The Attackers Have AI. Do You Have a Program?

Introduction to the Session

Tom Bechtold

Hey. Welcome everybody to today’s remote session. This is Tom Bechtold, your host for today’s event.

Today, we’re talking about the attackers have AI. Do you have a program?

You really have to have a program these days. You do because this is serious stuff. It wasn’t a fad. We all thought, you know, hey. This is gonna be a fad like cloud security. Right?

Hula hoops, things like that. No. I’m kidding, of course. But this is, like, serious stuff. You need to have a program in this day and age because there are so many different attack vectors now, and the things have sped up.

Welcome, everybody. I wanna say, thank you for joining us wherever you’re at in the world or in the the US. Excuse me.

Thank you to the folks over at CyberMax for making this one possible. We’ve got a a great group of guys that we’re gonna, chat with today. I actually get to kinda take a break. It’s kinda nice.

I’m gonna kick back in the audience with you guys and listen to the presentation this time, and we’ll try to formulate some questions from our side and stump the guys if we can. Right? So we’ll see what we can do. I don’t think we’re gonna be able to stump these guys, though.

We’ll give it a shot. Well, thank you to the folks over at CyberMax. Thanks to the folks in the audience for participating today. If we’re asking questions, during the course of this, please throw some stuff in the team or, excuse me, in the chat the audience chat if if our presenters are asking you stuff.

So today’s we’ve got some slides. I I made some very bare bones slides. I know a lot of you out there like to get that proof of attendance. That’s about all it really is worth.

There’s not gonna be a lot of good stuff on the slide, because it’s it’s just a shell today because it’s really just the guys talking. That’s where you’re gonna get the the most value out of this. But grab those if you do need that for a proof. You will be able to get the proof of attendance PDF as well, after about forty, forty five minutes.

I’m recording this thing. So if you like what you’re hearing, come back, invite colleagues back. I say this all the time. Some of you are, like, rolling your eyes already.

The bad guys are actually very, very, very good at sharing information and they’re making money off. We need to collaborate a lot better too because it actually works. So that being said, that’s why I’m saying please share this webcast with other people that are struggling with AI.

This is a new disruptive technology, and I have to believe that most folks don’t really have their arms around it very well. Otherwise, we wouldn’t be having all of these conversations still. That being said, who are we talking to?

We got three great guys. Let me get them on camera here for you guys to take a look at as well. We got Brian Zimmer, field CSO at CyberMax. Tony Scribner, he’s a VP solution advisory at Bluewave. Connor Jackson, Jackson, principal security researcher at CyberMax. I’m gonna turn things over to mister Tony Scrivner as the moderator for our talk today, and I’m gonna disappear into the cloud and and throw out some questions for the guys as we go through.

Introducing the Panelists

Tony Scribner

Thank you, Tom. Much appreciated. So, as mentioned, my name is Tony Scribner. I’m the vice president of solution advisory with Bluewave. And if you’re not familiar, simply put, Bluewave is an independent technology advisory and strategic sourcing partner. What we do all day long is just help deliver, confidence in complex technology decisions for our customers.

Also with us today, Brian. Brian, why don’t you give us a little intro of yourself?

Brian Zimmer

Yeah. It’s my intro will take about ten to fifteen minutes, so I hope everybody enjoys it.

I’m Brian Zimmer. I’m with CyberMax. I’m the field CISO here. What that really means is, rather than being solely internally facing, I get the opportunity to get out in the field, that’s in the title, meet with customers, and, meet with partners actually like like you, Tony, and, it’s a part of the job that I really enjoy.

Tony Scribner

Yeah. So that gives you a a kind of unique vision. Right? You you get to see security internally from your own operations, but you get to see it externally now that’s instantiated, which is perfect.

Yeah. Also with us today is Connor Jackson. Connor, why don’t you introduce yourself?

Connor Jackson

Yeah. Sure thing, Tony. So as Tony said, my name is Connor Jackson. I’m the principal researcher here at CyberMax.

I’m pretty fortunate that I don’t get to go out into the field. I get to stay indoors and live in the ones and zeros and be in that convergence between red and blue. So it works perfect for me. Exactly what I want.

Tony Scribner

Oh, perfect. Well, you’re you’re virtually outdoors today, so so I think that counts.

The Impact of AI on Cybersecurity

Tony Scribner

Tom did a a great job introducing us, to today’s topic, so I don’t think we need to take a lot of time before we just jump right in and start the discussion. Obviously, AI is disrupting a lot across the board, with IT in in all technology areas, really, and that’s very prevalent in today’s, information security and and cybersecurity world. So let’s start at a little bit of a higher level and kinda dig dig into this and unpack this.

So we’ll let’s start with kind of the the the the speed and the the lower barrier to entry that threat actors are seeing. And I guess my first question for the group and discussion point is really what has changed in the last twelve to eighteen months that that we’re having to deal with to to move towards a more resilient rather than a a reactive standpoint for cybersecurity.

What’s what’s making it faster? What’s making it cheaper? And and I think more and most importantly, what’s making it more accessible to threat actors?

Brian Zimmer

Yeah. Connor, that’s that’s that’s all you Tony, you’ll you’ll you’ll laugh because we went through the some of your ideas, and we decided that Connor was gonna take all of them. And I was just gonna agree with him.

So

Tony Scribner

That’s great.

That’s Excellent.

Connor Jackson

I like it. Yeah.

So I’m actually gonna start things off by pushing a chart for the audience because this will actually give a little bit of context to some of the points I’m gonna make.

