When Trust Becomes a Trap

“I think the biggest risk to humanity today with this is the severing of human connection in preference to an AI.” - Sherrod DeGrippo Share on X

Most people use technology all day without giving much thought to what is happening behind the screen. We trust routers that may not have been updated in years, depend on internet systems few of us understand, and now turn to artificial intelligence for everything from travel plans to home repairs. That convenience comes with tradeoffs. In this episode, we look at the weaknesses built into our connected world and what happens when our technical knowledge fails to keep pace with the technology surrounding us.

Sherrod DeGrippo leads threat intelligence for Unit 42 at Palo Alto Networks, where she oversees teams working to identify and respond to increasingly complex cyber threats. During more than two decades in information security, she has held senior leadership roles at Microsoft and Proofpoint, along with positions at Nexum, Symantec, Secureworks, and the National Nuclear Security Administration. Sherrod was named Cyber Security Woman of the Year in 2022 and regularly shares her expertise at industry conferences and through outlets including BBC News, The Wall Street Journal, CNN, and The New York Times. She is also the author of *Threat Driven Software Development: Defending Modern Online Services“.

We discuss how outdated home routers become tools for criminal and nation-state attacks, what could happen as technical knowledge disappears, and why foundational internet systems may be more vulnerable than people realize. Sherrod also explains why the greatest danger from AI may not be a dramatic technological disaster, but the gradual loss of human connection as people choose frictionless answers over real conversations. Along the way, she shares practical examples of where AI genuinely helps, where its limits become obvious, and why slowing down still matters when emotion or urgency begins driving a decision.

“Don’t fool yourself into thinking you’re an expert just because you have ChatGPT. You’re not. But you could get basic.” - Sherrod DeGrippo Share on X

Show Notes:

• [01:48] Sherrod introduces herself and traces her 23-year career from government network security to threat intelligence.
• [03:00] An early lesson in buffer overflows sparked a lasting interest in both hacking and protecting systems.
• [05:10] Growing up around AT&T gave Sherrod firsthand experience with telephone networks, copper lines, and beige boxing.
• [08:17] Technology has shifted from something people opened and explored into consumer devices few people truly understand.
• [11:24] As technical knowledge disappears, the people who understand how systems actually work are becoming increasingly rare.
• [13:41] Older internet users often understood where their data traveled, while today’s devices constantly communicate in the background.
• [16:22] Network security remains critical because once malicious traffic reaches a device, the problem has already become much larger.
• [17:57] Outdated home routers provide an attractive attack surface for criminals and foreign governments.
• [20:12] The conversation turns to the fragility of DNS, internet protocols, and the systems supporting the global network.
• [22:13] Chris shares his experience with denial-of-service attacks and seeing legitimate online services exploited by malware.
• [25:48] Sherrod explains why AI’s greatest danger may be the gradual loss of human relationships rather than a dramatic physical threat.
• [29:23] AI works well for tedious tasks, but human connection, creativity, and judgment should not be handed over so easily.
• [31:35] Living intentionally means deciding what experiences matter instead of allowing technology or other outside forces to decide for us.
• [34:10] Frictionless technology may leave people more vulnerable to scams by training them to expect immediate and effortless results.
• [35:33] Social engineering uses modern tools, but manipulation, espionage, and theft have existed for thousands of years.
• [38:14] AI may eliminate certain jobs while also giving people more time to focus on customers, relationships, and other human-centered work.
• [40:44] A furnace repair shows how AI can guide basic troubleshooting and reduce the need for some professional diagnostic visits.
• [43:08] AI can help someone become competent in many areas, but having access to it does not make anyone an expert.
• [45:44] Used intentionally, AI can remove unwanted planning and create more opportunities for people to spend time together.
• [47:18] Strong prompts, detailed skill files, and personalized instructions may become more valuable than traditional prompt engineering.
• [49:10] A gift card scam demonstrates how fear and urgency can push someone to ignore repeated warnings from others.
• [51:30] Sherrod advises pausing whenever a strong emotion begins driving an unusual financial or personal decision.

“We’re moving into this place where consumer electronics really are consumer, and they’re not something that newer generations understand at depth.” - Sherrod DeGrippo Share on X

Thanks for joining us on Easy Prey. Be sure to subscribe to our podcast on iTunes and leave a nice review. 

Links and Resources:

• Podcast Web Page
• Facebook Page
• whatismyipaddress.com
• Easy Prey on Instagram
• Easy Prey on Twitter
• Easy Prey on LinkedIn
• Easy Prey on YouTube
• Easy Prey on Pinterest
• Sherrod DeGrippo
• Sherrod DeGrippo – LinkedIn
• Palo Alto Networks Unit 42
• Threat Driven Software Development: Defending Modern Online Services

Transcript:

Sherrod, thank you so much for coming on the podcast today.

Thanks for having me, Chris. Good to be here.

Looking forward to our conversation. Can you give the audience and myself a little background about who you are and what you do?

