How AI Driven Analytics Empower Saudi Arabia's Cyber Future

How AI Driven Analytics Empower Saudi Arabia's Cyber Future

Speakers: Pete Harteveld, President & CEO, Exabeam

Conference: Black Hat MEA

YouTube: https://www.youtube.com/watch?v=EBky-K-mZZI

Overview

In a rapidly evolving global landscape where cyber threats are not merely technical challenges but significant economic and national security forces, Pete Harteveld, CEO of Exabeam, delivered a compelling keynote at Black Hat MEA. His talk, "How AI Driven Analytics Empower Saudi Arabia's Cyber Future," illuminated the critical role of intelligent analytics in fortifying national resilience, empowering security teams, and safeguarding the digital foundations of nations undergoing profound transformation. Harteveld specifically addressed Saudi Arabia's ambitious Vision 2030, which is driving an unprecedented acceleration of digital initiatives across smart cities, digital government, advanced finance, and national infrastructure.

The core of Harteveld's presentation revolved around Exabeam's AI-driven security operations solutions, emphasizing a unique blend of machine learning and artificial intelligence to address the escalating complexity of cyber threats. A pivotal theme was the emergence of Agentic AI—AI systems capable of taking autonomous action—and the profound implications this technology holds for both productivity and security. Harteveld argued that securing the digital future, especially in regions experiencing compressed technology adoption cycles like Saudi Arabia, demands a strategic shift from merely spending more on cybersecurity to investing wisely in technologies that enhance efficiency, accelerate response, and manage the burgeoning threat landscape introduced by AI itself.

This talk is particularly pertinent for security professionals, policymakers, and business leaders grappling with the dual challenge of harnessing AI's transformative power while simultaneously mitigating its inherent risks. Harteveld's insights offer a roadmap for how organizations can leverage advanced analytics to baseline normal behavior, detect anomalous activities with high fidelity, and effectively manage the security implications of a workforce increasingly augmented by intelligent agents. By framing Agentic AI agents as new digital identities, Exabeam proposes a pragmatic and scalable approach to securing the next frontier of enterprise computing.

Background

▶ Watch: Saudi Arabia's Vision 2030 and cybersecurity foundation (0:00)

The digital transformation sweeping across the globe presents both immense opportunities and formidable cybersecurity challenges. In the Kingdom of Saudi Arabia, this transformation is occurring at an accelerated pace, fueled by Vision 2030. This national blueprint aims to diversify the economy and develop public service sectors, necessitating a robust digital infrastructure that underpins everything from smart cities and digital government services to advanced financial systems and critical national infrastructure. Consequently, cybersecurity is not merely an IT concern but a foundational pillar for achieving these ambitious national objectives.

Harteveld highlighted a unique dynamic in Saudi Arabia: the simultaneous adoption of cutting-edge AI technologies alongside the management of existing legacy infrastructure. Unlike other geographies that experienced protracted timelines for technological evolution—moving from mainframe computing to open systems and then to cloud computing over decades—Saudi Arabia faces compressed timelines. This necessitates a strategy to seamlessly blend the old with the new, maximizing existing investments while integrating advanced capabilities to keep pace with rapid change. This compressed timeline also means a reduced opportunity to organically build the necessary skills and capabilities over time, exacerbating the global shortage of cybersecurity professionals.

The cybersecurity industry itself is struggling with an exponential increase in threats and an overwhelming volume of alerts, leading to alert fatigue and decreased efficiency in Security Operations Centers (SOCs). Traditional security approaches often involve massive data ingestion into Security Information and Event Management (SIM) solutions, but without intelligent analysis, this can overwhelm human analysts. Prior work has focused on improving detection mechanisms and automation, but the advent of sophisticated AI introduces a new layer of complexity. General AI (Gen AI) has already begun to surface information, aiding in analysis, but the next evolution, Agentic AI, promises to take action autonomously. This capability, while offering unprecedented productivity gains, simultaneously expands the attack surface and introduces novel security challenges, particularly around identity management and behavioral monitoring for non-human entities. The problem, therefore, is not just about detecting known threats, but about understanding and securing a dynamic environment where intelligent agents operate alongside human users, often with the same credentials and access.

