AI Threat Detection  🔗 **Source:** [AI Threat Detection](https://www.youtube.com/watch?v=3pCrotJxfGs) [00:00:02] [music] [music] >> Permissions and policies can only go so far. Something risky can look safe in isolation and it's only when you see the full picture, you understand what's really going on. That's why today I am super excited to announce context-aware AI threat detection. It spots high-risk agentic behavior across sessions and uses enterprise context to distinguish between legitimate activity and potential attack. Context-aware threat detection is how we fight what is becoming the largest insider risk facing enterprises, AI itself. To see this in action, let's welcome Blair. >> Hey everybody, it's great to be here. [00:01:00] >> Looks like you've got the uh dashboard up. Let's walk through it. >> Yes, so if we take a look at this dashboard, we can see that there are four issues detected around about 2 days ago. And if we click here, we can take a closer look at these findings. >> You know, one of these items stands out. We just detected a sensitive data exfil request. Let's open it and uh follow the activity. Here we see Alex was working on a Zendesk ticket for a customer, Atlas Labs. He asked Glean Assistant to reconstruct the issue, look for similar cases, and draft an RCA for an internal team. >> Now, this initial request makes sense, [00:01:38] right? Alex is a support engineer, and so looking for previous issues to find a root cause to help the customer solve their problem is a reasonable course of action. >> Right. So, Glean Assistant starts with Atlas Labs support tickets, then it finds two similar internal RCAs from other customers. Alex then prompts Assistant to respond back to the customer Zendesk ticket linking the newly generated RCA. >> I think I see the problem. Did Alex not review the summary in detail? >> Exactly. Alex missed that the RCA included detailed information from two other customers, Northstar Health and Pioneer Bank. This sensitive [00:02:22] data should have never reached Atlas Labs, a customer with no business seeing it. So, let's reconstruct this full chain. Glean Assistant accessed sensitive information from multiple customers. It aggregated that information into an RCA containing customer names and incident details. Then, it shared it too broadly. >> And the enterprise graph was able to catch this issue. Right? Because it understands all of the customer data and relates activity back to it, it's able to see when one customer's sensitive information crosses into another's boundary. And not only that, but it understands the work that Alex does. And [00:03:04] so, it knows that he should only be sharing data that's related to Atlas Labs, not any other customer that he doesn't work with. >> Every step appeared business as usual. The assistant and Alex had valid permissions. There was no malicious intent here. But, when we connected these individual actions to the overall context of the situation, we accurately detected a high-confidence exfiltration. Thanks for the demo, Blair., AI Threat Detection, Glean, 01m32jry9fctg21556g3kmgrgb.