Hello, everyone.

Welcome back to another episode of the Security By Default podcast.

I’m the host of the show, Joe Carson.

It’s pleasure to be here and always my favorite time of my day, which is I get to talk to really cool, awesome, amazing people that actually really doing a lot of great things to make the world a safer place.

And in the world we have, it’s.

It’s sometimes chaotic, sometimes fuzzy, and sometimes we need, you know, that knowledge and education to help us see through that cloud and, you know, chaos that’s there.

And I’m joined by an awesome person who I was introduced through nostarch, which is one of my favorite publishers.

So nostarch Press do.

Amazing book.

And I was introduced to Harriet, who’s the guest on the podcast today to give us an update and insights into your latest book.

So, Harriet, before we get started.

So to give the audience a bit of a background, you know, who you are, what’s your origin story?

How did you get into the industry?

And, you know, is it something that.

Did you choose it?

Like, you know, is this the path that you decided, I’m going to go down this path and this is the one I want to do, or did you kind of come in through another angle, another direction that some people do, which is quite interesting as well.

So if you can give the audience a bit of background about yourself.

Thank you so much.

Jo, first of all, thank you so much for having me.

I’m really delighted to be chatting with you today.

The origin story, where to begin?

I’ll try not to make it too long.

I don’t want to bore your listeners.

No, they’re interested.

They’d like to know how people get in because sometimes people starting their journey as well, they might kind of, you know, is this something.

Is there something possible for me to go down this path as well?

So sometimes it’s good for the people to hear, you know, the kind of detailed, detailed version.

Yeah.

Well, I hope, if anything, people feel inspired to go out and do their own thing based on my story, because I. Yeah, so I, I’ve spent the last 10 years at the intersection of artificial intelligence and security.

But I didn’t start out in cyber security at all originally.

So my degree was in physics and anthropology because I, I thought, you know, they’re two subjects that explain the world around us.

You know, you have physics explaining the physical world, anthropology explaining us strange primates that occupy it.

Neither of them were that employable by themselves.

But something I did become really familiar with from those two disciplines.

So I ended up working in data science, originally at Deloitte where mostly I was working on projects with the Australian Department of Defense.

And like that was a really challenging environment.

Deloitte definitely does not let you slack at all.

But being able to work on defense projects was so interesting.

Like I spent a year working in Darwin in Australia.

As you can.

I’m in Australia.

Is that where you’re from, Darwin, or is it Canberra?

Yeah.

Not known for being that interesting.

You know, I love it.

It’s home.

Yeah.

Darwin for people not familiar is a very small town in the north of Australia known for mostly like British backpackers and crocodiles and including me.

I spent a year in Australia.

I did the Gibb River Road through three ways up to Darwin.

Interesting.

I have an interesting story from that, that time of my life.

I look forward to hearing that.

I think I’ve ever been out anyway before on a Monday night and seen so many people in the pubs than Darwin.

Well, there was a reason why the backpack.

So one of the things that I used to do was we’d go to the pubs and they’d have competitions, pub quizzes, football matches and different things and that’s what we did in order to try and win free trips or get free food.

That’s why the pubs were a place where we went in order to actually uh, tried to get, I, I, I got free trips to Kakadu from going to the pub yet.

Wow.

There we go.

Maybe I should just spend more time in the pub then.

But Darwin is an amazing place.

Absolutely.

Yeah, it’s very cool and like obviously yeah, has a big navy presence.

So yeah, I did like a, a year I’m doing FIFO work there.

So fly in, fly out work and yeah, working on different boats, ships, the Australian Navy looking at data remediation and data quality issues.

Um, I spent some time working with the Air Force.

And yeah, from Data science I, after a few years at Deloitte and on those projects I, you know, I wanted to change.

So I guess I did the sort of the opposite and I moved to the UK and I planned on working in a pub in the UK but on the, the way over there on my, my backpacking trip I ended up having a LinkedIn recruiter reach out about a job and so I was doing this Interview process.

And then, yeah, something like the week I landed in London, I ended up getting a job offer for this job at a tech education startup in New York City.

So I moved over there and it was a, it was a great opportunity to learn a lot about what different companies around North America, the challenges they were having in the tech space.

We went into all these Fortune 500 companies and basically taught them about data science and machine learning, artificial intelligence, even crypto.

