NVIDIA Corporation (NVDA) Earnings Call Transcript & Summary

Thank you for joining us today. My name is Killian Sexsmith. I am based in Austin, Texas. And I am the Segment Sales Lead for Morpheus, NVIDIA's cybersecurity solution. With me today, I have Pahal. Pahal, do you want to introduce yourself?

Hello, everyone. Good to be here and present Morpheus to you when it comes to financial services. Pahal Patangia, I lead developer relations for fintech and consumer finance at NVIDIA and responsible for growing adoption of accelerated computing, machine learning and data science within financial services.

Thanks, Pahal. We're excited to talk to the FSI community today. Morpheus is a cybersecurity solution, and we have much to discuss. The agenda today: we will go over some of the cybersecurity challenges; why organizations are approaching cybersecurity with artificial intelligence; our architecture and how that integrates into the broader ecosystem; some of the most popular cybersecurity AI-driven use cases; as well as next steps for you to get involved and get access to some of the technology. So with no further ado, let us discuss some of the challenges. It should be no shock to anybody listening that data center traffic is exploding at an astronomical rate. We see more things connected every day, targeting 1 trillion connected things, 5 billion Internet users, 221 zettabytes of data and the cost of cyberattacks are only growing. The reason why we're bringing this up is that we at NVIDIA see cybersecurity fundamentally as a data problem. We're in a relatively unique position to apply our artificial intelligence and acceleration technologies through this data to give the cybersecurity analysts, the SOC analysts more of a head start and more insight into the data that they already have as well as give them the ability to look at all of the data as opposed to only examining data after a breach has occurred or possibly examining the data with a rules-based engine or regex, which is not that difficult for attackers to get around. Using AI, we get a different view into potential attacks, and that enables our SOC analysts to better prepare and better combat the nefarious actors. You may hear zero trust in the realm of cybersecurity. It is a key driver for a lot of our customers, particularly those in the public sector. But really, the idea here is that there are a lot of transactions going on within your data center, within your cloud environment, at the edge. We have applications in a constant state of flux. We have users, devices, data and applications all moving about, and we can't trust something like perimeter security. When somebody logs in, we can't just give them access to everything and assume that they are that person, We need to trust but verify. So after authentication, it's incumbent upon us as cybersecurity-focused folks to look at that behavior and ensure that we're constantly validating that, that person is who they say they are and those credentials have not been compromised. NVIDIA Morpheus, our cybersecurity framework, is uniquely positioned to do this in the fact that it's a lightweight framework that can be deployed anywhere. So whether it's in the cloud, on-prem, at the edge, we have maximum flexibility, so you can enforce your zero trust principles wherever makes the most sense for your organization, ideally as close to where the data is coming in, so we can get that early view on potential attackers and nefarious actors and ensure that we're able to thwart them before they have a chance to launch their secondary attack. So like I said, cybersecurity is really a data problem. We're looking at a high velocity of data streams, heterogeneous and complex data, competing demands on a small group of people. The cybersecurity analysts are, frankly, buried in alerts for the most part. Wading through the sea of false positives and noise is a significant challenge. So the application of artificial intelligence does a couple of things. It enables us to get those better insights into the data that we currently have, and it's also becoming almost a pre-requisite since attackers are using artificial intelligence in their attack strategies. Obviously, GenAI is an extremely popular topic right now. We'll touch more on our approach with that as we go. But basically, the point here is that being a data problem, to get that full 100% visibility on the data coming into the system, being able to analyze and get the type of throughput required for those insights, requires acceleration on the GPU. It requires the application of sophisticated models. It requires the type of skill set that doesn't really exist in the industry. And what we are doing with Morpheus is giving our ecosystem, our partners, our customers a tremendous leg up, a tremendous head start in being able to implement this and tackle the problem. So before going into the architecture and getting a little more technical, just from a broader ecosystem standpoint, we're not trying to be a full cybersecurity solution in the sense of competing with other vendors. We are very focused on the few things that we're doing and we're doing quite well, which again is analyzing the data, applying models to that data and seeing that type of acceleration through our pipeline in order to get that fast response and lessen the time to detect and remediate. So integrating with the ecosystem is our top priority, figuring out how we can better augment the existing solutions out there, the existing solutions that you have. This is kind of a key ethos of ours. So looking at this architectural diagram, building from the ground up, we're building on cloud, data center, edge, embedded systems. Basically, the only real hard requirement is that we have a GPU of Pascal or later in order to run Morpheus. Moving up from there, we have a few libraries: RAPIDS, Cyber Log Accelerator, Triton Inference Server and TensorRT. These libraries and frameworks are NVIDIA's. We, as the Morpheus team, basically add value here as an abstraction layer. We take advantage of all of these core frameworks and libraries, but we don't require the user or the developer or data scientist to be intimately familiar with any or all of them. We make it much easier to take advantage of the tremendous power of these frameworks and libraries through this abstraction mechanism, which basically boils down to an API or CLI interaction, where users and developers can kick off these pipelines, these cybersecurity pipelines. They can mix and match stages. They can use different models. They can pull from different data sources. And all of this is very easy to use in the sense of pulling data from a SIEM, a SOAR, an app log, a cloud log, network telemetry directly from the DPU, using the sensitive information detection, phishing detection, fraud detection, any