Cybersecurity Perspectives for 2025 – Insights from Dan Lohrmann

Welcome to the Cybersecurity Vault. I'm your host, Matthew Rosenquist, CISO, industry cybersecurity strategist and advisor. And today, this podcast is part of a series where I get to pick the brains of cybersecurity leaders as to what 2025 will hold for our industry. And we're going to explore kind of in 3 different areas, how attackers are maneuvering, how business conditions are changing, and how technology innovation is impacting cybersecurity. And today I'm talking with Dan Lohrmann. Dan is a field chief information security officer at Presidio, an author, international speaker, and longtime cybersecurity trailblazer in the industry. Welcome, Dan, and thank you for sharing your insights today.

Matthew, it's great to be with you. It's great to be on this podcast, but also to see you in person back in Montreal last year. It was great to, Spent some time together. So really excited about the conversation.

Lot of fun in Montreal. We got to meet and talk with a lot of great people there.

We did.

Okay, so every year, right, especially around this time, but it seems that cybersecurity becomes more challenging and the attackers are adapting. The business expectations are increasing faster than budgets and the technology adoption creates all sorts of headaches, challenges, and opportunities. So let's start with the attackers, right? How do you see cyber threats changing in 2025 from tactics or capabilities or maneuvers or what do you think?

Yeah, I'm going to start off by saying one thing, a little plug, but it's not just for me, but for Government Technology magazine. Every year I do a report. I've been doing this for more than a decade now of not my predictions, but the top vendors all put out. We were just talking about this before the show. Free predictions. You can go out to Lorman on Cybersecurity and you can see this report. It's called the Top 25 Security Predictions for 2025, Part 1 and Part 2. Matthew, you're in there in Part 2 and you've done this. You're great at it. But, you know, not just individual predictions, but also what the vendors are saying. And the reports have references and more detail. So What I'm gonna say is definitely influenced by what I've been reading a lot over the holidays. And I do this every year for my own benefit, for my own career. I encourage your listeners to do that. Read the reports, the background, the references behind it, because it can really help you understand why people are saying these are, whether it's a prediction, a trend, a forecast, different people use different words, but it's really the same thing. One thing I, probably the one prediction that I like the most, I saw it in WatchGuard, I saw it in Trend Micro, I saw it in a number of them. They call it pig butchering, which like, what's pig butchering? What does that have to do with cybersecurity, right? It comes from the concept of, and that's a scam by the way, pig butchering scam. We're not talking about just fattening up a hog, but that is part of it. It's like the idea is it's a slow process. You know, they kind of like, they wait for the cow or the hog to get big and then they slaughter them, right? And I think a lot of the reports are talking about that. I like the concept of, I mean, I don't like the concept, but I think it is something that's happening a lot more. So the concept, the philosophy here, Matthew, is a slower, longer hack with big dollar figures. So we've seen fraud, CEO fraud, people call it whaling or the big fish, if you will, the big CEO fraud for a while. Business email compromise for a while. Those have been trends from the FBI and others over the last few years. What they're saying now and what a lot of the vendors are saying and what I'm seeing as well is you're hearing these stories of people, it can be days, weeks, months, you know, not necessarily just the quick, I clicked on something and ransomware hit. Of course, that's gonna be happening as well. So I don't think ransomware is going away. I don't think those hacks are going away. But a slow, longer hack where the idea is, you know, building a relationship with someone using deepfakes, using all of these different techniques and building that level of trust and then going after a much bigger payday. So maybe a bigger— you're not just a one-off, I transfer you $100 or $1,000, but maybe I'm going for several million dollars or, so it's a slower, longer relationship with the bad guys. Of course, you don't think it's a bad guy. Maybe you think you're in a romantic relationship with somebody who lives in Europe or it could be all kinds of different scenarios. We could walk through some of those, but pig butchering shows up in a lot of these reports or the low slong hack, the low slong, slow long hack. You know, and really just trying to get people to build trust with the victim so that they're gonna actually have a bigger payday.

