Former FBI Cyber Leader: 'We're Playing Catch-Up On The Defense Side'

Cynthia Kaiser says nation-state actors, ransomware groups and novice hackers are adopting AI differently, but midmarket IT teams can't assume their organization size makes it an unappealing target.

(Cynthia Kaiser, Cyber Executive, Halcyon, and former FBI Cyber Deputy Director)

For years, the news of major cyberattacks seemed remote. Nation-state attacks involved countries such as North Korea, Russia or Iran, while massive breaches hit global corporations.

But former FBI cyber official Cynthia Kaiser says that distance can create a dangerous sense of security for smaller organizations.

"I've found it really surprising moving from government into the private sector that risk is often assessed much lower than I would assume it would be," Kaiser said during a special crossover episode of podcasts Ready.Set.Midmarket! and Ctrl Alt Lead.

[RELATED: 7 Sobering Cybersecurity Realities From A Former FBI Agent]

"There's this belief, like, 'I'm nobody. Why would they target me?"

Attackers may beg to disagree.

Kaiser, who spent more than 20 years at the FBI and now leads Halcyon's Ransomware Research Center, said smaller organizations can provide cybercriminals with softer targets or pathways into bigger ones.

"They're often looking at suppliers or a third party as a means to get into a larger organization," she said. "That enables them then to take one operation, one hack they do, and then spread it across so many different types of entities."

AI Makes Manipulating Trust Easier

Cyberattacks don't always involve some exotic technical exploits.

"It's still manipulating trust," Kaiser said. "That really is a primary way we see a multitude of actors conducting their operations."

AI makes manipulation easier.

"It's easier to lie with AI," Kaiser said, pointing to deepfakes, increasingly hard-to-detect phishing schemes and voice cloning. She warned that organizations can no longer assume a familiar voice is sufficient authentication when only seconds of audio can be used to impersonate someone.

[RELATED: How Organizations Can Fight ‘Voiceprint’ Fraud, Following OpenAI CEO’s Warning]

That's why layered controls such as multifactor authentication and passwordless systems are security musts, rather than relying on employees to recognize every deception.

Still, AI can cut both ways. Kaiser called AI, machine learning and automation "absolutely" necessary for defenders trying to keep up with growing threats while avoiding the burnout that is so common among already-stretched security teams.

[RELATED: The Memory Problem Holding Back AI Security Agents]

Asked who is benefiting more from AI at the moment, attackers or defenders, Kaiser acknowledged the imbalance.

"I absolutely think we're playing catch-up on the defense side," she said. "I think we're going to get there, but it's going to be a hard few years."

Kaiser also dives into the various ways criminals are using AI. Nation-states can dedicate teams to experimenting at the technology's leading edge, while ransomware gangs are more likely to use AI for tasks that already make money. Then you have the less-skilled attackers, using AI to become just skilled enough to wreak havoc.

With AI making deception easier and cheaper, Kaiser urges midmarket IT leaders: don't consider your smaller operations invisible to attackers.

Watch the full episode of Ready.Set.Midmarket! below.

The full episode can also be watched on MES Computing's YouTube channel and heard on Spotify and Apple Podcasts.

Previous RSM! episodes are here.