think one of the ways I'd love to extend this. Ford recently launched a thing they call dreaming, which essentially is that sort of nightly or you know, weekly, whatever you want to call it, that sort of backwards review, that retrospective on things the AI agent did. I think NA10's valuations feature is actually a really neat fit for this, where at some point, you know, you you're gonna have to sort of score the quality of what this this LLM or this this harness, if you like, what it does. And through that, I'm sure you can feed that back into the corp, the prompts, the way it works, or have an AI modify some of the prompts directly if you're brave enough. That that's totally like uh I think uh an evolution of of this.
SPEAKER_01Is there something like, for example, you know, there is, I think it's called um, we have it, we have like a benchmark testing ability where you can you can rate different LLMs on their ability to do different things, use tools, rate outputs. I mean, I think there's nothing called artificial analysis.com as well, but you can look at it and say, okay, you know, how are these how are these LLMs scoring on these benchmarking tools? So it could be video generation, it could be it says have a tool use or anything else. Um, are there anything where they there they have whether it's workflows or things that can that are able to kind of have these uh I don't say games, but competitions where you can say these are the top performing abilities to detect threats and counteract them? Are the things like that ratings and scorings on that?
SPEAKER_00Yeah, you know, there's a bunch of uh of I guess metrics and and you know, like CTF style tests that models are completing. There's even different levels of like, okay, like how good is a model? Like if it's a level, if it can do a level three thing, then obviously that's really good. Uh often the models with better reasoning can can do the more complex things. But I think with something like this, it's really a lot, a lot of it is down to the harness. The idea, uh, my personal view is the way things are going. And you might start off with this large language model that does a ton of things, you throw some really vague instructions and it kind of figures things out and does a decent job. But the way things are going, especially in enterprise, is people are going to start using smaller models that are far more uh specialized and focused on one task. And the way that that's enabled is that you have a really good harness, that the code around the model itself or the workflow around the model itself is what enables that. So to answer your question, it's a combination of both, right? So it's looking at which models are the best doing the use case you have, versus also how do you improve that the harness, the suit you're putting the model in to allow it to achieve its outcomes.
SPEAKER_01Cool. Yeah, I was just thinking of like, you know, like AI wars competition, right? There's like some sort of like battleground entertainment thing where you can see these guys duking it out back and forth, right? And and you're right, like you can brute force it with an AI and say, hey, I want you to do a thing. And if it's smart enough, it'll it'll do pretty well. But for example, like let's just say writing in your brand voice, just picking a generic one. If you had a workflow and it not only had your current data sets, it had access to your emails, you had vector memory around it, you had a harness or a workflow around it that was actually tailored to you and who you are, you're gonna get way better output than just spinning up some random LLM and then asking it to do some sort of specialized activity. General knowledge, cool. But if you want to have specialized knowledge, the more in-depth you go into it, the better the output's always gonna be. So, like 100% to your point. I'm just wondering if there's like, I'm thinking of like robot battles, like the where they fight each other, but almost like AI, like cybersecurity battle kind of thing.
SPEAKER_00Like you deploy your AI into the arena, you've got other AIs, you know, slight sideway. Like, I would love to see that that competition emerge until then. Uh, I think I mentioned this to you in our in our one of our earlier chats. The TV series Person of Interest, you've got to watch it. If you're if you're into AI, it basically is it was well ahead of its time. It's I think 10 or 15 years old now, but it culminates in these two ultra powerful AIs battling it out and fighting for survival. But it's it's uh a super awesome show. I'd recommend it to anyone.
SPEAKER_01Person of interest is the name of it? That's the one. Okay, all right, all right. We got some homework to do. I love it. Um please go on. Um, is there um should we have more to the workflows we want to show off? I know we got a little side tangent here, but this was fun.
SPEAKER_00Yeah, sure. So maybe two things to touch on. One is just a quick look at okay, what do we need to get to this point? Uh, I've mentioned sort of data, you know, having clean data, having some mitre TTP mappings and so on. But I just want to kind of show it's actually a fairly simple ingestion workflow that gets all your playbooks and your past tickets into uh the Spectre database that's then queried uh in a few of these steps here. I won't go into the detail unless you think it's worth going into it, but ultimately the aim is to launch this with that raw data, so you're with that test data, so you can get going within a couple hours or even less. And then if you think it's it's good, if it works for you, then spend that day or two that it would take to build a POC and run your own data through it.
SPEAKER_01Well, let's let's dive into it a little bit, this ingestion workflow. So imagine I'm some sort of company, uh whether it's mid-market enterprise or whatnot, SMB, and I and I want to have this ingestion workflow. What are what are the steps of this? Like what do how do I ingest this data into here to be able to get everything set up?
