The Future of Cybersecurity: How AI Is Exploiting Technical, Behavioral, and Process Vulnerabilities
In this keynote, Matthew Rosenquist outlines how frontier AI models—exemplified by Anthropic’s Mythos—are reshaping the threat landscape across technology, people, and processes. He explains that AI can discover software, firmware, and hardware vulnerabilities at unprecedented speed, automatically generate exploits, and chain low‑severity flaws into high‑impact attacks, dramatically compressing the time from discovery to exploitation. This acceleration is already breaking traditional patch cycles, as illustrated by Microsoft’s Patch Tuesday data and a dramatic reduction in exploit windows from years to days. Rosenquist also warns that AI‑assisted development introduces insecure code, because AI‑generated code inherits the bugs of its training data, and that attackers are leveraging AI to craft highly convincing synthetic identities (e.g., “Celeste”) for multi‑provenance social engineering attacks. He highlights emerging process risks such as shadow AI, ungoverned model‑controlled APIs (MCPs), and automated attack pipelines that operate at machine speed, outpacing human SOCs. The talk concludes with a set of strategic recommendations: reinforce basic cybersecurity hygiene, adopt a “know your enemy” mindset, procure trustworthy AI tools, integrate AI into governance and accountability frameworks, and align security initiatives with business value. The overall message is that AI will only make cybersecurity harder, and organizations must evolve continuously or be overwhelmed.
Chapters
Good afternoon, everybody. So we're gonna look at the future. We already struggle with the challenges we face today. It's complex, it's hard. Doesn't matter what aspect you look at cybersecurity, it's tough. So why would we even ask what's out there? What, what's beyond that horizon? In fact, you should ask what is beyond the horizon. Okay. Thank you. Thank you. Okay, so we are going to kind of talk about, and we've heard so many great things today from different leaders here about best practices, about challenges, about what they've learned. So we're going to pull some of that together as we take a journey in looking forward, because it really matters. When we look forward, it gives us an advantage because we can start preparing now instead of being surprised, instead of responding to what happens. So again, my background, you can look up the bio online. I've been doing this 36 years, and I absolutely love it. I love the chaos. I love the ambiguity. I love dealing with that intelligent adversary. Okay, and that's what we need to start thinking about. And a lot of what we talked today is that adversary will also include AI and various forms of AI. So we need to start baking that in because let me tell you right now, it only gets harder. The only easy day was yesterday. It's, it's not going to get any easier. I don't have good news in that space. I've got good news in other spaces. But we'll cover some of that. And at the end, we're going to talk about what do we need to be thinking about now and how do we need to start evolving now to get ahead of these risks and not be just bowled over by them. Okay, and we're going to cover it in a framework that we should all be familiar with. Technology, people, process. Okay, we all know that. So we're gonna kind of break it down into those different areas, and I'm gonna cherry-pick and help elaborate some of the risks that we're seeing now and how they're going to evolve in the future. Okay, so from a technology perspective, we know AI, it's here, it's being adopted rapidly. We know the attackers are using it, right, to their benefit. So we've got this technology issue we're going to get into. And from a people perspective, we have to worry about the people who are coding the next generation of product. That's on the front end, the technology that's being built today. Yeah, they're using AI to do that. We also have to look at the people that are going to be victimized because our attackers are going to use AI to victimize them in new, better, more efficient ways. And on the back end, we have to think about it— all our organizations and the critical infrastructures that we all depend on, they're also integrating in AI. And there's processes— how do they vet it? How do they secure it? How do they attest to it? There's a lot of things in the processes that also can be undermined, can represent a threat, and can impact us at the end of the day. So let's tear down a little bit at the technology side, and I want to focus on the Mythos effect. Everybody familiar with Mythos, Anthropic's latest model? It was specifically designed to look for vulnerabilities, and as it turns out, it does 3 things really good. One, it finds vulnerabilities in software. Operating systems, firmware, and hardware. Does it really well, does it really fast. The second thing it does, which is kind of magical, is it can create exploits for those vulnerabilities that it finds. Okay, that's a lot harder than actually just finding the vulnerability. And the third thing is it can chain together vulnerabilities. So when you get a low or a moderate, you can't push that off because Methos, and it's not just Methos, right? It's all the frontier models. They're really good at chaining together even low-level vulnerabilities to create something much greater. All right, so the result of all of this