Skip to content

TRANSMISSION ACTIVE

// FREQ: HEALTHCARE EPISODE: 027 STATUS: SECURE

027 The Minnesota Water Hack, AI Threats at Black Hat, and the Case for Age Limits on AI

This week we went off script. Our CISO called in from the floor of Black Hat in Las Vegas — where she was invited to speak on AI and child privacy — for a wide-ranging briefing on the threats defining right now. First, the Iranian-affiliated cyberattack that knocked a Minnesota water utility onto manual operations, and the uncomfortable truth behind it: the attackers didn't break anything sophisticated. They walked in through factory default passwords nobody changed. Then, the story dominating Black Hat — the scramble to secure AI, the shift from assistants to autonomous agents, and why every startup in the room is chasing the same problem. And finally, the CISO's sharpest take of the year: that AI and social media, like driving and drinking, are dangerous enough to warrant age limits. The through-line from a water tower to a frontier AI model is the same one this show returns to every week: the basics still win, and the fundamentals don't care how advanced the threat looks.

JUMP POINTS //

00:32

The Minnesota Water Attack: What Actually Happened

An Iranian-affiliated cyberattack pushed a Minnesota water utility off its automated controls and onto manual operations. The drinking water stayed safe — but the attackers got in. Why water is historically a hard target, and why this one fell.

02:36

They're Testing Us — And the Magician's Misdirection

Roughly seven water municipalities were probed; this one happened to be the door left unlocked. The bigger concern isn’t the attack you see. It’s what a nation-state is doing while your attention is on the visible disruption.

06:41

Why It Wasn't Sophisticated — Small Blast Radius, Big Lesson

The impact was contained to one community — which is exactly why it didn’t dominate Black Hat. The comparison to United Healthcare, and how impact and blast radius determine what the security world actually pays attention to.

08:36

Factory Default Passwords: The Front Door Left Open

The attackers didn’t breach office systems. They exploited factory default passwords on programmable logic controllers — then changed them to lock the real operators out. The single most preventable root cause in the whole story.

12:42

Live From Black Hat: Everyone Is Racing to Secure AI

Five startups pitched a CISO panel. All five were about AI. The shift from AI assistants to autonomous agents, the “how do you protect what you don’t know you have” problem, and the race to the top among vendors.

16:44

The Three Threats That Matter Most Right Now

The CISO’s top three: attackers move faster because they don’t answer to ethics, autonomous agents pursue goals with no judgment, and a generation growing up with no concept of privacy. Why each one should be on your radar.

21:41

The Case for Age Limits on AI

We license driving. We restrict drinking. The CISO’s argument: AI and social media are dangerous enough to belong in the same category — and children aren’t developmentally ready for either.

// INCOMING SITREP

The episode covers the water attack and the Black Hat AI landscape at altitude. The companion Sitrep goes deep on the single biggest theme from the conference floor — how to actually govern autonomous AI agents before they act faster than your team can react. Read the SITREP dossier.

ACCESS THE BRIEF »

TRANSMISSION LOG //

An Off-Script Briefing From the Black Hat Floor

This week we broke format. Our CISO was in Las Vegas at Black Hat — one of the security industry’s biggest conferences — where she’d been invited to speak on AI and child privacy safety. So instead of the usual structured briefing, we riffed: the breaking news out of Minnesota, the mood on the conference floor, and where the two collide.

The connective thread ended up being the one Status: Secure comes back to almost every week. Whether the threat is a nation-state hitting a water utility or a frontier AI model, the fundamentals decide the outcome — and the fundamentals don’t care how advanced the attacker looks.

The Minnesota Water Attack: Sophisticated Headline, Unsophisticated Entry

The news that opened the episode: an Iranian-affiliated cyberattack on a Minnesota water utility. The affected systems were pushed off automated control and onto manual operations, two water towers and the sanitary system went offline for a period, and the city leaned on stored water while operators kept things flowing by hand. Critically, the drinking water stayed safe — there was no public health impact.

Our CISO put it in context. Historically, nation-states going after utilities have targeted the bulk electric grid, not water — because water is a genuinely hard target. Storage tanks and manual fallbacks make it difficult to actually disrupt supply. (A successful attack a couple of years back managed to alter chemical dosing enough to make some sensitive individuals sick — but that kind of impact is rare and hard to achieve.)

So why did this one land? Because it wasn’t really about this one utility. They’re testing us. Roughly seven water municipalities were reportedly probed around the same time — this was simply the door that happened to be unlocked. And that’s the part that should stay with you: the visible attack is often the misdirection. As the CISO put it, it’s how a magician works — draw your eye to the disruption over here while something you’re not watching happens over there. The real question isn’t what they did to the water system. It’s what a nation-state is doing that we aren’t seeing.

Why the Security World Shrugged: Impact and Blast Radius

Here’s a nuance worth internalizing, because it explains how professionals triage news like this. At Black Hat, this attack wasn’t the dominant conversation — and that’s not complacency. It’s how impact assessment works.

