AI Spera’s Criminal IP harnesses cutting-edge AI and cyber threat intelligence to deliver unparalleled visibility into your attack surface, empowering businesses to stay ahead of evolving cyber threats. From IP-based fraud detection to automated asset protection, our data-driven solutions safeguard organizations worldwide with precision and ease.
To request a demo of Criminal IP ASM, click here.
In this episode of the SourceForge Podcast, we speak with Ahmed Mobasher, Global Business Manager at AI Spera, a cybersecurity company that originated from Korea University’s Hacking Response Research Lab. We discuss the evolution of cyber threats, the unique challenges organizations face today, and how Criminal IP leverages AI technology to provide proactive cybersecurity solutions. Ahmed shares insights on the importance of context in threat detection, common use cases for their products, and the future of cybersecurity in an AI-driven world.
Watch the podcast here:
Listen to audio only here:
Learn more about Criminal IP.
Interested in appearing on the SourceForge Podcast? Contact us here.
Show Notes
Takeaways
- AI Spera originated from a research lab focused on hacker behavior.
- Modern cyber threats have evolved from simple viruses to sophisticated ransomware attacks.
- Organizations face challenges in monitoring their expanding cloud infrastructures.
- AI technology is crucial for both hackers and cybersecurity solutions.
- Proactive measures are essential to prevent cyber attacks before they occur.
- Contextual understanding of threats is vital for effective cybersecurity.
- AI Spera’s attack surface management tool automates vulnerability detection.
- Companies often overlook vulnerabilities in their expanding infrastructures.
- Continuous monitoring and patching are necessary to maintain security.
- The future of cybersecurity will heavily rely on AI advancements.
Chapters
00:00 – Introduction to AI Spera and Cybersecurity Landscape
01:27 – Founding Story of AI Spera
03:29 – Challenges in Modern Cyber Threats
07:12 – Leveraging AI for Cyber Threat Detection
09:29 – Proactive vs. Reactive Cybersecurity Measures
12:52 – Differentiating AI Spera in Cybersecurity
14:41 – Common Use Cases and Success Stories
17:35 – Release Cadence and New Features
20:16 – Future Trends in Cybersecurity
23:13 – Final Thoughts and Call to Action
Transcript
Beau Hamilton (00:05)
Hello everyone and welcome to the SourceForge Podcast. Thank you for joining us today. I’m your host, Beau Hamilton, Senior Editor and Multimedia Producer here at SourceForge, the world’s most visited software comparison site where B2B software buyers compare and find business software solutions.
On today’s episode, we’re joined by Ahmed Mobasher, Global Business Manager at AI Spera, a leading cybersecurity company founded out of Korea University’s hacking and countermeasure research lab. AI Spera is known for Criminal IP, a powerful cyber threat intelligence platform that gives users attacker perspective visibility into internet connected assets. In other words, the platform helps security teams to see what hackers might see when they scan the internet for weak spots. It lets users check websites, IP addresses, and online systems in real time to spot potential threats before bad actors can take advantage of them.
So with Ahmed at the helm of global expansion, AI Spera is becoming a key player in helping companies stay ahead of cyber attacks. So we’re excited to have him here. Ahmed, welcome to the podcast. Glad you can join us.
Ahmed Mobasher (01:04)
Hello, Beau. Thank you so much for having me on the podcast. It’s a pleasure to be talking to you.
Beau Hamilton (01:09)
Of course. Now I just want to get started, jump right into it and talk about how your company was started because I think it’s pretty neat. It’s a pretty neat story. Can you share kind of what led to the creation of AI Sparrow at the Hacking Response Research Center? And maybe you can just describe what that is in the first place. What is the Hacking Response Research Center?
Ahmed Mobasher (01:30)
Yeah, of course, both our co-founders at the time were professors at the Hacking Response Lab, professors at Goodyear University at the Hacking Response Lab. And at the Hacking Response Lab, the idea was to monitor the activity of hackers to see how they are behaving, what kind of anomalies they leave behind when they are working on a certain infrastructure or trying to access a certain network.
So the way they were monitoring that, it was pretty hands on. They also were testing a lot with AI technologies, hence where we started with the idea of our product. So out of that, out of that AI capabilities that were being tested, out of the idea of wanting to not only monitor, but also to show people how hackers are behaving, to give them context into this malicious activity, came the idea of our product, Criminal IP, which shows basically users and security professionals everything that they need to know on any internet connected device to show them what hackers might be doing, which hackers behind that device or that activity that they have detected on their network or devices.