Key Findings

▶ Watch: KSA's challenge: blending AI with legacy infrastructure (4:00)

Exabeam's approach to empowering Saudi Arabia's cyber future is predicated on several key findings and technological advancements:

1. Unique Blend of Machine Learning and AI: Exabeam distinguishes itself by integrating machine learning (ML) capabilities, refined over 14 years, with advanced artificial intelligence (AI). This blend enables the system to baseline what is normal behavior within an organization—across users, devices, and applications. By understanding "normal," the platform can rapidly identify "abnormal" activities, assess their rarity, and determine their business criticality. This approach directly addresses the challenge of alert fatigue by focusing SOC teams on the most impactful threats, leading to outcomes-based security.

1. Significant Productivity and Efficiency Gains: Internal benchmarking within Exabeam's own SOC, which serves as a proving ground for their technologies, demonstrated an 80% improvement in analyst productivity and efficiency. This substantial increase in throughput is critical for organizations facing a shortage of skilled cybersecurity professionals, allowing existing, often "skinny," SOC teams to handle a much larger volume of security events effectively. Furthermore, the adoption of Agentic AI within Exabeam has shown an average 5-hour improvement in productivity and efficiency per individual per week across over 500 employees, highlighting the transformative potential of these agents.

1. The Proliferation of Digital Identities through Agentic AI: Harteveld underscored a critical emerging challenge: the exponential expansion of digital identities due to Agentic AI. If a thousand-person organization were to adopt, on average, seven Agentic AI agents per employee, the number of identities requiring management and security could skyrocket to 8,000 in a matter of months. This rapid proliferation creates an enormous and unmanageable burden for traditional identity management and security operations, significantly expanding the threat landscape.

1. Securing Agentic AI as Digital Identities: Exabeam's core contribution to addressing the Agentic AI challenge is the paradigm shift to treating these agents as digital identities, no different from human insiders. Recognizing that an agent, like a human, can be malicious or compromised, Exabeam, in partnership with Google, has developed the capability to secure Gemini Enterprise Agentic AI agents. This allows security operations teams to monitor and manage Agentic AI agents using the same frameworks and tools applied to human users, effectively extending insider threat detection to non-human entities.

1. Flexible Deployment Models for Diverse Environments: Acknowledging the varied technological landscapes, particularly in Saudi Arabia with its mix of legacy and modern systems, Exabeam offers flexible deployment options. Organizations can choose SIM augmentation, integrating Exabeam's cloud-based insider threat capabilities on top of existing SIM solutions without a "rip and replace" overhaul. Alternatively, a full-stack capability inclusive of SIM and insider threat technologies is available, providing organizations the flexibility to maximize prior investments or transition to a completely new platform.

These findings collectively point towards a strategic imperative for modern cybersecurity: leveraging advanced AI and ML to understand normal behavior, significantly boost analyst productivity, and proactively secure the new frontier of Agentic AI by treating these intelligent agents as integral, monitorable identities within the organizational fabric.

Technical Deep Dive

▶ Watch: Baselining normal behavior for effective threat detection (6:00)

Exabeam's technical approach to cybersecurity, particularly in the context of Saudi Arabia's unique challenges and the rise of Agentic AI, is rooted in its sophisticated application of machine learning and artificial intelligence. The company's core offering is an AI-driven security operations solution designed to move beyond traditional alert-centric security to a behavioral analytics model.

At the heart of Exabeam's platform is its ability to baseline normal behavior. This is achieved through proprietary machine learning algorithms, honed over 14 years, that continuously analyze vast datasets of user, endpoint, and application activity within an organization. By processing logs and telemetry from various sources—including network devices, servers, applications, and existing SIMs—the system learns what constitutes typical activity for every entity. This includes understanding login patterns, data access, application usage, network connections, and even the time of day and location from which activities typically originate.

