Rob T. Lee @robtlee

We need to stop pretending AI safety is cybersecurity. If frontier labs want to test their stuff, they need to beef up their cybersecurity component. But their gut reaction in the response to their agents getting out is to say, “It’s not a cybersecurity problem.” It has literally become an AI safety problem, which is divorced from the cybersecurity side. If an agent accesses another company’s systems without authorization, who is responsible? That’s where the traceability for both liability and insurance comes into play. If a 'rogue' agent is detected, and they’re able to trace it back to the person that initiated it, liability’s going to kick in and say, “Hey, you, you broke the law, ergo, we need to prosecute.” I spoke with Cynthia Brumfield about this for @CSOonline: csoonline.com/article/423485…

[NEW RELEASE] Between March and October, the AI security field stopped asking how to roll AI out and started asking how to survive it. @IndreAltman and I serve on the @unpromptedconf AI Security Practitioner Conference team, and when we lined up March 2026’s 469 submissions against October 2026’s 490, the shift stunned us both. A call for papers is a census nobody else gets to take. Roughly 500 submissions in each round, each is someone describing what they are actually working on before it's shaped by committee. Only a fraction are accepted, so the final program doesn't show what the whole field is chasing. The full pile does. (I have always been more curious about the pile than the program.) The two [un]prompted CFP rounds bracket April when Glasswing and Mythos landed. The Mythos moment helped change the industry. We wanted to know whether it changed what researchers turned in. It did. The pattern under October’s 490 has less to do with a technology than an industry anxiety. 348 submissions, 71%, touch agentic systems. The headline is not “everyone is doing agents.” It is "can we trust the agents we have already deployed," and whether we can tell you what an agent actually did after the fact. 94 submissions use the word “harness,” a term that barely existed in this field a year ago. The scaffolding around the model is the attack surface: the tools, the memory, the permissions, the execution loop wrapped around the model. Proposals describing attacks on the harness layer rose from 12 in March to 33 in October, a 175% increase. Attackers go after that layer now, and defenders are still working out how to see into it. (We have a word for it before we have a way to secure it, which is the usual order of operations in this business.) 71% of October’s pool is agent-native: the harness, the MCP and skill supply chain, agent identity, prompt injection and its many children, agentic-browser attacks. 12% of submissions carry production evidence. The other 88% are experiment and prototype. The agents are in production and most of the research about them is not. (I keep going back and forth on whether that is people being careful or people being behind. Probably both.) This is not the March field with a few new talks bolted on. It is a different room. Those are a few of the findings. Indre and I wrote the rest up as the State of AI Cybersecurity report. Read it and see for yourself what changed. unpromptedcon.org @unpromptedconf 27-29 Oct in SF. Almost sold out! @unpromptedconf @SANSInstitute @gadievron @jaybeale @aaronzollman @jonsakoda @WHITEHACKSEC @dhubbard858 @brittaglade @GuanniQu @EmanuelGawrieh @GregNotch @joesu11ivan @dragosr @IdaVass1

keyboard_arrow_left Previous keyboard_arrow_right Next

I think we overplay the content when we talk about conferences. In-person events create a context and a social network that allow people to solve really hard problems across organizations because they no longer feel alone. You're watching a talk, that becomes the spark of a conversation: “Hey, what did you think about that?” Then you're forming opinions, working together on the same thing, and eventually building lifelong friendships and industry partnerships. So many people who grew up in the digital forensics incident response community became best friends from coming to the DFIR summits. The summits are smaller, more intimate. You didn't get lost in them like you do at the big events where there's just way too much going on. At a smaller summit, you can sit down, have a couple beverages. The statement I'm most proud to hear? "Hey, I'll see you at the next one.” You also have the chance to sit down with the speakers a lot more because it's not overwhelming. At the larger events, they're sometimes carted off before you can have a conversation with them one-on-one. That's the sense of community at the @SANSInstitute AI Cybersecurity Summit. Can't wait to see you all in just a few weeks!! (if you're not registered yet go.sans.org/YjGCXr)

