HMG Global Viewpoint - 2025 Cybersecurity Challenges with Matthew Rosenquist

Welcome to Global Viewpoint, an innovation accelerator brought to you by Hunter Muller, founder and CEO of HMG Strategy.

Hello and welcome to Global Viewpoint. I'm Hunter Muller, founder and CEO of HMG Strategy. I'm here with my good friend Matthew Rosenquist, who's the CISO at Mercury Risk. What's new in your role and how you're influencing our industry? Because you're Without a doubt, one of the brightest, I feel, independent thought leaders in our industry. Great to be with you today.

Well, you know, me, just like everybody else in the industry, you know, is challenged with some of the new threats and some economics and everything else going on within cybersecurity. So it's always a challenge. It's always fun, never boring. And I get the pleasure of, you know, I do advising work and consulting, so I get to hear and feel the pain of my peers as well. So it's just, it's an interesting time to be in cybersecurity.

So Cyber Insights, give us an angle on your latest thoughts of the geopolitical landscape and nation-state threats and really how bad is it out there?

I don't want to scare anybody, but so, you know, I have outlined some interesting thoughts in my 2025 predictions. And one of them, in fact, the first one, was the fact that we're going to see more nation-state attacks, aggressive nations. And we got 4 big ones out there: Russia, China, North Korea, and Iran. And we've seen that. We've seen them go after our critical infrastructures, particularly our finance infrastructure, cryptocurrency, things of that sort. And we expect that it's— we're also going to see healthcare get hurt even more than it did last year. And we've got a lot of turmoil going on right now in the world. If, you know, if we look at it, we've got cyber being used essentially as a tool for foreign policy by many different countries out there. We've got hot wars going on. We've got cold wars going on, right? Look at Ukraine, Israel. Look at what's going on with Russia and the West in Europe. Europe, right? We've got all these things happening. And because of that, nation states are using cyber as a tool to push that foreign policy, to influence or to inhibit certain things and put pressure on countries and people and things of that sort. And it all trickles down. And so even if you're not a government or you're not part of critical infrastructure, The simple fact that these nation states with all their power and technology being able to influence cyber, it trickles down to everybody, right? Everybody needs electrical power and telecommunications and have to travel and they need healthcare and have to go to the ATM to get money. And so, it does impact businesses, small, medium, large, and consumers as well. And, you know, today I'm looking at the markets. It's, it's It's red out there, right? Markets are down another 4% today. And so we've got economic pressure as well. We've got trade tariffs, embargoes. We've got challenges to freedom of navigation principles, right? Look at South China Sea, Red Sea, Persian Gulf, the Black and Baltic Seas. So again, with all this international turmoil, cyber is one of those capabilities that these nation states can employ that's easy, cheap, effective, can impact adversaries or allies of adversaries, and you don't even have to share a border. So we're seeing lots of activity.

It's almost unbelievable. I don't know exactly how to kind of dial it in, right? But it's, I guess it's very predictable, this behavior.

Well, you know, the attackers, whether they're nation states or whether they're a simple cybercriminal, they like the path of least resistance. And cyber is one of those easy paths. It doesn't take much to get in. We're seeing cybercriminals invest more and more because it's so effective. It's so easy to cause disruption, to steal money. You know, we had even this year, we had a recent attack against a cryptocurrency exchange $1.5 billion. This isn't somebody going in and stealing $20,000 from a, from a bank. I mean, this is $1.5 billion in a single attack, right? So the scale is astronomical when you start getting and using and leveraging cybersecurity against critical infrastructure and big companies. Anything of value.

We had Richard Clarke, the first Cyber Czar for the United States government, on Global Viewpoint a couple of weeks ago. And, you know, again, this isn't going away. It's going to continue to accelerate. It's going to continue to expand. I kind of want to talk a little bit about the hyperscalers and the cloud companies because they made a lot of money, a lot of money going to market and growing their businesses and locking you into their world. And I was out at RSA just years ago, over 10 years ago. And, you know, the big talk then was the open API layer, Matthew, and that it was truly, truly a huge risk. And by the way, if Microsoft executives can get breached, anyone can get breached. Matthew?

