0:03Thank you all again for coming. Just to introduce myself, I am part of the Cloudflare security team, I lead security strategy. I'm also the chief of staff for security here at Cloudflare. I am very pleased to be joined by Sean Mason. Sean is part of United Airlines and he leads their cyber defense team at United. So I'm super excited to be here. One of the things for me as an outsider observing the aviation industry is that it's a very clean machine where you enter an airport on one side and it throws you out the other or at your destination. And there's so many moving pieces in between that, in the machine there for you to be able to go from one door to the other. And it's complex, it's complicated, and I'm sure the security around it is complicated too.

0:52So that's the part that I'm excited to get into. In terms of... just complexity, I wanted to set the stage about United Airlines. 1 ,500 aircraft across the globe, 113 ,000 employees, more. Yeah, I think there were more. And more than half a million passengers every single day that they take from one place to the other. So it's a really, really complex environment. And then there's like a big plethora of partners as well, I'm sure. Yeah. I remember I actually came in during the height of COVID. So I've been there. about six years and I remember we were flying maybe 200,000 passengers a day or something like that and now we're like 500 ,000 is a slow day for us and you know we're coming into the holiday season we'll be well over 600 650 we'll see if we hit 700 ,000 it's a lot of folks that is amazing uh I know like just thinking about uh your world Sean and this is my simplistic view I think there's four groups that you guys are protecting there's obviously passengers and all of the customers and their information.

1:52There's operations and your employees, there's aircraft and all of the hardware associated with the operation, and then there's the partner ecosystem and the regional airlines, your catering, your baggage handlers. Tell us a little bit about which of those four is probably the most complicated or the complex to secure. That's a difficult question to answer. First and foremost, if it's a partner of ours. I'm famous for saying, I can't defend what I can't see, right? So we work with our partners routinely. In fact, I'm actually having a handful of them up to Willis Tower here in a couple of weeks to chat about cyber and see how we can continue to collaborate and work together. You think about our customers and our Mileage Plus program, right? Hundreds of millions of folks in there, right?

2:40That is a lot of data to manage, and it's a huge, you know, huge i'll say from a security standpoint and then aircrafts and i'm sure there's a lot of av geeks out here aviation folks um those are tricking in and of themselves and we have great partners at boeing and airbus to help us with that um but i always go back and like people sean what keeps you up at night uh and not kidding right before i stepped on stage like my phone is blowing up right because there's something happening in the world and frankly it's ai driven i'm sure um and the the reality is the operation like trying to keep a 24 by 7 operation that's global just running constantly is just an enormous weight and enormous pressure, right? And there's a reason we are critical infrastructure. And I'm sure folks have seen, unfortunately, when we've had some downtime, right, for one reason or another, the impact it has on, you know, the U .S.

3:34and not just individuals' plans, but also we fly a ton of cargo all over the world as well, right? So it's, it's quite a. So it's quite a bit to deal with. And like you're on the security side of the world, right? And there's like a whole universe of operations folks that are keeping the airline up and running. What is your collaboration like with that team? And you spoke about, you know, potential outages from a resiliency standpoint. How do you look at that play out between security and then the rest of the operations? Yeah, good question. So for those who don't know, we actually have what we call a network operations center that sits in. chicago and i'll say at any given point there's like a thousand men and women that are sitting there in this it's it's massive um this massive i'll say warehouse um with i don't know how many thousands of screens sitting in there right and they are running like every aspect of the operation um it's actually really cool to do we actually um actually like uh auction off tours and stuff if you want to use your miles to go check it out it's pretty pretty interesting and we work with them continually right so like when i came in about six years ago i wouldn't say there wasn't really that creative a partnership but um we've done drills that frankly we talk about the whole network operations center when something turns into a crisis maybe a cyber crisis or maybe something else um the network operations center turns into uh as i say the emergency operations center right so we drill that routinely um consistently constantly

