Latest / Cybersecurity Perspectives / S1:E5 - In 2025 AI assisted attacks used an average of 15 MITRE techniques, a year later its averaging 50

Transcript

S1:E5 - In 2025 AI assisted attacks used an average of 15 MITRE techniques, a year later its averaging 50 · Cybersecurity Perspectives

• 0:00
  SPEAKER_00: Cybersecurity moves fast.
• 0:02
  SPEAKER_00: Working in a space measured in minutes and seconds means we can't expect to keep pace by doing the same thing over and over.
• 0:08
  SPEAKER_00: The sharing of perspective across technologists, defenders, business, and professionals is key to unleashing internal capability.
• 0:16
  SPEAKER_00: Perspective comes from sharing experiences and ideas.
• 0:20
  SPEAKER_00: Welcome to cybersecurity perspectives.
• 0:26
  SPEAKER_02: So who does the intro?
• 0:27
  SPEAKER_02: Should we like change it every week, or is it should it just be you or me?
• 0:30
  SPEAKER_02: Oh we just play the music.
• 0:32
  SPEAKER_02: Well, yeah, but the music just played, like that's a different thing.
• 0:34
  SPEAKER_02: But then we have to like introduce the.
• 0:38
  SPEAKER_01: Yeah, well, right.
• 0:40
  SPEAKER_01: But what we should be like, hey, welcome, right?
• 0:42
  SPEAKER_01: Because we have our music.
• 0:43
  SPEAKER_01: We gotta think about this order of operation.
• 0:45
  SPEAKER_01: So like doo doo doo, then we have like the voiceover, you're like cybersecurity.
• 0:49
  SPEAKER_01: Not just dead there.
• 0:50
  SPEAKER_01: And then you're like, hey, hey, right?
• 0:52
  SPEAKER_01: So we gotta do some form of transition.
• 0:54
  SPEAKER_01: We have to have some form of intro.
• 0:55
  SPEAKER_01: Wow.
• 0:56
  SPEAKER_01: Right.
• 0:56
  SPEAKER_01: Now we've got to work out for next time.
• 0:58
  SPEAKER_01: Hi, welcome to Tuesday.
• 1:00
  SPEAKER_01: I like it.
• 1:01
  SPEAKER_02: Wednesday, Thursday?
• 1:02
  SPEAKER_02: I guess it'll depend on the then hi, everybody.
• 1:05
  SPEAKER_02: Welcome to Cyberney Perspectives.
• 1:07
  SPEAKER_02: How's everyone doing today?
• 1:08
  SPEAKER_02: Have you ever heard of Between Two Ferns?
• 1:10
  SPEAKER_02: I have.
• 1:11
  SPEAKER_02: This is between two cybers.
• 1:13
  SPEAKER_02: I like it.
• 1:15
  SPEAKER_02: Yeah.
• 1:16
  SPEAKER_02: Well, let's rebrand the whole podcast.
• 1:17
  SPEAKER_02: This would be amazing.
• 1:18
  SPEAKER_02: Let's keep noodling on that.
• 1:21
  SPEAKER_02: Awesome, man.
• 1:22
  SPEAKER_02: So how's the week been?
• 1:22
  SPEAKER_02: How's everything been going for you?
• 1:25
  SPEAKER_01: Uh good.
• 1:26
  SPEAKER_01: Um, as always, crazy, hectic, um, enjoyable.
• 1:29
  SPEAKER_01: I think the gamut of emotions, but um, that's life, right?
• 1:32
  SPEAKER_02: Yeah.
• 1:33
  SPEAKER_02: I'm not sure if that's a good thing or a bad thing.
• 1:35
  SPEAKER_02: Like we we keep trying to get more stuff to do, and we keep getting more stuff to do.
• 1:40
  SPEAKER_02: So this is starting to feel like a like a self-inflicted wound here at this point.
• 1:44
  SPEAKER_01: Yeah, I think back to where uh we were birthed from, right?
• 1:46
  SPEAKER_01: Is uh gluttons of punishment.
• 1:48
  SPEAKER_01: Um we we gotta just be punished somehow, some way.
• 1:50
  SPEAKER_01: But that's true.
• 1:51
  SPEAKER_01: That's good punishment, right?
• 1:52
  SPEAKER_01: And then yeah, things in the personal lives, right?
• 1:55
  SPEAKER_01: They always take over and we try to kick the personal lives aside for talus, and yeah, sometimes it works.
• 2:00
  SPEAKER_02: Amazing.
• 2:01
  SPEAKER_02: Well, I'll tell you, this week has been uh this week's been a little scary for me, man.
• 2:05
  SPEAKER_02: Like the thing that I've been worried about the most is like starting to really get mainstream news.
• 2:10
  SPEAKER_02: And this week, one of the main researchers who worked at both OpenAI and that anthropic basically resigned and was like, yo, this thing's gonna kill us all.
• 2:19
  SPEAKER_02: I'm out.
• 2:20
  SPEAKER_02: And that that's a little scary.
