Talkin' Bout [Infosec] News

The BHIS crew welcomes Andrew Morgan and Eva to explore social engineering, AI security, and why the “human operating system” remains difficult to defend. The panel discusses allegations involving NVIDIA’s CEO as a starting point for examining emotional manipulation, security awareness training, and layered defenses. Other topics include an SSH authentication bypass, basic flaws uncovered through AI-assisted penetration testing, unreliable AI-generated patches, and the future of secure software development. The team debates Goldman Sachs’ restrictions on AI coding tools, the risks of shadow AI, and the tradeoffs of local versus hosted models. Closing stories cover developer-targeted fake job interviews tied to cryptocurrency theft and research into residential proxies on White House networks, plus a preview of Right of Boom.

Join us LIVE on Mondays, 4:30pm ET.
A weekly Podcast with BHIS and Friends. We discuss notable Infosec, and infosec-adjacent news stories gathered by our community news team.
https://www.youtube.com/@BlackHillsInformationSecurity

Chat with us on Discord! -
https://discord.gg/bhis
🔴live-chat


Chapters
  • (00:00) - PreShow Banter™ — Un-patchable Humans
  • (07:53) - Local Chinese Model Seeks Nvidia Hardware – 2026-11-09
  • (09:38) - Plug: Right of Boom Conference and MSP Security Training
  • (11:06) - Panel Discusses Allegations Involving NVIDIA’s CEO and Social Engineering
  • (17:17) - Eroding Trust in Leadership and the AI Bubble
  • (20:23) - Terminal2Shell: A Parody of Vulnerability Disclosure
  • (21:31) - The Human Operating System: Security Training and Layered Defenses
  • (30:44) - AI Regulation, Election Disinformation, and Bot Traffic
  • (33:31) - SSH Authentication Bypass with Overlong Passwords
  • (34:09) - AI and Software Security: Finding Vulnerabilities, Writing Code, and Fixing Flaws
  • (40:36) - Goldman Sachs Restricts AI Coding Tools: Security, Productivity, and Shadow AI
  • (48:47) - Local and Open-Weight AI: Corporate Adoption and Security Tradeoffs
  • (58:13) - Goldman Sachs Follow-up: Why Restrict AI Coding?
  • (01:03:57) - Plug: Right of Boom Conference, BHIS Training, and Eva’s Keynote
  • (01:05:58) - Crypto Theft Follow-up: Fake Job Interviews Target Developers
  • (01:07:53) - Residential Proxy Research Points to White House Networks
  • (01:10:28) - Closing Remarks

Links
Right of Boom Conference
Right of Boom Conference; Eva’s Keynote

Allegations Involving NVIDIA’s CEO and Social Engineering
Terminal2Shell: A Parody of Vulnerability Disclosure
SSH Authentication Bypass with Overlong Passwords
Goldman Sachs Restricts AI Coding Tools: Security, Productivity, and Shadow AI
Crypto Theft Follow-up: Fake Job Interviews Target Developers
Residential Proxy Research Points to White House Networks

WHAT IN THE ACTUAL CYBER?! 2026 IN REVIEW

Click here to watch this episode on YouTube.




🔗 Register for FREE Infosec Webcasts, Anti-casts & Summits 
https://poweredbybhis.com

Brought to you by:
Black Hills Information Security 
https://www.blackhillsinfosec.com

☯️ Introducing BHIS Fusion Penetration Testing
https://www.blackhillsinfosec.com/fusion-penetration-testing/

Antisyphon Training
https://www.antisyphontraining.com/

Active Countermeasures
https://www.activecountermeasures.com

Wild West Hackin Fest
https://wildwesthackinfest.com

Creators and Guests

Host
Bronwen Aker
Bronwen Aker is a BHIS Technical Editor who joined full-time in 2022 after years of contract work, bringing decades of web development and technical training experience to her roles in editing pentest reports, enhancing QA/QC processes, and improving public websites, and who enjoys sci-fi/fantasy, Animal Crossing, and dogs outside of work.
Host
Corey Ham
Corey Ham has been with Black Hills Information Security (BHIS) since 2021 delivering red teaming and OSINT services. Currently, Corey leads the ANTISOC team at BHIS, providing subscription-based continuous red teaming to BHIS clients. Outside of his time at BHIS, you can find him out in the woods or up on a mountain somewhere.
Host
Ralph May
Ralph is a U.S. Army veteran and former DoD contractor who supported the United States Special Operations Command (USSOCOM) with information security challenges and threat actor simulations. Over the past decade, he has provided offensive security services at Optiv Security and Black Hills Information Security (BHIS) across various industries. His expertise spans network, physical, and wireless penetration testing, social engineering, and advanced adversarial emulation through red and purple team assessments. Ralph has developed several tools, including Bitor (set to release in January 2025) and Warhorse, which enhance efficiency in penetration testing infrastructure and operations. He has spoken at numerous conferences, including DEF CON, Black Hat, Hack Miami, B-Sides Tampa, and Hack Space Con.
Host
Wade Wells
Wade Wells has been working in cybersecurity for a decade, focusing on detection engineering, threat intelligence, and defensive operations. Wade currently works as a Lead Detection Engineer at 1Password, where he helps build and mature scalable detection programs. Outside of his day-to-day work, Wade is deeply involved in the security community through teaching, mentoring, podcasting, and running local events
Guest
Andrew Morgan
Andrew Morgan has spent nearly three decades in the trenches of the MSP industry, long enough to remember when MSPs were still called systems integrators. He started on that side of the business in 1998. As one of the earliest employees at ConnectWise, Andrew held a sales leadership role, created the “The Partner Summit” (now IT Nation Connect) and ultimately led the company's cybersecurity strategy, giving him a front-row seat to both the explosive growth of the MSP ecosystem. What he saw shaped a conviction that still drives his work today: the security of the SMB economy runs through the MSP, and most MSPs were never given the training to carry that weight. That conviction became Right of Boom, one of the few vendor-agnostic conferences left in the industry.
Guest
Eva Benn
Eva Benn one of the leading cybersecurity voices globally. As an international keynote and TEDx speaker, Eva is known for her disruptive thinking, unconventional storytelling, and high-energy stage presence. She has a unique ability to break down complex security challenges into captivating, actionable insights that inspire audiences worldwide. Eva has spent more of her security in red teaming and penetration testing, both as a people leader and hands-on practitioner. She is also the founder and host of Security Mondays, a podcast featuring conversations with many of the world's leading cybersecurity experts on the future of AI and security. She frequently speaks on topics such as red teaming, cyber threat simulation, adversarial tactics, and the future of cyber defense. Eva’s presentations challenge conventional wisdom, offering fresh approaches on how to outpace attackers and rethink security in an AI-driven world. Eva is currently a security leader at Microsoft. Before joining Microsoft, she worked in Big 4 cybersecurity consulting, leading global penetration testing and cybersecurity initiatives across various industries.
Producer
Ryan Poirier
Ryan Poirier began his time at Black Hills Information Security (BHIS) as the Video Producer and Editor in August 2020. Ryan polishes and perfects every webcast, podcast, and workshop on the BHIS, ACM, and WWHF YouTube Channels. Prior to Ryan’s time at BHIS, he worked for one of the largest public schools in the United States, conducting their video production and live broadcasting. He joined the BHIS team because he felt like it would be a great group of people to work with, and he couldn’t pass up the perfect next step in his career. Outside of his time with BHIS, Ryan does freelance photography, attends Cars & Coffee events, and expands his knowledge of audio and videos.

What is Talkin' Bout [Infosec] News?

A weekly Podcast with BHIS and Friends. We discuss notable Infosec, and infosec-adjacent news stories gathered by our community news team. Join us live on YouTube, Monday's at 4:30PM ET.

Wade Wells:

It reminds me of the time that Elon, like, said his windows in the cyber truck were bulletproof. And Oh, they're like, yep. I guess we're not.

Bronwen Aker:

Challenge accepted.

Corey Ham:

And then that got discontinued.

Ralph May:

Yeah. They just announced they're discontinuing it. And then Elon's like, oh, it's not for sales. It's so we can make more taxis. I'm like, bullshit.

Ralph May:

You're literally half, like,

Corey Ham:

half of

Ralph May:

the half of the whole inventory has been some lot and space.

Corey Ham:

I feel like they never actually sold more than they made. Like, it's got... It's been back overstocked since day one.

Ralph May:

Who wants to buy a driving dumpster, dude?

Wade Wells:

Dude, they're

Corey Ham:

they're they're rusts. That rusts.

Wade Wells:

They're all over San Diego. Like

Corey Ham:

Dude, I see them. I see them around, and I... There's this one person's house that I drive past, and they have one that's it's under a cover, but it's so obvious that it's a cyber truck just because of the shape of it. And it's like, wow, you're a brand new car. You can't park it outside.

Bronwen Aker:

Yeah. Go. Every time I see one, it's like, in what universe is that even remotely attractive?

Wade Wells:

Have you seen one with the shell on the back? No. It's not like a... It looks like a van. Like, cyberspace.

Wade Wells:

It's like... Yeah. It does not look great. Like, I like, I understand you may need a shell, but it does not help out the...

