Latest / Tech Talks With Kinsoft / Last Week in Tech - Ivanti's Unpatched Chain, a Record 1,400-Fix Patch Tuesday, and the Essential Eight Gets a Successor

Transcript

Last Week in Tech - Ivanti's Unpatched Chain, a Record 1,400-Fix Patch Tuesday, and the Essential Eight Gets a Successor · Tech Talks With Kinsoft

• 0:00
  So imagine you just bought like the most expensive,
• 0:03
  heavy duty, absolutely impenetrable deadbolt
• 0:06
  on the market for your front door. Right. Top
• 0:08
  of the line. Exactly. You install it, you lock
• 0:11
  it, and you feel completely safe. But what if
• 0:15
  the lock itself, I mean, the very piece of hardware
• 0:18
  you bought to keep intruders out is actually
• 0:20
  the exact mechanism. welcoming them inside. Yeah,
• 0:24
  that completely flips the concept of physical
• 0:26
  security upside down. You know, you stop worrying
• 0:29
  about someone breaking a window and you realize
• 0:31
  the primary threat is, well, the premium door
• 0:34
  you just installed. It's crazy. And welcome to
• 0:38
  today's Deep Dive. We are unpacking a massive
• 0:42
  tech and cybersecurity roundup today, covering
• 0:44
  the week of October 10th to the 17th, 2026. It's
• 0:48
  been a busy week. Oh, heavily. Our mission...
• 0:51
  for this deep dive is to decode a sudden, frankly,
• 0:54
  terrifying spike in cyber vulnerabilities. We
• 0:57
  need to figure out why our digital front doors
• 0:59
  are under siege right now. Yeah, and we're also
• 1:02
  going to look at how the entire paradigm of corporate
• 1:05
  security is shifting. It's moving out of the
• 1:07
  IT backrooms and, frankly, directly into the
• 1:10
  boardroom. Exactly. It's no longer just a headache
• 1:13
  for the tech support desk, right? No, not at
• 1:15
  all. I mean, it is a foundational issue dictating
• 1:18
  whether a business can even... you know, open
• 1:21
  its doors tomorrow morning. Right. So whether
• 1:24
  you're running a company, managing a team or
• 1:25
  just trying to navigate a world where your personal
• 1:27
  data constantly feels up for grabs, we are going
• 1:30
  to connect the dots for you today. Because it
• 1:32
  really does feel precarious right now. It really
• 1:34
  does. We'll get why it feels that way and what
• 1:37
  the new rules of survival actually are. And to
• 1:40
  understand the current threat landscape, we have
• 1:43
  to start where the attackers are starting. Right
• 1:45
  at the perimeter. Yeah. They aren't trying to
• 1:47
  break through the walls anymore. They are walking
• 1:49
  right up to the edge devices. And those edge
• 1:51
  devices, they are the literal digital front doors.
• 1:54
  We're talking about appliances like VPNs or email
• 1:57
  gateways that sit on the absolute perimeter of
• 2:00
  a corporate network. Right, the stuff facing
• 2:02
  the public. And security firm Valexity just disclosed
• 2:05
  a highly critical zero -day flaw in Avanti Connect
• 2:08
  Secure. Yeah, CVE -2026 -104935. That's the one.
• 2:13
  It's an unauthenticated bypass that leads to
• 2:15
  remote code execution. So think of a VPN as the
• 2:19
  bouncer at a very exclusive club, right? I like
• 2:22
  that analogy. Yeah. This bouncer is supposed
• 2:24
  to check your ID, verify you're on the VIP list,
• 2:27
  and only then let you into the corporate network.
• 2:29
  Right. A good bouncer keeps the chaos out. But
• 2:32
  this vulnerability means someone on the open
• 2:34
  internet with no username, no password at all,
• 2:38
  can just stroll right up to that bouncer. Just
• 2:40
  walk right up. Exactly. and essentially mind
• 2:43
  -controlled them into running their own malicious
• 2:45
  commands. Wow. Yeah. The unauthenticated part
• 2:48
  is what really keeps security professionals up
• 2:50
  at night. Attackers do not need stolen credentials
• 2:53
  for this. They don't have to guess a password
• 2:55
  or anything? Nope. They don't have to trick your
• 2:57
  accounting department with a clever phishing
• 2:59
  email. They just scan the internet, find the
• 3:01
  appliance, and take over. Which means if the
• 3:04
  bouncer's compromised, all those fancy security
• 3:06
  cameras inside the club are basically useless.
