Latest / Cybersecurity Perspectives / S1:E11 - Ransomware appeared in 48% of all breaches in 2025, up from 44% the previous year, but the median ransom payment declined to $139,875 in 2025, down from $150,000

Transcript

S1:E11 - Ransomware appeared in 48% of all breaches in 2025, up from 44% the previous year, but the median ransom payment declined to $139,875 in 2025, down from $150,000 · Cybersecurity Perspectives

• 0:00
  SPEAKER_00: Cybersecurity moves fast.
• 0:02
  SPEAKER_00: Working in a space measured in minutes and seconds means we can't expect to keep pace by doing the same thing over and over.
• 0:08
  SPEAKER_00: The sharing of perspective across technologists, defenders, business, and professionals is key to unleashing internal capability.
• 0:16
  SPEAKER_00: Perspective comes from sharing experiences and ideas.
• 0:20
  SPEAKER_01: Welcome to Cybersecurity Perspectives.
• 0:22
  SPEAKER_01: And just like that, we're back.
• 0:24
  SPEAKER_01: Welcome back, everyone.
• 0:25
  SPEAKER_01: Welcome back to another episode of Cybersecurity Perspectives.
• 0:28
  SPEAKER_01: I'm your host, Paul Marco, and I am psyched to be here.
• 0:31
  SPEAKER_01: If I'm being honest, we're recording on a Friday.
• 0:33
  SPEAKER_01: I'm in an exceptional mood.
• 0:35
  SPEAKER_01: My energy is through the roof.
• 0:36
  SPEAKER_01: The sun came up this morning, so I'm feeling great.
• 0:38
  SPEAKER_01: I'm a little bummed on can't be here today, but you know what?
• 0:40
  SPEAKER_01: That's okay, because I have an amazing guest.
• 0:43
  SPEAKER_01: I am psyched to talk with this gentleman.
• 0:46
  SPEAKER_01: We have a gentleman who's joining us from Philadelphia.
• 0:48
  SPEAKER_01: He has two decades focused on education.
• 0:50
  SPEAKER_01: He's an industry advisor, he's a director of technology and has maintained his love for learning over the course of his career.
• 0:56
  SPEAKER_01: He's the person ensuring that students can learn, that teachers can teach, and the next members of society come out swinging and ready to contribute.
• 1:02
  SPEAKER_01: I am happy to give a huge warm welcome to Bippin Prakash.
• 1:06
  SPEAKER_01: Bippin, welcome to the show.
• 1:07
  SPEAKER_01: Thank you so much for joining us.
• 1:09
  SPEAKER_02: Thanks so much, Paul.
• 1:10
  SPEAKER_02: So excited to be here.
• 1:11
  SPEAKER_02: So I'm pretty elated to be here, even though it's a Friday afternoon.
• 1:15
  SPEAKER_02: Pretty exciting times.
• 1:16
  SPEAKER_01: I appreciate that.
• 1:17
  SPEAKER_01: I I will say recording on a Friday definitely makes it a little easier for me to sit here in the office and kind of wait out the day.
• 1:23
  SPEAKER_01: All right.
• 1:24
  SPEAKER_01: Excited to get going on the weekend.
• 1:25
  SPEAKER_02: To add to what you just said, a couple of things, uh just about me for the viewers.
• 1:29
  SPEAKER_02: Um love all things security, uh, whether it be physical security or cybersecurity or camera system.
• 1:36
  SPEAKER_02: So uh again, uh love to learn more about those things.
• 1:39
  SPEAKER_02: And uh yeah, recently uh a few things have popped up, especially in the age of AI.
• 1:44
  SPEAKER_02: So those things have kind of been taking up more of my attention than other things.
• 1:49
  SPEAKER_01: I know it.
• 1:49
  SPEAKER_01: I feel like it's been taking up everyone's attention, right?
• 1:51
  SPEAKER_01: Like it's been one of those kinds of things.
• 1:53
  SPEAKER_01: Um, you know, it's interesting.
• 1:54
  SPEAKER_01: You actually talk about physical security and cameras.
• 1:57
  SPEAKER_01: And I'll say those are more, those are the things that I typically don't interact with, right?
• 2:00
  SPEAKER_01: My whole career has been in security operations, reading alerts, right?
• 2:04
  SPEAKER_01: Looking at vlogs that represent actions from other people from all over the world trying to do what are most of the time nefarious things.
• 2:11
  SPEAKER_01: But I never really get to interact with like these other systems that that really lean into the physical world.
• 2:16
  SPEAKER_01: Like, how what's that like?
• 2:19
  SPEAKER_02: Uh it's it's it's a uh whole nother world on its own.
• 2:22
  SPEAKER_02: But, you know, I mean, they're trying to integrate more into network systems.
• 2:25
  SPEAKER_02: So uh, you know, you're seeing more and more IoT devices that kind of work through and uh, you know, doors your uh IT closets or your uh key room for schools and other things where you know they kind of have much more of an audit blog versus this old camera that sits on and maybe it's working, but you know, everything right now can be triggered via motion, et cetera, et cetera.
• 2:49
  SPEAKER_02: So they're they're getting up there.
• 2:51
  SPEAKER_01: Yeah, I always I always am fascinated with the K-12 stuff, right?
• 2:55
  SPEAKER_01: Like you guys have to do so much more and you have to cover everything.
• 2:59
  SPEAKER_01: You have all these regulations that apply to you, and then you have to worry about things like lockdown systems, door badges, cameras, in addition to all the traditional cybersecurity.
• 3:08
  SPEAKER_01: So hats off to education, it's a space I've recently just got involved in in the last couple of years.
• 3:13
  SPEAKER_01: You know, my career has been in kind of these large enterprise organizations, and to see what education does with like the amount of resources they have is has always kind of blown my mind.
• 3:23
  SPEAKER_02: Yeah, um, I agree with you.
• 3:24
  SPEAKER_02: I mean, you know, fewer, uh, many more hats to wear, so to speak.