Ralph May:

I feel like this vehicle... Like, feel like the Cybertruck's gonna go down the history, like the Pontiac. What was it? Aztec. There you

Corey Ham:

go. Yes. The worst Aztec was a legend. Aztec is a legend. You get out of here with that negative Aztec energy.

Ralph May:

Worse

Corey Ham:

car. In breaking bad, man. That's the car he drives. It's like

Wade Wells:

I was about to say.

Corey Ham:

Yeah. Yeah. I I will say I did... I watched this video, and someone called the Cybertruck the PT loser. That really got me.

Ralph May:

The other one's like The one Yeah. The other one I've heard is the wanker panzer. That one's really popular.

Corey Ham:

Wow. Yeah. That one. I feel like it's also so funny. Like, you see them with the stickers that are like, oh, I bought this before Elon went crazy.

Corey Ham:

It's like, no. You didn't. This this didn't exist when Elon felt like

Bronwen Aker:

Elon has never not been crazy. What are you talking about?

Wade Wells:

What... No. They took they took deposits in, like, 2020. Right?

Corey Ham:

Like Okay. Sure.

Ralph May:

That's why that's why I ordered a Roadster too. I can't wait to get that thing and fly around.

Corey Ham:

Anyway...

Wade Wells:

Ralph got the Ralph got the invite to the special flying

Corey Ham:

one, if

Wade Wells:

you guys didn't know. He he hacked Tesla, got the invite. He's gonna be flying to people's houses any day now.

Corey Ham:

Oh, yeah. Definitely. That's gonna be street legal, for sure.

Ralph May:

Oh, yeah. For sure. Alright. Good driving.

Bronwen Aker:

You are being so quiet. And you're still muted.

Andrew Morgan:

There you go.

Corey Ham:

That's why he's being quiet.

Andrew Morgan:

Guys. How are you?

Corey Ham:

Good. How are you?

Andrew Morgan:

Good. Good.

Bronwen Aker:

Don't you know this is a participation sport?

Ralph May:

No trophies, though.

Corey Ham:

No trophies? No. Okay. Occasional trophies, but only for really good swears. Or great chicken articles.

Corey Ham:

Chicken articles. That's true. But but half. Most of the chicken articles are Overdue. Not good.

Corey Ham:

Yeah. We do have some

Ralph May:

good articles, kind of. It's mostly like hot goss right now.

Wade Wells:

Yeah. You you're absolutely right. It is hot. I'm not... I don't We

Ralph May:

all go to

Corey Ham:

the same article again. Long part. I can't do that. The jacket stays on. No matter what no matter what happens, the jacket stays on.

Ralph May:

Oh god. I don't... I I I saw this, and I was like

Corey Ham:

That can't be true. Come on. That's gotta be a psy op. Dude, yeah. We'll we'll hold off on that one.

Corey Ham:

Like That sounds like an idea he got from Elon, though.

Ralph May:

I I literally... My whole feed is just full of Jensen Huang Huang jokes, like,

Corey Ham:

the whole thing. I I know. It's so... It... But it's genuinely...

Corey Ham:

It... Yeah. It's a security... We can talk about it. It's it's fair.

Corey Ham:

It is a security thing. Like, this is social engineering. Right? Like, on some level, it's social engineering.

Wade Wells:

On the biggest level, it's just right there. I saw the... Someone posted that one where it's like dependencies, you know, where it's like Yeah. This huge thing. And then it's like, gent...

Wade Wells:

Jensen Wong's wife is that one sole dependency. I was like, bro.

Corey Ham:

This guy's getting

Wade Wells:

it's brutal.

Corey Ham:

I mean, they're only down 5% today, and I bet you it'll That's not gonna

Ralph May:

go anywhere. This has nothing to do with this stuff.

Wade Wells:

Let's buy low. That's

Corey Ham:

I I do like... I I was just... I was telling my partner about it, and I was like, I wish that this was the actual thing that popped the AI bubble. Like, I don't think it will be. I don't think it will be.

Corey Ham:

But I... Just for the story. So I could say that I was there. Like, it was all great. It was all great.

Corey Ham:

Okay. We had Claude. We had Anthropic. We had, you know, OpenAI. Everyone was And doing their then one guy One dude.

Corey Ham:

Decided to cheat on his wife, and then it just all collapsed. It's like, no.

Eva Benn:

Okay. So I've made a post about this this morning. Can you guys hear me well?

Corey Ham:

Yeah. Yeah. Yeah. Yeah.

Eva Benn:

So I made a post about this because I think it's quite interesting. This is a person of power with a lot of money. And, you know, my argument was that we are all still running on legacy human software. And no matter... Yeah.

Eva Benn:

I mean, like, seriously, there is a very big gap here. AI obviously is accelerating the ways that we can social engineer humans, but the good all, like, human to human social engineering, when you target big people, they're not immune to that shit. Like, they are all just, you know, just human. They run on legacy operating system with... Just like the rest of us.

Eva Benn:

And just...

Corey Ham:

Love that take.

Eva Benn:

I mean, honestly, I was just thinking... I I didn't see anybody else kind of, you know, like, look at it that way. There's a lot of memes. But the human operating system is inherently unpatchable. And there is no amount of knowledge or experience that could, you know, that could fix it when the amygdala is So

Wade Wells:

so we're we're gonna make a human application firewall. You have to talk to my AI before it gets Seriously,

Corey Ham:

whoever solves this Okay.

Eva Benn:

Like, go based on mental. I've been chipping at this problem for so long, and I think that we need a new way of, you know, actually human security training. Like, it's not knowledge. I'm sorry. But like, teaching people not to click links, teaching people how to, you know, make good security decisions is absolutely irrelevant when somebody is operating under urgency, because somebody has identified their personal vulnerability.

Eva Benn:

Like, if somebody is calling me, imitating me, my child, that they're in danger. Do you think that I am thinking about security training at this point? Absolutely no. My prefrontal cortex is not even engaged. Anyways, I'm very passionate about this topic, so I had to interject.

Eva Benn:

By the way, do you

Wade Wells:

see me delayed?

Eva Benn:

Do you see me delayed?

Corey Ham:

A little. The the the feed has to go... It goes through right to here and then back. It's a little delayed.

Ralph May:

You to could seeing, like, the actual Zoom feed as opposed to watching the feed, like, like, as an individual one, if that makes any sense. Right?

Eva Benn:

I mean Yeah. As long as as long as there's no technical No. It's not

Corey Ham:

that bad. Don't don't worry about it. Yeah. I agree with that take. I will say, like, I would hope, like, fingers crossed there was an air gap here.

Corey Ham:

Like, that's... Let's hope for this... The... For the sake of the stock market and Nvidia's future, let's hope there was an air gap and Jensen Huang doesn't actually know anything that would negatively impact Nvidia, like, tech wise.

Wade Wells:

That's not how networks are set up. Everyone knows all those owners. They all

Corey Ham:

ask for domain think she established c two? I don't think she established c two.

Ralph May:

She established something.

Wade Wells:

Texted him, and he just appeared. We got... We might as well roll the finger and just go to the yard.

Corey Ham:

Roll the finger. Let's yeah. Alright. Alright. Alright.

Corey Ham:

We'll we'll kick off the show. Alright. This is the show. Yeah. Isn't banter.

Wade Wells:

This is

Ralph May:

the show. Alright. Go ahead. Go ahead.

Corey Ham:

Hello, and welcome to Black Hills Information Security's Talkin' Bout News. It's 11/09/2026, and I'm Corey Ham, the COO of Black Hills Information Security here to talk about, well, the news. Shocker. Here to join me, we've got Bronwen, the director of looking like a librarian but using AI better than a librarian, I guess. Or maybe librarians are even better than library.

Corey Ham:

Who... How do we know what they're doing?

Bronwen Aker:

You know, librarians are not people you wanna mess with. They have it going on.

Corey Ham:

I agree. I wish I could look like a librarian, but I feel like people would not consider me approachable. So I'm just gonna lean into it. Wade, what's going on, man? Ted Lasso in the house.

Corey Ham:

How are you?

Wade Wells:

What's up? What's up? So I did a I did a Hamilton karaoke last week. Right? If anyone knows what

Corey Ham:

you're just gonna drop that? Yeah, it's just like a

Wade Wells:

so I have I'll throw pictures in the discord later. But complete Hamilton karaoke where you sign up for individual parts, and then you like they're playing and you go on it. And I played the king and and the first two songs. And I realized mustaches completely hide a lot of my emotion. Like I could not ask you where the mustache

Corey Ham:

did you wear khakis and like,

Wade Wells:

I wore I went full outfit. I have a wig. I have a crown. You name it. I'll throw it in there.

Wade Wells:

But mustaches hide emotions. So I'm gonna grow it more. So you can't tell when I'm crying.

Corey Ham:

I see. I see. I always look at people's mustaches to see if they're crying. That makes sense. We also have we also have Andrew Morgan.

Corey Ham:

Andrew, you wanna introduce yourself?

Andrew Morgan:

Yeah. Hey, Corey. Good to see you and good to see the team. I am the founder of a security conference called Write a Boom. Little bit tangential to what you guys do at Wild West Hackin' Fest, but John is involved with it.