Yeah, so true. Right. And all this technology that continues to bubble up, right, especially the disruptive technology. Allows us to communicate and collaborate better, right? It enables us to do things that we couldn't do before. So when we moved to the cloud, we were— we expanded what only big companies in their data centers could do. We expanded it to everybody. Everybody could have a presence and be out on that edge. You know, with the use of APIs, we now can share and collaborate data even faster. And, you know, most recently, right, it's the term of the last couple of years, AI. We're moving from generative AI to agentic AI. And if you think generative AI was big, stand by. Agentic AI is like its bigger brother. And we're just seeing this first sliver of what that's going to be able to do. And that's going to require more complexity, more access, more automation, and therefore more risk. But it's going to provide 100x more value and tangible benefits to people that are using it. I mean, it's what Jarvis is in Iron Man, right? It's an autonomous kind of agent and you say, hey, go accomplish X and it goes off and determines what it needs to do, what other tools it needs to employ, and then iterates on that and comes back and go, here you go, Hunter, this is what you asked for. Okay, great. But it's going to control our email and calendar. It's going to be able to manage our scheduling and machine learning and all of this, that's the next disruption that we're going to see. And as amazing as it is, I can't wait. I want Jarvis, right? It will also bring an equitable amount of cyber risk. The more we rely on it, the more it connects us, the more it can reach into our data and represent us, buy things for us, the more inherent cyber risk it is. And the cyber criminals and nation states, oh, they're drooling. They're like, oh yeah, bring it on. I want this. Embrace this. Rush as fast as you can to implement this because I know there's going to be weaknesses. I know there's going to be holes and I'll exploit it.

Fascinating stuff.

Matt, that's a very interesting topic, but I think there are compounding factors or something that influence that. On one scale, we have some very emerging and high-tech technologies, agentic AI and whatever it is that passed already Turing test, that's scary and adding risk. On another side of the spectrum, we have low-tech in, in a form of legacy devices and legacy debt. And that's what really, at least from my perspective, which will make it complicated and affect healthcare a lot. Just those factors. Do you see Other factors that you specifically pointed out, healthcare, any specifics related to that that you think is relevant?

Several, right? And let me amplify what you're saying. There is a lot of legacy equipment. And one of the kind of hidden areas that we don't talk too much about is the OT worlds, right? It's those manufacturing worlds. It's those medical devices. It's things that when you buy them, you don't replace them like your laptop or your phone every few years. They may be in place for 20, 30, 40 years. And so you're stuck with the vulnerabilities and the challenges of that. And so when we look at healthcare, we look at manufacturing that are highly dependent on these OT environments, right? We have to start to understand, hey, we're connecting these to our IT environments, which, you know, live and breathe communication and access. These OT environments were really designed to be isolated, and that was the major level of protection for them. So when we look at industries and sectors that rely so much on OT-type systems, we know they come with a massive burden the moment you start connecting them. And there's tremendous benefits to connect them to the IT networks. But again, we have to overcome some of this legacy burden that may or may not be able to acclimate to our IT type of worlds where we can do patches, we can do inventory, we can set ACLs and firewalls and do all these great things. The OT world is a different kind of world. So that is definitely one of the factors that's going to hurt and challenge. The healthcare industry as well as regulations, right? Healthcare industry, even if you could patch something, right? Let's say a medical device, you have to go through FDA approval that could take another 2 years. Can you imagine an IT department telling them, hey, we know there's patches to your operating system, but we're not gonna let you do it for 2 years. So start reviewing the patch now. That would be insane. And yet when you look at medical devices, and it's very important to be able to test them, but there, it's a conflict in keeping them up to date against the intelligent attackers. So again, we need to figure all those kinds of things out and we're not there yet.

Excellent.

Thanks, Matthew, for that. Uh, over to Todd. Todd, you wanna jump in?

Yeah. Two things. One, I, I'm a little surprised you didn't talk about telecom being a big target, especially given the, the big set of attacks in December that were, or that were revealed in December. And then the other thing, I think you almost jumped over what I think is an important point. Cyberattacks are less of an existential threat and more of a material threat. You and I were talking about this a couple of weeks ago. It's not so much that cyber is going to put us out of business, but that it's going to have material impacts in revenue, business opportunity, other, other aspects that it's important, but it's important to recognize that it's really not as much of an existential threat as some people talk about.

