Why AI Is Rewriting the Rules of Cybersecurity on The Top Voice Podcast.

Hello and welcome to the Top Voice Podcast. It is January 27th, and I'm excited to have Matthew Rosenquist on with us here today to talk about— we talk about AI a lot on this show. It's a big topic, but we're gonna talk about the other side of the equation, which is the, the impact on cybersecurity. And there's, there's nobody better positioned to talk about that than Matthew. Matthew, I'm gonna give you a chance to introduce yourself here in just a moment. Uh, for those of you that are listening in and watching in on the live stream, please do let us know where you're coming in from, leave a question or a comment. We already got some questions before the show even launched, so we're excited to pick those up from people that are interested. And for those of you that are listening, please be sure to subscribe on your podcast platform of choice. It's the best way to support the show. So Matthew, uh, we met last year, uh, at a— here's the other unique thing, there were two top voices happen to live in Folsom, California, which is the most ironic part, we met in person, but we're on the screen today to talk about your background and what you do. So share that with us a little bit before we dive into this conversation around AI and cybersecurity.

Well, thank you. I'm a CISO, I'm a cybersecurity strategist. I've been in the industry about 36 years. I did 24 at Intel and I advise governments, academia, and businesses all over the world specifically about emerging threats and industry best practices, the evolution of those best practices in cybersecurity. So I also intersect with disruptive technology and privacy and ethics and all sorts of other things. And every year I produce cybersecurity predictions. So I recently published my 2026 cybersecurity predictions and it is drenched with AI aspects in it, can't get away from it for 2026.

Yeah, so let's talk about it. We look— the conversation about AI, everyone is, is rushing to the opportunity. It's a bit like the 6-year-old soccer game where everyone's chasing the ball, and for good reason. There's a lot of upside, but there's a lot of, of implications. And so let's, let's maybe start with, I think, the most obvious. What, what is the fundamentally the most different aspect of the cybersecurity world now that AI has taken the hold that it has? What's, what's different from the past?

Well, if we look at it, right, AI is just a powerful tool, a really, really powerful tool. And what we see is we see businesses and organizations embracing AI, rushing. We see a rapid development and implementation of this disruptive tool. And that brings with it vulnerabilities. It brings with it a sense of urgency to get the next version out there. And when you see that and experience that, typically security is not ranked very high as a priority when we embrace technology like that. But then we also have to look at this powerful technology the attackers, right, our adversaries are using it. And maybe it's a nation state, maybe it's your business competitor, and most certainly it's cyber criminals. They're using every aspect of this very powerful tool to help them get to their objectives. So we're seeing all sorts of churn in here with more vulnerabilities and more capability on the attacker side, which elevates the risk.

Yeah. The— let's talk about the capability piece. I was, as you were describing that, I'm certainly, I, I work independently now, but in my days in a corporate world, we'd have our cybersecurity training. It's your 30-minute web-based training once a year. And here's how to recognize a Nigerian, you know, Ponzi scheme scam or a phishing attack. And there's always a little word misspelled, some kind of funky thing that makes it easy, but I imagine it's getting harder because the capability of AI to mimic real communications has just— so, so what's the difference in capability? Is it just speed? Is it scale? Is it something more?

Yes, yes, and yes. So typically, especially when we talk about social engineering, but also even technical hacking, right? The attackers typically had a choice. Either they could go really broad, target lots of people, but it's going to be very generic, right? Or they could focus in on a particular organization or person and make it much more personalized. Right. You know, make it more bespoke and have a greater effectiveness. So they were tended to decide somewhere on that spectrum where they wanted to be. The functionality of AI, and if you think about LLMs and how well they communicate and how accurate they are and the fact that they're multimodal so they can generate images or video and great text, very compelling text, right? We have these systems that can give the attackers both. They can make highly customized, very effective, very compelling types of attacks. Do it very quickly, and then make that broadly available to a massive target space. And we're seeing that. We're seeing, you know, a complete divergent Korean where you've got spelling errors and it's kind of obvious because the prince is contacting you. We are seeing highly complex, very rich information. So these systems are going out to your LinkedIn or your Facebook or, or whatever social media, grabbing information about you. Understanding that and then creating a narrative that would be very compelling for you to read, for you to click, for you to believe. And they're doing that at scale so they can hit 100,000, 200,000 people a day. And that is fundamentally different. That is empowering to these attackers. That's what they've been waiting for.