• 2:22
  SPEAKER_02: That's like the we're getting to the point where I'm very concerned we're gonna lose control of this thing.
• 2:27
  SPEAKER_01: How much of it is fear mongering?
• 2:29
  SPEAKER_01: So we still don't have the ability to pull plugs?
• 2:33
  SPEAKER_01: How much of this is entwined in the actual could it take down, say, the financial markets?
• 2:37
  SPEAKER_01: Right?
• 2:37
  SPEAKER_01: I to that extent, I don't think so.
• 2:39
  SPEAKER_01: I think people would be more than willing to go pull plugs before this catastrophic thing happens now.
• 2:44
  SPEAKER_01: Are there gonna be leakages?
• 2:45
  SPEAKER_01: Yes, right.
• 2:46
  SPEAKER_01: So this is what I'm trying to balance out between all of that.
• 2:48
  SPEAKER_01: I did read the same article.
• 2:50
  SPEAKER_02: Well, what was interesting is like the things that these articles that followed on with this guy's like resignation and announcement, you know, started to look at were like, how would AI take us down?
• 3:00
  SPEAKER_02: Like, what would be the issue?
• 3:02
  SPEAKER_02: And one of the things was not even AI itself.
• 3:04
  SPEAKER_02: This one of them was like the like the one the article I'm looking at, or was looking at, it had like probabilities for five different types of ways that AI takes us all down.
• 3:13
  SPEAKER_02: But the top way was not even AI, it was just the misuse of AI, right?
• 3:16
  SPEAKER_02: And specifically it was the misuse of bad actors using AI to accelerate the generation of chemical weapons.
• 3:21
  SPEAKER_02: So like that's a thing I've never even considered, right?
• 3:24
  SPEAKER_02: Like I've always considered like, yes, AI goes rogue, right?
• 3:26
  SPEAKER_02: You got the Terminator scenario.
• 3:28
  SPEAKER_02: And that was on there as well, right?
• 3:29
  SPEAKER_02: This whole thing of like it it continues to like self-improve and self-propagate and self-replicate, especially since it has access to the internet.
• 3:37
  SPEAKER_02: We know it can hack networks.
• 3:38
  SPEAKER_02: Like, that's the thing I expected.
• 3:40
  SPEAKER_02: I didn't think about this thing being like used to basically create a mass extension event because humans misused it.
• 3:47
  SPEAKER_02: Like that was a totally change, that was a total change of perspective for me.
• 3:51
  SPEAKER_01: I don't, yeah.
• 3:52
  SPEAKER_01: And that's what I struggle with, right?
• 3:53
  SPEAKER_01: Is I don't know if it's the humans' misuse of it or it's just humans using stuff in which they don't know the application of, right?
• 3:59
  SPEAKER_01: So I don't know if it's misuse, it's just on education, right?
• 4:02
  SPEAKER_01: Um, and it's the reliance within AI.
• 4:04
  SPEAKER_01: And there were other articles too that's out there that I was reading this morning that says, again, AI is gonna get really good at figuring ways in if you allow it, right?
• 4:13
  SPEAKER_01: And I think that goes back to the notion of guardrails and how quickly you're moving, right?
• 4:17
  SPEAKER_01: It was different with the cloud environment.
• 4:19
  SPEAKER_01: You can move there because it was limited in what its functionality or capability can.
• 4:23
  SPEAKER_01: So I think this notion of AI doing self-propagation and self-learning, yeah, that's I think that's a concern.
• 4:29
  SPEAKER_01: Um, to the extent, though, that it bleeds out across the board and can it do legacy systems, can it make jumps?
• 4:34
  SPEAKER_01: Like, I still think there's a lot to be done there.
• 4:37
  SPEAKER_01: Um, and then again, at the end of the day, hopefully too, there's gonna be some form of human or humanity intervention, right?
• 4:46
  SPEAKER_01: At the end of the day, we're gonna create AI and then it's gonna go off and start to do its own thing to an extent, right?
• 4:51
  SPEAKER_01: I don't think that there isn't this possibility of quote unquote good AI that would go out and search for bad AI and limit in which it does because AI theoretically needs a population in order for that to survive, right?
• 5:01
  SPEAKER_01: There's too many philosophical paths that we go down.
• 5:04
  SPEAKER_01: So if I try to bring it back into reality, what would this actually do and how would it actually truly impact and wipe out the human population?
• 5:11
  SPEAKER_01: I think that's a little extreme at this point, to be honest.
• 5:14
  SPEAKER_02: Yeah, I I understand that, right?
• 5:16
  SPEAKER_02: And I don't think it'll be a single like catastrophic failure that'll basically eliminate humanity from the planet.
• 5:22
  SPEAKER_02: But like if we're talking about things like financial markets, right?
• 5:25
  SPEAKER_02: If those were to tank and we fall into this like this dystopian place where everyone is bartering again, like that's gonna cause mass death and and it's gonna it's gonna truly impact like the world that we've built.
• 5:37
  SPEAKER_02: Good, bad, or indifferent, right?
