Six months after the Mythos Report, a look at what's changed with AI-found bugs and how fast we can patch them.
The insider threat is in your conference room
Back in April I wrote that CISOs should start treating frontier AI models as an AI-native insider threat. The last few weeks were a good reminder that the old-fashioned kind hasn't gone anywhere... one allegedly showed up with a microphone wrapped in toilet paper. Concern #1: The recon was sitting in his own tools According … Continue reading The insider threat is in your conference room
They clicked on a championship ring. Now what?
Earlier this month I wrote that phishing is an industry and that click rate is a vanity metric. Then the Knicks showed us what a phishing test built around the click looks like. In late September, Madison Square Garden emailed a long list of employees: "(Employee name), this one is on the house. MSG is … Continue reading They clicked on a championship ring. Now what?
Phishing is an industry… Is your phishing program up to the challenge?
Back in 2023 I gave a talk called Your Phishing Program is a Waste of Time and Money (or rant, depending on your angle). This week Microsoft published what the other side's program looks like. Spoiler: theirs has a storefront, a sub-reseller tier, and over 2,300 templates. They built a business Microsoft's write-up describes YAM … Continue reading Phishing is an industry… Is your phishing program up to the challenge?
Early thoughts on the Mythos Report
Posting this at 09:45AM ET - any updates will be noted. I've been thinking and discussing this a lot the last few days. I am cautiously optimistic and we should be able to confirm or disprove many of the claims in short order, but I try to get too excited in either direction…. That’s usually … Continue reading Early thoughts on the Mythos Report