For additional context, this chart is a history of ransomware attacks measured by quarter. The blue the blue bar is how many attacks per quarter in a night’s day period. The orange line is how many threat actor groups that we were actively tracking during that period. So over the last kind of three, four years, we’re seeing this slow increase. Now overlaid over the top with the arrows are every major AI release, every platform, every big update.

And what we’re seeing is every single time there is a big push to an AI platform, whether it’s Claude or DeepSeek or ChatGPT, within ninety days, there’s a spike in ransomware and data extortion attacks every single time.

So some of the points that I’m gonna make are gonna tie into this. I I just think it’s number one, it’s interesting for me to look at, but I think it backs up some points.

Yeah. But the the main thing is there’s this convergence of different factors that comes around what threat actors are doing, and it all falls under this umbrella of productivity. They threat actors want to get paid. They want to be more productive. So if they can make more money, they’re going to go in that direction.

What AI has done to at a very high level is it’s made things that usually would have taken, say, several days or hours compressed down into minutes so you can generate efficient content. You can debug some malware code or, you know, bootstrap another feature onto the onto the back end of it. All these things can now be done in in minutes. So it makes directors number one. It doesn’t make it more complex, but it makes the barrier to entry much easier. You don’t have to be technically sound to just vibe code, you know, your malware to do whatever you want.

On top of that then, this has been around for a number of years. We’re all familiar with ransomware as a service. But what’s happened in the last eighteen months is this huge shift in the ecosystem where everything has now been commoditized. You don’t have directors that have to breach you initial access, you know, establish persistence, lateral movement, privilege escalation. Every single stage has now been divided up into people who specialize in that specific area. So what this means is someone who’s really good at lateral movement will take someone else’s access, move laterally, maybe escalate privileges, and then they’ll resell that access.

If you don’t read Google’s mTrends report, you should. It’s one of the best resources that’s freely available. They actually measure dwell time. So in twenty twenty two I’m gonna try and quote this off the top of my head now. In twenty twenty two, dwell time was around a hundred days.

Now in twenty twenty five sorry. In twenty twenty four, it actually dropped down to ten days, and you can see where this ties in with with AI. The dwell time compressed right the way down to ten days.

Interestingly, last year in twenty twenty five, it actually went up first time in a decade because of North Korea and their IT worker scam, and they’re a huge proponent of using AI of using AI attackers. So what’s happened now is we’re seeing these director groups get faster with each section, and the handoff time is getting even quicker. So for anyone interested, on average, it’s taking twenty two seconds for one director to give it to another. A couple years ago, that was measured in hours. We’re now down to seconds, which I think is is pretty crazy.

I’ve, been talking for a few minutes there, so if anyone wants to chime in.

Sophistication vs. Volume of Attacks

Tony Scribner

Well, so that there that’s that’s a that’s a great answer and a lot to to unpack. One of the things I’m kinda wondering is, are are we really is it sophistication of attacks that’s that’s increasing? Is it a volumetric, you know, change? Is it a little bit of both? Is a higher volume of good enough attacks what we’re seeing, or is it is it really the sophistication level or both?

Connor Jackson

So it’s a that’s actually a really good point to make. I think you’ve hit a number of key points. So they’re not getting more sophisticated. The way AI models work is they tend to train off of previously done things.

So the k four threat actors have always been capable. I’ve dealt with APT intrusions, and one of the smartest things I ever saw was, file a scheduled tasks. If anyone’s interested, post a question in the chat, and I’ll answer it later. But they’ve always been good at coming out with novel ways.

AI hasn’t gotten to that point yet, but it it absolutely will probably in the next two years. But what we what we are seeing is the the average attack has gotten better. So all your low hanging fruit is easy easy pickings. It always was, but it’s much faster now.

The average attack has definitely become slightly more complex and greater in in scope. So before, you might have seen, like, maybe a hundred phishing emails and maybe two were good. We’re saying, like, maybe twenty are good today. So the quality is definitely coming up.

Tony Scribner

So, so so that that’s great point.

Tony Scribner

I’m I’m gonna have to stop saying great point because we’re gonna get great points throughout

Brian Zimmer

It’s gonna be a lot of them. In today’s event.

The Evolving Nature of Phishing Attacks

Tony Scribner

So so I’m gonna try to stop saying that. We talked about the barrier to entry, and I I was kinda wondering what that really looks like in practicality. And I think you just you mentioned it with phishing.

We used to get a couple attacks that looked decent, and now we’re getting a lot more phishing messages that look very, very realistic and are harder for people to discern against. Are there other areas I’m gonna throw out the term kill chain. Right? And I’m not sure that kill chain is is really relevant to to conversations anymore because I think we’ve kind of broken down that process.

But if anyone’s unfamiliar, right, the the kill chain was a a term developed by Lockheed Martin that really breaks down the the cyber attack process that we expected threat actors to take. Right? So reconnaissance to weaponization and on down the line till till finally they were taking actions on their objectives. And that’s kinda where you’re talking about dwell time.

Like, that kill chain used to, you know, used to take a bit of time, and as they breached systems, there were times when they were within systems trying to figure out how to get lateral movement and all that. And those those hundred days are really now compressed down into minutes. But I I wanna use kill chain, but maybe it’s not appropriate. But where else in, say, reconnaissance or malware development development, social engineering, where else are we really seeing that strong reduction and barrier entry for threat actors?

Identity as the New Target

Brian Zimmer

So so, Connor, before you answer that, because that’s definitely a you question, I wanna make sure that the audience understands, the context here. We’ve talked about phishing. We’ve talked about lowering the barrier of entry. We’ve danced around a couple things. I wanna get to a point right here.

The identity is the main objective, if you will. And, you know, as you think about phishing, you think about smishing, all the different ishings, they are targeting the identity. It’s no longer really a remote code execution.