But we did workshops on cybersecurity and that was my first real exposure to it.

And I found it so fascinating.

I thought it was such a cool area to get into because it not just focused on really interesting technical challenges, but there was a really fascinating geostrategic component, you know, national security implications too.

So while I was working over there in New York City, I started a master, master’s in cybersecurity strategy and Diplomacy at a university in Australia.

So I was doing it remotely.

And then when Covid happened, unfortunately the US office of this startup closed down.

I came back to Australia and continued the masters and I ended up working, getting a job at the Australian Signals Directorate, which is Australia’s equivalent of GCHQ in the UK or NSA in the usa.

And I, yeah, I was fortunate enough to work on a few different teams there.

I spent some time working in a team helping small businesses do better cybersecurity.

Basically I worked with a team that was about applying data science skills to understand tech sigint, which is signals emitted from military platforms.

And then my final team, my role was as acting Technical Director of the AI hub within asd.

And the remit of the AI hub was basically to help inform the artificial intelligence strategy and direction of Australia’s national security and intelligence community.

And there was a lot of work learning from and contributing to our five Eyes partners as well.

That was, that was incredible.

It was a really, it was really incredible to sort of peel like back that curtain as well that the national security engine.

And I was, after doing my master’s, I moved on to doing a PhD.

So I was doing my PhD in parallel to this work in the same.

Topic or in something slightly adjacent.

Yeah, I originally, originally the topic was something like translating tech SIGINT for military customers, something like that.

It was based on the team that I was in when I started it.

And then during the literature review process I found this field called adversarial machine learning, which is all about hacking and disrupting machine learning models.

And I think I read my first paper on that topic and I was like, this Is it?

This is what I’m doing for the rest of my life.

This is so cool because it combined the two things I found most interesting, like my, my data science skills and the cybersecurity challenges.

And so I’d been working on this PhD in parallel to that job and national security organizations at that time were taking AI security pretty seriously.

But it wasn’t something I ever heard talked about outside of those institutions, except for my PhD, but they looked at a very different kind of niche scientific challenge, you know, disrupting machine learning models.

It wasn’t really seen as something that could ever be a real threat.

But yeah, the national security community was definitely really keen to the, you know, the challenge that it might pose in the future.

I saw that there was this big challenge though, that the kinds of organizations that had access to this information was the national security organizations, maybe really big tech companies that had research labs in adversarial machine learning like Microsoft.

But most of the organizations that would be using machine learning models and AI systems had no idea about it.

And they were the ones most likely to be impacted if threat actors were trying to compromise their AI systems in some ways.

So I very naively had the idea that maybe I should start a company to solve that problem.

Which was like a terrible premise to start a company.

No market, no one had heard of it.

And I really just spent the first couple of years traveling around to different conferences talking about AI security.

Which type of conferences were.

Because I’ve seen more of the security conferences, doing more AI now, but probably two, three years ago it was probably more AI specific conferences.

So what type of conferences were you, Was it security conferences focused or was.

It AI or they combined, they were usually security conferences.

B sides is my all time favorite brand conference.

I know your listeners will be late.

I literally just, I’m just came from BSIDES rehear this morning.

So I’ve been on a bus, a bus for four hours from BSides Riga.

So it’s also one of my favorite because it’s focused on community.

It’s the community aspect of things rather than the vendors and the tech, which is great, original knowledge sharing aspect.

But yeah, BSIDES is awesome.

Yeah, I agree.

I’m sure that internationally there were probably lots of other AI speakers, too.

Yeah.

I mean, massive props to BSides.

And it just felt so inspiring and I felt confident and I was like, yeah, I’m going to start this company.

So, yeah, I can credit BSIDES to that inspiration, I think.

That was a really, like, incredible opportunity.

Definitely the scariest thing I’ve ever done.

Like, I don’t think.

I mean, and I do a lot of public speaking, but I’ve never been so nervous to do a talk because it’s just such a big.

Oh, yeah, biggest.

It’s the biggest cyber security hacker conference in the world.

So it’s.

Yeah, to go to that.

To go to that.

That size and scale is fantastic.

Yeah, I mean, it’s.

It’s big.

But like, all the previous speakers, they’re just so incredible.

And, yeah, being part of the lineup was just so scary and intimidating, but it was.

It was amazing because again, that was a crowd of people that took AI Security seriously.

