EP285 Scaling Lessons from Leading the NSA to Defending the World with Morgan Adamski

Security. Hi there. Welcome to the Cloud Security Podcast by Google. Thanks for joining us today. We're coming to you from Next 2026. Delighted to be in the PwC space recording this episode with Morgan Adamski, the head of cyber digital tech risk at PwC USA. It's a mouthful of a title, but we'll get it right in the show notes. Morgan, thank you for joining us today. Super stoked to have you here. Anton, you have the first question, right?

I'm going to start with threat intel because, you know, that's easy and fun. Everybody knows it.

Easy topic.

And I feel like enough organizations still live in the send me the PDF with what the bad guy did and that's threat intel. And their idea is that PDF goes to a human, humans look at it and decide what to do. But we talk about this real-time collaborative defense involving private sector, involving government. That sounds like maybe not a pipe dream, but a dream. How do you— can you make it a reality?

Yeah, so first, thank you so much. Happy to be here. Now, I will say, like, that dream is a reality. Now, I know that there's a lot of historical perspectives in the fact that, to your point, people would be sitting on the other side of the table, the US government would show up, there would be a document passed that'd say, hey, you had the following intrusion on this date. We don't really have any additional details. We wish you the best of luck to figure this out.

That's sharing right there.

Yeah, and a lot of times companies would be like, well, like— Would you like sharing? Yeah, like, we have questions. We need more data. Like, what's the context behind this? Why should we care that this happened? And at times, they weren't able to get those answers whatsoever, right? So let's fast forward that narrative to about a couple years ago when I know in particular at the National Security Agency, I stood up the Cybersecurity Collaboration Center, which was a way for NSA to be public. But what it really meant to bring was the people who understood the intelligence, who had the expertise, and could sit across the table from those companies and better explain the information that they were providing, right?

Yeah.

One of the things that I heard today from Thomas, right, in the keynote was intel plus automation equals value. And I think that really applies to this public-private partnership conversation. You've got to have the right intel and the people that understand it. You've got to have automation and capabilities to be able to scale sharing that intel. But the last piece I would add there is the trust. You've got to build relationships in advance. So if I call you and tell you you've got a problem, you got to trust, A, that I understand the intel.

Yeah.

B, that I know what I'm talking about and that you can move ahead and use that to better defend yourself. And so that has happened. I would say we're always going to have areas to improve, right? But I think that we're really starting to turn that corner, making sure that there's context with the intel and you're not just getting a PDF.

But the last bit that you mentioned about me, in this case, an example, private company, knowing what to do, that's not in your hands. And ultimately, I've met enough companies who collect intel but ultimately not do anything. Is it specifically not part of the sharing that the intel is easy to put into practice? It's kind of up to the client, their maturity? Would it be fair to say that it's on quote unquote them?

So from my government experience, what I would offer is that it's very difficult when that type of sharing happens for the government to offer recommendations on what you should do, right? There's a liability aspect of it. You can't provide preferential treatment in terms of vendors. And so you can say like, what are the top 10 practices that you should use to protect yourself, which are all things that I'm pretty sure we could guess.

Yeah, right.

And you know what the sad part is, is like when people are like, what should I do more of? The things that are basic hygiene.

The fundamentals of basic backdoor.

So I think that's why that conversation never truly existed. But I think that's where you have companies come in and say, hey, here's some of the practical things or vendors that you can use. And that's where you got to partner with industry so that they can use it.

There is another interesting aspect in what you said there about picking up the phone and it being somebody that you trust.

Yep.

What are we doing to establish that trust? How does that get built?

You got the hard questions too. I do.

Yeah, yeah, yeah.

That's what I'm here for. I think trust is built, A, when you know the person, you can have an honest conversation. You don't feel like you're talking necessarily to someone that doesn't understand your business, what your priorities are, what your budget constraints are. And so I think it takes time.

Mm-hmm.

There's no perfect model to trust.

Mm-hmm.

You know, personalities come into play. You gotta make sure you like the person across the table. You know who they are, you know what they stand for. But I think that what I love about the cybersecurity community and all of us that play in this landscape is we are this community that rallies behind each other. And we are humble because at any given day, we know that we likely have an intrusion or an adversary coming at us.

We could always be next.

But we collectively come together to say, here's how I solved my problem. How did you? What could I do better? What are the lessons learned? And how do I put it in, you know, it's practical.

Okay, great. So there's so many things I love about our community.

Yeah.

So many. And we could talk about that all day. But one of the things I wanna talk about is what the shift was like as we went to cloud For the defending the nation aspect, because we went from defending companies to the shared infrastructure, shared responsibility model. So how did that shift things internally for the government?

