AI Scams and the Death of Trust with Frank Riccardi

I think you're absolutely right, Frank.

And, you know, I, I actually wanna talk with OpenAI and Anthropic and others and ask them how do they quantify a sandbox? Because in my, in my book of, of, you know, cybersecurity 101, a sandbox doesn't have internet connectivity as the, the first principle.

So how are these agents getting out and attacking things on the public internet? So yeah, I, I, I think we need to look at some of these companies and go, how good is your own security posture in these places to start off with? 'Cause you created a technology that acts on instructions, and if those instructions are, "Go find the answer to this puzzle, and look at target A, B, and C to get it," and they can break out, well then intuitively they have a knowledge base that may allow them to find known bad.

And it's not net new, it's, it's, it's as is.

It's, it's stuff that's already out there.

But we need to get better at containment in the first place.

So I think, I think there's a lot of lessons to be learned over the next year off, off the back of some of these, uh, events.

Um, I, I know the Australians got quite irked with, uh, with that recent breach of, of their Medicare, uh, website.

Can't remember the specific name of it, uh, uh, essentially.

But it, it's, it's very interesting to see how this is evolving and how the narrative is changing.

Like, cybersecurity hasn't changed, the basics haven't changed, and hygiene is the thing that people keep getting caught on.

Uh, and it, it's, it's funny 'cause as you were talking, I was looking at this only in the last couple of weeks, and I looked, one of the main causes of, of a breach is unpatched systems or, or zero-day vulnerabilities, followed by identity as the most pervasive, so a stolen credential.

Y- and they logged in, they didn't, they didn't break in.

Then it was customer help desks giving away an identity so they could log in based on vision, which had raised up to about 62% on, on, on year last.

That was the version threat intelligence report that that was in.

Uh- And, and, and then it was, what came next? So there was the, the unpatched systems, the identities, the phishing, and then network-connected devices, VPNs, firewalls, et cetera, that were poorly configured was, was the other big one.

So, like, when, when you look at those things, I, I think next year's security program for every company should be, have we got the basic hygiene done right on these, on these four things to start with? And then, you know, spend money on the flashy capabilities and the AI agentic stuff that's gonna run around your organization changing stuff.

But look, that, that's, that's the fun of the game we're in, isn't it? It, it keeps it, keeps it fresh.