Sure. My name is Sherrod DeGrippo. I have been in information security and threat intelligence roles for 23 years now. I just did the math the other day and I've got the back problems to go with it. I started when I was quite young. I was 23 and I started in government. I've always been sort of a computer nerd. I got my first computer as a pretty young kid.

I was just always really fascinated by secrecy and securing things and being able to talk. I started in network security, securing networks at the National Nuclear Security Administration. From there, I just went directly into vendors. I have worked at pretty much every large information security and threat intelligence vendor that there is. I love building products and helping organizations and people become more secure.

What was it about that spark that got you really excited about this field?

I think a lot of people in this world start stories like this. It's when I popped a shell my first time. I had a friend who I met on IRC and I've been pretty into tech stuff and systems. He said, “Do you want to get on my box? Do you want to get into my computer?” I said, “Yes, I certainly do.” He showed me how to do what's called a buffer overflow. I was able to walk through the steps to get a shell on his machine legally with consent as an exercise.

Once I did that, I was hooked. I was then talking to him saying, “Am I actually on your computer?” He's like, “You are in my computer right now. Anything you do, it's on my machine.” Ever since then, I've both loved that aspect of it and really been drawn to making sure that the wrong people aren't able to do those things.

That's fascinating. I noticed the phone in the background. Does that mean that you worked with, that you ever played around with the devices that would create the coin drop noises?

The blue boxes? I did start. My first ever tech job was at AT&T. I was 18. I did database repair there. I come from a heritage. I come from a telephony heritage. My father worked for AT&T and retired from there with 31 years. Then my stepmother retired from AT&T with 32 years. I always had a bell truck parked in my driveway, had a lineman's handset and would do what's called beige boxing.

Beige boxing is the boxes you see in the street. If you open those, they have big panels in them and you can clip in and get on the line of any phone. This is back when copper ruled the world. It's different now. Obviously, fiber rules the world today. I did a lot of that. I didn't have a lot of need to do blue boxes. That mimics the sound of a coin going into or the sound that the phone makes when you put a coin into a payphone.

Beige boxing actually allows you to do unlimited calls and listen in. I did that as a kid when I was a teenager. Probably not the nicest thing to be doing as a teen, but it was a different time. Eighties and '90s were a different time.

In our neighborhood, the boxes were green. They weren't beige. I remember that as kids, we would go find a big fat screwdriver and open up the boxes, get the alligator clips, and just go through until we heard someone talking. We never did anything, but it was like, “Oh, wow, we can hear the neighbors. Uh-oh. We better move on before they figure it out.”

A lot of times, those boxes weren't secured in any way. They didn't have locks on them, but a lot of them didn't even have the little wire clip on them, which was like a giant safety pin. You could squeeze it and just open it. Yeah, it was really different.

That's one of the things that I really learned at AT&T when I was 18 is how the global telephonic systems work with local exchange carriers, POTS, which is the plain old telephone service capabilities. The world is covered in copper wire still to this day. It is just surrounding us all the time. I love to chat, so that was important to me.

As a funny story, the house that I live in now has no copper, only has fiber, and I just got a text message from my mom last week that their phone carrier is discontinuing copper service at the end of the month. They're not going to have their landline phone anymore. They're like, “Nope, we're not providing copper.”

I had no idea that was happening. It is in the end of an era. For anyone listening who's younger, let me tell you, that's a big deal.

You're probably one of the few people that know this, is that most people today don't realize that with copper phone service, if you have an old-style phone that doesn't require a plug-in to the outlet, when the power goes out, you still have phone service.

The phone still works because it has low voltage coming into it over that RJ11 jack. That's another thing that I learned when I was a kid. When I was 12 years old, I moved in with my dad, and he was like, “You have to have your own phone line. I cannot have a 12-year-old girl on the phone all the time.” He taught me how to install phone jacks in my room.

I think I had eight. I just kept putting them in. I was like, “I need phones, just many phones everywhere.” When the power goes out, the phone lines still work because they have the low voltage coming from them. They usually have three or four days’ worth of power, but eventually,

the power in the phone boxes does go out.

Yeah, eventually.

Eventually, it does run out.

Hopefully, the generators kick on or the local utility solves the problem before that happens, but everyone who has a cell phone has no idea what we're talking about. Anyone who still has a cordless phone at home has no idea what we're talking about. Only those that had the, oh gosh, what did they call them? The coil phone cable that was about 20 feet long, so you could take it from the kitchen into the next room so no one could hear your conversation.

Super long cables, yeah.

That is such a far cry from what threat intelligence is today. Those days are of kids just connecting things doesn't really seem to be the case anymore. Or is it? Or do I have it totally wrong?

I think about the future a lot with technology. I think about where are we going? What's it going to look like? I think about what today is versus when I was in elementary school and middle school. Things really are different.… Share on X

No, I think that's right. I think about the future a lot with technology. I think about where are we going? What's it going to look like? I think about what today is versus when I was in elementary school and middle school. Things really are different. Things really have changed. There's a great scene in one of my favorite TV shows, Mad Men, where we can't spoil. It's a very old show at this point, where a secretary dies at her desk and she's very elderly and she dies at her desk.