Yeah, I mean, that type of fraud, it's a long game, and it tends to focus on a particular target, and it's very personal, right? Because as you said, it's building that relationship, and in many cases, a romantic relationship or some type of, mentor-ish kind of relationship where the victim wants to protect or help or, you know, because of this long established kind of tentacles over time. But it's, you know, do you think in 2025 that type of attack is gonna be scalable? I mean, it's very personal, right? When someone gets victimized, it's very traumatic. It's not, you know, an entire company, it's a person typically. Do you think that's going to scale out or is it just going to be big in headlines and who gets hit?

I think it's going to scale in this sense. I mean, there was a program and now I'm going to forget who it was with. This actually isn't in any of the reports, but there's several programs you can go out there and look at romance scams over the last couple of years and using AI, using broad initial approach actually using how they would scale would be the initial round of getting people into the net or whatever and then they pass it off. And there were— they actually, I think it was 60 Minutes actually now that I think about it where they actually did a whole segment where they tried to track these guys down in Nigeria and in Africa. You may remember what I'm talking about. Yeah. How does that scale? Well, it scales because you're using AI, using automated means to get, you know, to get people kind of the step 1, step 2, kind of first inning, second inning, third inning. At the third inning, then you hand it off to another round of people that get it to the fifth, seventh inning, sixth inning, seventh inning. And then you have your closers that come in eighth and ninth inning, if you will, using a baseball analogy here, that are actually going to close the deal and get the millions of dollars. So, I do think, yes. I mean, the answer to the simple question is it might not scale like in the sense of we think of millions of people being in the headlines, but I do think millions of people— this will impact millions of people using— and we've been talking about this for a couple of years— using deepfakes, using AI, using automated techniques to be able to reach a wider audience and again, see who falls for that first level. We used to always talk about phishing and then spear phishing and then whaling. And we've been talking about that for several years. I've written about that. I know you have, others have. This is like, it's linking them together, maybe a broad push Wide, wide net, get you to the beginning, then get you to the next level, next level. And then you're going to read about the ones that are tens of millions or hundreds of millions of dollars that actually— I mean, these can be very sophisticated. Almost reminds me a little bit about— it's going to show how old I am— the old movie The Sting. These are like The Sting. And they're going to really— if you go way back and watch that movie, you know, a lot of—

watch the original. Yes.

Anyway, that's the same kind of concept, but it's online.

Well, you know, and what you're really talking about, and we're seeing this now, right, is that it's really a marketing and sales funnel. Just like you said, there are teams and experts and tools to get people into the funnel, right, to be able to trigger it. And then it goes into that next phase where they're, you know, a whole different team who is an expert more in local language and romance and empathy, building that long-term relationship. And almost like a CRM system. When did I last contact this person? What was said? What's my next little, you know, text I'm going to send or message I'm going to send? Great. Right. And then you get to the closers, right, where you're going to, you know, push the hammer down. You're going to get the money. You're going to have some type of fraud and transfer of assets. And that's where you close the deal. And if, you know, we're starting to see that in 2025, makes total sense to me that that becomes more institutionalized. Because it makes money. It works, right? And if it works, that's what the cybercriminals are going to do, and that's where they're going to invest. Okay, so I love that idea for the attackers. So let's switch. And how is running cybersecurity, the business of cybersecurity, how is that going to change for cybersecurity professionals?