is the lowered confidence in the software firmware products, devices, services, That we use. And this little thing called patching, maybe some of you have heard it, right? That fundamentally breaks. It's already starting to break. All right, everybody familiar with Microsoft Patch Tuesday? It's our favorite second Tuesday of the month. For the last 3 cycles, Microsoft has put increasingly higher numbers of vulnerabilities that it's patching. This last Tuesday, over 600 vulnerabilities, and it's just going up. Let's look at that from a kind of process perspective. Now, I want you to put yourself in the mindset of your organization that has to deal with some of these vulnerabilities. Okay? So you have software, you have a product, you have a service, whatever it is. When you have to manage these vulnerabilities, First off, you have to discover the vulnerability yourself, and hopefully it's an ethical cybersecurity researcher or it's somebody from your team. If it's the bad guy, you're not gonna find out about it until your business partner says we were hacked because your software had a vulnerability, right? That's bad. But let's just say for the sake of argument, it's someone on your team, but they have to figure that out. Is there a vulnerability? And then they have to validate it. Is it a real vulnerability? Okay, let's grade it. Is it low, moderate, high? Critical? There's lots of debate. That entire process can take months, and in some cases, Microsoft, years to actually discover the vulnerability, grade it, and then start developing a patch. Now here's where the problem comes in, because the people that know the code the best, those are your developers. You need their expertise. But they're not just hanging around. You have them working on the next generation product. So you have to rip them away and go, guess what? We need you to work on the software you already finished. There's nothing a software developer hates worse than finally coding something and it works. They just step back. I don't want to touch it.
It works.
I'm moving on to the next thing. So you're going to pull them back to their chagrin. Now they have to develop a patch, but we're not done. They then have to hand it off and that patch has to be tested. It has to be tested on the current product. But you know what? All your customers don't use the current product. You have to retrotest it to all the old versions your customers are using to make sure it closes the patches on those too. And you're still not done because remember that next generation product you have? You have to go validate that it's not going to undermine that as well. Okay, so we're done with testing, and that can take weeks depending on how many variants out there. Now it's time for rollout. And you could just hit the big red button and push it to everybody. But what if there's a flaw? We've seen this. Microsoft, we've seen it with CrowdStrike, we've seen it with McAfee and so forth. You push a bad update. You may get a blue screen of death. You may fry components. You may end of life a device. So you have to roll it out slowly. Fair enough. Okay, so the chart you're seeing here is this whole lifecycle that you have to do. And it typically takes a long time, depending. So long, in fact, many organizations, if a vulnerability is low or moderate, They'll put it off and say, you know what, we'll just bundle all those together and once every 6 months or once a year we'll address those. And we'll only focus on the criticals and highs. Okay, this is where the window of opportunity of the attackers now using AI comes in. Because Mythos, as we said, is really good. And what I mean by really good, I mean an order of magnitude better, faster, more accurate at identifying vulnerabilities, and even more so in being able to create the exploits. So AI tooling by the adversaries can do it in much shorter periods of time. And the whole idea with Microsoft Patch Tuesday, by the way, once a month— Microsoft figured this out years ago. As long as they get the patch out to their customers before the attackers can exploit it and cause victimization, they're good and they'll stay on that cycle. But they have to make sure they can get that patch out. The reality is it's flip-flopped. If you go out and it's a great site to go out and take a look at it, zerodayclock.com. I pulled this a few days ago. When we look at how long it takes for exploited vulnerabilities for the attackers to come in and take advantage and harm people, we can see that, let's say 2018, right? It took about 2 and a half years. Those were the good old days, by the way. When we start getting into 2021, it's 18 months. All right, a little closer, but not too worrying. By the time we get to 2024, 2025, actually the last quarter of 2025, it was inside that 30-day window. That's why Microsoft has Patch Tuesday, and then they'll deploy a few more patches after that. Nobody noticed, don't worry, because the attackers are inside of that. On the right here, if you can see it, it shows you the progression. And it took 1 year for the attackers to exploit a vulnerability in 2021. By 2025, it was at 1 month. By 2026, it took them a week. And right now where we stand, in some cases we see it in a day. So I want you to think about this for a second. You're security and you get notified, hey, there's a new vulnerability. So you're gonna go call your developers. And you're gonna say, okay, you have 1 