The New Weakest Link

For years, cybersecurity professionals have warned that people are the weakest link. We click things we shouldn’t, reuse passwords, and sometimes make decisions before stopping to think. But as AI becomes more deeply connected to the systems we use every day, there may be another weak link emerging, one that can move much faster than any human.

Today’s guest is Richard Hummel, Vice President of Threat Intelligence and Research at Security Scorecard. Richard has spent nearly two decades in cybersecurity, working on everything from nation-state threats and malware analysis to intrusion detection and network security. Over the years, he’s watched cybercrime change from relatively simple attacks into a much more organized and fast-moving industry.

We talk about what AI is adding to that mix, how quickly new attacks can develop, and why giving AI too much access inside a company can create problems of its own. We also get into AI-powered phishing, non-human identities, and a real example from Richard’s own experience where an AI assistant opened something it probably shouldn’t have.

Show Notes:

• [01:04] Richard Hummel shares his background in threat intelligence and nearly two decades of work tracking nation-state actors, cybercriminals, and other online threats.
• [03:03] Attackers who are motivated by disruption rather than money can be especially difficult to predict and defend against.
• [04:30] Ransomware remains a major threat even as older attacks like point-of-sale malware and website defacement have become less common.
• [06:54] Cybercrime now operates more like a business, with specialists handling phishing, malware, infrastructure, payments, and other parts of an attack.
• [13:17] AI-powered attacks may look familiar to defenders, but they can move much faster than traditional cyberattacks.
• [18:10] Security teams need to pay attention not only to threats coming into a network but also to what AI and other systems may be sending out.
• [19:43] AI could become the new weakest link when organizations give it broad access without the same controls they place on human users.
• [21:47] Just-in-time privileges can limit what an AI system is allowed to access and how long it keeps those permissions.
• [23:33] AI tools can expose sensitive information when companies capture prompts, screens, and internal work in the name of productivity.
• [29:32] Threat intelligence teams monitor underground communities to understand how cybercriminals are adopting and using AI.
• [33:28] DDoS tools are beginning to add AI on top of automation to help attackers choose, adjust, and refine their attacks.
• [37:09] Agent-driven traffic may soon outpace human traffic and change how websites, infrastructure, and online businesses operate.
• [45:23] A personal example shows how an AI assistant can create risk when it opens an attachment without enough restrictions in place.
• [48:13] Security awareness training can reduce risk, but people still make mistakes and need a plan for what happens when they do.

Thanks for joining us on Easy Prey. Be sure to subscribe to our podcast on iTunes and leave a nice review. 

Links and Resources:

• Podcast Web Page
• Facebook Page
• whatismyipaddress.com
• Easy Prey on Instagram
• Easy Prey on Twitter
• Easy Prey on LinkedIn
• Easy Prey on YouTube
• Easy Prey on Pinterest
• Richard Hummel – LinkedIn
• Security Scorecard 
• STRIKE Threat Intelligence
• Driftnet
• AI Security Cannot Depend on Everyone Slowing Down

Transcript:

Richard, thank you so much for coming on the podcast today.

Thanks, Chris, for having me. It’s a pleasure to be here.

Looking forward to our conversation. Can you give the audience and myself a little bit of background about who you are and what you do?

Absolutely. Vice President of Threat Intelligence at Security Scorecard, and been in this space for, it’s coming up on two decades, which is crazy to think about, but working everything from nation state in the Army when I first got started, contracting. I’ve been in the commercial space now for the past 12 years or so, and tracking anything from nation states to cyber criminals to underground forums, hacktivists, and the occasional chaos bringer that likes to see the world burn. It’s been a pretty interesting, exciting career, but I have fun doing it.

That’s an interesting distinction between each of those categories of threats. I haven’t recently heard anyone mention the anarchist archetype recently. Everyone likes to talk about nation state hackers and for good reason, but I’ve definitely ran across entities that are like, “No, we just like to mess with stuff.”

I mean, if you go back probably a decade or so now, maybe longer, there used to be something called Zone H, and that was essentially where you could go to look at what people were doing to deface stuff. You would have “hacksaws was here,” and they would paste it across your website. That was the original kind of, “I don’t really care. I’m just going to show people what I can do.” There’s no monetary gain for that.

It was more or less like recognition, like, “Here’s what I can do.” You see the same thing now with DDoS. You see the same thing now with ransomware. Half the ransomware campaigns, they have no decryption keys. It’s just they’re going to go encrypt everything. Maybe they get a payday, maybe they don’t, but sometimes it’s literally just to say, “Here’s what I can do.” So,yeah, the anarchist side of this is very real.

That’s, to me, one of the more difficult things to protect against. If you know a nation state is coming, the other actors, you know their motivations, you know what they’re going after, because you know motivations. There’s actions that you could take, but when someone just wants to see the world burn…

The entire world is their playground. I mean, to be quite frank about it—and it can be scary—you have seen times where hospitals are targeted, and there’s critical, life-giving equipment that’s taken offline because ransomware encrypts things. There are plenty of adversaries. They have no qualms. They really have no desire other than to hurt individuals, hurt organizations. Sometimes that’s motivated by finances, and initially, maybe you don’t realize that it’s motivated by finances because what are they going to get from it?