Yeah, I mean, I think, you know, AI, you know, we see wide trends. I mean, every report you read, every prediction you read, any conference you go to, you almost can't get more than a paragraph in without saying either AI or GenAI or automated tools. It is, you know, there's no doubt it is the new pixie dust, you know, and to some extent, it is everywhere, it's in everything, and all old products now have AI, you know, with it. Vendors are all, in '23, '24, everyone's now getting to the point where they said that, you know, we're an AI company, maybe creating a .ai version of the company or whatever it might be. But now they're starting to roll out products and/or new products associated with that. I think there are varying levels of what's real and what's not, but I will tell you that with some of the top vendors. And I hate to start naming vendor names, but, you know, we can if you want to go there. But they really are— we've been, again, talking about this for a while, but I think in '25 we're starting to really see a level of automation, a level of response with artificial intelligence and toolsets that is something at a level we've never seen it before. And really where your typical SOC analyst, security operations center analyst, analyst cannot possibly keep up. So we've, again, the concept is not brand new. I think what we're seeing though is it's coming to in '25 a whole nother level of speed, accuracy, the ability to really be almost like that, level 1 SOC analyst of old and then pass more things to a SOC 2 analyst or really be able to, again, that funnel of where are those threats, real-time response to those threats. We're seeing, if you want to take a big step back globally, just literally the headlines, Trump administration is about ready to take office. I'm not sure exactly when this is going to be airing. But, you know, talking about billions and billions of dollars coming into the US from all over the world around new data centers, I mean, to the hundreds of billions of dollars being invested over the next several years. Those data centers, you know, it's more data than ever. It's more— and, you know, we've been talking about data analytics for years. We've been talking about, you know, more data collected than ever because Internet of Things is all around us. So you've got IoT, you've got the physical aspects of security, then you've got cybersecurity, all of these threats coming together and how do you parse them and how do you know what you can actually work on as a security team? So that's where AI really comes in. And, you know, again, we could start talking about, you know, what different products can do for different companies. But I think at a broad level, almost every one of the top vendors is giving you the ability to do that at a scale, breadth, and depth that we've never seen before. So, whether they call it AI, you know, I think the other big trend along with that, I'll just throw this out there because back to the individual, you know, every report talks about agentic AI. We're all gonna have agents in our lives. Agentic AI keeps showing up everywhere on a personal level and at an organizational level. What is agentic AI? For those who have never heard the term, go research it, go read it. There's articles on this. It shows up in every single one of these reports. You can read at least 90% of them that, you know, an agent will, you know, be able to go out and do all these different things for me from, you know, I could set it off and it could go find all the travel deals the Lorman family wants to go on. I give it some boundaries and it goes and comes back and gives me all of this information about, okay, these meet the criteria, these follow these rules. And ultimately, we kind of want the Jetsons robot to do all this for us. I don't think that's going to happen in '25. I don't think we're going to have a robot serving us. But that model, we're heading in that direction. And the agentic AI is we're all going to have agents that's going to be gathering more data than ever before on Daniel and Matthew and We're gonna have this data in all areas of our lives. A lot of it is gonna be sensitive. It's gonna be very personal. How much privacy do you want in your life? All those questions. But my point is all that data is gonna be there in those tools, individuals, organizations, meetings. All this data is there. And guess what? The bad actors are going after the same data. So the reality is you're gonna have to have the ability to respond so much faster and so much broader and deeper if you're going to even keep up because you can't do this manually anymore. You won't be able to keep up without these automated tools.

So I'm hearing two things. One, I'm hearing that security teams in 2025 are really going to lean in to practical uses of AIs that vendors are now coming to fruition with. And making available, but they're going to lean into AI just to meet with the scale. And they're going to need to because on the other end of that, AI is generating and creating so much more data and sensitive information that's valuable that the company then has to protect. So the amount of data to protect goes up, and now you need scalability. And so, and you had mentioned SOC, right? Security Operations Center. Do you think that will be in 2025, right? I'm sure, years past, you know, expand out. But do you think in 2025, that's where security will see the biggest impact for AI systems to help them on this journey?

I mean, yes. And I think, you know, not all SOCs are created equal. You know, one small company, a lot of organizations outsource these functions or, you know, The people use different words, and it's— I was in, I was in government at a time, Matthew, where outsource was a bad word. You know, we weren't outsourcing anything. You know, we're partnering, we're not outsourcing. So like, you know, you say outsourcing, you get fired. You know, you can't say that word. Don't say the O word, especially if it's offshore. If it's offshore outsourcing, now you're really, now you're really out of a job.