Once a baseline of "normal" is established, the system can then rapidly identify abnormal behavior. This isn't merely anomaly detection; it's a nuanced assessment that considers the context and potential impact. When an anomaly is detected, Exabeam's AI capabilities come into play to derive two critical metrics: the rarity of the situation and its business criticality. Rarity quantifies how unusual an event is compared to the established baseline. Business criticality assesses the potential impact of that event on the organization, considering factors like the sensitivity of the data accessed, the privileges of the user/agent involved, and the potential for lateral movement or data exfiltration. This intelligent prioritization allows SOC teams to focus their efforts on the threats that pose the greatest risk, moving from a reactive, alert-driven model to a proactive, outcomes-based security posture.

The talk introduced a crucial evolution in AI: from Generative AI (Gen AI) to Agentic AI. Gen AI, prevalent about 18 months prior to the talk, primarily focuses on surfacing information—generating text, images, or code based on prompts. While useful for analysis and content creation, it generally does not take autonomous action. Agentic AI, however, represents a significant leap forward. These agents are purpose-built to take action on behalf of a user or system, interacting with applications, data, and other systems independently to achieve defined objectives. Harteveld illustrated this with his personal use of seven different Agentic AI agents that operate using his credentials, performing work on his behalf.

Exabeam is developing six specific Agentic AI agents designed to enhance the capabilities of security operations teams. These agents are intended to augment human analysts, making them more effective and efficient by automating routine tasks, correlating disparate data points, and accelerating investigations. The challenge, however, is securing these agents. As Harteveld emphasized, "any agent is no different than a human. It can be malicious and it can be compromised."

To address this, Exabeam has partnered with Google Gemini Enterprise Agentic AI platform to integrate security capabilities that view each Agentic AI agent as a distinct digital identity. This means that the same robust identity and access management (IAM) and insider threat monitoring frameworks applied to human employees are extended to AI agents. Exabeam's platform can track the activities of these AI identities, establish their baseline "normal" behavior, and detect anomalous actions that might indicate compromise or malicious intent. For example, if an AI agent typically accesses specific data repositories or performs certain administrative tasks, any deviation from this pattern—such as accessing highly sensitive data it has never touched before, or attempting actions outside its established role—would trigger an alert, assessed for rarity and criticality. This enables security teams to manage the proliferation of AI agents without compromising security, treating them as sophisticated, albeit non-human, insiders.

Regarding deployment, Exabeam offers flexibility crucial for markets like Saudi Arabia. The SIM augmentation model allows organizations to leverage their existing investments in traditional SIM solutions. Exabeam's cloud-based insider threat capabilities, powered by its AI/ML analytics, can be layered on top of these existing SIMs, providing advanced behavioral analytics without requiring a complete overhaul of the security infrastructure. This is particularly beneficial for organizations with significant on-premise legacy systems. For those seeking a more comprehensive transformation, Exabeam also provides a full-stack capability that includes both its SIM and insider threat technologies, offering an integrated, AI-native security operations platform. This dual approach ensures that organizations can adopt Exabeam's advanced analytics regardless of their current technological maturity or infrastructure preferences.

Demo / Proof of Concept

▶ Watch: Securing exponential Agentic AI identities: a growing challenge (13:00)

While the keynote itself did not feature a live, interactive technical demonstration or a traditional proof of concept, Pete Harteveld provided compelling evidence and validation points for Exabeam's capabilities and strategic direction. These "proof points" served to illustrate the tangible benefits and the efficacy of their approach, particularly in the realm of AI-driven analytics and Agentic AI security.