Andrew Morgan:

We focus on the MSP community, and MSSP community do a lot of training and certifications at it. And we were... We we look forward to having a lot of your team there, like John Patterson, Jake Williams, and some of the other folks that were at Wild West Hackin' Fest. So thank... Thanks for having me.

Corey Ham:

Yeah. Thank you. And then, Eva, you're keynoting. Is that right? Is it Eva or Eva?

Corey Ham:

I'm sorry if I mispronounced it. It's Eva. Yes. I'm Okay.

Eva Benn:

Keynoting. I'm super stoked. It's gonna be awesome.

Corey Ham:

Yeah. I'm sure it'll be awesome. I can't wait to hear about all your other takes in addition to this amazing Jensen Wong take that you're you're gonna give again because we have to get back to that on the actual recorded podcast.

Andrew Morgan:

Don't nerd

Eva Benn:

swipe me. Don't nerd swipe me.

Corey Ham:

Okay. I won't. Don't worry. And then lastly, with introductions, we have Ralph who's appears to be hiding in the dark, but he's actually just wearing a gray shirt.

Ralph May:

Yeah. I know. Hey. How's it going? Just, you know How's life?

Ralph May:

That gators are real and AI is hallucinating. So

Corey Ham:

That's that's true. It hallucinated a whole scam with a a Chinese spy. Wait. No. That was real.

Corey Ham:

So... Okay. So let's... I I I do... We we went live like mid banter about the Jensen Huang situation, but I think we should cover it.

Corey Ham:

I mean, it is security related. So for those that are living under a rock and don't look at memes, Jensen Huang, who's the CEO of Nvidia, the most valuable company on the planet right now

Ralph May:

And the center of AI.

Corey Ham:

He's the center of AI. He... The justice department, The U... Like, correct me if I'm wrong on any of these details. But the US justice department announced that they were investigating connections between him and a Chinese spy.

Corey Ham:

That's what happened first. Then, over the weekend, Jensen Huang issued a statement to Nvidia employees basically being like, oopsie, I cheated on my wife. I'm sorry. I'm sorry. And then the board of Nvidia was like, we are opening an independent investigation into this.

Corey Ham:

And, you know, like, the board is kind of trying to sound independent and different from the, you know, the company. So... And yesterday, he admitted he admitted that it happened. So basically, what we know is there was an affair between the CEO of Nvidia and a Chinese spy. We don't know any other details from my perspective.

Corey Ham:

We don't know whether she got trade secrets or whether she got IP or what her plan was. We don't know. But we know that this didn't help Nvidia's, you know, stock price.

Wade Wells:

We do know that the US government knew about it very early on and did not do anything because they were more like, let the market go Yeah. Which is awesome.

Corey Ham:

Capitalism?

Ralph May:

Why Yeah. Why does the US government care about a CEO's affair? Well, it's primarily has to do with the trade embargo with the actual graphics cards. Right?

Corey Ham:

So Yes. Right.

Ralph May:

I mean, otherwise, the US government really doesn't care. Like, that's not really, like, deep in there. Like, you know, don't send the CIA.

Corey Ham:

Well, they love to spill the tea, dude. I don't know what you're talking about.

Wade Wells:

China doesn't need graphics cards. They don't need anymore. You know? They're just too many.

Corey Ham:

Yes. Yeah. So there are... Yeah. Well, there's so there's trade restrictions.

Corey Ham:

So... Okay. There's... I I think there's two things. One is, yes, there's trade or export restrictions on certain GPUs.

Corey Ham:

That's thing number one, which basically China's trying to get GPUs like everyone else is, but they're all sold out on Amazon or whatever. So, you know Yeah. Gotta use espionage instead. But the other thing is that China wants to copy, you know, the... This is the whole, like, Taiwan versus China.

Corey Ham:

All GPUs pretty much are made in Taiwan. China had... Does have their own... Like, there's some Huawei chips and other, like, actual chips that are manufactured by Chinese manufacturers, but they're not on the same level. So, basically, they wanna steal the manufacturing process and use it for their own gain.

Corey Ham:

So that's like... It... It's not clear whether they were going after that or whether they're going after just, like, the ability to... Know, you maybe they're just trying to influence Jensen Huang to be like, hey, you should like send us a couple pallets of h two hundreds just as like a nice gift because you love your girlfriend. Yeah.

Corey Ham:

We don't know. But it's sketchy. And I guess, Eva, I I do want you to rehash your take. What is this vulnerability? How did this happen?

Eva Benn:

Yeah. So we were just chatting right before the show. I actually made a post on this on LinkedIn, and I literally pointed an arrow at him and just said he's running a legacy human software. So essentially, we're all running a legacy human software. We upgraded our technology.

Eva Benn:

We spend billions of... On fancy tools, fancy devices, but we're still running on a human operating system that hasn't been updated for thousands of thousands of years. We're still driven by the same things by our primal instincts. So what I was... The point that I made earlier and what I wanna make is that I think that while this is a position of power with a lot of money, with a lot of visibility and control.

Eva Benn:

None of that can fix that. He's still running on the same software we're all running. And so, inherently, the human operating system isn't patchable because when we are under high emotions such as fear, anxiety, urgency, when our bodies are dysregulated, and in this case, it could be a very strong attraction, we cannot reliably, you know, make decisions based on what we know. So we might know well, but that doesn't mean that we act well. So this is the problem that I stated in my post on LinkedIn this morning is I believe that the security training as we know it is no longer sufficient.

Eva Benn:

Nobody is, you know, just because that they are a position of power, just because they know better, even ourselves, like we're in security, we are all vulnerable when we're under, you know, attack, when we're targeted. Every single one of us can be exploited, I believe. Like, even us. Even no matter how technical, no matter how smart you are, everybody has their kryptonite. And I think that the the problem that we're facing is a million dollar problem, and I've been thinking about how to solve it.

Eva Benn:

I don't know. I'm actually curious about this this group. But I think security training needs to go beneath the surface of just knowledge and really into how we make decisions subconsciously. And I I don't know. Like, I've been trying to figure out a problem.

Eva Benn:

We need to figure out what does that human firewall look like. I don't know. Whoever came up with this is probably gonna be a billionaire. What do you

Corey Ham:

guys think? I mean, I fully agree. I think it's hilarious that way to frame it of like legacy, you know, this particular brand of operating system, like the older gentleman and it's, you know, with a billion dollars is a particularly vulnerable operating system from what we've seen. But I've

Eva Benn:

been very very appetizing with their high value target.

Corey Ham:

Therefore Yes.

Ralph May:

Our

Eva Benn:

company is willing to invest more in identifying, you know, the vulnerability. Like, it's

Corey Ham:

I Yes.

Eva Benn:

The terrain is higher. Right? The terrain to get to them is higher. But they're gonna be much more interested going after them than after me or you. Yes.

Andrew Morgan:

Corey, I I think, you know, Eva, great job. I don't know if you guys have heard of a book called The Fourth Turning by Neil Howe. And it talks about how as a society, we go through these periods. And we are in the myths or heading into a fourth turning, and it's basically as... You know, there's four four four components to it, but we're in the area right now where trust in leadership is eroding and you eventually move into, god forbid, but, you know, examples are, you know, a civil war.

Andrew Morgan:

Examples are what happened in our country during, you know, the sixties with, you know, the JFK, Martin Luther King, and all the upheaval eventually come out of it. Right? But but you see, you know, these people of authority feel almost above the law. We're seeing it, you know, we see it in our government. We see it in everything.

Andrew Morgan:

The reason I wanted to to mention that is, you know, there... It doesn't surprise me. Right? You're seeing a lot of precursors to cracks in the AI bubble. Not that I'm calling it top, not this investment advice, but you don't have to look too far.

Andrew Morgan:

Just look at the, you know, the neo clouds like CoreWeave and Nebius that have literally gotten cut in half in terms of... They need even more, their market value. Again, related to related to Nvidia. And you're also seeing things like the South Korean stock market, which is really the home of the DRAM companies, you know, Samsung, etcetera. I just think it's kind of emblematic of the the time we're living.

Andrew Morgan:

And I hope... You know, I'm optimistic. Right? This isn't a pessimistic thing. But I just wanted to kinda highlight that and see, you know, what your all thoughts are on on that as we are in this kind of era in our in our society.

Corey Ham:

Yeah. I mean, I don't know. I feel like the... I mean, I don't disagree with the notion, but I feel like this just happens at this point. The the pace is accelerating.

Corey Ham:

The the end of the... Whatever you wanna say, the OODA loop shrinking, you know, to find whatever, you know, framing you wanna give. But, like, it feels like in our society, it's like in a week, we do a a whole another turning and then and then another one. And then it's like, I feel like at some point, it all blends together, and I'm just like, I don't know where we're at. Neither does anyone else.

Corey Ham:

But here we are. We're we're we're here right now here. But as far as anything outside of that frame of reference, I have no idea what's going on. Yeah. But...

Corey Ham:

Yeah.

Andrew Morgan:

I the whirlpool analogy. That's that's great.

Corey Ham:

We'll see. I mean, we'll see.

Eva Benn:

It's a whirlpool. I don't even remember. Like, I I don't know about you guys, but I'm starting to, like, lose track because there's so many, like, security news, so many incidents, so many new AI developments every single week. I'm... I feel like we're just in this timeless existence right now.

