Mayank Agarwal on Securing AI and Scaling Cyber Defense

Jeff Kavanaugh:

I'm Jeff Kavanagh with Infosys Knowledge Institute. We're here at the Infosys Connect Conference in Los Angeles, and very happy to be joined today by Mayank Agarwal, who's the Head of Cybersecurity, Americas at Infosys. Mayank, good to see you.

Mayank Agarwal:

Hey, Jeff. So nice to meet you.

Jeff Kavanaugh:

You bet. We're talking about unlocking value from AI, and I can't think of a more important, and sometimes misunderstood area, cybersecurity. So let's just jump into it. What is it that you're seeing now, trend-wise, with cybersecurity and AI?

Mayank Agarwal:

It's a pretty interesting topic. First of all, you talked about cybersecurity being a little bit of a misunderstood topic. Thanks for saying that.

Mayank Agarwal:

A lot of times, people talk about cybersecurity as a function that wants to put a lot of guardrails that slows down innovation. In fact, the way I look at it is, cybersecurity is truly important in a client environment because these guardrails help you to go faster. It's like, I was talking to one of the race drivers, and what he said is, "Typically in a race car, what do you think is the most important thing that helps me go faster?" And I was guessing for some time, and then he said, to my surprise, "It's the brakes." I was amazed because he said, "Yes, it's the aerodynamic body, the engine, all of those are good. But finally, knowing that I can truly rely on my braking system because I have the right guardrail, that truly helps me." Coming back to your question on AI and cybersecurity, that whole intersection, we see two interplays in that. First, truly protecting AI because when you truly look at AI, how do you make sure that you work with the models, the data is protected, the agent identity is taken care of, all the output that's coming in, that's right, it's acceptable, it's following the laws of the land, and so on and so forth? So that's one area, which is all protecting and guarding the AI. Second piece is all about leveraging AI to truly amplify the work that we are doing in cybersecurity. So finding the needle in the haystack faster, finding the bad actors in your environment faster, and truly acting it at scale. So those are the two things. One is protecting AI, and second is leveraging AI to make sure we are truly amplifying the work of the cybersecurity team.

Jeff Kavanaugh:

Can you share an example, a recent one from one of the clients you've worked with, where you really hit that home run? It really was able to overcome something and build that trust.

Mayank Agarwal:

So two things what we did recently with a customer. One, we built an agent that does a lot of work which is needed in risk management compliance from a cybersecurity perspective. And lot of times, that whole activity used to be a big, tedious activity, reaching out to multiple sets of individuals, looking at different sets of submission reports and stuff. So we've been able to create a GRC agent that truly is,

Jeff Kavanaugh:

Global risk and compliance.

Mayank Agarwal:

Yeah, global risk and compliance agent, and that is something that has been able to automate a lot of that work. We've been able to cut down the time it used to take to prepare for a cyber audit for a certain function from more than a four, four and a half months, to less than a month time frame. So that has been significant. Second piece, what we have done when it comes to leveraging AI in cyber, there is this whole area called SOC, security operations center. And the whole job out there is to find out patterns and activities where you try to see if there is an attacker who's trying to, or an adversary who's trying to get into your environment, take all the good data. So that's where earlier it used to take, in a complex environment, it used to take between 12 hours to almost two to three days to solve a very complex kind of case. Today, what we've been able to do is amplify the work that our agents are doing, and we've been able to cross-correlate a lot of information, give them the information, and that has truly helped them to cut down this analysis from 12 hours to two to three days to almost less than two hours. So a lot of powerful use cases in cybersecurity around AI.

Jeff Kavanaugh:

What I'm hearing as well is it's not just what you have to do is being reduced. Many things you couldn't have time to do before, you can now do more of. Other words, you can have more coverage, the nice-to-haves, you can actually do more of that, even beyond the compliance, just for protection.

Mayank Agarwal:

Oh, absolutely.