Yeah, so when I stood up the NSA Collaboration Center, it was really focused on defense contractors. And so I constantly got the question of like, how are you gonna defend 100,000, 300,000 defense contractors? You're not gonna be able to do individual sharing with each one of them. And oh, by the way, not all of them have the capabilities to be able to take the intel and to operationalize it.

Right.

And I said, Well, I don't have to work with all the defense contractors. I have to work with their internet service providers, their cloud providers, the ones that really own the upstream ecosystem. Now, I want the defense contractors to understand the importance of knowing what their cloud providers and internet service providers are doing, but I really just need to work with the major cloud providers to say, hey, here's the intel. Let's have an intel, like a really in-depth conversation about what the threats are to you because— Even when we migrated to the cloud, the adversaries migrated with us.

They sure did.

And so that really changed a lot of the conversations, just the strategic importance that the cloud providers play when you talk about national security, defense of our critical infrastructure, them having that collective defense where they're constantly sharing the information together matters too. And to your point, our community coming together, I think that what you see is multi-party sharing, which means you don't just have one-to-one sharing with one cloud provider. There are cloud providers, internet service providers, endpoint protection companies that all share together. And that makes the ecosystem more secure as a whole.

So what's so interesting to me about that is we've talked for years about cloud ecosystem concentration risk, but here ecosystem concentration is actually an upside. It's a choke point, but a strategic good one, not a Gulf Straits one.

Yeah, but it's back to when Phil had the— Phil Venables, our CISO at the time, had the megatrends. And one of them was this collaborative defense immune system argument, which to me is very strongly represented here because ultimately, if you defend that particular choke point, you defended everybody downstream.

Yes.

And this is, I mean, lately we haven't been trying to convince people that cloud's more secure. I think the argument that cloud's more secure is— I think that argument won. That argument has won. But it's also a very clear example why. Yeah.

Yeah. And I mean, Phil's great, absolutely great perspective that plays into this. But I do think it's the one point that you just brought up that I want to reiterate is the fact that it's really important that people come out and talk about their lessons learned. I think Sometimes when we see intrusions or activity or prioritization, like I don't want you to know necessarily what I'm investing in, like that really becomes difficult to balance because if we're not sharing amongst each other and because we're all in this ecosystem together, it really can hurt us at the end.

And then from what I've heard, again, I'm not that deep in the TI ecosystem, but the risk of attacker doing something useful because of that sharing is presumably quite low. So defenders lose if it's not shared, but attackers don't really win. So it's kind of like, Seems like a good argument for sharing, but occasionally people say, oh no, no, no, what if the hackers know?

Yeah, I mean, that's true, right? I would say how we share, where we share, and what people do with that information is really important. Because to your point, if there's a very bespoke tradecraft that an adversary is using across multiple things, we don't want to disclose it if we know how to protect against it. We may want to do that in a separate channel. You just have to be thoughtful in how you're doing it.

Yes, I mean, these examples are either unique controls which we use to detect it, or maybe it's a mistake the attacker made, I'm fully with you. Like, I want to just limit the sharing. So I want to shift gears a tiny bit to something quite odd. While I— Of course you do. Didn't have to convince, quote unquote, the big bosses, the manager, the CEOs that, you know, cyber matters. But occasionally from my colleagues who deal with boards, actually that question is still real. So how do you translate some of this technical cyber threat knowledge into the language of a board? And beyond just hand waving and saying, there are big risks, we're all going to die. Like, that's not really effective from what I heard. So what is the— you've sat in some really high-pressure situation rooms. So what are the lessons from that for board comms?

Yeah, you know, it starts with the fact that you have to be able to explain how the risks associated with cybersecurity play into the larger business risk. And I'll apply this to my previous job experiences. I would spend a lot of time talking to the Department of War officials, our government officials about the fact that, hey, you have to recognize that your reliance on this infrastructure, on this technology, on being able to have access to this data to make decisions, if it all of a sudden has some issue where it goes down, it's inaccessible, you don't have redundancy set up, you now have assumed a significant amount of mission risk.

Yep.

And so driving that conversation into boardrooms now is really about the fact that, hey, you have to stop looking at cybersecurity as a back office function. It's not just an IT problem. It is the fact that you are reliant on these capabilities, this information, the access to the information, and all of this being up and running 24/7 with no problems to make your business successful. And I think we've seen that play out even on a geopolitical scale now, and thinking of all the geopolitical volatility that exists in the world.

Yep.

And you see it playing out in the technology ecosystem, right?

Yep.

We have a lot of adversaries now thinking about how do I target infrastructure? How do I target technology providers?

Supply chain, of course.

Supply chain to as pre-preparing for a crisis or conflict or war. I mean, we all now play in this world together. And the way that we're interconnected, geography is no longer an added benefit. There's no geography when it comes to cyber and technology.