There of course, there is, but the main point here is that we’re they’re targeting identities. So compromises now happen targeting and using valid credentials to get into enterprises, to move laterally, to escalate, and then ultimately to move on action on objectives.

I will now be quiet, and Connor, let you crush it further.

Connor Jackson

I mean, you kinda answered the question for me.

AI has compressed every point, but there’s this huge shift in the the industry where identity became your network perimeter. You know? You have the firewalls and VPNs, that’s not the edge of your network anymore. It’s your laptop.

It’s your user’s browser. It’s how companies have shifted to a SaaS model. Your users interact through their browser now. So if an attacker can get in between your users and your tools, they’re gonna have as much access as your users have.

And if you’ve got too many privileges associated with with specific users, you’ve just handed the keys to to an attacker.

What that what that tends to look like then is for, like, for myself, I come from, like, an incident response perspective, so that’s where my background mainly is.

When an attacker hijacks someone else’s account, it makes it incredibly difficult because you don’t know what normal looks like unless you’re in that environment every day, and the logs just show this user logging in. So what we have to do is we have to look historically, and not everyone has six months worth of logs to look through.

So it it creates these these unique challenges at the same time because of that, which is which is pretty interesting to me.

Tony Scribner

Yeah.

Brian Zimmer

Yeah. And and, Tony, operationally, I can tell you we that is exactly what we see. So we we didn’t exactly we we wanted to provide this as a service to the community and not make this a commercial.

So to get everybody caught up, CyberMax is a modern managed detection response firm. So when Connor and I talk about, you know, what we see and how we operate, we don’t wanna make assumptions that everybody knows what what MDR is, what a SOC is, etcetera, etcetera. Although, I think everybody should know what a SOC is. So having said what Conor and I do, I can confirm that what we see are a couple things.

Real-World Incident Response

Brian Zimmer

We just had an incident where, a malicious third party was using just PowerShell and normal commands to move laterally. And we we to us and to definitely to our client, it looked like just a normal day on the high seas. But it turns out that that user had been, compromised sometime before. We were able to go back and and do exactly what Conor is talking about.

Look at the telemetry, look at the metrics, look at the baselines, and determine, hey. Hey. Hold on. We have to go back because this is abnormal behavior. This is way outside of the pale of what a normal user, especially this user, would be doing. We declared an incident, and it it turned out that that user had been compromised. One last point.

Along with that, we at CyberMax have really doubled down on email as an essential attack vector for attackers. Of course, attackers would be using an attack vector. It’s a total redundancy. Sorry, everybody.

So we, by default, include email security in our core offering. So when you sign up for a CyberMax service, we don’t layer on email. We include it into the service. Why?

Because attackers are targeting email. Attackers are targeting the user. They’re targeting the user via email. So that’s why we made the decisions that we made, in the face of of modern attackers, especially getting back to the point of this entire exercise, especially in the face of attackers that are enabled and driven by AI?

Understanding the Attacker’s Perspective

Tony Scribner

So what I find interesting is is we’ve naturally turned this conversation a little bit towards now the the target. Target. Right? So so the target are obviously companies, enterprises, organizations, whatever, that the threat actors have interest in for whatever reason, and, obviously, as Conor said, that is to to make money.

I have a lot of conversations still that that really surprise me with organizations that will say things like, well, we’re too small, or we’re not heavy into infrastructure, and so we’re not really a target, or frankly, we’re just not interest interesting enough for threat actors to pay attention to us.

And to to people that kinda have that mindset, what what are what are they missing about how attackers can now really do what we’ve been talking about so far all along is is operate at scale.

What’s what’s what are they missing?

Brian Zimmer

Yeah. I I think I I’ve I’ve struggled with this answer before, but I think now more than ever, it’s relevant. One of the the good pieces of work that Conor does is, he really leads our ransomware reporting.

And, you know, you can see on the screen some of the data that he produces for us internally and for our clients.

But one of the things that we’re seeing is, and the data show it, that the attackers have moved to an as service model. And by doing that, everything and I shouldn’t say everything, but this becomes a volume play. So if you target ten regional hospitals using your as a service model, if you target ten regional waste management firms who are, and this is a real number, taking two weeks to even get to alerts, then you’re making a volume play.

And your ransom is gonna go your ransom demand is gonna go down, but via volume, your ultimate payout is gonna go up. So I think that line, and I heard it a lot, Tony, to your point, especially years ago, I don’t think that defense works anymore. You know, I had a I had a former customer of mine in, the food industry that said, I I make I make and bottle fizzy sugared drinks. I don’t have the attack codes, you know, the nuclear codes. Well, that that didn’t apply then, and it definitely doesn’t apply now because then I would turn it around and say, person whose name I won’t mention, how do you feel about that now? What does it look for you as the CISO of this organization to not be able to make fizzy, sugary drinks for a month.

Tony Scribner

Right.

Connor Jackson

Just wanna jump in for one second because Brian hit all all of the key points there.

You don’t need to have data for an for an attacker to find you profitable. All you need to do is to have some level of disruption to the point that it’s cheaper to pay them off. So you may not have the keys to, you know, nuclear codes, but if your operational costs cost more to be have this downtime, you’re going to pay them, or they’ll they’ll think that you’re going to pay them as to to Brian’s point. You do not need data. You just need to exist at this at this level.

Tony Scribner

So that really, I think, talks to the the attractiveness of an organization. Right? The the the what’s attractive now to a threat actor for an organization has totally changed, and and, honestly, it’s it’s anything that allows them to to extort money.

Is there is there anything else that can can add to that attractiveness, though? Are are are we missing something, or is this really just a a money play?