• 5:38
  SPEAKER_02: Like, I don't know if that's a good thing or a bad thing.
• 5:40
  SPEAKER_01: But I just don't think that's gonna happen, right?
• 5:41
  SPEAKER_01: So we were thinking JP Morgan's or the chase of the world are gonna allow that to occur, right?
• 5:46
  SPEAKER_01: Like, no, 110% not, right?
• 5:49
  SPEAKER_01: Um, even if someone does drain a bank account or whatever, what does it actually mean?
• 5:52
  SPEAKER_01: Are there actually ledgers?
• 5:53
  SPEAKER_01: Are there any tying back to that?
• 5:54
  SPEAKER_01: Probably not, but that notion of that massive jump to take down the financial sector, I think is a really big one.
• 6:00
  SPEAKER_01: Uh, what was the the one movie?
• 6:02
  SPEAKER_01: Is it um War Games, in which I think it's like 1980s, in which again AI was doing nuclear basically proliferation and then attack, right?
• 6:11
  SPEAKER_01: It was all based off of a game, and then they ultimately did chess to get that hung up into a spun state in which it just basically fell, right?
• 6:18
  SPEAKER_01: Yeah.
• 6:19
  SPEAKER_01: So I I don't know.
• 6:20
  SPEAKER_01: Like I said, I do appreciate this particular resource speaking up and doing what they think is right.
• 6:26
  SPEAKER_01: That's what I found was amazing out of this article.
• 6:29
  SPEAKER_01: And that's why I also had a little bit of faith in humanity to not have it come to these levels of catastrophe in which human races wiped off the planet, right?
• 6:37
  SPEAKER_01: Um, so I would say more kudos to him and the more awareness that we have.
• 6:40
  SPEAKER_01: This is such a young, young industry.
• 6:42
  SPEAKER_01: Again, I don't want to jump down these rabbit holes of what I'd say just pontificating, right?
• 6:49
  SPEAKER_01: Any new industry is gonna have this notion of what does it actually do, and then it's gonna kind of balance back in.
• 6:54
  SPEAKER_01: How long has science been around for?
• 6:55
  SPEAKER_01: How long has accounting been around for, right?
• 6:57
  SPEAKER_01: My assumption is back in the day when the abacus was created, oh my god, this is it, right?
• 7:02
  SPEAKER_01: Now let's let's slow down over time, right?
• 7:05
  SPEAKER_02: You're fair.
• 7:05
  SPEAKER_02: It's a fair, it's a fair perspective, right?
• 7:08
  SPEAKER_02: Like when the TV came out, everyone was like, oh, it's gonna rot your brain, it's gonna be terrible.
• 7:13
  SPEAKER_02: Um, those other things.
• 7:14
  SPEAKER_02: Or should what about the printing press, right?
• 7:16
  SPEAKER_01: That was gonna be the the end of everything.
• 7:19
  SPEAKER_01: All right.
• 7:20
  SPEAKER_01: Mass misinformation, right?
• 7:23
  SPEAKER_01: That is true.
• 7:24
  SPEAKER_01: That is true.
• 7:25
  SPEAKER_01: No, the other article that I want to bring up just from kind of this morning was more realistic.
• 7:29
  SPEAKER_01: I thought it was really interesting.
• 7:30
  SPEAKER_01: I forget exactly what report was.
• 7:32
  SPEAKER_01: I think I heard it on the Cyber Daily Wire or something like that, one of the podcasts.
• 7:36
  SPEAKER_01: But it was this notion of what industries are actually paying ransom.
• 7:42
  SPEAKER_01: Manufacturing, education, um, healthcare, I believe it was, and there was two other.
• 7:48
  SPEAKER_01: It was just really interesting to me because the fact that while ransomware may not have the cliche as much anymore in terms of the main front page media, sure.
• 7:59
  SPEAKER_01: The attackers clearly know where they need to focus.
• 8:02
  SPEAKER_01: And like that is just an amazing opportunity.
• 8:05
  SPEAKER_01: And even the the other guys that on the podcast are like, so these industries start to think about how do you manage ransomware.
• 8:11
  SPEAKER_01: Once you are identified as someone that does pay out, you're going to be highly, highly focused in a targeted attack.
• 8:18
  SPEAKER_01: Yeah.
• 8:18
  SPEAKER_01: Um, so those are the things as we think about this, right?
• 8:20
  SPEAKER_01: There's there's so many things of just topics of conversation, you don't know where to go.
• 8:26
  SPEAKER_01: There's so many things that you could do.
• 8:27
  SPEAKER_01: Taking a step back and looking at the trees through the forest on this one is like, okay, all manufacturers, all education, all healthcare, start to really think about how do you handle ransomware attacks and more or less how do you pay that out, right?
• 8:40
  SPEAKER_01: Um, so it's just something I wanted to bring in before we dive into the cards that I just thought was a a nice way to understand technical impact through just a simple business need, right?
• 8:50
  SPEAKER_02: It's it did, it's it's it's super interesting, right?