5:07we try to learn from those. I'll say there's those trainings. And then unfortunately, right, we do have actual issues that come up every so often. And I think like hopefully any good organization, we take those learnings, we take them to heart. We have tons of review meetings out of them. And we just continue to kind of iterate on how we ideally won't have those issues in the future. Right. Yeah. And it's a great partnership. I'll just say that. That's amazing. And if there's somebody coming in from the outside, side into your industry you've been united for a long time now you're part of aviation isaac what would surprise an outsider coming into the aviation industry especially from a security standpoint what's a unique thing about your industry that you don't think other people realize you know i was kind of talking about that this morning maybe in a meeting i had and you know i think maybe what makes us a little bit special people always and i'm a former general electric individual and i was very worried about intellectual property and when i came here it was a lot more the operations and then also you know mobile and dot com as we call it lovingly right very trafficked properties that we have to defend and keep up and running and even though it's not i'll say 99 of the time it's not a security issue i still have my security team on the calls with the business with our it partners um looking through everything trying to figure out what's going on because again the last thing i want to have happen is an impact to the operations so i think at united we take it very

6:42seriously and it's never uh that's not my problem i'm not going to go help out it's like you know what i might have that little nugget of information here that could actually help folks understand what's actually going on maybe avert a bigger issue so to me i think that's probably the more interesting thing it's just the the dedication that our teams have to the operation and making sure we keep people in cargo flying safely. That's amazing. And we, through the course of the day today, we've heard different talks about how AI and agents are going to change the workforce. We spoke about 113,000 employees, if not more. The future may have a million or billion agents that are working on things. How do you see your team changing? How do you see...

7:29an airline like united changing and how does your job change with that good gosh that's a lot um so it's a lot so and and i think just being recorders hopefully my folks will watch this um so first and foremost like i just got off vacation uh i actually burned through all my tokens i actually ran out of tokens because i was building stuff for myself right i was building an orchestration agent i was building a bunch of sub agents right and i say that because like i'm all in on ai right i it truly is the future, and we need to embrace it, and it's fantastic what you can do with it, right? So just from a, I'll say a cybersecurity lens, like I'm all in, we've been deploying bits and pieces of the agentic SOC, right? Building on a lot of the great work that we've done with SOAR, which is very deterministic, and now doing some non-deterministic work.

8:17We are also talking about things like Red Team, I think you and I were chatting about that earlier, right? So we built some stuff internally, some different harnesses, and then we're also partnering. some some great folks like Arminen um if you've heard of them right uh and then you know i think everybody knows like vulnerability hunting and all that good stuff right um it's with mythos and the mythos moment from from a while ago so i say that because like if you can't hear the excitement and the stuff i'm talking about we are all in on it and that's just a piece of it right so that's i'll say cyber security right but there's also the i'll say the the it the digital technology piece right we're all in on that as well. And then we've also looked at it through a couple other lenses. One, we're calling it everyday AI, and I swear I have a meeting on this every day, but, you know, it's just how do we empower our workforce to leverage AI?

9:03And I'll just, you know, quick nugget there is I have learned and appreciated so much more of the concept of data protection when you're rolling out AI just across the board, right? So if you don't have your data protection, um team in place if you don't have that set up straight um you're gonna be in for a world of hurt so um that's a huge piece for us and then lastly the two other pieces i would talk about i mentioned mobile and dot com right so i think about our commercial aspects right so how can we better enable our customers maybe give you some cool ideas on where you want to fly where you want to go uh and then lastly you know we've been talking about the operation a good bit but how do we use ai to help augment the work those thousand plus folks that are doing up in Chicago, how do we augment that work?