One significant validation came from Exabeam's own internal operations. Harteveld proudly stated that their internal Security Operations Center (SOC) serves as a "proving ground" for their technologies. Through benchmarking, they observed up to an 80% improvement in an analyst's productivity and efficiency when utilizing Exabeam's machine learning and artificial intelligence capabilities. This substantial increase demonstrates the practical impact of their AI-driven analytics in real-world security scenarios, allowing "skinny" security teams to achieve significantly higher throughput.

Further evidence of the power of AI, specifically Agentic AI, was drawn from Exabeam's internal adoption. Harteveld revealed that over 500 individuals across their organization engage with their Agentic AI capabilities weekly. This internal deployment resulted in a measured five-hour average improvement to productivity and efficiency for each of these individuals. This personal endorsement from the CEO, who himself uses seven different Agentic AI agents daily, underscores the immense benefits these technologies offer, while simultaneously highlighting the critical need for their secure implementation.

Perhaps the most crucial "proof of concept" regarding the security of Agentic AI was the announcement of Exabeam's partnership with Google. In September of the previous year, Exabeam publicly announced its ability to secure Google Gemini Enterprise Agentic AI agents. This partnership signifies a concrete step towards implementing their vision of treating AI agents as digital identities. It validates Exabeam's capability to extend its behavioral analytics and insider threat detection frameworks to autonomous AI entities, allowing security teams to monitor and manage them "much in the same exact way that my security operations team would see Pete Harteveld develop." This strategic collaboration with a major AI provider like Google provides strong credibility to Exabeam's approach to securing the rapidly expanding Agentic AI landscape.

Collectively, these internal benchmarks and strategic partnerships serve as robust validations of Exabeam's technological advancements and strategic direction, showcasing real-world productivity gains and a viable solution for the complex challenge of securing AI agents in an enterprise environment.

Defensive Implications

▶ Watch: Future threat: collaborative, autonomous Agentic AI agents (17:00)

The insights shared by Pete Harteveld carry profound defensive implications for organizations, especially those in regions undergoing rapid digital transformation like Saudi Arabia. Adapting to the rise of AI-driven threats and the proliferation of Agentic AI agents requires a strategic re-evaluation of current cybersecurity postures.

1. Extend Identity and Access Management (IAM) to AI Agents: The most critical defensive implication is the need to recognize and manage Agentic AI agents as distinct digital identities. Traditional IAM systems focus solely on human users. Defenders must now extend these frameworks to include every AI agent operating within the network, assigning them unique identities, managing their credentials, and defining their access permissions based on the principle of least privilege. This necessitates a shift in thinking, where an AI agent is treated with the same scrutiny as a human employee, subject to the same security policies and monitoring.

1. Implement Advanced Behavioral Analytics for All Identities: Relying on signature-based detection is insufficient for sophisticated AI-driven threats and anomalous agent behavior. Organizations must deploy advanced User and Entity Behavior Analytics (UEBA) or similar AI-driven analytics solutions like Exabeam's that can baseline "normal" behavior for all identities—both human and AI agents. This allows for the detection of deviations that signify compromise or malicious activity, even if the activity itself is novel or exploits zero-day vulnerabilities. The ability to derive rarity and business criticality from these anomalies is paramount for prioritizing response.

1. Proactive Insider Threat Programs for AI Agents: The concept of an "insider threat" must expand to include AI agents. Since an Agentic AI agent can be compromised or potentially act maliciously, organizations need robust insider threat programs that monitor the behavioral patterns of these agents. This involves continuously tracking their data access, command execution, and communication patterns, looking for any indicators that deviate from their established operational norms. This proactive monitoring is essential to prevent internal breaches facilitated by compromised AI.

1. Augment Security Teams with AI, Don't Replace Them: Given the severe global shortage of cybersecurity professionals, organizations should strategically leverage AI, particularly Agentic AI agents, to augment existing security operations teams. By automating routine tasks, correlating alerts, and accelerating investigations, AI can significantly boost the productivity and efficiency of human analysts, allowing them to focus on complex threat hunting and strategic initiatives. This scales human capability without requiring an impossible increase in headcount.