• 8:53
  SPEAKER_02: Because like I think like all the time I think about like how do you track attacker movement and like where they're going, what their tactics are, how they're shifting.
• 9:02
  SPEAKER_02: And it's fascinating to watch these decisions because these attacker groups don't typically know each other.
• 9:07
  SPEAKER_02: Some do, right?
• 9:08
  SPEAKER_02: They talk amongst themselves, right?
• 9:10
  SPEAKER_02: The vast majority of them are independent kind of you know operating organizations.
• 9:15
  SPEAKER_02: They all kind of do similar things, right?
• 9:17
  SPEAKER_02: They move in similar ways, right?
• 9:19
  SPEAKER_02: Kind of like following that path of least resistance.
• 9:21
  SPEAKER_02: And it reminds me of one of the things that you know we say that to our clients, which sometimes gets a little bit of a raised eyebrow, but it's ultimately like your job is not to build the most defensible network, it's to make it annoying enough so that the attacker moves on.
• 9:35
  SPEAKER_02: And that's what I feel like is what you're describing, right?
• 9:37
  SPEAKER_02: Is like as different industries get targeted more, it's because other industries basically made their stuff tight enough that the attacker got annoyed enough to move on, right?
• 9:47
  SPEAKER_02: To find an easier target.
• 9:48
  SPEAKER_02: Um, so you're right.
• 9:49
  SPEAKER_02: Like this stuff is cyclical, right?
• 9:51
  SPEAKER_02: There are ways and things are gonna kind of change over time, and how they've changed has been pretty interesting if we if you go back and look at kind of what that movement's been.
• 9:59
  SPEAKER_01: Yeah, no, a hundred percent.
• 10:01
  SPEAKER_01: Um, well, I think I delayed uh the last week recap.
• 10:04
  SPEAKER_02: This is dude, this is what this is what this podcast is about, right?
• 10:06
  SPEAKER_02: Talking about whatever and giving perspective.
• 10:08
  SPEAKER_02: So I I read last week, oh, why don't you hit us with a car?
• 10:12
  SPEAKER_01: All right.
• 10:12
  SPEAKER_01: I guess I'll do uh B.
• 10:14
  SPEAKER_01: All right.
• 10:15
  SPEAKER_01: All right, middle of the says.
• 10:17
  SPEAKER_01: All right.
• 10:18
  SPEAKER_01: So the title is AI Enabled Threats and Adversarial Use.
• 10:23
  SPEAKER_01: According to the 2026 Verizon Data Breach Investigations Report, the median threat actor researched or used AI assistance across 15 different miter attack techniques in 2025, with some actors leveraging as many as 40 to 50.
• 10:40
  SPEAKER_01: What's your initial thought on this one, Paul?
• 10:42
  SPEAKER_02: My initial thought is we saw this coming, right?
• 10:45
  SPEAKER_02: Like I'm I'm super unsurprised by this statistic.
• 10:49
  SPEAKER_02: And the fact is, like, this is what we knew exactly was going to happen with AI is look, we talk about it all the time.
• 10:55
  SPEAKER_02: We're not gonna stop talking about it.
• 10:57
  SPEAKER_02: It's a transfor, it's a transformative thing, right?
• 11:00
  SPEAKER_02: And in and ultimately, I think the benefit outweighs the cost.
• 11:04
  SPEAKER_02: But again, like attackers are now utilizing it for their tradecraft as well.
• 11:08
  SPEAKER_02: But the difference between these attacker groups and and normal businesses are literally just that we pay taxes.
• 11:14
  SPEAKER_02: They have the same organizational structures, they they still treat their services as services, they provide customer support.
• 11:20
  SPEAKER_02: Like it's it's even though it's considered criminal, it's still an organization and they're gonna use this technology in the same exact way that we do.
• 11:27
  SPEAKER_02: So this is like this is just more proof that this has become an arms race.
• 11:31
  SPEAKER_02: Who can use this more effectively in order to defend yourself?
• 11:35
  SPEAKER_02: Or are they are the attackers gonna win and use it more effectively to gain access and accelerate their attacks?
• 11:40
  SPEAKER_01: Yeah.
• 11:41
  SPEAKER_01: So this is an interesting thing because it brings me back to corporate when internally on the SOC side, um, the team was trying to basically do a mapping of controls to the mitre framework.
• 11:52
  SPEAKER_02: Okay.
• 11:52
  SPEAKER_01: Right.
• 11:53
  SPEAKER_01: And so when we think about the enormous effort that took in again to the level of finality that it actually was operationally used, again, hugely well, it was a good resource to have internally, and I think it allowed, especially the responders, to really understand what are our controls and how do we look for gaps when we try to say stop threats, right?
• 12:17
  SPEAKER_01: Yeah.
• 12:18
  SPEAKER_01: But now if we think about this from an attacker's perspective or understanding how onerous this is for an organization to truly understand all the different miter attack, I think there's what, 168 different line entries of for that framework.