Connor Jackson

Most of it is a money play. There’s obviously gonna be, you know, health outside use cases. They’re gonna be on the fringe. Most people that are operating in this is an industry today. Most people who operate in this industry, the ransomware industry, are just looking to get paid. Some of them do it because of, you know, ulterior motives, but a lot of them are just looking to get paid.

Tony Scribner

Okay. And And I kinda wanna keep digging into this. Right? Because now we’re getting into the economics of it, and and we’ve established that economics is is the driver.

Economic Motivations Behind Attacks

Tony Scribner

And, ultimately, the threat actors are looking to get paid.

We talked a little we talked a lot, or Brian did a lot about, identity, right, now being the the the major pressure point that they’re pushing on. What other kinds of weaknesses are they looking for, or what are they looking to monetize the most? Is it is there anything else out there?

Connor Jackson

I know Brian gets asked this a lot, but do you wanna tackle this, Brian, or do want me to jump on this one?

Brian Zimmer

Start.

Connor Jackson

Okay. I’d like to flip the narrative slightly, because I think this kinda helps people frame things.

Particularly when it comes to, like, executives and leaders, they think of hackers as hacking into hacking into computers.

But if you kinda switch that around and look at it in terms of economics, it it helps my brain anyway, see how it how it works. Attackers looking to get paid. So every time you put a new control in place, it slows down their profitability. And the more you can slow that down, the more attractive your neighbor looks because they’re gonna get paid if they go over to him instead. So by slowing down the attacks, we can actually defend ourselves more. It doesn’t have to be bulletproof, but it’s definitely going to decrease the profitability of an attacker, and time is money.

Brian Zimmer

Yes. So I’ve I’ve I’ve always thought in terms of increased cost and and by the way, you’re thinking as a defender. Number one, you want to increase cost.

You want to create noise, meaning, I need to create as many barriers as possible whereby an attacker can expose themself.

So is it hitting a honeypot? Is it hitting a honey token? Is it running a noisy command that is completely outside the norm internally? Again, go back to that incident we just had.

So I want to increase time. I want to increase, the cost. I want to, impose, all sorts of constraints and ultimate ultimately, buy myself time as that attacker moves, I don’t wanna say through the organization, but, as they move vis a vis my organization. And I hate that I use that word so much, but I’m gonna stand by it.

Tony Scribner

So so you’re referring to a lot around defense and depth, right, or layering of controls to to be able to slow down the attack and gain visibility.

And and so we’ve made a natural shift now kinda away from the target and now into the the some of the systems and tooling.

I mean, we’re not that far out of where the traditional detect and response model was kinda what what everyone was aspiring to, but that’s obviously falling short in today’s world. So so so why is that falling short? Where is that falling short?

I think we’ll let’s start there, and then I’m sure we’ll we’ll have a whole conversation on on tools and building into the program discussion.

Brian Zimmer

Could you refactor your question a little bit?

Tony Scribner

So so in essence, why why is the traditional, detect and response model falling short today?

Brian Zimmer

Because I don’t think it takes into account attacker speed. And, of course, part of what we’re talking about here today is AI. You know, the fact that and Connor mentioned some of these reports. I I will also use the Verizon data breach report, CrowdStrike recent CrowdStrike’s recent excellent report along with the the Google Mandiant report.

You know, you’re talking about lateral movement in, you know, twenty twenty nine minutes. You’ve got handoff in twenty two seconds, x fill in four minutes. These are real numbers, by the way. You can see my head turning because I’m looking at my notes.

You know, dwell time, as Conor said, down to four or around fourteen days, we see those numbers going up, and sometimes persistence at at three hundred and ninety three days. Those those are real numbers, but I I think it’s I I think they they show speed. It’s not sophistication, although attackers can be sophisticated, but it’s speed. Speed.

We we are seeing speed right now and depth and breadth that we have never seen. I think it’s fair to say.

And I have no idea if I answered your question.

Tony Scribner

Well, can see that.

Brian Zimmer

And I think about bunch of numbers, and that sounded great.

Tony Scribner

Yeah. No. I I think if I extrapolate what you said, if I have to collect a lot of log data and correlate that and and go through and and run a rule set against it and start to to pick out things I need to alert to the SOC, and the SOC is gonna take what used to be maybe an average of thirty minutes to go through an an alert and deem it an incident or not.

So by the time that has passed in today’s day and age, the damage is already done. Like Yep. The the the old method is just not sustainable with the speed of of today’s attacks. So that’s that’s more or less what I extrapolated from what you said.

Brian Zimmer

That’s right. And and what is the grease that we use in these gears as attackers? It’s it’s vulnerabilities. And Connor and I talked about this for a while yesterday.

You know, I I would encourage the audience to, a, read everything and anything that Jen Easterly writes, but recently, she wrote an article about the the Kev program, the known exploitable vulnerabilities. And here’s another interesting stat. Twenty six percent of Kev vulnerabilities were fully remediated in two thousand twenty five, and the median remediation time stretched for forty three days. So now take that time, look at it in the face of attacker speed, and tell me we don’t have a problem.

Tony Scribner

We have a problem.

Brian Zimmer

We have a problem.

Tom Bechtold

We have a problem.

Tony Scribner

A hundred percent. So we have to address this problem.

And I think I still hear a lot when I’m speaking to organizations. There’s confusion around tool ownership versus actually having security security preparedness or security readiness.

Where do people start to really confuse, I have tools, and so therefore, I’m prepared, but they’re not really prepared?

Brian Zimmer

Connor, you wanna start with that one?

