Cybersecurity Perspectives for 2025 – Interviews with Experts: David Hahn

Welcome to the Cybersecurity Vault. I'm your host, Matthew Rosenquist, CISO, industry cybersecurity strategist and advisor. Today, we're going to talk as part of a podcast series where I get to pick the brain of cybersecurity leaders as to what 2025 will hold for our industry. So it's going to be an interesting conversation here. And we're going to explore in 3 basic areas. How attackers are maneuvering, how the business conditions are changing, and how disruptive technology is impacting cybersecurity. And today, I get to talk with David Hunn. David is the chief information security officer at Ballistic Ventures. He's on multiple advisory boards. He's an industry speaker, and he has over 20 years as a veteran in the cybersecurity industry, specifically around leadership. Welcome, David, and thank you for sharing your insights today. Thanks, Matthew.

Thanks for having me aboard.

All right. So we're just coming into 2025, and every year there seems to be all sorts of new challenges, new pain, people crying and sobbing, you know, from attacks. It's challenging. And we know the attackers are adapting. We know those business expectations are always going up, and it seems to be going up faster than budgets or ability to make change. And then overlay that with all sorts of technology, right? There's all sorts of challenges and opportunities. So let me start with this. From the attacker's perspective, How do you think they're changing and they're adapting in 2025 from tactics or capabilities? What do you think?

Yeah. So, you know, all my years of being a CISO and, you know, hearing all these predictions and prognosticators and everybody saying all these things, you know, certainly it follows anytime there's, you know, new technology or greater. So I remember when like mobile was going to be the big thing. They said, oh my God, all the attacks are going to be on mobile, right? And then cloud. And certainly, you know, all the talk with AI and, you know, in terms of how the bad guys are gonna weaponize themselves, I think all those things are, are absolutely, you know, true in terms of they will eventually do that or they may already be doing it. But I think there's also this thing called, you know, if it ain't broken, you know, don't mess with it. So the bad guys still have very, you know, good capabilities, you know, in terms of ransomware, in terms of phishing, Fishing, I mean, can you imagine, Matthew? I mean, you and I were like children when fishing started, right? And it is still there and it doesn't go away, right? In fact, you know, if anything is the gray hair, nobody's buying that, David. Yeah, yeah, no, but you know, I mean, certainly, you know, the fishing's better. You know, you just go on ChatGPT and say, hey, write me a fishing, you know, so, you know, no grammatical errors, no, you know, whatever of that things that are obvious to see. So I think from the standpoint that the really sophisticated ones clearly are going to be using, you know, more techniques and capabilities, but at the same time, the oldies and the goodies are still there, right? So we still have to worry about ransomware because it is still the most effective way, and obviously that there is a monetary, you know, value, right? And so with the crazy amount of cryptocurrency going on, right, that absolutely there's motivation for the bad guys to continue to what makes them tremendous amount of money and easy money. And so I don't see that going away until we all collectively are able to change that. So I think that's out there. So my kind of, I guess, advice to CISOs is, hey, don't stray too much and start wearing all the shiny stuff that people like us keep talking about and talking about AI, which again, it may be true and it's all gonna be there. It's just a matter of time, but don't forget the blocking and happening that we must do because the bad guys will continue at that. In fact, they're obviously able to now scale it, automate it, you know, so the amount of attacks that they can do is really, you know, no big deal. And certainly their ability for them to kind of control the financial aspect of it with crypto is just, you know, mind-boggling in terms of how much they can get away with.

Yeah. And again, it makes a lot of sense, right? I mean, we have to respect the fundamentals and, you know, look at the classics, right? The attacks that work and Part of the fundamentals is a lot of these, especially cybercriminals, they're looking for the easy button, right? And if something's worked yesterday, let's try it again today. Green principle. Why overcomplicate things when ransomware is still working, when social engineering is still working? So it sounds like you're in the camp of saying, hey, everything we're seeing now is going to continue that works now for the attackers. There's still that push, there's still that pressure, but it also sounds like you're saying that they may try and leverage new tools and make it a little more efficient, a little more effective, you know, using AI for local language or, you know, sounding more professional, but still sticking with the fundamentals, those classics that continue to work. And we can't forget those fundamentals, right? That intersect.