Yeah. Wow. Well, you know, you scared everyone. So that's good. We've, we've, we've started out with the fear equation. A bit. I, I would love to get some maybe examples of these in more depth. You've shared them generally, but you've probably— you've probably got a million stories of these kinds of experiences. And maybe let's, let's start it at the corporate level. You don't have to use names, but what's the most kind of recent or, you know, impactful event that you've seen at the corporate level that's made it through the firewalls into something pretty damaging? We— I think we'd be curious to know what it really looks like?

We're seeing huge things, right? So we're seeing on the social engineering side, again, this whole new wave of impersonation attacks, right? They use various cognitive vulnerabilities, whether it's urgency or appeal to authority, all these kinds of things. So we're seeing attacks where it's impersonating other executives, maybe your boss, your boss's boss, the CEO. And so we're seeing a lot of those in the BEC attack, right? The business email compromise. It's really just fraud. Right, but impersonating somebody of authority. We're seeing other attacks that are, you know, you've got attacks that are appealing to the lovelorn out there, right? So you've got these attacks that are, you know, somebody that's luring you in with favors or attention or whatnot. We're seeing people click on those. We're seeing malware being distributed. We're seeing attacks that are representing financial institutions. Hey, you know, your account has been compromised or we need this, please log in. And that leads to a whole nother string of gathering your credentials or your personal information. We're seeing all of those. So we're seeing losses, we're seeing access. The other aspect away from social engineering, just the technical hacking, we're seeing these AI systems very rapidly go to task. To evaluate software or systems or cloud environments to identify new vulnerabilities and then automatically generating exploit code to take advantage of those, to hack. And we've seen several of those with very large companies where their latest update, their product, whatnot, vulnerabilities were identified and then attacked. And just to add extra fervor to it, these AI systems can actually do orchestration. So it isn't just the initial, I'm taking advantage and I got through your front door. It's the next step after that and the step after that. I'm going to elevate my privileges. I'm going to go left and right. I'm going to go to these other systems. I'm now going to, you know, make myself stealthy, right? And tough to evict. Now I'm going to go look for data and now I'm going to exfiltrate. The AI system does it at machine speed.

Wow.

And it used to be once the attacker could kick in the front door and get themselves into your network, it then notified the attacker and saying, hey, I'm in. And the attacker would sit down and would manually do that. It became a race between security operations to try and contain them and the bad guy to try and get where they can and dig deep so that they couldn't be evicted. Now they don't have to do that. It's not a manual process. AI takes care of that for them.

Wow. This is fascinating. I want to talk about the other side of the AI protection coin because I'm assuming it works in the other direction. But before we do that, I'm curious about maybe the ethical piece of this. We had an episode last year with Lukas Erb around ethical AI, and so much of what we talk about out with personal usage of AI. And we've seen some of the really tragic stories of AI encouraging, you know, really, really bad behavior, bad actions on the part of the user. But, and, and so this debate about how much is pre-programmed into an AI language model around ethical behavior— what you're describing is fundamentally unethical behavior on the part of a learning language model. That's breaking into something. How does that work? Is that a thing? I mean, there's no built-in precaution that an AI knows I'm doing something I shouldn't be. It's just executing actions.

Well, you can program guardrails into AIs, right? To trigger tripwires to say, oh, I'm not going to do this. I'm not going to communicate how to build a nuclear weapon right in your bathtub. Right. Little things like that. And we've had guardrails like that, whether it's in materials that are being published in newspapers or in books or whatnot. So we do have some general guardrails that you can put in place. Now it's up to the vendor to decide if they want to do that. But let's get back to the ethics question, because this is really, really important. Ethics is really a matter of perspective. And I'll give you an example. AI is just a tool, right? I could build a perfect hammer that we could create homes for the homeless with, right? And that's a perfect benign tool. But then somebody could take that and hit their neighbor's head and that's a bad thing, right? Is the hammer unethical? No, it's how you use it in many cases. And now let's take that back to AI and attacking those vulnerabilities. By the way, AI tools are looking for vulnerabilities so attackers can exploit them and do damage. But those same tools, the exact same tool, can be used by the security professional so that we can find the vulnerability before the attacker does and that we can patch it to make users more secure. So is the vulnerability scanning, the AI-powered vulnerability scanning tool, is that unethical? Well, it depends on how you use it, right? So the conversation has to have more context. We cannot simply state AI is unethical because it found a vulnerability. We have to look at the greater context to understand the ethics behind it.