• 3:28
  SPEAKER_02: And uh, you know, especially dealing with miners and other regulations that kind of gets in the way of some of the stuff you want to do, but ultimately they're there for a reason, and uh, we try to make the best of it.
• 3:38
  SPEAKER_01: So amazing.
• 3:39
  SPEAKER_01: Well, look, what else is going on in your life, man?
• 3:41
  SPEAKER_01: What what are some of the other things top of mind for you?
• 3:43
  SPEAKER_02: Yeah, uh, I think I hinted at it a little bit uh in the intro, but AI agents and you know, gone are the days when you're like, hey, uh you have a firewall and you have on-prem servers, and if they can't get to it, that's you know, you're safe.
• 3:56
  SPEAKER_02: The delineation between what's on-prem and off-prem and what's on campus and on the computer, it's kind of pretty blurred.
• 4:05
  SPEAKER_02: So, you know, we can block certain websites, but then you know, they go into ChatGPT or some other unapproved AI and begin typing in a whole bunch of PII stuff.
• 4:14
  SPEAKER_02: I mean, so I mean, a browser has really become your uh door and your biggest source of leak.
• 4:20
  SPEAKER_02: I mean, I'll be interested in seeing statistics of how many more like right now in the industry, email is the biggest threat vector, but I'm sure that's shifting at a very rapid pace to browser-based um DLP losses and other things.
• 4:36
  SPEAKER_01: Oh, absolutely.
• 4:37
  SPEAKER_01: In fact, we we're experiencing a full fundamental shift at this point in in terms of like how threats are emerging, how threats are changing.
• 4:45
  SPEAKER_01: So you're 100% spot on.
• 4:47
  SPEAKER_01: The the AI agent stuff is super interesting.
• 4:49
  SPEAKER_01: Like, I, you know, I just recently have gotten into using them myself, trying to like build these agents to do very specific things.
• 4:56
  SPEAKER_01: And of course, as a cybersecurity guy with my tinfoil hat on, right?
• 4:59
  SPEAKER_01: I'm always a little like, you know, am I doing it right?
• 5:02
  SPEAKER_01: Am I making sure the proper guardrails are on there?
• 5:04
  SPEAKER_01: You know, I just build one to do, to do regular research.
• 5:07
  SPEAKER_01: For me, I'm doing another one that's going to be focused on cyber threat intelligence.
• 5:10
  SPEAKER_01: Like, and this is the way of the world.
• 5:12
  SPEAKER_01: But you're right, like, gone are those days where it was like, I have a firewall, my stuff is behind the firewall.
• 5:18
  SPEAKER_01: As long as my firewall is tight, I'm in good shape, right?
• 5:20
  SPEAKER_01: Like that was that old castle and moat mentality.
• 5:22
  SPEAKER_01: And like, I mean, uh, we've been we've been moving away from that for years, right?
• 5:26
  SPEAKER_01: Cloud changed that world, changed that world.
• 5:28
  SPEAKER_01: SaaS changed that world, everything's interconnected, data is flying all over the world now.
• 5:32
  SPEAKER_01: So there's a lot more to consider.
• 5:34
  SPEAKER_01: But I agree, man.
• 5:35
  SPEAKER_01: Like, I feel like back in the day it was just simpler times.
• 5:38
  SPEAKER_02: Yeah, right.
• 5:38
  SPEAKER_02: I mean, I think you kind of start losing the grip with the advent of a whole number of SaaS apps.
• 5:43
  SPEAKER_02: I mean, we have way more workloads on the cloud and different clouds compared to what's on-prem.
• 5:48
  SPEAKER_02: But at least with uh on-prem DNS filtering, you could kind of control, hey, you know, you can you can't put things on GCP or whatever it is, or whatever your stuff might be.
• 5:57
  SPEAKER_02: But now uh, you know, you don't want to block AI tools and mass, and there are, you know, so many of them with, you know, uh OpenAI and Lama and all those underlying models.
• 6:08
  SPEAKER_02: So I mean, you can block maybe a model directly on Chat GPT, but you know, you can get to the Microsoft Copilot.
• 6:15
  SPEAKER_02: I mean, yes, those have enterprise grade uh uh guarded walls around them, but it's it's very easy to kind of lose perspective of what all you need to be governing.
• 6:28
  SPEAKER_01: Absolutely.
• 6:29
  SPEAKER_01: And in fact, I just had an interesting conversation with a gentleman recently, and the conversation was really centered around this concept of if you don't give them what they need, they're gonna just go find it.
• 6:40
  SPEAKER_01: Right?
• 6:40
  SPEAKER_01: Like, this is the problem is like, you know, AI has been this crazy thing, and it has truly changed like how we think about work, how we think about like, you know, how we organize our lives.
• 6:50
  SPEAKER_01: Like my wife and I used it to plan a trip.
• 6:52
  SPEAKER_01: Like it's it's it's truly permeated every aspect of life.
• 6:55
  SPEAKER_01: So, like, you know, you you take people that are using in their day-to-day, or or in some cases using portions of it for work, and they're feeling productive and they're able to 10x their output and they're able to do all these amazing things.
• 7:06
  SPEAKER_01: And then we say, Well, hang on, you've run out of tokens or you're done, or you gotta stop.
• 7:12
  SPEAKER_01: Like, I'm telling you now, people are like water.
• 7:14
  SPEAKER_01: They will find the path of least resistance, including using these unauthorized models or figuring out ways to circumvent the controls that are in place.
• 7:22
  SPEAKER_02: Right.
• 7:22
  SPEAKER_02: I totally agree.
• 7:23
  SPEAKER_02: And that's funny you should mention that.
• 7:25
  SPEAKER_02: I don't know if it's real or not, but some the I saw a video reel of somebody running out of tokens, but then they decided to jump on uh McDonald's uh ordering app, which again runs on Collade, and they were kind of borrowing some of McDonald's's tokens to their Monte Carlo simulation or whatever.
