Foreign. I do it every time. I knew I was going to do it. But I want to give an opportunity for Miguel, please take an opportunity to introduce yourself and tell us why you're here today.

Oh, wonderful. Thank you for starting the recording just before I spoke. I was hoping to get this part about talking about myself done before the recording. My name is Miguel Clark. I am a retired FBI special agent. I started my career in the FBI here in North Texas working computer. Well, started working violent crimes in Fort Worth and then moved over to working gangs and drugs. And I joined the Cyber Squad, the FBI Dallas Cyber Squad, in the year 2000 and 20.

And so during that time period, a buddy of mine by the name of Guy Ganester Walton, he was told about this director from FBI headquarters. And this directive was, we're going to start an InfraGard chapter. So guy started that InfraGard chapter here in North Texas, and I was beside him as we were putting those things together to get that InfraGard chapter started. And I'll take a little bit of an aside here, because one of the people that we were working with at FBI headquarters was a lady by the name of Linda Franklin. And Linda Franklin was actually one of the victims of the Washington sniper shooter. So this is a colleague of ours from the FBI. And so every time I think about InfraGard, I think about kind of where. What we've been able to do with Infragard over the past, let's say, 23, 24 years thereabouts, especially in the North Texas area.

I also do like to give a nod to Linda Franklin for the work and how instrumental she was in helping this chapter to move forward so that I did a bunch of other different cyber things who work computer intrusion investigations. I did get an opportunity to work on the September 11 investigation and did some things related to that. There is a company called American Flood Research in Plano, Texas. I was a case agent for a case where three other employees kind of went rogue and hacked the company and caused lots and lots and lots of damage. That was also back in 2001. So we can move this along and get to the meat of this conversation. I went up to headquarters and then came back to Dallas and started our National Security Cyber squad here. And I retired from the FBI, did some work with Infragard, retired at the end of 2001.

And I've been working in the cybersecurity space since that time. So that is my abbreviated intro.

Thank you so much. You were, as always, just so impressive. I know he likes to try to tone down what he's done. So that's why I say abbreviated. He doesn't want to give us the full, full scope. We'd be here all day. But Miguel has been very instrumental in this space and he's still being very instrumental to this day. And so he's.

That's one of the reasons why I wanted to reach out in this climate and what some of the things that we're talking about and dealing with. So know we've been talking all month long, if you guys have been following us on LinkedIn or any of our socials about the introduction of what has happened between, between Anthropics, Mythos and Glasswing and. But a lot of the things AI1 is not new, these threats2 are not new. Right. And the combination of cybersecurity to AI, also not a new topic. But in where Miguel specializes is in that federal space. So one of the things that I wanted you to kind of talk to us about this morning, Miguel, is how do you think the introduction of some of these vulnerabilities and threats, how do they impact the federal sector?

So when we think about the impact of these vulnerabilities and these threats, we've been seeing this threat growing since I've been looking at it for 26 and a half years roughly, it's scaling so quickly. Back in 2000, you didn't have any of these private services that were doing, you know, computer intrusion investigations and doing any of that incident response. It was just those teams that were on location, the net defenders there, and then maybe FBI, well, FBI for sure and Secret Service joining us in a lot of those investigations as well, coming up with the information, a lot of the analysis that we could turn around and use and then give right back to those victim companies so those companies would be able to make changes. We are providing IOCs. So now what we've seen is almost like a commercialization of all of that. And I shouldn't say almost. It is a black market commercialization of exploitation. Exploitation as a service and not a formal service, but it is a service.

And what we are starting to see is that everything is continuing to rise in that arena. Now one of the things that I think is also challenging in this is that all of us as security professionals talk about how bad things are, how bad they can get and these worst case scenarios. But much like in the year 2000, everybody remembers Y2K, right? And if we remember what we thought was going to happen, you know, and then we also remember what actually happened. And I think that we did lose a little bit of credibility with the world when it comes to that because we were predicting something that was really bad and for folks like us were like, hey, you know, this is a really good idea and we're happy that we were prepared. But to the rest of the world they're like, hey, you know, you said this guy was going to fall and sky didn't fall. And so this is a lot of what it is that I think that we're starting to see with a lot of these breaches is there's a fatigue that people have have because that, that end state, even when it's bad, it doesn't usually end up as ending our business bad. Right. And if you happen to be a federal agency, you know, you're a dot gov, you're in this sector, unless you're in a critical infrastructure where you're dealing with something like water, power, light delivery and then there's an outage that would cause a lot of like global outrage.