of the use cases that we're going to dig into really is just a matter of coordinating the appropriate stages within the pipeline execution calls themselves. Now I don't want to oversell the simplicity. It does require some development skills in order to integrate these things if we want to do more complex activities like talk to a net new data source. But by and large, this is a very straightforward and simple-to-use framework that can be deployed anywhere that the situation dictates, agnostic as far as cloud, data center, edge deployments, et cetera, and we are data-agnostic. So if we are looking at particular data sources and you don't see them on the list on the left-hand side, that's not to say that we can't speak to them. It's just to say that we don't have a native integration built yet. But we're interested to hear from the community as to what those data sources may be. So please don't hesitate, type in the chat, let us know what your sinks and sources are. Feel free to reach out. We are very keen to work with the ecosystem and the community at large to build the next iteration of this and make it more useful to you. So how is Morpheus unique? So from a performance and scale standpoint, this is one of the key drivers and the key value propositions. We have a lightning-fast backbone built on reactive framework, and we have the ability to scale out. Obviously, GPUs are fantastic for this type of parallelization. When we're aiming for 100% visibility of data and analysis of that data as it comes in, this type of performance and scale is a differentiating factor and absolutely critical. As I kind of alluded to earlier, we have a very quick development and deployment paradigm. So in order to get operational with Morpheus, deploying it is very simple. We package this up as a container or in a Kubernetes manifest via Helm charts. You can also build from a source. But basically, we are easing the burden of having to learn a lot of the lower-level libraries with a simple-to-use API and CLI interface. Real-time telemetry, as it comes in, one of the key drivers here, again, is giving our SOC analysts as much warning as possible with good alerts, basically separating the signal from the noise as early as possible as the telemetry comes in. One mechanism to do this and one of our key integration points is with a BlueField DPU. This is not a firm requirement of Morpheus. Some of our use cases that we'll talk about, such as ransomware, do require integration with the DPU. The DPU actually houses a lot of the intelligence around that type of detection. But more broadly speaking, across the use cases, the DPU is an optional component. There is tremendous value there that we'll speak to in the context of the actual use cases as we get to them. And lastly, the cybersecurity use cases that we publish. We ship with quite a few models. We'll get into those as we go. These can be thought of almost as example models. We give you the head start with some training. Obviously, a model is only as good as the data that it has been trained on and the data it's inferring on. So we do recommend that customers don't just use this out of the box for the most part. They -- we will work with you to work on the training on your own data, ensure that that's constantly being improved and the model is ultimately not drifting from an accuracy standpoint or from a value standpoint. We want this to consistently be growing as the attack vectors are growing in the bad actor community. So I mentioned the reactive pipeline. Going a little bit deeper into this, the key value here and the reason why we're talking about it is that this pipeline is very good at a few things. I mentioned stages just very briefly. But all of the stages that go into a data pipeline, what this reactive pipeline does that underpins Morpheus is it's extremely good at repurposing resources to the stages that are under pressure. So ensuring that we have data constantly flowing through the pipeline can be a bit of a problem if one of those stages is potentially choking without enough resources. We are able to automatically reallocate resources from underused processes to the ones that are under pressure, using back pressure within the reactive framework and ultimately get that pipeline flowing with good data and making sure all of the stages are utilized and saturated. It does all of this automatically. There's nothing that the user has to do. It's just part of how our pipeline works. So let's talk about some of the use cases and attacks. Credential attacks are the most common entry point for attackers. Typically, they will compromise an account, move in, do some reconnaissance over the course of a few days or a few weeks or even longer and then execute their next series of attacks. It's at this point, where we have an opportunity as cybersecurity professionals to detect them early, not because they're necessarily breaking rules at that point, obviously compromising accounts is breaking rules, but from an account standpoint, they may just be poking around and doing things that aren't technically breaking any corporate rules. This is the most dangerous point because they can be in your system and you will not know it for days, potentially weeks. What we are doing with Morpheus is detecting those behavioral changes. So if I am constantly logging into, let's just say, 5 corporate systems today, always from Austin, Texas, always from a PC, and then suddenly, I'm logging into 50 corporate systems a day and possibly from a different geo IP, possibly from a different browser type, we would flag this as anomalous, not because I'm necessarily breaking any rules. There's no corporate rules against different browsers or logging in from a different location and I might have access to all of those corporate systems, but because it is abnormal. We effectively overfit each one of these auto encoder-driven models to the individual's behavior as it learns over a course of time. And as that behavior starts to fluctuate, we will create an anomaly score based on those users or machines, basically whoever owns that account from an authorization and authentication standpoint. As I mentioned, these exposed credentials, they lead to a number of other attacks, the number on the right-hand side of the slide here. 3.3 billion malicious log-in attempts over the course of the year is just astronomical. So it's really up to us to kind of assume that these breaches will take place and then work on what our secondary strategy is for identifying when an attacker is in the system and how best to combat them even before they're able to launch their secondary attacks. So talking a little bit more about digital fingerprinting, I will actually play a little video here where our Director of Engineering, Bartley, goes through the use case. [Presentation]