• 3:08
  Completely useless. And the timeline on this
• 3:11
  Avanti flaw makes it even worse. I mean, Flexity
• 3:14
  found it being actively exploited in the wild
• 3:16
  around October 3rd. Yeah, early October. Right.
• 3:19
  But fixed software builds like version 25 .1
• 3:21
  .1 .2 weren't published until roughly 10 days
• 3:24
  later. That is 10 stray days of a wide open door
• 3:28
  for anyone who knew how to turn the knob. And
• 3:30
  honestly, 10 days in the cybersecurity world
• 3:32
  is a lifetime. During that window, an attacker
• 3:35
  group tracked as UTA 0576 was... Incredibly busy.
• 3:40
  Oh, I bet. Yeah. And they didn't just use this
• 3:42
  single flaw. They actually chained three different
• 3:44
  weaknesses together. Chaining. That's where they
• 3:47
  use one flaw to get to the next, right? Exactly.
• 3:49
  It's a fascinating, if terrifying, tactic. They
• 3:52
  use one minor flaw to get a tiny foothold, which
• 3:56
  then positions them to exploit a second flaw.
• 3:59
  Which gets them deeper. Right. And that gives
• 4:00
  them the exact access they need for a third flaw.
• 4:03
  It's like... Picking the front door lock, which
• 4:06
  gets you close enough to the alarm panel, which
• 4:09
  you then short circuit to open the main safe.
• 4:11
  Perfect way to put it. And the reports note that
• 4:13
  while the first two weaknesses in this chain,
• 4:15
  the authentication bypass and the remote code
• 4:18
  execution, those are fixed in the new updates.
• 4:20
  Okay, good. But the third weakness is not. Wait,
• 4:24
  really? The third one is just left open. Yeah.
• 4:27
  That third one allows a privilege escalation
• 4:30
  straight up. to root access. And as of the end
• 4:33
  of this reporting week, there is absolutely no
• 4:34
  fix for it. That's insane. So patching doesn't
• 4:38
  even fully solve it. Well, patching the system
• 4:40
  closes that initial front door, you know, stopping
• 4:43
  new attackers from casually strolling in. But
• 4:45
  if a sophisticated group is already inside, that
• 4:49
  third unpatched flaw means they can escalate
• 4:52
  their control to the absolute highest level.
• 4:54
  Root access. Root access means they own the machine.
• 4:58
  They can do anything they want. Oh, wow. This
• 5:01
  is exactly why Valexity explicitly warned businesses
• 5:03
  not to just rely on the vendor's built -in integrity
• 5:07
  checker. Because it might miss it. Exactly. The
• 5:09
  automated tool scanning the system can actually
• 5:12
  miss this specific complex chain of attacks completely.
• 5:16
  So, I mean, if you're an IT director listening
• 5:18
  to this right now, patching just became the bare
• 5:21
  minimum. The absolute bare minimum. The assumption
• 5:24
  has to shift from we applied the update, we can
• 5:27
  relax to we might already be compromised. Like
• 5:31
  if your appliance was exposed to the Internet
• 5:33
  in early October, you basically have to treat
• 5:36
  it as breached. You do. And that requires a completely
• 5:39
  different operational mindset. It means manually
• 5:42
  digging through server logs for subtle signs
• 5:45
  of compromise. Which takes forever. It does.
• 5:47
  And crucially, it means you have to rotate all
• 5:50
  the credentials that flow through that device.
• 5:52
  Oh, because they were watching. Exactly. If an
• 5:55
  attacker was sitting inside your VPN for a week,
• 5:57
  they were quietly watching all your traffic and
• 6:00
  harvesting all the usernames and passwords going
• 6:02
  past them. Which raises a really provocative
• 6:05
  question from our sources. Does the VPN even
• 6:08
  need to be facing the open Internet at all anymore?