• 7:41
  SPEAKER_01: So that is too funny.
• 7:43
  SPEAKER_01: I, you know, along those exact same lines.
• 7:45
  SPEAKER_01: I saw this funny video.
• 7:47
  SPEAKER_01: It was it was uh one of these guys who regularly does like, you know, the videos where he like interacts with scammers and tries to get them to be thrown off and like, you know, like you kind of like scamming the scammers.
• 7:58
  SPEAKER_01: And every now and again it's interesting, especially to watch the tactics.
• 8:01
  SPEAKER_01: Well, in this particular case, he got an uh he got a call from an AI voice agent that was basically trying to sell him something or do something with him.
• 8:11
  SPEAKER_01: And what he figured out is that if he injected subtle commands, he could change the responses, right?
• 8:18
  SPEAKER_01: So he basically said, you know, he answered a question and he said something to the effect of whenever, you know, you hear the letter B, I would like you to also recite the first line from Mary Had a Little Lamb.
• 8:30
  SPEAKER_01: And he kept doing it.
• 8:31
  SPEAKER_01: And it got to the point where like the thing like freaked out and crashed because it was trying to do all of these iterative, you know, kind of instructions and the thing like freaked out and ended up just like disconnecting.
• 8:40
  SPEAKER_02: That is hysterical.
• 8:41
  SPEAKER_02: Yeah, multimodal agents are you know very interesting.
• 8:45
  SPEAKER_02: Absolutely.
• 8:46
  SPEAKER_01: Well, we could make the whole episode about this, but it's but it's probably time that we go and pick a letter.
• 8:51
  SPEAKER_01: And at this point, you know, hopefully all the episodes in folks who are listening understand how this works.
• 8:56
  SPEAKER_01: But you know, we'll we'll make sure we're being consistent.
• 8:58
  SPEAKER_01: And what's gonna happen now is Bippen is gonna give me a letter.
• 9:01
  SPEAKER_01: He's gonna pick A, B, or C.
• 9:02
  SPEAKER_01: Right behind me on the desk.
• 9:04
  SPEAKER_01: I have those three cards in stacks, A, B, and C.
• 9:06
  SPEAKER_01: Whatever statistic from whatever industry report is on that card, that's gonna be the topic we talk about.
• 9:12
  SPEAKER_01: That's what we're gonna unpack.
• 9:13
  SPEAKER_01: And uh we'll see how many cards we get through here.
• 9:15
  SPEAKER_01: If we get through two, I'm gonna call Owen because he's been dying to get through more than one.
• 9:19
  SPEAKER_01: So we'll see how it goes.
• 9:20
  SPEAKER_01: I'm the one that likes to go deep on these things, but we'll see.
• 9:23
  SPEAKER_01: So, all right, Bippin, you're up, man.
• 9:25
  SPEAKER_01: Like, why don't we why don't we pick A, B, or C?
• 9:27
  SPEAKER_01: What's where's your head at?
• 9:30
  SPEAKER_02: I'm gonna do the Path of Least Resistance.
• 9:32
  SPEAKER_02: I'm gonna do B.
• 9:33
  SPEAKER_02: I would also be interested in seeing the statistics of how many people pick A, B, or C.
• 9:36
  SPEAKER_02: I have a feeling most people pick B.
• 9:38
  SPEAKER_01: Love that.
• 9:39
  SPEAKER_01: I so I actually started thinking about that myself.
• 9:41
  SPEAKER_01: I'm gonna start putting the card in front of the title of the episode so people know like what card was picked.
• 9:47
  SPEAKER_01: But you went middle of the pack, you went B.
• 9:49
  SPEAKER_01: This is it.
• 9:50
  SPEAKER_01: So let's grab that card and let's see what we end up with.
• 9:52
  SPEAKER_01: Okay, let's take a second to unpack this one.
• 9:55
  SPEAKER_01: All right, so this one actually comes from the 2026 Verizon Data Breach Investigations report.
• 10:01
  SPEAKER_01: We've got some really good statistics out of this report.
• 10:03
  SPEAKER_01: This one is great.
• 10:04
  SPEAKER_01: The topic for this one is ransomware and extortion economics.
• 10:08
  SPEAKER_01: Uh we haven't gotten one about this yet, so this is actually gonna be interesting.
• 10:11
  SPEAKER_01: All right.
• 10:12
  SPEAKER_01: There's the here the statistic from this report is that ransomware appeared in 48% of all breaches in 2025, up from 44% the previous year, and in 77% of system intrusion pattern breaches.
• 10:28
  SPEAKER_01: I'm gonna read it one more time.
• 10:30
  SPEAKER_01: Ransomware appeared in 48% of all breaches in 2025, up from 44% the previous year, and in 77% of system intrusion pattern breaches.
• 10:43
  SPEAKER_02: Yeah.
• 10:44
  SPEAKER_02: That is a very interesting statistic.
• 10:46
  SPEAKER_02: I mean, uh, you know, uh on the upfront, it's like, oh my god, half of all breaches are uh ransomware driven.
• 10:55
  SPEAKER_02: So it it's it's interesting that it's increased from the 44 to 48, uh, which you know it's not an insignificant number, especially given the toll it can take in an organization.
• 11:06
  SPEAKER_02: Uh, I mean, you might have mitigation measures for retrieving your data, but then they still have the data.
• 11:13
  SPEAKER_02: And I think it's the secondary what they do with the data, even if you can unlock it on your own or restore your own data.
• 11:19
  SPEAKER_02: So that's that's very interesting.
• 11:21
  SPEAKER_02: To me, what's a little bit more interesting is the 77 number, which tells me that more than three-quarters of all system intrusion signals are now through a ransomware mechanism.
• 11:33
  SPEAKER_01: Yeah, 100% agreed.
• 11:35
  SPEAKER_01: I mean, that I think that's a more startling number, right?
• 11:38
  SPEAKER_01: The fact that the that ransomware is driving this number of breaches, right?