Beau Hamilton (02:43)
Very cool. Okay, yeah, I like how you were founded out of that sort of real world testing scenario. I think that just naturally that kind of gives you a really good foundation of things to tackle. So let’s talk about some of those challenges. You’re obviously born under this research organization and obviously there’s a wide range of cyber threats in today’s world. And there are also some that are more, I would say pervasive than others.
10 or 20 years ago, I would say some of the biggest threats out there were viruses and botnets that were used for spam or DDoS attacks. Now it feels like it’s shifted more to ransomware and supply chain attacks. What unique challenges do organizations face in managing all those different modern cyber threats they face and what are you doing to address them?
Ahmed Mobasher (03:31)
Well, you hit the nail exactly with that. Now we are moving to more sophisticated attacks. Back in the day, it was just a hacker finding a vulnerability, trying to access the company’s infrastructure, trying to get on the network. But now it’s much more sophisticated than that. And that’s due to the challenges that security teams face. First of all, we are growing massively. Each company wants to be as big as they can, and then turn leads to them expanding their infrastructure on the cloud. So we are talking about so many servers that are not now, are not anymore hosted within the company. It is all in the cloud. So the challenge is how do we monitor all of this? We have so much infrastructure outside of our base basically.
And the other challenges with the advancement of technology and the advancement of AI, not only hackers are getting better at hacking and ransomware attacks. But also, the more we have advancement at our infrastructure, basically, and what we are using, the more things we have to monitor. Basically, our attack surface now is much bigger. It is hard to notice everything. So we need something to help us with that detection.
And this is where we step in. First of all, with our attack service management product. It is built on all the threat intel and the threat context that we have gathered on our expertise with detecting hackers behavior. And with that product, we are able to tell security teams automatically, just there is a crack in your wall basically, there is the, when you’re at tech surface, there’s something that could lead to a hacker coming to you. And this is where ransomware starts. It is basically someone who’s trying to access your company, trying to find the point where they can actually enter into your organization’s infrastructure. And from there, they would install a malware that would lead to their ransomware.
So to prevent all of that from the beginning, we either monitor their attack surface and tell them about it. Or since they have such a big workflow now, there are so many things to monitor. And that leads to many logs, many data that’s flying their way. They can use our threat intel API in that or just our Criminal IP website and just making sure they understand everything that they see. Is this malicious? Is this normal? Is this device? Is there a hacker behind it or anything like that?
Beau Hamilton (06:04)
Yeah, I feel like you have your work cut out for you. I mean, there’s just so many different moving pieces. And you mentioned like the remote, the fact that things are kind of being utilized remotely more than ever. The data centers that are located who knows where, there’s these different vectors of ways cyber security or cyber criminals can tap into it and deal some harm.
One thing that really mentioned that stood out to me, you mentioned how cyber criminals are maybe utilizing AI for their own personal gain. As we, I know as we kind of journey deeper into the AI era, cyber threats driven by AI are only expected to increase. But I also feel like AI holds the key to solving many of these threats, right? One of the, I know one of the methods that you guys use is called anomaly detection or outlier detection for the IT pros listening in. And that basically involves identifying data points or behaviors that significantly deviate from the norm and could signal malicious activity.
So I’m just curious, like how are you leveraging both this form of detection, anomaly detection, as well as AI-based solutions to ultimately detect and mitigate cyber threats?
Ahmed Mobasher (07:14)
Well, that’s a great question. And actually you are completely right. The more we advance in AI, the more it means that there are malicious actors that will use that advancement into their own malicious behavior. We have already been seeing that in social engineering and just, you know, people, normal people getting voice phishing attacks and stuff like that. But now it’s advancing even more to include all possible attack points that the hackers can use the AI in. It’s no longer someone just sitting on a computer trying to access your network, it’s now an AI agent doing that for them. They automate everything from the background.
So for us, we utilize the same technology since we already understand the behavior of these attackers. And we already can monitor the behavior of these attackers. Obviously, we have our own scanning methods. We have something called Honeypots. I’m sure you heard of it, which is basically a weak server that a hacker would try to access, but it’s actually our server and we are monitoring their behavior. So over time, we aggregate all of this data and we build our AI around it to make it understand that when you see something like this, this is actually an attacker.