9:55And instead of them making like the hundred decisions that they're just used to doing and they've learned the playbooks and they know all the rules of engagement, so to speak, that we have, how can we help them make those decisions quicker? Like kind of keep that human in the loop and go, you know what, that looks right, approve. And then ideally when we're in what we call IR ops or regular operations, which is when. there's weather or maybe uh there's a computer issue whatever might happen um how do we get from ir offset is maybe impacting us how can we like soften that blow and make things a lot easier right because there's a lot of repercussions to a lot of decisions we don't need to get into that whole another conversation but yeah and what's interesting when we compare our organization at cloudflare 100 of the company uses ai everybody's building everybody has the tools available to them on united's front is it a central team that is building out RISM processes for the rest of the company to use?

10:52How is that progressing? Or are there multiple teams in some companies? Yeah, it's kind of a mix, right? So I think we rightfully did, I'll say a couple of years ago, we started with a responsible AI governance body, right? And it's a cross-functional collaborative. group right so we get together we really kind of manage how we want to roll out and manage ai across the board so when things like deep seek come out we actually had the vehicle already where we said hey emergency meeting we're going to get you know you're 20 people in a room we're going to explain the issue and then we're going to make a an executive decision essentially right are we going to allow you know say chinese models to to be in our environment or not so we had that structure in place and then if we move forward especially this year i feel like like I woke up in January and it was like, yeah, AI is cool.

11:41And then like February, March, like if I go back and look at my calendar, it's just completely changed. Right. Uh, and I swear every meeting I have is AI based. So there are, I'll just say different groups that are, um, focused on the different aspects that I kind of talked about. Um, but there's not necessarily, while there might be a governing body, so to speak, it's not necessarily one group that's just doing all the work. It's really, how do we empower all our employees, um, and give literally thousands of access to things like Microsoft Co -Pilot, Microsoft Co -Pilot Co -Work, Microsoft Studio, Claude, CLI, et cetera, et cetera. There's just, it's a lot, right, to manage and look at. You and I were talking about you doing a trip to Singapore for vacation.

12:28A friend of mine who's a big United frequent flyer took the flight from San Francisco to Singapore, West City. On our new plane, by the way. On the new plane. on the new 7a and they have starlink yeah and are there any recent united converts here because of in -flight wi -fi yeah so in -flight wi -fi obviously was a big topic on twitter recently united landed on the good side of it tell us more about how you look at starlink from a security standpoint because from my simple perspective there's three groups essentially that are using in-flight wi-fi there's passengers this true attendants pilots there's ops i'm assuming so there's all of these like crazy stories that you read on the internet about the hacking a plane tell us more about that from a second oh my gosh i mean you kind of just you kind of summed up a little bit so first off anybody use starlink yet i saw a couple hands like on the plate it's amazing isn't it right yeah i i still like the flight that i do a lot didn't have starlink for the longest time and everybody's like oh it's a mistake i finally got it and like oh my gosh This is like game-changing.

13:35And now I have like a whole setup going. And I don't know if anybody saw, there was like one gentleman who had like five screens watching like college football one day. This is pretty cool. It's game-changing. So for us, when it comes to a security standpoint, one, I will say, you know, we have a vulnerability disclosure program. The planes are off limits. So if you are sending us stuff, it's like you're not supposed to. to be doing that like you're committing crimes so um i say that lovingly because we do get reports and trust me we're working on stuff behind the scenes we're working with our vendors and our partners um to make sure we do that and then yeah we actually um i would also say there's also that sense i think people are like hey i got a i got a linux uh prompt here so that means i can hack into the plane and fly it i'm like that's not how it works right um you know these networks are segmented right they're built properly by Boeing and they have these massive spec sheets, like safety is the number one priority, right? When it comes to aviation. So it's not how it works.

14:34And then, yeah, when you actually get into the nuts and bolts of it, right? There are, you know, our customers, right? Who want to use Starlink, they want to play video games. I also hear the folks say, yeah, I joined a Teams meeting. And I'm like, you are not supposed to join Teams meetings, right? That's the other thing. You should not be doing, taking meetings from, you know, 36,000 feet. But the other side of the coin is, you know, how do we also make sure our, you know, our crew are taken care of and they can, because we have so much technology that's on the, on the plane. And if you've ever seen them walking around with like the little handheld devices or called links or maps, right, depending on which one they're using, those are connected in through Starlink, right? So we have essentially segmented networks that way we're not like cross -talking or having challenges.