Yeah, let me hit those one at a time. First off, telecom part, definitely part of the critical infrastructure. Yes, they're being targeted. Yes, they're being attacked. The difference with the telecom for this year is they've made lots of investments. They've all— they've always been under attack, just like the big finance houses, right? The big banks have always been under attack. And so they tend to spend the most. Are they under pressure? Absolutely. They're also in a better position to shield themselves and recover from that. They've learned their lessons and we tend to go in cycles. I think coming into 2025, they're a little bit better positioned than they have been in the past. So, but yes, they will still be attacked. Every sector in critical infrastructure is going to be attacked in 2025. So, and the second thing that you talked about, I do think it is a material impact, right? It's moving towards that. But we've got boards that are starting to feel the pressure from the FTC and the SEC and are being held accountable. Right, for oversight of cyber now. And so we've got a shift. Yes, there's material impact and that material impact is getting so big that it's now become a board issue as well. And they're not exactly prepared for understanding yet, understanding and getting their arms around that and bringing it into the other business risks that they manage. So there are challenges there. Now, I don't think there are any attackers out there that want to completely destroy our digital ecosystem. This is how they're winning, right? You don't want to kill your golden goose. You want to keep taking its golden eggs, right? And that's really what we're seeing with this global digital ecosystem that we live in. The attackers don't want to bring it down and burn it to the ground. Instead, they want to leverage it for their purpose, for their objectives.

Yeah, it's parasites. You can't kill the host.

Yeah, you kill the host, you got to, you know, so. Exactly.

Okay.

Over to Michael.

Michael, I had a quick question and I think he's just touched on it.

What are the changes that you're seeing on board reporting? Are you reporting to a committee on the board now?

Are you reporting to the open board? Do you still kind of give your message to the CIO to carry to the board?

Across the industry, we're seeing the voice of the CISO go up. Throughout my career, you know, from the first day that I was a CISO, I did report into the board, as in gave them a quarterly report or as needed. I still reported physically or, you know, from an org chart somewhere, you know, down the line, either to the executive, you know, chief executive officer, president, things of that sort. And that's what we're seeing in the industry. There's some great reports out that are showing You know, Hutch or Hitch, Hitch Report just came out a couple of months ago, but it shows kind of where the CISO is reporting within the organization structure and that's starting to move up.

Right.

And it's also showing how often the CISO has face time with the board itself and whether it's directly with the board of directors or whether it's with the audit team or whatnot. The voice of the CISO is being heard. There are challenges with that, right? A lot of the CISOs came up from a technical background, and so they're going in with 50 slides of technical charts, and this is not what a board lives or breathes or communicates. So there's, there's a disconnection right now. And so our industry has to learn how to close that chasm. CISOs need to learn how to frame cyber as a business risk versus a technical risk. And the boards need to edge over a little bit as well to understand that cyber risk is a little bit different than the other business risks that they typically deal with, whether it's competitive or financial or regulatory risks that they do have a good grasp on. So we got to close that chasm. Matthew, that's fantastic.

Thank you.

Thanks, Michael.

Over to Doug.

Doug, you're up.

Thanks so much.

With the reliance on encryption today, What should we be doing with the introduction of the commercial availability of quantum computing in the next couple of years? Are there certain processes, certain tools, certain products we should be looking at since we've been reading that quantum is going to yield encryption not effective? Yes and no. So quantum will undermine certain types of encryption, right, where you've got key pairings. So think RSA. The bulk of a lot of the transactions we use actually on the internet, on the World Wide Web, is using that type of encryption, right? Asymmetric kind of encryption. So yes, we do need to move those. And we do have new algorithms that are approved through NIST. A series of them that can replace it. My big piece of advice is don't be surprised. Anytime that we're going to transition to new technology and our old algorithms that are susceptible, right, need to be replaced with quantum-resistant ones, that means there's an infrastructure change, a change to applications, a change to infrastructure, a change to security and oversight, all sorts of different things that need to happen in order to transition well. It takes time. It takes time. And we're going to see more and more service providers automatically switch over. So, expect your cloud provider to already do it for their communications. But if you have internal communications within the apps that you're using or whatnot, you may have to have your own program. But get a team together, figure out what your exposure is, what you want to move to, and then start choosing some vendors to work with to develop that. Because again, doing encryption is easy, except when it's easy, typically it's not done well. Doing encryption well is extraordinarily difficult, even just the implementation of it. So most organizations are going to need to work with experts, trusted vendors to make sure that they move that transition and they manage that in an appropriate way, not leaving more exposure than what they started with. So start early, have a plan.