• 6:10
  It's a great question. Right. Because if the
• 6:12
  bouncer is the biggest liability, maybe it's
• 6:15
  time to stop putting the bouncer out on the public
• 6:17
  street corner. And network architects are debating
• 6:20
  that exact question right now because, you know,
• 6:22
  it's not an isolated incident with Avanti either.
• 6:25
  There's a similar highly critical flaw in Cisco's
• 6:28
  secure email gateway. Oh, right. CVE. 202676519.
• 6:33
  That's the one. And in that case, an attacker
• 6:35
  can write arbitrary files and run commands as
• 6:38
  root without even logging in. Again, unauthenticated.
• 6:41
  Yep. But what makes that Cisco flaw so strange
• 6:44
  is the timeline. Cisco shipped the fixed software
• 6:47
  releases way back on September 14th. Okay, September.
• 6:50
  But the advisory actually warning customers about
• 6:53
  the flaw didn't go out until a month later on
• 6:55
  October 14th. Wait, why the delay? They only
• 6:58
  sent it out after they learned it was being actively
• 7:00
  exploited in the wild. So the vendor built a
• 7:03
  new lock, but didn't tell anyone the old lock
• 7:05
  was dangerously broken until people started reporting
• 7:07
  break -ins. Pretty much. It highlights a massive
• 7:10
  breakdown in communication between the vendors
• 7:12
  building our defenses and the companies relying
• 7:14
  on them. That is just wild. When the people making
• 7:18
  the locks are telling us after the fact that
• 7:20
  the locks were broken the whole time, you really
• 7:23
  start to worry about the rest of the house. You
• 7:24
  absolutely do. We aren't just seeing targeted
• 7:28
  attacks on these edge devices either. We are
• 7:31
  drowning in a sheer overwhelming flood of software
• 7:34
  flaws across the board. Like Microsoft's October
• 7:37
  patch Tuesday just broke records. Oh, it was
• 7:40
  a massive drop. Yeah, they fixed roughly 1 ,400
• 7:43
  vulnerabilities in a single day. Yeah, and around
• 7:45
  80 % of those were rated critical. Just for some
• 7:48
  context, the previous month, September, saw about
• 7:51
  974 fixes. Jumping to 1 ,400 is an enormous leap
• 7:56
  in volume. Huge leap. And that batch includes
• 7:58
  a mark of the web bypass, right? CVE -2026 -96951.
• 8:05
  It was actively being used by attackers. Yeah,
• 8:07
  that's a nasty one. For anyone listening who
• 8:10
  might be unfamiliar, the mark of the web is that
• 8:12
  little digital flag Windows attaches to a file
• 8:15
  when you download it from the internet. It's
• 8:17
  the mechanism that triggers that annoying but...
• 8:19
  helpful pop -up warning asking, are you sure
• 8:21
  you want to open this? Right. The one everyone
• 8:22
  just clicks through anyway. But bypassing that
• 8:25
  flag means a malicious file downloaded from a
• 8:27
  shady website can masquerade as a completely
• 8:30
  safe local file. So it doesn't even warn you.
• 8:32
  Exactly. It strips away your chance to second
• 8:34
  guess the download, tricking the operating system
• 8:37
  into executing it without any warnings at all.
• 8:39
  Wow. But the bigger question here is why we are
• 8:43
  suddenly seeing 1 ,400 bugs in a single month.
• 8:46
  I mean, the sources point squarely to AI -assisted
• 8:49
  vulnerability discovery. Oh, AI is completely
• 8:51
  changing the game here. Right. We have artificial
• 8:54
  intelligence models literally hunting for flaws
• 8:56
  at superhuman speeds. It feels like we are frantically
• 9:00
  bailing water out of a leaky boat. That's a good
• 9:03
  way to look at it. If AI is finding 1 ,400 holes
• 9:06
  in our hull every single month, are we just bailing
• 9:10
  faster and faster instead of building a better
• 9:11
  boat? I mean, that is arguably the defining tension
• 9:15
  in modern cybersecurity right now. We are supercharging
• 9:18
  our ability to find flaws, which on paper sounds
• 9:21
  fantastic, right? Sure. You want to find them
• 9:23
  first. You always want to find the vulnerability
• 9:25
  before the bad guys do. But the logistical burden
• 9:28
  of testing and deploying 1 ,400 patches across
• 9:31
  an enterprise network, it's crushing IT departments.