I mean, it sends me down into some of my favorite '90s are over arguments because we have the same IT, same computers on the backend. So just because you live in some country where maybe you're less reliant on IT for some things, you're still reliant on IT, on cloud, on AI. And I think the AI example is there. Like, if somebody became truly AI native and they use AI for critical tasks, are they ready for this AI to be not there, not there for a while, not being as accurate as before, degraded? Like, I've seen some really fun tabletops and people test for this. And the results are, as Jamie and I would say, maybe unexpected. Yeah, yeah.

And I mean, I think one of the conversations that I have a lot with clients and a lot of people we talk to now from a boardroom perspective is that you need to be having both sides of the conversation. Like, how am I leveraging AI for security, right? Especially in a security operations center and a lot of the work we do with you guys in SecOps.

Yep.

But at the same time, when you think about how you're building and integrating AI into your workflows, you've got to think about that AI security, that trust AI, which is, you know, a lot of the discussions we have on Gemini. But you can't, just be taking AI, throwing it into your networks and saying, God, I hope it's secure and nothing's going to happen to it.

What could go wrong?

Well, we know from an adversary perspective that they're thinking the same way we did when we talk about how do you scale operations? How do I get into a network and potentially manipulate, disrupt, or destroy your integration or your implementation of AI? Because that will have a larger effect because now you've made it part of all of your networks and systems. So you've got to have both sides of the conversation.

Yep, that makes sense.

So I want to pick on something that came up in there around resilience and geography. We've seen for years a desire for cloud sovereignty and cloud data residency. And now we're seeing the risks with that, with physical disruption. How are we helping boards reason about that kind of risk?

A lot of the conversations around that kind of risk is, to your point, resiliency, redundancy, but recovery. Like when you talk about cloud sovereignty, you talk about the disruptions now that we see occurring, people now saying, oh my God, that's gonna take us 10 to 15 years to rebuild. We didn't recognize that that would have such a significant impact. Or the fact that it could just go away in an instant.

Right.

Talking to boards about really recognizing that fact that you need to really tabletop and play this out more times than not. And then you've got to plan for the unexpected. Like, I think that a lot of boards at times say, oh, I have a tabletop. We've thought about all these things. We are well prepared. We will execute this on a dime. I am good to go. And the conversation really is, that's great, but like every plan goes down. the tube as soon as something goes wrong, right? It always has to shift and you have to think of different things that you never considered, right? You know, we always tell the story of the fact that the squirrel ate through the fiber. Like, you never— did you plan for that? Is that in your playbook? Probably not.

Probably not. Well, now squirrels are because the whole squirrel— the damn squirrel showed up on many threat models and it's been there for many years now.

I opened a wormhole with the squirrel.

You really did. But yeah, I mean, people made all sorts of beautiful materials with squirrels, how they're much higher risk to OT than attackers. Yeah, I mean, we're doing this.

Just to be clear, I have no squirrel expertise, so I am not contributing to this conversation. It's merely the point of we really, you just, you get with boards, resiliency, redundancy, cloud sovereignty. Like, again, there's no boundaries when it comes to cybersecurity in terms of geography. And so you've got to really consider yourself if you're a global company, how are you thinking through all those scenarios? And then if you've thought through all of them, great. But you also have to think about recovery. and then how you're going to communicate. I feel like breach comms, like when there's an incident, a lot of companies want to say, don't talk about it, right? That's their natural inclination. But the problem is, is that if you're not providing transparency to your clients and to your customers, you're going to have to deal with a breach. You're going to be in the worst of your days while you're also trying to communicate to all these people who think that you're like boxing them out. And you lose a lot of client customer trust in that respect.

Yeah, yeah, yeah. Back to trust.

And please don't bring up the, we take security seriously here, because this has been a very notorious line from many early attempts to communicate post-incident And I think that many people who focus on this pretty much tell people, don't do that. Don't. No, not this one. Anything but that.

Yeah. As a government official, the former, you know, no comment always leaves a lot to the imagination.

Sure does.

So if you do not comment, people will write their own story and then you spend a lot of time trying to defend it.

Easier to give the story you want than no story at all.

So I feel like we spend most of our time discussing something really fun. And I just want to maybe start closing the episode by drilling down into the resilience discussion. You brought up the geopolitics. Yeah, I want more resilience because ultimately—

We all want more resilience.

Right. But like the board discussion brought up another resilience question when the tabletop done at a high level does hint that we are okay. But when the squirrel shows up at a detailed level, we're not okay. So any kind of way to bridge that kind of more vertical, like make resilience actually be there in metal and not just resilience at the board tabletop. That's probably a good, like, double down in resilience in the real world as opposed to like good idea?