1. Strategic Investment in Outcomes-Based Security: Rather than simply increasing cybersecurity spending, organizations must invest wisely in solutions that deliver measurable outcomes. This means prioritizing technologies that reduce alert fatigue, improve detection accuracy, accelerate response times, and provide clear visibility into the most critical threats. Solutions that can blend with existing infrastructure (e.g., SIM augmentation) are crucial for maximizing prior investments while integrating cutting-edge AI capabilities.

1. Develop a Strategy for Blending Legacy and Modern Technologies: For nations like Saudi Arabia with compressed technology timelines, defenders must devise comprehensive strategies for integrating modern AI-driven security solutions with existing legacy systems. This involves selecting platforms that offer flexible deployment options, ensuring interoperability, and planning for a gradual transition rather than disruptive rip-and-replace cycles.

1. Prepare for Collaborative AI Agent Threats: Harteveld warned of a future where Agentic AI agents can work together across disciplines 24/7, exponentially increasing their impact. Defenders must anticipate this evolution by building adaptive security architectures that can identify and respond to coordinated attacks originating from multiple compromised AI agents. This will require even more sophisticated behavioral analytics and potentially AI-driven defense mechanisms that can counter emergent AI threats.

In essence, the defensive posture of the future must be AI-informed, identity-centric (for both human and non-human entities), and agile enough to adapt to the unprecedented pace of technological change and threat evolution.

Key Takeaways

• AI is indispensable for modern cybersecurity: Rapid digital transformation, exemplified by Saudi Arabia's Vision 2030, necessitates strategic investment in AI-driven security analytics to build resilience and accelerate response against increasingly sophisticated cyber threats.
• Agentic AI fundamentally alters the threat landscape: While offering immense productivity gains (e.g., 5-hour weekly improvement per individual), Agentic AI agents exponentially expand the number of digital identities within an organization, creating a new, vast attack surface that traditional security models are ill-equipped to manage.
• Secure Agentic AI by treating agents as digital identities: The most effective defense against compromised or malicious AI agents is to manage and monitor them as distinct digital identities, applying the same principles of identity and access management and insider threat detection used for human employees.
• Baselining "normal" behavior is critical for effective detection: Exabeam's blend of machine learning (honed over 14 years) and AI enables organizations to baseline normal user and entity behavior, allowing for rapid identification and prioritization of abnormal activities based on rarity and business criticality, significantly reducing alert fatigue and improving SOC efficiency by up to 80%.
• Flexibility in deployment is key for diverse environments: Security solutions must accommodate varied technological landscapes, offering options like SIM augmentation for integrating advanced analytics with existing legacy systems, or full-stack platforms for comprehensive new deployments.
• Strategic, AI-driven investment outperforms increased spending: The future of national and organizational cybersecurity relies not on simply spending more, but on investing wisely in AI-driven technologies that enhance efficiency, scale human capabilities, and proactively secure the evolving digital frontier.

About the Speaker(s)

Pete Harteveld is the President and Chief Executive Officer at Exabeam, a leading provider of AI-driven security operations solutions in the market today. Under his leadership, Exabeam boasts over 3,000 customers globally, delivering its solutions both on-premise and in the cloud, with specific capabilities for cloud hosting within Saudi Arabia. Exabeam has also maintained over 15 years of combined Gartner Magic Quadrant leadership, being named a leader in their most recent report in November.

Harteveld emphasized Exabeam's significant investment in the Saudi Arabian market, establishing a full complement of team members including sales representatives, solution engineers, engineers, marketing, and customer success individuals. He also announced an expanded office and the establishment of a Customer Innovation Briefing Center in Saudi Arabia, designed to introduce new capabilities, serve as a hub for university students and partners, and accelerate understanding of the cybersecurity world. His insights reflect a deep understanding of the unique challenges and opportunities presented by Saudi Arabia's rapid digital transformation under Vision 2030.