Robert Morris, the great actor who plays Bertram Cooper, comes up and says she was born in a barn in the 1800s and she died in a high rise. She is an astronaut, meaning it's just a really moving scene because it really shows that technology and change through a lifetime is mind-blowing. Mind-blowing. I have something in my pocket now that can give me anything I want. I have more processing power than took us to the moon in my purse.

I have something in my pocket now that can give me anything I want. I have more processing power than took us to the moon in my purse. -Sherrod DeGrippo Share on X

I think about what that's going to look like for people in the future. I come from a generation that's very tinkerer. We would open our electronics. We would get screwdrivers, like you said. I mean, how many times have you opened a computer to upgrade memory or to put a new PCMCIA card in or, “Oh, I'm adding a modem to this.” You open the big metal case and you put the stuff in, you cut your hands all up.

I don't know people who really do a lot of that anymore. We're certainly not doing that with our mobile devices or our televisions. We're moving into this place where consumer electronics really are consumer. They're not something that newer generations understand at depth. I think that is going to make technologists, true technologists that understand how the systems work, more rare. We're not going to see people learning the ins and outs of it like they used to.

We're moving into this place where consumer electronics really are consumer. They're not something that newer generations understand at depth. I think that is going to make technologists, true technologists that understand how the… Share on X

I remember changing the processor on computers. There's no way that I could do that with my current laptop. If I open it, it probably destroys everything. Even if I could get to the processor, oh, there's what, 16,000 welds on it now or soldering? Glue, glue, glue, and gunk. It's just not even conceivable with today.

Right. I think I know there are people listening right now who say, “Hey, wait a minute. I still build my own machines.” You must know. Those of you who are saying that, you must know that you are rare. You must know that that is not the norm anymore. We're moving into a place where kids get technology and they have no idea how it works.

They don't need to. It's a device that they use the same way that I use the TV. I've never opened my TV. I don't have any interest in opening the TV, but it points to the thing that it works. But computers, we always have this customization capability, or we wanted more from it. We wanted performance or we wanted more memory or we wanted a bigger hard drive. We wanted all these things.

Those days are over, I think, and we're becoming more and more consumers of the technology without having to really know how it works. Those of us who do know how it works are going to be the last standard bearers of how the world is going to progress into the future.

We're becoming more and more consumers of the technology without having to really know how it works. Those of us who do know how it works are going to be the last standard bearers of how the world is going to progress into the… Share on X

Are even the people who make the technology going to become unsure of how it works with AI and we start having AI designing chips for us? Are we even going to know how they work?

That's an existential question that I wrestle with all the time. Are we cutting ourselves out too much? Are we automating too much to a point of ignorance or a point of lack of context? For myself, yes, I do see that happening to some degree. I worry about lack of knowledge, loss of knowledge, you probably know. We talk about the older programming languages—COBOL, FORTRAN—all these things from the past that a lot of our brittle systems still need.

Ada.

The people who built and designed that, many of them are retired, some of them have died. It's ancient. It's old stuff.

It was old when I learned Ada a couple of decades ago. We teach this just because it's required, just because there are ancient systems that run on it, but here it is 30 years later and there's still these ancient systems running Ada and everyone's like, “I don't even know what that is.”

Where are the experts that can work on it? There are fewer and fewer and fewer. I think that that applies to a lot of our networking technology as well. The backbone of the internet used to be something that people like me and hacker-freaker types were constantly working with and thinking about, understanding a traceroute of where is my packet going?

If I type into the computer, where does it end up and how does it get back to me? That's something that we were constantly thinking about. We were moving through like Hurricane Electric held part of the backbone. We always wanted to be on that one, like Hetzner. He wanted to know where your stuff was going and how it was working. A lot of that really isn't part of daily life of anyone anymore. A lot of technologists just don't have to deal with that anymore.

The flip side of that is the amount of traffic that is constantly going to and from our devices. Running whatismyeputors.com, every now and then, I will get someone who will be like, “I don't know what possessed them, but someone's 83-year-old grandma installs Wireshark or something like that on the computer.” All of a sudden, she sees all this traffic going to and from her computer and is like, “Well, clearly, a den of thieves have now taken over my computer,” not realizing every piece of software is phoning home. This is normal.

In some ways, it is a den of thieves because it's all ad traffic. A lot of it is surveillance tech that is operated by this kind of hive of tech billionaires that are now siphoning all of what you do. It may not be what we traditionally consider malicious traffic because it is commercial. Believe me, you've clicked to agree to it somewhere, I promise you. But it is, in many ways, exploitative.

But even if it's your Microsoft office checking to see if there's an update…

It's a ton of traffic.

There's a ton of traffic and people are rightly so like, “Oh my gosh. I didn't know that this was normal.” I thought traffic only went to and from my computer when I said, “Go do this,” but not realizing, “Oh no, it's constantly sending and receiving stuff all day long, every day.” Silence is not something that your computer does well.