Yeah, so more so along the lines of like when you think about where you actually storing and accessing your data, having that set up in multiple different locations, I think that's really critically important. I think it is difficult for CISOs right now in particular, right, to think about how do they invest in multiple different technologies and places to store their data because the cost sometimes can be astronomical, hard for them to deal with. But I think you have to explain to the board like this is why I'm trying to be able to have this redundancy, why I'm trying to have this in different places. I think that's critically important, but again, a difficult conversation to have. I think I've heard in multiple conversations to have Phil talk about cold restarts and various things like that. How do you play out?

Yes, the minimum viable business.

Yes.

To how much you can shrink so you still have a business. To me, that concept is stuck in my head for like since—

Because everyone just keeps growing and they do end up doing all the things. And then at a certain point, you have to go down and understand like, what are your mission essential functions, what used to be called in the government. But how do you really say what are the critical tasks that I need to provide after Day zero, worst day. And then how do I get them up and running again? And what's the pathway to be able to do that? And that, by the way, is more than just the cyber organization, right? It can be everything from procurement to contracting, maybe you need to bring in a specific skill set, like, and you've got to be able to do it quickly. And I think that's why it's so important that the conversation is broader than cyber when you talk to the board, because all the players need to understand what their role is going to be to make sure everyone's successful and they get to move on as a business.

And I think that message has spread enough, and I think that security as a business enabler, security matters for business story started probably in the '90s. I don't know. But it's interesting that it took that many years so that today in 2026, we talk about this and you say, yeah, boards mostly get it that it's not just about IT backroom. And Tim is making a skeptical face because clearly some don't. And that's also a fact.

Not all organizations are created equal. But I think there are enough organizations that have seen entities that have to have gone through this. And when they talk about lessons learned, it really is about the fact that here's all the things that I had to do. And now people recognize this is where we're going to be. And in the world of AI, I think one other piece we tell people is prepare for a breach in the next 2 years. So you need to put all these pieces together. But I, I still root for the defenders. I think, I think we're working hard.

I think we're working hard. Morgan, I hate to do this, but it's my job to ask our traditional closing questions. So 2 questions. First, do you have recommended reading? And that could be anything from, you know, Mary Shelley to I don't know, NIST guidance. It's not allowed to be Anton's blog.

It can be an orange book from the 1970s. It can be anything. It can be anything.

Oh no, I don't think I have a good answer to this. Is that horrible?

No, no, just think about it. I'll ask you the second question and then we can come back to the first.

I just like to stay current on all the things that are out there and reading like differing perspectives. I think I love the fact that the cybersecurity community like debates the crap out of each other.

Yes.

Like they never agree on a single thing because then you get all the different perspectives. You get the security professionals, you get the cybersecurity researchers, the vuln researchers. So I think it's really important to make sure that you're reading from both sides of the house.

Where do you like to get that reading from? Are you a LinkedIn person, a former Twitterite? What's your feed look like?

No offense to anything. I'm not— I'm on LinkedIn, but I am not a— I like to go out to like different types of blogs and websites, ones that are— make sure they're legitimate. I still have a national security background. I like to check my sourcing. But I honestly, I do get a lot of references from friends and people that think something's valuable to understand.

Yep.

Okay. And our second closing question is, if you had one tip to help people with their information sharing or resilience preparedness, what would it be?

Anything from the show. I mean, anything you feel like.

Yeah. You can't build trust in a crisis. So don't try to build those relationships when you're in the middle of a bad day. Build relationships you need now, whether it's with your service providers, whether it's with your cloud providers, whether it's with the US government. Even though you may not need them today, you're likely going to need them in the future. So build strong relationships.

That's great.

That bit alone pays for the ticket. Yeah, I think it does. If you listen to the whole show, like that bit alone is kind of amazing because I've seen so many people kind of attempt it out of desperation.

Yeah, it's so hard.

And if you would show up and say, hey guys, no, sorry, you need to build it before. I mean it. It's just oddly liberating.

Hardness includes your friendships.

Yeah.

Yes.

Yep.

Amazing.

We all need each other.

Morgan, thank you so much for joining us today.

Yeah, thanks.

And now we are at time. Thank you very much for listening and of course for subscribing. Please subscribe so you can get new episodes piping hot And if you love our content, please drop us a review on your platform of choice.

You can find this podcast on YouTube, Apple Podcasts, Spotify, or wherever you get your podcasts. Also, you can find us on our website, cloud.withgoogle.com/cloudsecurity/podcasts. You can argue with us on the Google Cloud Security Community site, googlecloudcommunity.com.

You can follow us on X, x.com/cloudsecpodcast. Tweet at us, email us, argue with us. And if we like or hate what we hear, We can invite you to the next episode.

See you on the next episode of the Cloud Security Podcast by Google.

Security.