Exactly. Those classics. But yeah, let me touch on a few areas that certainly are more from a trending standpoint growing, and again, the capabilities there. And so, you know, we've all heard about deepfakes and what you can do with it. And really it's this kind of almost open-source nature to how it's proliferated because it's so widely available. And, you know, there's so many fun and interesting things you can do with it. Well, guess what? There's also, you know, a lot of bad things you can do with it as well. And we're slowly starting to see a few of those, you know, starting to come out, you know, like in Zoom meetings, you know, you have fake, fake interviews, basically someone was able to exploit some money out of a company in terms of doing a wire transfer based on a fake Zoom meeting that was deepfakes. But I think if we take it further in terms of how widely, so we're talking any kind of a voice, right? So it could be an automated voice response unit. So remember that I think a lot of banks still have the, you can verify everything through voice, Well, you know, that's basically broken now, right? Because you can clearly fake the voice so well, you know, that you can break through any of that. And then certainly in terms of images and stills, we've seen that going on for a long time. And then the combination of both the voice and the still, which is now in form of video, right? And so, and then to be able to do it live, so it's not just a recording, but you know, for those who can basically figure out how to get into a Zoom meeting and fake it, It's called the Puppet Master where, you know, this is not David Hahn. This is, you know, somebody who took my image and made me into this, right? So you got to worry about that. And I think it's gone now beyond just media companies that were, you know, have to worry about this. It's now going into, you know, big fortune, you know, companies, the extortion capability that you could do with it, the faking of your, you know, senior leadership, just the things that you could do to manipulate and then kind of create the sense of disinformation, which which is a term, and we hear a lot of it during the elections, but it's not gonna go away just because the elections, the presidential elections are over. So we're gonna see, I think, that continue to go in, and it's going to be, again, augmented. Meaning if you're gonna be doing a ransomware and a phishing, all the things we just talked about, they may add that to it to kind of create the deception even further to make it tougher for the companies to respond to it. To cover their tracks much more easily, right? So think of it as like additional things that they can easily use. And it's, again, it's so widely available that we're literally enabling that to happen. And guess what? The bad guy's gonna pick up on that and say, "Hey, I'll use that. In fact, it'll take me 20 minutes. I can go ahead and pull my lines.

Boom, I'm already off and running." So it sounds like AI is in the category of a disruptive technology in your mind moving into 2025. Both for the attackers and the defenders. But I mean, when we look at the attacks, right, for them to be able to undermine voice authentication, right? And I think some banks still use that. And I know there were proof of concept attacks like this 3 or 4 years ago, but that's concerning. Now, you know, do you think those real-time puppet masters, right, which takes a lot of effort, a lot of energy, and it is complex to do well. You know, even the case that you were talking about where somebody joined a Zoom bridge and got to do basically a BEC attack, right? And got them to send money. The video was not very good. It was blurry, choppy. They were apologizing, "Sorry, my video was bad." You know, given that level of technology adoption complexity. Do you think the use of these deepfakes will be very common in 2025? Or is this still just a niche kind of attack? We'll see a few scattered, but it won't be widespread adoption in 2025. What do you think?