And within a couple of months of that talk, I think I remember I was on a plane at some point and I was thinking about how I could, I don’t know, talk to more people about AI Security, how I could get the message out faster.

And I was like, no, I’ve always wanted to write a book.

Maybe you should just write a book.

I don’t know how that happens, but, you know, maybe I’ll write an outline and just, you know, I’ll start shopping around, I’ll start pitching it.

And a week later, I got an email from.

No Starch Press from.

From Bill himself.

No, I just.

I hadn’t sent anything out, but it just, like, the opportunity came in.

One of the amazing editors, I think, had seen the, like, the DEF CON talk and seen my YouTube channel and other things like that, and it just felt like really, really good timing.

If I was someone who believed in manifestation, I would probably say it’s manifestation.

However you define manifestation is definitely the right time and put the work in.

It kind of happened.

Sometimes it takes all of those different aspects to just happen at the right times.

Speaking at DEFCON in the right fields or somebody’s there who, you know, heard the talk and thought, you know, this would be a great way to, you know, to turn into a publication that would be, you know, valuable for.

For everyone.

So when.

When did the, the book writing start?

And so you started with the outline and then you got discussed with no starts.

So when did, when were you thinking about doing an AI security book?

Or was it looking at, you know, did it, did it change over time or was it, you know, what you originally had planned to do at the beginning?

Yeah, it actually didn’t change over time at all.

Obviously the technology changed in certain ways.

You know, agentic AI certainly became more of a topic of conversation over that period of time.

I really didn’t anticipate how much work it would be, which sounds like a really stupid thing to say, but it.

Is a lot of work.

It’s a lot of work.

Especially when you get to a point where, you know, if you have a good copywriter, that makes your life a lot easier and if you end up getting a good, you know, visual designer.

I don’t know who did the graphics for the book, you know, for the COVID but if you get somebody who’s really good at visualization, they also help lots sometimes.

You know, it’s getting people who’s done it before and helping them navigate where you can just focus on the content.

Makes life a lot easier.

Yeah, yeah.

No, the no such team was fantastic.

I mean, everyone that I worked with, but especially Francis, so my editor, who I work with the most and yeah, for about nine months there, we’d probably email every day or every second day, I’d have, yeah.

Different versions of chapters.

She’d come back with feedback and yeah, it was a really, it was a lovely period of time.

It was a lot of work.

But yeah, it felt really, felt very exciting.

But by the time it went in, like the full manuscript went in, I know it felt like it’s done.

Like it’s kind of crazy that now the book is launching and it’s starting to come out.

I feel like mentally, you know, it’s all been a long time ago.

Yeah, that’s, it’s even.

Yeah.

The post, once you’ve done the, you know, the, the kind of initial drafts and the kind of, you know, the final manuscripts and everything’s coming together.

The process of just, you know, going through that post production side of things and getting it all ready and you know, sometimes translations, sometimes just getting the prints and the formats that, you know.

Right.

Takes, Takes a lot of time.

So I’VE got, I’ve.

I’ve myself had, you know, one of the early reviews and I got to probably about close 40, 50% of the way through.

And it’s very insightful.

For me, one of the things, because I always find my background is purely cybersecurity, like security.

Well, originally that was not, you know, a thing.

Even when I started, it was just it.

And security was just part of your job.

And a lot of times we have had automation helping us when we’ve.

We’ve been looking at data, using data to input.

And I actually laughed because somebody asked me, it was like, can you remember in like recall, when’s the first time you really did anything that was like, resembled AI?

And I laughed.

When I used to work in HP in Concord west in Sydney, and what I remembered is like, years ago, we had a survey server that kept failing.

It was a billing system.

And the only way to get that system up and running was to go send somebody into the data center, into the cage, push the button and get it started again.

And what I crafted was another server at the opposite side of it where I attached like a pencil to the CD tray.

So what I could do, because of what we used to do, when you went into the data center, a cage, in order to find out which server you’re meant to work on, you’d eject the CD tray.

So you went in and you looked around which server’s got the CD tray ejected?

And you’re like, oh, that’s the one.

And I laughed.

One day when I went in to fix the server, I was like, oh, there’s the other, like the cd.

So I got it.

So I placed it opposite.

So every time I needed to reboot the server, I ejected the CD tray and it would push the button to close the CD tray and it reboot the server.

