Cynthia Kaiser, Halcyon: The New Breed of AI-Powered Cyber Criminal - Ctrl Alt Lead podcast

And why you should be scared of 'the stupid ones,' according to the FBI's former deputy director of cyber

AI may eventually hand cybersecurity teams an advantage over their adversaries – but for now, defenders are still catching up.

That's the assessment of former FBI cyber leader Cynthia Kaiser, who now leads ransomware research at Halcyon. Speaking on a special joint episode of Ctrl Alt Lead and Ready Set Mid-Market (with apologies for the choppy video), she discussed how nation states, ransomware operators and less capable criminals are adopting AI in markedly different ways.

“I absolutely think we're playing catch up on the defence side,” she said. “I think we're going to get there, but it's going to be a hard few years.”

One immediate danger is AI's ability to make social engineering more convincing. Attackers are using AI to produce convincing phishing messages and manipulate people because “it's easier to lie with AI.”

Cynthia also pointed to voice phishing – where as little as three seconds of audio can be used to clone someone's voice – as a growing concern.

“You cannot [have] a CFO call and say, 'Move money,' and you move money [any more].”

That makes relying on trust increasingly dangerous. Cynthia backs multiple checks, including multi-factor authentication, rather than assuming that someone is genuine because they sound like a known colleague.

We also examine why SMEs shouldn't assume nation-state attacks are somebody else's problem.

“There’s this belief, like: I’m nobody, why would they target me?”

Just being a small firm is no defence. Not only are these companies attractive targets in their own right, they can also provide attackers with a route into larger organisations if they are part of their supply chain.

There is also the intent to sow panic, a particular tactic of nation state actors:

"I'm sure they'd love to get into some larger companies, but they can compromise smaller entities and then lie about it: lie about how big [the attack] is, or just compromise a lot of different small ones to make it seem more widespread than an incident or campaign really is."

These rising threats make AI as important for defenders as it is for attackers. Automation, machine learning and AI can help teams keep pace with growing threat volumes and reduce burnout – but defensive tech still has ground to make up.

Cynthia says attackers are currently using AI "a little more" than defenders, but the way they are doing so is wildly diverse.

Nation states, for example, may dedicate small teams to experiment at "the cutting edge" of what AI models can do and how to use them for offence, while established criminal gangs, small teams of affiliates and individuals are "not going to throw out a playbook that works and is making them money to do something entirely new and different."

Finally, there are what Cynthia terms "non-capable actors": those who might previously have been unable to conduct a successful attack, and are using AI to improve their chances. Despite the lack of sophistication, they create a different kind of danger precisely because they don't understand what they're doing. Cynthia points to poorly built ransomware that cannot be decrypted even if the victim obtains a decryptor, turning it into “destructionware.”

"When these kind of stupid criminals start using AI, it becomes a little more dangerous."

Although she believes defensive AI will catch up, "it's going to be a hard few years," Cynthia says, which makes educating people outside of IT all the more important:

“We’re really making sure everybody understands that these are not merely technical threats that stay on a computer. These threats impact people’s lives.”

To access the full podcast watch the video, use the web player, or find Ctrl Alt Lead now on Spotify and Apple Podcasts.