• 11:44
  SPEAKER_01: Um, I do agree with you.
• 11:45
  SPEAKER_01: I was this one was interesting.
• 11:47
  SPEAKER_01: I would have expected this to be higher.
• 11:48
  SPEAKER_01: I honestly like, you know, like if I'm thinking about this, if someone were to just say, all right, in 2025, you know, how many of all breaches contain some form of ransomware?
• 11:58
  SPEAKER_01: I would have been in the 80s or 90s.
• 11:59
  SPEAKER_01: Like that would have been my gut reaction, just based on kind of how things have been going.
• 12:03
  SPEAKER_01: So the fact that it's actually half, right?
• 12:05
  SPEAKER_01: So it's like 48%, and to your point, up from 44%, this one is super interesting.
• 12:11
  SPEAKER_01: You know, like I I think about this one, and I, you know, I like I've said this before, I'll say it again.
• 12:18
  SPEAKER_01: Like we think about cybersecurity, it still fundamentally is about money most of the time, right?
• 12:24
  SPEAKER_01: Like you got you follow the money.
• 12:25
  SPEAKER_01: And that's true for things like, you know, ransomware, the cyber, the cybercrime organizations.
• 12:31
  SPEAKER_01: It's true for some nation-state actors, not all, some, right?
• 12:34
  SPEAKER_01: In some cases, it's indirectly true, right?
• 12:36
  SPEAKER_01: When nation-states deal things like intellectual property, well, that's so they don't have to spend money on research and development, right?
• 12:42
  SPEAKER_01: So you know, outside of like controlling critical infrastructure, which we can spend an entire episode on, like it truly comes down to money, right?
• 12:49
  SPEAKER_01: Especially in the cybercrime space.
• 12:51
  SPEAKER_01: And like, you know, if I think about this, uh again, like 48%, I would have expected this to be way, way higher.
• 12:59
  SPEAKER_01: But at the end of the day, like this is about that economics.
• 13:01
  SPEAKER_01: And like this is, you know, this has been something that's been permeating our organization, right?
• 13:06
  SPEAKER_01: The cybersecurity industry cheese now for years, right?
• 13:10
  SPEAKER_01: We've probably been dealing with ransomware for what, 10 years at this point?
• 13:13
  SPEAKER_01: At least, um, yeah.
• 13:15
  SPEAKER_01: That's interesting.
• 13:16
  SPEAKER_01: See, the thing, the thing is that that I think in the reason why, and I've I've talked about this on on other talks and other podcasts and whatnot, the reason why I think that ransomware is so prevalent is that because ransomware is really it's been enabled by cryptocurrency.
• 13:33
  SPEAKER_01: Those two things are inextricably linked, right?
• 13:35
  SPEAKER_01: Like if we think about like why ransomware is a thing and why cybercrime has shifted from where it was 20 years ago, which was stealing credit card numbers, stealing social security numbers, conducting fraud, doing things like, you know, uh resale of objects that were purchased online using fraudulent credentials, into what did it say, which is direct extortion?
• 13:58
  SPEAKER_01: It's all it's because of cryptocurrency, right?
• 14:01
  SPEAKER_01: Yeah.
• 14:01
  SPEAKER_02: Um that statistics also, you know, I mean, depending on whether you're a half uh cup, half full or half empty kind of person.
• 14:08
  SPEAKER_02: I mean, on the one hand, you could be like, oh, it's only gonna buy uh 4%, uh, so to speak.
• 14:14
  SPEAKER_02: Uh so does that mean our defenses are getting better?
• 14:18
  SPEAKER_02: Or does it mean we have room to, you know, get way worse?
• 14:22
  SPEAKER_02: And hey, you know, I mean, ransomware attacks are very powerful and they're very debilitating, as we've seen across so many different industries.
• 14:30
  SPEAKER_02: So I mean, uh is it a lull where, you know, we can they're getting us to get our guard down and then it might take an exponential leap?
• 14:40
  SPEAKER_02: Because in the initial years, if you were to look, I mean, I recall saying, hey, you know, it's gone up by 120% compared to last year, and for it to have kind of condensed down into that, it's either you know, our technologies have caught up, which um, you know, I would like to believe, but most likely is not the case.
• 14:57
  SPEAKER_02: But, you know, is it now that their focus has shifted on they're building the next set of agentic attackers, whether it be for DDoS attacks or ransomware attacks, so that you know, it's uh you know, the next step of a ransomware as a service, it's kind of like ransomware agent as a service.
• 15:17
  SPEAKER_02: Will we see another iteration or another family of uh attack vectors or attack methodologies kind of hitting us over the next 12, 18 months?
• 15:28
  SPEAKER_01: Pippin man, telling you right now, I'm like a proud papa.
• 15:31
  SPEAKER_01: I am like super happy that you said that.
• 15:33
  SPEAKER_01: I'm I'm an I'm a positive person.
• 15:35
  SPEAKER_01: So to answer your question directly, I'm a glasses half full kind of guy.
• 15:39
  SPEAKER_01: And the reason I'm psyched is because you've brought that perspective back.
• 15:42
  SPEAKER_01: And it's something I complain about a lot, is the negativity in our industry.
• 15:46
  SPEAKER_01: So I honestly like I agree with you.
• 15:49
  SPEAKER_01: We if if we're looking at this, a 4% increase year over year for what was at one point the most detrimental attack to an organization, that is an unbelievable bright spot in our industry.
• 16:01
  SPEAKER_01: And I do think you're right.
• 16:02
  SPEAKER_01: Like if I'm thinking through this, you've shifted my perspective on this episode.
• 16:06
  SPEAKER_01: This is an incredibly positive perspective.
• 16:09
  SPEAKER_01: I started this episode by saying I would have expected this to be 80 or 90%, right?
• 16:14
  SPEAKER_01: And here we are, it's 44%, and it only increased 4% year over year.
• 16:19
  SPEAKER_01: And what that means is yes, we're getting better.