And then I actually, I started learning the data because the point is, is that when you start gathering and logging and creating analytical information from it, you can start becoming predictive.

You start making assumptions about, you know, probably this is maybe a right time when we should probably restart the server.

And I actually got at the point, because I would get a pager back then little pagers, and you get a pager saying, oh, the server’s not working.

And then I would actually, you know, go and run the script to eject the CD tray.

I push the button, put it back in and restart it, and everyone’s happy.

And then I got to the point where actually the servers were started talking to each other and the CD tray.

You know, when the server started realizing the other server wasn’t responding, it automatically ejected the CG tray.

And I got the point where I could really start understanding the trends and knowing roughly when it was going to crash.

And that was always makes me laugh.

I’ve actually started creating a talk on that exact topic is, you know, AI and you know, in the old days, like retro.

Retro AI, it’s quite.

I’m in the process, I actually want.

I’ve actually, I just went and found two machines where finding CDs, CD trace these days is not easy.

So I’ve got two, two machines where I’m actually going to recreate it again and record it on video.

But that was for me is like, you know, but what I found was that we kind of almost went down two separate paths, Security went down its path and AI is kind of taking its own trajectory.

And a lot of it was many early systems back in the 60s for training models, the Eliza, the psychologist model and stuff, the therapist side.

And that moved into a lot of probably the last, maybe 15 years before has been around visualization, image detection, you know, especially cameras and CCTVs in order to be able to detect things and understand what they are.

But I think in the last probably, you know, seven years now with the improvements where I think for me probably the biggest change was the natural language processing and understanding the ability for us to communicate in a very different way that starts to understand what for what was the.

What was for you, the, the thing that probably, you know, was what was the change that you saw make the biggest impact over the last years of AI has been evolving?

That’s a really good question.

I love the story you told because I think one of the challenges when people talk about AI is that they don’t really know what they mean when they use the term, or at least lots of different people use the term and slightly.

It’s a very broad umbrella.

When you say AI, it covers lots of things.

Yeah, yeah.

It’s a massive field of technologies.

And I think there’s a technical definition that ISO gives and other organizations too.

But in essence they’re all kind of along the lines of a machine that can do human like things.

So in terms of what I think the biggest change I’ve seen, I don’t know, I think a lot of the point of the book is really that there are a few things that are fundamentally different about the way that machine learning models work.

That whatever kind of system they’re in, the system is comprised of a machine learning model or many and then lots of other things that have been in computer systems for ages.

But the way that the integration of that machine learning component changes the system is really fundamental.

And you can add things onto the system, you can add tools and stuff, but it doesn’t change the fact that machine learning models are probabilistic.

They’re so reliant on that data and they can like.

Yep, they can get better or worse and get better and worse again.

So depending on that learning model and the deep learning and machine learning and the modification of the weights, you know, from basically if they skew off from, you know, data poisoning or other types of manipulation, then you can get a lot of bad results.

And this is one of the things is, you know, as I was going through, I really enjoyed from my side as being a security practitioner, I think I really enjoyed, you know, the really first chapter was around, you know, the actually maths behind it.

And that was for me is like, okay, I knew parts of it, but it really brought it all to kind of, you know, to clarity for me.

It made much more clear for me as I went through.

So that’s, that’s how it’s working because I kind of had some ideas and some pieces, you know, building my own agents and working on.

But the mass and probability and the history behind that’s what kind of brought it kind of close.

That piece of, of knowledge that I didn’t have, which was great.

And then they’re moving into examples.

Right now I’m in the section of the AI adversary part, exploiting it and, and, and the risks.

One of the things that as I was going through, I love all of the references and associations back to, you know, some of the older models of the past.

It was a highlight was as I was thinking about that was the part with the how do you patch AI was, was really kind of.

And I started getting.

Because a lot of my history is, is in patch management and you’ll have a, you know, system has a vulnerability and you patch it and that’s it.

And it wasn’t really anything you needed.

Sometimes you might need to go and fix the data because maybe the data got corrupted or some way or maybe it wasn’t compatible with the new patch and you had to make some, you know, slight modifications to it, but as I was going through and one of the things you highlight was about, you know, patching AI, especially when it’s all about the data, because the data is the fuel, you know, the algorithm, the learning model and everything that’s there, the LLM.