No, no, it's constantly moving.

Which has got to be awful for people that are running security on networks.

Over the years, I've seen a really good job with network detection engineering. That was one of my focuses for many years. I think that ultimately, if you can't secure the wire, you can't secure information. Security on the wire is very important to me. If it gets to the host, by the time malicious traffic is on a host, you have much, much bigger problems than you may have thought or may have started with. I think security on the network is forefront, incredibly important.

Yeah, and I feel bad for consumers in the mix of all this.

I can't imagine.

Because probably 90% of the people listening to this podcast have a router. All their network gear was provided by their cable company, ISP, and likely it's at least 10 years old. If there were ever firmware updates being applied, that has ceased about six months after they installed the device. There's just these devices out there that are totally unmonitored, connected to high bandwidth connections. It's not the consumer's fault. We haven't been trained as network engineers. To me, I sit there and go, “Oh my gosh, the world is just ripe for vast amounts of compromised devices.”

It is really well documented that both Russia and China leverage American home devices to launch attacks from. They do that because it appears that they are coming from a standard residential IP address. The reason that is such a delicious and attractive attack surface is because of what you said. A lot of those routers have never been updated. A lot of them are provided by the ISP.

It's in their home, but they don't feel responsible for it. Many of those devices don't have security updates available. They're already end of life. Even if you said, “I'm going to really take care of this. I'm going to update my router. I'm going to make sure that it's secure,” there are not security updates available anymore because that particular router, as you said, they're like 10 years old or whatever it may be.

I do think if you have any technical background doing an update when you go home for the holidays or when you go visit the parents, it'd be great if you could run updates on their devices and, at the very least, a power cycle because most of that threat actor activity from China and Russia is not persistent. If you just power cycle it, it kind of gets them out for a while. They might be able to get back in.

That's something that's really unfortunate that there's a whole world globally, but particularly in the United States, we're covered in these really vulnerable edge devices in both residential homes and small offices, things like that. It's a problem and it is a surface that we definitely see threat actors using.

Does that surface keep you up at night?

The fragility of the global network and its security makes me nervous. I think we have dependencies on things like the DNS root servers and various other protocol-level services. How are they being managed? How are they being… Share on X

That keeps me up at night. The fragility of the global network and its security makes me nervous. I think we have dependencies on things like the DNS root servers and various other protocol-level services. How are they being managed? How are they being maintained? Are we in a place that we're resilient? I think about that a lot.

Getting into a tangent, which I really love and some people will understand it and some people won’t—that's OK. It's fun to listen in over here. I have been for years and probably decades surprised that there haven't been absolutely masses or maybe there have been. I'm surprised that the DNS root servers haven't gone down. That's kind of like this is where the yellow pages gets the yellow pages from for users.

Yes. If anyone is particularly nerdy enough and interested, I did a full podcast about this topic. It's called Forest Blizzard. You can just search my name shared to group of Forest Blizzard and you'll get it. It'll walk you through how DNS works and how the root servers work. I do think quite a bit about those ports, protocols, and services that are based on the design, like BGP and things like that, that are based on the design of how the internet is made from its most core foundations.

Somebody owning the root servers could be catastrophic. A friend of mine, Danny Adamitis from Lumen Networks, always tells me like, “No, no, no, Sher. The people securing those are really good. They're really good.” I'm like, “Yeah, but I know tons of really great security people who have been through horrible incidents. I don't know. I don't know.” But I do think that the global networks are fragile and that's part of the reason that I do the work I do and that we all do the work we do in threat intelligence.

OK, I run a maybe consumer-popular website and I've had to go through iterations of when they first started it, it ran in the house. Once a week, I'd have a denial of service attack that would saturate all the copper I could get my hands on. I went to a co-location facility and OK, now they got a faster connection. I can eat larger and larger denial of service attacks. I started getting denial of service attacks that the co-location facility would call me and say, “Hey, we're going to shut you down because the bandwidth.”

Who's DDoSing you, Chris? What's going on?

Everybody. Then it was like, “OK, let me switch behind some of these more enterprise-level platforms.” I would still see stuff that could get through the enterprise-level platforms hit my servers. Even to this day, I always kind of joke is the content delivery networks and Cloudflares and Akamais can get about 90% of the automated suspicious malicious-looking stuff from hitting my edge.

Then still, 90% of what hits my servers is still not…. The orders of magnitude of not real traffic have always just baffled me. But if I sit there and I was getting 250 megabit, megabit, gigabit, just massive denial of service attacks. This nobody site. I can't imagine what government institutions, Microsoft, Fortune 500 companies, the sort of stuff that they have to deal with must be several orders of magnitude more than what I've had to deal with.

Interesting. I wonder who you've upset.

Some of it is probably…I've come to the conclusion that it's not that people are upset with me, but it's just like, “Oh, this is an IP address site. I wonder….” More of a curiosity. But I also had an API service for years that would just return the IP address and it started getting included in malware of machines being able to effectively figure out their own IP address by going to my site.