Hey, Matthew, when you think of the enterprise, what are the top 1, 2, 3, or 4 areas you think the enterprise is most vulnerable? Data, identity access management. What else?

Yes and yes, absolutely. Data access management. What I would say right now, and I'm sure many people are going to challenge me, the rapid rush to AI, right? Whether using a third-party service, whether you're developing it yourself, whether you're creating your own apps and exposing it either to your employees, your business partners, or your customers, right? That rapid adoption of technology, which its value is predicated on how much access it has to your data, that rapid rush creates windows of opportunity because it introduces vulnerabilities at a rate that cybersecurity, one, we tend not to be involved early on, right? You get individual departments, not even the IT department. This is individual business groups going, hey, we developed this cool thing and they call up the CISO. Hey, CISO, we're deploying this new cool AI tool. We're releasing it on Monday. Can you make sure it's secure? No, I can't, right? I need to be part of the architecture discussion, the engineering and the development, the Q&A, the, the, And so we're rushing to fantastic technology, but we're not applying the necessary due diligence when it comes to security, privacy, and ethics for these. And I think especially as we go to agentic AI and embrace that, that will create windows of opportunities for attackers and vulnerabilities that we just have no concept of now until we will feel the pain.

Thanks, Matthew, for that. Over to Andrew.

Andy. Hi, Matt. So I own and run a small cybersecurity company that primarily services very, very small companies.

Thank you, by the way. Yes, thank you.

Well, but I'd love your thoughts on this because, you know, my target clients are usually those who are You have to comply with one or more government regulations. So the IRS, you know, has just released a whole bunch of new regulations for CPAs. HIPAA has released some new regulations, uh, you know, etc. They don't want to do it. And the, uh, and so I just, just, you're curious, I mean, you know, we talk about the big guys and, and the threats that they have. What's it going to take to get the small business like, hey, no, this is really something you need to take seriously?

It goes back to the first axiom of cybersecurity, right? Cybersecurity is not relevant until it fails. And unfortunately, as an industry, we have kind of forgotten the small and medium business companies out there. And we are doing a disservice because we're focusing on those big, big corporations and the big expensive cybersecurity tools are just too much of a financial burden. And getting people to run those and install those and configure those is just too expensive for the small, small businesses. So they need a path. They need a path where they can still manage the risk and do so in an intelligent manner and choose what's important to them. It's the same process as the big companies.

Yeah, I know.

But they need to have that process going, okay, yeah, regulatory compliance is important. What is the minimum I can do right now? And as I expand, I should also be expanding my cybersecurity range and my acceptable exposure to cyber risk. But making intelligent risk decisions doesn't matter if you're small, medium, large, or, or a country, right? It should be done in a methodical and trusted manner so that you're confident in making the right business decisions and accepting the right residual risk. Small companies are willing to accept more risk than in many cases large companies.

And so informed decisions, you know, that's what I provide them. And you're actually right. They just, they're, you know, they're just willing to accept the risk.

Yeah, a lot of small business, a lot of small businesses are signing up to contracts that say they're following this 171 and 172 and they're not doing it.

Paper dragons, right?

Yeah, they think they can get away with that. We don't have to follow everything we signed up to contract for, but they're at big risk. Of false claims, triple damages. And so that you really have to ask the question, should small businesses be in doing cyber if they don't have the financial resources to invest in what is needed to meet the requirements? Uh, so, you know, we're going to have to make a choice. Is it okay because we want small businesses to have second-rate cyber? Can they get away with not all the requirements? And if not, then we need to say you need to have the financial resources or you will not be allowed and we will prosecute.