Security leaders evaluate an incident by its impact and blast radius. This attack hit one community. It didn’t cascade across twenty states, it didn’t take down a sector, and nobody was harmed. Contrast that with the United Healthcare/Change Healthcare event, which dominated the industry for months precisely because the blast radius was enormous — small hospitals and provider offices couldn’t deliver care, and it escalated all the way to congressional testimony.

Water utilities also sit in a well-known staffing reality: many are unionized municipal environments where a security role gets posted internally and filled by whoever bids on it, not necessarily by someone with deep security experience. Our CISO has worked in a water municipality and named it plainly — these organizations are frequently under-resourced on security, and that context matters when you ask how a factory default password survived long enough to be exploited.

The Root Cause: Factory Default Passwords

Here’s how the attackers actually got in, and it’s the most important operational lesson in the whole segment.

They did not breach the main office computers. They exploited factory default passwords on programmable logic controllers — the industrial devices that run the physical process. Think of the router an ISP drops at your house, pre-set with a default password you never change. Same idea, on infrastructure that manages a city’s water. Once inside, the attackers changed the IP addresses and passwords to lock out the legitimate operators.

The federal security recommendations that followed read like basic home-network hygiene:

Pull operator dashboards off the public internet
Enforce strict firewalls
Change default passwords
Use secure VPNs

As Actual noted from his own training: before attempting anything sophisticated, you try the default credentials first. Why pick a lock when you can check whether the door is even locked? A lock on a door keeps an honest person honest — but the house on the block with no cameras, no dog, and only a doorknob lock is the one that gets hit first. The Minnesota utility was that house.

The takeaway for every organization, in every sector:

Go find the equipment in your environment still running default logins pulled straight from a manual anyone can download. That’s the work that prevents you from becoming the next headline — and it costs nothing but attention.

Live From Black Hat: Everyone Is Racing to Secure AI

Then we turned to the conference floor, where one topic swallowed everything else: AI.

Our CISO watched a pitch event where five startups presented to a panel of CISOs. All five were about securing AI. That’s the signal — when every company in the room is solving the same problem, the industry has decided that problem can no longer wait.

The concern has moved past AI assistants that draft documents. It’s now agentic AI — autonomous agents that take action, access data, and call systems on their own. And it lands on a foundational security principle: how do you protect what you don’t know you have? Executives are mandating AI adoption for speed and cost savings, every team is racing to comply, and security is structurally behind — because the tools already in place weren’t built to monitor AI use at all.

The vendors are chasing two things: how to monitor and inventory AI agents, and how to build guardrails that stop an agent the moment it crosses a policy line, without waiting for a human. The CISO framed it as a race to the top — startups innovating fast, and incumbents like CrowdStrike poised to either build the capability in or acquire whoever gets there first.

This is the theme our companion Sitrep takes apart in full — see below.

The Three Threats That Matter Most Right Now

Asked for her top three current threats, the CISO named:

1. Attackers move faster because they don’t answer to ethics.

Nation-states and threat actors are using AI to accelerate and innovate their attacks, unconstrained by the legal, moral, and compliance boundaries defenders operate within. That asymmetry is real, and defenders have to close the speed gap deliberately — because abandoning principles was never an option.

2. Autonomous agents have no judgment.

An agent “will do whatever it takes to achieve its goal.” Give it a goal and broad access, and it optimizes literally — with none of the unstated “obviously don’t do that” context a human carries. The Terminator framing is a joke with a real point underneath: guardrails and tight scoping aren’t optional for anything acting autonomously.

3. A generation with no concept of privacy.

Kids growing up immersed in AI and social media treat these tools as friends and tell them everything — with no instinct for online safety. That creates both easy targets today and, eventually, adults who write the privacy laws without believing privacy matters.

The Case for Age Limits on AI

The CISO’s sharpest position of the episode: we’ve long accepted that some things are dangerous enough to gate by age. You need a license to drive at sixteen because a car can hurt people. Drinking ages exist because alcohol is harmful to the developing. Her argument is that AI and social media belong in that same category — genuinely dangerous, and something children aren’t developmentally ready to handle. With some countries already moving to restrict social media for minors, this is a live policy debate, not a hypothetical, and it ties directly back to the ethical-use-of-AI conversation running through the entire back half of the show.

The Bottom Line

From a water tower in Minnesota to the AI security scramble at Black Hat, the episode kept circling the same truth: the basics still win. The most consequential vulnerability in the water attack was a password nobody changed. The most consequential AI risk is losing track of what you’ve already deployed. Advanced threats and unglamorous fundamentals aren’t opposites — the fundamentals are what stop the advanced threats.

Update your passwords. Get guardrails around your AI. Know who — and what — is operating in your environment. Then stay on top of it.