I would say within that instance, that is not actually DDoS. That is a piece of malware using you as their infrastructure.

Correct. Yeah.

That's pretty common.

When it becomes 100 megabit, 150 megabits, I can't afford to maintain your infrastructure.

You're maintaining threat actor infrastructure at that point.

Which is why that service is no longer available because all good things get exploited when they can’t. What is the stuff that keeps you up at night now? Let's not worry about the DNS and internet infrastructure in and of itself. What are the things that keep you up at night now?

I mean, I think there's the technology aspect of it, but really more than that, there's the human aspect. I see where AI is going. To be really blunt about it, I don't want to lose our humanity to this. A lot of people talk about, “Well, AI isn't going to destroy humans.” I don't think that we're at a serious risk of some kinetic event that AI sets off some huge fire bomb or something. I don't see that. I'm not going to rule it out because I don't know the future.

But I think the biggest risk to humanity today with this is the severing of human connection in preference to an AI. -Sherrod DeGrippo Share on X

But I think the biggest risk to humanity today with this is the severing of human connection in preference to an AI. As an example, my trainer at the gym moved away. I need to figure out a workout plan. This actually happened to me. I can't believe she moved away.

She moves away and I'm like, “OK, I need to figure this out on my own. I need to be able to go to the gym. Everything.” I'm like, “Well, I'll just get on ChatGPT and I'll tell it my goals and it'll put together a whole workout plan for me. I can ask it what app I should get. This will be great.” Then I saw it, but I also have a bunch of friends who were, like, gym nerds.

I could go ask them. That would take longer. Then they're going to have all these opinions. Ultimately, I did make the choice to talk to my friends, which I'm glad that I did. People are going to make that choice without that level of mindfulness again and again and again. Planning a party. Instead of going and talking to your friend who you're going to invite to the party about what you should get and who should be invited and how should you just get on the AI.

It'll give you the shopping list. It'll tell you what to eat. It'll tell you everything you need to know. Those connections are slowly going to erode as people become more drawn to less friction. Ultimately, friction is what makes intimacy, connection, depth. It is the human experience. Friction is a foundational part of the human experience, how we deal with that. I do worry that there is the potential for AI to destroy humanity by cutting us out of relationships.

Friction is a foundational part of the human experience, how we deal with that. I do worry that there is the potential for AI to destroy humanity by cutting us out of relationships. -Sherrod DeGrippo Share on X

We're seeing that people would rather have a medical issue rather than talk to their doctor. They'd rather just go on ChatGPT. We'll blame ChatGPT for everything in this context.

I'm happy to blame Claude as well, or John AI, or Perplexity.

I see lots of people starting to ask relationship questions or how to manage their team questions. You're going to a computer that summarized potentially good or bad information, how to form a human connection and maintain a human connection. We're asking the computer that.

I think one of the great ways, even for people who are deeply technical, and they would love to argue with me about it, but I'll say it this way anyway. When you go on your phone and you just put “I,” it gives you below a list of autocomplete options. When that first came out, people would just tap it and make some kind of crazy nonsense sentence.

But I really want people to understand you will not get real, true innovation and creativity from something that is trained on past knowledge. It's not possible. -Sherrod DeGrippo Share on X

In many ways, that is what LLMs are doing. They are autocorrect predicting what the next word in a sentence should or would be, or predicting what an answer most commonly is, and just giving that to you. They're much more sophisticated and much more complicated than what's on your phone. But I really want people to understand you will not get real, true innovation and creativity from something that is trained on past knowledge.

It's not possible. It cannot synthesize new ideas and certainly not at the levels that we are now or at the levels that the consumer products are at. Please, if you have relationship troubles, ask a friend. If you want to have a better social life, ask a friend. If you want to work better with your team at work, find a leader who's great at working with their team and ask them how they're doing it. You want to organize a schedule? Use the chat.

Please, if you have relationship troubles, ask a friend. If you want to have a better social life, ask a friend. If you want to work better with your team at work, find a leader who's great at working with their team and ask them… Share on X

You want to do some kind of pain-in-the-butt labor? Have the AI do that. But you want to have real human connection. It's hard to make friends as adults. You know why it's hard? Part of it is because you're talking to an AI instead of a human.

You want to do some kind of pain-in-the-butt labor? Have the AI do that. But you want to have real human connection. It's hard to make friends as adults. You know why it's hard? Part of it is because you're talking to an AI instead… Share on X

With lots of stuff like they always talk about with products, it’s a race to the bottom. “How can we make this the cheapest, the minimum spec in order to make the product work? Where can we source it from the cheapest materials? How do we get the razor-thin margins? How do we use human traffic labor to make this product cheaper?”

It's this race to the lowest common denominator. Is AI the race to the median? At some point, if I know nothing about traveling to Taipei, AI can bring me up to a certain level, but it's not going to get me, “Oh, here's the really neat things that are going to meet your personality, Chris, that are going to make this the best trip or best adventure ever.” But I can at least bring you up from, “You're not going to have a miserable experience,” to, “Yeah, you'll probably have a decent experience.”