Yeah, yeah. So let's— this is fascinating. I was thinking about that as you were saying it. It's sort of, could, could AI stop itself from taking an action because it knows it shouldn't be doing that? And maybe we'll come back to that. You talked about the other side of the equation. Let's talk about the good guys for a minute. So people— we spent 13 minutes talking about the bad guys, and people want to know that there's hope in the world. So What, what's changing on the protection side now? I would imagine it's just as sophisticated and maybe even more so now. And it's a, it's sort of a battle in cyberspace for who's wielding this tool the most effectively.

It is a battle. It's an arms race, in fact, because again, AI is just a really powerful tool. Now, the attackers get the advantage because they can grab AI, even if it's half-baked, and use it. And if it breaks, whatever. And they'll change it and go again for another round. The defenders, we know we have to use AI predominantly to counter that massive scale and quality increase that the attackers now have. So we need AI-powered defensive tools or cybersecurity tools. But we're at a disadvantage because we just can't grab half-baked tools and put them in our environment. They could bring down our environment. They could be introducing new vulnerabilities that could be exploited. So we have to be much more careful. And so there's a lag, there's a delay between how fast the attackers can use innovative tech and disruptive technology versus how fast the defenders can use that same technology for our benefit, our security, and our protection. So, you know, in my predictions for 2026, I estimate it's probably going to be around Q3. So between now and Q3, the attackers have a distinct advantage. They can use all these AI tools and the defenders are trying to defend against them manually for the most part. And it's a losing proposition. They can't win. They just can't win. Right. But when we get to about Q3, we will have enough satiation of these AI tools that the defenders can now much more effectively defend against the AI-powered attacks. So it's a matter of time. Yeah, but my industry, the security industry, is trying to move as fast as humanly possible to get machine-powered tools and technologies in place.

Yeah. What, what role do— does government and government policy play in this, if at all? I know that the The current approach to AI has been to take the gloves off and let things go as fast as they can. And there's, there's this, there's this arms race across nations with us and China and other places that are trying to get to superintelligence first. We've also had discussions about that. We'll just save that for another time. It's a whole different conversation.

That's a whole different beast we're talking about, but yes.

It's, it's a whole different thing. So, so what I hear you saying a little bit is, and what I've seen for myself is that companies are really fighting this battle on their own. They're taking the steps, they're investing in cybersecurity. What role does a broader kind of governmental or global policy role play, if at all?

Yeah, for most of the regulations, especially the ones we see in the United States, they are very reactive. So when really, really bad things happen again and again and again, people connect the dots and they decide, okay, let's, you know, contact our lawmakers, let's create a law, let's You know, and there then becomes that debate, the trade-offs. And then finally we get something that's put to paper and we say, okay, in a year's time it'll be active to give people, you know, time to adjust to it. And so it lags quite a bit. Now, that's not true in all cases. You know, the EU has created, and so have other regions, China has done the same thing. They've created laws realizing, hey, this is going to be a problem. Let's at least set some broad guardrails that we don't want people, you know, to go beyond, developers to go beyond. And these are really, really geared towards the companies that are developing, hosting, managing, and to a lesser extent, to the people using AI tools that are legitimate, that do want to follow the law. Again, the problem is many of the attackers don't care about those regulations. So they're not burdened by them. And the technology, especially with AI, is very open. It's very distributed. You can go out to get and grab all sorts of different things and create your own. And that's very unique because up until now, most software companies wanted to keep it proprietary, right? Their ideas, their concepts, their models, very proprietary. So it was tough to duplicate things. Now it's more easy to do that than ever. And there's tons of research that are openly available so anybody can spin up an AI and train it themselves in an afternoon.