Connor Jackson

Yeah. I can jump on that. I’ll start that by saying I have a gym membership, and it hasn’t done me what the sales guy told me it would. So ownership, it doesn’t lead to outcomes.

Is that is how I like to think of things. Just because just because you own a tool, it doesn’t mean it’s going to do what you were told it’s going to do. It’s how you implement it. It’s your process that you’ve built, your people that are working around this tool.

The the tool will just enable you to to get to a point of security readiness, but just ownership doesn’t immediately imply that.

Tony Scribner

So so you get to see I mean, I would I would imagine that you get to see, through your the lens of your customers as as you acquire new customers and bring them on board, that maybe a company has has invested in tools.

They’ve bought the membership, right, but they’re obviously not going to the gym and using it. And for whatever reason, that that really rings with me. But, anyway, what are some of the warning signs that you see as you acquire customers, that maybe they’ve they’ve made a decent investment in the tools, but they’ve really not built any kind of operational program around it. Are there any telltale signs? Is kinda any warning signs that you see that you can identify?

Connor Jackson

It’s a it’s a conversation I think probably a lot of our listeners have as well where you you move into a new environment, and you need to kind of figure out how things are working.

Usually, what I find is if you ask a question about, like, can you walk me through an instant how you would, you know, detect, respond, contain, remediate?

They’re responsive. Typically, we have x tool. Like, how do you detect, you know, lateral movement? We have x tool. How do you, you know, how do you detect the you know, whatever. We have x, y, and z to do those things. And you end up seeing, like, dashboards and automatically generated reports, but they’re not really being acted on.

So that’s that that’s something that I often see. I’ll I will start with the shopping list. People think, you know, we check the box. We we go through our shopping list. We buy all the tools, and we’re we’re ready.

It doesn’t quite work like that, unfortunately. I wish it did.

Brian Zimmer

Yeah. I I I have one of my favorite quotes was a guy named Bill Wheeler. He’s a bit of an expert in in in sore and at least back in the day, he did sore technologies and would help with with runbooks and instant playbooks, etcetera. And he was brought in on our project, and they said, hey. We want to implement SOAR.

And he said, fantastic.

Show me exactly what Conor talked about. Show me your incident response prog process. Show me your runbooks. Show me your escalation procedures, etcetera, etcetera.

And they said, we don’t have those things.

And he then responded, and I’ll never forget this, with, well, what would you like me to automate and orchestrate?

So they bought a SOAR platform, but they had nothing to orchestrate or automate. The other thing that I see is governance.

If if your AI is driven by governance or is driven by data, show me your data governance program. Nine times out of ten well, not nine times out of ten. Ninety nine times out of a hundred organizations don’t have a data governance program.

Now talk about identity. Do they have an identity program? Absolutely not. Do they have a corporate governance? Do they do they have are are they following a framework like a NIST or a CIS top eighteen or an ISO twenty seven thousand and one or even twenty seven thousand and two?

The difference there being the code of practice versus specification.

Those are all those are the things that hold up the technology, and those are the things that organizations don’t have. So we bring it all the way back, Tony, to your question.

Those are some of those yellow to red flags that we find, especially when Connor and I, move to onboard new customers. And we look at it and we say, oh, we we’ve we’ve got some coaching to do. And and, of course, it’s our job. It’s our responsibility to get our customers caught up to get them on at least a level footing with the attackers.

That’s a long answer. I apologize.

Tony Scribner

Well, we actually have a a an audience question about tooling, so I’m gonna I’m gonna ask that one real quick of you two. It’s it’s specific to Blue or Red teaming. And the question is, what security tools do you leverage, dear, either during Blue or, Red teaming?

And what are you seeing at customers the most?

Connor Jackson

Yeah. I was actually just about to start. If anyone saw me typing, I just began typing out an answer for this. So, Matt, this is something I I do a lot.

So I’m actually kinda glad you asked. I get to talk for things I enjoy. When dealing with Bluewave and Red Team operations. I don’t think you have to tell me to shut off.

I’ll keep going now till the end of the top of the hour.

The most effective tools that you can use right now, specifically when we’re talking about identity, are Bloodhound and Azure Hound. Set them up in your environment, run them, don’t look at it for a couple of hours, and then come back. It will map out the attack paths that an attacker will take for you.

As an aside to that as well, you can see if your tools can detect that. Some of the other tools I like to use are PowerShell Empire and Impacket, and these are just traditional attacker framework tools. These are things that attackers are actively using.

If you use them in your own environment, you can see if if your talk or your your provider is able to detect them. That will give you a a huge amount of of input. If you wanna do it more externally, there’s a number of tools you can use for password spraying. I actually wrote my own called Microsoft Sprinklr, and that will actually tell you which users have MFA as well. And it does it without locking your accounts. It it it relies on the error messages.

So using those kind of tools, I think that’s that will give you the biggest bang on the biggest return on your investment is Bloodhound and Azurehand. Find out the attack path in your network and then work to basically break those paths. The more of those you can break, the less options an attacker will have.

Tony Scribner

I think we also had a question about your chart. So so while while you’re you’re talking, I I think the question was the the dip in around q two, twenty twenty five. We see a pretty big dip, from the quarter prior, and that stays low and it goes back up. Is there, some logic behind that?

Connor Jackson

I’m just gonna pull it off a bit bigger so I can see exactly where it was.

Q2 twenty twenty five. Right? Correct.

Tony Scribner

It’s a little small on my screen, but I believe so.

Connor Jackson

Yes. It’s a bit small on mine as well, but I’m gonna make do. So q two twenty twenty five, I think that’s right after claw two launch. So, typically, what’ll happen when, we see these dips, there there’s a number of things. Like, you’re always gonna naturally have, you know, the ebb and flow of the tide of attacks.