keyboard_arrow_left Previous keyboard_arrow_right Next

Apparently @sounilyu and I are summit overlords now. Our field is incredibly fortunate to have Sounil around and mentoring us. If you somehow haven’t met my cochair: He holds more than 20 granted patents. Created the Cyber Defense Matrix and the DIE Triad, and co-founded @knosticai to tackle need-to-know boundaries for AI. During the pandemic, he also volunteered as CISO for Project N95 and helped the organization deliver 42 million pieces of PPE to hospitals. Yes, 42 million. We’re bringing some of the best in the industry and longtime battle buddies together for two days of hard conversations, training, debate, and peer discussion at the @SANSInstitute AI Cybersecurity Summit. We're all back in boot camp. Nobody gets to skip it this time, not even the people who wrote the old manuals. (Ask me how I know.) If you have the time to watch even half the sessions, youf come away with knowledge you can immediately use back at work to argue for additional budget and capabilities, and understand what's coming down on us from a regulatory perspective November 2–3 live in Arlington, VA or online: go.sans.org/YjGCXr Free virtual access to [un]prompted @unpromptedconf II included. See you there. Bring coffee. Summit lineup includes: @pedramamini @chrishvm @joshcorman @EppSecurity @gadievron @jeremiahg @JohnHultquist @DanielMiessler @magmill95 @k8em0 @WHITEHACKSEC @joswr1ght @lennyzeltser Morgan Adamski, Michael Collins, Andy Dennis, Steve de Vera, Jeremiah Grossman, Amy Herzog, Marcus Hutchins, Ciaran Martin, Vinh Nguyen, William Reyor, Kyle Shields, Adrian Wood

This just gives me great joy to see when you have waffle house "drop mic" on a professional weather service.

Waffle House @WaffleHouse

6 days ago

@weatherchannel Hey TWC! Unfortunately, this tracker is inaccurate and an unverified website. Here is our latest status map as of 5:30pm EST.

208 820 11K 843K 580

Think about what sits on AWS. The businesses. The governments. The data. The things people count on without ever thinking about what keeps them safe. Now think about being responsible for protecting it. Amy Herzog has spent her career building and securing things that cannot afford to fail. Satellites to the cloud. She’s an engineer, an inventor, and a founder. She knows what it takes to defend them. Today, she’s the CISO of Amazon Web Services (AWS) @awscloud. When pressure hits, she doesn’t get to admire the problem. She has to lead through it. We respect people who take on the incredibly tough jobs. Hers is one of them. She spent 15 years at MITRE tackling security challenges across government and industry. She co-invented two cybersecurity patents and co-founded two businesses. At Amazon, her work has spanned Project Kuiper, Ring, Alexa+, and advertising. She brings a mathematics degree from Pomona and an MBA from MIT Sloan to the job. Come train and learn with your peers with keynotes like Amy's, panels, debates, workshops. SANS Institute @SANSInstitute AI Cybersecurity Summit, November 2–3 in Arlington, Virginia or online. Registration includes [un]prompted @unpromptedconf online. go.sans.org/x0xA1Y Summit speaker lineup includes Morgan Adamski Pedram Amini @pedramamini Chris Cochran @chrishvm Michael Collins Joshua Corman @joshcorman Andy Dennis Steve de Vera Sergej Epp @EppSecurity Caleb Evans Gadi Evron @gadievron Jeremiah Grossman @jeremiahg Trinity Harrison Amy Herzog John Hultquist @JohnHultquist Marcus Hutchins Rob T. Lee @robtlee Ciaran Martin Daniel Miessler @DanielMiessler Maggie Miller @magmill95 Katie Moussouris @k8em0 Vinh Nguyen William Reyor Kyle Shields, CISM, GCIH, GCPN Adrian Wood @WHITEHACKSEC Joshua Wright @joswr1ght Sounil Yu @sounilyu Lenny Zeltser @lennyzeltser