Excellent. So with that in mind, like I said, we -- as Bartley said, we actually experienced this attack last year. We since used -- this was before Morpheus was actually in the mix. It was in early access at the time. So we've since moved this to production. We have been using digital fingerprinting in that particular use case with the models, with the auto-encoder models retroactively against the data at the time of the attack. And we were able to validate that we actually were able to detect the attacker doing its reconnaissance quite a few days earlier than we did in real life. Unfortunately, Morpheus was not GA at the time, but it's certainly in production now. Again, the goal here is that 100% data visibility. There are just so many events. Being able to boil these down to 10 or 12 actionable alerts, actionable anomaly events that SOC analysts can look at and not just turn into background noise is one of the key value propositions of Morpheus. Let's move on to a different use case. So phishing is pretty common. Most folks know about phishing attacks. A lot of companies even test it by sending phishing attacks to their own employees to see how many are well trained. This affects 75% of organizations in the U.S. In 2020, 74% of attacks targeting these businesses were actually successful. It's a very common attack vector. 96% of social engineering attacks are phishing attacks, and the follow-up of that is pretty significant. It's the second most common form of breach, averaging $4.9 million per breach. Now that's -- those costs come in a number of ways, cost to the brand, the cost of downtime, cost of remediation, cost of potential ensuing lawsuits. It's extremely important for us to recognize this. Even though phishing is a relatively well-known attack, it is actually growing in prominence because of, oddly enough, a lot of the AI technologies in play. Attackers are getting better at using some of the GenAI technologies and techniques to create better phishing attacks, whether it's in the form of generic attacks or actual spear-phishing attacks, which we'll talk about in a second here. We work with Best Buy for quite a while now. They actually -- they've implemented Morpheus in their system, and we're able to see an improvement of accuracy in detecting phishing e-mails up to 96% while maintaining a low false positive rate. We have -- we've been now turning our attention to GenAI. Obviously, it's an extremely hot topic of the day. NVIDIA at large has a very comprehensive solution in the NeMo framework around creation of LLMs. Basically, the idea more broadly with GenAI is being able to create content and scale. This is particularly relevant in the cybersecurity ecosystem because the availability of labeled data, there's not a lot of it. People in cybersecurity obviously aren't willing to part with their data very readily. So finding labeled data sets, things that we can train models on is often quite difficult. We also have multiple different types of architectures and models out there. GenAI is not just LLMs. But when we're really looking at how we can apply this, we're looking at creating visible, labeled available data for these models to get better. And we can increase the ability for the resulting model to identify attackers simply with more prompt tuning on the base model, more -- adding more specifics that will help individual organizations tailor those models to the specifics of the attacks of the people that are working there and the situations that they encounter. So looking at spear phishing, the creation of this labeled data, as I said, is a bit of a challenge. So we've embarked upon this project work with the NeMo team, creating LLMs to go about creating this trove of generated phishing e-mails, specifically spear phishing. Spear phishing by definition is low volume, very targeted with high click-through. So they put a lot of effort into these to target specific roles, specific people, and being able to train against that is pretty difficult. But the attackers are actually using GenAI themselves, which means that we have to at least match them, if not exceed them, hopefully exceed them, in our ability to defend, again, using GenAI to do so. So this robust training is going to be iterative. We can train the model. We will have to consistently update it as we go in order to keep pace with attackers because they do not stand still. The multiple modalities, this kind of creates an adversarial approach, right, where we're working to ensure that the convincing e-mails are blocked, tracked, flagged, whatever the case may be, before they get through by focusing on things like the intent of the e-mail and a lot of the natural benefits that LLMs provide in this space. With that, I'll kick off yet another demo here. [Presentation]

And we will, of course, provide links as part of this. But for right now, let us -- I'm going to pass the baton to Pahal, who will take us through a couple more use cases here.