Corey Ham:

Yeah. Very true. Yes. A 100%. I like...

Corey Ham:

Don't know if you guys saw the, like, joke that was, like, terminal2shell. Did you guys see that? So the... I think the website... Someone can find it and post it, but it's terminal2shell.com.

Corey Ham:

And it's basically... I started my... One of my testers sent me this, and I started reading it, and I got that, like, trauma response. I was like, oh my god. Oh, no.

Corey Ham:

Every client's gonna be horrible. I'm gonna have to go. And then and then I'm getting re... I'm reading it. I'm like, wait.

Corey Ham:

Hold on. This is a joke. This is literally just it's literally just the terminal is a shell. Like, it's like, okay. I get it.

Corey Ham:

But, yes, I definitely reacted to that and was immediately like, oh, no. Not another PHP two shell. Not another broccoli God. Broccoli shell, node shell. I'm like, oh, there's too many two shells.

Corey Ham:

Another one. Another one. So, yes. This vulnerability will not be fixed. As you can see in the vulnerability disclosure timeline, he he brought it up to Ubuntu and they said, yes.

Corey Ham:

This is what a terminal does. So anyway, this one will also go unpatched just like the human operating system.

Eva Benn:

Yes. I think

Ralph May:

I think the most interesting part about that is that, like, yes, we can't patch the human operating system, and I totally agree with you. But we already have so many things we could patch. It's like Yes. It's like all of these things. It's kind of like, you know, put it on that scale.

Ralph May:

Right? I'm not sure we should totally forget it or, like, you know, not important. Right? You

Corey Ham:

know? Yeah.

Ralph May:

To your point, so many vulnerabilities and so many things right now that, you know, this is just yet another. Now I will say, though, one one thing I will want to mention about actual trade craft at place. Right? This is ultra super common in state on state, nation on nation trade craft. This is not new.

Ralph May:

Everyone talks about it.

Corey Ham:

Romance fraud

Ralph May:

or whatever.

Corey Ham:

Romance. Yeah.

Ralph May:

It's a honeypot. It's a... It literally pot. This is like CIA, like, one zero one. Right?

Ralph May:

Like, if you're, like, junior rookies, you know, agent, they're they're gonna talk about this. Right? Now does that mean that it doesn't happen? No. They talk about it because it happens so much.

Ralph May:

Right? It happened again. Right?

Corey Ham:

But I kinda feel like this goes back to Andrew's point about the turnings of, like, this is, like... It's a probably a blind spot because it's, like, that's an old technique. Like, this guy probably went to, like, eighty hours of fishing training, and they skipped the part about, like, watch out for sexy ladies. Like, you know what I mean? Like

Bronwen Aker:

Okay. But there's there's another factor, people, and it gets back to this business of our human operating systems being unpatchable and unpatched. Men in power tend to think that pretty women walking up to them are just there to flatter them, and they take it in a complementary manner. This is a known vulnerability. It's not going to change anytime soon.

Corey Ham:

What's the CVSS score? It's gotta be, like, nine at least.

Wade Wells:

I I We keep

Corey Ham:

putting we keep putting them in power. They keep getting hacked. I don't know what's going on.

Ralph May:

Know what to do.

Wade Wells:

Well But here's the other thing.

Bronwen Aker:

Here's the other thing, though. When security is hard, it's always gonna fail. And the only way that we're going to be able to get around the flaws in the human operating system is basically to make it such that the human operating system isn't the first line of defense. And that means that we have to make security easier and have it built into our other systems more effectively than what we do today. We have been consistently failing.

Bronwen Aker:

And I'm speaking as a former developer at... With decades of working with and around other people who write code professionally. We have sucked at security for as long as we have had computers. End of line. That needs to change.

Bronwen Aker:

And until it does, we're gonna keep seeing the same stuff over and over and over again.

Corey Ham:

I don't know, Bronwen. I... I'm gonna have to disagree because it's not like just last week, there was a vulnerability where if you just typed a password over 256 characters, it would let you in. That didn't that didn't happen. Right?

Ralph May:

Nobody used that long of a password, Corey. That that that

Corey Ham:

So what I'm talking about passwords

Bronwen Aker:

I have.

Andrew Morgan:

He's a one of them. I wanna hear Eva's take. She she she was itching to say something. Go ahead.

Eva Benn:

Oh, no. I mean, I don't know. I did have so many thoughts already. Look. I personally believe that if Kevin Mitnick is one of my favorite people in cybersecurity, I always find a way to bring him in my keynotes.

Eva Benn:

And, you know, one of the things that he famously said is why go through the trouble of, you know, hacking your software where humans are so easy? And I think that this continues to be true. And AI has introduced just more ways for us to to interact with humans and to exploit the human operating system. I'm not saying that this is our only issue, obviously. Obviously.

Eva Benn:

I do believe that we have a lot of problems that we still need to solve on the technology side. I'm not saying this is fixed. But I do believe that we absolutely need to look into new ways to protect a human operating system in this new age of AI where deception happens at machine speed. I'm so sorry for the buzzword. But, you know, there's new ways for us to...

Eva Benn:

You know, we... This is the first time in history where we have software that interacts with us, that engages us emotionally, just like other human beings. So it does require us for us to rethink how we do security training and how we protect humans, the human layer.

Wade Wells:

You know what? You guys are all putting the blame on Jensen. It was his personal securities problem. Right? This dude's a billionaire.

Wade Wells:

He's got armed guards around him all the time. Like, I hate to say that no one could have just like, one could have just like, cock blocked him. Does he need like one female security guard? Like, you get what I'm saying? Like, this this out?

Wade Wells:

That is the the firewall.

Eva Benn:

Like an attacker. This is what I'm saying. This is what I'm saying. This is talk about AI and interacting with AI. It's friendly.

Eva Benn:

It's always available. It's always kind. Like, this is not how an attacker works. And this is why our guard goes down and this is why we are, you know, letting them control our decision making. When when the guard is down, when the prefrontal cortex is unfortunately incapable of making decisions, there is no amount of training.

Eva Benn:

Like, there's no amount of training that that could solve this. Right? If you get a call, and I I made this example earlier. But if I get a phone call that sounds like my son that he's in danger, will you be thinking about what you learned in security training, or will you be acting out of instinct? Of course, you could be acting out of instinct.

Eva Benn:

That's how we are biologically made.

Corey Ham:

It is so romantic when someone records all your calls.

Ralph May:

I love that. I think that's adorable.

Eva Benn:

It is. Oh, and this is the other thing. Like, I think it's traditional... This this is the last thing I'm gonna say on this. Traditional training is basically, like, trying to fix vulnerable human...

Eva Benn:

Vulnerable operating system by putting secure software on top. Right? Like, you can't do that. You gotta go into the OS layer, and then you can install software to fix it. So anyways, my 2¢.

Eva Benn:

I'm gonna stop here.

Bronwen Aker:

Alternately alternately, what you can do is make sure that the vulnerable software is isolated the same way we do in other systems where you you have... This is an essential something. It is vulnerable. It's always gonna be vulnerable. Fine.

Bronwen Aker:

Isolate it.

Corey Ham:

Yeah. I I I mean, I agree. It's basically like we don't need, like, in this specific case, it's like, yeah. Wade's right. You put layers of security around.

Corey Ham:

I mean, also, let's talk about how I'm just gonna say Jensen Huang might be the most sane CEO out there. Like, it gets... It only gets worse from here. I mean, think about, like, an... Like, I mean, think...

Corey Ham:

I mean, if the only thing tweeting about why he needs your RAM, and he's coming over to get it. We've got Dario Amode going to Starbucks and writing up 50 page blog posts why the US government needs to regulate anthropic and then freaking out when the US government regulates anthropic. We have Elon Musk making

Ralph May:

Everything. Rocket Yeah. Like, our only our only thing we

Wade Wells:

can say is he wears a leather jacket. That was it. That's our only, like Yes.

Corey Ham:

Yeah. Like, he he... He's the most sane of all of So it's only like, yes, you have... You cannot patch it. You can't...

Corey Ham:

You just have to air gap it. It's Windows XP Yeah. Living on your network forever. Yep. You just put it in the corner and you say it's a known risk, and that's about all you can do.

Ralph May:

I'll I'll mention one last interesting...

Eva Benn:

Agree Yeah. With I agree with that. Like, make it hard to get, like, just... Yeah. Air gap is...

Eva Benn:

But but it's... Yeah. Yeah. I mean, like, I was thinking about this also. How how do you find that balance?

Eva Benn:

You know? Because they also need to know Yeah. That. Right?

Ralph May:

I'll I'll tell you the most interesting thing I read today, and that is the fact that, one, they didn't have a prenup, and she would be set up for $84,000,000,000 in the split, which would

Corey Ham:

be Yes. McKenzie Scott two point o? Yes. I need another McKenzie Scott in my life.

Ralph May:

Yeah. No. No. Hold on. Just just for context, $84,000,000,000, which I can't fathom in my mind, but somebody told me

Corey Ham:

How many h 2 hundreds is that? Like, That's

Ralph May:

more money than Bill Gates lost and probably every Elon relationship and Jeff Bezos. So it's a lot of money. Let's just play.

Corey Ham:

If you're listening to this, do it. This guy's not gonna change. Just like we talked about patching, he's not gonna be patched. Pull the trigger, baby.