Yep, yep.

That is hitting the tax, the tax coffers. So we don't do that. So you say, we have to have it onshore and you have to— different people are saying, okay, is this being done in India? Is it being done in Australia? Are we doing a follow the clock, follow the sun kind of approach to this? Or is it kind of your traditional SOC that it's 6 guys in the basement? We used to call it when we first created our first SOC in the state of Michigan, when I was CISO in Michigan, we called it the Bat Cave. It was the Bat Cave. And literally the Batcave was where, you know, all the fun stuff was happening. And we put a big sign over the door and said, "Do not enter," and, you know, "Warning," you know, and that was about all we had. You know, there was no security around it or anything, but we had a good sign. But, you know, the reality is we've come a long way with SOX. I mean, and so, you know, a lot of organizations now partner for that or use managed service providers for that. But I think that's where we are seeing the most innovation. And again, it's really challenging. I think at the end of the day, you know, some of these threats are still the same threat. So ransomware is evolving. You know, we're still seeing more and more, you know, record levels of ransomware hitting hospitals and healthcare organizations in '24. Do I see that stopping? No. I mean, as we're getting better, unfortunately, the bad guys are getting better as well. It's going to be a required, bring you, you know, step up your game because the bad actors are stepping up their game. And if SOCs don't innovate, if they don't change, if they don't modernize, if they don't bring in these tool sets, they will not be able to keep up.

Yeah, that makes a lot of sense. So the last kind of area is really around technology. And we've been talking from the onset here about artificial intelligence. Do you think 2025, that's really gonna be all we're gonna talk about from a technology perspective? Or do you think things like quantum, distributed computing, you know, things like that, next-generation cloud, from a technology perspective, what will be the big movers and shakers in 2025 for cybersecurity?

Yeah, I mean, interesting, you know, you mentioned quantum. I'm gonna give you a different answer. A few days ago, The CEO of NVIDIA just kind of, you know, just came out with a press conference this week. And when we're taping this in the second week for first full week of January, you know, it just came out with a report saying that real quantum computers might be 15 to 20 years away. So, you know, a bunch of startup quantum stocks just halved in value, literally. I mean, that's not a joke. I mean, that is literally— go out and look, you know, believe me, go out to CNBC or Bloomberg and you'll see what I'm talking about. So, I do think that, you know, we have a lot of different things on that traditional hype cycle, if you will, from Gartner or whatever vendor you'd like to use to look at that. I do think, you know, I mentioned earlier, agentic AI, I think that that is a trend that keeps showing up that it's an evolution of AI into more practical areas of every area of life.

And so it's the Jarvis in Iron Man, right? I mean, it's that being able to do analysis, being able to be extensible, grab and set off other things and pull it all together. That's the promise of that type of AI. Everybody wants that. I mean, correct. Correct.

And I think, and being able to take some steps out of it, like, so I mean, the idea, putting this very practical level, you know, You know, I, I, it's funny, just before I was on the show here, you know, I just— a good friend, Larry Whiteside, and everybody know, you know, Larry is, is, uh, posted something about a vendor who posted on their website, uh, a little side thing. It's like, um, you know, this data was created with ChatGPT. Uh, we are, you know, we are basically a total disclaimer of the value. It's like no responsibility Please do not use this to make any important decisions. Please do not rely on this as being accurate.

Full liability disclosure.