• 16:22
  SPEAKER_01: That's 100% what that means.
• 16:23
  SPEAKER_01: We've slowed the growth of what is this detrimental attack.
• 16:27
  SPEAKER_01: And we're at the point now where we have better controls, and I would even argue better resiliency, right?
• 16:34
  SPEAKER_01: Because what we haven't talked about is how many people are or are not paying.
• 16:38
  SPEAKER_01: Like if someone gets it, like I get it.
• 16:39
  SPEAKER_01: And look, defense is a really, really difficult thing to do.
• 16:42
  SPEAKER_01: But if someone does get hit with ransomware and that ransomware encrypts their systems, I would imagine a lot of folks are basically being like, yeah, okay.
• 16:50
  SPEAKER_01: I have backups.
• 16:51
  SPEAKER_01: I'm gonna restore.
• 16:52
  SPEAKER_01: Oh, you took my data.
• 16:53
  SPEAKER_01: All right, well, whatever, right?
• 16:54
  SPEAKER_01: I'm not gonna pay.
• 16:55
  SPEAKER_01: Like it, I'll just send out my notifications, I'll pay the credit monitoring, like we'll deal with the reputational hit, which every company's recovered from on the stock exchange, by the way, historically.
• 17:04
  SPEAKER_01: No one's ever been, you know, had a detrimental fallout because of this.
• 17:08
  SPEAKER_01: Um, so I I really love that perspective.
• 17:11
  SPEAKER_01: Like, you're right.
• 17:12
  SPEAKER_01: The bright side here is I think we are getting better as an industry.
• 17:16
  SPEAKER_02: Yeah.
• 17:16
  SPEAKER_01: Um you know what I think?
• 17:18
  SPEAKER_01: I think we actually have time for another card.
• 17:20
  SPEAKER_01: All right.
• 17:20
  SPEAKER_01: I think this is one of those ones where we like, we, we, we nailed it.
• 17:24
  SPEAKER_01: Like, this is a really great positive place to go.
• 17:28
  SPEAKER_01: So I'm gonna open it back up for you, Bitpin.
• 17:30
  SPEAKER_01: And you're the only you're only the second guest to get through another card here, and Owen is gonna be super jealous.
• 17:35
  SPEAKER_01: I can't wait to tell him.
• 17:36
  SPEAKER_01: All right.
• 17:36
  SPEAKER_01: Uh let's let's go.
• 17:38
  SPEAKER_01: P or C.
• 17:38
  SPEAKER_01: See?
• 17:39
  SPEAKER_01: Let's just see.
• 17:40
  SPEAKER_01: Okay.
• 17:42
  SPEAKER_01: Man, this is interesting.
• 17:43
  SPEAKER_01: This actually is a follow-on statistic from the same report.
• 17:47
  SPEAKER_01: You know, I I started this by telling you that I shuffled this deck, and I swear to you, I did.
• 17:51
  SPEAKER_01: But this is this is the randomness of the world, right?
• 17:53
  SPEAKER_01: Okay.
• 17:54
  SPEAKER_01: So this one is also ransomware and extortion economics.
• 17:57
  SPEAKER_01: This is also from the 2026 Verizon Breach uh Data Breach Investigation Report.
• 18:02
  SPEAKER_01: And this one actually talks about payment.
• 18:04
  SPEAKER_01: So this is kind of interesting.
• 18:05
  SPEAKER_01: And here's the statistic.
• 18:07
  SPEAKER_01: The median ransom payment declined to$139,875 in 2025, down from$150,000 the prior year, continuing a two-year downward trend.
• 18:23
  SPEAKER_01: I'm gonna read it one more time.
• 18:24
  SPEAKER_01: The median ransom payment declined to$139,875 in 2025, down from$150,000 the prior year.
• 18:36
  SPEAKER_01: This is like full confirmation we were just talking about.
• 18:39
  SPEAKER_02: Right.
• 18:39
  SPEAKER_02: I was just gonna say that it's uh it's almost like reading our mind, and you know, it's uh the stars are aligned.
• 18:43
  SPEAKER_02: I mean, it's kind of like confirmation that, hey, we are getting better.
• 18:46
  SPEAKER_02: And uh, you know, this is from 2026.
• 18:49
  SPEAKER_02: So, I mean, given it's a two-year trend, I hope the trajectory continues.
• 18:53
  SPEAKER_02: Um, it is also uh what's kind of, I want to say a little maybe I don't want to say not so visible in that statistic as I wish it would say how many, what's the it's the median, but what is the average number of institutions that got hit by a ransomware?
• 19:09
  SPEAKER_02: Uh did that proportionally increase?
• 19:11
  SPEAKER_02: Is it that more people are paying uh or fewer people are paying more or more people are paying less?
• 19:18
  SPEAKER_01: So I would love to kind of buy do you happen to know that statistics uh from your I don't I don't know, but I I'm I suspect if you downloaded the 2026 Verizon Data Breach Investigation Report, it would be in there.
• 19:31
  SPEAKER_01: And I think that that's something that you know all the listeners here can kind of follow on and do.
• 19:35
  SPEAKER_01: Excellent publication, by the way, if people aren't reading it, we definitely should.
• 19:38
  SPEAKER_01: Um So I agree.
• 19:40
  SPEAKER_01: Like, and this is this is what's interesting is like I r I so I have a degree in political science and then I have a degree in philosophy.
• 19:47
  SPEAKER_01: I have no technical degrees whatsoever, but I just happen to luck into this industry that I absolutely love and makes a tremendous amount of sense to me.
• 19:54
  SPEAKER_01: But growing up in political science and philosophy, I had a political science professor that I I used to adore.
• 20:00
  SPEAKER_01: And he, I remember him vividly saying, because political science is all statistics, right?
• 20:05
  SPEAKER_01: Statistics about populists, statistics about con economics, like what motivates government, so forth and so on.
• 20:10
  SPEAKER_01: And everything is statistics.