Yeah, that you just mentioned anybody. Maybe to go back, who, who are the attackers? Are they groups? Are they individuals? Is it a kid in his mom's basement? Is it a nation state? All of the above? Who are these groups?

It's all of the above. So I'm part of a group that basically creates and has created a model of archetypes, right? And right now we've got about 26 as part of our threat agent library. And some of them, there's a whole group of them that we would consider internals, right? Think disgruntled employee, think an untrained employee, think an employee that knows security, but, you know, their project is more important, so I'm going to skirt the rules of the company, of course. Right. We've got a whole other subset, almost 20 of them that are external. And think of this as data miners, cybercriminal, you know, various nation states that are trying to, you know, exert power. Each one of them have their own objectives, their own capabilities, their own targets, their own methods. So we've got a very broad range, everyone from terrorists to an accidental employee that's just simply untrained. So some are malicious, some are not, but they all represent a threat and can cause loss. AI, again, is a tool. So people are going to be using AI across this entire spectrum to pursue their objectives. Right. And we see that. We see data miners, we see vulnerability, you know, experts and researchers, definitely cyber criminals. They're the first ones to go in. And we have states who have the biggest bankroll for research and development and to grow their staffing and their intellect in this space. They're the big players as well.

Wow. It feels like a never-ending battle, I'm sure, just given what you've described. How much, what are the industries that maybe represent, I think we'd know the obvious ones, financial services, banks, healthcare, there's a lot of data. What are some of the other industries where this is maybe more prevalent? Are there some where it's a better target than others?

Well, the risks are prevalent across everywhere, but given the most powerful attackers, right, which are nation states and cyber criminals by far. Those two represent the highest level of risk. They tend to go after critical infrastructure and any organization that has a lot of money or financial resources because that's what cyber criminals are after, right? Personal financial gain is their goal. So they're looking for anywhere they can make money. The nation states typically target critical infrastructure, and so do cybercriminals because people need critical infrastructure. So they're willing to pay, especially for outages or ransomware, things of that sort. So critical infrastructure, you've named a few, right? Telecommunications, healthcare, finance, critical manufacturing, government services, military and the military-industry base. Right. Those kinds of things. Transportation logistics, all of those things are critical, critical to economies, critical to governments, critical to society. And so impacting those has a detrimental effect that is very noticeable. And typically those organizations need to come back online even if there's a small disruption. So that gives leverage to the attackers for what they're doing. And whether it's, again, political gain, whether it's part of warfare that they're conducting or if it's simply, hey, they're, you know, they want more money, right? It's— they're motivated by personal financial gain. Regardless, those are all great targets and we're seeing them impacted.

Well, I want to talk about what us as individuals can do before we wrap. We're getting kind of close to the end. We could keep going. They— we got a question. I got a question when I posted the event about the relationship between the kind of this topic in a company's brand. And it was someone who worked in the brand space and works in brand identity and visual identity. And, and because so much can be mimicked and impersonated, there was a question, or I guess a tension between the sort of authentic expression of a company's brand and who they are and the communications they put out and, and the ability for those things to be copied, affected. I have a good friend of mine who just kind of went down a rabbit hole with a job application for a company that was not— it was a real company, but somebody had created a separate mimicked architecture to collect personal data. How, how does that— I understand technically how it works, but I'm curious about what you tell to CEOs and senior leaders on the sort of the brand side, maybe the qualitative side of the brand experience, and what Is that something people are thinking about or is it just too far down? We're just trying to stop the bad guys at the front door. I'm just curious what that looks like from your point of view.

