What are we missing here?

So I think we've got the policy questions wrong on what we're afraid of.

If you look at the frontier models, there's a big push to stop.

What do we do about models breaking out and hacking things? I think that's going to be the exception, not the rule.

It's an edge case.

The labs are much better now at looking for things and sandboxing their tools.

So put that off to the side as a low risk.

It's actually

What would you advise the companies that you work with on this?

Yeah, so the danger we're in right now is we find faster than we fix.

And I'm watching companies struggle with, you know, how much transparency they have about their vulnerabilities and what's in a patch.

Because the ability for agents to go in and reverse engineer what has been patched and then turn that into an exploit is accelerating from a rare expertise down to something you can task an agent with and it can deliver in a few hours, which means it can be weaponized in a day or two.

So that is something companies are struggling with.

on the other side of it is the people who know they have to patch faster but trying to figure out how to do it right that's always been a challenge for us is how to do that patch management what are your service level agreements how fast do you go i've been making arguments that we need to think about our risk tolerance in different ways because of this new vulnerability discovery speed so every cso you talk to will worry about a self-inflicted wound from patching too fast putting an untested patch into an environment or having something malicious come into the patch channel.

And I would argue now that we ought to think about blindly applying vendor patches to anything Internet facing.

What would you show the board to prove this is a 2026 problem and not a 2035 problem?

created scary high efficacy models?

I think the place to start is to understand that while everybody got this mythos fever about this model that came out that was so amazingly powerful, I was concerned before that.

Think about the fact that you get hit by an old Ford pickup truck or you get hit by a Lamborghini race car.

Either way, it's going to hurt.

And the models that preceded some of these newest models are capable of finding vulnerabilities and creating exploits.

They just took a little more expertise and a little better cajoling by the operators, but they were capable for the past 18 months.

And it's been a growth path since then.

It kind of worries me because it sounds a little bit like... subprime stuff right it's a cake mix once you make bake the cake you can't disaggregate it and i'm also reading that what the implications are for the development of quantum and when it lands i'm imagining like a spaceship landing and everything changes at once how did ai get us closer to this wasn't that supposed to be a decade from now

And that is where Rob Joyce, the former head of NSA's cybersecurity directorate, told me defenders may actually be reclaiming the advantage.

I actually think the North Korean problem is much more solvable than the generic intelligence asset deployed into a company.

Why do I say that? Because these are all remote workers.

So I was at a conference just this week where people were talking about the tools they've enacted to stop remote workers from getting into their employment chain.

They're doing things like taking a picture on the video interview and then using that when the person shows up and is online at work to see if they've changed in any appearance or haven't kept a consistent story.

Others are insisting on a one-week onboarding where you come in, and you've seen things like technical capabilities, looking at the latency of keystrokes.

So the fact that they're remote workers is a real liability, and I think the industry will adapt and get much stronger at detecting and preventing this.

Here's Rob Joyce again.

What do we do about that? How does AI protect those systems, and what's the counterpoint? How do we protect those systems against the malicious use of US-created scary high-efficacy models?

I think the place to start is to understand that, you know, while everybody got this mythos fever about, you know, this model that came out that was so amazingly powerful, I was concerned before that, right? Think about the fact that you get hit by an old Ford pickup truck, or you get hit by a Lamborghini race car.

Either way, it's gonna hurt.

And the models that preceded some of these newest models are capable of finding vulnerabilities and creating exploits.

They just took a little more expertise and a little better cajoling by the operators, but they were capable for the past 18 months, and, you know, it's been a, a growth path since then.

What we have to understand is the AI tools are not creating new ways to hack.

What they are doing is they are revealing the flaws that are already in our software or in the configurations of our networks, or the problems we have created accidentally inside these systems.

How did AI get us closer to this? Wasn't that supposed to be a decade from now?

Uh, so if you were able to, to penetrate Axie's machine, you got access to, like, five or six of these signatures.

And how did they get there? They went after the developer.

They used social engineering and our human weaknesses.

It wasn't technical brilliance, it was social engineering mastery.

They did it by posing as a recruiter on LinkedIn.

They targeted the senior engineer at a developer that works in this crypto ecosystem, and then after multiple fake interview rounds with that developer, they sent him a PDF job offer that was laced with malware.

So they worked to build their bona fides with this guy and convince him that he was getting a job opportunity.

[laughs]

That was Rob Joyce, who was running NSA's hacking division, TAO, at the time, and while he has to be circumspect on the classified intelligence they had definitively pointing to the DPRK, he confirmed that the initial public assessments were right on target.

After the Sony attack, even the cybersecurity community focused in on North Korea.

They got it right.

If you watched the, kind of the Twitter community that I follow, everybody was talking about the fact that Sony was a North Korean job.

It was really funny, though.

After the White House came out with attribution and the FBI named them, then all the conspiracy theories popped out, and people had all sorts of reasons why it wasn't the North Koreans, which really just surprised me because the wisdom of crowds was already there, and the fact that the government said it pulled everybody into a, a whole different region.

Here's Rob Joyce, who watched this unfold in real time at the NSA.

The strategic moment was the Sony breach, where it wasn't just a breach, it was reaching into an American company and kind of bleeding them in public.

Their estimate, roughly half a billion dollars a year.

I have to put into perspective that the North Korean economy is the size of, like, Vermont's economy, and here they are establishing a nuclear weapons program and have created intercontinental ballistic missiles that most nations don't have.

Here's Rob Joyce, who used to run hacking divisions and later cybersecurity for the NSA.

Cyber theft punctures the sanctions.

Sanctions assume you can restrict the revenue, and this cyber channel creates revenue that's borderless, deniable, and renewable.

They've been to- able to continue to generate cyber revenues year on year.

So I think, uh, North Korea is more dangerous because they're disconnected.

Deterrence is harder.

Gain deep visibility into your network with ExtraHop's advanced analytics platform.

Brian, think about it.

If you've got the perfect patching program and you can get every device immediately patched with whatever the manufacturer sends as the latest update, you still are in a world now where we expect more zero days.

And in fact, one of the cybersecurity companies, it might've been CrowdStrike, put out their annual review and they talked about the delta between you know, the known vulnerability and exploit.

And they said it's minus seven days in their most recent evaluation.

And what they mean by that is people are using zero days against devices before the patches are out.

So you've got to assume that things are going to get past your first line of defense.

What are you seeing in terms of what the industry is doing to maneuver to get ready for when it is released?