Strategic Insights of Cybersecurity – Career, Threats, AI, and Advice

Welcome everyone to the AI Risk Reward Podcast. This is your host, Alec Crawford, and our very special guest today is Matthew Rosenquist, who's the CISO and cybersecurity strategist at Mercury Risk and Compliance and iconic cybersecurity professional. So welcome, Matthew.

My pleasure to be here.

So I hate to say it, but, but at least ChatGPT said that, that you worked at Intel for 23 years and 5 months, which is Pretty amazing. And one of my favorite quotes from you was to actively pursue roles that had to solve impossible problems. So, that's pretty impressive.

And back in the day, Intel was a perfect landscape to find all of those impossible problems.

Pretty amazing. And so, tell us a little bit more about that time. Look, you know, obviously, there's some iconic figures there. I love Andy Grove's book, Only the Paranoid Survive, that's on my— top 10 business book list, for those that don't know. So, give us some stories.

Well, Andy was incredible. He was also maniacal. He was very ruthless from a business perspective. And if you've read his book, you kind of understand why. He had that mindset, that A-type personality, that top-tier A-type personality. And he brought and cultured in an organization that were full of A-type personality, go-getters, let's go make it happen. And he was very, very clear on expectations and in a way, very ruthless in that manner. But he was also very creative and understanding when you're trying to achieve something so difficult or what people say is impossible. You have to leverage all the resources. You have to bring in the best minds. You have to motivate them. And in some cases, you kind of got to kick them in the backside a little bit, right? And I can remember him coming into a meeting and there were some new executives and whatnot in there. And, you know, everybody wanted to give their title and he stopped them after the first couple of people and said, "Listen, when we come into a conference room to solve a real problem, I don't care what your title is. That does not matter. The only thing that matters is the people with the best ideas that are going to get us from where we are now to what we need to accomplish." And if that's the lowest grade person in the room, that's who we're going to listen to. So, don't worry about giving your titles. It's a waste of everyone's time. Let's dive in and fix this problem. And I thought it was just, it was awesome. And that set a lot of the culture back in the day.

Wow. That is amazing. I mean, it sounds a little bit like Steve Jobs, a little, like, you know, pretty harsh boss, but, you know, get things done, right? He definitely got stuff done. Obviously a visionary, and we all miss him. It kind of reminds me, you mentioned Sun Tzu, The Art of War, which I think is also a really cool book. So, pitch our listeners on that book and how it applies to their job and their role and why you like it so much.

Well, this particular tome is infamous within the industry and even throughout history, right? Written by a famous Chinese general, Sun Tzu. And really one of the first kind of writings that articulated strategy when it came to dealing with intelligent adversaries. In his case, it had to deal with, you know, other feudal lords and whatnot in warfare, physical warfare, trying to harm somebody. And so he painted the picture that you needed to understand several different elements. You needed to understand yourself, right? What are your capabilities? What are your limitations? What are you good at? Things of that sort. He said, the other thing you need to understand is who is your adversary? What are their strengths, weaknesses? What are their go-to plans? Right? What are their capabilities? How are they going to maneuver? And then the third thing he said is you have to understand the battleground, right? Where are you going to have this conflict? Because that makes a big difference. And he covered a few other things, but those three principles, when dealing with intelligent adversaries, and cybersecurity is, and so is business, right? If you're gonna compete in a highly competitive field, you have to worry about those smart competitors out there who may be bigger and stronger than you, who may have more resources than you. The same kind of tactics and understanding definitely apply. And even more so in cybersecurity where we are dealing with intelligent adversaries who may be smarter than us, who may have more resources than us, right? Who may even know our environment better than we do. And yet we have to continually adapt and find ways to win. So, you know, the book, which the writings itself is actually really small. Most of the books you'll find is interpretations of those of people throughout history to say, okay, here's a little stanza of what he said. Now let me interpret that based on this setting or this environment. This is really the deeper meaning of it. So I've always loved it.

Super cool. Well, pivoting to cybersecurity, so thank you for the segue. Let's start with ways that threat actors are using AI and GenAI to increase the frequency and severity of cyberattacks.