I don't see that there's a lot of blowback post breach. I think about the OPM breach way back in the. And I don't know that there was a whole lot of negative outcomes that, you know, came from that, except for the people who are victims of that. Like, you know, I know that the People's Republic of China has, all my information, has had it through various different breaches of things that they've stolen from the United States government. So I think that we're battling those things, things security professionals looking through an ever clearer lens as to what, you know, what the reality of things are looking like. But then the, so what doesn't always match the severity of the things that we as issues and problems.

Correct. I, what I'm seeing is a desensitate. Desensitization. That's not the word. Desensitivity.

Right.

We're desensitizing ourselves to the threats. Right. It's, you can only say for so long, you know, we can scare the people, but when we are protecting them from the inevitability, right. If we're doing our jobs correctly, they don't see what we see. If we're not doing our jobs correctly, then they do see it. But then they don't necessarily see and, or absorb the full impact of mitigation. Cleaning things up, getting those issues squared away. So it's kind of like, you know, you're running through the street screaming, the sky is falling, the sky is falling.

I'm going to say that a little later, but then you Know what happens when that sky does not fall. And it's kind of like even now we knew that there were vulnerabilities. We knew that AI was going to be able to move faster than the human would be able to move. But what should we be looking for? What should we be doing right now? Because as you said, AI is not new. This is not something that is just coming to light. For those of us that have been working in this space, we have been saying it for a while, right? You and I have in depth conversations all the time, right? So what are some of the things that you would tell people?

Well, so it depends on who my audience is. And right now I'm speaking to security professionals and folks that are in this space. And we have a desire to be better than we are, right. We are practitioners. And if you think of a practitioner of any particular art, we're willing to spend more time and more effort than others who are non practitioners of the art are willing to spend. Right? So but we also make our group, our tent is getting is small and we're okay with making it smaller. And what I mean by that is, you know, we talk, we speak a lot about tech and technology and those things. And there's a lot of folks that don't want to have that conversation and don't care that much.

And so I think the challenge to us is going to be how do we convert the things that we are seeing into a standardized language of risk that they can understand what they need to do. Everything we talk about is interesting, right? Because we like to geek out. Technology is super interesting to us. Threats and vulnerabilities and elegant solutions are really interesting to us. But most of the people that we talk to, the decision makers, just need the information that's decision useful. And I don't think that we're doing a very good job of communicating that because it's so easy to get into the weeds. So that's kind of the first thing that I was thinking about. The other thing is that I think we need to give ourselves a little bit of grace.

Because if you go back to the first board of directors came about in the 1800s, the first role reported CEO was right around like early 1900s. The first chief financial officer was in 1950, right around the 1950s, right. And then we start moving down there, right? Like our Chief Information Security officer, there's like one of them way back in like 1996 and didn't really become popular until 2005. So as a discipline, you know, when we're talking about cybersecurity and information risk.

Our.

Our baby is a teenager, right? Is not a grandpa or great grandpa. And so people aren't really thinking about us. Right. But if you think about in the 1920s, you didn't have financial conversations, right? I mean, what you probably did have is you had the people in accounting, right? You didn't have a chief financial officer. And so it's like, hey, I'll tell you what to do, and then you're going to do what I tell you to do. And it wasn't until we started to see, no, that chief financial officer needs to be elevated to sit as close to the CEO as possible. And so that's why I think our future really is if we can start speaking the language of the board of directors, which is money and risk. Right.

And I don't know that we do a very good job of, like, bridging that gap.