• 12:32
  SPEAKER_02: I don't even know, to be honest.
• 12:32
  SPEAKER_02: There's still just a ton.
• 12:33
  SPEAKER_02: Yeah.
• 12:34
  SPEAKER_01: And so, like, in order to get your head wrapped around that, I'm not surprised that AI is allowing the attacker to just hammer away at techniques either that are known to exploit or ones that they're not sure of and that are used, that can just expedite, hey, how do I need to package this up?
• 12:48
  SPEAKER_01: How do I get into the network?
• 12:50
  SPEAKER_01: Pairing this back up, I assume, with open source, or at least some of the entry or the access points that they already know about, right?
• 12:56
  SPEAKER_01: So if you start to think about the attacker layering in these opportunities, they know that organizations are aligning to this framework.
• 13:03
  SPEAKER_01: They know that they already have some pre-information to get into a network.
• 13:06
  SPEAKER_01: And then they're just saying, hey, how do I pound through each one of these quicker and faster to actually find my path?
• 13:12
  SPEAKER_01: Like that's again, using these frameworks that are publicly sourced from the attacker's perspective is really putting, I would say, the defenders and responders in a really, really difficult position, right?
• 13:23
  SPEAKER_01: There's no way that they're going to be able to keep up or build their capabilities to align to the mitre gaps that they find as quick as those attackers are going to be able to exploit it.
• 13:32
  SPEAKER_01: And so it's just interesting that the MITRE framework now is, again, as we always know, defenders will try to align attackers above to exploit.
• 13:40
  SPEAKER_01: Who can stay quicker and who can actually use that framework more efficiently, right?
• 13:44
  SPEAKER_01: The attacker wants to use this framework to exploit efficiency in getting into networks or moving laterally, right?
• 13:50
  SPEAKER_01: Getting to that data, getting to their actual objective.
• 13:53
  SPEAKER_01: And then defenders want to use that to try to lock up their gaps, right?
• 13:56
  SPEAKER_01: Right.
• 13:56
  SPEAKER_01: They don't even know what gaps sometimes they have in their network to allow.
• 13:59
  SPEAKER_01: That's the challenge.
• 13:59
  SPEAKER_02: Yeah, exactly.
• 14:00
  SPEAKER_02: Well, look, so what the word you said is the key, right?
• 14:03
  SPEAKER_02: It's efficiency, right?
• 14:04
  SPEAKER_02: And let's not forget where MITRE came from.
• 14:06
  SPEAKER_02: MITRE came from human tactics that were utilized by threat actors that are very well known and documented.
• 14:13
  SPEAKER_02: That's why they're on a framework, right?
• 14:15
  SPEAKER_02: These aren't like novel things, right?
• 14:17
  SPEAKER_02: It's like, hey, they're gonna try to do X, they're gonna try to do Y.
• 14:20
  SPEAKER_02: What MITRE has done is effectively laid out here are the tactics that you can use if you want to achieve this portion of a breach or this portion of an attack.
• 14:27
  SPEAKER_02: And all we have to do now is basically point an unrestricted LLM at that and be like, all right, here you go.
• 14:34
  SPEAKER_02: Here's the roadmap, right?
• 14:36
  SPEAKER_02: So this truly is about efficiency.
• 14:38
  SPEAKER_02: And we know that these, these, you know, these AI agents and and systems and large language models, they move at machine speed.
• 14:45
  SPEAKER_02: And the challenge you laid out at the end is exactly what the problem is, is that being an attacker, and look, I'm I'm I've never been on the red time red team side.
• 14:54
  SPEAKER_02: So for the pen testers out there listening to me, please don't roll your eyes.
• 14:58
  SPEAKER_02: But it feels like it's easier than the defense side, only because those tactics are laid out.
• 15:05
  SPEAKER_02: You try things in sequence.
• 15:06
  SPEAKER_02: Here's my target, here's what I know works, here are the things I'm gonna try.
• 15:10
  SPEAKER_02: And if it doesn't work, you move on.
• 15:13
  SPEAKER_02: But from a defense perspective, the level of complexity that comes with some of these networks that might be serving four, five, six hundred people, seven, eight, ten thousand people, like that complexity is almost impossible to compartmentalize.
• 15:27
  SPEAKER_02: What do you have?
• 15:28
  SPEAKER_02: Outdated architecture documents, systems that don't have full coverage, blogs that aren't forwarding to the SEM, like we've dealt with all these issues and they're true issues.
• 15:36
  SPEAKER_02: So while the attacking group, the red team group, is allowed to be like, yep, I'm gonna kick off my tools, I'm gonna roll those tools out, I'm gonna try some things, we'll see.
• 15:44
  SPEAKER_02: If it doesn't work, move on.
• 15:46
  SPEAKER_02: All we need is one thing to not work.
• 15:48
  SPEAKER_02: If one thing on our side doesn't work, we're toast.
• 15:50
  SPEAKER_02: And that's why every single pen test I've been a part of, every single one across my 22-year career has always been like, yeah, we have some findings.