Nobody’s going to pay them, or at least you shouldn’t pay them. I’m going to put that on record right now. Don’t pay the bad guys because you’re enabling them, but I get it. There’s entire insurance businesses around payments to these cyber criminals because sometimes the risk is worth the reward, and the reward could be, “I get my system back up and running because if I don’t, then I no longer have a company.”

It’s one of those really tough boundaries that you have to traverse. But as a security professional, I know that every single payment these guys get, the more bold they get, the more sophisticated they get, the more money they have to increase their operations, buy new malware, hire new people. It’s just not something you want to get into.

You’ve been in this space for a long time. What things have gone away that aren’t really an issue anymore? What’s the bleeding edge concerns that you have?

A whole lifetime of changes have happened in the past year and a half with AI. We don’t even have to go back two decades to figure out what’s changed. We could just go back a year and be like, “Everything we used to do then is not what we do now.” But there’s been a lot of things that have come and gone. Point-of-sale malware was really big for a while, where they would go and try to compromise payment card readers.

You would have all of these campaigns. I remember tracking a ton of those things and be like, “Oh, they’re going to keep doing this.” And then we moved to chip readers and then we moved to NFC payments. You have all these different encryption levels and that kind of phased out. The whole defacement thing, it still happens occasionally, but not so much anymore. Most of the time, it’s going to be ransomware because they realize that some people will pay.

If you deface something, what are they going to do? They’re just going to take their PHP file down and they’re going to redo it, right? Not a huge deal. But if you encrypt all their files, well now you have a problem. I even remember when I was working over at iSIGHT Partners in FireEye back in the day. When we were tracking ransomware, there was this big, huge joint law enforcement, Interpol, FBI, I mean, you name it, all the agencies from all over the world got together and they said, “Hey, we’re going to stop ransomware once and for all.”

And there was this whole push. I don’t know if it was like stopransomware.org or something like that. It was, like, this huge thing. The objective was that in the next three to five years, ransomware is going to be a thing of the past. Where are we now? It’s 2026 and ransomware is still very much the number one cyber criminal threat out there. I was even saying back then, I was like, “This is never going away.”

As long as there are devices connected, and the adversary has a method to get in there, and everybody is hosting all of their crown jewels in a place that can be touched by an adversary, ransomware always has a place. Unless the entire world went offline and took away their digital footprint, you’re always going to have that threat, because the vast majority of those cyber criminals, they literally operate like a business in the cyber underground.

It used to be you would have one adversary that would do everything. They would build their own malware. They would do their own spam campaigns, their own phishing. They would do their own brute forcing. They would host their own scanning. They would use, like, bulletproof hosting providers to tumble their IP addresses and domains around. They would compromise. They would run the Bitcoin payment processing, the decrypted files. That typically doesn’t happen anymore.

It’s a business now. All of the infrastructure operates as if you and I have an enterprise and we’re reaching out to AWS or Oracle or Google and host our stuff. They have hosting providers. They’re not handling their spam campaigns anymore. They’re specialists that can do their phishing campaigns to make it look more like a human. They’re not building their own malware. They’re just outsourcing and purchasing that malware. They might not even do any of their own Bitcoin payments.

They might use these crypto tumbler exchanges to facilitate that money laundering for the cryptocurrency. Like, all of this operates like a really well-oiled machine. And now you enter AI into this space and it further enables them. So now you can actually go back. It’s funny because it used to be one person doing all this. Then it moves to this whole corporate structure. Now with AI, you’re back to one person being able to orchestrate everything. It’s kind of like a full circle moment. It’s really odd.

I know with the frontier models, there’s always the concern of what can this do to government systems? How easy can it get into things? There have been a couple of new stories recently about some frontier models escaping the labs and hacking organizations to try to capture the flag. Luckily nothing particularly nefarious happened. Rather than the question of, “Are there bad people using AI?” Clearly. Are there large language models that are actually designed and built for malicious activity?

I would even say, if you go and look at, so what was it? Anthropic, I think happened first. Then OpenAI, then Meta. I don’t think I’ve heard about Gemini escaping the sandbox. I’m sure it has, but maybe in their own vacuum. But you hear about all of these things happening, but the reality is what you have to understand is that these things were instructed to try and do that as part of their testing.

In a sense, the frontier models were weaponized by the founders and the builders of it to do the very thing that it did. Now, it did it much more successfully than it probably planned, but it did it. If you were to take the open-weight reasoning models, let’s think just looking at benchmarks here. You’ve got your Fable 5, you’ve got your Opus 5, you have Grok 4.6, you have Gemini 3.5 Pro models, you have the OpenAI 5.6 Soul, you have all these different frontier models. Well, go two-and-a-half weeks ago, China says, “OK, you guys have all these cool frontier models.”

They’re proprietary. It’s close source. Here’s Kimi K3. And Kimi K3 has the same benchmarking as all of these other frontier models, but it’s open-weight reasoning model, which means anyone with the infrastructure can use that model. If it has the same capabilities as all of these other frontier models that are capable of escaping a sandbox and doing this offensive cyber, what happens when somebody takes Kimi K3 and fine tunes it based on thread activity?