Yeah, so, you know, full disclosure, you know, Ballistic Ventures, you know, we're early-stage cybersecurity, you know, venture capital. And so we invest in companies, and so we invest in companies that actually in this space. And so, you know, We're following it very closely in terms of what they can actually see. So instead of just speculation, these are things that they're actually seeing and, you know, helping their customers in terms of defending. Certainly the capability is there. And then to your point, you know, it could get a little choppy. So, you know, they're going to get better and better and better. It's just a matter of time in terms of being able to do it. And then, you know, they're actually going to be able to train their models to make it you know, so much easier for them to manage and go through. Now, in terms of being widely, I think, like I said, it's going to be an attack that is going to be augmented versus just a deepfake attack by itself, right? So, you know, to be able to transfer, you know, get a wire transfer to this or to get into Bitcoin, you know, there's a series of things that the so-called bad guys have to have in place to do that. So it's not like somebody says, hey, I'm gonna be a bad guy today. So I'm gonna do a deepfake and I'm gonna fool Matthew and I'm I'm not going to do all that, but okay, that's cool, right? But if you're already able to have an organized crime capability to be able to do that, you're going to add this to it so that you can take each of those steps and do it better. I think it's going to be much more targeted. I think it's going to be much more of specific attack that they're doing, and now they're just going to make it better. All we can see is that Everybody who is using this technology, and again, so many new companies are coming out and coming up with new models of how you can fake this and fake that. And it's just like, oh wow, every time I see something like, oh wow, I just, you know, my other brain goes to like, holy, you know, Anthony Teng, like, oh my God, what are they going to be able to do with that? So yeah, I think that part is real. But to your point, I think it's going to be much more targeted, specific thing. And I think it's going to be, you know, to a point where they need to get something out of it, right? It's not just for kicks, right? It's not just a bunch of high schoolers having fun. They're going to steal lots of money or some kind of a major impact that they're trying to make.

So we already have ransomware as a service. Do you think we will see the evolution come to fruition in 2025? I mean, eventually it will, but in 2025, where these ransomware-as-a-services will also have deepfake-as-a-service as a component to that? Because the ransomware-as-a-service does a lot of those other things as well as you talked about. Do you think that will happen in 2025 or is that something moving beyond?

Yeah, as I said, if you think about how an attack is done, even with ransomware, there are many parts to it, right? In terms of, and there are different kind of backends. It's almost like a syndication, right? So, you know, there's someone to specialize in this, There's one specialized in that and each of the pieces there. And so they're all available going through it. So there's no reason why this can't be, is the way I would put it. And if they can make your ransomware attack so much more effective because they can fool somebody, again, if you look at the origins of how ransomware can get through, there was some kind of credential that was compromised. Somebody was missing, you know, so this is just another means of it. So you may not think of it as a deepfake attack, it may come off as a ransomware attack, but what aided it and what made it so much more effective is, again, the capability. So again, deepfakes is just another capability in and of itself. There's nothing wrong with it. But again, if they can fool you to, again, give up your credentials, to give something up, then, you know, the rest of the attack is going to occur, and then we're all in the same thing again.

Yeah, I mean, impersonation is an incredible tool when you're trying to commit a fraud, right? So yeah, I think it's going to be a scary moment in time. I think it's going to be a watershed moment where we start seeing that deepfake be integrated into those ransomware as a service where somebody that isn't even technical, right, can use that ransomware as a service to handle all the technology on all the backend transactions and business. You know, we see it now, but, you know, I haven't seen it include deepfakes yet. That's going to be a brave new world when we get to that point in trying to validate who you're really communicating with, right? Your eyes and your ears no longer work. But, okay, so other—

Matthew, it is just another form of authentication if you want to kind of get to the root of it, right? So deepfakes is the fancy part of, hey, that's all cool. But the fundamental piece of it, like, how do I know you are who you say you are and I am who I— how do you get to that? So I think it is still, again, the same blocking and tackling that needs to be. It's just that we're basically deceiving the kind of the human because like we see something, we just assume, oh yeah, that's Matthew. It looks just like him. I don't know, things like that. But so we need better obviously tools to be able to detect that. And so we follow again, what's your overall authentication identity strategy, right? So that's still, I think, the building blocks. And I think inside of an organization, inside of a security team, you know, they have to build that into it in terms of, okay, deepfakes is just another form of somebody's going to try to deceive us. How do we ensure that our authentication is in place. And yes, the medium that is going through, which is whether Zoom or Teams, things that we didn't have to really worry about, and we just like, okay, user ID, password, then you're in. Okay, there are people going to try to fake that all. Have we strengthened our authentication capability of people who can get into a Zoom, right? And then in terms of what you can respond to that. So I think those are ways to look at it so that it doesn't become just, oh my gosh, how do we like figure out how to deal with the defects, things like that. Fundamentals pieces from a security standpoint to build your way. And then yes, ultimately at some point you need something to figure out what is the synthetic thing that we're seeing out there and do we need some better tools to get to that? Yes. But it's within that wheelhouse of identity and authentication that we have to be managing.