Got it. Now, there's a sexy way to talk about this, which isn't all that relevant, but it's really sexy headlines, eye-catching, people are interested. And then there's the kind of reality of it. Where the risks are. And I'll briefly touch on the sexy, right? When we talk about deepfakes, we talk about, "Oh, we're going to impersonate the CEO's image and get on a video bridge and do some kind of fraud." Is it possible? Absolutely. Is it happening? Rarely. Is it the primary threat that we have to worry about? Absolutely not. Nope. Nope. Not even in the top 10, top 50, right? But is it sexy to see on the headlines and worry about and vendors jumping pop up and go, "Oh, I can protect you against those deepfake, you know, business, you know, meeting impersonations," and okay, not relevant. The real area where we see AI is attackers realize it's a tool. It's a really good tool at many different areas, and they're leveraging it to do what they currently do. So for example, social engineering, phishing is one piece of that. Social engineering is a powerhouse for the attackers. In fact, depending on the metrics you want to look at, between 60 and 90-plus percent of all attacks involve some kind of wetware—humans, us big bags of water being manipulated, typically through social engineering. Phishing and those types of attacks happen all the time, and they have been happening. But now the attackers realize, "Hey, I can use GenAI and LLM to write better and more compelling phishing messages." No spelling errors, no grammar errors. It's in that same kind of tone that someone would expect. My click rate is going to be higher on that. Okay, that makes sense. We can do that now. We do that with ChatGPT or other AIs. The other thing it can do is I can translate it to local language, right? So I'm not just limited to, you know, I only predominantly speak English, barely. I'm not stuck in just targeting English-speaking potential victims. I can now translate this to 20, 30, 40 different languages. So that now broadens my total available target market, if you will. And we're seeing them do that. The automation behind it, right, around these continually learning LLMs, and we haven't seen it quite yet. We know it's coming. We know it's being tested. We know some of the attackers are working on this. But if I send you a phishing email and you don't click it, right, I may be able to track if you opened it or if you didn't open it. If you opened it, how long you looked at it before you decided not to click it, right? I can gather all this telemetry and feed that back in and say, "Hey, AI system, the phishing email that you wrote wasn't successful. I want you to learn from that." Right? So go send out a million or a couple of million of them. Take a look at which ones failed and which ones succeeded and iterate. Create a new version of that phishing to make it more effective, right? And now continually do it. I just set the automatic to let it go off and do this, and it will get progressively better very, very quickly. And we know the step after that. The step after that is to do exactly that, but to customize it for each individual target to where it would look up your LinkedIn, your Facebook, your MySpace, whatever you have. We're old. You may have a MySpace account. Who knows? You know, your AOL account. But, you know, pull data using open-source information and customize that, send you those phishing attacks, And when you ignore it or don't click it or look at it for a few seconds and delete it or mark it as spam, it learns and then recreates it specifically for you. And maybe next time it sends it from your kid's email, a spoofed your kid's email account, right? Or realizes who your boss is and what projects everyone's working on and changes the headline to be relevant to that. But it's targeting specifically Alec, right? Wow. That's coming. So yes, that sounds pretty scary.

And, and, you know, we were talking about cybersecurity insurance earlier, and it's just how they're kind of missing the risk. They're just like, yeah, they do a survey, whatever. They're not doing a lot of investigation, and they charge you some money, and they don't really understand what the risk profile is of a company. You know, like, how, how can that get improved?

Yeah, and this has been a longstanding problem. And I've worked with the insurance industry and been trying to help them for the better part of 2 decades. Most of the insurance that we deal with looks at actuaries. So, your home insurance, your car insurance, things like that. They're looking at a history of automobile wrecks, earthquakes, forest fires, all these kinds of things. And they've got these massive tables of this actuary data, things that actually happened. And when you pull back and you look at the macro level, you can see very clear trends. That's why you hear things like, oh, it's a 30-year flood zone, right? Or something like that, because they've got actuary tables and they can predict that. Now, they know that they're not really good for high chaotic environments. And the most chaotic environment you can have or factor you can have is actually the human. That's why in most insurance policies, if you read down, you'll find a little section, an exclusion that says act of war, right? And, you know, hey, if this is part of an act of war or, you know, act of deity or whatever, yeah, this is completely null and void and this contract does not count, right? We're not going to insure that. And when they decided to get into cybersecurity, They thought, "Well, hey, we've got tons of attacks. We'll use the same methodology of just actuary data. Let's see how many attacks. We'll scale things out." What they didn't account for is the vast amount of ambiguity and sheer chaos. Those numbers over any length of time, decent length of time, simply don't hold true. It becomes a parabolic curve, and they use actuaries in a linear fashion, so the math simply it simply wasn't going to work out. And, you know, keep in mind, these are some of the best minds when it comes to doing these kinds of calculations. So, in the beginning, they said, "Oh, no, no, no, no, we know what we're doing. We do insurance, right? We can calculate for that." And they turned to their actuaries and said, "You can account for that, right?" "Oh, absolutely, absolutely." And then they failed and failed and failed and failed. Now, what we're seeing 15 years later is we're seeing some of the big insurance groups go, Yeah, we really don't know how to do that. And we're going to set up a separate group, a risk analysis group, to just look at cyber risk because it is so different. Even the primary calculation, right? The primary equation that insurance uses is fundamentally different than the primary equation of risk for cybersecurity. So they're learning, they're learning, they're getting there. But unfortunately, because the risks go up, the premiums are going to go up and, you know, You know, we learn more, we have to deal with more. So don't expect their ability to get more accurate to lower your premiums. That's not in the books. That's not what's going to happen. They're going to get better in understanding what they should be charging to have a consistent rate of return on their investment.