But how would you patch AI if you find out that the data itself had, you know, got a bit of a, you know, it’s like a, you know, teenager that’s just got a bit of a bad habit.

And how do you, how do you change the behavior back to the behavior that you expect?

Yeah, it’s really hard.

It’s a real challenging question because something I’ve noticed a lot of, of AI security professionals will refer to, instead of a traditional vulnerability associated with deterministic code that you can patch, like in AI systems and machine learning models, it’s more of a weakness.

It’s something that’s inherent in the nature of how those machine learning models optimize.

But at times isn’t always a bad thing.

Like the probabilistic nature is a lot of the time a good thing.

It’s why you get good pros and why you have some variety there.

But yeah, I think something I’m conscious of during the book and in my practitioner life too is like depending on the kind of use cases and how it’s implemented in an organization that dramatically changes the technical answers that you have for a question.

So, you know, most of the kinds of organizations I work with are big enterprises who, they don’t really build their own models most of the time using Microsoft products or aws.

And they have almost no control over those machine learning components in the AI systems.

But they do have control over contractual arrangements and they can contribute to discussions around governance and standards.

That’s a very different kind of question where the, the, the solution is more process and systematic than if you’re a machine learning developer who has the slightly easier job, I guess, of deciding whether maybe they can like retrain a model from scratch, maybe they can fine tune it again.

But yeah, it’s, it’s definitely not as simple as a, as a code solution.

It’s, it’s essentially changing the fundamental property of what that model understands about the world.

And thinking about how to solve those problems is in many ways similar and borrowing from the existing doctrine in cybersecurity.

But it’s important to understand that there are pretty fundamental differences too, otherwise those kinds of challenges just get ignored.

Yeah, my concern, as I was thinking about that part of the book and then that aspect, my mind started racing.

Because I started thinking about and some of the things I’m seeing also in media at the moment with a couple of peers, mine, who’s using, using it to do coding.

And I started thinking, you know, for the, for the first couple of years it’s been a lot of experts and you know, professionals in the field who’ve been using the models and their data has been contributing to training the models.

So if you get a lot of people who knows what they’re doing and interacting with the models and it’s their interactions which are being used to train it.

Now I got it to where it’s, it’s getting, it’s getting better and better and better and better.

And then if you open it up to the wider public, you get a lot of people who don’t know what they’re doing, start using the model and the model gets, gets trained on, you know, the mass of people who have no idea.

They’re just used to using Google searches and they’re using for the same thing and not understanding.

And now that model is learning from people who are, let’s say, less experts or junior in the field.

How does that impact the model going forward?

If I’ve all of a sudden, you know, for the last two years I’ve got expert coders who’s been using it to improve their code and now you, you flood it with lots of junior coders, is it going to learn from the junior coders that that’s the right way to do things, do things and all of a sudden, you know, reverse back?

Because I’ve seen some comments around, you know, with Claude recently where, you know, the quality, it started introducing vulnerabilities in the recent months.

And if you’re not really understanding about quality and understanding about what it’s creating and not checking it, you’re just assuming that it’s right, then you know, it can create a lot of risks as well.

Is that something also that you know, potentially is as who, who’s who’s been used the data being trained on.

But do we quantify it?

Do we, you know, check it for quality or do we just assume that it’s, it’s good?

Yeah, that, that’s such a great question because one of the like, it’s both a technical and a systematic challenge is how opaque the models are when it comes to how they actually understand the world around them.

I mean, so the base models that we’re using, like your, your Claude and your GPT family of models, you know, they were trained based on basically the entire Internet and unfortunately, as we now know, a lot of models are also trained on copyright material, but sort of everything that is available to humans are trained on and being able to like ensure that that is good quality data is impossible.

And so they’ve obviously picked up lots of weaknesses in how they, you know, write code, for instance, and biases that they then propagate into language as well.

But then the extent to which us interacting with those models and to what extent that retraining process actually fundamentally changes the representation underneath those models, I suspect is quite minimal actually.

But we also don’t really know, like, we don’t know because there’s no mandate for AI labs to release any of that information beyond the kind of academic information they choose to release.

And there’s also still a lot of questions among the researchers about how it actually how they hold information.

You know, we understand a fair amount about how models work and we can interrogate them in some way and kind of try and understand their reasoning.