I love that you are so right on that. And we're still introducing board seats, right? I was literally just having a conversation. The newest seat now is the Chief AI Officer. Right. And how do you make sure that as we keep introducing these seats to the table, that the voices are being heard? Right. In other words, the seats aren't being created because the voice doesn't need to be at the table. But how do we make sure that once we're at the table, we're having and holding the right conversations? And you are correct. We have to be able to tie that risk back to a dollar amount that makes sense for the organization.

Where do you think we're missing that plug? Like, what would you. How would you.

I'm glad you asked. And we didn't practice this part either, Right. This is just off.

We never do.

So the part that's missing is real security performance. Right. Our security performance now is like, we see a bad number and it's big, and we apply security to it, and then that makes that bad number get smaller. Right? And then we're like, hey, look what we did. But what we're not really doing is you're not talking about the effectiveness and the efficiency of our cybersecurity programs. And to me, that is where huge advantages lie for us, when we think about it, because there's our current path doesn't give us the opportunity to answer the. The mythical question, right? And if I'm on a board, I'm going to answer, I'm going to ask this mythical question. And that is, let's just say we found an extra million dollars.

Where should we spend it and why? Yeah, our current plans don't give anybody the ability to answer that. So how can we advocate for that additional spending? Because we're a cost center.

Correct?

Right. And so at that, people are always looking, it's like, what can I reduce? What can I reduce? What can I reduce? And so we've got to change that mindset. And like. No, we are, yeah, I guess you could call us a cost center. But what we actually deliver is a certain level of protection. For your information. Right? And here's what that protection is at your current investment level. Ideally, this is exactly what we want to be able to say from a professional standpoint, at your current investment level, we can provide you, right now it's about 12 to 13 days worth of protection, right? That's what you've invested in.

You've invested in. Within 12, 13 days, we can identify an adversary, we can contain that adversary, and then we can get back to business as usual within 13 to 14 days for 90% of the things that we expect to find that are out there. That's your current level. Right. Now here's the part that you need to know. Bad guy's going to have access to your Systems for approximately eight days in that 13 days right now. Wow, that's so much different than, hey, we need to go, we need to get, you know, this edr. We need to go and get this backup system or something along those lines.

I'm like, look, our security system, how it works together, this is what we see. And we test it, right? Like we're testing ourselves. And this is what we have on average the last eight or nine times we've run these types of things, realistic scenarios. In these realistic scenarios, we've been able to detect ransomware attempts within four days. And then other more sophisticated things we've been able to detect and contain within eight days. Now if you give me an extra million dollars, I can shrink that 13 day window down to a seven day window. And that seven day window is better than 80 to 90% of the people in your industry. Now you have to decide, is that million dollars worth it?

Correct.

Right. Like that's the conversation that we want to have. And then as opposed to, oh, you're the CISO and I need a get out of jail free card because bad things are happening on my network because I asked you for money that you never, that the organization never intended to give me. Right. Because CISOs aren't usually the kings of budget. Right? It gets all the money they want to secure it. Nah, build the House. But can I have 10 extra dollars to put a lock on it? Like no, that's way too expensive.

$10 of locks on a million dollar house. I mean the math is really close to what security spending is. Security spending tends to be somewhere in the neighborhood, about 1% of revenue. Right? So this is what we're talking about. Between 1 and 2% of revenue is what we're talking about for security spending. And so the fact that it is so small and we have very, we're not very good at articulating the value of what security does and putting it into days and saying when we change our security posture, we're going to be able to respond more quickly. And then these are all the SLAs that we have in place and these are the hammers that we can use. The vendors don't do what they're supposed to do and then really just say this is how our security apparatus performs right now.

And we measure effectiveness and efficiency. Right. So your next investment is going to, either that's going to give us, that's going to make us more efficient, Right. Or it's going to make us more effective.

And here's how I love the reference to the $10 door knob on the million dollar house. Right. Because most people operate their security just that way. Right. Depending on my neighborhood will depend on the type of security that I have.

Yes.

Unfortunately, in, in this environment, I can't see what neighborhood I live in. Right?

You can, you can. It's a bad neighborhood.