And I see when we get to that point, it's going to also have to be included in the behavioral and cognitive training too, right? In combination with the technical tools. We're so used to just trusting our eyes and ears. We're going to have to relearn that. No, right? We learned about it in photographs back in the day when, you know, Photoshop came out. Okay, what you see isn't really what you see, but we haven't gotten there yet with video or with voice yet. So that'll be challenging. So you mentioned AI, right? And deepfakes. Are there other disruptive technologies that you think will really kind of land in 2025, whether they be quantum or next-generation cloud or distributed computing, cryptocurrency, whatever, you know, what's on your radar right now for 2025?

Well, all the quantum stocks are falling like crazy right now because James Wan basically said a few words. And so we can— I think there's a There's a little bit of a balance there in terms of is it ahead of its time and all that. You know, again, you know, there's a bunch of building blocks that would often have to be in place in order for quantum to be successful. And so, you know, whether we're really there or not, I'm going to leave that one alone for them. I think in terms of, you know, are there things that are out there? Well, whatever it may be is the way— again, my thinking is get back to the building blocks, is go through it. So as a security professional, I want to make sure no matter what those things may be, the new toys and new things that the bad guys may be using, I need to get through a kind of a validation. How do I know that my controls are working? So the way I like to turn things around is like, okay, I can't predict every single thing that's going to be out there, but I have built in whatever, 150 controls that protect my company, a lot of controls, right? With two-factor authentication, firewalls, all the different things that you have in place there. And I can tell you all the stories in my career of that I had all the proper controls, And then it's not working. Like, what the heck? Like, it goes through. Somebody turned off the firewall. Like, why would you do that? Oh, somebody changed the rules of the firewall. Like, why would you do that? So you see all these things. Oh, that's an exception or things like that. Oh, what ID? Oh, yeah, we have this thing called— well, we'll get to non-human identities. Like, okay, yeah, you can't ask a 90-day validation of a certification of an ID if it's not a human, right? So how do you get through that? So, you know, The fundamental pieces aren't getting covered there. So I think those are the parts that I look to, to get. So ask the question, how do I know my controls are working? Well, we have an audit once a year. Good luck for the rest of the year, right? Well, we have, you know, some kind of a 90-day thing. Okay. And back to, unless it's real time every single day that you have this notion that your controls are working, you don't have a fighting chance, right? So I like to look at it that way. So I think, you know, in terms of looking at ways that you can do that, well, obviously you can't, you know, ask an auditor, a human, even if you have an army of them. So it has to be in an automated way to be able to validate your controls are working. And so I think that's an important area to really push the kind of security organization from, again, chasing down so many different new things, focus on the fundamentals, And again, you have, you know, probably took 3, 4 years, right? Typical company for security program to build out all its capabilities. You know what? You make that investment. Now it's time to go ahead and again, ensure that your controls are working. And so it's so important to do that. And again, there are companies out there who provide tools and capabilities and, you know, set of ways that you can go through to really figure that out. And I think that's so much more important, again, than just kind of chasing the butterflies of the latest new things.

Well, we're coming full circle, right? We've talked about technology, we've talked about behaviors. That third piece is really the processes to say, how do I ensure this? How do I make sure changes aren't made? How do I ensure that consistency and comprehensiveness of the security controls that I have to meet some optimal level of risk over time? Which leads me into kind of the third area I wanted to talk about, What do you think are going to be the biggest business challenges? And when I say business, I mean the business of running cybersecurity programs in 2025. Will it be getting those policies right? Will it be, you know, picking the right technology winner and integrating it? Will it be training the users? Will it be somehow adapting to the crazy expectations? I mean, What is it that's just going to throw cybersecurity leaders for a curveball here when it comes to running the business?