• 15:59
  SPEAKER_02: Of course you do, because defense is damn near impossible.
• 16:02
  SPEAKER_02: We build these networks at scale and at speed.
• 16:05
  SPEAKER_02: We they're constantly changing and evolving.
• 16:07
  SPEAKER_02: The tool sets are constantly coming and going.
• 16:09
  SPEAKER_02: We never really spend a ton of time with like full, full coverage.
• 16:12
  SPEAKER_02: Health checking doesn't happen half the time.
• 16:15
  SPEAKER_02: Like these are all the issues that defenders have to deal with.
• 16:17
  SPEAKER_02: And like this is what we're up against.
• 16:19
  SPEAKER_02: And that's why, like, I hate saying it and I don't like being negative, but this is a losing battle for us.
• 16:24
  SPEAKER_02: Like, we got to figure out how do we do this differently.
• 16:27
  SPEAKER_01: Yeah, and and I think that's what we were talking about before, right?
• 16:30
  SPEAKER_01: Is basically build for defense online for compliance is one of the uh models that we have at TALAS.
• 16:35
  SPEAKER_01: I think it's really hard at the enterprise level, right?
• 16:37
  SPEAKER_01: We didn't talk about the notion of, well, attackers can pivot while attackers can build their tool set extremely quickly.
• 16:44
  SPEAKER_01: The the defense side, right, or enterprises, they can't move that quick in terms of gut control, right?
• 16:49
  SPEAKER_01: I can't just go out and buy new technology within five days and then have it operationally stood up within another five days, right?
• 16:55
  SPEAKER_01: Like think about the purchasing cycle within all of this, right?
• 16:58
  SPEAKER_01: The procurement aspect of doing this, bringing it in house, and then getting the distributed, like you're saying, all of our actual endpoints.
• 17:03
  SPEAKER_01: Very, very difficult.
• 17:04
  SPEAKER_01: The one thing that I you touched on a little bit was this notion of LLM, right?
• 17:08
  SPEAKER_01: That's what I'm seeing too, is that everyone has a different, what I'd say, formula within their MLM, LLMs to basically move quicker and to evaluate and determine how a new technique can actually be used and exploited.
• 17:21
  SPEAKER_01: Right?
• 17:21
  SPEAKER_01: Like that's the other power that we can't underestimate with the attackers, that they're extremely knowledgeable and dive deep into the AI technology, across how they're building their algorithms, how they're actually incorporating results from what they're actually trying, making that back into their formula, outputting and then doing that all over again across the board.
• 17:39
  SPEAKER_01: So I'm not I'm not surprised to see that some attackers leveraging as many as 40 to 50 additional miter techniques, right?
• 17:46
  SPEAKER_01: This is the power of speed and scale that the attackers can actually leverage.
• 17:50
  SPEAKER_01: It just puts us, again, on the defender side, in a really difficult position.
• 17:54
  SPEAKER_01: Um, and the only thing I think is as we start to build for defense, really know your inventory.
• 18:01
  SPEAKER_01: Know your assets, know how you're controlling them, know your movements of access as well as data.
• 18:06
  SPEAKER_01: I think that's the way to keep up, right?
• 18:08
  SPEAKER_01: Is we don't always have to have the newest and cutting edge against attackers.
• 18:12
  SPEAKER_01: It's we have to look more inside and protect ourselves and know ourselves more than ever before.
• 18:17
  SPEAKER_02: Yeah.
• 18:18
  SPEAKER_02: You know, you said something when we did the intro, you said something really cool, which was this concept of like, you know, well, what are we gonna do?
• 18:27
  SPEAKER_02: Like shut systems off, we're in the cloud.
• 18:28
  SPEAKER_02: Like that resonated with me because again, I always think about like cyber being cyclical, right?
• 18:33
  SPEAKER_02: And like organizations have largely moved to the cloud.
• 18:37
  SPEAKER_02: There's still plenty that maintain their own networks, they have their own infrastructure.
• 18:40
  SPEAKER_02: But the reality is when you're in the cloud, it's very hard to set up that kill switch.
• 18:45
  SPEAKER_02: You can't just unplug the internet like you used to be able to do, right?
• 18:48
  SPEAKER_02: So, like as we think about you know, these the efficiency you're talking about, know your assets and like understanding like your network.
• 18:56
  SPEAKER_02: When we start seeing machine speed attacks, we're gonna need a way to hit a kill switch, right?
• 19:02
  SPEAKER_02: We're gonna need a way to turn off the internet.
• 19:04
  SPEAKER_02: And like, I almost, I almost see like as this becomes more and more of an issue, because mark my words, this will become an issue.
• 19:10
  SPEAKER_02: I almost see more and more organizations reinvesting in on-prem infrastructure because then you can pull the pull the plug, right?
• 19:17
  SPEAKER_02: If you if you're being attacked by some you know, large language model, AI agent driven attacker, and they're they're hitting you at machine speed and you're just underwater, you need a way to pull, right?