Now you have all of these adversaries that have been doing this in the adversary space for as long as I’ve been doing it on the cyber defense side, and they have all the knowledge, they have all the documentation, they have corpus of mower, they have all of their different hacking tools, the Metasploit tools, all of the different sniffers that they’ve done, the reconnaissance tools. They can basically toss all of these different toolkits, if you will, in the underground that you can go find, and they can suck up telegram channels, they can suck up different marketplaces. They can essentially toss all of this to a Kimi K3 model and…

Run on their own hardware.

Exactly. Their own fine tuning. It won’t have any of the restrictions that the frontier models have with doing the offensive operations, because it’s been tuned to do that explicitly. If they have the same capabilities as some of the frontier models, with a tool that they can run basically 24/7, provided they have the infrastructure, yeah, I mean, it’s all over the place. And then you do have some—let’s call them underground frontier models—right, where you can actually pay premium to run these things. And so some operators are functioning the same way that you would have, like, open router, the IO, where here’s a bunch of malicious, different GPTs.

So like WormGPT, DarkGPT. I’m trying to go through the list. It’s been a little bit since I actually got on the underground and looked at these things. But they have a number of these things, where you can just use them like you would ChatGPT. And there’s no restrictions. It’ll do whatever you want it to. If you say, “Go attack this website, go try to find an exploit on this website,” it’ll do it. If I did that with OpenAI or Agentic, “No, sorry, you can’t do that. It’s against our terms of service.” Adversaries don’t have that compunction. They’re going to absolutely use it for sure.

Why aren’t we seeing more news stories about people using Kimi K to do all the stuff that Anthropic and OpenAI have done? What does it look like? What does the intentional stuff look like? Why aren’t we seeing news stories about it?

Well, here’s a question. If they’re using these things, what does it look like to you and me as a defender? Does it look like Kimi K3 is coming at us, or does it look like there’s just a lot of adversaries coming at us really fast?

They were going to end up in the weeds. At least with the Anthropic, the Hugging Face, to them, it was clear that like, “Oh, no. This is clear that this is an AI.”

Because it self identified. Oh, OK. In the Anthropic models, the OpenAI models, when those LLMs are touching your website, it has a marker in there in the header data. It will self identify as OpenAI, it will self identify as Anthropic. Most of the frontier models will do that because they want people to recognize that, Hey, this isn’t about board; this is a frontier model, this is legitimate.

But if an adversary is trying to do this, do you think they really want to advertise that they’re using? Probably not, right? So they’re basically going to add in rules here that are essentially either they’re going to automate scripts, or the LLM that they’re using will use their scripts. And so from the defender standpoint, it doesn’t look any different than what we’ve seen for many, many years. But it’s coming in much, much faster.

There’s basically no SLAs anymore in terms of the time it takes. CVE drops and within 20 seconds, you might have a proof of concept code that can exploit that CVE. The reality is, is that the activity itself doesn’t look a whole lot different. It’s just coming way faster than ever before.

Why aren’t we seeing more news stories about major corporations being breached? Is it that they just don’t know about it yet? Or done much with it?

There’s a lot of that. I would say that the breach cadence has significantly improved. But at the same time, we’re getting much faster at patching. You have the Glasswing project, you have Operation Daybreak. Operation Daybreak is opening eyes conglomerate, and then Glasswing is Anthropic conglomerate. The objective there is let’s work with all of the primary vendors that are in this space securing the internet.

You might have your Ciscos and your Microsoft Oracles, your Fortinet, like a lot of these devices that are your frontline defenders, that secure, essentially, your environment, whether it’s a firewall, it’s a router, it’s actually operating system themselves. Most of those vendors are now part of one of these two programs. What they have been doing is for probably that I want to say Glasswing was six months ago. No, it wasn’t quite long ago—three or four months ago, maybe for Glasswing, it could be six months, I don’t know, time is flying so fast anymore.

But they have been using Mythos, they have been using the GPT, I think they started at like 5.5 cyber version, and then now 5.6. They have a cyber version of that, which we’re actually now part of the trusted access program with OpenAI. We have operations to like Daybreak Blue, which is like the defender’s perspective. We have access to some of the Anthropic models for security, currently working on our Mythos certification.

We’re working to get into that space as well, so that we can help them with this. Because one of the things that we can do is because we are products, we have acquisition we did about six months ago to acquire internet intelligence company called Driftnet. One of the things that we do is constantly monitoring the internet for our things susceptible to vulnerability. One of the cool things that we would bring to the table here is that we would be able to say, “Here’s all of the different assets in the world.”

What is Mythos or Glasswing and Operation Daybreak, what are they doing to help solve that problem? What they really need is, like, a feedback loop that says, “Hey, here’s all these things that we have to patch. Here’s all the patches that we sent out pre-disclosure to all these companies to patch, are they actually doing it?” That feedback loop needs to exist so you can get faster and faster about this. Right now, as far as I understand it, whenever the patches are coming out through the Glasswing project or the Operation Daybreak, they are not being disclosed anywhere.