day, 24 hours to validate the vulnerability, build a fix, test it, and roll it out. But it doesn't end there. By 2027, it'll be estimated to be an hour and then a minute. So these are some of the challenges that we have to deal with. It's not just the timing, it's also the numbers. I'll throw some stats out here. So before Mythos came out, Mozilla, who creates Firefox browser, you guys are familiar with that. They were going through their normal patch cycle and they identified 22 vulnerabilities in their browser. They went off and they patched it. When Mythos got limited release, they brought in Mozilla. Mozilla grabbed it within a couple of weeks. They started running it against their Do you know how many they found? New ones. In that short period of time, it was in under 2 weeks, over 270 new vulnerabilities where the best and brightest only found 22 the previous several weeks. This is an order of magnitude difference. Now, couple the fact with— it's not just finding the vulnerabilities, the vast number of vulnerabilities never get exploited. Because it takes so much time and effort to develop exploits. Mythos and its peers out there can now develop the exploits at the same time it's finding the vulnerability, typically within days. So that's the good news on the technical side, right? So let's go with the people side. And when we think about the people side, we've got the— Accidental, the non-malicious, right? And then we've got the malicious side. Well, again, you've got a lot of people out there that are using AI, probably some of you right now. In fact, you're using AI. We have developers that are using AI to write code and develop products, and it's amazing because they can give a short prompt and the AI will come back. It'll pull the libraries it needs, and it'll write the code, and it'll put it on the screen. And that developer can see if it works. And if it works— number 1 rule in software development, by the way— if you write code and it works, you don't touch it. You don't add or remove a space, a comma, nothing. Right? And it works. So they just move on to the next piece. They don't go back and look at the libraries. They don't go back and look at the code. They don't have time for that. They're being pushed. What we see is AI, which has been trained on code. It's a whole library, is massive amounts of human-created code. Guess what? Those code was riddled with bugs and vulnerabilities. It's no surprise that the code that AI is generating today also has bugs and vulnerabilities. What did we teach it? Right? But we're not doing those checks, unfortunately. So we're seeing a lot of code. It's not intentional. What is intentional are the attackers. who were using AI to be able to do social engineering. And we've, we've seen a couple of them here today. You can impersonate, you can do phishing, you can do all sorts of things. You can create synthetic deceptions. And with that, I want to introduce you to Celeste. Celeste is my favorite. When I say my favorite, you have to understand she's not real. In my position, I get the pleasure and joy Of every month going through and trying to find the latest scams in my inbox or SMS or on web pages, right? Most of them, I'm waiting for the ones directed at me. I've got some great little research stuff that I do. Celeste is now my favorite. She is totally awesome. So Celeste here, right, is a very carefully crafted synthetic identity. The name itself actually comes from a Swedish investment family. She purports herself to be part of, I think it's TCG Finance or something like that, which is a real company, by the way. Okay, so she engaged me, right? Started an email, and of course I'm going to engage back, right? She, in her first engagement with me in email, did OSINT, right? She researched me, looked at my recent posts and articles, crafted a message using cognitive vulnerabilities, appealing to topics that I'm interested in, right? Appealing to urgency, opportunity, all these things. So of course I engaged back, started doing research. And one of the things I typically ask is, hey, connect to me on LinkedIn, because if they give my, their LinkedIn profile, I've got a whole bunch of info, more information I can go dig into. And she gave a great response on why she's not in LinkedIn. Okay, no problem. We go back and forth multiple times a day and get to the point where she says, I have a webpage. Really awesome. So I go look up this webpage. The webpage was created less than 24 hours before, has full SSL certs, has the domain. She's already seeded it in Google and search engines. She has a new email address. She's got all of this. In fact, I can look up all that information and see exactly when it was created. It's fantastic. So now I'm trying to get her online. Hey, join me in a video. She was willing to do it, but not in something like Zoom where you have a higher resolution. She wanted it on other platforms where I had to give more information. She could put layers over it and do some other things. But the question is, would you be fooled if somebody's approaching you or your workers and they had webpages, they had social media accounts, they knew your interests, they were leveraging cognitive vulnerabilities? This is what we're seeing. I'm seeing intelligent threats create contracts on the fly, job requisitions on the fly, custom just for me. I'm very flattered. I was very flattered when she created a webpage for me.