It is again, the hacker’s perspective that our team has out of that Korea University lab until now, our team has been always keeping up with their methods, their behavior. And all of that is being fed to our algorithm to be able to detect right away once we see something. Even though it might not seem malicious, might seem something just normal, but we are able to know based on the historical behavior and based on what is happening now and what changed on that device, that IP address, that website or domain, for example, we are able to know if there is a hacker behind it or not.
Beau Hamilton (08:59)
Interesting. So how do you, I mean, just like maybe we can take a step back and just talk about how some of the techniques you’re using now differ from the techniques used in the past like, you know, obviously, you know, some of the threat detection methods you provide are, you know, more proactive. You have a more proactive solution and a more effective solution than some of the traditional measures that have been used for the past couple of decades. But can you talk about some of the, you know, maybe what was used in the past and what, what’s currently used now? Are they similar? Are they different?
Ahmed Mobasher (09:31)
Of course, of course. What has been used in the past was usually focused on detecting something that has been already happening or that happened already, which doesn’t work anymore because like you said, the attacks are so sophisticated that if you allow someone to reach you, it’s already done. The ransomware has been deployed, for example, or malware has been deployed and you’re now under ransomware.
So the idea for us was to detect something even before it happens. And that, again, that goes back to that context that we can offer, that AI detection that we have happening in the background. We can show teams, even though something didn’t reach you yet, like for example, with our attack service management tool, they can see something that, oh this doesn’t look okay, or I have a vulnerability that might lead to the attack. So that’s the proactive approach, always being ready, always making sure that there is nothing that an attacker can use against you, plus like, for example, when it comes to when we scan a website or URL or a domain, our scanning is pretty active at this real time.
So with our AI capability, we’re able to scan that domain or that website and know if it’s malicious, if the user of that domain, someone built it for a phishing purposes, for example, which is the main way now that ransomware attacks are happening. So we take that proactive approach and to being the first line of defense for security, being the first ones to see things and tell them, like, this doesn’t look OK. And that way, because the traditional method just there was no first line of defense. It was right away the security practitioner in front of the attacker. He has to monitor everything manually. He has to keep looking at all the logs that he sees detecting something like that. And that leads to so many alerts, so many time being wasted at false positives, for example. So this is where we try to help.
Beau Hamilton (11:29)
Yeah, I really do like how you’re a data-driven security company at the heart. And obviously that shines through the methods you talked about, like anomaly detection and how you’re kind of looking for outliers and data points that could be problematic. I know my mind just goes to some of my schooling in the past where I’ve got a data analytics degree. And so I just picture like an Excel spreadsheet that we’ve had to kind of comb through and just look for, you know, of potential problematic formulas or different outliers just in general that could cause some concern and ultimately ruin the overall data that you’re trying to extract.
But as a data-driven security company, how does AI Spera differentiate itself again from other cyber threat intelligence providers, specifically in regard to that data that’s so crucial and that you’re looking at?
Ahmed Mobasher (12:24)
Well, that’s the million dollar question, as you say, of course. And the security field, people tend to think of cybersecurity as a niche market. But within that niche market, every product kind of serves a niche use case. So there might be out there a lot of products that serve different use cases. But for us, it’s always we say it context, context, context.
We don’t want to tell someone that, oh this IP is malicious and that’s it. Some other tools might be doing that, but for us context is more important. I want to let you understand for yourself why this is malicious. If in our attack surface management tool, for example, you see something that seems vulnerable, here our threat intel feed or data comes in hand where we tell you like, this is vulnerable because so-and-so. And we are able to expand on that. are able to give advice based on that.
So for us, is, yes, the data at the back, feeding everything that we show our users and making them understand that with context and with enrichment, actual enrichment, this is just malicious. This is safe. You need to look more at this, even though it might be safer now. Again, to be proactive, you need to really have an understanding of everything that is going on.
Beau Hamilton (13:49)
Yeah, that’s so true. I mean, context is everything. If you’re, I don’t know, trying to test ransomware or brute force attacks at a white hat conference or something, knowing that it’s at that conference is one thing. If you’re just reading about it in an article or something and you don’t have the full context of the security conference you’re at, it could be misinterpreted as something way more nefarious. I don’t know, I just think of the different quotes and everything really has to come down to context.