• 20:12
  SPEAKER_01: And I remember him saying, you got to be really careful with statistics, because if you have one foot in a fire and one foot and a block of ice, on average you're comfortable.
• 20:22
  SPEAKER_01: Right.
• 20:23
  SPEAKER_01: And like that's always stuck with me.
• 20:24
  SPEAKER_01: So I agree.
• 20:25
  SPEAKER_01: We have to be a little careful with these things.
• 20:27
  SPEAKER_01: But again, like there's a couple of other interesting bright spots here.
• 20:30
  SPEAKER_01: Of course, the lower payment, of course, the downward trend.
• 20:34
  SPEAKER_01: I think the other thing that I'm I'm curious about, and what this doesn't talk about, and this is where we can think about like, again, what are the follow-on numbers?
• 20:42
  SPEAKER_01: What is the origin story for this particular statistic?
• 20:45
  SPEAKER_01: And how do we think about this as an industry?
• 20:46
  SPEAKER_01: And how do we think about this as professionals, as IT and cyber professionals?
• 20:51
  SPEAKER_01: Is are people, are the attackers getting better at it if they can just accept less?
• 20:56
  SPEAKER_01: Right.
• 20:56
  SPEAKER_01: Like, have they made up revenue based on volume?
• 21:00
  SPEAKER_01: Right.
• 21:00
  SPEAKER_02: Like if the numbers are right, have they commoditized the product and they can sell many more of those by rinsing and repeating the same process.
• 21:08
  SPEAKER_02: Uh but uh, you know, if they were to do that, I mean, uh again, these are people without scruples.
• 21:14
  SPEAKER_02: So I I think they would want to look at 2x, 3x in it.
• 21:17
  SPEAKER_02: I don't think they're looking for a discount sale like Amazon, where it's kind of like, hey, if you get attacked in, you know, for you know, Christmas in July, we're gonna give you a break.
• 21:26
  SPEAKER_02: Yeah.
• 21:27
  SPEAKER_02: So I think uh if I had to venture a guess, it's I'm guessing it's truly that we are getting better at many fronts.
• 21:34
  SPEAKER_02: And I think you also hit uh something very interesting, like the commoditization of endpoints, right?
• 21:40
  SPEAKER_02: So I mean data is on the cloud.
• 21:42
  SPEAKER_02: There are many more ways to protect it, and like you're hitting either uh Google Workspace or Amazon, um AWS or Microsoft, where you have like things like impossible travel, MFA being uh kind of made the norm, and you know, fish resistant MFA.
• 22:00
  SPEAKER_02: So with all that, you know, they might be able to compromise the computer, but the amount of valuable data that they're able to extract from it might be limited to what's in your downloads folder or your desktop.
• 22:10
  SPEAKER_01: Yeah, a hundred percent.
• 22:11
  SPEAKER_01: I yeah, it it's interesting you say that.
• 22:13
  SPEAKER_01: Like people don't realize how much valuable data is in your downloads folder.
• 22:16
  SPEAKER_01: Right.
• 22:17
  SPEAKER_01: So everyone out there, like once a month, just clear the thing out, right?
• 22:20
  SPEAKER_01: Make sure everything you've you've ever looked at from email is in there.
• 22:22
  SPEAKER_01: Just be aware.
• 22:23
  SPEAKER_01: I'm and and hopefully the cyber professionals that are listening to this are rolling their eyes, like, yeah, Paul, we know.
• 22:28
  SPEAKER_01: Um, you know what's interesting though?
• 22:29
  SPEAKER_01: Like if we if we keep going down this path, right, like talking about what would drive some of these costs down and and kind of this concept of volume is like what what folks, what some folks don't realize is that ransomware in and of itself has largely become an ecosystem.
• 22:47
  SPEAKER_01: And there are usually two, sometimes three teams involved that are completely disparate teams that specialize in particular functions for effectively what is just a piece of the pie.
• 22:56
  SPEAKER_01: Right.
• 22:57
  SPEAKER_01: So the first thing is you have your access brokers.
• 22:59
  SPEAKER_01: These are your initial access teams, right?
• 23:01
  SPEAKER_01: And they're individual groups that do nothing but gain access.
• 23:05
  SPEAKER_01: They're harvesting credentials from, you know, um, you know, uh GitLab and GitHub and looking for things that are stored in code and and and and pulling information from previous breaches and doing, you know, this is what you're seeing on most of these organizations' edges when we start to see things like brute force or credential stuffing, it's that initial access, half uh that initial access.
• 23:25
  SPEAKER_01: But it's also things like social engineering and it kind of getting their initial foothold.
• 23:30
  SPEAKER_01: When I've looked at at actual breaches, right?
• 23:32
  SPEAKER_01: Like when I've been a part of actual breaches for this and responding to these things, like the patterns are always really, really interesting.
• 23:39
  SPEAKER_01: Because what you have is you typically have that initial access, you have a lot of activity.
• 23:44
  SPEAKER_01: You'll see a spike of activity from those, that infrastructure, and then you'll see echo quiet.
• 23:49
  SPEAKER_01: And then every now and again you'll see little blips, then you'll see a ton of activity again, then you'll see the actual extortion event.
• 23:56
  SPEAKER_01: And the reason why that pattern is so important is because that is an indication that there was an access broker involved.
• 24:02
  SPEAKER_01: The access broker gained access, established persistence, then started the shopping access.
• 24:07
  SPEAKER_01: And the little blips are them showing, like, hey, look, I can get in here, here's the servers I can get into, here's the access, the data we have access to, here's a repository, and then they get out.
• 24:16
  SPEAKER_01: Right.
• 24:16
  SPEAKER_01: And then someone buys that access or they partner with a team that that specializes in exfiltration and extortion, because almost every attack is double extortion at this point, right?
• 24:25
  SPEAKER_01: From that point, they then do the exfiltration.