15:23And then we're actually using you guys to do some. And we had to learn this ourselves, but like to essentially do like DNS filtering, right? It sounds old school, but that's how it works, right? To actually figure out like who can do what and who can go to where, right? And for people trying to get onto Teams calls and trying to do WhatsApp calls, if you're blocked, that's because of Cloudflare. So don't sort of throw hate at us, but just wanted to let you know. We have just a few more minutes left. So let me ask you one last question. question, knowing what you know about security and airlines, what makes you feel secure when you fly? And considering all of the chaos that is happening in the world today about agent swarms and everything else, what makes you feel as secure to get on a plane?

16:09And first off, agent swarms is a whole other conversation. That's, man, we're all in. We all have work to do. I'll just put it that way. And that's why we stay. business, right? And that's why we're at conferences like this, we can learn from each other. But I digress a little bit on buying time. The, I think the reality is, you know, I mentioned a little earlier around the network operations center. And if there is some crisis that happens, it turns into the emergency operations center. And that is an all hands on deck. And I was joking with the lady back there. I'm like, I have to turn my phone off because I'm like the department lead. I own the, chair for cybersecurity. and my phone has the worst alarm because it it can be two in the morning three and one it does not matter i have to get up i have to be on that call instantly and what i've learned on those calls over you know six years and fortunately we don't have as many as um probably folks think but is no matter what's going on in our corporate network or corporate environment or you know back to kind of the starlink and like the segmentation of the the networks that the reality is like the planes, they'll be all right, right? We can land those things safely.

17:18The pilots are very well trained, right? They know what they're doing. And I think we were joking a little bit about like, you know, hitting the button on a Tesla and kind of auto drives, which is great. And I'm sure a lot of us just think, oh, it's autopilot and the plane is like, no, something truly happened. There's so many redundancies built into the aviation sector and the business and operations and how we do things. resiliency, redundancy, failover, and safety, I can't stress safety enough, is really the most, it's like the North Star. It's the guiding thing that we have out there. So again, even if there is some, and I hope it never happens, some major cyber attack, no, we're still going to be able to land our planes safely and get people, you know, on the ground. Let me end with this.

18:08I know you guys are all at Aviation ISAC in Vancouver about a week or two months ago. Should we see it or something like that? And So what's the biggest topic that you heard about at Aviation Eyesight? What is the thing that aviation as an industry is worried about or thinking about? I mean, I helped curate the whole thing, but I kind of know what the theme was. But it was AI, right? You just saw my face. We were talking about swarms of AI agents. And heck, I think there's been, gosh, when I was actually in Asia, I think it was. what korea and i think japan's they're they're getting you know hit pretty hard and pretty badly over there um and then i think uh i know there's i'll just say i'm very privy to some calls happening this week um to talk about ai hitting a lot of different sectors and companies right so um to me especially being critical infrastructure providers there's a huge way to make sure that we can um keep you know people in cardo flying safely um and ai is really it's been a huge paradigm shift and you know it's very unfortunate i think some people looked at it you know when it was coming out and even earlier this year and they're like nah it's not a big deal mythos nah don't worry about it's like you know even if it's not mythos like some of these frontier models some of these open weight models they are extremely capable and you know i mentioned arm it in for a minute i'll plug them a great group of folks over there they're not using mythos they just have engineered their way into

19:39a very nice I'll say organization a way of looking at things so if they can do it and they're fantastic people they're the good guys trust me the bad guys can do this as well right that's what keeping me up and I think from an AVH perspective that's what we need to really focus on right now yep that's a good note to end on thank you so much Sean appreciate it thank you