Wade Wells:

I like Anyway, our podcast is... Oh, go ahead.

Andrew Morgan:

Oh, I was just gonna say, could the positive coming out of this maybe where you have a Austin Powers meets Wild West Hackin' Fest skit. You know, something, you know, at at at the event. I mean, this this

Corey Ham:

I I I love it. I I will say I was even thinking, like, this whole Chinese spy thing, like, sell the Netflix rights to this immediately. This is an amazing TV show. Like, where where do I sign up to watch this? I don't know if John Strand needs to be involved, but I'm sure we can get a leather jacket on order.

Corey Ham:

You know? I'm sure he'll be up to it.

Ralph May:

What... We also have the the other kind of transition for the AI. So Jensen, we've... I think we've harped on him and

Corey Ham:

Yeah. Yeah.

Ralph May:

But poor guy. The other the other piece of AI news, right, is the the whole midterms. Right? And not to get to the political side of the midterms or what you thought about the midterms. That's that's that's fine.

Ralph May:

Whatever happened is what happened. But what what is happening from the AI side of it is they're saying, you know, we're gonna put, like, the stop on this. And what do you guys think? Not not not... What do you guys think?

Ralph May:

Not about the political piece of that. Right? But what do you think about stopping AI where we are? And like, would that help in, you know, anything? Like, what...

Ralph May:

What's the what's the benefit here from maybe either a stop or not stopping? Right? Because...

Bronwen Aker:

Yeah. Yeah. It's interesting that you bring that up, Ralph, because some of the stuff that I've been reading post midterm as speculated that

Corey Ham:

part of

Bronwen Aker:

the reason why the blue wave was successful, and I'm not saying one way or the other value judgment on whether it's good or bad, But some people are crediting the takedown of Yandex and all of the bots and the bot traffic being generated

Ralph May:

by that. The Russian disinformation machine?

Corey Ham:

I I think it was just the

Ralph May:

$6 diesel.

Corey Ham:

That's a really inter... I was gonna say that's a really interesting take. I think I I would basically say, I would actually credit more Andrew's concept of, like, the turning. I feel like this is just the pendulum. Mean, there's there's a bunch of different individual points you can point at, which I agree with.

Bronwen Aker:

And I'm not saying that that that turning isn't a factor. There's so many layers going on. There's so many different facets, and that's part of the reason why it's so difficult to predict what's going to happen next. But I thought that it was an interesting take that that might have been a contributing factor because what? The the bot traffic dropped to point 4% of the normal amount to the point where certain political officials wondered why specific social media suddenly became very negative about the economy and prices and stuff.

Bronwen Aker:

And it was suggested that, well, yeah, you're finally seeing humans posting instead of all the bot traffic.

Corey Ham:

Yeah. I mean, I I will say, like, I do think from a technical perspective, I don't think there's any... Like, the bot traffic that has technically actually been proven to drop was basically scraping traffic. I don't necessarily think there's a technical source that's proven bot traffic as in, like, social media influencer bots. Maybe that exists, but I I'm not aware of that.

Corey Ham:

I think they're just basically saying, like, the scraping bots shut off. But I don't actually know. Hopefully, there's an article about it someday, and we can talk about it more. But let's keep moving into some other articles. So I did wanna highlight real quick the SSH whole thing.

Corey Ham:

Basically, that joke I was making earlier is real. If you typed into certain Linux distributions, a password over 256 characters on a password password less account, it would just let you in. It seemed like it mostly affected like dockerized, like Yeah. Alpine.

Ralph May:

Yeah. It was very like small distros. It wasn't like the large set. It's not like your Mac or your regular

Corey Ham:

It wasn't a Bout or Debian. Yeah. But still, just an example of like, this is the table stakes, I guess, is something that silly could just slip by. And I will say like, using AI against our clients, we're finding stuff like this all over the place. Not this broad.

Corey Ham:

But like, for example, last week, we're doing an agentic pentest of a web app, and we found the LLM just decided to set the... It set its own cookie for admin. It just said, my role is admin. And, of course, the web was like, oh, well, I guess he's an admin. I better let him in to all the admin So it's like that, you know, that app's probably twenty years old or whatever.

Corey Ham:

It's like the dumbest thing ever, but that that stuff is

Ralph May:

more whether it's 20 years old. I was doing one they just wrote, probably vibe coded it. Same thing. Right?

Wade Wells:

You

Eva Benn:

did hear what I

Bronwen Aker:

said about developers not knowing about security.

Corey Ham:

I mean Are you saying... Bronwen, are you saying that LLMs were trained on developers who also didn't know anything about security? I don't know.

Ralph May:

Oh. They did.

Bronwen Aker:

Yeah. Well, they did snarf up all of Stack Overflow and Reddit. So what do you think? I don't know.

Eva Benn:

I actually think that in the past, we've always had this gap where we have developers who are builders, and then we have security people who are defenders. And I actually think that with AI, we have this opportunity where everybody is a builder, everybody is a security person. I think that we're going to start to blur the lines. And while people... There's been a lot of, I guess, mixed opinions about vibe coding and whatnot.

Eva Benn:

But, I mean, what developers used to do in the past, they would just go to Stack Overflow anyways. Right? So now they just... I feel like with AI, it's probably more secure code anyway. So I don't know.

Eva Benn:

I I feel like that this is... We're going to see an improvement in code security overall.

Corey Ham:

I I kind of agree with you.

Ralph May:

I kinda hate the the rhetoric that you see like, oh, if AI wrote it, it's insecure. I'm like, if humans wrote it, it's insecure. Where are we going this? Right? What did you try

Bronwen Aker:

to say? Secure code only happens when there is a mandate from the top that security is a priority.

Ralph May:

So that's the fun thing about something like AI. Right? Like, you can do so much more from the security side. We're talking about it constantly. Right?

Ralph May:

If you can find a vulnerability, then AI can fix that vulnerability in that same code at that same pace. Right? It's just whether you understand that those exist or that you understand what's going on there. So I think that's kind of the joke around about the vibe coding. It's essentially someone trying to build, I don't know, a game or whatever, and they kind of understand what they wanna do, but they have no idea about security and, like, some of the fundamentals.

Ralph May:

Just the fundamentals around it. And I think that's where we see the the gaps.

Bronwen Aker:

Okay. Here's something that I think we need, though, in the DevOps space. Claw and other LLMs, they have the ability to create skills, to use context libraries, to do all of this kind of stuff. What we need is instead of just skills and and all of these resources for red teamers and blue teamers, we need to have a similar repository of skills for developers that will help teach the AIs to write code securely from the ground up. And if we can get those more popularized in the development sphere, that's going to make it a lot easier for Vibe coders to be able to generate secure code because most vibe coders, they don't know anything about coding to begin with.

Bronwen Aker:

Why would we possibly expect them to know anything about secure coding?

Eva Benn:

Well, that actually exists, and I'm not gonna, like, throw any company names here, but there are a few companies that are chipping at this exact problem to varying degrees. I think that with AI... Previously, we had our standard software development life cycle. Right? We've got the design.

Eva Benn:

We've got the code build, all that stuff. The security development life cycle basically came after it. We've got scan the code, check the build, then we do fuzzing, then we do a pen testing, red teaming, bug bug, all that stuff. That's actually all collapsing now. So I think that with some of those things, what you discussed, that there are these native tools that integrate with the AI coding platforms natively that we...

Eva Benn:

I think the next era of developers are not even gonna think about security because everything is gonna happen in the background. And the the secure code is actually being written, like, natively instead of, like, writing the code, then waiting for the next... For the static analysis, then waiting for the dynamic analysis, waiting for all the other checks at the end. So I I don't... I think that this is...

Eva Benn:

I've been talking a lot about this to a lot of people about the collapse of the security life cycle. It used to get so much more expensive the more right we go, and now I feel like the shift left is just taking another new meaning with AI. So we're only scratching the surface in this space.

Andrew Morgan:

I like what Bronwen... You... What you said though about... Or, you know, did we teach the LLMs, you know, incorrectly? And there's a gentleman named Keith Hoodlet off by one labs.

Andrew Morgan:

It's like one password security research team. Wade, I see maybe smile to you. I don't know if you know him or not, but did some great research on... I forget exactly how many vulnerabilities, but he put them into different frontier models. And long story short, only...

Andrew Morgan:

And asked, hey. Can you remediate these vulnerabilities? And only 20% were actually correct in in the patch. Most either created new vulnerabilities or were were not effective patches in the first place. Are you familiar with this a bit, Wade?

Andrew Morgan:

And do you think there's something to what Bronwen said the way they're being trained?

Wade Wells:

So I I work at one password. I I run the detection and

Andrew Morgan:

Oh, okay. So you know Keith. Okay.

Wade Wells:

Yeah. Yeah. So the the overall study, it was like, I believe, very little percentage. Like, the worst worst case was that it didn't fix the vulnerability and added a new vulnerability. Right.

Wade Wells:

Then there was one where it didn't fix the didn't do anything and broke the system. Or there was like several different configurations for it.

Corey Ham:

I always do.

Wade Wells:

I know. Right? I know. I don't don't I don't click on any links Corey sends me anymore just to let you guys know. That was one time.