The adversaries probably don’t have those CVS dropping to do the proof of concept codes right away. What they’re trying to do with all these organizations is they’re trying to patch those internally inside those ecosystems before they get released publicly. When the adversary does get them right now, the vulnerability, hopefully that gap is closed, which could be why we’re not seeing an acceleration more so than we already are as far as breaches go. Now, this is conjecture and hypothetical because I’m not part of those programs myself, but based on my understanding, that’s what I would imply.

OK. I’m going to ask a question and expose my lack of understanding probably in the threat intelligence space and try to draw parallel to internet routing because that’s more my somewhat knowledgeable space. It has historically been that through the TCP/IP network, when you announce your IP space, “Hey, here’s where my traffic is supposed to come from.”

Anytime that you are running a network, you should really on your edge router say, “Hey, anything that’s claiming to be from outside of my network, leaving my network, I should just drop it because clearly what’s outside can’t be inside.” Is there an element of threat intelligence that says that looks at hacking behavior and stops and rather than trying to stop it from coming in, stops it from coming out of places?

Yeah. I mean, you have to look at both, right? We would consider that to be inside a threat, right? If it’s coming from inside your environment and you should be able to stop outbound threats just as much as inbound threats. I don’t think there is enough people focused on the outbound side, especially given AI stuff right now. What happens when you have a rogue AI inside? What happens? Like, I mean, the Hugging Face example, right? Let’s go back to that.

You had LLMs internally that managed to reach out and compromise various vendors that you have externally. That wasn’t an outside-in threat. That was an inside-out threat. Whether it’s based on TCP/IP protocols, whether it’s based on an adversary trying to spoof you as if they’re coming from your environment, like there’s any number of ways that adversary can do this from a digital footprint perspective. What I’m more concerned about right now is the amount of vendors and third-party, fourth-party, fifth-party entities inside your own ecosystem that becomes your weak link.

I’ll mention this towards the end. I know you said you had a question for me at the end, and I think this might tie into it a little bit. It used to be that the human was the weakest link. And I still believe like right now, we’re at this weird, it’s like an inflection point. I still believe that the human is the current weakest link, because we are all susceptible to clicking on things. However, with the speed at which AI is being adopted, my mind is starting to change a little bit that maybe it’s not the human that’s the weakest link anymore.

It’s the AI, because you don’t have policies in place to handle the AI. There’s something called non-human identity, NHIs. And normally, if you’re part of an enterprise, you have an onboarding process. You come into your organization, you have your email, you have to go through your training, you have to go through your authentication, you have to get your credentials, like everything is governed, right? You have whether it’s an active directory or something else that’s managing you. You don’t just immediately have keys to the entire kingdom, at least you shouldn’t. You should have only what you need.

That access should expire at some point, typically, you know, 30, 60, 90 days. That’s the security boundary for a human. Well, what happened is AI sprawl, and the speed at which AI came on board, none of that was being done for AI. But if we’re looking at AI to replace some of us, if we’re looking at AI to manage socks, and those AI just have all the keys to the kingdom, because you gave them every single API access with rewrite capabilities, because oh, they need it to do this job. You basically just opened yourself up now to an insider threat.

I was actually listening to a keynote. I’m gonna forget the name because I’m not good with names. It was a keynote. It was one of the—I think it was the CEO, maybe of Cisco, it was at one RSA. And he had a keynote speech around AI, specifically the non-human identity portion. There’s three different areas that he said that we need to be looking at. One is, you only give access for an AI to something when it needs it. For however long it needs it. And only for what it needs. This is called just-in-time privilege for these different AI.

What you would do is basically say, “Here’s my little bot. Here’s my AI. It needs to do this job. Great. Let’s have it check in to get a credential and have that credential be very short lived or maybe specific-purpose built.” It has that credential until it accomplishes its task. And then it’s removed and now no longer has access to do something else with that access that it shouldn’t have. We need to get better about that. Because if we don’t, I think that becomes our weakest link.

I had seen an ad for somebody’s—I gotta try to be intentionally vague—kind of integral, simple AI to help you have the perfect memory, let’s say. And the pitch was you don’t have to give it access to anything. Because you’re giving it access to seeing what you see on your screens. It’s like, “OK, I get that.”

I get the point that it doesn’t technically have access. But anything that shows up on my screen, maybe stuff that I would never have given it access to, that it now has seen for the text message from my spouse came in and talked about their illness. Well, I would never have had the AI given access my text messages. But now it’s seen that text message because it popped up on my screen. And it’s indexed.

So even in a corporate space, we run into the same thing where we have everybody using AI. And rightly so, I think that every engineer worth their salt should be using AI. Like I truly do. Will AI replace them in the short term? Probably not. There’s still, I think, many years before AI gets to the point where it can actually replace, like, a human, your consciousness, your decision process, your gut feelings, strategy, thinking forward, it’s going to be a little bit I think before we get there.

However, in the context of what you do day to day, every engineer should be using it because it is an enabler. What we’ve seen is when you enable an engineer with this, you can two to 10x their velocity. Now, one of the things we want to do is make sure that engineers are actually using AI. Because if they’re not, they’re not 10x in their work. In order to do that, we have to track that. Well, how do we track that? We’re looking at their actual confidence responses, right?