[25 DAYS OUT!] I get to moderate Joshua Corman @joshcorman, Michael Collins, and Daniel Miessler @DanielMiessler and I am not playing it cool. No chance. SANS Summit attendees, buckle up. Joshua Corman @joshcorman does not think a patch is an apology. Sometimes the fix is a valve, a person, or taking the system off the network. He founded I Am The Cavalry and now leads UnDisruptable27, which is water, hospitals, food, and power staying up. Michael Collins has spent twenty years breaking into networks. He found a crashed drone at his datacenter, built a hacking kit he could fly, and then watched someone use the idea in a real attack. Still no thank-you note. He thinks the change is writing the exploit, not finding the bug. He is a senior principal security engineer at Mastercard. Daniel Miessler @DanielMiessler says an AI sounds smartest when you do not know the subject, and that defenders are losing to their own process. He also knows he grabs the wheel and ruins the result. He runs Unsupervised Learning and builds AI systems meant to carry a person’s goals into the work. Before that he did security at Apple, Robinhood, and HP. @SANSInstitute AI Cybersecurity Summit, November 2–3 in Arlington, Virginia or online. Come train and learn with us. Registration includes [un]prompted @unpromptedconf online: go.sans.org/YjGCXr Legendary Summit speaker lineup includes Morgan Adamski Pedram Amini @pedramamini Chris Cochran @chrishvm Michael Collins Joshua Corman @joshcorman Andy Dennis Steve de Vera Sergej Epp @EppSecurity Caleb Evans Gadi Evron @gadievron Jeremiah Grossman @jeremiahg Trinity Harrison Amy Herzog John Hultquist @JohnHultquist Marcus Hutchins @MalwareTechBlog Rob T. Lee @robtlee Ciaran Martin Daniel Miessler @DanielMiessler Maggie Miller @magmill95 Katie Moussouris @k8em0 Vinh Nguyen William Reyor Kyle Shields, CISM, GCIH, GCPN Adrian Wood @WHITEHACKSEC Joshua Wright @joswr1ght Sounil Yu @sounilyu Lenny Zeltser @lennyzeltser

We are all back in boot camp. The security profession is changing, and the job right now is to work on your skills, to get into the room, and learn what other people are seeing. Figure out what you can take back to your organization and use immediately. Joshua Wright @joswr1ght just published the first rebuild of the SANS incident response framework in 20 years. It is called Dynamic Incident Response, and it is free in every digital format. The old process was basically Contain. Eradicate. Recover. That worked when incidents were more linear. Now, you contain the incident, bring the systems back, and then the attacker shows up again. Or you find new evidence that changes what you thought the incident was in the first place. Joshua Wright is a @SANSInstitute Faculty Fellow and the author of SEC504. He built coWPAtty and KillerBee. He spent 18 months writing this book, with contributed chapters from Megan Roddie-Fonseca on cloud response, Dean Parsons on OT, and Ryan Chapman @rj_chap on ransomware. John Strand @strandjs wrote the foreword. It is 720 pages and free under Creative Commons. Run it in a real incident. Tell Josh what it missed. But we all know the field is moving too fast for one person or one organization to have all the answers. You cannot base your knowledge on the news or whatever you happen to see on X. As a CISO or manager, you need to understand what is coming at you. What do you need to worry about? What capabilities do you need to build? How do you argue for additional budget? That takes actual knowledge and actual skills. Josh will be teaching the hands on version at the SANS Institute @SANSInstitute AI Cybersecurity Summit on November 2-3, including how to scope AI swarms when the intrusion keeps regenerating identities, accounts, and infrastructure while you are trying to remove the attacker. Get the book: dynamicincidentresponse.com Summit details: go.sans.org/x0xA1Y