But a lot of those approaches are still quite nascent and they’re not very reliable.

So actually understanding like if you have a model that is billions of parameters, big, where is this certain idea located or how does this certain input lead to that kind of output?

A lot of those are still unknowns.

Efficiency and costs can also kind of have massive impacts.

Yeah.

So going back to the book, when you were doing the book, one of the things I found is that in CyberSecurity we need AI and AI needs security.

It’s like, you know, it’s a double edged sword.

You know, it can be good for bad, both directions, but we definitely need it to stay ahead.

We need it to move fast because ultimately it’s an accelerant and data is the fuel to AI to make it move fast with accuracy and efficiency.

When you were doing the book, I find that we need to bring both AI developers and architects with security together because we need to do with security in mind by design.

So when you did the book, did you really target it for the AI side of the world who’s just looking at creating, you know, AI and doing it securely, or did you have it for cybersecurity to better understand AI more?

What, what was the target audience you were thinking about when you were writing it?

Yeah, the target audience is very much someone who is either an a cyber security practitioner already or adjacent in some related field or is interested in cybersecurity like a, like a student and really helping them go from like 0 to 60.

In the intersection with artificial intelligence, it’s Challenging, because I also, in my network work with a lot of AI people who want to understand the security side better.

But those fields are really quite separate and trying to bridge them both is quite hard.

There’s a lot of implied, sorry, assumed knowledge that really isn’t common between the two fields.

Even the term AI security when writing the book is quite challenging.

We really workshopped the title quite a bit because among, like, different groups of people, AI security as a term means very different things.

Like most of the time when I’m speaking with cyber people, AI security means using AI for security, either effectively or defensively.

And there is one chapter about that in the book, but that’s not the focus.

And then among AI safety researchers in my network, and they tend to come from more of an effective altruism leaning for them.

AI security is securing the AI models in Frontier Labs and making sure that they have good, like normal cybersecurity so that, you know, threat actors don’t steal their AI models.

That’s a totally different kind of problem.

Although increasingly there’s, of course, overlap, as, you know, AI systems are doing things to other AI systems.

But the way that AI security is framed within the book and sort of my field and paradigm is very much securing AI systems from external threats.

They could be AI systems, but also humans.

Just anything in the external environment that’s seeking to manipulate an AI system in some way.

So in writing the book, I was really cautious or like, keen to make sure that, as you say in that first chapter, going through the math of machine learning, to me that’s really important because you don’t need to, don’t need to love math.

You don’t need to do any more math than that.

Well, even though it did take me a little, I was like, okay, I need to go back to my childhood to try and remember some of the mathematical algorithm.

I was getting there eventually.

But it did take me a moment of reading it over again.

I was like, okay, what’s that symbol mean again?

But I got there in the end.

I certainly don’t want to bring back math trauma for people.

I mean, we’ve all, we’ve all been there.

But the math of optimization is so fundamental to machine learning because that is the core reason why people are either scared that AI systems are going to become super capable and try and take over the world, or even that, you know, errors in AI systems propagate unnecessarily.

It’s all because of the way that they’ve been trained to relentlessly optimize on some Kind of objective or prop.

The objective and to what extent that can actually work in a real environment.

Most of the time, you know, most of the time it’s okay, but it’s certainly not a safe or robust solution for training large scale AI.

And I have seen that transition.

I did see, you know, the early years, a lot of security companies looking to use AI to accelerate their own capabilities and use cases and features.

But in the past year it’s completely switched to realizing that actually it’s not AI for security, it’s, it’s, you know, security helping reduce the risk of AI AI systems and you know, because they’re going to be using a much broader scale and accounting and you know, in production and food and medicine and therefore, you know, it’s important for security to realize that it’s not just something they can use, but it’s something that they actually can reduce the risk and make safer as well.

No problem.

I do have some questions for you.

You know, how has your movie Algorith improved and also your wine algorithm?

Have you got those both prediction models down?

Yeah.

Yes.

To choosing the best wine and the best movies.

Yeah.

For your listeners.

I have a couple of examples in the book based on my real life hot takes on how like no movie should be longer than 90 minutes basically.

I don’t know if they’ve improved over time.

But yeah, it’s.

Yeah, yeah, that’s.

So that’s definitely, you know, it was part of the book for the audience.