Go Deeper: Governing Autonomous AI

This episode covers the AI landscape at altitude. Our companion Sitrep drills into the single biggest theme from the Black Hat floor — the agentic AI security gap: why your current tools can’t see the AI already running inside your walls, why guardrails have to deter an agent rather than detect it after the fact, and the practical sequence to inventory, scope, and govern autonomous AI before it acts faster than your team can react.

Trust but verify your own posture. Change the default passwords. Inventory your AI. Build the guardrails before you need them. Execute the standard.

// DECODED TRANSCRIPT

Access the full text logs of this transmission for compliance and review purposes.

00:00:01:06 – 00:00:07:19
Actual
Welcome to Status Secure, the weekly Cyberthreat briefing for executives who refuse to operate in the blind.

00:00:07:21 – 00:00:20:08
Actual
Hosted by the watcher six collective, uniting former Army Special Forces and Naval Special Warfare communications operators alongside an industry leading CISO nominated for cybersecurity. Woman of the world.

00:00:20:10 – 00:00:27:05
Actual
We cut through the noise and give you the operational intelligence you need for mission success in a hostile digital environment.

00:00:27:07 – 00:00:28:10
Actual
The enemy is listening.

00:00:28:13 – 00:00:32:03
Actual
Is your status secure?

00:00:32:05 – 00:01:00:10
Actual
Welcome to Status Secure. On today’s episode we’re going to riff a little bit. We’re going to go a bit off script because CSO is in Vegas at the blackjack conference where she was asked to speak on AI and child privacy safety. And before we get into what’s been going on at Blackhat, we’re also going to discuss, you know, the big news that happened last week, with the Minnesota Water Tower cyber attack from the, you know, nation state Iran sort of situation.

00:01:00:10 – 00:01:23:20
Actual
So what I’m seeing here is basically let’s see, I’m I’m seeing notes on the drinking water stayed safe. So there wasn’t health risk. There was. They temporarily shut down operating controls for the well and treatment plants, leaving the city reliant solely on water stored inside its water tower for a few hours. Two water towers in the sanitary system went offline.

00:01:24:02 – 00:01:51:03
Actual
See it? It affected utilities. The affected utilities quickly mitigated the threat by taking automated systems offline and switching to manual operations to keep the water flowing. So it’s believed that this was in Iranian affiliated cyber actors. And so we kind of want to get into what happened. What are your thoughts on this CSO? And, you know, maybe we can dig into that a little bit and you can kind of educate us on sort of the what the cyber attack was.

00:01:51:04 – 00:02:36:01
CISO
Yeah. I mean, it’s interesting because historically when we look at nation states and, and their attempts to, you know, attack our utilities, it’s usually been, you know, the bulk electric utility, not their not the water because it’s, it’s actually really hard to, to shut off like water supply because we have you know, we have storage tanks. We have, you know, other ways to, to get the water flowing like you mentioned, manual, like, you know, it had to do manual because, for those who aren’t familiar with these types of systems, like, you know, you know, like electricity, water, rain, those, those critical infrastructure for water make it.

00:02:36:05 – 00:02:57:15
CISO
It was a couple years ago where it was a successful attack, where they were able to increase the flow of chlorine. You know, I some some chemical that we put in our water. Right. It just it made a, it made some people sick think who are sensitive to or sensitive to it. But so it’s, it’s, it’s it’s actually hard.

00:02:57:15 – 00:03:25:18
CISO
What I think they’re doing is they’re just testing like they’re just they’re testing us. Right. They’re seeing, you know, like I saw maybe seven other municipal water municipalities were being targeted as well. They just so happened that, you know, this one, they were able to get in, but they’re testing our infrastructure in there and they’re trying and they’re trying to see.

00:03:25:18 – 00:03:41:23
CISO
And why did this one, you know, this one in this capacity, this water just happened to be the one that they were able to get in. Right. But do you have to be careful because we’re you know, right now they are eight. Have you ever heard this? Do you know how magicians do their tricks?

00:03:42:04 – 00:03:49:02
Actual
Yeah, right. You know, sleight of hand like our deception over here. Hey, look over here while I. I do something over here.

00:03:49:02 – 00:04:17:20
CISO
Yeah. So that’s really the bigger concern, right? They’re doing this, they’re doing this, and we’re seeing it. Right. But what else are they doing that we’re not seeing. Right. So what other critical infrastructure hospitals electric utility I mean if you go if you go on to the, you know, the know site, I think there is a list of our critical infrastructure.

00:04:17:20 – 00:04:48:10
CISO
And so and there’s quite a few right. So, you know, the energy sector, the water supply, the communications, our telecommunications infrastructure, you know, our, you know, all like I would say, like our supply, like our shipping and our, our roads. Right where, where I supply, I train, I train or, you know, so basically, like transportation infrastructure. Okay.

00:04:48:12 – 00:05:09:05
CISO
So I think most people just live their life and don’t think about that. But we but we can’t we have to think about it. Yeah. Yeah. And so it’s been you know, it’s it’s been talked I mean like I said they, they didn’t do great harm but they got in and they, you know, and again what are they doing that we’re not seeing.