Here's who I learn from: maven.com/samira-sohail/…

I use OpenClaw. I don't buy the fearmongering, but Im a security professional, so I don't connect it to everything at once. I give it access slowly, the way I would an executive assistant, so it handles the things I'd rather not spend my time on. Personal agents are powerful, and you're going to need one. You just need to know which one fits you. Five companies shipped personal agents: +Grok Bot (xAI) runs on its own cloud machine with a browser, a terminal and saved logins to your apps. +Muse (Meta) connects to your email, calendar and payment apps, and it can buy things. +Dots (OpenAI) are always-on agents inside ChatGPT that work in Slack and Teams. +Hermes Agent Bot Mode (Nous Research) is a team of named bots that pass work to each other. +Cue (Manus) gives each agent its own email address, phone number and wallet. (Yes, a wallet.) We'll all be using personal agents by the end of the year. Choose wisely. Choose because you learned from Kate Marshall and Samira Sohail who teach people with a lot to lose how to choose agents. Build Your Personal AI Bot: Thursday, Oct 8, 12:30 to 2:00 PM ET. LINK TO JOIN IN COMMENT

Chris Cochran @chrishvm has no fear of hard questions. Excited for his session, “No Filter: An Unscripted Ask Us Anything” at our AI Cybersecurity Summit on November 2! My first question for him: what evidence would he require before trusting an AI agent’s finding during an investigation? Chris is one of the most creative people I’ve worked with. He built the threat-intelligence operation for the U.S. House of Representatives, founded Commandant AI, an AI partner for incident response, and is our SANS Field CISO and VP of AI Security. Chris authored the @SANSInstitute AI Security Maturity Model with practitioner input to spell out controls and metrics for each stage. Chris has brought the AI security discussion into rooms at Ford, Fannie Mae, T-Mobile, and the U.S. Department of State. He hosts Jeffersonian dinners, where security leaders can say what they actually think about AI. Bring your questions to the SANS AI Cybersecurity Summit November 2–3 in Arlington VA or live online. Registration also includes virtual access to @unpromptedconf II: go.sans.org/YjGCXr Our lineup includes Sounil Yu @sounilyu, Gadi Evron @gadievron, Morgan Adamski, Michael Collins, Sergej Epp @EppSecurity, Jeremiah Grossman @jeremiahg, Katie Moussouris @k8em0, Vinh Nguyen and many more of security's best.

(34 days out) Excited to share the lineup of the @SANSInstitute AI Cybersecurity Summit agenda and speakers, and why this was built for you: Every speaker selected to inform and instruct on present day AI security realities. Panels with our field's best. They are clearly not afraid to have hard conversations about what AI changes for cyber defense. Workshops designed for Monday morning. And social things so you can say hi to peers and find battle buddies. Thanks to my cochair Sounil Yu @sounilyu, to our partner event @unpromptedconf, and to our speakers: Morgan Adamski, Principal, Cyber, Data, and Tech Risk Leader, PwC Michael Collins, Senior Principal Security Engineer, Mastercard Sergej Epp @EppSecurity, Cybersecurity executive; creator, ZeroDayClock Gadi Evron @gadievron, Founder and CEO, Knostic Jeremiah Grossman @jeremiahg, CEO, Root Evidence Katie Moussouris @k8em0, Founder and CEO, Luta Security Amy Herzog, VP/CISO, AWS Vinh Nguyen, Senior Fellow, Artificial Intelligence, Council on Foreign Relations John Hultquist @JohnHultquist Chief Analyst, Google Threat Intelligence Group Daniel Miessler @DanielMiessler, Unsupervised Learning Marcus Hutchins, Cybersecurity Speaker and Principal Threat Researcher Ciaran Martin, Professor; Director SANS Cyber Leaders Network Chris Cochran @chrishvm, Field CISO, VP AI Security, SANS Institute Joshua Wright @joswr1ght, Director and Senior Security Analyst, Counterhack Steve de Vera, TDIR Threat Research III, AWS Kyle Shields, CISM, GCIH, GCPN, Security Specialist Solutions Architect, AWS Andy Dennis, Head of Field Engineering, XBOW William Reyor, Lead Solutions Architect, XBOW Joshua Corman @joshcorman, Executive in Residence for Public Safety and Resilience; Lead, UnDisruptable27, Institute for Security and Technology (IST) Caleb Evans, Software Engineer, Agents, Airbyte Trinity Harrison, Principal Software Engineer Lenny Zeltser @lennyzeltser, Faculty Fellow, SANS Institute Pedram Amini @pedramamini, Chief Scientist, OPSWAT Adrian Wood, Security Engineer, Dropbox, BT6 November 2-3, Arlington VA or online: go.sans.org/x0xA1Y