I think it can do a lot. I think that there really is an incredible capability there, but we as humans have to insert and assert our humanity into it. I would say this about any kind of technology or any kind of relationship or any kind of person just sitting back and letting life happen to you. You're not going to have a good experience. I want everyone to really understand, to be fulfilled and happy and satisfied and content and successful in life, you have to get in your own driver's seat. You have to make the decisions of what experiences you want to have.

I want everyone to really understand, to be fulfilled and happy and satisfied and content and successful in life, you have to get in your own driver's seat. You have to make the decisions of what experiences you want to have.… Share on X

The best luck, in my opinion, is to decide it from the beginning, is to say, “My intention is this, and this is what I'm going to get out of this.” With your trip example, which I think is a great example because they are really good for travel planning.

They're great for that crappy logistic stuff that I don't want to deal with. “I want to go to this museum, but it's across down from this other event. How do I?” Great. Let it plan. “Oh, we'll take this and do that. Mix up your day this way.” Great. But you need to sit as a human being and say, “What do I want to feel? How do I want to experience the world? What is my taste? What is my preference? What is my passion? What is my interest?”

When you're letting technology or any other force, whether it's another person or your family or society, whatever, when you're letting outside forces decide what your experiences are, who you are as a person, how you feel, what you do, what you like, you're not going to be happy. You're not going to be happy.

Life has to be intentional.

the more you eliminate friction from your life, the less choices you have to make, the less feelings you have to process, the less interactions you need to have with other humans, that’s not a human existence. It's not a human… Share on X

It has to be intentional. I think that going back to that friction point, the more you eliminate friction from your life, the less choices you have to make, the less feelings you have to process, the less interactions you need to have with other humans, that’s not a human existence. It's not a human experience. It's a synthetic experience.

The decisions we need to make are around where do we want to employ our friction?

Right. I think that that's right.

Maybe I don't want it on the logistics piece, but I want it on the interactions with human beings piece.

Perfect. Maybe you make choices that give you that optimal feeling. This is something I tell people all the time. Yes, I am a computer nerd. Yes, I'm kind of an intellectual. I get it. But I optimize for how I feel. How does something make me feel? I think that when you start looking around at everyone you know and at yourself, we're all chasing feelings. Why do I want to buy that new car?

Well, most of the time it comes down to I want to feel important. I want to feel the sense of speed and the engine revving. I want to feel this. Most of the things that people desire are because they're looking for a feeling. I also worry about AI eliminating the concepts of desire completely and never allowing people to sit. Amazon is a great example.

I just get on. I get it. I want this thing. It'll be here tomorrow morning. You're not finding people having to sit with desire and having to understand the complexities and the complications of what it feels like to want. In many ways, societally and with technology eliminated, human want.

And I wonder if that is potentially part of the component of why scams and frauds seem to be so successful these days. It's because we've engineered such frictionless society that we so much desire, in some sense, a lack of friction that the scammers and thieves exploit that desire for no friction. The path of least resistance is going to result in you getting scammed, as opposed to, “No, I'm going to stop. I'm going to ask questions. I'm going to slow this down.”

Everything is designed for, and I assume that it's probably a certain amount on the threat intelligence side, is the things that you use to defend networks introduce friction. And the things that the scammers and the hackers use are things that we implement for having a frictionless interaction.

I talk about some of this in my book, Threat-Driven Software Development, about defending online services from modern threat actors. The thing that I always remind people about is that we're talking about social engineering, which essentially is getting a human to take an action that you want them to take that they otherwise wouldn't. Pretty simple.

You want someone to do a thing. You engineer that human to get them to do that thing. The thing that I really try to remind people about is that social engineering, crime, threat intelligence, espionage, these are thousands-of-years-old concepts. People have been stealing for thousands of years. People have been waging war and gathering intelligence about their adversary for thousands of years. Go back to the Roman Empire.

Go back to tribalism thousands of years. Since organizational human society, we've been doing these things. Today, the people doing them use computers and technology to do it with. And the goal isn't different. It's to either get information or resource financial gain.

Well, and the information is also for gain.

Right, exactly. And ultimately, to be more successful in whatever their particular goal is, we tend to split up motivations into financial or nation state-based goals. But ultimately, I think in the global reality, I think gathering of capital is a good enough goal, whether that's an individual crime threat actor group or the large apparatuses of military intelligence for espionage.

They're all kind of going after resource accumulation in the end. But these are concepts that are super old. I think sometimes people talk with me about what threat actors are doing, and they're trying to get information to better facilitate some kind of kinetic information. They're using military intel, all this stuff. And I'm like, the Peloponnesian War had this.

I mean, they're called Trojans in honor of the original Trojan horse, which was made of wood. If you don't know this stuff, go back and read your history. That's one good thing about AI. That’s one good thing about AI is that we're going to bring literature back. We're going to bring literature back, everybody.