Q two twenty twenty five, if I remember right, is actually a very specific in instant because the CLOP ransomware gang had just launched fifteen hundred attacks, and anyone who knows CLOP will know that they’ll spike activity one month, do nothing for four months, and then they’ll spike again. The reason for that is they have a very interesting model.

Actually, this is maybe just a bit of information for everyone. If we often see reports where, you know, mass scanning of the Internet, you know, mass scanning of specific customer devices, you know, whatever firewall, whatever VPN.

A lot of the time, that’s actually a threat actor weighing up whether buying an exploit is going to give them a return. They’re scanning to see how many endpoints are going to be vulnerable. The the CLOP ransomware gang do this to an absurd level where it takes them three or four months to work through the backlog from a single exploit. So what we often see is you’ll see a huge spike because this the way that the statistics work is I track the dark web pages. So when a announces they’ve compromised someone, it gets logged into our database.

We we have some additional metrics as well. I just I take it out for gravity. But, yeah, it’s usually just a case of there’ll be a drop, but the overall trend is moving upwards.

Tony Scribner

That that does explain that very well. Thank you so much. So I I think we’re gonna kinda take the discussion now and start to to really think about what a modern security program should look like today.

Building a Modern Security Program

Tony Scribner

And what what I’m kinda curious from from your side, both Brian and Connor, if you were talking to a a a a new customer, a a prospect that you wanted to make a customer, and you were assessing whether they had a real security program versus just the collection of tools that we kinda talked about. What what would you what would that conversation look like? What would you start to to look for first?

Brian Zimmer

Yeah. I I would I would slightly I would just slightly repeat.

I always start with a framework. What’s your chosen framework? What do you like? What do you if you if you have to be CMC compliant, if you have to be PCI compliant, HIPAA, whatever, all the different compliancy frameworks, just pull it back.

What do you what are you using as a framework? And and don’t overthink it. You know, years ago, I I was trained as an ISO guy and, you know, always over rotated to ISO conversations. And finally, somebody pulled me back and said, Zimmer, do you understand how expensive ISO is? It’s it’s fine for you and your, you know, Fortune one hundred banking and and what whatever the world is that you’re in.

But for the rest of us, that that’s just not a feasible model. And so you’ve got you’ve there are missed options there. And, again, the the most simple, especially for our customers who you know, our ideal customer is anywhere from, you know, five hundred to five thousand endpoints. Of course, we can do more.

We can do less. But the CIS top eighteen really, really connects with them, and it gives them a place to start and a place to really rally around to build that program. And then after that, you can you can build your identity governance. You can build your data governance, and, of course, you can build your AI governance.

But I think it really all starts with a framework, because that you know, ultimately, that framework is then gonna help you, with, reporting metrics and providing visualization back to the board, back to your CIO, back to your CEO, etcetera. So, I think it all starts with with that framework, quite frankly. Not a sexy answer, by the way.

Tony Scribner

Well, if you’re if you’re saying that that looking at their framework really becomes foundational to to the movement, then, I think it’s a very sexy answer.

Brian Zimmer

Are there I’m accounting for taste.

Tony Scribner

Yeah. Are there, other capabilities or disciplines that you would consider foundational, above and beyond that?

Brian Zimmer

What what do you think, Connor? I I talked for too long there. What do you think?

Connor Jackson

No. I think you you hit all the, the main points again, not leaving me much room to to move around in.

I think one thing that maybe they can do to their program is not necessarily like a a hard framework, but it’s more of a mindset shift, and that’s to basically change your security posture sorry, change your security culture to be in the mindset that you have to change what you’re doing. Like, just because you spent six months of your life building a program doesn’t mean that it’s gonna work in another six months. You’ve got to keep updating it. And Yeah. This is something that we tend to see a lot is these programs took a long time to build, and people almost have, like, a sunk cost fallacy because their mindset isn’t right in today’s age. You really have to update that before you can start to, you know, implement the tools and the frameworks that that Brian mentioned.

Brian Zimmer

Yeah. And there’s the updating phase, but then there’s also, you know, to speak a language that that, you know, Conor and I live. If you look at the incident response life cycle, what’s the last step in in that process?

It’s lessons learned. You’re writing up your report. You’re delivering your report, and you’re sitting down together, with with as few egos as possible. Notice I didn’t say with no egos.

And you’re you’re you’re trying to figure out what did we do, how do we do better. And the same is true with what what Conor is saying. There’s that reevaluation phase, and this goes back to what I was saying. I I I worked for a really good CISO.

I’ve worked for a couple, actually, when I was younger that that really focused on reporting and metrics. And that that reporting and those metrics, when you visualize them, they give you an idea how are we doing. When things become metric based and time bound, then you can really assess where you are with respect to your program and your program build and your program execution. I would say another thing that’s completely, well, it’s not unrelated, but it’s a it’s a a sub bullet of a a greater program.

One of the things that we are really big advocates of here at CyberMax, we really encourage our clients to do is test. And how do you test? You test by harnessing the power of offense. I was with our our CEO a couple weeks ago, and I I kind of said inappropriate things.

Luckily, it was just a few of us there. And I said, listen. If if if you are one of those folks that believes that your your defender shouldn’t be doing offense, meaning pen testing, meaning automated pen testing. What I said in that session was grow up.

It’s fine to have a third party doing assessments. I think you should do that, but Google’s BeyondCorp years ago and the Zero Trust programs years ago said, what is the best way to test your response? What’s the best way to test your SOC? Constantly running offensive operations.