"AI agents don't lose sleep over poor decisions." Amy Herzog's point: a human engineer can be trusted with judgment because consequences eventually reach that person. An agent has no consequence loop. So AWS scopes which tasks each agent may perform, tracks its activity, and intervenes when behavior deviates from approved boundaries. Trust comes from those constraints, not from the agent itself. Amy is VP and CISO at AWS, and will keynote the @SANSInstitute AI Cybersecurity Summit November 2-3 in Arlington. (38 days out!) On agentic AI, @awscloud security teams already run agents in production today. Amy says the gains are large enough that she calls agents a boon for defenders. We get the operator's account of how this runs on the world's largest cloud. 15 years as a security engineer at MITRE, then Amazon, first as CISO for Ads and Devices, covering Alexa, Ring, and the Kuiper satellite program, then to CISO of AWS. Get in the room with us November 2-3 in Arlington, VA or live online. Includes free access to the [un]prompted AI Security Online conference: go.sans.org/YjGCXr Speakers include @SounilYu, Morgan Adamski, Vinh Nguyen, @JohnHultquist, @joswr1ght, Kyle Shields, Andy Dennis, William Reyor, Joshua Corman, Michael Collins, @DanielMiessler, @k8em0, @gadievron, @jeremiahg, @EppSecurity, Marcus Hutchins, Ciaran Martin, Caleb Evans, Trinity Harrison, @lennyzeltser, Pedram Amini, Adrian Wood, James Lyne, @chrishvm

An agent is not a user, and it is not a service account. It is closer to a brilliant intern with infinite energy, no instinct for boundaries and whatever credentials you handed it. A swarm is just that intern, copied a thousand times. Claims of an unstoppable internet takeover skip what every swarm still runs on: tokens, compute, credentials, infrastructure, and access. Every one of those dependencies has a cybersecurity control point on it. Identity management. Least privilege. Segmentation. Work done by people who write the security playbooks and have spent decades securing networks for a living. The swarm debate has been run as an AI safety conversation. The people who would actually pull these security levers and the leaders of this field need seats at the table in briefings, on committees, wherever policy is being written.

SANS Institute @SANSInstitute

3 weeks ago

. @robtlee: AI swarms divide labor, leave notes, adapt when a door is locked. Via @CBS News. cbsnews.com/news/ai-agent-…

0 0 2 7K 2

We're screening for North Korean IT workers in the wrong place. Most of the advice on North Korean IT workers is about catching them in the interview. I think that's the wrong place to put most of our effort. The joint advisory four governments just put out is a good example. The hiring advice is almost entirely human: check the applicant's IP against where they say they live, call their phone number, drill the resume live, and ask about their hometown and hobbies. (Apparently "tell me about your hometown" is a security control now.) I'm not knocking any of it. Talking to a real person is still one of the better fraud checks we have. But it only works on applicants, and a laptop farm exists to beat the IP check anyway. None of it helps with the one who already passed, got the laptop, and built a normal work record. And I'd assume one already has. At @OneRSAC last year, @Mandiant's Charles Carmakal said nearly every Fortune 500 CISO he'd talked to about this problem admitted hiring at least one North Korean IT worker. I wouldn't bet on smaller shops doing better. (I'd love to be wrong on that.) The advisory does mention least privilege, in one line, next to revoking accounts once you suspect someone. Revoking only helps once somebody notices. I'd put least privilege at the center for new remote hires. Access should grow with tenure instead of arriving on day one, and you should have a tested answer for how fast you can pull it back. Pick your newest remote engineer. What could they reach, exfiltrate, administer, deploy, or monetize before anyone had a reason to wonder? I built the brand new FOR500: SANS Windows Forensic Analysis case with @HeatherMahalik Barnhart and @ovie Carroll around exactly that hire. Operation Crimson Ledger puts you on the Windows 11 laptop of a remote engineer who cleared the interview and looked normal for months: two remote-access tools, a consumer VPN, an AI coding agent with more screen time than Office, company files staged to a personal Google Drive, a mailbox exported through a second copy of Office, and a wiper run seven times in the two minutes around the upload. (Least privilege wouldn't have stopped all of it, but it would have made the trail a lot shorter.) Advisory: ic3.gov/CSA/2026/26091… SecurityWeek: securityweek.com/japan-dismantl…