00:05:09:07 – 00:05:31:18
Actual
Well yeah. And it kind of reminds me of we discussed this on one of the past episodes. I brought it up. I know somebody that works in a, in the cyber space in a tech company. A pretty well known one. And, I don’t know, maybe a handful of months ago, they came under a coordinated and they would call it a sophisticated cyber attack that was similar.

00:05:31:18 – 00:05:50:07
Actual
It was nation state. It was an Iranian thing. And when I remember, one of the things that was told to me was the attacks themselves weren’t, you know, super crazy. Like they weren’t like these super sophisticated individual attacks. It was more of like they just happened to be on a list and they were like, let’s go knock on these doors.

00:05:50:07 – 00:06:05:15
Actual
But it was the flow of the attack. It was sort of the the rolling flow of it, the daily like hit over and over and over and over. It was just kind of annoying, right? And it was a big nuisance. And the whole team had to be, you know, stood up, you know, working off hours and mitigating everything.

00:06:05:15 – 00:06:22:23
Actual
And it wasn’t, I guess, from their perspective, like it wasn’t that difficult for them to, you know, be secure and defend themselves against. It was just interesting. It’s almost like like they’re sort of, you know, walking through a neighborhood checking doors to see if they’re locked. Right? They’re just going house to house. The house is this one open?

00:06:22:23 – 00:06:39:13
Actual
Is this one open? Is this. And they’re doing it over and over and over and over again, waiting for someone to just, oops, accidentally left it unlocked and then boom. That’s kind of what it seemed like to me. But it seems like this is a similar thing that they’re doing. Is there any talk about this over at and at the conference?

00:06:39:13 – 00:06:40:22
Actual
At the Blackhat conference?

00:06:41:00 – 00:07:01:17
CISO
Yeah. That’s it. That’s interesting cuz it depends. It depends on the CISOs. It depends on their, you know, quite quickly and right now because again, this is this is something that security folks deal with all the time. You think that like you think it’s news because they got in. Right. And it’s our water supply. But they’ve been attacking before.

00:07:01:18 – 00:07:25:01
CISO
It’s not like they haven’t been attacking. It has. It’s not like you know, they’ve been like the water. Our water supply hasn’t had attacks. Right. They just weren’t able to get in before. So. So yeah. So I mean there is a little bit it’s an it’s interesting because it hasn’t within that the impact. Right. Because you always have to look at impact like what was what was the impact.

00:07:25:03 – 00:07:48:08
CISO
But what was the blast radius. It was the impact was small. There was no other like it didn’t affect any, you know, any larger like any other. Like it didn’t. It’s not like it’s not like it had like, oh you know like 20 states, right. Eight, eight. I think it was like, hey, a community. Hey, it hit a community.

00:07:48:08 – 00:08:13:05
CISO
So it’s a small municipality, water municipality. And and I’ve, I’ve actually worked in a water municipality before, and I can tell you that they’re not staffed the way they should. Insecurity. A lot of times their security staff, a job was posted, somebody internally applied for it and they got the job. So it wasn’t like they were really, you know, extremely qualified.

00:08:13:07 – 00:08:36:16
CISO
It was it’s a position that was open and they bid for it. So I don’t know if you know a lot about but most like a lot of times I mean it’s it’s it’s union money in the in disparities. So you know they open you bid on it. And then sometimes based on seniority sometimes, you know, you, you, you get that position and then you learn.

00:08:36:19 – 00:08:58:02
Actual
Well I was going to say to add to that or, you know, to go along with that. I’m reading here, so how the attack happened and this is going to make sense, to what you just said. So this is saying that the attackers did not breach man office computers. Instead, they exploited factory default passwords on on programable logic controllers.

00:08:58:03 – 00:09:21:22
Actual
Kind of like getting, you know, Wi-Fi for getting, AT&T internet, home internet. And then dropping the router into your house and saying, here it’s set with the default password, and then you use it and you never change it. Right? Is basically what I’m hearing here. And then once inside, then they changed the IP addresses and passwords to lock out, you know, to people who are supposed to be using it.

00:09:22:00 – 00:09:45:21
Actual
Yeah. So you have they issued this, this, this, these security recommendations, right, to these municipalities? They, they here’s what they said. They said, you see, this urged all U.S water utilities to pour human dashboards off the public internet, enforce strict firewalls, change default passwords, and utilize secure VPNs.

00:09:45:21 – 00:09:47:19
CISO
Pretty basic security stuff, right?

00:09:47:21 – 00:09:53:20
Actual
Yeah. I mean, it sounds almost like what you were just doing your individual home as like a normal person.

00:09:53:22 – 00:10:20:01
CISO
Yeah, I’m not surprised. So yeah. And so that’s why here I don’t think it’s know it’s like anything it’s anything major because it wasn’t extremely sophisticated. Right. Yeah. I mean it would be more like I think they would talk about it more if it was like, again, if it was a really sophisticated attack, new and something that hadn’t been seen before for the blast radius, the impact was so large.