• 19:29
  SPEAKER_02: And we need a way to figure out like how do we do that, not only with the cloud infrastructure that's out there, because of course that's not going to go away, but like how do you do that safely internally as well, right?
• 19:37
  SPEAKER_02: Like, can we queue up network traffic so that when we're back up and running, things can set again set out?
• 19:42
  SPEAKER_02: Like, I'm thinking about this a little abstracted, uh, abstractly, like this is not a fully formed idea, but this concept of like having full control over your network again and not have to worry about going out to these different SaaS platforms and and and cloud infrastructure.
• 19:55
  SPEAKER_02: I it's an interesting way to think about like how do we gain control of our networks when you're dealing with a machine that's just simply operating faster than you.
• 20:04
  SPEAKER_01: No, I I know we're going down one of the rabbit holes that isn't about the framework, but the one shot I want to give here is lawyers, jump in, right?
• 20:11
  SPEAKER_01: There's a prime opportunity for contracts and clauses now with I would say cloud platforms for a kill switch, right?
• 20:17
  SPEAKER_01: So much of this is being trying to transfer, no, it's in the third party, that's their responsibility.
• 20:21
  SPEAKER_01: No, it's not.
• 20:21
  SPEAKER_01: Right?
• 20:22
  SPEAKER_01: At the end of the day, it's the company's data that you're generating.
• 20:24
  SPEAKER_01: That's your responsibility.
• 20:25
  SPEAKER_01: And I think this goes back to, again, this notion of while privacy is being pushed, we need to be able to have this point where we can cut that off, right?
• 20:33
  SPEAKER_01: And I don't know to the extent of how many contracts actually have this.
• 20:37
  SPEAKER_01: Um, I know for our Microsoft, I wouldn't know how to basically do a kill switch in our O365 Cloud instance, right?
• 20:42
  SPEAKER_01: Yeah.
• 20:43
  SPEAKER_01: We can shut off endpoints, right?
• 20:44
  SPEAKER_01: But if we need to pull the plug to have shut down every single paper and pen, I'll admit it, right?
• 20:48
  SPEAKER_01: I don't necessarily know how to do that.
• 20:49
  SPEAKER_01: I don't know if we have that a clause in our contract, but these are the little things I think the users, right, need to start to empower themselves to do.
• 20:56
  SPEAKER_01: Um and I know we can't strong arm AWS or Google.
• 20:59
  SPEAKER_01: Um to what extent do we actually try to drive this through legal means, right, with contracts?
• 21:04
  SPEAKER_01: Yeah.
• 21:04
  SPEAKER_01: Um, and then build that into the things like BCDRs and IRPs, right?
• 21:07
  SPEAKER_01: We have to have the kill switch.
• 21:09
  SPEAKER_01: It's becoming more prevalent than ever before, especially on the water systems, right?
• 21:13
  SPEAKER_01: That's that's where it becomes a little bit more of a, I would say that this is a true human security issue, right?
• 21:20
  SPEAKER_01: Not just a computer or data issue.
• 21:24
  SPEAKER_02: Yeah, no, there are definitely ways to do it.
• 21:26
  SPEAKER_02: I remember working with an organization building a kill switch for AWS because that was our operations requirement, right?
• 21:33
  SPEAKER_02: I at the time cloud was a brand new and everyone was moving to cloud, and we're like, hey, we need the same capability we have on-prem to move off prem.
• 21:40
  SPEAKER_02: In this case, we need a kill switch, and they did it, right?
• 21:42
  SPEAKER_02: You can build the routing and configurations.
• 21:44
  SPEAKER_02: For example, on Microsoft, you can do things with you know conditional access and locking stuff out and required routes, right?
• 21:50
  SPEAKER_02: But like the thing is like those are the things that I think, especially the folks that are in the SMB space with limited resources need to start thinking about.
• 21:57
  SPEAKER_02: Like, if you really needed to, how could You shut your systems off from the network until you could regain control.
• 22:03
  SPEAKER_02: Um, and these are the things that you know AI is is making a concern, right?
• 22:07
  SPEAKER_02: Like it's the speed, it's the speed that I'm really worried about.
• 22:11
  SPEAKER_02: Wow, that was a wild perspective.
• 22:14
  SPEAKER_01: Yeah, that went down a couple different paths for sure, 100%.
• 22:17
  SPEAKER_02: I know.
• 22:17
  SPEAKER_02: I mean, this that one took up damn near the whole episode here.
• 22:20
  SPEAKER_02: We're coming up on the whole time.
• 22:23
  SPEAKER_02: So I guess like let's maybe we just end it here and and what do we what do we want people to leave with on this one?
• 22:28
  SPEAKER_02: Like, what's the thing that resonated with you the most?
• 22:30
  SPEAKER_01: Yeah, so for this week, for me, it's it's more or less on kind of the aggregate level, right?
• 22:36
  SPEAKER_01: Um, so the one thing about industries that are actually being targeted, right, because they pay out.
• 22:42
  SPEAKER_01: Um, starting to look at, hey, is my industry a focal point?