It'll be digital. It won't be paper, but at least it will be there.

I want people to be able to know the stories that got us where we are. A lot of people coming in, if I say remote access Trojan, do they know the story of Troy? I don't know. Probably not. It's worth checking out.

With AI, are there kind of conventional wisdom that you think is probably wrong about AI in that? I think a lot of people are like, “Oh, information workers are the ones that are at risk. It's the people that move data from one place to another, the people who analyze data. As soon as the AI can figure that out, as soon as we can assure that we're not getting a hallucination, that whole classification of jobs just vaporizes overnight.” Do you have a different view of that?

I do think that there will be elimination, but that also means there's a possibility for changes. There's a possibility for things moving around. There's a possibility for going back to the section we were talking about earlier. There’s a possibility to do things that are more human-focused.

Spend your time on really understanding your customer, for example, and how they make decisions and taking it to that level where you're putting the human in the loop, like we were saying. But a lot of people say, “Oh, they're not going to take blue-collar jobs. Oh, that is foolish.” The reason I feel that way is because over the winter, I live in this great house from the 1950s. I love it. It used to be a duplex. I have two HVAC systems.

One of them went out. Heat went out. It was getting cold. I mean really cold. I was kind of freaking out. I'm calling. It's cold in Atlanta. They don't have anybody to come out. It's Friday. We can get someone there by Tuesday. I was sort of like, “Oh, this is not good. I'm going to go see if I can fix it. What?” I go in my basement. There's the furnaces. I know what they look like.

There's things happening, but I find on the ground the manual for these furnaces, the 26-year-old manual, paper in a plastic bag. Previous owners left it for me, I guess. I go, “OK. I take this manual back up in my house. I get out the scanner app on my phone, and I scan all 37 pages of this paper manual that’s, like, a quarter of a century old. I turn it into a PDF. I upload it into ChatGPT, and I say, “Hey, chat buddy, I'm cold. What do we do?”

I'm taking pictures of the furnace. It walks me through how to fix it. My heat comes back on. My house is warm. The reason I say it's going to take blue-collar jobs is not because every person on earth is going to fix their furnaces now, but because I did not call for a diagnostic. It told me what parts I needed to get and how I could get them.

It's not going to take installing furnaces away, but that initial call for diagnostics, I think that's going to be gone. The initial, “What's wrong? Let us come out and figure out your problem.” Many people are going to be able to do it themselves, especially those who are in trouble, like I was. I was freezing cold. People who don't have a ton of money to call someone out to figure it out and blah, blah, blah.

If you think about content that you see on social media, home DIY, it's huge. Where does that leave a lot of this diagnostic? If you're not afraid to take pictures and upload them into the AI, you're fixing stuff in your house easily, quickly.

It's going to eat the stuff that our parents used to know how to do, that our aunts and uncles used to know how to do, of the first round of triage is going to be gone.

I think so. I think as we get further and more advanced in it, I would have potentially gotten a diagnosis from ChatGPT and then have that automatically conveyed to some kind of, well, probably a variety of service providers within my area. I would have an agent go find who's available, who could do it, what the lowest price was.

It puts consumers in a very strong position because now, and believe me, I don't believe that AI is expert level. Go talk to any LLM about what your expertise is and you will quickly say, “Oh, I know a lot more about this in a lot more depth. This is basics, but I'm a lot more deep than you.” When you realize, “Well, I can be basic on anything.” You can get a lot done.

Don't fool yourself into thinking you're an expert just because you have ChatGPT. You're not. But you could get basic. I don't cook and I can cook now, kind of, with it. You can get basics. -Sherrod DeGrippo Share on X

Don't fool yourself into thinking you're an expert just because you have ChatGPT. You're not. But you could get basic. I don't cook and I can cook now, kind of, with it. You can get basics. Once you get to that level, it's sort of like what you're saying: we had a lot of generalists in the generations before us that could fix things and do things. I think it will bring back some of that to a degree.

My recent AI experience this weekend, I love cooking, my wife loves cleaning, so it's a good combination. But neither of us like planning. I don't mind going to the grocery store, but we don't like planning what we're going to eat. But we do have certain ground rules. Can't do fish on Sunday night or Monday night because my wife goes into the office and you don't reheat fish at work because that's a no-no.

We have a standing appointment on Wednesday night, so we need a quick, easy clean up from the meal. I uploaded about 50 recipes of stuff that we like that's kind of in our normal routine and said, “Hey, plan the menus for the next month. I don't want to be eating the same protein multiple days in a row.” And it says, “OK, here's your meal plan.”

Love it.

And I was like, “Oh, that took the piece of eating that I like least.” It took me a long time to get all this uploaded, but I could go back again next month and say, “Hey, that was great. Here's what I like. Here's what I didn't like. Do it again for another month.” And I've now taken a ton of conversation about, “No, I don't want that.” Or, “What are you feeling like having?” And turned it into, “Oh, here's the meal plan.” “OK, we can execute. We can talk about other things, not trying to figure out what we're going to have for dinner tonight.”

