The Exchanges

Q That's when we all first started getting online, right? I think I got AOL in 1993. This is the very beginning.

A Wait, what was that called? AOL, yeah. Hey, growing up in the, you know, the DC area, we know a lot about AOL. But, uh, I, I lived with the whole thing. You know, the first couple of intrusions happened in 88 with the Hanover hackers and Cliff Stoll and those sort of things. You have the Morris worm. Actually, I think Cliff Stoll was 84. Morris worm was 88. Guy at Cornell, you know, right in a worm that, uh, had a finger demon buffer overflow and kind of spread them across Unix machines. By 93, I'm sitting at the Pentagon looking at log files, TS log file, secret log files, figuring out who's doing what. And by 1995, I'm responding to my first ever computer intrusions as an Air Force Uh, special agent in the Air Force Office of Special Investigations.

AI assessment note: “By 93, I'm sitting at the Pentagon looking at log files”

Q Tell us one of your favorite early war stories from the nineties or 2000. Like what, what, what, when did this really start to get more dynamic and complex for you?

A Well, I can tell you in 1996, when I responded to intrusions, I remember one of the first intrusions I responded to that was China. You know, back then it was, there was almost nobody responding to intrusions. It was kind of like a, so what? Like who cares? These guys are breaking into military systems. What are they doing? Flag officers aren't really using email. There's not much there. The reality is there was stuff there. I, I think one of the first major cases that I responded to, I went, okay, now I get it. Was that the Russians broke in and they were exporting, uh, display. In other words, they were, they were running our weapons modeling and simulation software from Russia and seeing how it worked.

AI assessment note: “one of the first major cases that I responded to... Russians broke in”

Q What's made it interesting to go in again? Because I, I think obviously you made a lot of money, you've done really well. Like, are there new threats with AI?

A Are there new possibilities? Joe, it is impossible to sit on the sidelines when you see the AI shift change comment. Are you kidding? Like, oh, I could be, no offense, I could be an investor. You know, maybe that's what you do all the time. But for me, I was sitting there going, in security, I haven't actualized my dreams yet. We still have victim companies, and you can see the future crystal clear right now in cyber. You're gonna have AI agents on offense, automating incredibly talented humans, you know, like literally that brain surgeon analogy. AI agents will be that, and you're gonna have swarms of agents that can communicate, and think, and instantiate normal, and learn, and have total recall, and operate at a scale and scope where as we go from Human-led offensive operations in cyberspace for crime and espionage to AI-led, agent-led espionage and cybercrime. Uh, that shift change is real, and we've got to create systems that prepare us for it.

AI assessment note: “it is impossible to sit on the sidelines when you see the AI shift change”

Q Well, if I was, if I was a state with utilities I was in charge of, I'd want to be hiring guys like you to, to, to show me how you break into my utilities so I can fix it, right?

A You should never, the number one question every single CEO really asks when it comes to cybersecurity, In many different forms is, are we secure? That simple. What's worst case scenario? What can happen? The only way to answer that question is in a safe and simple way, you shoot the bullets at the best to see what you can stop. You have to simulate wartime. You have to simulate, unfortunately in the cyber domain, there's a pretty high level percolating hum of offense, even during times of peace, you know? Um, you gotta, Really make sure you can withstand the attacks that are out there. And by the way, there's no other way to get unvarnished truth, Joe. If you want to know how good your security is, you just got to test it. You can't read the manuals and go with the 38 different products we're running, we're good to go. You really need to know is our defense that's been kind of duct taped together and massaged over many years capable of withstanding a modern attack.

AI assessment note: “If you want to know how good your security is, you just got to test it.”

Q How does this stuff roll out in general in our society? So let's say you're gonna, you're gonna build this, the governments are gonna use it, the corporations are gonna use it, like, like, like a CEO who's listening to this, like, like what should they be thinking about dealing?

A CEOs want to know what can I withstand? How good am I at security? Am I secure? Can I, you know, did the frontline headline I just read about on the breach, does that, am I prepared for that? It's all the same question. How do I withstand an attack today? And you'll, you know, I've been in a lot of boardrooms and chief information security officers usually brief their CEOs with these four dimensional pie charts that show we're green in these areas and we're red in these areas and we're yellow in these areas. And the problem with that is a CEO doesn't know how to feel. If they see green, they don't believe it. If they see red, they're ticked off. They're like, why are we red in access control? If they see yellow, they're like, what's yellow? You know, and then people change colors to not be alarmist. Here's the reality. The only unvarnished truth CEOs really want to do is can someone hack in and steal my email? Can someone hack in and get to our critical assets or cover data and steal it? Those things should be tested every time your network changes or the threat changes and CEOs get that and they want to test it, but there's never been a way to do it. Without humans, and it's, and, and humans can only do one way in at a point in time. With AI coming, it's going to be, here's all the ways people can get in all the time, and you have to fix it, because that is coming. The day whe…

AI assessment note: “CEOs want to know what can I withstand? How good am I at security?”

Q Everyone in the business knows your name because of that. Like all the top guys are calling you. How do you keep up with that when there's hundreds of people calling you with different breakings going on?

A The, um, so one of the things that I've always had is the, I don't know if it's empathy, sympathy, or all of it. I feel the same violation a victim does literally when they get breached. Nobody deserves it. I don't care. It's kind of like you don't deserve to be robbed because you had a few drinks at a bar and you walked out and you're a little bit susceptible to it. I've not responded to breaches where people were negligent. You know, some of the biggest breaches where you have someone beaten up. How could they let this happen? Like the story I just told you. Almost every CEO I've met and every CISO I've met is trying to prevent the inevitable breach. They're hiring good people. They're buying technology. We're getting better at it. And, uh, you know, so every time I get a call, It's kind of like it's good versus bad. I mean, it's good versus evil. It's like there are people with no risk or repercussions during our podcast, probably over a thousand Americans are going to get duped, scammed and lose money in the cyber domain from, uh, folks that, uh, are untouchable to our law enforcement.

AI assessment note: “one of the things that I've always had is the, I don't know if it's empathy”