What happens when you forget that you’re in a session that’s being recorded? Now you’re talking about a performance improvement plan for one of your downstream direct reports. Well, whoever has access to those traces now understands that you’re working on a performance improvement plan. Like even with that sense, you still have to have layers of access and privileged access in different escalation paths. But the reality is that AI is going to be embedded everywhere, all over the place, which means that we’re going to have to have checks and balances for this.

We’re going to have to have clear guardrails, we’re going to have to have ways in which we can say this, but not that. And I don’t think there’s a whole lot of people considering that. In fact, I talked to—I think there’s three different companies now around this, because one of the things you want to try to do as a large organization, how do you bring all of the knowledge of the engineers, the work that’s being done into, like, a centralized brain trust?

Because what you don’t want to do if you have every engineer is 10x in their velocity, it means there’s going to be some redundancy. If everybody’s working on individual products, somebody is probably working on the same thing somebody else’s. How do you prevent that? Well, you have to have a unified memory substrate somewhere. There’s a bunch of boutique companies being stood up to do that. They’re using anything from Andrej Karpathy’s Wiki LLM, which is basically knowledge graph of markdown files with some links to understand anything.

Which is a structured JSON file that tracks things throughout all of the stuff. Or it could be something else. It could be using graph frag or lane graph or vector databases or PG, whatever, like there’s any number of technologies here, right? Everybody’s trying to solve that problem. Because what they realize is that the token spend is getting out of control. And for a lot of enterprises, it was go wild and spend as much as you want. Let’s do leaderboards.

Whoever spends the most is winning. We’re starting to realize that’s not sustainable. Now everybody’s like, “Well, how do I enable still? Would not spend a million dollars a year on a few engineers, right? We’re trying to figure out what that brain trust looks like. I’ve talked to a number of these different companies. When I asked that question, they’re like, “Yeah, we don’t really have a way to solve the sensitivity issue. Either you track it all, or you don’t track it at all.”

I don’t want all of the company seeing all the privileged communications, because more and more, we’re using AI to help us create PowerPoints and to manage personnel and do HR-related tasks. There’s just some of that stuff that you can’t disclose to the rest of the organization. You just have to say, “Well, you know what? If you’re HR, if you’re C suites, or if you’re a manager, you just can’t use AI. Because you might possibly talk about something sensitive that nobody else should see.” Now, I don’t think that’s the answer either. Anyway, I don’t think there’s a solution for this right now. I really don’t.

It is an interesting problem. It’s like, well, do you have different AIs for different…I’m in HR.

I’m doing a simple boutique.

The programmers have access to this. Everything has to get monitored separately. It’s quite possible, which is opposed to all being kind of in the same space.

It’s possible. But then when you want to start to learn from them, maybe somebody in HR did a really, really cool process. You want to capture that process. So the rest of the organization can learn how they did it. When you’ve got to do it in a separate tool and the separate system, and then you’ve got to put it over to this, then you know what I mean? Like, it essentially gets really complicated.

I don’t know how to solve that right now. It’s definitely an industry-wide problem. Hopefully somebody comes out with a solution that says, “Hey, the LLM just understands when it’s sensitive and can just restrict that.”

And you hope that the LLM knows what is and isn’t sensitive in a particular environment where sensitivity is not necessarily defined.

Or maybe you’re a startup and you have two people and it doesn’t really matter if there’s sensitive conversations, but it’s still flagging it. I don’t know.

I mean, those are the interesting challenges with stuff that is just changing so fast and being implemented so quick. That we’re, what’s the phrase? Over our skis a bit.

I think that the entire year, year and a half, when ChatGPT went mainstream, we’ve been over our skis.

Yeah. And so does that mean that we’re now, like, over our neighbor’s skis?

That’s like we’ve gone over the ski resort at this point.

We’re away. We’re over the ski. We’re over the community. We’re over the community now. Kind of like refocusing is how much as researchers, you have much visibility into what threat adversaries are doing with AI and, like, going, because I think there is a mindset difference from the red teams and blue teams, so to speak. If you’re not with a space that’s evolving so quickly, if you’re not up on what the adversaries are doing.

Absolutely. You have to be in tune as a CTI organization. If you’re not in tune with what the adversary is doing, you won’t succeed in this space. One of the ways in which we can see this is by monitoring what we see in the underground. I actually was doing this for my last company with the DDoS space because I was trying to figure out like, “Hey, when all of the ChatGPT stuff hit, when all of the different frontier models hit, and we started to see these underground GPTs launch, how was that going to change for DDoS?”

Because we could actually see over time the evolution of how adversaries were using this. When I was first tracking this, you would have these, I don’t know if it was like a term for it, but basically DDoS panels or underground DDoS for hire, Buddha stressor services, right? All of these different entities in the underground, and there’s hundreds of them. I think at one point when I had done an enumeration, I found 367 different services that were being offered. If you have…well, I’m not going to tell you how to do it. Anyway, you can go research it. Anybody listening can go research if you want to. I’m not going to tell you how, because I want you to get in trouble. Underground places is a very dark place. I encourage you to stay away from it if you can. Once you get there, though, it’s not that hard to find all these different websites or Buddha stressor services.