And extrapolate that further out. Many of them now have plug-ins to grocery shopping order capabilities. You can tell it like, “Order my groceries for the week from what you just planned. Go, go.” Yes, yes, yes. And you can walk through that. Something I'll share with everyone listening, I strongly encourage it. If you feel disconnected from your social community, get on ChatGPT and say, “I want to have a party.”

Decide how many people and tell it, “I want to have an AI-created party. And I want to tell my friends, ‘I let AI completely create this party. Our food, our activities, our drinks, everything. Come over and let's see what happens.'” Use it as a reason to get together. Use it as a reason to communicate with people. Use it as a reason to get rid of something that you don't really enjoy doing to facilitate something that you do, right?

Like the meal and the connection and the new recipe or whatever it may be. And the novelty of being like, “Yeah, a computer planned my dinner tonight. That's kind of fun.” I think that those are the right things. But again, if you're not being intentional and you're not thinking about it, you can fall into this sort of horrible Black Mirror reality of not being human anymore, really, and not connecting with other humans.

I'm going to ask two. I know we're going a little bit long, and I apologize. If you have a hard stop, let me know. Two questions as we wrap up here. Now I forgot the first question. The second question was, have you been scammed? Two questions as we wrap up here. I know that to me, I've always viewed the ability to search for something on Google as a master skill.

That there are some people that, you know, if you say, “Hey, I want to go to Taipei; where should I eat” will get you one set of results. And, “I want to go to Taipei, and I want to eat local food,” but you can do a better search and you get a much more specific answer to your question. You don't have to go down to page eight to find what you're looking for. Is AI prompt building going to be the next kind of super skillset?

That's a great question. I think, you know, maybe a year or two ago we were talking about prompt engineering, which has kind of fallen into a ridicule space now. I think that it's actually next level of that, which is making really great skill files, making really great markdown files, and having the AI platform that is oriented toward you and your preferences, and that is given the instructions that you want it to follow.

I don't like the flowery language, I've put files in that say, “Can you just give it to me straight? I don't need a bunch of drama around it. Just tell me what your answer is.” But there's lots of elaborate things that you can do as well to not just refine personality, but to also make sure that it checks things multiple times, to make sure that, for example, the bookstore that it's sending you to in Taipei is still open and open on the day that you want. Go check; make sure.

There's this sort of joke I use all the time, which is think hard; make no mistakes. I think there is an element of being able to do that, and your prompts really, really, really matter. Your skill files really matter. Creating those is worth the time it takes to do them.

The second question, which I didn't ask up in the front part of the conversation, but because this is the Easy Prey Podcast, I have to ask, have you ever been a victim of a scam, a fraud, or a cybersecurity incident that you're willing to talk about? Because if you and I can't get it right 100% of the time, the audience shouldn't feel embarrassed or humiliated if they can't get it right.

I don't think anyone should feel humiliated or embarrassed if they can't get it right. I personally have not experienced that. However, I've been running my own email server. I don't even have Gmail, so I'm very insulated in a lot of ways. That said, I did work in email detection and engineering for almost a decade, and we kept getting alerts about purchasing gift cards. And that is a huge red flag.

Looking through the conversations, we were able to see that it was actually an employee at a drugstore emailing their boss saying, “There's a customer in the store and they want $5,000 of gift cards, and I just really know they're getting scammed and I don't know what to do.” And the regional manager kept coming back and forth with this employee and the employee’s in the store talking to the individual saying, “No, I really don't want to sell you these. I think you're being scammed.”

The customer in the store is like, “No, my computer is broken. This is for tech support to get it fixed again.” And finally, the regional manager said, “Tell them you won't do it and you're not allowed.” OK, so they leave and they go to a different location of the same chain of drugstores. I start seeing the next level of conversation, which is another manager going, “I've got somebody here.”

Finally, the regional manager of this drugstore chain was quite smart and said, “Call the sheriff, not the police,” which I kind of like that better too. “Call the sheriff,” and this was not a tiny little small town, but the sheriff actually came and interacted with the individual and said, “I promise you, you're being scammed.”I think it was resolved and all of that.

When Trust Becomes a Trap Share on X

But the lesson for me was when someone is taking actions from emotion, that's when you really need to kind of stop and say, “What's going on? Are you doing the things that you would normally do? Are you being pushed by some kind of emotional fear, excitement, curiosity?” It doesn't matter what that emotion is. But if your actions are coming from a purely emotional place or a strongly emotionally driven place, that's the time to hold up. What are we doing? How is this going to work?

Very good advice. Sherrod, as we wrap up here, if people want to find you online, where can they find you?

I'm on LinkedIn at Sherrod DeGrippo and would be happy for everyone to check out the new book that releases July 2nd, 2026. It is called Threat-Driven Software Development: Defending Modern Online Services.

We will link to both of those in the show notes so the audience can find them easily and quickly. Thank you so much for coming on the podcast today.

Thanks for having me, Chris. It was great speaking with you.