Right.
So that's what we have to worry about from the behavioral side. It's going to get worse. It's not just multimodal, which was text, image, video, voice, video and voice. We now have to worry about the multi-provenance because they're going to back that up with social media accounts, web pages, job requisitions, all this other material. That is highly convincing. Fun stuff, huh? Okay, I'm gonna go through process real quick. We have to worry about shadow AI. Makes shadow IT back in the day look like child's play. It's really tough to understand what AI is being used. And there are more and more challenges around this. The implementation of MCPs and APIs, which is the interface to allow agentic systems To use your technology. It's fantastic. It also creates a tunnel through all your security tools and platforms and oversight and management to allow attackers to get to your most critical data. Unfortunately, MCPs were designed specifically for functional use. They even tell any opposing agent. What access they have, what data. It's a hacker's wet dream. And all of this happens at machine speed, a speed in which security operations— there's not a human in the world that can detect that and respond to it in time. We're seeing orchestrated attacks by AI blowing through an organization, and they don't know until it's done. So what do we have to do? We either adapt or we get crushed. And this is where you're going to hate me because the first thing here is probably the most important. And this is the I told you so moment. You got to do the basics. And when I sit and I consult and sit down with companies of all sizes all over the world, this is the first one. If you don't have good basics of cybersecurity, no matter what else you do, you could buy some fancy AI tool and tracking and whatever. It's not going to make a difference. So if you're gonna do anything, do this. Ignore the rest of what I say. So this has to be in place. The second thing, and this is a change, know your enemy. Our industry in cybersecurity has, since the beginning, focused only within our walls or firewalls. We looked at, well, what vulnerabilities, what issues do I have, so on and so forth. Anybody watch a World Cup? Oh, great games, great games. You're a coach in the World Cup. If you only focus on your players, what's your best defense play? What's your best offense play? What, what are the conditions of the field? You're probably missing something in your next match because you should really be understanding what the other team brings to the table. And we haven't done that in cybersecurity. We have to start doing that because it allows us to be more efficient, more effective, and we could allocate our resources better. We can't peanut butter across anymore. We have to focus. Military has learned this for decades, or hundreds of years, back to Sun Tzu, in fact. 3rd, we're trying to run a race with a Toyota Corolla, and the enemy has just jumped in an F1. We have to change the tooling. We have to get the same tools or something comparable, which means we have to embrace AI. They have the advantage, by the way. They don't care if it works completely, if it breaks something, they can just jump in at its current state. We have to wait. In security, we can do no harm. It undermines the trust that we bring to the organization. Therefore, we have to have trustworthy vendors before we can adapt to it. But we have to move into this and work with them. And lastly, and we've talked about this a little bit, as security professionals, AI's coming. Yeah, we don't get to stop it. We can't try and block it. We can't be the office of no. We have to be a welcomed partner. Otherwise, we'll be the last to know. So we have to get over that. Governance requires cooperation. And the last thing I'm gonna go through here is really the accountability. Because out of all these things that are changing, the one thing that doesn't change is our neck is still on the line. We're still accountable for all of this. The customers, the business partners, the board, they don't care About all these other changes, you still own risk. So we have to adapt to that. So we have to be that partner. Without a doubt, we have to build our tools, processes, people, and everything else to continually adapt. If you think you can build a static system and go, it's