Wade Wells:

But anyways, I don't like, I know we're talking about like straight to development and everyone being an AI coder and stuff like that. But then we were looking at this article where Goldman Sachs is pulling bankers and traders from Cloud Code, right? And as a as a defensive person, I think that's the way to go. It's not not everyone needs access to Cloud Code. Right?

Corey Ham:

Yeah,

Wade Wells:

you can give them access to others terminals that where I can as a security person, I completely own the flow and what you access to it and doesn't give you complete reign of your computer. Maybe it gives you access to some servers in the back end where we can also monitor, right, and then monitor chats and stuff like that. I think that is more of the way to go at least what we're going be coming. And then with that, you're going to be able to inject skills, inject different things at an easier rate. Right?

Wade Wells:

It's like that's the old fashioned, like, if you if it like that guy talk about this with insider threats. If someone wants to steal a file, they're going to be able to write. Or if someone wants to do something on a computer, they're going to find a way. So you make the way easier, very much like how the streaming platforms go. If you really wanna pirate something, it's not hard.

Wade Wells:

But if you make it easier to do it legitly, like, that's the way you wanna go. I feel like that's the way we need to move.

Ralph May:

The other thing I've I've noticed too is that this conversation has come up with, like, the models when

Corey Ham:

it first started. Right?

Ralph May:

When the first AI models were out, it was like so... It was so easy to make Bout of Chat. No. Oh, man. It is...

Ralph May:

This thing is so

Corey Ham:

How many hours are there in Strawberry again?

Ralph May:

Yes. Exactly. Exactly.

Wade Wells:

I haven't

Ralph May:

tried that They still come out with these. Right? They still

Wade Wells:

come out

Corey Ham:

with Yeah. It still has blind spots. Yes.

Ralph May:

Yeah. It has progressed so much. And it's like that same article that says, right now, AI can't do this. Six months six months from now, that article will be disproved in all the ways that it it like it's foundationally makes sense. Right?

Ralph May:

Which is the wildest part. I mean, right now, they're literally having AI improve smaller AIs because this AI can read the weights of the actual model, the actual just weight of the model and make a 27,000,000,000 model better at certain things. This is like the self recursive piece, right, we're getting into. And not to say that where we are isn't where we are. It's just how long will it take for that statement to be inaccurate?

Ralph May:

It might only be a couple months.

Corey Ham:

Yeah. Yeah. I I will say... And I I wanna get back to the Goldman Sachs article because I think that's a really good discussion to have. And, basically, like, the thing I wanna pause it to the chat or to the chat and the other host would be, like, do we think this is GRC that drove this, or do we think this is, like, actually just, like, security?

Corey Ham:

Like, I'm curious to what do you guys think the drivers are to this. But back to what you're saying, you know, and and to kinda zoom out in this conversation a little bit. I feel like we're approaching security as a solvable problem. And, like, buy an LLM or buy a harness or buy a tool or buy a thing. And I think that is fundamentally not true.

Corey Ham:

I think on some level, pieces of security like use after freeze and, you know, simple coding bugs are solvable. And security controls like WAFs and other, you know, whatever, that's also solvable. But on some level, security is

Ralph May:

Yeah.

Corey Ham:

The opposite of usability. Right? Like... And so if... Even if I tell Claude, okay, it has to be secure no matter that's gonna block Claude from doing certain things that I want to do or that my business wants me to do.

Corey Ham:

And so on some level, even if the AI, you know, knows that this is a bad idea, if I specifically tell it, you need to make the API global read or whatever stupid security vulnerability I decide to build into my app as a feature, then it's gonna do it. Whether or not it, you you could try to limit the impact of it. You could have a security team that brings this up and says, we can't publish this app because it's not secure. But on some level, there are vulnerabilities you can't solve, so to speak, with AI because they are features. The ability for any account like iDoors or whatever, like the ability for any account to read any other accounts properties, maybe that's just the AI got misaligned on like what account level it was dealing with.

Corey Ham:

You know what I mean? It's like, there are cases where AI is not gonna be able to solve security, because the feature is a security risk. You know what mean?

Ralph May:

I think I think for... From a bigger philosophical standpoint, what you're saying is is that we don't live in a perfect world. Like, this is never

Corey Ham:

gonna Yes.

Ralph May:

Yes. Yes. Right? Yes. And I I totally, like, get it.

Ralph May:

It's almost like the the ultimate end card to all security conversations. Like, will it never be perfect? Right? I mean, plane plane travel, very safe. Right?

Ralph May:

Statistically, super safe, but

Corey Ham:

they still crash. Right? It just Yes. Yeah.

Ralph May:

It's not something we can fix. So, like... But the argument is how close can we get to, you know, that that that 100%

Corey Ham:

Can we fix... Yeah.

Ralph May:

Yeah. We know we can't hit it. Right? But how close can we get? I think that

Corey Ham:

I agree.

Bronwen Aker:

I have another question. And and it just... It it struck me while I'm listening to to everybody talk. How likely do you all think it is that vibe coding will become a fad fades?

Corey Ham:

Zero likely.

Ralph May:

0% chance.

Corey Ham:

Zero for sure. Well, okay. Good job.

Ralph May:

Yeah. It... It's done. Right? Basic coding, the hand coding, it's gone.

Ralph May:

It it... It's a, like, it's like, it's the equivalent of knowing great cursive or whatever. Like, sure, you could still do it and somebody might calligraphy. Yeah. Calligraphy.

Ralph May:

Yeah. It's it's still out there. Like, it's not gonna die.

Corey Ham:

It's cool. I love it when my... You know, I'd I'd I'd like to see someone do calligraphy, but it is not required for Yeah. Yeah. I agree with that.

Corey Ham:

You know,

Bronwen Aker:

I do calligraphy, Corey. Right?

Ralph May:

Oh, yeah.

Wade Wells:

Bronwen's batting for a 100 right now. First calligraphy, then programming.

Corey Ham:

Think it's cool. I I mean, again, like, I... But the difference is two thousand years ago, calligraphy was, like, a very powerful thing that, you know, like, we needed this. Not everyone could read or write. Like, you know, it's different than it is now.

Corey Ham:

Anyway

Eva Benn:

That's the thing that we are moving into a world that AI does not just write the code. It also tests, runs, always maintain. And it actually... I think that we're not quite there yet, but I think it's... I don't know why I'm doing this.

Eva Benn:

It's also going to make decisions on what code to write. You know what? We have this happening here. Here's what I'm observing. Like, I think that we are shifting from us prompting AI to really AI prompting us and making these decisions.

Eva Benn:

And to earlier point, right, when we talked about stopping the train, all that stuff, I think that ship has sailed. If I was a decision maker who was given the opportunity, which I'm not, I would definitely choose to slow down, because I think that we are moving really fast. And what I worry about the most is not the big corporations, but the small and medium sized businesses that don't have full fledged security teams, that don't have the ability and the bandwidth to train their teams to figure out what they're doing. They're already drowning in noise. Actually, we're gonna be talking a lot about this, with Andrew's keynote in February, the right of boom.

Eva Benn:

But I think that with AI just... You know, yes, there's new attack services. Yes. There are new threats. There are new attack types.

Eva Benn:

But it's really just amplifying what attackers could do. It's doing it faster at greater scale, and it's enabling lower skilled attackers to,

Bronwen Aker:

you know,

Eva Benn:

to enter the game and really act as nation states.

Wade Wells:

I'm not scared of Claude hacking me. I'm scared of an Eastern Bloc teenager with an OpenAI model get me.

Eva Benn:

We need to... What? Okay. You cannot... You can't do this.

Eva Benn:

What's his or her name?

Corey Ham:

This is fruit bat.

Wade Wells:

I don't know their name. So I don't know.

Corey Ham:

This is Fruitbat. He's very he's very needy and needs to be cuddled the whole podcast. Meow meow.

Wade Wells:

Meow meow.

Corey Ham:

Yes. Sorry for derailing.

Ralph May:

Yeah. Hey. Don't be trying to get worded.

Corey Ham:

Hats to a chat. You know that I'm sorry. That was a that was a knife to a gunfight type scenario. Sorry.

Andrew Morgan:

Corey, can can I ask one last question to you guys before we move on again? Yeah. So, you know, you brought up the... I I like the way you brought up, hey. This...

Andrew Morgan:

Are we asking a question that's unsolvable? Like, you know, we're thinking security can be solved. We've become a much more, at least in The US, a much more isolated, you know, country, right, than we used to be. Is there... Is that a precursor also for how the AI models will eventually become?

Andrew Morgan:

Meaning, you know, bringing them in house, bringing bringing, in essence, ITs, everything in insular to stay away from others. Like, you're seeing, for example, Thomson Reuters. I'll use that as an example. There was a great article on them saying, you know, we're done playing, paying the frontier models like $40,000,000 a year. They're a very progressive company.

Andrew Morgan:

They built their own models, trained their own models, and they brought it in house. What are your thoughts? Do you think this is driving a more insular approach to, you know, the way people or companies operate?

Corey Ham:

It's a really good question. I think... I mean, this is like, who knows? Right? Like, if I could predict the future, I'd be a billionaire like Jensen Wong.

Andrew Morgan:

Or half the half half worth half a year.