So I think it is, again, I go back to the same thing that security doesn't want to be the one that gets in the way of the business moving forward. Okay. Again, back to remember when mobile came out and we're all like, oh, be careful. Okay. It's very scary. Cloud. Oh, it's very, very scary. Things like that. Guess what? The business went anyway. Like, okay, now we're catching up, right? Always to get through that. And so with AI and the usage of AI that's now, I mean, you know, remember a year ago, maybe half the, you know, percentage of companies are kind of taking a look at it. I mean, I, I don't know anybody who's not looking at it, right? Either from a ChatGPT or, you know, various other ways that it's already kind of come in. In fact, it's already in, you know, obviously, you know, search engines, right? To go through. So it, it, generative AI is inside your company. Now, okay, you don't want to be the one, hey, we're going to block all that. We're going to—

we put in a rule in our firewall that's going to—

good luck, okay? You know, how well does that strategy work? Not very well. So, and then worst of all, you are basically, you know, pulling back your business from being able to advance forward. So that's another area where, okay, how can security be an enabler? And you have to be. Otherwise, you will be extinct because they're going to go around you anyway. That's how we get shadow IT, and that's how we get— But really, the thing is you want to be the one that's going to say, you know what, we're going to use AI in a safe and effective way versus we're not going to use this, we're not going to— No, no, you want to be able to say. Security as an enabler is absolutely important. How do you do that while you still allow, again, employees and your company to be able to use it? Without putting a risk. Do they realize all the risk? No. I'm sure most people in the company don't realize how risky using ChatGPT may be. Well, it's your job, again, not to just inform them and like, hey, hey, cry wolf all the time. You're there to put something in place to protect that. How can that be? And then again, it's the 80/20 rule. 80% of all the stuff that people are doing on ChatGPT is probably going to be safe. Again, it's the few things that they're going to do that catch those things, focus in on that. So I think the CISO has to get in front with the CEO and with the chief product officers and the chief technology officers who are building AI or who are utilizing it just in terms of incorporating them into their day-to-day usage. Okay, maybe it's a bad idea to put every single one of our documents, our legal documents into ChatGPT. That's probably not a good— but here is a safe way to do it, right? Okay. So I think you got to get into that conversation and you got to be able to enable that. So I think adoption because it's so easy. I mean, I remember, you know, took cloud, whatever, 10 years, right, for a company to start adopting that, to go through ChatGPT. I've never seen anything so like lightning fast because it is so easy on that. So really, there's not even an adoption ramp. It's just plug it in, use it. Okay. You just go through and people are just coming up with all kinds of neat ways. And the more they start hearing, oh, you know, I tried this. Did you try? Oh my gosh. Like, how do you do that? Well, just put it in and ChatGPT will tell you. And that kind of, you know, wildfire, you know, kind of an approach is just something that you don't want to be the one that stops it or tries to because first of all, you can't. So you know what? Get in front of it and help your company use it in a safe way. So again, back to, you know, we invest in companies who are focusing on that area because we are wanting to make sure that security is an enabler and not, you know, holding something back.

So I hear for 2025, security teams need to transition from being a technology cop, right? And limiter to a proactive enabler. And specifically with AI, it's not— the enemy is not the organization that's using it responsibly. It's the shadow AI that's going around your policies if you're trying to police it. That aren't using it in a secure way, that's the real enemy is what I'm hearing.

Yeah. So, but the thing is, you know, it's there. It's not like, oh, we're blocking it so it won't happen. Okay. Again, we've learned that many, many times over that it doesn't work. Right. So get in front of it is my point. Right. Get in front of it and help your business able to utilize the technologies that's there, but do it in a safe way. Okay. Don't just, you know, cry wolf and say, hey, that's bad, that's bad, that's bad. Don't do that. Don't do that. No. How can we do it in a safe way?

So be that proactive enabler, right? I'm going to work with IT and the business groups proactively. You either are using AI now or you're going to. Let's just assume that. Let's figure out how we do it in a secure and safe and private manner versus being responsive. That doesn't work real well for us. Okay. So last question, I think it kind of lends itself to what we've been talking about. So, you know, the audience, many of them are cybersecurity leaders. Many of them are CISOs that watch the podcast. What is your advice if you had to tell them one thing to do to get in front of these challenges that we've talked about in 2025, whether it be AI, whether it be attackers, whether it be, you know, business conditions and whatnot, what is the one thing you would say for them that they need to act now? Where should they lean into?

