The Defender's Window at enterprise scale with Standard Chartered

# The "Defender's Window" at Enterprise Scale: Standard Chartered's Practice **TL;DR:** When leveraging cutting-edge AI models like Daybreak for security analysis, Standard Chartered found that providing comprehensive contextual information—beyond just code—was key. This helps identify truly exploitable attack paths. They emphasize transforming the security team from "gatekeepers" to "enablers" by fostering cross-functional collaboration, shifting security left, and integrating it into the development process to address modern cybersecurity challenges. ## Understanding the "Defender's Window" & Vulnerability Focus For a global institution like Standard Chartered, the "defender's window" signifies that with advanced models, the time to understand software, identify, and recognize vulnerabilities has significantly shortened. The key is not discovering a list of vulnerabilities within a code repository, as attackers aren't focused on single assets. Instead, they target attack paths that span systems, APIs, authentication mechanisms, and trust boundaries. Therefore, the focus of defense must shift from increasing CVE lists to understanding what is truly exploitable. ## Applying AI Security Tools: Starting with Daybreak Standard Chartered was among the first banks globally to evaluate Daybreak, a component of Microsoft's Defender ecosystem. Their exploration began with a core question: Can cutting-edge AI provide risk insights that traditional methods cannot? Specifically, can AI understand the holistic picture across repositories, architectures, and trust boundaries? Initial observations confirmed that when the system understands the holistic context across architectures and microservice repositories, it uncovers more issues. This indicates that having the full context is far more important than simply choosing which model to use. Because with context, you can discover what is truly exploitable. ### "Context is King" in Practice When asked what "providing context" specifically entails in practice, the response pointed out that simply handing over the codebase to a model is insufficient. To help the model understand, they also provide: * Architecture diagrams * Deployment models * Dependencies * Relevant services or assets * The design intent of solutions The core principle is: the more context provided, the better the results. This helps the model move beyond static code analysis to understand the overall behavior and potential risks of the system. ## Organization & Teams: Building Trust & Collaboration Introducing new tools is not just a technical challenge but an organizational one. Simply demonstrating tools to development teams is not enough; concrete evidence is needed. Therefore, Standard Chartered formed cross-functional groups comprising application security and development teams to jointly test and run tools. Any findings must be validated collaboratively against code, architectural deployments, and environments. Security is no longer solely the security team's problem; it requires buy-in from the entire software engineering community. Experience has shown that the key isn't just focusing on "what we found," but on improving remediation efficiency and achieving the right security outcomes. This includes: 1. Helping development teams understand the root cause of issues so they can build applications differently in the future. 2. Collaborating with development teams to fix issues, rather than assigning blame. 3. Even using cutting-edge AI to assist with remediation, not just providing yet another dashboard for reporting issues. ## Transforming the Security Team Role: From Gatekeeper to Enabler Faced with the urgency imposed by the "defender's window," existing processes and governance in large institutions may not be designed for the required speed. To build confidence and move forward at the necessary pace, Standard Chartered is actively working to change the traditional perception of the security team's role. Historically, security teams were often seen as "gatekeepers" or "blockers." They are attempting to transform into "enablers." Their strategy involves: * **Shifting Security Left:** Giving developers earlier access to security tools. Providing "virtual spaces" within the development cycle for them to test and confirm at runtime whether vulnerabilities are exploitable. Once developers see the evidence, they can prioritize based on exploitability. * **Integrating into the Workflow:** Whatever is built is integrated into existing processes, not added as an extra burden. Trust is built when developers understand the security team is helping them "accelerate safely." * **Providing Intelligent Tools:** Combining security tools with intelligent coding tools to accelerate development work, ensuring security is not a traditional burden. ### The Importance of Foundational Infrastructure To effectively utilize AI, a solid foundation is essential. This includes: * Reducing technical debt and complexity (e.g., reducing the variety of programming languages used). * Ensuring architectures are updated to provide the correct context for AI. * Having robust identity and access controls, as AI, once deployed into the environment, amplifies everything it sees. Only organizations with the correct foundation can maximize the benefits of AI. ## Addressing Challenges of Scale and Complexity As a large institution operating in numerous global markets subject to different regulatory regimes, Standard Chartered's security footprint is vast and complex. To handle this scale and complexity, their team structure and future planning follow this line of thinking: * Although a global organization, development teams are concentrated in several hubs, making coordination and collaboration easier. * The goal in security is to provide developers with the right tools for "self-service." Ultimately, they need to be able to advance their work securely while appropriate checkpoints are in place during the process. ## Expectations for Future AI Defense Tools When asked what they would like OpenAI to provide to make defenders' work easier, the feedback centered on: * **Capability to Run at Scale:** The ability to run at scale, not just scan a few repositories. * **Sandboxing and Batch Testing:** The ability to run in a sandbox environment in batches to check for vulnerabilities. * **Understanding Blast Radius:** Because applications are interconnected, there's a need to understand what other parts will be affected once one is compromised. The vision of a "defense factory" would help in this regard. ## Unexpected Gains & Lessons from Six Months After integrating generative AI into security processes for about six months, the main takeaway is a deeper understanding of the importance of "context." This has drawn attention to things often taken for granted in the software development lifecycle—such as the assumption that development teams keep architectures updated—when in fact, there may be gaps that need addressing. The positive finding is that not many anomalies were discovered; certain areas missed by traditional tools are now captured through this approach. Source: https://www.youtube.com/watch?v=a75xDflRooI