Ralph May:

I Yeah. Just bought Nvidia. You know?

Corey Ham:

Yeah. Yeah. Basically, what I would say is I think probably a lot of organizations will move to using open weight models that they can tune parameters on. Mhmm. So, like like Ralph mentioned, you can throw an LLM at another LLM and be like, fine tune this for my use case.

Corey Ham:

And it will get really good at whatever your use case is. I think it's... It truthfully, like, if I'm looking at five years, ten years down the line, if I'm making a guess about what AI looks like, I think AI is a mix of your own company, you know, whatever. Like, for Thomson Reuters, it could be like Thomson AI or whatever that's like, very insular looking, and very like, I know all the things, I know all the corporate culture, I know all the... I know, you know, what I'm supposed to do, what I'm not supposed to do.

Corey Ham:

And that maybe is the default. Maybe that's all someone who's not a developer gets access to. Then you have the frontier models. It's like, now I wanna go outside. I wanna get different approaches.

Corey Ham:

I wanna understand different thing... I I wanna get a different perspective. And, like, it's kinda the same thing with, like, China's Internet. Right? It's like the great firewall.

Corey Ham:

It's like the great LLM. Right? You have, like, differing perspectives on on things. We all know that political, you know, spectrums vary between different models. Some models know about Tiananmen Square massacre.

Corey Ham:

Some models don't know about Tiananmen Square massacre somehow. So, like, a lot of things... I I do think we'll see that of, like, kind of more like, we saw the Internet. It started out super open and why, you know, everyone could just log into each other's modems. Oops.

Corey Ham:

Then we're like, okay. We probably should like add some more things. And now we have more like, we all know that we live in these little bubbles on the Internet. Right? Whether it's social media or whether it's just I'm in The US and so my IP geo locates me to certain ads or certain things.

Corey Ham:

Right? Like, we all have a different Internet. So I would guess like long term, we probably all have a different LLM. I would And say even already, if I go in Ralph's AI and I type in a question, if he has all of his preferences and his chats and his MCPs and everything saved, might get a completely different response than I would if I went into Bronwen's AI and said, maybe if I go into Ralph's, it's like, okay. Cool.

Corey Ham:

I I chose... I wanted to use TypeScript because you always use TypeScript. But then Bronwen's... You know, everything's in Rust or whatever. So super long answer.

Corey Ham:

Yes. I do think we'll see a lot more of that. I don't think necessarily from scratch training is gonna be super popular just because of the cost of it. But I do think fine tuned models of messing with weights or having things in between will become the standard.

Ralph May:

Yeah. I think one of the cyber models

Corey Ham:

too.

Bronwen Aker:

And as someone who's both taught local LLM classes and talked to a lot of people, both individuals and people working within organizations looking to leverage LLMs, I do think that we are going to see growth in the local LLM implementation, especially for large organizations that have highly proprietary information or that wants to make sure that none of their secret sauce gets out into the wilderness. They wanna have that control, and they also wanna have that customization. And I... So I think that... To answer your question, Andrew, I think that especially as more people become conversant in the technical idiosyncrasies of this technology that we will see that.

Bronwen Aker:

And, you know, frankly, I'm I'm curious to see how all of the little agents will refine things and gradually be able to work together for a a better total output. It's gonna be interesting to watch.

Wade Wells:

I don't I don't think we'll see anything near that in the corporate environment for ten, fifteen years. What's interesting about that?

Andrew Morgan:

Wade is I love Eve's take because we... Again, we hear everything from the Western side. You know, the the the greater world is adopting open weight on a two to one model. And it's one of the reasons you can't get in, you know, a DGX spark. It's one of the reasons they've gone from 5,000.

Andrew Morgan:

You could sell... You buy it for 5,000. You could probably sell it for 10 or or more. But Eva, you know, you you have a more worldly, I would say, perspective. What do you what do you think?

Andrew Morgan:

We only see it through our our media.

Wade Wells:

Yeah. In the cyber defensive space, right, like, these open way models are the same way as, like, using open source EDRs or SEMs. Right? They're they're building your own at that. Like, it it takes a lot in order to keep it up and running.

Wade Wells:

And also then you have to have the engineering behind it. You have to have GRC behind it. You have to have all these other things. And from what I can tell talking to people like AI adoption isn't nearly as strong as people think it is. Like most corporate environments do not...

Wade Wells:

Are not using it at a level that the top 5% are. And I couldn't imagine them using an open weight model if they can't just do a plug and play with Claude. Right? Like where it's much, it's not necessary cheaper, but much easier to set up and verify. I think one day, yeah, we'll get there.

Wade Wells:

And maybe it'll work. But even then, like, I think I was talking to this with some friends, because like I was, Ralph and I were talking about Orca a little bit earlier, right? And I am super down with Orca AI, a IDE, right? If you don't know, go use it. And it's really fun.

Wade Wells:

But the thing is, would never be able to use that internally at an organization because of the abilities that it has out of the box, where it can remote at... You can remote access, do all these other things. Because it's so hard as a blue teamer, I would have to completely lock that application down in order to make it safe for everyone to use. And that's going to be the same thing with these open weight models. Like, it may be easier in the end to lock them down and put them in AWS somewhere and then just point your VPN at it and then make sure and you can't do anything relatively.

Wade Wells:

But the configuration of that is still gonna be hard and very costly, whereas in I can just pay a subscription model and let Cloud do it.

Andrew Morgan:

Eva, what are you gonna say?

Eva Benn:

Yeah. Yeah. I mean, look, I think that this is... When we think about using up and weight models, they do give you more flexibility when you actually have the team that understands how a LEMS works, that can mess with the parameters, the weights, that can also evaluate the supply chain and what's actually in this model. But, and this is a big but, the vast majority of teams don't actually have these capabilities inherently.

Eva Benn:

So, obviously, the big corporations that have big security teams have that flexibility, you know, to use OpenAway, it's maybe Frontier, maybe a a mix of those. But I believe that when we talk about the vast majority of organizations, the simple abstraction, the simplicity of sending calls to Frontier Labs that has got a done it for you model, it's it's what most people will be doing. Right? And I think that there's a lot of a lot of startups, a lot of ambitious people who are doing great work and are bringing a lot of those AI capabilities on top of Frontier Labs that are solving specific security problems. But I think that this is what the majority will be doing.

Eva Benn:

Like, hey, what's the simplest solution? I'm already drowning in security debt. I don't have time to send my team to a one week boot camp to get ramped up on LLMs. I don't have the capability. I don't have the money, the resources.

Eva Benn:

So this is what I am seeing based on talking to a lot of leaders and practitioners.

Wade Wells:

I Even then with, like, these big organizations that do have, like, security people to go do that, The GRC monster behind those big organizations usually won't allow it. Right? Like they're most of the places are run by tape red tape rather than the practice. Yeah,

Corey Ham:

for sure. And just to run through a couple articles since this is, I guess, legally a news podcast. Legally. They're It's the hot thing.

Ralph May:

Podcast that happens to talk about news.

Corey Ham:

Yeah. That's right. We we did link to this article already. But basically, the news story is that Goldman Sachs, who ironically is the company handling the IPO for Anthropic, the world's largest AI company, they pulled from their traders and bankers the Cloud Code usage ability, basically. So they basically stopped their bankers and traders from using Cloud Code.

Corey Ham:

And this is after in July, they were bragging about how much they were allowing these citizen developers. There's a buzzword for you of like, how to, you know, people that are just vibe coding their own stuff. I... It... The the thing, you know, we kind of touched on it from a few different perspectives, but basically, the question no one really knows is why?

Corey Ham:

Was it because traders were making apps that were making bad trades? Is it a money thing? Is it genuinely... Like, I don't think it would be a money thing from, like, an AI usage perspective. Right?

Corey Ham:

Like, I think it's more just... Is it enabling bad decisions? Is it because AI is just gassing up traders? Like, oh, dude. You should short Nvidia.

Corey Ham:

They're the worst company. Like, I don't know. But

Bronwen Aker:

Okay. Is it just Claude code, or is it Claude period?

Ralph May:

What if... Is OpenAI still on the

Corey Ham:

Is there a difference?

Andrew Morgan:

There there...

Wade Wells:

I I don't think there is a difference nowadays if long as you have the application installed.

Corey Ham:

There are

Bronwen Aker:

a lot of installed. You've got you've got all of it built into one interface, and they've merged chat and co work, and then code is is still able to interact more directly with your host system. But, again, if they're pulling code, then that means that these people can't have the desktop app at all. And it... And my question is, again, is it code for generating code or is it Claude period, meaning they can't even chat with Claude anymore?

Corey Ham:

Claude, could it

Eva Benn:

said... Then you said, no. It's not necessarily just Claude code. They are not allowed to use any code, like, AI coding period. Oh, this also include any kind of copilots and all that stuff.

Eva Benn:

So they were actually... So the the word is they were already actually using them for their financial analysis, and they were like... It's basically, like, cutting what you

Corey Ham:

already use. They already... Yeah. Exactly.

Eva Benn:

Which I think is a fast track to ShadowAI, my view.

Corey Ham:

Oh, yeah. Let's hope they have a... You know, all that stuff blocked, and they... I'm hopefully, you know, they probably wouldn't do a policy like this without the ability to enforce it.