It was crazy. I mean, I'm reading this, I'm like, Larry, come on, what's going on here? But so I think the level of trust that people have in that, that's where the level, that's where the battle's going to be. Again, right before Trump's taking office here, you know, CISA just came out with their— they're announcing that they're going to now have trust labels on IoT device certifications of, you know, is this product cyber safe? Is it trust— will be cyber trustworthy? And so, you know, who are you going to listen to about data? Who are you going to listen to about you know, these AI agents. I mean, I will say, like, on a personal level, I use— I would never use AI to write for me because I love to write and I want it to be unique for me. But I will use it to, like, I'll take a blog, I'll throw it in ChatGPT or Gemini or something and say, what's a good headline for this? Yeah, and it gives me a great job of, like, giving me an SEO, search engine optimized title.

I do the same thing, right? Give me 10 titles.

Oh yeah, and so doing all of the job for you, no, not yet. At least, you know, I wouldn't want to outsource that because of the trust, because I want my voice. I want— I'm sure you want your voice. I don't want, you know, a machine making that decision for me. But as far as gathering the data, automating that process, maybe, maybe summarizing it, um, I, you know, when I wrote this and I looked at it, literally it was over 10,000 words for this two-part blog for all these vendor reports from all these hundreds of cyber vendors and technology vendors. And, you know, I wrote it all up and I, and just out of curiosity, I threw it in to ChatGPT and Gemini and said, what do you think the top trend is? And it came back with too much data. It couldn't deal with it. I mean, I probably didn't I didn't have the— maybe I didn't have the high enough level version of it or something, or I didn't give it enough time or money. I don't know, but it kind of burped. The reality is I do think that we're going to see innovative ways to help us do our daily jobs faster, more efficiently, better. I think that's going to be the main thrust of this in 2025. I think the other thing I would just mention briefly, Prediction, these prediction reports and this talking about the future, the old cliché, Yogi Berra, "It's hard to predict the future because I don't know what's going to happen," basically. I mean, the reality is, I just want to mention this, we always think about these challenges in a linear way, assuming a whole bunch of things are going to stay the same. We all learned the hard way during COVID That, you know, when COVID hit, it totally changed a lot of our paradigms about working from home, about what does it mean to be healthy or safe or wear masks or all these kinds of things. It totally changed. So, for example, I'm not predicting that China's going into Taiwan or some major cyber incident, Pearl Harbor's gonna happen, but it might. And so, the point is, is that what we don't know is what paradigm might shift that could change this focus. I mean, what's very clear is that there are a lot of geopolitical challenges we have in the cybersecurity world right now with the war in Ukraine, what's going on in Gaza, what's going on in the Middle East, what's going on in Iran, what's going on with China and the attacks, the number of data breaches we saw in 2024 and the attacks of the telecoms. I don't think we fully even understand what all of that means, how much they've been listening to our phone calls or have our data.

30 years, but yeah.

Exactly. And, you know, I come from NSA, but I don't think we got that much data. You know, the reality is that there's a lot of moving parts right now. And so I think as people think about the future, my point of bringing that up with you, Matthew, is I think people need to think in terms of scenario-based planning. And scenario-based planning is, okay, when you have your stock portfolio and you're thinking about your investments, if it's higher inflation market, it's going to be scenario 1. If it's what we expect or best average case, it's going to be scenario 2. And then if it's lower inflation and higher growth and the best case, maybe that's scenario 3. We do that with our money. We do that with our bonds and our stocks. We do that with a lot of things in our lives, even with weather forecasts. If the storm goes here, we're gonna get 12 inches. If it goes there, we're gonna get 6 inches. If it goes here, we're gonna have rain. I mean, we know how to do that in other areas of our lives. We need to be doing that as companies and thinking about this in cybersecurity. When we do tabletop exercises, when we do ransomware, it's not just a one-size-fits-all ransomware tabletop. Because if you've been doing the same ransomware tabletop for the last 5 years, you're doing it wrong. You know, and I've had people tell me that they, you know, "Oh yeah, we're doing this again. We did the same thing back in 2018." If that's what you're doing, then you probably need to make some adjustments. And so you need to have scenario-based planning. I hope and pray China doesn't go into Taiwan. I'm not saying that's gonna happen. What I am saying is whatever your scenarios are in your organization, you need to have If this, then this. If that, then that. And think through some of those scenarios and be ready for those.