When you’re on there, when we first started tracking them, you would see a certain type of attack on there. Maybe it’s just a simple UDP flood. And you could choose how fast you want it to be you, how powerful it’s going to be, how many IP addresses to hit. But it was pretty straightforward. It was pretty rudimentary. Over time, they added TCP capabilities, then they added HTTP capabilities, then they added Cloudflare bypasses and JavaScript challenge bypasses.

And then they started adding, targeting, Minecraft servers and Fortinet servers and all of these different like evolution, right? Well, then it got to the point where they started automating some of this. One of the things—I’m going to probably butcher this—but I think it was called TCP connect. It was a capability that an adversary had added. This was right around the time that ChatGPT was going mainstream.

Basically what it was is an adversary could go in there and say, “You know what? I really want to attack this entity, but I don’t really know how to attack them. I don’t know what I want to attack them with. I don’t know what they’re susceptible to.” You could choose this particular attack type, you could put their IP address in there. The tool itself would automatically go out and try to figure out what the best attack was by doing a port scan. It would look at those ports and figure out what attacks do I have for those that would modulate the attack, looking for things like time-to-live values, hop counts.

Because what happens when you launch a DDoS attack and they have DDoS defense services in place? At some point, you’ll most likely see the hop count change because they’re rewriting their traffic to a scrubbing center. They would monitor these and then the TTL values would tell you if there’s, like, a lag in the pipe, or if they’re succeeding in these things, they would figure out what that trigger point was, and then they would back it off. That they could launch just enough traffic to stay under that mitigation aspect, and continue to affect that.

That wasn’t AI, that was pure automation. Then they started adding AI. They started with little chat elements in there. You would see this, like, I think one of them was called Sentinel AI 1.1. And it was just this little AI chat widget that you could just basically ask it and say, “Hey, I want to launch an attack.” It would basically guide you through the process of choosing the right attack. That’s where I left off when I joined this company. It was the last thing that I looked at.

It’s only going to go further from there, right? At some point, you’re going to be using all of these different other LLMs, they’re going to be using some of the open weight frontier models. You’re going to have really, really high power, really fast things. When you look at some of the recent things in the DDoS space, like a Suru and Kim Wolf launching multi-terabit per second attacks. I mean, most people can’t weather that. If you unleash AI into a harness that is that powerful, you’re going to have outages all over the place.

The adversaries are absolutely weaponizing this, they’re absolutely figuring out how to do it. Are they moving as fast as I expected? No. I did expect them to move a little bit faster, especially in the DDoS space. It seems relatively slow. I think that’s because there’s no money in it. It’s very, very rare that anybody would be extorted out of money for DDoS, because they know what’s going to end at some point, right?

It’s not like ransomware where the files are decrypted. Now we said we did have some adversaries getting into the triple extortion where they would attack the entity, they would get inside, they would steal all their files, they would encrypt their files, and then they would DDoS them if they didn’t pay. In those cases, the lever might work and the DDoS might actually result in extorted payment.

But for the most part, when it comes to just your DDoS expert, and you’re just taking my website down for 30 seconds or an hour, I’m just going to go to Cloudflare, or I’m going to go to Netscout, or I’m going to go to some other company, and I’m just going to buy services, and then it’s ineffective. I think that’s why maybe in that space, it didn’t accelerate as fast.

But you can see in other spaces now, looking at all these boutique services and the other offerings in underground, it’s moving much faster in other areas, especially in the phishing space. You get a phish now, and you can’t distinguish it from a real email. Most of the time, people are duped.

That’s particularly scary. I remember back when I was hosting my own stuff in a data center without any protection services that I could see, and I was never able to identify which DDoS as a service people were using. But it was very clear that I could see, “Oh, someone bought time on one of the DDoS platforms.” They targeted my site, and it would go from zero to 250 megabits, and it would run for exactly 15 minutes, and then it would….

Exactly that, because they paid for 15 minutes.

Exactly, like, “Oh, they paid for 15 minutes to see if the tool actually worked, and they pointed it at me. Great, thanks.”

Or they used one of the free services that offered five, 10, 15-minute increments of a free attack.

Once those things got beyond 250 megabits, I’m like, “OK, my hardware can’t stand up under this. I’ve got to do something else about it.” But it is interesting to see that the tools are trying to figure out what the thresholds are and to stay below the techniques or the defense techniques. This is more of an internet infrastructure.

What point do you think that the agent traffic, if it hasn’t already—we already know that non-human traffic has probably surpassed human traffic on the internet—at what point does agent traffic, like pure agent traffic, make human traffic look like a drop in the bucket?

I honestly don’t think we’re far from that. Will the internet infrastructure hold up to that? Honestly, OK, so the way that I see this, how would you define human versus agent-driven when the vast majority of people in the world now are using AI as a Google search? Is that agent-driven or is that human-driven?

Well, that’s human-driven. In my mind, that’s human-driven because you’re just….

How do you distinguish that on the network?