From a brand perspective, right? There's a different conversation about how not to be victimized, but from a brand perspective, uh, it's still a little squishy, right? You've always had to worry about impersonators and counterfeiters, right? We've, you know, Gucci bags and Rolex watches, right? So that's not new. And if you have a digital presence, that's exactly the same thing, right? Spoofed, you know, web pages or domain names, all that. Those have been around for a while. However, the quality, the depth, and how well it's convincing, right? The level of that is much higher with the AI tools. So companies are going to need to defend their brands better. And then there's also reputation with brands. So, you know, we've had a couple of, you know, the big four consulting firms get caught using AI to generate reports for their clients that were hallucinating. And their clients are wondering, why are we paying so much when you're just using an AI engine? We could do that. Right. And so there's been reputational and brand damage. Because of the overuse, overreliance on AI without it being integrated with the proper checks and balances. So there's brand issues with using AI tools. There's brand issues with attackers using tools to undermine or to leverage your brand, which can, you know, lower it to do bad things. There's a lot in this space and we're just starting down that path. Right now it's about, I'm going to impersonate your web page, maybe your domain. Later on, it might be, I'm going to impersonate your CEO and make a video, do a news announcement. I'm going to do all these other things. I'm going to fake how your product killed 10 small children over here. Well, wait a second, right? Now they can use that to extract. And again, it's going to get much more complex. And we can't see how that's going to happen. It's only limited by the creativity and the greed of the attackers. And those are immeasurable.

I, as you're describing that, I will tell you, I, I can spot an AI-generated social media post from a mile away. And I find myself, I've done a few and I'll admit, I said this last year, I did a post where I got caught up in kind of trying to chase the volume equation. And I stopped myself and I self-reported, and I was doing a LinkedIn post and said, hey, I got caught up in this. And I said, I'm not going to do it again because I just, I can see it. And what I find myself, this sounds, I'm not being judgmental. Maybe I am a little bit. What I find myself is when I see the post, particularly the architecture and structure of the language, you can tell it's AI-generated, short sentences stacked on top of each other. There's a lot of juxtaposition of language and these sorts of things., and I think about the person who did it, and I'm sure that their idea, this original thought they had, started the conversation with the AI, then the AI generated the post. And I read it and I find myself thinking, I, you're making a good point, but it's kind of tainted by the fact that I didn't think you made it all the way. And I was thinking about that with companies of how much could it be that like this Big Four comment, you know, how much does the consumer now look at some of these experiences and go— and I'm kind of taking you out of the cybersecurity world a little bit— but to say, like, how much of that starts to taint things? And if criminals are taking advantage of that, well, I can get real brand damage because I'm, I'm, I'm taking consumers on a different journey, if that makes sense.

Yeah, it it always creates a risk. And from the security, I'm worried about impersonation, but there is, or synthetic identities, because you can create someone new and have a social media account and gain influence and do bad things that way. But this whole, I'm going to use AI, and I don't do it myself. People have to suffer with me and my post because I just won't do it because I don't believe it's authentic. But just because I don't doesn't mean that a whole bunch of other people do. But that's kind of always been the case, right? I mean, even before LLMs came into fashion, you had companies that would hire out their social media page and make posts on behalf of the CEO, right? It wasn't the CEO typing in Twitter. It was this marketing agent or somebody in the marketing department doing that and managing their social profile. Is that not authentic? Well, it isn't. It's not the person that it says on the profile, right? You know, images, AI-generated images.

There's a lot, there's a lot of panic about that, especially in the movie industry. That's been a huge thing now.

But wait a second. Temper that for a moment. Because if you go in the years before AI-generated images and you picked up a magazine, every single image was Photoshopped. Every single one. Unless it was a documentary, right? And we were okay with that. We're probably also going to be okay in a short period of time with AI-generated images. As long as in our mind, cognitively, we don't trust it. And when you pick up a fashion magazine, do you really trust that's what, you know, Margot Robbie looks like when she gets up in the morning? Probably not. We already know that. We assume that. And so it's okay that it's this beautiful picture of Margot Robbie, right? We know we're going to have that same level of critical thinking at some point. When it comes to AI. We won't believe our eyes, we won't believe our ears, and we won't believe necessarily what we read. And the same thing is true with books, right? Someone's— a buddy of mine was talking about how this is horrible that AI is generating content. And I said, well, it's kind of like a ghostwriter, right? I mean, people write books and just go through ghostwriters or write an article or write a paper and go through ghostwriters. That's been around for a very, very, very long time. And he was— he's also a ghostwriter, so it's kind of funny. So I was picking on him and he's like, yeah, but it's not real. And I said, but a ghostwriter isn't the real author either.