And that’s what we do at CyberMax. We’re constantly encouraging our customers to engage us and to engage with us to use our offense to test our defense. We wanna be better, and we think that the best way to do that is to test it with offense, to go through the entire process, to do the lessons learned, to understand where we can do better in a metric based and time bound way. We now here’s my closing thought.

The very immature, in my humble opinion, way of thinking about this is the age old fox watching the henhouse. We are not engaged in that. We are trying to get better. We are trying to test our controls.

We at CyberMax are a control. We are your security operations center. You have to test us. We have to test ourselves.

So I would encourage everybody out there to really integrate offense into your day to day operations. Don’t just do that external and internal pen test that tests fifteen IPs once a year because of compliance reasons.

Do it constantly. Iterate constantly. Alright. I’m done. Connor, get me off stage.

Connor Jackson

I’m actually gonna just quote something that Brian said to me before. It’s a test for impact. Don’t test for audit. You wanna make sure that the things you’re looking for actually have, like, real metrics behind them. Make sure you can quantify what you’re doing, and then you can bring that to the board. So, yeah, it’s always been good for me.

Brian Zimmer

I seriously say that? Test for impact, not test for audit?

Connor Jackson

Yeah. It’s in Teams. Look it up.

Brian Zimmer

That’s brilliant. Alright.

Tony Scribner

Good. I think that’s certainly a a leave behind nugget for for everyone on the on the webinar to quote

Connor Jackson

I was so glad I wrote it down.

Tony Scribner

From here forward, which and I’m gonna use that as well. You you really open so, Brian, you opened yourself up before when you started talking about frameworks and compliance, and we’ve really opened the door for a deeper discussion on on the some of the dangers that can be wrapped into that.

When when you think about what some of their frameworks will tell you that you have to do and we actually have a a customer question that I think is gonna wrap into this very well. So I’m gonna read I’m gonna read the question, and then I’m gonna kinda finish and launch the the answering phase of it, which is most security tools are to to quote verbatim, most AI security tools focus on detecting known AI threats. So, you know, library of of of vulnerabilities and and threats, and we we look for matches against that, and that’s, obviously part of the process.

Preparing for Unknown AI Threats

Tony Scribner

What capabilities should organizations be building today to prepare for AI enabled attacks that have not yet been identified? Right? So we’re we’re talking pre zero days, zero day attacks.

So I I think we can probably build the answer to that into the discussion over the next couple minutes of why that annual assessment and compliance exercise doesn’t fit the bill anymore. Right? That that once a quarter, once every six months, or once every twelve months, pen test, whatever that that that assessment was is no longer good enough, and we really have to start working in terms of continuous testing.

So how how do we start how do how do we get there? What are the what are the most valuable ways to to to test whether controls are working across identity, across endpoint, across our cloud surface, across our network perimeter, and maybe, like, user behavior and such. How do we start to get to the point where we’re doing things we’re actually gaining resiliency now. We’re moving away from reaction to resiliency by doing things in a continuous manner.

How do how do we start? How do we get there?

Brian Zimmer

Connor, you take the first one.

Connor Jackson

I’ll challenge that and say, if you did a test a year ago, does your environment look like it did a year ago today?

Most organizations, they’re looking to to grow. There’s new users, new updates, software devices. Like, there’s always new in your in your network. And your annual audit or your review or pen test, that’s just a point in time checkbox. It says that you, you know, you ticked all the boxes on this day, but within a few days, depending on how much your organization changes, that may no longer be true.

So continuous testing is incredibly important because as we’ve kind of been talking about for the last, what, fifty minutes, AI accelerated attackers are getting faster, so our testing has to be faster as well. And, you know, an annual pen test just isn’t enough in my opinion today. We really need to bring that up. Again, it depends org by org, but continuous testing is a must today.

The Importance of Business Logic Testing

Brian Zimmer

I I I think there’s another thing that needs to be continuously tested, and and, Tony, apologies if I I’m leading us astray, and that’s business logic. There was a really fascinating, short, article that, a colleague of ours, Vijay Haripal, put out.

And he he said three things are so important to defenders. Number one, the speed asymmetry. Number two, governance. We already touched on governance.

Number three is really where I’m going, and that’s business logic. And business logic is one of those things that you really have to test and test often because that is supported by by Conor’s point. If you tested a year ago, what does your environment look like? Well, from a business logic perspective, it probably looks drastically different.

I’ll give you a number to to think about. Thirty one percent of breaches start with software vulnerabilities. A vulnerable and that number is is increasing, which is crazy. Software vulnerabilities have unseated attacks by identities, which is fascinating.

So constantly testing the the business logic of your systems, is really, really key. And so, Tony, I I will pause there because I I am concerned I might have taken us off a path.

Tony Scribner

Well, I think that all goes into part of the answer. Right? So so so the the direct question well, the direct question that the the viewer asked was how are we building systems that are are testing us against things that we don’t know yet?

Adopting an Assumed Breach Mindset

Tony Scribner

And, obviously, we you know, there is a limit to this this sphere of control any company has.

Within that sphere of control is certainly their own software and their own systems. Right? So whether we know whether it’s a known vulnerability or not, we need to be continuously testing and probing.

And I believe the statement about being working on the offensive as well really kinda fits into that entire thing. That’s how we protect ourselves against what we don’t know yet is coming down the line.

Brian Zimmer

Yep.

So

Tony Scribner

I I do believe that all then.

Connor Jackson

Yeah. If I could just add one point as well. It’s it’s another mentality switch, which is where you move to an assumed breach mindset. So assume that you know, assume the the unexpected. Assume there’s a threat or in your environment at all times.