built, I'm done, you're lying to yourself. This is moving way too fast, and it will continue to move. This fast. And lastly, and I'm going to close on this, this is for all of us in the room. We have to embrace this ride. It does not get any easier and it does not slow down. And there's a lot of people out there, they're at the end of their rope, they're stressed. So if you are not somebody that enjoys that ride, that is okay with ambiguity, that doesn't like chaos, this may not be the role because it doesn't get any easier. But if you are that person, oh, it's gonna be a good ride ahead. So, questions? I know I brought up a lot of stuff here. Question right up here in front. Wouldn't it be safe to say that there's a lot of AI tools available to help prevent these vulnerabilities from appearing to begin with? Absolutely. And by the way, we've had tools like that. We've been using them, SAST and DAST and all sorts of things, and yet still vulnerabilities get through. There is an inherent race condition, if you will. We need to get the product out as fast as possible. Do scans, but it needs to be done in 2 hours. The same business limitations are there, and we have to reset those. But yes, we are seeing— and this is why Microsoft released patches for over 600 vulnerabilities in this last cycle— because they are using Mythos and other products to find more. But every time they look, they're getting more, and these engines are getting better. Since Mythos first came out, it's already had 2 major revisions, and what it finds is even more every time, and it finds it faster. Do we have an online question, perhaps? All right, they're asleep. All right, we got more. Oh, the indomitable Edna Conway. Yes.
It's not so much a question as I want your opinion on something. So, You and I have talked about, at the end of the day, while we embrace the technology, we believe that the humans are the solution as well. So what I've been doing is I've been getting a lot of Celeste-like folks in my life who know that, you know, I sit on boards. And they found really great ways to do all kinds of cognitive research and set up just the perfect board seat That it's amazing that they're looking for somebody with my bizarre background, right? So what I've been doing, and I've had a lot of success, and I want your opinion on this, and I'd love to encourage people to do this. When I realize what's going on, and, you know, you and I might be a little quicker at figuring out, but many in this room can do it. I actually contact the company that they have. Claim that they are part of. Many of them boldly use the names of people in the particular field and/or on the board. I contact them, and then I contact the local FBI agent, and I sic all 3 of them on, on them and gleefully send them a message back that says, you will be hearing from the following 3 communities, and I appreciate the fact that you gave me ample evidence to come after you. Try not to do this with somebody who's as smart as me next time.
Setting aside the glee that you experience from this, and that brings up a really important point, right? Our industry is already stressed just to achieve the deliverables we're on the hook for now. For us to move forward and be able to adapt to things like this, Sometimes it needs a gentle nudge. Sometimes it needs an Aetna nudge. But we're not— and it's really tough for organizations to be able to justify— we need to do this now. But we have to find a way because the people in this room and on the bridge, we are the experts. And what it's really going to take and what Aetna does really, really well Is she translates that cyber risk and puts it in the context of business value? Because the moment you do that, now you have your C-suite attention. You now have your board attention. And it also travels downwards. You now have your product line management attention and everybody else. That is a skill that we're going to have to do and apply. To make sure that we are moving our industry. We can't stay stagnant. Everything I've shown you today, it's gonna get worse. That's today. What's it gonna be like tomorrow? So we have to move and be in the mindset of moving and upgrading and adapting to the risks that present themselves. And if you can do it ahead of time with foresight, you will have an advantage. Thank you, Matthew.