00:10:20:01 – 00:10:49:15
CISO
Like you knew United Health Care was a big topic, when that happened, because of the impact. I mean, there were there were, like small hospitals and providers, which are your doctor offices who, like, who couldn’t provide care. Right, who like. And it lasted for months. I mean, their CEO had to go had had to go testify in front of, you know, I, you know, legislature.

00:10:49:15 – 00:11:16:03
CISO
I mean, that’s a that’s huge impact. Then this is like, okay, you know, it’s interesting, it’s interesting. You need to be aware or, you know, especially in these current times, what they’re talking mostly about here at Blackhat is, you know I threat. Right. Yeah. And what do we do about it. Because that’s the that’s that’s the new emerging threat.

00:11:16:05 – 00:11:19:17
CISO
How do we secure against it. That’s where the concern is.

00:11:19:17 – 00:11:42:19
Actual
Got it. Yeah. And I think just to kind of finish off with what we were saying it’s it’s another one of those situations of a, you know a lock on a door keeps an honest person honest and, you know, just covering the basics. Again, I know that some of my training was this actually some of my training was if you’re going to try to get into someone’s system before you go and do all the advanced crazy stuff, just try the default passwords.

00:11:42:19 – 00:12:02:21
Actual
Just look up the if you can get access to the hardware and figure out what they’re using, just go on, you know, go on whatever resource website and look at the documentation and go, okay, here’s the, you know, the the pre-installed, you know, admin login and password. And then just try it first. That’s the first step because why go through and do all this complicated stuff if you can just get in that way, you know that.

00:12:02:22 – 00:12:23:22
Actual
And it was the same thing of, you know, looking for getting into places. If we think about this just for ourselves, just as individuals, if you’re in a row, a neighborhood, let’s say, and there’s a row of houses and there’s like houses with security cameras, you know, locks, deadbolts, security systems, maybe dogs, you know, barking, whatever.

00:12:24:03 – 00:12:42:06
Actual
And then there’s the one house that doesn’t have security cameras. There’s no dogs, there’s only the doorknob lock. There’s no deadbolt lock. Like, what else am I going to try to get into first? You know, and it’s it’s so that’s this is that basic conversation of like, you know, use a password, change the password kind of thing. But yeah.

00:12:42:08 – 00:12:53:12
Actual
So now moving into Blackhat, the focus is on AI threats. So walk us through kind of what you’ve been seeing what’s been kind of trending. What are people talking about. Yeah I.

00:12:53:16 – 00:13:20:20
CISO
I got to go watch a pitch event. So basically five companies pitched their ideas to a panel of seashells. All five of them talked about AI. So, you know, so what I’m seeing on the ground is that everybody’s trying to figure out how to, you know, how how to secure. Because you have you have a lot of I mean, you have a lot of companies now that, you know, their users are using AI.

00:13:21:02 – 00:13:45:03
CISO
You know, initially it was more like an AI assistant where it’s like, hey, help me create this document or help me create this presentation, right? But then moving into a genetic AI now. So these agents are going to be able to do, you know, all kinds of things and have access to all kinds of data. And so the it comes back to basic security, which is, you know, inventory.

00:13:45:07 – 00:14:04:17
CISO
You know, you have to know, like how do you protect what you don’t know you have. So you, you know, you’re you’ve got your executives wanting, you know, you know, to find AI efficient. You know, get AI in here so we can be more efficient and lay off people, you know, and reduce and reduce cost. They, you know, you know, use AI.

00:14:04:18 – 00:14:28:12
CISO
So, you know, so that way we can deliver more faster, you know, find AI innovation so we can be forced to market like, you know, there’s there’s that pressure. And and then of course everybody else in the organization is trying to, you know, trying to work on those objectives. Right. That was handed down by the board and then and the executive team.

00:14:28:14 – 00:14:58:08
CISO
Then you’ve got security, you know, you got security, privacy, you know, compliance trying to catch up now I think because that’s how it’s that’s what it feels like. The tools, the security tools that are in like that are in place. Can’t, you know, currently don’t monitor for AI use. So that’s what I see I’m seeing a lot is, you know, all these vendors, all these startups like wanting to figure out how to number what two things.

00:14:58:08 – 00:15:41:14
CISO
One is how do you monitor AI agents, which includes, you know, an inventory of them, like what are they doing? You know, if they’re doing? The other thing is how do you how do you put, you know, how do you enable them in a way where they have guardrails? Hey. So that way they, you know, they bump up against a policy and they stop by themselves without human intervention because by the time a human looks, looks at what an AI agent has done, now it’s, you know, now it’s detecting it and then responding to it versus, you know, not just deterring it, I mean, stopping it before it even happens by preventing it from happening

00:15:41:14 – 00:16:03:06
CISO
at all. So that’s the big talk here is how do we, you know, how do we get to that. Like how did the tools and then the I see I see kind of like a, a race a race to the top. Now okay. So you know everybody’s trying to see who can get there first. Yeah. Yeah. It’s yeah it’s it’s a race to the top.