• 22:46
  SPEAKER_01: Is my industry actually paying out?
• 22:48
  SPEAKER_01: Is my industry doing things that kind of attracts threat actors?
• 22:51
  SPEAKER_01: Um, and then the other one, too, I think that I want to leave people with is there's always going to be a framework.
• 22:56
  SPEAKER_01: There's always gonna be something to align to.
• 23:00
  SPEAKER_01: But start to look at what are your controls and what is your actual environment that you need to protect.
• 23:05
  SPEAKER_01: Get that defined and you can align appropriately across the board.
• 23:09
  SPEAKER_01: As you identify gaps, try to work with business to figure out your short-term tech quote towards your long-term strategy to bring in items, right?
• 23:17
  SPEAKER_01: Whether that's new technology, whether that's more people, right?
• 23:20
  SPEAKER_01: Whatever that actual expense is, try to define that from the business perspective.
• 23:25
  SPEAKER_01: Because again, slowly chipping away and just securing your critical business operations will allow you to, as you talked about before, right, be able to weather the storm, hopefully kick that down to the next company.
• 23:37
  SPEAKER_01: Or if it is something that you have to face, hopefully you have that in a good way in which you can segregate and start to not allow the attack to proliferate, right?
• 23:45
  SPEAKER_01: Quote unquote that um blast radius, right?
• 23:48
  SPEAKER_01: We really, really want to try to look at that and really focus on the prime critical data.
• 23:54
  SPEAKER_02: Yeah.
• 23:54
  SPEAKER_02: You know what I didn't think about is like this concept of the kill chain, not the the the mitor attack framework, right?
• 24:02
  SPEAKER_02: Or the kill chain, like the frameworks are interchangeable, but in this case the framework and like how much more of the framework is being used by AI year over year.
• 24:09
  SPEAKER_02: Like I didn't even think about that as a metric.
• 24:12
  SPEAKER_02: Like that completely shifted my perspective because it's true, right?
• 24:15
  SPEAKER_02: Like you think about this thing, it's like, oh, it's a good resource, it's out there, lays out all these tactics and techniques and procedures and what attackers are doing, but I've never really thought to like map these against attacker types, right?
• 24:27
  SPEAKER_02: Like how many are being used, how many are being used more often, which ones are the and like all that data is clearly out there, but it's always been out there from like a human perspective, right?
• 24:35
  SPEAKER_02: So now we're looking at this from like an AI machine perspective.
• 24:39
  SPEAKER_02: This is wild.
• 24:40
  SPEAKER_02: Like I'm actually now that I'm rethinking about the statistic, I'm actually more surprised it's not more, right?
• 24:45
  SPEAKER_02: Like 40 to 50 out of, you know, out of however many are out there, like that's uh this is definitely gonna get more sophisticated.
• 24:53
  SPEAKER_02: It's gonna get more sophisticated fast.
• 24:54
  SPEAKER_02: So to your point, like it's time to get organized, right?
• 24:56
  SPEAKER_02: It's time to make things as simple as we can, get them organized and figure out where we have control and where we don't.
• 25:02
  SPEAKER_01: And I don't know if it's more sophisticated or if it's just their net and their ability to throw it is larger, right?
• 25:07
  SPEAKER_01: So if we think about traditional fishing and when net phishing came out, right, you were able to get more in one shot than you were before.
• 25:14
  SPEAKER_01: So now our attackers, because of their ability to do more with AI and their knowledge, are they just casting a bigger net?
• 25:22
  SPEAKER_01: Or are they actually more sophisticated in what they're doing as to get into their actual objective?
• 25:27
  SPEAKER_01: That's what I'm still unsure about, right?
• 25:29
  SPEAKER_01: Goes back to the notion of speed versus quality, right?
• 25:31
  SPEAKER_01: As long as they get their objective, what do they care that they how they get there?
• 25:36
  SPEAKER_02: Well, we didn't have a guest this week, but I dig these ones.
• 25:40
  SPEAKER_02: I dig these episodes where we get to just like get together and jam.
• 25:43
  SPEAKER_02: I think this was awesome.
• 25:44
  SPEAKER_01: I guess there's no limitation of perspective from us.
• 25:48
  SPEAKER_02: I guarantee.
• 25:49
  SPEAKER_02: Well, we should we should figure out like what we're saying on these things over time and figure out how our perspectives change based on what we've talked about and what we looked at, right?
• 25:57
  SPEAKER_01: I hope my perspective changes.
• 25:58
  SPEAKER_02: I don't want to be an old dog.
• 25:59
  SPEAKER_02: I gotta keep going to new tricks, right?
• 26:01
  SPEAKER_02: That is true.
• 26:02
  SPEAKER_02: Well, that is that is something we can look forward to.
• 26:05
  SPEAKER_02: And uh yeah, amazing episode, and we'll catch you again next week.
• 26:08
  SPEAKER_02: Let's do it.
• 26:09
  SPEAKER_02: All right, take care, everyone.
• 26:10
  unknown: Bye.