• 9:35
  Teams literally need a collective vacation just
• 9:38
  to recover from Patch Tuesday. I can't even imagine.
• 9:41
  And the cost of that burden is just staggering.
• 9:44
  I was reading the Bank of America CEO's report,
• 9:47
  and they said they spent a couple of hundred
• 9:49
  million dollars plus last quarter on software
• 9:52
  fixes and anti -money laundering efforts. Hundreds
• 9:55
  of millions. Yeah. They had to bring on 1 ,000
• 9:58
  contractors, and that is on top of their 3 ,000
• 10:01
  existing staff, just to patch the flaws being
• 10:03
  surfaced by AI models like Anthropix Mythos.
• 10:06
  A thousand temporary workers just to keep the
• 10:09
  water from sinking the ship. Right. It just shows
• 10:11
  that finding the bug is only the very first step.
• 10:14
  Testing the patch to make sure it doesn't break
• 10:16
  your existing software and then deploying it
• 10:18
  across thousands of machines, that takes massive
• 10:21
  human capital. But hold on, is AI actually helping
• 10:24
  us here or is it just generating expensive busy
• 10:27
  work? Well, it depends on who you ask. Because
• 10:29
  the source material includes an interesting counterpoint
• 10:31
  from Mozilla's CTO. They mentioned an AI found
• 10:35
  271 bugs in the Firefox browser, but they claimed
• 10:38
  there wasn't a single one that an elite human
• 10:40
  researcher couldn't have found. Right. Human
• 10:43
  experts are still top tier. So is this technology
• 10:46
  making us safer or just creating an impossible
• 10:48
  to -do list that costs hundreds of millions of
• 10:51
  dollars to process? I think the key... Is that
• 10:54
  AI is scaling the discovery process, not necessarily
• 10:57
  inventing new categories of vulnerabilities.
• 11:00
  Okay, so just doing it faster. Yeah, it is doing
• 11:03
  the tedious, meticulous legwork of an elite human
• 11:06
  researcher, but it's doing it millions of times
• 11:08
  a second, 24 hours a day. Wow. So yes, it is
• 11:12
  definitely creating an impossible to -do list.
• 11:14
  And this is exactly where organizations have
• 11:16
  to shift their strategy toward prioritization
• 11:18
  over panic. You simply cannot patch everything
• 11:21
  at once. But how do you even begin to prioritize
• 11:23
  1 ,400 red alerts? I mean, if my dashboard is
• 11:27
  completely lit up, where do I even start? So
• 11:31
  the source cites Tyler Reguli from Fortra, and
• 11:33
  he brings up a crucial, honestly calming statistic.
• 11:37
  Of all the Microsoft vulnerabilities discovered
• 11:39
  in 2026, fewer than 1 % are actually known to
• 11:44
  be exploited in the wild. Wait, really? Less
• 11:47
  than 1 %? At the time of that report, it was
• 11:50
  only 26 out of the thousands found for the whole
• 11:52
  year. Out of thousands of terrifying red flags,
• 11:55
  only 26 are actually being used by attackers
• 11:58
  to break into systems. That's it. That's it.
• 12:00
  And that is the secret to not burning out your
• 12:03
  team. If you try to patch all 1 ,400 equally,
• 12:06
  systems will break from untested updates, and
• 12:08
  you'll likely miss the truly dangerous, actively
• 12:11
  exploited flaws hidden in all that noise. That
• 12:13
  makes sense. Yes. You get lost in the weeds.
• 12:15
  Exactly. The lesson is to patch the actively
• 12:18
  exploited ones first and anything facing the
• 12:21
  open internet first. You have to build a sustainable
• 12:24
  rhythm of patching rather than treating every
• 12:26
  single AI -discovered bug as an existential crisis.