Ralph May:

Think the idea of locking out major companies from AI just opens up other companies to use AI to compete against those companies and, you know, and market.

Corey Ham:

Well, okay. So like Oh, okay. So this

Eva Benn:

their own device. Like, I'm just gonna open and do my job in my personal device. I don't know.

Corey Ham:

I mean, if you're a trader for Goldman Sachs and you can get to anything trading related from your personal device, then they have another thing coming to them. But, basically, what I would say is the the discussion here is more, is this a red herring for efficiency and productivity? That's essentially the discussion to have is, are AI tools for someone who has a very specific job, like trading stocks or, you know, whatever bankers do, packaging up mortgages? I don't know.

Ralph May:

Whatever bankers do?

Corey Ham:

Yeah. Whatever bankers do. Excel. Excel. Basically, question is, is it a red herring?

Corey Ham:

Am I spending half my day vibe coding a dashboard that then becomes completely shuttered like a week later because it's not actually a useful dashboard? Like, I don't know what the answer is. It also could be GRC related. It could be they genuinely figured out like, okay, the analyst who vibe code something and then makes a bad trade, we are legally responsible, or there's some GRC or financial restriction for why that's the case. I don't know.

Corey Ham:

But it's just interesting to think about, they are allowing developers still to use Cloud Code. They're still allowing Frontier. It's not like they've blocked Anthropic from everything. It's just the traders and bankers are no longer allowed to vibe code stuff all the time. I don't know.

Corey Ham:

It's an interesting discussion. We'll see if other companies start doing this. Or is it like a privacy thing? Are they like, we don't want our secret trades getting out? Like, I don't know.

Corey Ham:

I mean,

Eva Benn:

to be honest, like, if if you think about it, like, let's just forget about, like, the... That obvious problem. Right? Limit... Limiting them what happened.

Eva Benn:

But, like, if I was a leader, you know, I would probably think about empowering them first. Like, what do you need to do? How can I empower you with AI so you don't go, like, rogue? But I also think that, you know, I understand the problem of shadow... Of, you know, technical debt.

Eva Benn:

Like, every single... If you think about it, every single person developing stuff, they just like develop something, forget about it. That just become technical debt. Somebody like, you know, I just think that we are dealing with an explosion of software that everybody just build. And a lot of the times, you know, it's not built with security in mind.

Eva Benn:

And I think that that's probably the rationale. Like, they're just like, hey. Like, just limit the attack surface. Let's just limit how many things we build. That's that's what I would be thinking if I was making this decision.

Corey Ham:

Yeah. I think that's... I think the combo of productivity and security are probably the the right answer. But who knows? I don't know.

Corey Ham:

I mean, we'll see. It's an interesting article, you

Eva Benn:

know. So

Corey Ham:

a couple more things. I know we're close on time. I do wanna give Andrew and Eva, you guys wanna plug right of boom. It's in February. Right?

Corey Ham:

Where where are we at? Where are we going?

Andrew Morgan:

We are. We're at the MGM Grand in in February. That's our home, and we're thrilled to have Eva. I mean, this has been something... We've been we've been, I would say, kind of a goal to have her and and be main stage, and she's gonna kick off.

Andrew Morgan:

We're gonna have Eva and then John Hammond, Chris Hughes, all main stage. And then, like I said, a host of folks from BHIS doing training. It's it's pretty pretty awesome. But let me let Eva talk a little bit about what she's gonna talk about there.

Eva Benn:

Yeah. I have major impostor. I'm rolling with the big boys. So look. I'm gonna keep it practical.

Eva Benn:

All of my all of my keynotes are just always practical. I truly value people's attention. And as I mentioned earlier, I think that what we need to do is help put the mask on on the people that are helping these small small and medium sized businesses, which are the people who are going to be in this conference. So if you don't have a dedicated security team, if you feel lost right now, this is really going to be a good session for you to be in because we're going to be getting practical. You're going to be leaving with a ninety day playbook that you can go and implement with your clients.

Eva Benn:

And this is all harnessing all of my big enterprise experience across big organizations as well as working with smaller organizations. So that's it for my pitch. We're gonna have fun, and hope to see you there.

Corey Ham:

I hear Vegas is nicer in February than it is in July. Is that true? Absolutely.

Wade Wells:

Just just the touch.

Andrew Morgan:

Just the touch there, Corey. It's... You actually walk around and not feel like you're in a furnace. But, yeah, it's it's great.

Corey Ham:

Love it. That's awesome. So, yeah, I guess couple articles to close out. I did wanna follow-up the Binance thing. Ralph, you have a you have a podcast buddy there.

Ralph May:

Moving in.

Corey Ham:

The Binance thing is we got more details on what happened. We all joked it was like six minutes, $20,000,000,000, or whatever. That is not at all what happened. Turns out, we were wrong. It was a super long social engineering campaign.

Corey Ham:

It's kind of in-depth. Basically, actually popped another developer. They popped a developer back in June and gained a bunch of information about how their practices work, how development works, all that good stuff. Then they came back, and they came back with a job interview, social engineering campaign with a fake company. I mean, we've seen these work in the past.

Corey Ham:

Developers are such ripe targets for this because coding interviews involve running code. And that is like a risky thing. I guess, you know, we've joked about it before. It's like, you know, make your developers keep them loyal. Like, give them offers they can't refuse so that they don't do this.

Corey Ham:

But, like, you you know, like, this is a... It's just gonna keep happening as long as we have developers who are underpaid or, you know, whatever, like, the symptom is. This is, again, unpatchable vulnerability, just like Eva said. But... Yeah.

Corey Ham:

I mean, it's just interesting. It sounds very advanced from my perspective. Like, we know Lazarus Group is some of the most advanced social engineers out there, and we're... I think we're still attributing it to them or to a North Korean threat actor. But...

Corey Ham:

Yeah. Really interesting and super scary. Because if you're a company reading this, you're like... I mean, you know your developers can run code on their systems.

Ralph May:

You know they have access to

Corey Ham:

sketchy and sensitive things, and, you know, they might be looking for jobs. So I don't know. Like, it's it's pretty scary, but it's really interesting write up. Couple other hot takes, I guess, we can do in the last minute. There are residential proxies on the on the White House network.

Corey Ham:

God. See this? You would've This is like

Wade Wells:

The best.

Bronwen Aker:

I thought SignalGate was bad.

Corey Ham:

I have so many questions. So, yeah, you thought you thought SignalGate was bad. So, basically, this is some fun research someone's doing, layer three Intel's doing into... Essentially, looking into the ASNs, autonomous system numbers, which are the basically residential IPs that are being used for proxies. If you don't know how these proxies work, if you're getting an app for free these days, you're probably consenting to being part of proxy network.

Corey Ham:

And we're just gonna assume it's LG smart TVs?

Ralph May:

Yeah. Don't know what this is. It's Roku's LG smart TVs.

Corey Ham:

Yeah.

Wade Wells:

It's someone's cell phone connected to the guest We all know it. Like, it's... That... That's exactly what it is. Someone brought in their home laptop connected to the guest Wi Fi.

Wade Wells:

We turned the detections off for that. There's no problem. It's it's honestly...

Corey Ham:

The guest Wi Fi is isolated.

Wade Wells:

You know it's not the guest Wi Fi. That's not really...... Fishing's blocked. Right, Wade? No.

Wade Wells:

Well, we hope so. Yeah. It's probably like an evil twin, you know? No. Yeah.

Corey Ham:

Oh my goodness.

Wade Wells:

Who was surprised by this news article? No one. Right? Like

Corey Ham:

Honestly, you want... Okay. Fair that no one's surprised. My like... The closing thought here is like, what do you do with this?

Corey Ham:

Like, I know it's just kind of an internet anomaly and there's not like like, what is the actual point of this? Like, oh, I need to scrape like, what? Scanned? Missiles or something? Like, I need to scrape for something?

Corey Ham:

Like, I don't get it.

Wade Wells:

I I would just be like, I would be telling friends, be like, oh, I heard the White House... The White House is gonna scan your computer if you download this file, and then they download it, and then I kick off a scan, and they're like, what the heck? Like...

Corey Ham:

Use it for intimidation? Bro, I am at the White House. Let me geolocate. I mean, look at my geolocation right now, dude.

Ralph May:

If you filter that in one of the residential proxy servers, like White House, I would like to White House.

Wade Wells:

That's it.

Corey Ham:

Yeah. Honestly? Okay. Honestly, I bet you the main use case for this is espionage. Basically, just Yeah.

Corey Ham:

Looking at the, like, what kind of you get? Like, what kind of...

Ralph May:

Yeah. Like, if you could inject ads on the TV? Oh my god. Perfect.

Corey Ham:

Oh, yeah.

Ralph May:

You're buying ad spots only on this TV.

Corey Ham:

Discount discount

Bronwen Aker:

for sure. AI companies that wanna do that Yeah. And advertising companies.

Corey Ham:

Click here to get your reflection blueprint painted for only $5 anyway.

Ralph May:

Oh, it'll break out just like the real one.

Corey Ham:

I think that's I think that's good as place as any to end. Thank you, Andrew and Eva, for being here, and thank you everyone else. See you next week. Bye

Andrew Morgan:

bye. Guys.