Well, you at least know where it’s going to and from, in a sense, that if I’m using a public model and I’m interacting with ChatGPT, it’s going between me and ChatGPT’s servers.

But you don’t know what ChatGPT is searching because it’s just going to go out and touch the entire internet, agentically. In some senses, it’s both. I would argue that now, today, the amount of agent-driven traffic far surpasses human-driven traffic. Because when I go and search something in one of my AI tools, it’s not just searching one website, which is what I would be doing. It’s searching 100 or more websites to find the thing that I want. I mean, 100x multiplier right there for one single search.

Yeah. With every company that runs a website now has to dial up their platforms to handle all this traffic. You have to have the LLM.txt file now instead of just robots.txt file.

It was funny because when this was first happening at my prior company, it’s all about service assurance. You had people saying, “Well, we don’t want the AIs touching our website because it’s causing problems.” And then that lasted for all of a couple of months. Now it’s like, “No, you have to have the LLM.txt file because that’s how everybody’s going to find your business.” And so now, “OK, bring on the traffic, but let’s have this file.” Anyway, it was just a funny anecdote.

I guess the ultimate underlying question is how do we monetize this? If we have a website that was previously driven by ads, I’ve got to monetize it differently if it’s agent traffic. If it was sales of products, “OK, well, if the agents are buying the products, then that’s OK.” As long as humans are still buying the products, it doesn’t matter.

Well, here’s something for you to consider. Is it the human that’s buying the product or is it the agent suggesting the product for the human to buy?

It is a very good question.

Are you familiar with Vercel?

No.

Vercel is basically, I don’t really know what kind of category to put them in, but they basically do web hosting. And it’s very, very early on, Vercel realized that agents or LLMs are looking for very, very specific things for finding services. They were able to basically modify their website in order to attract LLM traffic. What happened is Anthropic’s models started preferring.

Whenever somebody’s building a website, what is it recommending? “Hey, Vercel. Hey, Vercel.” Now it’s the preferred hosting method for all of the Anthropic models, which is really intriguing. It’s almost to the point where if you know how to game the system, like we used to do for SEO, how do you get the number one Google ranking? Well, it’s a completely different mindset now.

In fact, I want to say it’s like Grok, for instance. If you want Grok to notice your business, guess what? You better have an X account and you better be posting your products on X. If you want OpenAI to notice your stuff, you better have a Wiki page because it’s going to go to Wiki first to try to figure out what your business is and what your product offerings are. Then it’s going to drill down from there.

If you want Anthropic, you should have a Reddit account because it’s going to look at Reddit. If you want Gemini models to find you, you better have a YouTube account because they’re going to go through YouTube videos. You know what I mean? This whole thing, it’s a completely different paradigm shift.

It’ll be the probably short-term Wild, Wild West of AEO.

Yeah, I think it’s not the greatest term, but I think they’re calling it GEO SEO now. Which, sure, why not?

GSEO?

Yeah, it’s not the best GEO.

It really is an interesting thing. There was a YouTube—we’ll wrap up here shortly. I’ll tell the story. I watched a video on a guy who had AIs create competing lemonade stands in his neighborhood. And it was, “You figure out how to brand it.” You figure it like the AI has to figure out how to build it. One of the AIs went on, like, one of the local Thumbtack or something like that and hired, like it bought the lumber from Lowe’s and, like, created plans and it went out with Thumbtack and it hired two carpenters to come out and build something to build a lemonade stand.

And at one point, one of the AIs bought something from Amazon and it wasn’t the right size, it wasn’t the right fit. And so they returned it and the AI was like, “Oh, wait, you mean I can buy stuff and then just return it a couple of days later?” It goes, “Well, we’re only going to run the lemonade stand for one day, so I’m going to buy a whole bunch of stuff and return it the day after the lemonade stand was open.”

That’s hilarious.

It bought the little air wiggly arm things because it doesn’t care about the ethics of return limits.

No consciousness. It’s interesting, like, thinking through all of this. So I listened to a group of guys that run the Moonshots podcast. If you’re not familiar with it, I highly recommend it for the tech field. But Peter Diamandis on there was talking about this and one of the guys, Alex Grossman, he’s a very, very high IQ. One of the things that he was saying with regards to us in AI is that we are becoming meat puppets. The AI is starting to actually hire humans, like in your case for the Thumbtack. It really is odd. Strange.

I get hired by an AI to do a job. I have no idea why I’m here.

Yeah, exactly. I don’t even know who hired me. There’s no name. Just the job posting came through.

Somebody named Claude hired me? As we wrap up here, a couple of questions I want to ask you, and I love to ask the people in the cybersecurity space and anti-scam and anti-fraud space if they’ve ever been a victim of a scam, fraud, or cybersecurity incident, because it’s those of us that are practitioners and live in this space and talk about it on podcasts.

If we can’t get it right 100% of the time, the audience who isn’t spending hours a week thinking about these sort of things, they shouldn’t be feeling embarrassed or humiliated or that they’re somehow a failure because this is organized and that’s plotted. Has something like that happened to you? Do you have a story to tell?