• 12:29
  Okay, but when that rhythm fails or a patch doesn't
• 12:32
  hold, the consequences spill out of the digital
• 12:34
  realm and into the physical world almost immediately.
• 12:36
  They absolutely do. Look at the real -world chaos
• 12:39
  of the October 12th security issue at Hold Del
• 12:42
  Haze. For context for our listeners, this is
• 12:45
  a massive retail group. They own supermarket
• 12:47
  chains like Albert Heine, Food Lion, and Stop
• 12:51
  and Shop. They're huge. Yeah, we are talking
• 12:54
  about more than 9 ,400 physical stores globally.
• 12:58
  And operating at that scale requires an immensely
• 13:01
  complex digital nervous system, tracking inventory,
• 13:04
  payroll, logistics, and customer data in real
• 13:07
  time. Right. And while the physical stores managed
• 13:09
  to keep their doors open during this incident,
• 13:12
  That digital nervous system took a massive hit.
• 13:14
  A very public hit. Yeah. Employee posts indicated
• 13:17
  that staff couldn't access their schedules or
• 13:20
  their pay stubs. European broadcasters reported
• 13:23
  that websites and apps went down completely across
• 13:25
  multiple brands. It was a mess. Now, our sources
• 13:28
  are very careful here, and we need to be too.
• 13:31
  We have to be completely impartial. Ahold Delahaye's
• 13:35
  hasn't confirmed the exact cause. Right. They
• 13:36
  haven't said much. They haven't stated if it's
• 13:39
  ransomware. and they haven't confirmed if any
• 13:41
  customer data was stolen. We are strictly looking
• 13:44
  at the symptoms of a major outage, not diagnosing
• 13:47
  the disease. And treating the symptoms, as reported,
• 13:50
  is really the only responsible way to analyze
• 13:52
  an ongoing incident like this. But those symptoms
• 13:55
  teach us a vital lesson about modern digital
• 13:58
  dependency. How so? We have optimized our businesses
• 14:01
  so much that we completely forgot how to function
• 14:04
  without the network. Oh, absolutely. I mean,
• 14:07
  picture walking into your workplace tomorrow
• 14:08
  morning. and every single core digital system
• 14:11
  is just gone. Terrifying. The screens are blank.
• 14:15
  No schedules, no payroll access, no internal
• 14:18
  communications. It's like relying entirely on
• 14:22
  your phone's GPS for a cross -country road trip,
• 14:24
  and suddenly you hit a dead zone in the middle
• 14:26
  of nowhere with no signal. Yeah. And you just
• 14:29
  freeze. Right. Do you still have a paper map
• 14:31
  in the glove box? And even if you do, do you
• 14:34
  even know how to read it? Or is it some dusty
• 14:37
  relic from 2010 that no one understands anymore?
• 14:39
  Every single business leader needs to be asking
• 14:42
  themselves that exact question today. The core
• 14:44
  business lesson from the Ejol Delez situation
• 14:46
  is the absolute necessity of the offline fallback.
• 14:51
  The offline fallback. Yes. True security resilience
• 14:54
  isn't just about building higher digital walls
• 14:56
  to prevent hacks. It is about continuity of operations.
• 15:00
  The walls will eventually be breached. A patch
• 15:03
  will eventually fail. The servers will go dark.
• 15:06
  So what does that offline fallback actually look
• 15:08
  like for a massive modern supermarket? It means
• 15:11
  having manual analog procedures ready to go at
• 15:14
  a moment's notice. If the scheduling software
• 15:16
  dies, can your store manager print a roster on
• 15:18
  actual paper? Right. If the point of sale network
• 15:21
  goes down, can you still process a customer's
• 15:23
  payment using an offline terminal or cash? Can
• 15:26
  you issue a physical payslip or a manual check
• 15:29
  so your employees can still pay their rent on
• 15:31
  Friday? Wow. Going back to paper checks. The
• 15:34
  operational technology of running a business
• 15:36
  has become so deeply intertwined with the IT
• 15:38
  network that when the network falls down, the
• 15:40
  physical business often freezes completely. Resilience
• 15:43
  means knowing how to decouple them in an emergency.