Yeah, that totally makes sense. And pivoting back to AI, what are the biggest risks associated with using GenAI models in enterprise settings, particularly around data security and intellectual property?

Yeah, I mean, GenAI is the big thing, right? And it seems to be the tip of the spear. AI has been around for a long time. We've seen some great advances in machine learning and deep learning. And within deep learning, GenAI has just taken off because it is so enthralling and it can be so useful to massive numbers of people, right? Whether it's summarizing an article, writing a paper, wordsmithing something you're going to have to submit at work, And the adoption of like GenAI, right, has been spectacular. The adoption of that type of technology has surpassed all the different social media platforms, right? The rate of adoption and how people are using it and how often. Now, because it can be used by someone in finance to review contract or write a new contract, somebody in HR to help write a hiring rec, somebody in engineering to help write some code, right? Everybody can use it. Everybody is. And this is a new technology and the interfaces and the, you know, the engine behind it, everybody has rushed and continued to rush to advance its capabilities and the security and privacy and sometimes even the digital ethical concerns around it. Tend to lag, right? You're driving for competitiveness and capability. Security's going to fall to the wayside, unfortunately. And so in using these tools, and we see a vast amount of employees in a corporation using them in every department, every department you can imagine, you know, and it not necessarily being secure, it exposes you to data loss. It potentially exposes you to bypassing all the traditional security controls that you may have established. Yes, we've seen this. Introducing new vulnerabilities that we haven't even thought of, right? And what we also find in the enterprise world is to gain the very most value out of it, you have to connect it to backend systems to be able to interact and to be able to have an understanding and context and maybe even to accomplish something in an automated way. But in doing so, again, now you could be exposing all those backend systems that you're connecting it to, to a malicious attacker or somebody that just wants to misuse the system. So there is, from an operational and integration perspective, there can be some really big risks in the race to get the benefits of GenAI.

Yeah, that totally makes sense. You mentioned ethics and we both know Reid Blackman, who wrote "Ethical Machines." GenAI has been criticized for amplifying bias, producing harmful outputs. How can organizations mitigate these risks when deploying these tools?

First off, read Reid's book. That, you know, and I know Reid real well. We work together. He's got a great book and he's got a great sense of these things. So, you know, first off, get an expert because these can be very convoluted issues. That it does take a lot of thinking, a lot of pondering, a lot of looking at the horizon going, "What does this really mean?" Right? The greater picture. And then bringing it back down into things that are tangible. So, 1, get educated. 2, bring in an expert because you're probably going to need it. And 3, understand that even though you may be able to paint a picture of the problem, what really matters is the type of controls and oversight that you institute because you want to be comprehensive and you want to be consistent. And that just doesn't happen by itself. There have to be structures put in place within the organization to vet things coming in, to, you know, check them before they become widespread or made available to other parts of the organization or customers or partners or whatnot. And then also maintain oversight and accountability of it. As we learn more and more about how they potentially could be misused or misconfigured.

Yeah, so, well, look, if we look at governments and regulators, obviously they kind of missed the boat in terms of like not regulating social media or not doing something about it, and now it's kind of too late. And I think there are at least some people in government that are like, oh, we're not going to miss the boat on AI this time. And I'm just curious, What role do you think governments and regulatory bodies should play in defining the safe use of GenAI? And let's also assume certain countries outside the US will not follow any rules at all.