Well, you know, there's the old saying, right? You say, don't wait to be invited to the party. Okay. Because you'll be sitting there by yourself for a long time. And, you know, many of us security folks are like, how come they're not inviting us to all the cool parties? And, you know, how come we're not there? Like, you know what, you're not a cool kid, okay? So you're not going to get all the invites, but doesn't mean you, you know, you can't crash the party and just kind of come in and, okay, get in front, you know, go seek out your technology partners, go seek your product people, you know, even the CFO and, you know, head of HR. I've had more conversations with all these, you know, kind of different areas and they'll first be like, oh, you know, do we have a security problem? Like, no, no, it's okay. I want to know more about where's the business going? What are we doing? You know, what are the issues that are facing? You know, so if you start thinking about, you know, cyber, we touch every part of the organization. There's nothing that we don't, you know, have something that we go through. And so part of that is making sure that you know what's going on. So you have to make the effort. So don't sit back again, wait for an invite that's not going to come. You know, get yourself invited. Go to and talk to all the different leaders, all the different groups there, and then find out what they're doing. And so instead of saying, oh, well, we put a policy in there so that we don't have ChatGPT, I know we're good. No, go talk to people, ask them, hey, how are you guys doing with ChatGPT? Are you using it? And just let me know what— don't make it into a bad thing. Learn to see how people are doing it, and then they'll show you like, oh yeah, here, I take all our documents, I tell it to go scan everything. Hmm, you know what? There could be another way that we could do that to get the same, you know, result. But again, and I think that's the part that we have to kind of get away from this notion of having to be invited to be more of kind of, you know what, make your presence known. And, but again, back to the previous point, you got to be proactive. You got to be able to figure out how to enable that. So, you know, I think it is so true that security people have to lean in, you know, using the old Cheryl Sambro, you know, we got to get in there and we got to be begin to have these conversations instead of being like, well, the security guys here, let's shh, don't say anything. Right? Right. Okay. Well, no, let's talk about it. Okay. Well, what are you guys trying to do? Yeah. I'm not going to stop everybody. What I'm going to do is help you make it. So I think with, again, so many different technologies and tools these days, get to it. The other one, a little bit of a slant is vulnerabilities, right? So security guys have been talking about vulnerabilities, please. How many vulnerabilities do we have? I don't know, about a million something.

Okay. Yeah.

We're going to go fix those. Like, I guess, oh, how long has it been a million? Oh, for like the past 3 years. Well, you know, we fix some and then there's new ones, fix something. Okay. But so that's not a good batting average, right? Okay. We have that. So how about we can help them by coming up with ways that vulnerabilities can be remediated, right? Again, using AI, start using it. So there are a lot of these tools that are now going to be more effective in in terms of our ability to say, you know what, we're going to help the IT team. We're going to help the engineers. We're going to help the developers. We're not going to just tell them everything that's wrong and we got a million vulnerabilities. We're going to say, hey, let's figure out how to use some of this automation, how to use AI that's coming through there. And so again, there are companies that are focusing in that area to help to reduce the number of vulnerabilities by in terms of providing an AI-enabled method of trying to remediate. And you know what, we have to start to put those things in place to help them. Because yeah, if you've got a million vulnerabilities, you know what, it ain't going to go away tomorrow. Okay. By itself. Okay. And so there's a bigger problem there. And so you got to get back to enabling that, focusing on how to help the business.

All right. Cybersecurity leaders, you heard it from David Hahn. Crash the party. Learn the business, right? Communicate with those business partners and then help them. Them, right? Instead of being just somebody that's hitting them over the head with a nightstick and telling them the bad things, be that partner to work with them to get them to where they want to go. I think it's great, great advice. David Hahn, Chief Information Security Officer, Operating Partner at Ballistic Ventures, thank you, sir, for sharing your cybersecurity insights today.

Great. Thanks a lot, Matthew.

And thank you all for watching. Be sure to subscribe and catch all the Cybersecurity Vault episodes where we chat with industry leaders to dive into the most relevant and interesting cybersecurity challenges, perspectives, and best practices. We'll see you next time.