I’m a visual, so I’m a visual guy. I love a good illustration to help prove a point. And I’m just, I’ve been thinking like, do you have any common use cases for AI Spera solutions and maybe a success story that you could help kind of share where you helps a customer mitigate a threat with your product?
Ahmed Mobasher (14:40)
Oh definitely. I would say the most common one that we see, especially with our attack surface management tool. Like I said, the idea of the tool is to automate your attack surface detection. And an attack surface, when we say attack surface, it means basically all our buildings, doors, and windows, the cracks and the windows that a hacker might be able to use to enter into our building.
So when we monitor that attack service management, we are not only looking for vulnerabilities, we are trying to show you stuff that you didn’t know existed. It is something to monitor every door I have in my house, but it’s something else to forget that I have a back door that is unlocked that someone can enter from. So this is the most common thing that we see most of our customers. Once they deploy the attack service management tool, they realize that they had so many servers because when we scale, we forget what we are buying, and sometimes now most of the cloud providers they allow you to automatically scale up. So you, that scaling up as servers that are being added, that could be vulnerable later on if you don’t monitor, if you don’t patch, if you don’t make sure everything is OK. And for that, you’re forgetting about these servers. You’re leaving them vulnerable. A hacker will be able to find them and will be able to access your organization through them, even though it might have not been that important for you.
So that’s why we try to tell companies always and customers, if you want to be proactive, you have to really know everything as much as you can. And we try to automate that process of knowing everything. Another one would be as simple as certificates expiring, for example, for websites. And that goes the the whole service we’re offering our customers to go down. So just simple automation. We’ll show you that through our tech service management tool. It will show you that you’re actually leaving something behind, there’s a certificate that’s not renewed, of course, on top of that all the risks and threats that they can.
Beau Hamilton (16:42)
Yeah, certificates are important. And then, yeah, messaging is a huge, huge thing. And it’s always important, like when I cover news for Slashdot and curate content there, it’s like a lot of the ransomware attacks that affect a particular agency or some of the security vulnerabilities we cover. It’s like at the end of the story, I always like to include like the recent patches and notes about, you know, patches that are coming out so that people can update because that’s an important way to protect yourself, right?
I know you yourself, your company is probably issuing patches and releasing new tools to help mitigate some of these evolving threats. What does your release cadence look like?
Ahmed Mobasher (17:25)
For us, when we are talking about patches for the clients that are using our tools and monitoring their infrastructure, in that way, we have always an insight into the kind of applications that are in use. Of course, we are able to monitor what applications, what servers, what kind of patches, even versions they are running on their system. And through, even through our threat intel, they are able to know if that server is running a certain, like old version of an application, if their website or domain has been built with an unpatched version, for example, the JSON they are using, is a vulnerability in it, something like that. It could be anything within that context.
But through, again, automation and being proactive, we are able to show them. You have to patch this vulnerability that you have within the application that you have. It could be something really simple that they have forgotten about, but that small, simple thing, especially now with the hackers automating their attacks could lead to unfortunate disasters.
Beau Hamilton (18:31)
And do you have any exciting features coming down the pipeline that customers can look forward to or any new tools that you have in the works that maybe just released or coming out pretty soon?
Ahmed Mobasher (18:42)
Of course, we are going to focus more on showing much more data on the dark web activity and the threat actors in general. So we already have like monitoring capability of threat actors and their behavior, their IOCs, what kind of, for example, command and control servers we have on a certain country and who’s using those servers. We’re going to add much more context into that more monitoring of their tactics, for example, their TTPs, and as well as incorporating AI and generative artificial intelligence more into our product.
Not only it’s not going to be static context that we offer, it’s going to be more engaging with the user when they are looking at something they will be able to understand more. They can request something that will help them learn more about what risks are they looking at. So there are more fun things to come. I hope people look forward to.
Beau Hamilton (19:42)
Yeah, a lot of exciting things coming. I have a feeling that you’re gonna mention AI as one of those things. And I also have a feeling that it’s gonna be the answer to the next question. And that is, what new trend do you believe will have the biggest impact on your industry over the next five years? I know that’s a long ways to look ahead with how fast things are changing, but what do you see will have the biggest impact?