They're just going to do their thing. It's a complex beast to even talk about because there's social issues, economic issues, business issues, political issues, international political and power struggles that are all involved in this. And, you know, why? Because AI is simply that powerful and that capable. It can be used in every industry and every sector and give a distinct advantage. So it is a tremendously powerful tool that we are developing. It's not done. We are just at the tip of the iceberg on what AI will be able to do and how it will affect society and mankind, humankind, right, moving forward. So yes, a lot of countries and companies and individuals want to jockey to be in the forefront of that development implementation, ride that big, big, big technology wave. When it comes to governments, whether it's ours or EU or whatnot, a lot of their mandate is to protect the citizens, right, from harm, unnecessary harm. And that could include, you know, criminal issues and whatnot. So they have to position themselves, but not overly so, right? They want to make sure people are reasonably safe and secure, and yet they don't want to stifle the innovation or business benefits, economic benefits, social benefits, right? And even technology leadership benefits of the nation level. They want those to move forward, but at the same time, you have to also protect your citizenry. And that is very, very difficult. Traditionally, it has been a kind of post-review when technology comes into play, like social media, for example. Okay, let's figure this out. This social media on the interwebs thing, we don't understand it yet. Okay, sure. 'Let's let it kind of entrench, manifest, see what kind of dangers and bad things happen. Once we can kind of confirm that, great. Now we'll move at legislative pace and start putting controls.' And for very slowly evolving technology, that's okay. And for the history of our legislature, that's really been the kinds of things that they had to deal with. But when we start talking about very rapidly moving, extraordinarily powerful technologies that could have detrimental effects, that also have mind-boggling benefits, that model of how we legislate and put controls in place, everybody agrees you can't be that late, right? You can't say, oh, let's just let this AI thing play out for 5 or 8 years and then, you know, we'll get together and see what kind of rules we want in place. That's not going to work. So, there have been some efforts to be much more proactive. We've seen EU do this to say, "Hey, we're going to establish rules." The first set of rules, not the final set of rules, the first set of rules, which will be evolving. We've seen the White House and we've seen different states also put forth proposals to be able to do similar things. But you're trying to nail Jell-O to a wall because AI is constantly morphing and changing. And again, you're trying to protect your citizenry, but at the same time, you want to enable those great, fantastic benefits for everyone. Yeah, I love that, Neil.

Jell-O to the wall. So you must have seen some pretty cool stuff with AI or JetAI. Is there anything you've seen recently or that was just mind-blowing or cool or you want to tell us a story about?

Well, you know, what really blows my mind is how fast the iterations of these engines come out. Not that long ago, we had ChatGPT released and it was, you know, it had a single, it was not multimodal, right? I mean, it only did text and then you rapid evolution and now we've got image generators and movie generators. I was playing with the tool and I can't remember what the heck it was. Just last night where you can actually make entire movies. You just put in a prompt, right? And it will create scenes, video scenes, and give a whole storyline. It'll generate a storyline for you that you can go in and modify, and then it'll create the actual scenes. And it has voiceovers and it creates characters for you that stay consistent through the scenes. It's a miniature movie maker. Without the actors, without a script, without a director, without a camera, right? And it's generating all of this from one person typing a few lines and then just kind of guiding the process. Wow. It was amazing to me. And wait a second, we were just doing ChatGPT text prompts just a little while ago. How fast. Is that accelerating? So what are we going to see tomorrow?

Yeah, it's definitely been faster than I thought. And I'm on the front edge of GenAI. So pretty amazing. So let's look forward a decade. What do you see AI doing that other people just haven't thought of yet or imagined, or at least it's going to happen that quickly?