And if you couple that there, I don’t know the specifics of your network, but if you’re building in house detections, focus on dynamic TTPs because the behaviors don’t change. The, you know, the static analysis may, but the behavioral identifiers will give you much better grounding. I’ve caught the zero days, you know, before we even knew about them, we just literally caught them, looked at the the PCAPs and the payloads. And before we know it, we were looking at an old day. So soon reach and focus on TTPs and dynamic analysis.

Brian Zimmer

Yep. Yeah. And I think I think when it comes to this this ***** business logic conversation, so as you merge these things together, for those of you not familiar with what we’re talking about, if you have run your code through a static or dynamic analysis tool and it’s passed, now is not the time to pat yourself on the back. We’re talking about the difference between correct, which your SAS tool and your DAS tool are gonna identify, and unsafe. Those are two completely separate things. So just because you’ve passed your SaaS and your DaaS phase, it doesn’t mean that that AI empowered and enabled attackers are not going to be able to exploit business logic flaws in your system or systems.

Key Takeaways on AI and Security Assumptions

Tony Scribner

Excellent. Excellent point. So I know we’re starting to wind down on time now, and I wanna make sure that we we have enough time to to leave our viewers with with a little bit of homework. So, before we assign that homework before we assign that homework, I I really wanna ask each of you, you know, briefly, if you could leave this audience with one message, what would you want them to remember out of this when they think about AI attackers and program maturity?

Brian, we’ll start with you.

Brian Zimmer

Oh, darn it. I was gonna kick it to Connor.

Tony Scribner

Oh.

Connor Jackson

Yeah. I I I can take it if you want.

Brian Zimmer

Yeah. Go. You do it. Okay.

Connor Jackson

I’m gonna say that AI hasn’t fundamentally changed security, but it has changed the the half life of our assumptions about our security. So AI has gotten so much faster. That’s really the biggest takeaway for me at least is that attackers with AI are just unbelievably quick compared to what we were looking at three, four, five years ago.

The fundamentals are still the same. They’re still doing the same things. They’re just using AI to do it faster and more effectively. So when we assume that things are secure because we’ve got MFA or, you know, identity protection or what whatever our assumptions are, we need to to compress that down and start challenging our own assumptions. Because if a threat actor challenges them first and they’re right, they’re you know, you’re gonna get compromised.

Tony Scribner

Yeah. Okay.

Okay.

So so now the the the homework and, again, you both are gonna help me assign this homework. And I apologize if I my lighting is a little bit off.

Of course, like most modern office buildings, our lights turn on and off as we enter and leave the offices. The sensor can’t see me where I am, and so it didn’t think I was in here and turned my lights off for me.

Practical Steps for Immediate Security Improvement

Tony Scribner

But, anyway, what is one practical step this audience can take in the next thirty days to improve readiness? Right? So this is the homework for them. This is their take home. What can they do in the next thirty days? What should they do in the next thirty days?

Brian Zimmer

Yeah. I I would say I would say engage honestly with a firm that does offense well, and that firm should it should lead you through a tabletop exercise for both your technical staff and your executive staff in what a breach looks like. And that breach watch how I tie this all together, should include attacks on business logic.

So I gave you I gave you three nuggets of homework for one. Look at me.

Tony Scribner

Full circle.

Excellent. Well, I certainly appreciate that, and I think that, brings us towards the conclusion of our time together. Tom, I wanted to throw it back to you to see if you had any housecleaning for the for the group.

Tom Bechtold

I do. I’ve thanks, Brian, for the generous helping of homework. That was kind of you. I think the audience members are gonna appreciate it.

No. Seriously, good stuff, guys. Thank you for joining me today. I think we you guys covered a lot of good stuff, stuff people need to hear about.

Those tools that Connor threw out were awesome. I was kinda, like, googling them as you were, like, throwing them out there for the people. That’s awesome.

Good job, everybody. Out there in the audience, if you haven’t already, grab your certificate of attendance. You can grab like I said at the beginning, the slides are in there as well if you want some kind of proof, but they’re just stuff I made. It’s not from the guys really.

You’re gonna wanna download the ebook that we have from CyberMax. It’s in the resources, though. There’s good stuff in there. Keep those applause the the hands coming.

I love seeing that stuff as you guys are are kind of grabbing the stuff from the resources. I love seeing the animated stuff when people actually like the sessions.

But, no, thank you, Brian, Tony, and Connor for being here today. Thank you, CyberMax, for making this one possible.

We’ve got more stuff on the way. We always do. I’ve got another one next week on Thursday, the AI and human risk landscape, securing collaboration in the age of AI. So we’re gonna figure out what that one’s all about.

We also got coming up in August, we’ve got a NIST course. This one’s actually a paid online course. This is with Kip Boyle out of our Seattle area. He does a wonderful job on these.

You’re gonna wanna take a look at it. It’s pretty affordable, and you’re gonna come out of that knowing a lot more than you did going in. I’ll tell you that for sure. I’m bringing back ask a lawyer that’s coming in end of August.

So we’re gonna have to bring the ladies back. We’ve got a a great group of cyber attorneys. We’re gonna go through privacy and AI law and other things coming out.

When you register for that, throw in questions because I always pull the questions out, and I share those ahead of time with the group, and then we kind of that’s how we develop those. So please share that information. And, I didn’t put it on any of the slides, but tomorrow is our big AI conference, virtually. If if you haven’t signed up for that one already, you should.

Go to secure world dot I o. I forgot to put a link in for that one. I just assumed everybody already signed up for it. But it is happening tomorrow, so you wanna check that out.

Grab your CVEs. Check out CyberMax, and we’ll see everybody at the next remote session. Be well, everybody. Take care.