Terra Security uses agentic AI to find risks before attackers do 

The attack surface of any modern enterprise is bigger than ever.

Artificial intelligence has transformed both sides of the cybersecurity space. Now, security experts must use AI to defend against AI-powered cyberattacks. This has led to widespread concern about organizations’ ability to protect their data, and the rise of cybersecurity companies ready to address the problem.

“What led us to found Terra is that we knew that things were going to change even before ChatGPT was widely adopted,” said Shahar Peled (pictured), co-founder and chief executive officer of Terra Security Inc. “You basically have to run adversarial operations, so offensive security, all the time across the entire attack surface, because otherwise adversaries are just going to get to it before you can. We have to move from reactive to proactive, from defensive to offensive, and beat adversaries at their game.”

Peled and Anna Sarnek (pictured), vice president of business and strategy at Terra Security, spoke with Christophe Bertrand, principal analyst at theCUBE Research, for the AWS Marketplace Series, during an exclusive interview on theCUBE, SiliconANGLE Media’s livestreaming studio. They discussed the role of agents in cybersecurity and Terra Security’s relationship with Amazon Web Services. (* Disclosure below.)

Terra’s agents fan out over the attack surface

Terra Security is an agentic offensive security platform, meaning that it uses agents to do the security testing and remediation on behalf of human employees, while still keeping the human in the loop. In a demonstration of the platform, Peled showed how agents can analyze an attack surface and the business impact a vulnerability might have if exploited.

“We train a swarm of hundreds of AI agents that are trained to do everything in the offensive security cycle,” Peled said. “We train them how to think and act like ethical hackers. They analyze the attack surface. They generate hypotheses or test cases of what adversaries can do. They run penetration testing and red teaming, cross every vector of attack to validate the exploitability. Once they have validated it, they don’t have to stop there. They will go ahead and generate a fix.”

Terra Security is the first company to be certified in AWS Security Competency under continuous autonomous validation for the Application Security category — a point of pride. Being certified under AWS gives customers a greater sense of security, according to Sarnek, who highlights Terra Security’s position in the middle in the application security space.

“We’ve worked on refining how we can use Bedrock and the foundational infrastructure to power our solution for that secure deployment and seamless deployment,” Sarnek said. “There is a lot of regulatory pressure to make sure that assets are secure within the space. It’s not even just adversaries using AI for faster attacks and wider scope of attacks, but it’s also how quickly we’re now developing the technology and we need to keep up on the IT side.”

By bridging both sides of the IT and the security space, Terra Security can pinpoint security issues with greater accuracy. For example, a FinServ customer was found to have a critical vulnerability, but a Terra Security agent identified it before catastrophe could hit.

“We keep talking about cyber risk as a vertical pillar, even though it’s a horizontal overlay of all of the business risks within an enterprise,” Sarnek said. “We talk about security and remediation in a circular feedback loop. The way that I see Terra fitting into an enterprise is if you draw an infinity symbol, we sit at the middle where on the right-hand loop you have the security offensive mechanisms … and through that feedback loop of remediation and retest, you punt it over to the IT side.”

Here’s the complete video interview, part of SiliconANGLE’s and theCUBE’s coverage of the AWS Marketplace Series: 

(* Disclosure: TheCUBE is a paid media partner for the AWS Marketplace Series. Neither AWS, the sponsor of theCUBE’s event coverage, nor other sponsors have editorial control over content on theCUBE or SiliconANGLE.)

Photo: SiliconANGLE