There's no way to look 10 years ahead. I mean, if we go back and we say, hey, this internet thing just became public, what do you think's going to happen with your 300 baud modem that you have to take the phone off the hook in the kitchen and plug into, right? What's going to happen in 10 years? Right? We had no clue. When electricity first came into existence and use in the home, What do you think could happen in 10 years? Nobody had a clue, right? They would've said, well, we might have 2 lights in the house, right? Versus all these other appliances and television and radio and all these means of communication and every, we have no clue. I would challenge anybody that could say, oh yeah, I could paint a picture 10 years ahead. There's absolutely no way. We do not have the cognitive ability. Last night I just reviewed my— I do cybersecurity predictions every year and it's tough because of the chaos and ambiguity and everything. And so I was grading my 2024. Actually, I had ChatGPT grade it for me. First year I did that and that was awesome. And it came back with some great insights. But, you know, just looking a year out because of the chaos and ambiguity, it's extraordinarily difficult. 10 years, you're talking orders of magnitude. So, I have no idea 10 years. You know, again, I'm interested what's going to come out tomorrow or next week. I think what we're going to see probably by the end of next year, though, I'll give it a shot, is a lot more automation, right? To be able to do tasks that we already do, to do them better, to be able to enrich whatever output it is, whether it's video, audio, text, whatever, to enrich it with a lot more context. Right. You know, it's been a few months now and they finally hooked up these, you know, ChatGPT and other LLMs to the internet so it can see real time what's going on. I think it's going to, by the end of next year, be able to pull all that in, do all the analysis. So every, you know, YouTube video you create, it'll be able to scour the internet, look at that, understand it, break it apart. Tag it, you know, and then incorporate some of that as part of its base learning, right? And so the richness and applicability will get orders of magnitude better, right? And when we give it input, no, I don't like that, you know, can you kind of do this? And we're horrible at communicating things we like and don't like. It'll be able to translate and compensate for our inadequate ability to communicate what we want, what we like, what we don't like, simply because it can aggregate all the knowledge of people before you in how they try to communicate things and apply that with some high degree of confidence and fidelity. So it's a lot of stuff will happen in the background, but it will manifest for us into a tool and set of interfaces that we won't understand how life exists without it. Just like today we can't imagine a world without the internet. Or our smartphones. Or, oh yeah, you know, talk about a catastrophe if you ever lose your smartphone. I mean, the world stops. I don't care what meetings you have. I don't care what appoint— I need to go get a new phone. I have to go do that. Hard stop on everything else in life. I cannot continue unless I have my smartphone. I think we're going to see the same thing with GenAI. Yeah, totally believe that.

So let's talk about artificial general intelligence, right? So I don't know if it's coming or not, but I'd love to get your take on that. Is it going to happen? And I don't need a prediction of when, just is it going to happen?

And should we be worried? Yes, you should always be worried. Anything that ends up being smarter than you at particular domains or tasks you definitely want to because we often look at those things or people or situations as adversarial. Okay. Are we going to see general AI, which is, you know, for the listeners, obviously it's a lot different. It's a world apart. That's not GenAI. This is general AI. Think T-2000 sentient kind of beings. Are we going to see that? I would say yes. But again, now we have to communicate a little bit better. Do— are we going to have that, that, you know, T-1000, T-2000 kind of artificial intelligence that understands everything and becomes this sentient being knowing all? I think that is problematic in the end. And I think it is a very distant kind of reality. Now, do I think we will have those general AIs for specific domains? Absolutely. I think, you know, within, definitely within our lifetime, probably within a decade, we're going to have AI doctors, right? They're not GenAI doctors, they're general AI doctors. That can understand, not regurgitate, but actually understand and incorporate and interact with patients, with research, things of that sort, to be the very best doctor you could possibly have. And I mean, that's going to be wonderful. I think you're going to find the same thing for automobile mechanic. We'll probably still have cars. We love our cars. So, you know, there will be a general AI that knows everything about every car, how to fix every, just about every ailment a car could have, right? And it will be domain specific to that. Will it decide, hey, I want to take over the world? No, that's not what it's designed for, right? But will it have that general AI where, yes, I understand and I can interact and, you know, I know when people come to me, they want upgrades or they want fixes or there's problems, have you you thought about this. I am, I won't say omnipotent, but I am the collection and continually evolving insights to this domain. And I am the interface is essentially I'm aware of what I am and my purpose. And this is what I'm going to focus on. And if you ask it, hey, can you take over the world? It would go, "I'm here to make every car in the world operate better. I'm not here to take over the world, right? I'm here to do this." So I think it'll be more domain-specific and the, you know, "Hey, we're gonna put it and make it our government and our overlord and it's going to decide that humans aren't supposed to be here or, you know, this wetware is inefficient or whatnot." I'm not too worried about that, at least within my lifetime. The complexities are just off the board when you start getting towards that last mile.

Yeah. Number one rule, never give AI the nuclear codes.

That will actually probably happen, unfortunately, at some point. But, you know, you don't—

That's really— I really hope not.

—let it decide what to launch, you know. Yeah. Control it? Possibly.

So heading into the advice section, what's the best piece of advice you have gotten that you want to tell us about?

In what? Life, work, cybersecurity, driving a car? I mean, we've covered a lot, a lot of ground.

We'll go with life, work, and/or cybersecurity. How about that?