So that's a great lead-in. And my last question for you is how should cybersecurity leaders act right now, right? To get in front of these different types of challenges. I mean, what opportunities should they be leading into already as we're coming into the first quarter in 2025?

I think, first of all, they've got to be involved in the AI initiatives in their companies, in their businesses, in their governments. I mean, it's amazing to me as I travel the country like you do, Matthew, and I get to visit around the world a little bit, and it amazes me. I work with a lot of governments, work with a lot of companies, and It's interesting just to even understand what CISOs, what Chief Information Security Officers do, what their day is framed like, what they're involved in, what they're not involved in, what committees they're not involved in. I would say out of the gate, you know, you need to be, and not just from a cybersecurity perspective, okay, cybersecurity and AI for our SOC, and that's nice. But I mean, as a business, understand what are the priorities of the business. So thinking of, you can't really even think about the risk side and really dealing with that till you really have a good grasp of what are the business goals, what are the business priorities, what's really top of mind of the CEO, CFO, what's top of mind of the different business areas, whether that's in government or in the public or private sector. What are the top priorities and what are the deliverables? I learned that as a CISO many years ago, you know, and I figured out very quickly the little, little, side story here, Matthew, I'll just throw out that people always ask me like, how do you get more money in cyber? How do you get more? And I kind of figured out, yeah, we were able to get some grants and we would get some money here and there. But one person said to me, this was probably 20 years ago now, Dan, you guys aren't even involved in the top projects. And so I was like, kind of almost thinking like, get on boats leaving the dock. So the idea of Hey, you know, there's this island out there. You're sitting here on the land. There's this island out there. The boats are all going out to the island. That's called Money Island, right? How do you get out to Money Island or whatever you want to call it? Call it Priority Island or, you know, Top Initiative Island, whatever you want to call it. But the reality of it is you say, I don't have a boat. I don't know, Matthew. I don't know how to get out there. Well, there's all these boats leaving the dock. Get on one of the boats leaving the dock. What does that translate to for cyber professionals, for leaders in technology is make sure that you're involved in those top projects. I mean, in government it might be, you know, we're doing a tax rewrite system, we're doing a new CJIS system, criminal justice system, we're doing a new transportation system, you know, or maybe you're doing SAP, a big new, you know, system, whatever the priorities are. Are your security pros involved in those top projects? And certainly in 2025, they all have components of AI. So making sure that AI is part of the conversation, not just from a cybersecurity defense perspective, but that your teams are on those projects where artificial intelligence and generative or GenAI and other types of new innovative solutions are being discussed. And making sure cyber pros are on those teams. And that's also, by the way, where the budget comes from because you say, okay, it's $100 million project. I just need 2% for cybersecurity. There's $2 million for you. So I mean, that works really well if it's done right. I give you a very simple view of it. It actually can be a lot more complex. I understand a lot of companies and governments, but making sure that you're engaged in the top priority initiatives wherever you're working this year And that's going to make sure you stay relevant both in your personal career, your organizational, and that you're providing the right risk. So then you can provide risk management around those business processes and those new projects.

I think that's absolute— it's genius and it's key, right? Cybersecurity has to align itself as part of the overall business goals. You're not just over in the corner doing a little security stuff.

Exactly.

Cybersecurity is now part of the business and it needs business leadership as part of that. So you have to know and be intertwined for all the major goals of the organization. And that's how you win. That's how you adapt. Great insights, Dan. I really appreciate you here. Dan Lohrmann is the Field Chief Information Security Officer at Presidio. Thank you. Thank you so much for sharing your cybersecurity insights today.

Thank you for having me.

And thank all of you for watching. Be sure to subscribe and catch all the Cybersecurity Vault episodes where we chat with industry leaders to dive into the most relevant and interesting cybersecurity challenges, perspectives, and best practices. See you next time.

Shalom.