Jeff Kavanaugh:

And you build it in by design.

Mayank Agarwal:

Yes, it's built in. In fact, earlier, we were running SOC for this large chip manufacturing company. And what used to happen earlier was, there are significant number of alerts which were there that we will assign to a user group. And they were taking their own time in trying to solve those and stuff. Now, with the advent of AI, what we've been able to do is truly solve those things in a much efficient way, and then only escalate to those user groups, which are the manufacturing plants which they have across the globe. Only a handful of them that truly needs their things. So what we've been able to do is cut down the work of the manufacturing team out there and effectively improve the cybersecurity in the region. So it has worked out very well.

Jeff Kavanaugh:

We hear a lot about trust, and trust is often with loyalty and customers. I'm thinking cyber has to play a role in developing trust with regulatory agents, with your customers, with your corporate leaders.

Mayank Agarwal:

Absolutely. When you associate trust, in fact, even in our strategy, out of the hexagon strategy that we have, Trust.AI is one of the big pillars which is out there. And the reason why trust is so important, because it's all about putting the right set of guardrails. When you are sending someone or some information, you truly want to trust that information is coming in from that individual, that person.

Jeff Kavanaugh:

If it's a black box, you have to trust.

Mayank Agarwal:

Absolutely. And there is nothing that has been truly made. Someone has not made any changes when they've sent this information. So there is confidentiality, there is integrity, and availability. All too are very important dimensions of trust that we take care of from a cybersecurity perspective.

Jeff Kavanaugh:

Well, as you're thinking about this, I think about the tens of thousands of attacks that could be coming in. Could you just paint a picture of what a modern CISO, cyber officer in a company, is dealing with? How many attacks come in? How many of them are thwarted through AI? And then how are they using cyber to overcome it?

Mayank Agarwal:

So, let me define the role of this person, the head of cybersecurity, CISO. Dealing with attacks is just one part of his job. So that is what we call as threats. So he or she truly needs to look at what are the different threat actors that are attacking the enterprise, not just indirectly, but maybe through their suppliers as well.

Jeff Kavanaugh:

That's true. Tier two, tier three.

Mayank Agarwal:

So tier two, yeah. The supply chain attacks that we talk about.

Jeff Kavanaugh:

Heck, from their smart devices.

Mayank Agarwal:

Yes. Absolutely. The cameras. Even the target attack happened through a fish tank.

Jeff Kavanaugh:

A fish tank? No way.

Mayank Agarwal:

Yeah. So it's truly interesting. So one is working and truly protecting the company against the threats. Second piece is there are a lot of converting these threats into risks because there is probability, there is impact analysis, impact to the business. Converting all of them into a risk, then creating a risk mitigation plan. Some you can transfer the risk to insurance, some you can do a remediation, residual risk which is there. And creating this whole risk management framework and reporting back to the board that happens. Third is there's a lot of compliance that a CISO deals with. So elements around SOX compliance, which is all around software attestation, the identity and access pieces. There are privacy requirement, PCI, DSS, HIPAA, and so on and so forth. So a lot of those things that the CISO has to deal with. Fourth is if there is a true cyber event that happens, how do you truly recover from it? And it's really different from a BCP or a DR event, which is there. So it's all about baking in a cyber resiliency plan, which is there. And lastly, cyber is also truly responsible for providing a secured user experience, which is there. And all of this leveraging AI, protecting AI. So that's where I call the five things that the CISOs are responsible for. Managing threats, converting those threats into risk and reporting to the board, making sure there is cyber compliance which is there, ensuring there is cyber resiliency, and lastly, it's all about providing the secured user experience. So those are five things that the CISO is responsible for, not just threats.

Jeff Kavanaugh:

Well put, well played. You said one little phrase you dropped in there, important to the board. It's interesting how visible, Board members, NACD, the whole corporate directors, they have training for board members on cyber. I think of all the areas that board members get training on, they actually go deeper and more detail in cyber. So talk about why board members are getting involved with this.

