The Ledger
Every statement that passed quotation and attribution checks. Mix any filter with any other: certainty 1/5, debate potential 5/5, or both at once.
why aren't all 18 resolved? a statement only gets an assessment when the public record can support or contradict it. opinions and what-ifs never can, and 0 checkable ones are still open, waiting for their date. predictions held up or didn't; assertions are supported or contradicted. on every card: ▮▮▮▮▮ certainty · ▮▮▮▮▮ debate potential. speakers are clickable
Kurtz: China directly hands stolen US trade secrets to its domestic companies
“The big thing with China is, there's a commercial aspect to what they do. So if the government breaks in and steals a trade secret from some company in the U.S., they'll just give it to another company in China.”
Kurtz: Hackers are deploying prompt-only autonomous malware that interacts with LLMs
“What we're seeing now is prompt only autonomous malware, meaning I can drop the prompt on your computer by a variety of means, and then it will autonomously interact with an LLM, and it will give a unique fingerprint every time it runs.”
Kurtz: Modern AI cyber threats can run autonomously without phoning home
“Now these can run autonomously whatever, without ever phoning home.”
Kurtz: All software contains unpatched zero-day vulnerabilities
“There are zero days in all software”
Kurtz: Two AI agents collaborated to bypass enterprise administrative security guardrails
“These two agents are reasoning and they went right around The guardrails that were put in place.”
Kurtz predicts each corporate employee will eventually control 90 AI agents
“On average, each employee is going to have about 90 agents they control.”
Kurtz: LLMs empower less-skilled hackers to execute nation-state level cyberattacks
“You're minting new adversaries because you don't have to have all the knowledge that you had to have in the past. You can ask any number of LLMs and you can get answers back. So what's happened is the attack timeline has been compressed. You can automate all o…”
Kurtz: CrowdStrike uncovered hundreds of North Korean operatives working as US engineers
“Well, it, it's hard to find these guys, but any event we found 40 of them. We were right. 40 of them. That, that's for the first run. We found hundreds now over.”
Kurtz: Nation-state hackers will always break into a target phone if determined
“If you look at the nation states and some of the creative ways they can actually get into a phone, as an example, if they want to get in bad enough, they're going to get in.”
Kurtz: Top companies embed cybersecurity personnel in HR to filter AI resumes
“So, what we're seeing now is the best companies are actually embedding a security person in the HR group, where they're pre-filtering all these resumes, because the resumes are AI generated, the LinkedIn profiles are AI generated, so you want to catch them up …”
Kurtz: CrowdStrike has never operated or generated revenue in China
“We don't have operations there. We don't have any revenue. We don't sell them to China. Never have. From the start of the company.”
Kurtz: Help desk speed incentives create major cybersecurity vulnerabilities
“So their whole job is to open a ticket, solve a problem, close a ticket. So if you follow the money and the incentives, you can see why there's a problem and people want to be helpful at the help desk and hence they get into the situation.”
Kurtz: The web browser is the primary front door for cyber adversaries
“So it's the front door now for how people work and how adversaries get in us through the browser.”
Kurtz: CrowdStrike uses internal SLMs and guardrails when leveraging LLMs
“We, well, we have our small language models, and we do work with just about all of the large language models. But we've built our own guardrails around what gets shared, how it gets shared, and how we process any of the data back.”
Kurtz: Companies shouldn't try to replicate billions in frontier AI R&D
“For other bigger, you know, frontier type models, I mean, you're not going to replicate billions in R and D you want to leverage what's out there and take the best of it.”
Kurtz: Rising geopolitical tensions consistently drive increased cybersecurity activity
“Whenever you see the geopolitical tensions go up, there's always more security activity”
Kurtz: Trump administration takes platform-focused, business-first cybersecurity approach
“When you think about what the administration is doing with security, they're taking a business first approach. You know what that means? They want to save money. They want to consolidate. They want platforms. They want better outcomes. Right. And they don't wa…”