You know, in life, For me, figure out your own internal compass. For me, have a code that you're going to live life by, and that's how you determine whether you're doing right by the type of person you want to be. Everybody believes they're a good person. You talk to a mass murderer and they think they're a good person. You talk to anybody, they think they're a good person. But what are you measuring it up against? That's just your feeling. That's just your situation that is 100% biased. So instead, figure out, all right, what kind of person do you want to be? What would they do? What is your code, right? You know, samurai had Bushido, right? They had a code that said you act a certain way, you're held to a certain standard, and this is what makes you a good person. Anything else would dishonor you. Right. So, you know, and there are— and this goes back to ethics, right? If you just say, I'm going to be an ethical person, there's a lot of latitude there, right? There's no guardrails, right? If you get into a really tough situation, you may, you know, you're going to bend it because that's what's warranted. Whereas if you go, I'm going to be an ethical person and these are the boundaries, you know, I'm not going to lie, right? I'm not going to lie. I'm not going to steal. I'm not going to harm, whatever it is, whatever it is for you. Right? And you may get into a tough situation where, yeah, I really want to lie. I'm going to hurt this person's feelings or I'm going to do whatever. And you have that hard code. Oh, okay. I'm not going to lie. Right? Because if I do, I know I am no longer the person that I want to be. Right? Hard evidence. So in life, I would say that. In work, I would say continually go after that platinum ring, right? In everything that you do, do your best. If your name is going to be on it, if you're going to be involved, give that 110%. Go above and beyond. And when those opportunities arise and you think, oh, I'd kind of like to do— I'm not sure, I'm not sure. Don't be your worst enemy. Put that aside. Go for it, right? Push yourself. That's how you grow. That's how you get better. And actually, that's how the world moves forward. It's not by the pensive people that go, ah, yeah, I don't know. It's the people that go, I'm not confident I'm going to be able to do it, but I'm going to give it my best. I'm going to try. I'm going to make it work. And they jump forward and that moves everybody forward. So don't be afraid.

Awesome. Hey, for someone in college that wants to be a cybersecurity professional, what's your best advice for them? Oh, lots of it.

One, first understand if it's really for you. Now, we need vast amounts of really smart, motivated people, but it is a hard job. And for some people, they don't like certain aspects of it and it can just grind on them. So, for example, there is a high degree of ambiguity and chaos inherent to our environment because we don't control everything, right? We're responding to the bad guys. And if you are an engineer, right, an engineer likes to know, okay, what environment I'm working in, what are the rules, what's going to happen, right? Coders like sitting down and going, okay, I'm going to control and start writing the code and I can test it. And it's kind of a closed environment. I know what I'm going to be doing every day, right? It may be a different project or a different, you know, programming language or whatnot, but I've got a good idea. I'm going to come in and this is what I'm going to work on and I've got certain goals, right? And I can manage my time. Okay, this is good. Cybersecurity often is not that case, right? You don't know what's going to happen that day. And I've hired a lot of people into cybersecurity throughout my career. And one of the things I've always told them is I said, no matter what you're hired for, okay? I guarantee you within 18 months, there are fundamental aspects of your job that will have completely changed. It may be who you report to. It may be the primary tool you use. It may be your business objectives or what you're graded on or what you have to deliver or who you're working with. Right? Something major will, I guarantee, change. Probably a lot of major things. Right? So if you're not comfortable with that, nah, this probably is not the world for you. If you are, if that excites you, then you may find this a very rewarding and exciting and stimulating field. Right? So, you know, that's, you know, I typically start off with that. I talk a little bit about the chasm between people that get their degree or certifications trying to get their first job. It can be very, very difficult and there's some best practices around that and, you know, just getting in the industry and realizing, wow, this is a lot more complex. Most of our industry has come up through the technology field, right? Many of them within the IT field. And whether you're an IT professional or you're an engineer or architect or developer, you have a problem-solving mindset typically. At least the successful ones do. Show me the problem. I'm gonna build, design, code, whatever, a solution. We apply it. Done. We're done. And I can move on to the next problem. And that's great in IT. It's great in engineering. It's great in software development and so forth. In cybersecurity, it fails miserably. Because there's a problem created by somebody else who's really smart. And you go in and go, "Oh, well, I'm going to put a security control in. Yay, it worked!" And that adversary goes, "Yay, he put a security control in. I'm going to go over it and around it and above it and through it and under it. Here we go." And you look at it and go, "Well, wait, I just put a fix and it's still broken?" But it's broken in a different way. "Well, wait a second. No, I fixed that." "No, that's not satisfying." "No, wait. No, I fixed that." And you see this dilemma. And a surefire way of seeing that personality is the mentality of, "Oh, I can fix security." No, you can fix a problem and the attacker can adapt to it. You're not fixing security. If you believe you can fix security, I guarantee you will fail. There is not a single engineer, architect, or developer prior to you or the collection thereof in existence that has ever been able to do that. And if you think you can do that, I will bow at your feet if you really can, but it's not going to happen.