It's a tough decision. It really is. You know, and unfortunately, cyber is expensive, right? Having people like any of us be able to go in and advise them and give them good advice is also expensive. So, you know, I'm hoping to see more consortiums of small businesses get together, pool resources to be able to bring in the right expertise, give, you know, better playbooks And it isn't all or nothing. It isn't you completely commit and you're going to do everything or you have zero and you're just going to be the next victim. It's really about finding that optimal space. And every company, every industry is a little bit different and there's different drivers. Same thing for the small businesses regardless of what industry they're in. We just need to be able to communicate out and teach the world there are good practices. You don't have to just go, "Ah, I can't do it. I'm going to do nothing." Start small, even if that's what it takes, but realize that this can put your business in jeopardy, just like the other risks you have to worry about, right? You have to worry about fire and theft and shrinkage and all those other things. Cyber is one of those more ethereal concepts until it hits.

Hey, Matthew, real quick, there's thousands of cyber companies out there and many of them are legacy. They're fixing old problems with old technology and they have a they have a whole moat and a trench that they want to protect and are doing the best to innovate. Netskope being one of the best forward-leaning mega companies that's probably going to go public this year. I had the opportunity to interview Sanjay Berry and I asked him, Sanjay, out of the thousands of people in your organization, how many people are innovating and helping engineer the next wave of innovation and solutions to protect your clients in the enterprise? He said about 50% of everyone in the whole company. Pretty amazing fact. At HMG Strategy, we often find leading-edge cyber companies from all over the world, from Silicon Valley to Tel Aviv, Israel, that want to meet you all as design partners. So just kind of throwing it out there, if you want to learn about some really cool innovative companies at the application level, at the data level, at the identity access management level, that are looking for design partners, reach out to me at Hunter M at HMG Strategy, or better yet, come to an upcoming summit. Next week, we're in New York, April 9th and 10th with the 18th Annual New York Summit of America. And then later in the month, we'll be in DC with a lot of amazing cyber executives, including Israel Martinez. Matthew, final question. How best to continue to innovate and keep that, the enterprise architecture, that enterprise threat landscape safe?

Well, you know, as you mentioned, Hunter, a ton of innovation in cybersecurity always comes from these small startups. And we see a trend in our industry where the big companies will actually go out and just start acquiring a whole bunch of these small startups because these startups are nimble enough and have incredibly bright people that come up with amazing ideas. And so these big companies start sucking them up like a Hoover vacuum and integrating them in. And we go into these cycles, right? But we see a tremendous amount of innovation, again, from those small companies. So I would say if you're a CISO or a CIO, don't just look towards the big companies. If you've got a specific problem and you need cutting-edge ideas, also open, be very open to looking at some of those small innovative companies that are pushing the boundaries, that are coming at it with fresh ideas and new capabilities. Right, especially when you're dealing with disruptive technology. If you're worried about your AI, right, and you're just running into that, you're probably going to need new tools and new capabilities, new ideas. That's where you're going to find them, is in those small, innovative companies with brilliant people coming at it in new directions.

And thank you for that, Matthew. And by the way, we do have a global CISO summit in June, June 12th in New York City. Have a lot of cyber innovative, cyber new innovative cyber companies there as well. Every 2 weeks we have Melissa, let's include it in the link in the notes. We have a global CISO call where we often look at early stage companies that want to meet you. So great viewpoint. Final comments, Matthew, in terms of where we are today and where we're going.

We just have to remain vigilant, right? We have to apply those best practices. And we can't give up, right? The only easy day was yesterday. So, embrace the suck, enjoy the chaos, right? And get the right people with that right positive mindset. Yes, we're always going to be climbing a hill, but that's how we get stronger. So, keep at it.

Hey, Matthew, great stuff. I'm a great fan of yours. We've been partnering now probably over 15 years in Silicon Valley. Thank you very, very much for your friendship, partnership. But remember, HMG Strategy is the place to go for innovation, leadership, invention, and disruption, keeping your enterprise safe and secure. Friends, family, and colleagues for life. Thanks, Matthew.

Cheers, all.