Ahmed Mobasher (20:05)
It would be definitely the AI automation. So like we touched on that point earlier, a hacker no longer has to do anything manually. They can develop an AI agent that will do everything for them. All the scanning, all the monitoring, all the even penetration that they can try to do to a server can be done through an AI tool. So that will have the biggest effect. And now all security companies, even all security professionals, they have to catch up with this capability.
We have to incorporate AI as well. We have to be as proactive as the hackers are trying to be. and we have to be able to catch things before they happen much faster than we are doing right now. This is why again, not to push our company more, but this is where we come in. The context is really important in that regard, because even if I have an AI agent looking at everything that’s happening on my network or my infrastructure without the right context that AI agent will not understand what it’s looking at. So again, through our behavior analysis, through the data that we have, we can help.
Beau Hamilton (21:13)
Yeah, I think it’s, I think that’s, that’s a lot of things to consider. And I think that, yeah, your, platform is definitely going to help, you know, set clients up for success. I’ve just been thinking of all the different, like AI deep fakes and automated phishing attacks that, I mean, are just are coming. You have to really fight fire with fire in terms of AI and people using it for nefarious purposes and people using it to, you know, for the greater good, right?
What, so maybe you can recap some of the things you mentioned earlier, but what role will AI Sparrow play in just shaping this future of cyber threat intelligence?
Ahmed Mobasher (21:49)
We definitely hope to be at the center of all the expansions that are happening in the security products. We already offer a lot of integrations with many technology partners. They have amazing technology and we try to help as much as we can with providing that context. So someone that is using a different product will be able to see Criminal IP’s data and integration within that product.
More collaborations around that will allow us to help more, will allow us to be at the center of everything because the rich data that we have, it has to be used in this regard. It has to be provided to customers, to security teams, wherever they are and whatever they are using. So yeah, with enhancing our AI capabilities, even we try to be at the forefront of everything, just providing this rich data and rich context to other security providers, to security reasons.
Beau Hamilton (22:46)
Now, if there was one big message you’d like to tell potential customers, many of whom might be listening right now, what would that one big message of yours be? What would that one big takeaway be?
Ahmed Mobasher (22:58)
Definitely that if we think we are not vulnerable right now, it doesn’t mean that everything is okay. Just because things seem pretty safe, we still might be vulnerable. We still need to be proactive, as you mentioned earlier. We need to look more deeply into everything that is happening in our network and our infrastructure. Even what our employees are doing, how they are behaving. And other than that, just listen to your security teams. These people know what they are doing. We tend to only focus on cybersecurity after the issues happen. But I feel like there is now a bigger shift in the world toward more focusing on security, even if everything seems okay. So I hope that companies start doing that more proactively and I hope they again listen to their security teams.
Beau Hamilton (23:50)
I love that. Yeah. No, it’s true. Listen to your security teams. They’re the professionals. They know, they know what, how to keep you safe. and just, yeah, stay vigilant, stay proactive, make sure to don’t be lazy with passwords. Don’t give into, to ransom demands, etcetera, etcetera. I feel like we’ve all kind of heard the, heard the speech. We’ve all taken the cybersecurity courses for, for our companies, but it’s, true. It’s you really got to stay, stay vigilant.
Yeah. So how can companies interested in AI Spera solutions get started or get in contact with your team?
Ahmed Mobasher (24:25)
Of course, they can register through our website for free. They can try the tool for free. Even we have a free tier for that. They’d like to try the attack service management tool or something. For example, our enterprise API, they can contact us. We’ll connect with them. We can show them a demo. We can offer them even a free demo of the tools. So please feel free to reach out to us through our website. And we’ll be happy to be there for you.
Beau Hamilton (24:51)
Awesome. Well, hey, thank you for taking the time out of your morning to sit down and talk with us about your company. I know you’re calling in from Seoul, South Korea. It’s early for you. I appreciate it.
Ahmed Mobasher (25:01)
Thank you, thank you, Beau. No, it’s been a pleasure to talk to you, And thank you so much for having me.
Beau Hamilton (25:06)
course. That’s Ahmed Mobasher, Global Business Manager at AI Spera. Thanks again. I really appreciate it. And thank you all for listening to the SourceForge Podcast. I’m your host, Beau Hamilton. Make sure to subscribe to stay up to date with all for upcoming B2B software related podcasts. I will talk to you in the next one.