00:16:03:11 – 00:16:34:02
CISO
Right. So you have all these startups, you have all these startups, but you have all these big security companies, right, who’ve been doing like, you know, your, your CrowdStrike, your, you know. Yeah. Like just I mentioned CrowdStrike. There’s, there’s so many like that are big players already and they are looking. So what I see is this either they’re going to you know, they’re going to innovate and they’re going to add it to that their stack.

00:16:34:07 – 00:16:44:19
CISO
Right. They’re offering or they’re going to purchase where it is. They’re going to purchase a startup that has what they want okay. So that’s really the top here. Now that’s what everybody’s looking at okay.

00:16:44:21 – 00:17:02:13
Actual
And what would you say are three three things like if you didn’t know these are sort of your three biggest threats right now. And then let’s just go with that. So like from, you know, maybe what you’re hearing from the conference, maybe something new or maybe it’s just something that’s being rehashed, but like, what are sort of the top threats that we need to be aware of.

00:17:02:15 – 00:17:33:07
CISO
Just, you know, as we’re looking like as we’re looking to act and we’re like, I would say the top three, right, is one is how fast, you know, threat actors and nation states, they’re using AI to, you know, to do their attacks and they’re innovating okay. So in this space. So it’s, you know, it’s always this is just put my personal opinion, it’s always faster and easier when you don’t have to worry about ethics.

00:17:33:12 – 00:17:58:16
CISO
Right. More morals and ethics. So they’re going to move faster and so on you know. So that’s that I would say that is a concern. That’s a big concern is that they’re moving faster than we are on the defensive side. You know it’s always good to be on the offensive right. Like when you and I when you do when you you know when you do wargames and simulations and you know, and you do your pentesting, it’s always more it’s always better.

00:17:58:16 – 00:18:19:21
CISO
It’s always more fun to be the attacker. But, you know, the reality is on the defensive side, we got to get faster. We got to get, you know, better and and you know, and we got to really think like you know those ethical and moral boundaries. I mean are they more important than safety and being secure. Like that’s going to be that’s going to be a challenge.

00:18:19:21 – 00:18:54:04
CISO
So that’s I think that’s and then that touches into like this second risk right. Is these agents they have no they have no soul right now. They don’t you know, they will you know, they will they will do whatever it takes to achieve their goal. Okay. So I mean, if everybody’s watch Terminator, if they, if, if you set them a goal that says, hey, make the world a safe place and they and they identify that human beings are the, the biggest risk to the world, guess what they’re doing.

00:18:54:06 – 00:19:15:00
CISO
You know, so, you know, how do we how do we make sure the guardrails, those ethics, you know, those those like those guardrails are in place, like how do we make sure of that the next. And then the third thing I would say is like, and that’s the topic that, you know, is the next generation because they’re growing up with they’re going to grow up with AI.

00:19:15:00 – 00:19:35:03
CISO
Like, you know, like the generation after me grew up with that, you know, with, with like cell phones and the internet. Hey, you know, and and you see, you see what happened. A lot of them are on social media posting where they are, what they’re doing, they have no idea about, you know, online safety at all about privacy.

00:19:35:05 – 00:20:04:13
CISO
Right? So was I what is that like? They could be at home like, this is, you know, you that they don’t know. So they just they grow up with it. They think it’s their friend. They tell it everything. And now it’s out there for, you know, for bad, you know, for bad actors. So, you know, and that’s the thing like, you know, and, and a generation and a generation of people who don’t care about privacy or safety, they’re easy targets that, you know.

00:20:04:15 – 00:20:12:12
CISO
Yeah. And then they grow up and they make laws and they don’t think those, you know, they change the laws because they don’t think it’s important. I mean, those are those are the concerns.

00:20:12:13 – 00:20:38:15
Actual
Got it. Yeah. So, you know, we’re getting to the tail end of this. And I think, you know, we’ve covered a few topics. One basic, you know, if you have equipment that has the default login passwords that you can find in the paperwork that anybody can find in the product manual from the company’s website, and maybe we need to go and kind of go through our stuff and make some changes, make some updates so that we don’t become the next Minnesota water tower that gets attacked.

00:20:38:15 – 00:21:01:12
Actual
Right. Keep an eye on I you know, I know that this is a gray area that we’re all planning right now, but is there a way that you can implement some guardrails in in your use of AI? Right. So looking into that and then sort of the, the personal know the personal side, you know, the the kids, the younger generation, how are they how are they using I don’t know, keep an eye on it.

00:21:01:14 – 00:21:25:06
Actual
Right. I mean, we’re all finding out now. There’s all this, this data now that’s showing that this, I would call it maybe like the Covid kids, that generation, they’re going, man, their overuse of social media has a direct link to some pretty negative outcomes. And so there’s a was it a well, what was I reading? Was it a country or a state that outlawed in Europe.