Yeah, yeah.

Okay, so let's just temper it. I'm not saying it's okay, and especially if you're passing it off as authentic, it definitely is not ethical. But again, let's, let's kind of temper it. Let's get out of the panic and actually look at it and see the other structures that we have currently in the world that we accept that are very similar.

Yeah, yeah, no, it's a really good point. And I think speed and scale change the equation. We make it, makes it feel bigger than it is. There's a comment in the chat here and we're just about at time. So I wanna make sure we end on time. I have another question for you. And it was, it says, at some point, do we admit that Western cybersecurity model has facilitated intellectual property theft of Americans for decades? Do you have a perspective on that?

Yes, it has. There's been a massive drain of intellectual property, and that's one of the things in cybersecurity we've tried to protect. So you're talking about trade secrets for the most part, right? You're not talking about things that are, that are out there and you've got patents for because that's public. You're talking about trade secrets, anything that is confidential that you don't release out. That has been a problem. And again, we've embraced technology, innovative technology, the internet, Cloud, all that, which is open up vulnerabilities to allow that valve to be opened even more. But at the same time, it has provided great value, creating more intellectual property. Without those tools, it wouldn't have been possible. So there is tension in that system. Now, unfortunately, AI will continue to be a powerful tool for the attackers who are looking for that, that type of sensitive or confidential information, including trade secrets, including privacy information, healthcare, finance, all those kinds of things. Yeah. AI will help discover those vulnerabilities to get into those systems. AI will help the social engineering to be able to get to credentials or simply get information from the end users. There's, you know, so many different ways to get that. AI will be a catalyst. It is a powerful tool for the attackers who are pursuing that type of objective. And again, in the first several quarters, they are going to have a massive advantage over the defenders. Hopefully by the end of this year, it'll start to even out. They'll still have an advantage. It'll just be less so.

Yeah. So, so how do we— maybe last question before you get to your bonus question, which is always my favorite part of the show. How does the average per— what does the average person do in terms of how do they protect themselves and how do we take some power back in this world of kind of continuous threats?

Well, you know, we have to innovate and keep pace with the attackers. And right now they're using a very, very powerful tool. We're trying to do that as well. So we have to shorten that. And, you know, when they discover a vulnerability or exploit exploit it. Again, we have to shorten our ability to quickly detect and quickly respond, recover. That's part of resilience. So we need to start integrating and embedding these fundamental principles in the architecture, in the design, development, into release, into post-support, everything around these beautiful, wonderful technology tools that are enabling us and helping us advance as societies and economies and everything else. We want to embrace those, but we also want to make sure that there are certain guardrails to protect us from really, really bad, you know, security and privacy things and safety things out there. We know there will always be some risk, and that's okay. Every day we live our lives with risk, but it needs to be understood and managed to an acceptable level. So we want to go fast with AI, but we want to have the guardrails in there to protect us from really, really bad things.

Yeah. Yeah. It's this speed and resilience topic, I think, even for individuals. I mean, I remember when we had lunch, we have a comment in the chat I want to get to before we go because she, this individual actually disagreed with you. So I want to get your take on that is I remember when we met for coffee, my first thought was, oh my God, I got to go take every piece of data off my computer. I'm never going on the internet again. I'm sure that everything's been stolen. Uh, you know, are there some fundamental things, I think, maybe at the, at the more practical level that we should do? Should everyone have a firewall? Should we all be using VPN? Should we not use our phone? Stop, you know, sending messages in the group chat? Like, what, what do we do that seems just like, like, what's the biggest step we can take, just practically speaking, in our daily lives?

So in our daily lives It's really about common sense. It's really about critical thinking, right? And again, we have to transition. We're seeing audio and video and images and so forth being flooded. We have to move to a mental position of going, I'm not going to trust it. It used to be you could trust a picture, you could trust a video, or you could trust audio voice or something like that. We have to get to the point, just like those images in the magazine where we go, we know that isn't real. It's okay, I want to see it, but we know it's not real. We need to have that same level of mentality when we're on a video call, when we're getting an email or a message, when we're hearing someone's voice, when we're seeing a video. We have to have that same level of, we're going to question the accuracy, the validity of it, whether it's really true or not. And even if it's a real person, you can make a real person say something they never said.