SPEAKER_00Yeah, great question. So ultimately, that there's really two, yeah, that there's two bits of raw data. We've got the playbooks, we've got the past incidents. In this case, they're they're nicely kind of you know in JSON format already in GitHub. So it's quite easy to get download those, do a little bit of data cleaning, you know, data prep, and then again with NA10, it's really easy to chunk that data up and put it into a vectorDB. Uh in our documentation, we have a in the repository, there is some commentary on the different things that we tried, what work better, which models work better, what your embeddings models, and what chunking strategies were best. So there is some discussion there on that if you'd like to have a look. In a real company, all you do is you just replace these two nodes with wherever your test incident data and your playbooks live. Now I imagine the hardest thing on your incidents normally are JSON anyway, because most uh most tools will output them as JSON. That shouldn't be too hard. I guess the the one bit that might be required here is if your your playbooks are PDFs or if they're in Markdown or something like that, just you know, wrangling with them a little bit so that they can be be easily passed and vectorized.
SPEAKER_01Got it. Okay, so the the playbooks in terms of being vectorized and all that stuff. Like so, in that second node you have there, uh, does it have to be in a certain format? Like are we talking uh is it JSON format? Is it binary or what what's the data set?
SPEAKER_00Yeah, I mean JSON is best. So we use JSON here because I think it it is what a lot of companies luckily have this, uh, you know, have the have have this content in that format anyway. But if it's I mean, I can't imagine PDFs are really like a key source source of data in this environment, it just makes it a little bit more complicated. But ultimately, PDFs are just a bunch of text. All you have to do is get that text out, chunk it up, and put it in. So it's not, you know, it's not something that's super complicated. When you get to images, again, I don't really, I can't foresee many cases where you're gonna have image data in this. But again, there's multiple ways, you know, either using visual models or having an LLM kind of comment on okay, what exactly is in this chart or in this diagram and vectorizing some of that. But again, I mean I think you could do a whole episode on the different ways of ingesting documents.
SPEAKER_01For sure. And if people want to get like acts to this, like if people say, hey, this is awesome, this is a this is a great workflow, this is a great system, I think that's something I'd love to use. I'd love to how do they do that?
SPEAKER_00Yeah, well, so I think this will all be on GitHub by the time the podcast is published. Um so there'll be a link probably underneath this video where you can click and get all this stuff. It's it should all be free. As a little bonus, I'm also gonna make this, you know, I'm gonna put this little uh HTML uh snippet in there as well. You can run this yourself, just plug in your own AI models into it. And a really cool thing you could do is, and that I was doing before, is if I just go into, I mean, your favorite uh AI tool, let's create a new chat. I'm just gonna put anthropic in here. And you can ask it a question, for example, I'm just gonna be super vague, but generate a typical incident that you might see more of with Claude Mythos and output a ticket in this format. So the real you know, the cool thing here that I want people to start doing is don't just use my test data, actually try and you know use your real data if you have it, or like create synthetic data of real-world attacks you might get and put that through the system to see how it works.
SPEAKER_01Yeah, and to that point, I mean, also can you let people know just uh you know a bit of what you did at NAN and because you you you now have kind of gone on your own and you do things now and in terms of the forward deployed engineering. Can you talk about kind of how this all lines up with what you do?
SPEAKER_00Yeah, sure. Uh so a bit of background. In my previous life, I was a company founder. Uh, I found an A10, not doesn't just stumble upon it. Uh, I love the tool. And I actually joined when the company was about 20-ish people in size. I only left last year. Had a really cool um, I guess, timer NA10 going from like the there was no kind of commercial person through to now the company getting to the size that it is. A lot of my role for the past couple of years was when a company buys NA10, often an enterprise company uh that's spending you know a lot of money on the on the licensing. How do you make sure they get the most out of it? So, how are they implementing NA10? How are they trading their staff? Do they even down to are they configuring the governance and compliance policies of NA10 properly? There really is a lot of nuance in how to roll out a complex tool like NA10 successfully. And I really enjoyed that part of it. And at the same time, there is this, I mean, I guess you could argue it's been in the whole forward deployed engineer curve has been around for a decade or so now, uh, with Palantir, but there's this whole emergence of a bunch of people that are technical, yes, but who are also able to handle business problems and you know go into a company, understand what the human issues are that prevent tech from being deployed, work on those, try and push the boundaries, and then with that kind of widened constraint set, deploy a solution that's going to work for the customer straight away. So that's what my new company is doing. Uh, we're a small but growing team at the moment, uh, that is everything from obviously you know small automation projects all the way through to that forward deployed engineer style engagement where you're really in the trenches with the customer team, spending a lot of time doing discovery and then working with that actual team to co-deliver a solution for the for the company itself.