Yeah. How about advice to CEOs who are just kicking off their GenAI adoption to ensure they achieve business value without exposing the companies and their stakeholders to unnecessary risks?

This is one of the biggest problems I deal with when I get brought in. So I get brought in by boards and C-suites and by CISOs as well. It's the implementation of AI, right? And typically when a company decides we're going to use AI to do X, Y, or Z, there already is a value proposition for it. And they see it and they want to go after it. Great. And they're going to run as fast as they can. It's a competitive advantage. It's awesome. Great. But again, security tends to be an afterthought. I had a colleague of mine, a CISO, at a medium-sized company called me up and, you know, he was frustrated and he's like, I just got an email from our development team who's supporting IT. And they said, he read it to me and essentially it said, hey, we're turning on this new AI agent for password resets. We're turning it on tomorrow. Can you make sure it's secure? And he's like, They're turning it on tomorrow. He's like, what do we do? So I said, okay, so call in the CIO and the CTO, call in yourself and, you know, the head architect or product developer, whatever. And I said, let's just have a quick meeting. And so we're all on the bridge and I'm talking with the IT department and they're explaining the business value. And I'm like, okay, fine. They said, hey, you know, we look at our call desk and, you know, a predominance of calls or password resets, especially after the holidays or somebody comes back from vacation, they forget their passwords, they need a password reset. And it's a productivity hit. It's a productivity hit to our help desk, right? But it's also to those users. They don't have credentials. They can't actually work until they get onto the network. So they need their password reset. And the queues fill up. And so, you know, so we thought, hey, if we had an AI agent that could interact with them, well, hey, they could validate who they are, reset their password, and they wouldn't be waiting on hold. "Right? My first-call resolution would go up, right? The overall productivity of our workers would increase. And I don't have to hire after holidays or have as many call desk people to answer the phones. I mean, this is a win-win-win, right?" And I'm like, "Hey, you don't have to sell me on it. Totally get it. Awesome. Just walk me through this. Just walk me, just humble me, right?" And I'm doing my Columbo impression essentially, right? And, you know, I'm saying, "Okay, so essentially someone loses or forgets their password and they get ahold of the system and the system has to validate who they are." And they said, "Yeah." I said, "So you have to enable the system to reach back into the environment and get some kind of details about them, right? To validate who they are." They're like, "Yeah, yeah, yeah." I said, "You're probably connecting it to your Active Directory to have it read whatever, to validate the account actually is locked or whatever." They're like, "Yeah, yeah, yeah, yeah, yeah. So it's read access. Okay, great." And then the next thing, once it validates, "Hey, it validated Matthew. Matthew's locked out, needs a password reset, maybe some other checks." Now they have to reset the password. They said, "Yeah, they reset the password and the person's back up and running." I said, "Awesome. So you had to give your AI system administrative privileges into your Active Directory so they could actually do the password reset, right? Because that takes more privileges." Well, yeah. And I said, and, you know, if I'm that employee and I forgot my password, I can't actually get inside the network to ask for a password reset. I'm still on the outside. So you have to expose this to the internet. And he said, well, yeah, I mean, that makes sense. That makes sense. Okay, so let me recap here, right? You are deploying a tool that your CISO just found out about and hasn't done any security evaluation, that has administrative access into your Active Directory, that could crater your entire company, and you've exposed it to the internet. And it was just quiet. And I could hear the gears turning. And the CIO spoke up and he's like, uh, maybe we should put this on hold. Until we do a proper security review. And even the product manager, you saw him sink a little bit, you know, he got a little shorter in the video and he's like, yeah, that might be a good idea. And I said, yeah. And I said, moving forward, it would really be great for all these wonderful, hugely valuable, you know, new capabilities you're developing around AI to actually involve the security team, and not just for technical vulnerabilities, but also for vulnerabilities about misuse. A security engineer will get some of the technical stuff, but you also need to know how bad guys might misuse these things. And I said, just introduce them as part of the architecture, right? Architecture discussion and keep them involved, right? And you'll have them as part of, you know, some design reviews and you'll have them as part of QA before final release and they'll check everything off. And you can go as fast as, you know, that team can move and we want to move fast, but involve them early. Not as an afterthought.

Yeah. I love that.

They all kind of nodded that would be a good idea.

Yeah. I love the Socratic method too. Awesome. Well, the last part of the show is our lightning round where I mentioned something and then ask if you think it is underrated or overrated and why. Okay. So, I'm going to start with zero trust architecture, underrated or overrated?