Yeah.

Do something they never did. So we have to build that into our psyche because this world is not going to change. Right. And the attackers will always use whatever tools that they can to manipulate. They always have. They always will. So And I see where the disagreement— and I love it because they call out China as a big threat. So for those that don't know, again, cybersecurity has been trying to protect intellectual property since the digital world emerged. China is the number one aggressor when it comes to that, in harvesting intellectual property, in stealing secrets and whatnot, and using it in their environment and technology, they've been the number one threat and they continue to vacuum up massive amounts of data, even encrypted data. They're just, it's like a vacuum. They're sucking it all in. So we have to continue to treat that understanding how the AI-powered digital landscape is constantly changing.

Yeah.

And as a nation-state actor, yes, they are absolutely using AI in every aspect. To continue to pursue their objectives. So the objectives don't change. They're going to use the most powerful tool possible right now. That's AI and they're investing in it.

Yeah. Yeah. No, I think that's a great spot to end on. We could keep going, Matthew. You know, there's no question why you are doing the work you do. Your expertise, your perspective, your breadth, your depth is really, really impressive. Before we let people know where else they can find you, as I mentioned, we have a bonus question tradition on this show where the last guest leaves a question for the next guest. It's a tradition I shamelessly stole from one of my favorite podcasts. So, uh, I'm— we're asking you to look back on your own career journey now. Um, what was maybe a necessary evil that you would keep along that journey? And maybe what was a mistake that you'd avoid if you were starting over from zero again today?

Oh, so I'm a big believer in critical thinking, right? In understanding fallacies. I teach them to my children, which their teachers and their friends hate. But, you know, understanding when somebody is making an argument that it could still be true, but they're not using valid reasons or argument logic structures. I think that's something that I would have promoted even more with everyone around me and myself if I could have learned those. And I learned those early on, you know, through argumentation, even in junior high school and high school and all that. But learning that and applying that more, I would say that's one area. And the other, especially when it comes to cybersecurity, is making sure we understand our our adversary, because my industry has grown around the technical, right, with the rise of digital technology. And people unfortunately believe it's a technical problem. Well, if it's a technical problem, it can be solved with technology and it can't. Right. There is a living, breathing adversary. And if we go back several thousand years to Sun Tzu, he said it right. Right. Understand yourself, but understand your enemy as well.

Yeah.

And if we only look at our technology, what our firewall rules are, what our— we are missing one of the most important aspects: who we're facing, what their capabilities are. So we have to know our adversary. That's the only way we win.

Yeah, I think that's great advice. That's great advice. Matthew, where can we, uh, find you, follow you, learn more about you, see your predictions? I'm sure our guests would love to read more about what you're talking about.

You're welcome to follow me on LinkedIn. So I've got a few followers out there. I publish, you know, all my information out there. I have great conversations. I respond to messages and questions and have great debates. I truly believe, especially in cybersecurity, even for us to keep pace with the attackers, we have to communicate, we have to collaborate. So I try and foster a very good community in constructive debate about all these different things. The other thing is I've got a Substack. You can find me on Medium, pretty much, pretty much anywhere where there's good constructive discussions. I'm not on the other sites where it's just trash and debate and all that, but on the professional sites, yes, you'll find me on LinkedIn, you'll find me on Medium, you'll find me on Substack. Please join me and let's work on making our digital world safer and more secure.

I, I couldn't, couldn't agree more. Matthew, thank you for being on this week. Thank you for sharing everything that you did. As always, for folks listening in, thank you for being a part of this community. We're off to a hot start in 2026 and happy to have you join us. Please do subscribe, whether it's on YouTube or your favorite podcast platform. And as I mentioned last week, we're in the midst of building a little premium subscription that we're gonna launch with more episodes, more guests. And some new twists and turns as well. So please be on the lookout for that. In the meantime, thanks again, and we'll see you next week on the Top Voice Podcast.