There’s a lot of, I think it was like 30, 30 different scripts or projects that they can leverage in order to understand and better in test and change the parameters and to learn, you know, how the output and impacts of each of the those.

And I think they’re all Python scripts if I remember.

Yep, yep.

Correct.

Yeah.

And it did start off as fruit.

Fruitcake was a cake in the beginning as well.

And then it was the movies and then it moved to wine.

I don’t know if that’s.

Is that in the order that he started?

But it was, it reminded me back when I, when I was.

One of the reasons I started programming was to try and predict the football, you know, football league tables.

That’s right.

I was 8 years old writing basic code to do predict, you know, predictions of football.

And that’s what we all try to do.

We want good prediction models.

We want to know, you know, what’s the future, you know, what’s, what’s, what’s the right, you know, where’s things going.

Yeah.

And I mean it Helps to have an intuitive model.

Like you can kind of have an intuition about how some sort of classification or prediction might turn out.

But really they’re in there.

So that if someone meets me in the real world, they know not to make me watch a certain movie or to give me for instance.

Because we want to optimize at the end, the most valuable thing we have in the world is time.

And the more we can use these models to optimize our time wisely as possible, then that’s the great thing that comes out of them.

So it is.

So for yourself, the book’s been released and it’s available.

Where can people get the book?

Where’s the availability for them?

Is it directly from those starts or is it like an available in bookstores or what’s the easiest way?

As of, as of 9 June, it’s now available from all book retailers that stock it.

No Starch Press website.

You can go there directly and get a PDF version or the hard copy version.

But yeah, it’s also now available on Amazon and other like Barnes and Noble.

I’m gonna, I’m gonna add all the links into the show notes so it makes it probably, you know, easier for everyone to find it as well.

So one of the things, I mean this is it’s such a fast moving industry and you know, sometimes just staying up to date.

I’ve talked to a lot of startups or you know, AI startups and they’re looking about, you know, every six months, they don’t know where they’re going to be.

So as the industry is moving really fast, you know, how do you stay up to date?

What’s, how do you stay knowledgeable?

You know, what’s, what’s your method of, you know, staying educated and informed in the advancements?

Yeah, great question.

I’m, I’m still so time poor that it can be really hard, but I think a couple of things I think are really important, especially in a field that moves as fast as AI security is.

Firstly to have a really good breadth of understanding.

So going to diverse sources I find really useful, especially in a field like AI security where it means so many different things and there’s different paradigms according to different people and for some people it’s just red teaming but really it should be more holistic than that.

I think it’s, that’s really important to cover, you know, all the AI safety topics through to cybersecurity papers as well.

So for example, I subscribe to a few email newsletters like Jack Clark for AI is really good.

There’s a podcast I listen to the daily AI Breakdown, which is really helpful.

Embrace the Red is a really good blog site, but there’s so many out there and I think people, if you search broadly and widely, that’s a really good way to start.

I also am lucky that AI security is my day job.

Like I, you know, I’m always, for example, doing projects where I’m helping build AI security frameworks for companies where I’m always learning something new about that industry or about that system.

But also I run courses and stuff.

So interacting with people in the courses is incredible.

So learning what their real problems are and what’s happening on the ground in different industries.

So more broadly speaking for your listeners who don’t get to work in AI security day to day, I still think that actually having those real human conversations with people, whether that’s at a B sides conference, the AI Security forum is incredible.

If you want to go.

They have one every year in Vegas around Hacker Summer Camp.

They have others around the world as well, but that’s definitely the best my opinion, AI Security conference.

But yeah, being able to connect with other people at that AI security intersection and hearing their thoughts, I think is a really valuable way of staying up to date.

Fantastic.

And for the training courses, I guess they can get it from the Mileva website.

That’s where they can go on and find.

Fundamentals.

That’s what it’s called.

And it’s a similar sort of trajectory for the book, but goes a bit deeper and some, I guess updates based on, I guess ways of teaching that work better for a course than for.

But yeah, we get to work with people from.

Yeah, no, when, when I first released the course, I thought if one person’s interested in this.

And then we ended up having people sign up from like Microsoft, Palo Alto Networks, Google, like we’re training them, which is wild.

So yeah, it’s a great, great community of people.