00:21:25:08 – 00:21:29:02
CISO
Yeah. They just yeah, they just banned it for children under a certain age.

00:21:29:02 – 00:21:41:08
Actual
Which is actually great. I guess depending on who you are, if you’re if you have believe that. But I, you know, now we’re seeing the fallout of that. And so that’s going to, that’s going to be the next wave is the AI wave and how that’s affecting people.

00:21:41:08 – 00:22:02:00
CISO
I want to I want to say something like on that, like, you know, they put lines in about like, you know, like you can’t drive until you’re like, you know, 16 because you have to get a driver’s license because, you know, driving is dangerous because you know, you can, you know, you can harm people with a car, right?

00:22:02:02 – 00:22:19:13
CISO
You they don’t allow you to drink. I mean, used to be like, you know, in some countries it’s 18 countries, it’s 21, whatever it is. But there was, you know, there’s some idea of like, hey, drinking at a young age is not a good idea. So we’re going to try and, you know, like, stop it as much as possible.

00:22:19:18 – 00:22:36:01
CISO
People just need to, you know, understand that AI and you know, social media is insane. It’s dangerous. Now, there needs to be age limitations on it because they’re not ready. Yeah. They’re not developed enough. They don’t understand enough. And it is dangerous. Yeah.

00:22:36:01 – 00:22:55:13
Actual
And that kind of, you know, I guess before we take off, there was an article I came across. That’s right. Here, let me open this up. And it came out, let’s see. So there was titled five Reasons More Americans Are Cutting Off Their Own parents, according to psychologists. And one of them, the number two reason was social media influence.

00:22:55:13 – 00:23:15:05
Actual
And so it’s really interesting. So it said there was a study of nearly nearly 10,000, which is kind of what you you would need for a study. Teens found that spending more than two hours a day on social media was linked to significantly greater odds of negative relationships with one or both parents. And they they called this, there’s a word for it.

00:23:15:05 – 00:23:35:01
Actual
They called it the word of mouth mimicry and or no contact viral stories. So basically what they’re saying is someone might see a video on TikTok, I cut off my parents and I’m much happier now. They were toxic, narcissistic boundary crossers, and now I’m great and people will mimic that. Or they think, oh, this person’s getting a lot of attention.

00:23:35:01 – 00:24:03:17
Actual
And although, see, they acknowledge, they acknowledge there’s no long term studies that have definitive, definitively documented this, it doesn’t mean that the absence of evidence is evidence itself. So basically what they’re describing this as a dignity culture towards 1 or 1 places greater value on like the victim culture. And so now it’s with there’s the psychologists are saying is this sort of whatever this relationship with social, social media is creating a race to the bottom.

00:24:03:17 – 00:24:16:20
Actual
It’s if you have enough victim status because of the way you were born, you can create a victim status by suggesting your parents abused you or neglected you, and therefore you have value and a reason to cut them off.

00:24:16:20 – 00:24:41:15
CISO
I need to tell you my opinion. I’m not right. I mean, so I don’t know if you remember, there was a famous there was a famous doctor, doctor Spock. Right. Who said, hey, you shouldn’t, you know, you you know, it’s you know, you shouldn’t, like, spank you children. You should let them like, grow up naturally way and let them, like, kind of find their own way.

00:24:41:17 – 00:25:00:11
CISO
Right. And then everybody was like, oh, well, you know. Yeah, my parents thanked me. So I don’t want to take my kids. Right? I don’t want to be mean to my kids. I want my kids to just love me every single second of the day. Right. And yeah, and I want them to grow up to be. And they’re going to be okay.

00:25:00:13 – 00:25:19:07
CISO
Okay. There are trends in culture and society, you know, and obviously this is a trend, a dangerous check, but a trend I mean, those are symptoms. But let’s do it. You know, like like, you know, with the Doctor Spock thing, you know, that people like a ton of people did that. Right, is a little bit of is a little bit of good in it.

00:25:19:07 – 00:25:37:18
CISO
And there’s a little bit of that, like, I feel like that root causes people. And maybe it’s just me, like, you know, you know how they say there’s always two, like there’s always truth in somewhere, but not not the entire room. Right. It’s true. Hey, like I think that everything is like that. So you have to look at it.

00:25:37:18 – 00:25:59:02
CISO
I mean, I think social media is definitely bad for children. You know, they get influenced by it easily. The sooner they are exposed to it, the sooner they believe that that’s reality. But I also think that, you know, another another thing that needs to be looked at is, you know, there are like, why do we have so many children who, you know, who where are the parents?

00:25:59:07 – 00:26:22:13
CISO
Because the biggest influence on children when they’re young should be their parents, not, you know, social media. So I’ve seen tons of parents who have kind of delegated, you know, parenting like like you should get your morals and ethics from like when, when I was growing up, you got it from your from your, you know, your family and your community right now.