SPEAKER_01Yeah, and that's great. And it's uh and it's growing a lot. Uh even since I've been I've been here for the last year, and so we're kind of uh ships passing in the night. The thing is with AI intelligence getting so much better and its ability to code and write and build automations and workflows, a lot of it, what it comes down to, and I I heard this from the the uh CEO of NVIDIA, it comes down to what is the person's ability to be intuitive with these systems? And this is kind of a weird, vague term, and even he was he was commenting on it, but it's like can you sense what the problem is? Can you identify what these human issues are? Can you can you develop systems around it? Because as as we know, like AI at the end of the day, if you do not have the the people that are the most successful with it, are they they're already going to be successful individuals, right? They have strong worth, they they they they're they're honest, they have integrity, they're authentic, they're they're diligent, they're caring, they're of service, like all those core things that people need, right? You slap AI on top of that, it becomes a it becomes a powerhouse, right? But if you have, if you're if you're messy, if you're lazy, if you're what name all the bad things, then you can't go in there and solve it. So when you have somebody come in that understands the human issues, understands the business problems, understands the data hygiene problems, understands what's going to make a business work, I think it has a tremendous impact because at the end of the day, these LMs are getting so smart that they can do it, they can do anything. But the question is, what do they focus on? What problems do they solve? What systems do you put in place first? How do you organize your data sets? What should you be focusing on? And so uh that's why I think something that someone like you has a skill set of being able to come in as a founder, as someone part of a crazy growing company, and as someone who's deep in the trenches, it's a really unique blend that I think is has a ton of value besides someone that just has incredible technical knowledge. You it's that rounded perspective that can actually have a tremendous impact on a business. So I just wanted to like tap on that a little bit about what I think you're doing and the impact that you're having with it.
SPEAKER_00Yeah, I mean, I mean, spot on that's exactly how I see things as well. Ultimately, you know, you can have a Ferrari or a Lamborghini, but if you know can't take it to a track, if you can't take it on the autobahn, you're not really gonna enjoy like the the fullest ex to the fullest extent the benefits of making an investment like that. And that's pretty much what I liken, I guess, an FTE too is you can sort of go in there and say, cool, you've bought this amazing car, but can you drive it properly? And you're not only sort of driving it for them, but you're sort of teaching them as you're doing it, and hopefully like leaving them better off and leaving them in a position where they can now take that car to the track and they can drive it on the twistiest of mountain roads, and and they know how to control that machine to the nth degree, right? They are like pros by the time you leave them.
SPEAKER_01Yeah, for sure. Yeah, I just picture someone taking the the Ferrari and driving it into the into the lake and going, This thing doesn't go on water.
SPEAKER_00You're like, you're right. Yeah, I did find this today, man. Honestly, it's not a bad analogy for some of the ones that I've seen.
SPEAKER_01Yeah, this is great. Uh okay, so um, is there, I mean, is there anything else you'd like to let people know about? So this is gonna be available. We're talking about these vectors of attack. Are there any like things that you think people should be aware of, especially in the world of like cybersecurity, uh, things that should be uh put on people's ideas or any crazy examples that have come out to you lately that uh people you know should know about?
SPEAKER_00Yeah, honestly, I think there's just so much. This base is moving so quickly. Uh, there's probably like a gazillion things I I could point to. Just follow what interests you. You know, just just take like a strand that you're genuinely interested in, uh, and I'm sure there'll be an AI element to it and follow it through. For example, for me, that's been a lot of my focus has been on local models, models that you know you they run on your computer, on your infrastructure. So a lot of the stuff that I'm looking at, and a lot of companies now are moving this way as well. They don't want to just be sending all this data through to a cloud, especially if it's got critical, you know, IOCs, vulnerability data. If that gets into the wrong hands, you can, you know, you're really asking for trouble. I guess from a personal perspective, for me, it's been those local models and saying, what can I do on my like 2,000 euro computer? What can I get it to do? And you'll be surprised at the level of output and quality you can get doing tasks on a machine like that. So that's that's sort of my my personal advice. But if you generalize it, just find something, find a use case, an application, something about AI that interests you. And there's so much there, whether you're technical or not technical, to latch onto and to follow.
SPEAKER_01Yeah, yeah. Local model, I mean, especially because NIDN can be on the edge or locally done if you if you can get a local model to work. I will say out the gate, they are a little, they're they're not gonna be good as Opus 4.7. I'm just gonna tell you this right now. It's not there. It's not gonna be the thing. But you can train it up, and there are trade-offs, and there's and there's ways to to to make them more powerful, but which I'm sure could be a whole podcast in and of itself on that topic of like how do you how do you train up a local LLM to actually be competent at specific tasks? But uh maybe we'll save that for another point. I'm a big home automation, home lab person as well. I've got a lot of bells and whistles going on here as as well. Um so maybe we'll do another pod on that. So then if people want to find you, if people want to get a hold of you, how do they do that? Sure. I mean, the the easiest thing is the website, forward.deployed.engineer.
SPEAKER_00Uh, I think hard to forget in the context of our conversation. Otherwise, I'm most active on LinkedIn. Uh so if you search for Viraj Malica or just Viraj NA ten, it's a bit easier. Uh you'll probably find me and and I'd love to connect and and continue uh some interesting conversations over there.
SPEAKER_01Amazing. Viraj, it's been an honor and pleasure, my friend. Much love, and I will see you on the other side.
SPEAKER_00Thanks so much, Delon. I'll really enjoyed it.
SPEAKER_01Speak to you soon, bye now.
.jpg)