Mayank Agarwal:

So very interesting. In fact, a cyber event can truly impact the market cap of a company in a big way. We've seen instances where publicly traded companies, their market cap can drop by 25, 30% because of a cyber incident. So that's a very large number that,

Jeff Kavanaugh:

We call it asymmetric warfare, yeah.

Mayank Agarwal:

Yes. And it could be like 20s, 30s of billions of dollars market cap that we are talking of. So that's why the board has the fiduciary responsibility to truly make sure it puts the right set of processes in place and the oversight to ensure that the companies are there for long runs and long periods of time. So for that, if a single event can impact the value by 30%, they have to understand it better. They have to ensure that the management team is aware of the risk, and they put all the right systems and processes to make sure it doesn't happen to them.

Jeff Kavanaugh:

Well, taking that to a whole other level, we've got to talk about Mythos. So what's your perspective on the new model coming out, its impact on cyber risk, and what are you telling clients these days about it?

Mayank Agarwal:

In fact, last, I'll say less than five weeks, I've done at least 25 conversations around Mythos. So obviously it started with fear.

Jeff Kavanaugh:

About the new model, yeah, new model and probably comes out with it and it's going to attack everyone.Yeah.

Mayank Agarwal:

So let me just first talk about what Mythos does. So Mythos, what it does is it truly provides an ability to chain multiple vulnerabilities, which could have been very low probability, low severity vulnerability. But what it does is it chains all of them together, and it can create a truly critical vulnerability in the environment, which if and when it is exploited, it can truly bring down the entire enterprise. And that's what we have seen today, not just Mythos, but all other models, including Opus 4.7, GPT 5.5, ClearWing, and lot of other models which are there, they have very high ability to chain these vulnerabilities together. And they are not just available to the attackers, but now also to the defenders. So one important dimension for all the CISOs and even the boards is to truly look at what's truly the most important critical vulnerabilities or chain of vulnerabilities which are there in the environment that could get impacted. So that's one part. Figuring out, having the right visibility, putting the remediation plan. If you cannot remediate, is there a risk transfer plan? Can you put compensating controls that are out there? So that's one thing. Second piece is also about truly working on a cyber resilience plan that could work in minutes, not in days.

Jeff Kavanaugh:

Yeah. Shortening your response time.

Mayank Agarwal:

Yeah, response time. So that's the second part to it. And third is making sure that the entire enterprise is aware of such a thing.

Jeff Kavanaugh:

Yeah, aware.

Mayank Agarwal:

Because businesses, if a company is in the manufacturing space, they're all worried about are their manufacturing lines running, are they making the right set of output? And retail companies are all focused on are the right SKUs at the places and stuff. So all talking about all of this and bringing it together, I think that's what it's important, that the enterprise is aware of it, and then taking the right set of steps around it. So that's what our role is on this.

Jeff Kavanaugh:

Well, know you have to get back to things. One last question. What is it that executives should be thinking about relative to cyber as the next big thing coming, or the next opportunity for them in the next nine to 12 months?

Mayank Agarwal:

I'll say more than nine to 12 months. So the big opportunity today is definitely unlocking the value from AI. One is, going back to the first question where we started, one is protecting the AI. Make sure you're putting the right set of guardrails. You know which agent is doing what, and you are able to track that entire life cycle of that whole thing. Second is leveraging AI to the fullest in the cyber function so that you are able to amplify the work that the cyber teams are doing.

Jeff Kavanaugh:

So cyber for AI and cyber in AI in one sense.

Mayank Agarwal:

Absolutely. You put it absolutely correctly. Great. Well, Mayank, it's a pleasure talking with you. So nice to meet you. Thank you so much for your time.

Mayank Agarwal:

Thank you.

Jeff Kavanaugh:

I'm Jeff Kavanagh. Until next time, keep learning, and keep sharing.