• 24:28
  SPEAKER_01: So they'll exfiltrate as much data as they possibly can and then hit people with kind of the encryption and the second phase extortion.
• 24:36
  SPEAKER_01: And like, because there are so many parties involved, like, is that driving the price down?
• 24:41
  SPEAKER_01: Right.
• 24:42
  SPEAKER_01: Are people like, yeah, here, look, here's your 10%.
• 24:44
  SPEAKER_01: I don't have to worry about access.
• 24:45
  SPEAKER_01: I can get in, I can get out.
• 24:46
  SPEAKER_01: Like, I wonder about the economics of ransom.
• 24:50
  SPEAKER_02: Right.
• 24:50
  SPEAKER_02: Yeah.
• 24:51
  SPEAKER_02: And, you know, we talked about ransomware as a service and the commoditization of ransomware itself.
• 24:56
  SPEAKER_02: I mean, maybe that's driving, or maybe there are other nation states that are willing to, you know, uh willing to engage in this at a cheaper cost than some of the traditional ones.
• 25:08
  SPEAKER_02: Right.
• 25:08
  SPEAKER_02: So to speak.
• 25:09
  SPEAKER_02: So yeah.
• 25:10
  SPEAKER_01: Well, here's the other thing that we we haven't thought about.
• 25:12
  SPEAKER_01: And at this point, I'm actually impressed that from this statistic, it took 26 minutes to bring AI in, but I'm gonna bring AI in.
• 25:19
  SPEAKER_01: I'm doing it.
• 25:19
  SPEAKER_01: I don't care.
• 25:20
  SPEAKER_01: Here's the other thing we haven't thought about from this particular statistic, if we're gonna think about this kind of long-term and pontificate, is has the implementation of AI and these unhinged AI models, things like Worm GPT or or what other kind of unrestricted models, has that driven the cost down?
• 25:36
  SPEAKER_01: Right.
• 25:37
  SPEAKER_01: Like, because now really anyone can just say, hey, yeah, produce me this thing.
• 25:41
  SPEAKER_01: It's gonna do here's my requirements.
• 25:43
  SPEAKER_01: Like everyone's vibe coding.
• 25:45
  SPEAKER_01: Like, why can't attackers now, right?
• 25:46
  SPEAKER_01: Like, has that made it so that they don't have to have these investments and pay out these big development teams, which is what people had to do before?
• 25:53
  SPEAKER_01: They'd have development teams, or they'd have like an individual who's coded this thing over however much time that expects to get paid.
• 25:59
  SPEAKER_01: Well, now they can just create malware on the fly, right?
• 26:03
  SPEAKER_02: Right.
• 26:03
  SPEAKER_02: Uh yeah, I mean that's again, um, yeah, I was thinking as I was talking about, you know, the next uh family of agentic swarms that are do nothing but, you know, trying to infiltrate your organization.
• 26:16
  SPEAKER_02: And it's also very interesting, you kind of hit um on it a little bit earlier, like the social engineering.
• 26:21
  SPEAKER_02: Gone are the days of the Nigerian Prince email.
• 26:24
  SPEAKER_02: You know, it's very sophisticated now where they are looking at disparate systems.
• 26:29
  SPEAKER_02: I can tell you they're looking at LinkedIn, they're looking at your website to be like, hey, who got recently hired?
• 26:34
  SPEAKER_02: Who who do you have a press release about?
• 26:36
  SPEAKER_02: And they go to tools like um, you know, truepeopleseearch.com that just compiles, paste a list of a whole bunch of information about you that's out public, uh, and you know, just public domain.
• 26:49
  SPEAKER_02: And you know, I mean, uh, I was very surprised when I first looked myself up on True People Search.
• 26:54
  SPEAKER_02: I'm like, oh my God, it has a list of every single movie I've had in the past 20 years.
• 26:59
  SPEAKER_02: Yeah, absolutely wow.
• 27:00
  SPEAKER_02: That that's they come back and bind that and send you an email, and they actually send you a text saying, hey, I'm your new XYZ, you know, can you do this for me?
• 27:08
  SPEAKER_02: And you're like, oh, there's no way it has you legitimate because how could they know my person cell phone number?
• 27:13
  SPEAKER_01: Right.
• 27:14
  SPEAKER_01: Oh, it's been uh I I've experienced a couple of wild things.
• 27:17
  SPEAKER_01: So like one of the things, and and this is this ties directly into what you were just talking about uh relative to LinkedIn.
• 27:23
  SPEAKER_01: We hired an intern, and like literally within four hours, he got an email from me, from Paul Marco, that said, Hey, this is Paul, really need you to call me on my WhatsApp, got a question for you.
• 27:39
  SPEAKER_01: It was four hours.
• 27:41
  SPEAKER_01: Like it was his first day.
• 27:42
  SPEAKER_01: And like, this is like the the speed that we're dealing with, the velocity that we're dealing with, right?
• 27:48
  SPEAKER_01: When we're when we're dealing with these issues.
• 27:50
  SPEAKER_02: Right.
• 27:50
  SPEAKER_02: And you know, with your voice being on all your podcasts, I mean, you know, with somebody with 11 labs of gun can impersonate your voice in what, 30 seconds?
• 27:58
  SPEAKER_02: Why would you say that?
• 27:59
  SPEAKER_02: Why would you put that on the I'm sure you can edit that out.
• 28:03
  SPEAKER_01: No, honestly, you're you I you're 100% right.
• 28:05
  SPEAKER_01: In fact, uh, we've gotten to the point in my family where we have to have safe words.
• 28:09
  SPEAKER_01: Like I I tell, I tell mom, I tell dad, I tell everyone, hey, listen, if I ever call you and I'm I'm in I'm in duress or having some trouble, if I don't say this safe word, hang up the phone.
• 28:20
  SPEAKER_01: Hang it up.
• 28:20
  SPEAKER_01: Like that's it.
• 28:21
  SPEAKER_01: Like there's no way.
• 28:22
  SPEAKER_01: Like it's getting wild up.