Yeah, I’ll give you a story and then I could be a little background, something I did for my masters. I’ve been at this company now for about just over three months. It’s my first startup, and it’s very, very fast-paced compared to what I’m used to. One of the first things that I did when I got here was, “OK, how am I going to set up all my AI processes? I’m going to need something that’s going to give me daily day digests. It needs to synthesize my meetings, my transcripts. It needs to monitor my inbox so that if I get priority emails, I can answer them right away.”

I basically had this, I set up, I actually built my own AI operating system. I call her Lucy. So with Lucy, she monitors all of these things. Now, she only has read capabilities, so she can’t send an email, she can’t do all these things, but she read all this stuff. One of the things I had in there—I’ve got like three or four people where there are priority email senders. “Lucy, hey, you need to monitor any inbounds from these four people. And if there’s anything in there, I need you to open the email and I need you to summarize what it is so that I don’t miss these things.”

Well, I didn’t bound that. We have a really decent phishing security awareness campaign here where we’ll have an email campaign go out to the whole organization that’s completely legitimate. Like three hours later, our phishing campaign will send out almost identically the same thing, but it’s a phishing campaign. That’s what happened here where our CEO had sent something out. And Lucy’s like, “OK, here’s the thing.”

And then a few hours later, I get another thing from the CEO with an attachment related to the same topic. What does Lucy do? It opens the attachment. Anyway, just a case in point, if you’re going to use AI, you’ve got to be very careful. Even though Lucy only has read access, she still opened a file that shouldn’t have been opened and isn’t an alarm. Thankfully, in that case, it was in a sandboxing environment. It wasn’t a huge deal.

But, like, if that had happened, and it was a real phish, which that probably wouldn’t have been a real phish to mimic exactly what I had just been talking about with the CEO, less likely for that to happen. However, be careful. Like, if you’re setting up automated processes like that, do due diligence in there, like, “Hey, it must come from this email. It must include these things. Don’t ever open an attachment.” Always surface those, “Hey, if there is an email comes that has an attachment, cue that up for me to go look at it before you just blindly open something, right?”

There’s different ways in which you can do that. Honestly, as long as you’re conscious of the fact that this can happen, that’s going to solve a whole lot of the problem. I told you I was going to circle back to what I did my master’s on my very last paper for my master of science in information security was the humans as the weakest link. I did a huge deep dive, I did a bunch of surveys, talk to a bunch of different organizations to look at their security posture and the security awareness campaigns.

One of the things that I found was the vast majority of individuals that click on something are not the everyday layperson. It’s typically people that routinely get things that they need to click on. Just HR, right? HR is getting PDFs of resumes, and different other things. HR is highly susceptible. It’s most likely C-suite because they’re moving so fast, they don’t have time to sit there and sift through everything. They just need to like, really, really quickly click through things.

But there are some facet of people who just think that this will never happen to me. That’s the piece that I centered around. And so what I found is that in an average security awareness campaign, you’re going to have anywhere between five to 15% of people click. It’s just going to happen. It doesn’t matter how good you are. As soon as you get, maybe if you’re just two people, and you’re really good at security, that’s never going to happen.

But you get a company that has 100 people, you’re going to be in that same demographic of five to 15% of people will click on that email. Then the question was, “OK, if they did it, and you issued remediation training, will they click again?” Thirty percent of those same people will click again. OK, what about the next time? Twelve percent of those people will click again. You know what I mean? That there’s these different levels of it’s never going to happen to me.

“OK, I learned my lesson. I can’t possibly do that again.” Just be real with yourself. Like, this can happen to anyone. And with AI and automation, it’s going to happen even more. Just understand that it will happen and take precautionary steps to avoid it.

Know what you do when it does happen. You have to talk to…

Nobody report to.

The story I’ve always heard is you always have, if you need a PR company to deal with something bad that happens, you need to have the lawyer and the PR company figured out before the something bad that happens. Because you don’t want to be calling all your friends at midnight, your C-suite friends at midnight saying, “Well, who do you guys use?”

I mean, business continuity planning, right? I mean, every organization that has any number of people needs to have all of their business continuity, their risk planning, all of that stuff to be figured out ahead of time.

All that scary stuff. Thank you so much for coming on the podcast today. If people want to get connected with you, and they’re not nation state adversaries, how can they get ahold of you? And how can they learn more about Security Scorecard?

Sure. Securityscorecard.io. We mentioned driftnet. Driftnet.io is also a resource that you can go to, but then you can connect with me on LinkedIn. My LinkedIn is not my name. It’s Malware Analyzer, because I used to do a whole bunch of malware analysis back in the day, and so you can find me there. I’m sure we’ll get some links to you guys, but definitely check our resources out.

We also have a Strike, which is the brand of our threat intelligence or CTI operations here. We routinely push out really cool reports. We actually did a, once it was, like, 20-something pages, we call the can of worms. It was essentially breaking up in a Chinese nexus EPT. Highly encouraging guys to go check that stuff out, read through the resources. There’s a lot of really great stuff there.

Richard, thank you so much for coming on the podcast today. We’ll make sure to include links to all those in the show notes today.

Awesome. It was nice to speak with you, Chris.