Chronicle, Alphabet’s cybersecurity defense company moonshot

The kinds of problems I encountered require you have an org where you can lose a top shelf researcher/architect for 4-5 months while they train up on new tools and then use them to run down rabbit holes. This requires both vision and direction, and a moonshot culture to support it.

Chronicle's focus on their customers' problem in the article is sound, the next step is that each customer, or class of customer is going to be defined by their own specific ROC curve, relative to their business. Some just want raw data, others the world ends over a missed alert (false negative), still others have costs associated with false positives.

When you are doing a deterministic rules based system, it's straight forward, but when you get into dynamic and scoring based systems like ML, the responses to it are going to be polarized between customers, and you need top a level vision to tie the whole product narrative together. It's not a thing you stand up that everyone uses, and few people want to buy a framework with a bunch of gigo based trade-offs.

Something I discovered in my own work was that the threat model is the business model, both for products and surprisingly for customers as well. I'm really interested in what Chronicle comes up with, as these are truly Hard problems.

It's expensive. Very expensive. Not just in terms of money, but also time: the countless hours spent maintaining it, upgrading it, expanding it, securing it, and actually using it.

And then, of course, there's the cost of actually knowing what's going on within your infrastructure. It's stressful: attacks are happening constantly. Most of them aren't worth investigating; the firewalls do their job and the attacks fail. But which ones are worth worrying about? Which bugs are actually worth patching? Is it really an issue if a small part of our site goes down for a few minutes--especially when it might cost us 80 hours of work to patch?

I doubt these problems can be solved by collecting and analyzing more data. Lack of data isn't a problem--there are already plenty of systems for collecting, analyzing, and storing data. The trouble is using that data in a cost-effective manner. Similarly, I have zero faith in anyone's ability to solve these problems by simply throwing more computing power at them, for much the same reason.

I really hope that's not what they're planning to do, but this is Google we're talking about, so I'm not holding my breath.

Edit: Clarification, wording

A clever approach, but I wonder how noisy it will be at the start.