It's underrated for what it can do. It's overrated for what people think it can do.

Oh, love it. Hiking in California, underrated or overrated?

Oh, it's underrated. California has some of the best hiking trails, whether it's in at the ocean or in the Sierras and, oh, oh, beautiful, beautiful. You got deserts and lakes and forests and, oh yeah, underrated. Amazing.

Paying more for the best cold brew coffee, underrated or overrated?

Ah, so I personally believe cold coffee is the downfall of modern society and therefore nobody should ever have to suffer through drinking a cold cup of coffee. So I would say completely overrated. In fact, it should be outlawed.

Blockchain for cybersecurity, underrated or overrated?

I think it's underutilized, although the utilization of where it could be used for a significant value is much more narrow than people think or want to think. But it is underutilized where it could provide a value.

The Folsom State Prison Museum, underrated or overrated?

I've never been there either as a guest or occupant of that particular facility. I do have colleagues that work there as correctional officers. They have given it thumbs up. So I'm gonna have to say it's underrated, but it is secondhand knowledge. I just wanna make that clear.

Yeah, there's gotta be some, there's some Johnny Cash memorabilia there apparently from that very famous famous concert. Yes. AI-powered phishing detection tools, underrated or overrated?

I think right now they're overrated, but their potential is huge. And ultimately, they're underrated as what we need them to be because they will have the capability to do it. In fact, that tool, as the attackers, it's an arms race. As the attackers use AI, to generate vast amount of better phishing, we actually need a comparable tool, in this case AI, to keep pace, to detect and block and mitigate the risks of those. So it's an arms race.

Teaching children chess at a young age, underrated or overrated?

It's underrated. I, you know, I say do that. It helps you with strategic thinking. It helps you in understanding adversary. It helps you in understanding positioning and and sacrifice. There are lots of lessons in chess that open one's mind, I think.

Quantum computing, busting encryption in the next few years, underrated or overrated?

So that's a trick question. Why would you throw that in there? Computing can undermine encryption. It's all a matter of time. Given the quantum capabilities of computers when they get to a certain error-level correction level and qubit capability, they absolutely will be able to decrypt the types of encryption that are predominantly used right now. But the fear that the world is going to fall apart, I think, is completely overrated. I believe that there's already mechanisms in place and moving forward to as technology is advancing, where we get towards that cliff, we will begin shifting away from those algorithms that are most susceptible to more quantum-resistant ones. So there will be a window of opportunity for attackers, but it won't be the end of the world, you know, year 2000 catastrophe kind of things. There will be outages that will happen. There will be a loss of confidentiality and integrity that will happen. But for those organizations that need to protect that, they have the tools now to move to more quantum-resistant structures. So I'm going to say it's overrated, the catastrophe, but it's underrated in what it's going to be able to do.

Yeah. Black Hat for cyber professionals, underrated or overrated?

Ah, see, now I'm going to get a whole bunch of hate mail on this one. I love how Black Hat started grassroots. Unfortunately, you know, some people say it's sold out to commercialism. I won't go that far, but I would say there's probably now openings for more grassroots in, you know, engagements and conferences that was Black Hat and isn't anymore.

Yeah. And finally, the TV show Columbo.

Overrated. Columbo is completely underrated. It is one of the best shows out there ever made. Peter Falk, you know, but I love it just because of that, you know, the way he portrays the character, which if you go back and read kind of how that the cast came together in the scripts, a lot of it actually is Peter Falk. He crafted that character to appear to be kind of the bumbling, "I really don't know anything, but I just have one more question." And ultimately he outmaneuvers the bad guy. And you can kind of look back and go, "He was thinking about that the whole time." It's kind of like the US version of Sherlock Holmes as part of a '60s, '70s detective detective show. So I find it underrated. I'm not sure if the current generation would have the same appreciation.

Well, what's kind of fun, obviously, is you can tell ChatGPT, ChatGPT, play the role of Columbo, and then you could ask it to answer questions.

I've never done that. I'm going to do that. I am going to do that. I am going to— I never thought about using that as a personality. Yes. You don't have to search back in the archives to even understand what that is. Do you mean Columbus? No, I meant Columbo. It will figure it out, I promise.

Anyway, Matthew, thank you for coming on the show. This has been Matthew Rosenquist, CISO and cybersecurity strategist at Mercury Risk and Compliance, and obviously iconic cybersecurity professional. Awesome show. Great to have you. Absolute pleasure.

Thank you for having me on your show.