• 15:46
  And the stakes for getting that wrong are incredibly
• 15:49
  high. We are talking hundreds of millions of
• 15:52
  dollars in mitigation costs and massive paralyzing
• 15:55
  operational chaos. It's enough to bankrupt a
• 15:58
  company. Definitely. And because the fallout
• 16:00
  is so severe. Governments and regulators are
• 16:03
  stepping in and completely changing the rules
• 16:05
  of the game. The era of cybersecurity being written
• 16:08
  off as just an IT problem is completely dead.
• 16:11
  Oh, it's buried. We are witnessing a total paradigm
• 16:14
  shift in corporate governance. The liability
• 16:16
  is rapidly moving up the chain of command. Right.
• 16:19
  Because when businesses are paralyzed and customers
• 16:21
  are locked out, governments eventually drop the
• 16:24
  hammer. And we're seeing that regulatory hammer
• 16:26
  drop right now in Australia. Yes. Big news out
• 16:29
  of Australia. On October 15th, the Australian
• 16:32
  Signals Directorate launched ASD Essentials.
• 16:35
  This framework replaces their older Essential
• 16:38
  8 maturity ladder. I remember the Essential 8.
• 16:41
  Yeah. The old system was basically a standard
• 16:43
  checklist moving from level one to level three.
• 16:46
  The new system is described as a principles -based
• 16:50
  approach. Which is a big shift. Massive. It focuses
• 16:53
  heavily on identity management and, tying perfectly
• 16:56
  back to our first segment, the security of edge
• 16:58
  devices. But most importantly, it explicitly
• 17:02
  demands defined executive and board accountability.
• 17:04
  It completely removes the plausible deniability
• 17:07
  from the boardroom. It connects technical failures
• 17:09
  directly to leadership oversight. But let me
• 17:12
  push back on this for a second. A shift from
• 17:14
  a clear level one to three checklist to a vague
• 17:18
  principles -based approach makes me a little
• 17:21
  suspicious. Doesn't moving to principles just
• 17:23
  create a blurry line? It can seem that way, sure.
• 17:28
  I mean, it sounds like it just makes it easier
• 17:30
  for regulators to point fingers and hand out
• 17:33
  million dollar fines to executives when things
• 17:35
  inevitably go wrong. Because a principle is so
• 17:38
  much harder to define than a simple checklist.
• 17:41
  Well, you have to look at it from the perspective
• 17:43
  of why checklists fail in the real world. Checklists
• 17:47
  inevitably turn cybersecurity into a bare minimum
• 17:50
  compliance exercise. OK, I see what you mean.
• 17:53
  An IT director checks the eight boxes, hands
• 17:56
  the piece of paper to the board. The board glances
• 17:59
  at it, says, great, we're secure, and files it
• 18:01
  away. They did the bare minimum to pass the audit,
• 18:04
  and they never think about it again until the
• 18:06
  next audit. They treat it like a chore rather
• 18:08
  than a dynamic defense. Exactly. Principles force
• 18:13
  genuine, continuous risk ownership. You cannot
• 18:16
  just check a box for identity security once a
• 18:19
  year. You have to prove. constantly that the
• 18:22
  principle of secure identity is being upheld
• 18:24
  across your ever -changing, evolving network
• 18:27
  environment. That makes sense. And if you want
• 18:29
  proof of this new regulatory teeth, just look
• 18:32
  at the recent ASIC action against Fortnum Private
• 18:34
  Wealth. Oh man, this is a wild story that should
• 18:37
  make every executive sit up. The Australian Securities
• 18:40
  and Investments Commission ordered this financial
• 18:43
  advisory network to pay a $1 .35 million penalty.
• 18:47
  plus $250 ,000 in costs. That's a massive hit.