• 28:24
  SPEAKER_02: Yeah, it's multi-factor authentication, right?
• 28:26
  SPEAKER_02: It's not just what you know, it's what you have.
• 28:29
  SPEAKER_01: Well, this is so like this is the thing.
• 28:31
  SPEAKER_01: I've said this before, but like it's relevant here again.
• 28:34
  SPEAKER_01: And uh this thing, this is crazy to me.
• 28:37
  SPEAKER_01: Originally, the original control was passwords, right?
• 28:41
  SPEAKER_01: Like that was the number.
• 28:42
  SPEAKER_01: Hey, just make up a word, put it in here, we'll know it to you because it's your word, and only you know this word, right?
• 28:48
  SPEAKER_01: But then everyone was like, ooh, password stuff's getting a little crazy.
• 28:53
  SPEAKER_01: You know what?
• 28:54
  SPEAKER_01: Let's go to two-factor, right?
• 28:56
  SPEAKER_01: Let's go to two-factor.
• 28:57
  SPEAKER_01: And in this case, like if we're if you if you if you get an email and it feels like it's me, I want you to pick up the phone, I want you to call.
• 29:03
  SPEAKER_01: Let's do voice verification, okay?
• 29:05
  SPEAKER_01: I think that's really, really important.
• 29:07
  SPEAKER_01: So we did that.
• 29:07
  SPEAKER_01: So now it was like, all right, now I got this request.
• 29:10
  SPEAKER_01: Like, I don't know if it's you or not, but I'm gonna call and verify.
• 29:13
  SPEAKER_01: And of course, we have the voice emulation.
• 29:15
  SPEAKER_01: So people were like, listen, voice is out, need you to get on a video call with me.
• 29:20
  SPEAKER_01: I need you to make sure it's me, right?
• 29:22
  SPEAKER_01: Get on a call, hop, hop on Zoom, hop on Teams, ask me directly.
• 29:26
  SPEAKER_01: Okay, no problem.
• 29:27
  SPEAKER_01: Now we have video emulation.
• 29:29
  SPEAKER_01: So what are people doing?
• 29:30
  SPEAKER_01: They're creating safe words.
• 29:31
  SPEAKER_01: They're going right back to the beginning of the circle and getting right back to passwords.
• 29:34
  SPEAKER_01: That's funny.
• 29:35
  SPEAKER_01: Yeah, I mean, hopefully it doesn't get into, hey, do an automatic blood test, you know.
• 29:39
  SPEAKER_01: That's right.
• 29:40
  SPEAKER_01: I need a retinal scan as well as a fingerprint simultaneously while we while we check your voice pattern.
• 29:45
  SPEAKER_01: Well, look, Bippen, this has been an amazing conversation.
• 29:49
  SPEAKER_01: I'm psyched we got through two cards, although they were kind of the same card, which I thought actually was really complimentary, which I really enjoyed.
• 29:54
  SPEAKER_01: Yeah, it was almost like a part A and B.
• 29:56
  SPEAKER_01: Yeah, exactly.
• 29:57
  SPEAKER_01: Part A and part B.
• 29:58
  SPEAKER_01: But listen, let's let's just take a step back.
• 30:00
  SPEAKER_01: Like if there was something that you are leaving this podcast with, if there's something you want your listeners here to think about, what's that thing?
• 30:07
  SPEAKER_01: What's the thing that you have at the top of your head here?
• 30:10
  SPEAKER_02: I mean, one thing technical and one thing slightly ph philosophical.
• 30:15
  SPEAKER_02: I mean, most organizations that are engaging in cybersecurity, uh, you know, I think the next big thing is how you protect against data leaks and protect your data in the world of AI, whether it be through outside actors or even insider risk.
• 30:32
  SPEAKER_02: I mean, I think that's an untapped area where people have shadow AI kind of now being the top of the town.
• 30:39
  SPEAKER_02: So stay ahead of that.
• 30:41
  SPEAKER_02: And the other thing is, you know, um stay hungry, keep learning.
• 30:45
  SPEAKER_02: I think a lot of people say, oh, AI is coming for my job, it can do what I do.
• 30:49
  SPEAKER_02: But you know, in a world where AI knows everything, how do you prove that you're the expert?
• 30:53
  SPEAKER_02: It's the experience.
• 30:54
  SPEAKER_02: It is I can provide you one-word answers or paragraph answers, but it's not gonna have those lived lessons that you bring to work.
• 31:02
  SPEAKER_01: That's right.
• 31:02
  SPEAKER_01: That's that's that love of learning you were talking about.
• 31:05
  SPEAKER_01: I love that.
• 31:05
  SPEAKER_01: You know, for me, closing this episode, I you know, the thing that's gonna stick with me is is honestly like your shift in perspective or or your ability to shift my perspective is probably more accurate.
• 31:18
  SPEAKER_01: That this this really told me like we are getting better.
• 31:21
  SPEAKER_01: Like this wasn't as bad as I expected in my head.
• 31:23
  SPEAKER_01: It was a minimal kind of increase from, you know, 44% to 48%.
• 31:28
  SPEAKER_01: And I do truly think that people are starting to get it now.
• 31:31
  SPEAKER_01: This has become a spectacular Friday for me.
• 31:33
  SPEAKER_01: I really appreciate that.
• 31:35
  SPEAKER_01: Um, and honestly, it's been a it's been a pleasure having you on.
• 31:38
  SPEAKER_01: Really appreciate you taking the time.
• 31:40
  SPEAKER_02: And uh and thank you again.
• 31:42
  SPEAKER_02: Thank you so much for having me.
• 31:43
  SPEAKER_02: So it's been my pleasure.
• 31:44
  SPEAKER_01: Amazing listeners.
• 31:45
  SPEAKER_01: Well, we appreciate you listening.
• 31:47
  SPEAKER_01: Stay safe, be well, and we will talk to everyone soon.
• 31:49
  SPEAKER_01: Take care.