But yeah, all the, like, the AI security niche is still so small that it’s such a great opportunity to get involved and even if you don’t come from AI or security that we need so much help that I really hope that even if people aren’t technical, even if they don’t want to read this book, even if they don’t want to code, they still feel like their contribution is worthwhile in this field because there are so many technical challenges we still have, but so many geostrategic challenges that we need help solving to make sure that AI security doesn’t become the threat that it needs to.

Yeah, absolutely.

We need to make sure that we think of it.

One of the comments I said I was part of the subject matter expert group for the EU AI act and going back to.

We were giving different problems that we had to.

That was AI was being used in order to solve those problems.

And one thing.

So I said, you know, we need to embrace it, but we need to do it with responsibility that we are, we own it.

And therefore that means any of the things that we want to, you know, make it.

The goal is to make it our lives better with it.

So it’s not about AI replacing people, it’s about AI empowering people.

And how do we make sure that every time we think of a use case is it.

How are we making people’s lives better by taking dangerous work away from people.

You know, whether it be doing analyzing, you know, neural kind of, you know, mines and you know, dangerous places and forest fires and stuff, you know, all of those things where we can actually take humans away from the danger and let AI deal with it.

And that was kind of one of the aspects.

And so absolutely, I think, you know, we, we always have to make sure that from an ethical side of things.

And that’s why I always say that, you know, when I heard about the book, I was like, oh, this is great because, because we’ve always looked how can we use it, but at the same time we also need to protect it.

And that’s, that’s a fundamental kind of, I guess, responsibility that we have.

Yeah, I definitely agree.

And there are going to be some big conversations that societies have to make sure that AI can, you know, the, the incentive structures in place least help that happen too.

Yeah.

One of the concerns I have is that we’re trying to make it very human like, which I think is probably not the best thing to do is because then we, we misunderstand that when we’re inter interacting with AI is that we can misinterpret as being a human, as having intelligence.

And I think we, we have to make sure that that and, and then people get, you know, psychology problems and stuff with inter interacting the more human like we make it it because that makes us more comfortable when we’re using technology, we’ll make it human like and again that, you know, we should also make sure that people are aware that, you know, what is human and what is not.

So and it can be misinterpreted.

That way as well.

So if anyone has questions afterwards, they want to contact you.

What’s the best way to reach out to you?

What’s the best way to contact you?

Is it through LinkedIn or to your website or otherwise?

Yeah, people can absolutely reach out on LinkedIn.

Harrietfarlow I also include my email address in the book, which was maybe a really dangerous to do, but it’s harrietarriathacks.com but if you look up Harriet Fowler, you’ll be able to find various ways of contacting me.

Well, emails are meant to be public.

The question is that, do you filter them enough?

And the, you might have to have an agentic AI agent that just filters the incoming messages into things that you need to read and things that, you know is maybe, you know, something of interest.

So yeah, it’s a challenge.

We all have, you know, when email is getting, getting flooded with a lot of messages.

So, so many.

Yeah, I definitely, yeah, definitely want people to reach out and feel like, fantastic.

I’ll also make sure that those links and everything’s in the show notes as well, so it’s easy for people to find.

So, Harriet, it’s been fantastic speaking to you.

I’m really excited, I’m excited to, to continue my, my goal is to go through this weekend and, and spend more time reading the book, but I also want to get to the point where in the next couple weeks I’m going to get more the practical side as well.

You’re playing around with the scripts as well?

Because I want to, I want to play around with the, the, the scripts, the Python scripts and I want to optimize the wine list as well with my own inputs.

That’s one of the, that’s one of my fun things I’m going to play around with and then also get it into my, my own agent code as well to see how it works for that.

So it’s been fantastic having you on, really enjoyed and looking forward to the future work and thanks for creating the book.

It’s definitely something we all need because for me it’s really, it’s, it’s closed the gap and where I didn’t have knowledge in certain areas and it’s, it’s made it possible for me to better understand it.

So thank you for everything you do.

No, thank you so much, Joe.

Thank you so much for having me.

It’s a pleasure.

So everyone, this is the Security By Default podcast.

I’m the host, Joe Carson and it’s been awesome having Harriet on talking about the Practical AI Security book and we’ll make sure that you’ve got the links in the show notes to go and get your own copy so you can actually get to understand better about how you can make AI security and make the world a safer place.

So for everyone, tune in every two weeks.

Take care.

Stay safe until next time.

Thank you.