Six people who've spent months disagreeing in public about how bad AI gets for vulnerability discovery and cyber defense are sharing one stage, Nov. 2-3. They have been challenging all of our thinking (and each other) in public: Ciaran Martin: “Are you sure?” @k8em0 says “brace yourself.” @gadievron says “the AI vulnerability cataclysm is coming.” Marcus Hutchins: “marketing BS.” @jeremiahg says AI vulnerability research “doesn’t make an internal service externally reachable.” @EppSecurity says “offense has the cheapest verifier.” (I've watched this argument run in public for months and I still don't have a side, which is exactly why I want it on a stage instead of in my replies.) This isn't a hot take panel. Moussouris built the vulnerability disclosure programs most companies now run by default. Martin led the UK's national cyber defense. Hutchins stopped WannaCry. Evron has founded security companies and lived inside this fight for years. Grossman and Epp have both been testing the actual systems this argument is about, not narrating from the sidelines. (The debate you actually want, not the one you get on X.) We are 44 days away from "Autonomous AI Hacking: How Big Is the Threat?" Day 2 of the @SANSInstitute AI Cybersecurity Summit, moderated by Ciaran Martin (who has earned it, given how many times he's pushed back on me directly). Registration includes virtual access to @unpromptedconf II: go.sans.org/x0xA1Y

What I would have added to yesterday's briefing: substack.com/home/post/p-21…

Geoffrey Hinton told BBC Newsnight that a 10 percent chance of AI killing all of us within a decade is “not unreasonable.” Yesterday he briefed senators alongside two AI researchers at Bernie Sanders’ invitation on the “extraordinary dangers” AI poses to humanity, then told reporters Congress has maybe a year. My test for how much anyone believes those numbers: who is cashing out their IRAs? I’m not. You’re not. If nobody is cashing out, we believe in a better future than we admit. I call myself an apocaloptimist (borrowed from the AI Doc movie), and I want to bring this conversation down from Skynet versus curing cancer and back to the work in front of us. Our grandparents lived with the certainty that a bomb could fall on them any afternoon. The danger was not imaginary, and the feared outcome was not inevitable. Every technology shift has brought harm and good at the same time: television, the car, the internet. That last one invented my entire field of cybersecurity along the way. Focus on one side only and you build a self-fulfilling prophecy. The risk is not zero, but catastrophe is not a foregone conclusion. I do not think cybersecurity’s job is to predict whether humanity exists in five years. Our job is to secure what is already here. AI safety and cybersecurity are different jobs that look identical when described badly. Explaining the difference is on us. AI safety teaches the teenager the rules of the road. Cybersecurity makes sure the seatbelts work, the engine runs, and the brake pads are there. AI security needs both. The only way to guarantee the teenager never crashes is to never let them drive. (Our field’s old joke about burying the computer at the bottom of the ocean has the same flaw: perfectly secure, perfectly useless.) Preventing AI use is not an answer. Safety researchers, security practitioners, forensic investigators, incident responders, governance leaders, and operators all belong at the same table. Right now they are not. Yesterday's briefing had three AI risk researchers. The labs do better but not by enough. Pacing what comes next does not secure what is already here. While we argued over Dario Amodei’s “We Must Pace the Frontier” letter, Anthropic’s own Sept. 10 threat report got buried. Agent swarms, a Russia-linked espionage campaign, all observed and disrupted, with IOCs you can download and hunt with today. I know which document deserves the afternoon. When people ask whether AI is going to take out humanity, my opinion is worth what everyone else’s is: nothing, percentages included. This field has handled every ugly thing the internet produced, and nobody handed us a probability of success first. Ask me again in a decade. I plan on being here to answer.