00:26:22:13 – 00:26:44:14
CISO
You get your ethics in morals online. You know, like, hey, hey, you know, you need to look at that if you have if you have children, you need to really look at that. Like, you know, like, are you not talking to your kids and just giving them an iPad. So that way, you know, you can not have to, you know, because I know it’s it’s it’s hard.

00:26:44:14 – 00:27:07:02
CISO
I mean, you know, it’s hard because there I tell people all the time, like, first kids don’t bring you together, you know, they can tear a family apart because it’s stressful. But the other thing is that, you know, I think you have to be really patient because they’re everything is new to them. And so, you know, they are like they’re just trying to learn everything.

00:27:07:02 – 00:27:29:18
CISO
And if you’re not the one, somebody tell me, why make babies infants, toddlers, right. And young children are they have a white board. And so everything they experience, everything they hear, everything they do writes on that whiteboard. It becomes who becomes part of who they are in the future. So if you’re not writing on their whiteboard, somebody or something.

00:27:29:20 – 00:27:45:13
Actual
It’s, you know, and that’s interesting. This kind of goes back to the basis of the new Toy Story movie. I don’t know if you’ve seen it, Toy Story five, that’s what it’s all about. It’s all about kids that are being grown up, growing up just for the parents, give them iPads and are like, okay, the iPad to take care of you.

00:27:45:16 – 00:28:03:05
Actual
And it’s the whole like that, that, that dilemma. And of course they bring in, it’s like nobody’s playing with toys anymore because now they have their iPads. Right. And that’s kind of interesting that you brought that up. And and what it reminded me of when I was in grad school, when we talked about that topic of confirmation bias.

00:28:03:05 – 00:28:24:19
Actual
And so basically what you’re saying is, hey, I’m going to get or what this situation is saying is I’m going to get my information from social media, or now where we’re going is I’m going to get my information from my best friend, my AI therapist. Right. And the problem is, and I don’t I’m sure you’ve seen this is when you use AI, like when I use cloud, it tells me every thought I have is great.

00:28:24:19 – 00:28:39:05
Actual
It’s like, that’s so smart. And I’m like, no, I’m not asking you to tell me I’m smart. I’m. I actually want you to tell me I’m. This is not the right thing. Like, please tell me when this is not the right choice. And it, it it has they’re like built in a way to to tell you whatever you choose is great.

00:28:39:05 – 00:28:58:03
Actual
And I feel like that does lead us towards that confirmation bias of like, I’m just going to find what I’m looking for. I’m not actually going to find maybe what’s helpful or needed or what’s true. I’m just going to find other people that agree with me. Right. I’m just going to talk to cloud. And cloud is just going to agree with me and make me feel like, okay, yeah, that I that is the right answer.

00:28:58:05 – 00:29:22:02
Actual
And that’s like, that’s a dangerous slope. I mean, shoot, I had a whole course on it. I had to write a whole paper on it on this concept. Right. And that’s and I mean, that’s something that just adults struggle with that everybody struggles with that when one way or another. But to make social media like the internet, I your sole source of your truth, that’s going to I feel like maybe I’m wrong, but I feel like that leads you directly in to confirmation bias.

00:29:22:08 – 00:29:32:07
Actual
I’m just looking for everyone else, a bunch of people that agree with me. And then then I’m. I’m going to call it good. I don’t know. I don’t know what where we got how we got off track on this security podcast episode.

00:29:32:08 – 00:29:36:21
CISO
Well, I mean, it’s that I mean, it’s it because ethical, ethical use of AI is a big topic.

00:29:36:21 – 00:29:56:07
Actual
There you go. Yeah, yeah, yeah. Well, I think we’re we’re we kind of went over our normal time. So we’ll, we’ll cut it here. But yeah you know update your passwords, get in some guardrails. You know, take a look at how or who is using. Yeah I and let’s let’s do our best to stay secure and, stay on top of things.

00:29:56:11 – 00:30:00:02
Actual
So with that, we’ll see you next week.

00:30:00:04 – 00:30:03:21
Actual
Mission. Success isn’t about luck. It’s about preparation.

00:30:03:23 – 00:30:06:22
Actual
You’ve heard the Intel. Now go put it to use.

00:30:07:00 – 00:30:14:08
Actual
If you need to verify your security posture. I’ve established a secure line at watcher 6.com/secure.

00:30:14:10 – 00:30:17:10
Actual
Go there to get the briefing the enemy doesn’t want you to have.

00:30:17:12 – 00:30:20:18
Actual
We’ll see you next week. Until then, keep your head on a swivel.

JOIN "THE WATCH" //

Receive critical SITREPs, Industry Alerts, and Threat Indicators sent directly to your inbox.

By submitting this form, you agree to our Terms & Conditions and Privacy Policy.

SILENCE THE NOISE. AMPLIFY THE SIGNAL.

INTELLIGENCE IS USELESS IF YOU AREN'T LISTENING.

Join The Watch to receive New Episode Alerts, Strategic Breakdowns, and Guest Intel delivered to your inbox.