• 18:51
  Huge. And this was over cybersecurity failures
• 18:54
  that ended up affecting about 55 ,000 clients
• 18:57
  between 2021 and 2023. But the real kicker here
• 19:01
  is that ASIC openly admitted the company's conduct
• 19:04
  was not deliberate. Right. And that ruling is
• 19:06
  the ultimate proof of the paradigm shift we are
• 19:09
  talking about. You do not have to be malicious
• 19:11
  to be held legally and financially liable anymore.
• 19:14
  Just negligent. just have to be negligent in
• 19:17
  your digital defense. Regulators are now looking
• 19:19
  at weak cyber controls not as a stroke of bad
• 19:22
  luck or the unfortunate result of a sophisticated,
• 19:25
  unstoppable hacker. They are treating a weak
• 19:27
  defense as a direct legal breach of your obligations
• 19:31
  to your clients. So throwing up your hands and
• 19:33
  saying, we got hacked, we were the victims too,
• 19:36
  is no longer a valid legal defense in the eyes
• 19:38
  of regulators. Not if you left the digital front
• 19:40
  door unlocked and the alarm system turned off.
• 19:43
  The expectation now is that the CEO and the board
• 19:45
  of directors must own the cyber risk just as
• 19:48
  seriously and with the exact same level of scrutiny
• 19:50
  as they own financial risk, market risk or workplace
• 19:53
  safety. It's just the core business function
• 19:55
  now. Exactly. It's a core business function.
• 19:59
  Well, let's pull all these threads together for
• 20:01
  you. We started at the physical front door, looking
• 20:04
  at the deadbolts that are actually welcoming
• 20:06
  the intruders in. Those are the vulnerable edge
• 20:09
  devices like VPNs and email gateways. which are
• 20:12
  under relentless attack by adversaries who are
• 20:14
  chaining flaws together and hiding in the blind
• 20:17
  spots. Then we explored the sheer overwhelming
• 20:19
  volume of the threat. AI models are supercharging
• 20:23
  the discovery of vulnerabilities, creating a
• 20:26
  massive financial and logistical burden on businesses
• 20:28
  trying to patch everything. And the key survival
• 20:31
  tactic there is prioritizing the active threats
• 20:34
  over the theoretical ones. Yeah. And we also
• 20:37
  saw what happens when the digital layer fails.
• 20:39
  with massive retailers facing physical gridlock.
• 20:42
  It highlights why every single organization needs
• 20:45
  an offline fallback plan. You have to know how
• 20:48
  to read the paper map when the GPS suddenly cuts
• 20:50
  out. Absolutely. And finally, because of all
• 20:52
  this escalating chaos, regulators are completely
• 20:54
  changing the rules. They are tearing up the old
• 20:57
  IT checklists and holding the boardroom legally
• 21:00
  and financially accountable for cyber negligence.
• 21:02
  The overarching theme of this entire week of
• 21:05
  news is that passive security is no longer an
• 21:08
  option. Organizations have to actively manage
• 21:11
  their perimeter, understand their true vulnerabilities
• 21:13
  in real time, and take absolute leadership ownership
• 21:17
  of the risk. Which leaves me with one final forward
• 21:20
  -looking thought. We talked about massive banks
• 21:23
  using AI to find vulnerabilities and then deploying
• 21:26
  a thousand humans to patch them. But if AI is
• 21:29
  accelerating the discovery of flaws to a volume
• 21:32
  that humans, even well -funded armies of humans,
• 21:36
  can barely keep up with, Will we soon reach a
• 21:39
  tipping point? It feels like we have to. Will
• 21:42
  we soon reach a point where software updates,
• 21:45
  security patching, and active defense are entirely
• 21:47
  managed by AI, removing human oversight completely?
• 21:51
  And if we get so frustrated with a heavy -duty
• 21:54
  deadbolt on our front door that we decide to
• 21:56
  just hand the keys over to an artificial intelligence
• 21:59
  to lock and unlock it for us, what entirely new,
• 22:03
  unpredictable risks does that create for our
• 22:05
  future? Yeah, that's the million dollar question.
• 22:08
  It really is. Something to think about the next
• 22:10
  time you lock your front door. Thanks for joining
• 22:13
  us on this deep dive.