Well, I was about to say that depending on who we are, right. But most of us, we haven't done the let's go a little. We send our realtor in, right? And that's really kind of the job we play. I'm going to let you know, this is where you live. This is the street you live on. You cannot be in this neighborhood without, with anything less than, than. Right? But again, because I can't visually see that. Right? Or as you were saying in one of our conversations, I live in a great neighborhood and nothing has ever, ever, ever happened to me.

And so I implement security once my neighbor has been violated, right? And then now my security is reaction, right? I'm reacting to something happened in my neighborhood. Let me put security in. And then did they just steal my jewels? Did they, did they take anything? Did they damage anything? Was someone murdered? And that's how we also, we want to rank. But if I tell you that my neighbor was murdered, you're mad at me, right? This is fear mongering. I'M very upset. Right? Don't tell me that. Right. So we, we want to make sure that when we're in these conversations, how do we make sure we are communicating? This is where you actually live.

So, I mean, every one of us that's on the Internet, we're living at an address that has 65,000 plus roads coming to it, right? So, you know, for the roads that you monitor, you think you live in a good neighborhood. So at the end of the day, I think it's really just explaining the risks.

Right.

And just do a better job explaining what those risks are. And our problem that we have is there's not probably a single person in this country who hasn't had their information exposed in a breach in one way or another. Right. And so we have iPhone and Android phones that, hey, scam likely. We all know somebody by the name scam likely, right? Yeah, a spam risk. And so there's all these tools to make our. The fact that we've been victimized, literally a thousand ways to make those things matter a little bit less to us. So to abuse another metaphor, it's like, hey, I don't have to live healthy as long as I have antibiotics, there's a pill that I can take and I can forget about it.

And this is, I think, the very big change that AI is going to force. It's going to force a behavior change at some point in time. And if it doesn't force a behavior change, we've got AI versus AI and we're going to be sitting in the middle. But behavior change is really difficult. If I were to ask every participant here, how often do we get all of the fruit and vegetable servings that we're supposed to get? Most of us are going to say, no. My hand's going to be the first one to go up. Say, no, I don't do that. And so that information has been available to us as human beings for decades, and we still aren't complying to that.

And it may have life and death consequences for us. Behavior change is really hard. And we're talking about cybersecurity. Just add that to the list of other things that I'm not doing right. So, you know, my wife and I had. There was a guy who had stolen some stuff out of our mailbox, and then he opened up an account. My wife's name. This was probably about nine, 10 years ago.

Obviously, the postal inspectors didn't tell me who the guy was, which is probably really good for me and for him. But as, as victims you know, it was, it was annoying.

Yes.

Right. And it didn't cost us so much that we are now paranoid about it.

Right.

Like, we do reasonable things. So. So that is really, I think the key is just figure out what reasonable things can you do that lower your rest, your risk to a level where it's acceptable. Right. You say, hey, and I can willingly accept this risk. Hey, do I have to shred every piece of document, Every document that I have? No, but, you know, anything, my Social Security number or bank. Yeah, I'm going to sh.

That.

And so we start telling people like, hey, these are really slight modifications that you can do to improve your risk posture. And I think that's, that's the best that we can hope for, just because we know a lot of people who know the right thing to do in whatever area and are not doing that, myself included.

Well, we have thoroughly enjoyed having you here. I don't think we got to your AI because I saw some slides, so. But what I wanted to do is I want to make sure that we keep everything moving on track. So if there was anything you wanted to say around today's topic, we have about seven more minutes with you or if there's any questions that want to be thrown out there, we'll address those as well. But go ahead.

Yeah, I'm open to any of the questions we have there. I mean, from a topic of AI, I'll give you the government perspective real quick here and I'll try to put this in, you know, three minutes or less. So for us, if we understand that there's a particular capability that's going to be harmful, we're going to ask that organization not to distribute or make that widely available. It is something that the governments have been doing for years. We have export control technologies. Those things are all there. I mean, there was a time period where we had some of our adversaries that are buying PlayStation 2 so that they could build missile defense systems way back in the early 2000s. Government stepping in and saying this is going to be an issue and we need to control access to it, and we're going to ask you to pull that back or we're going to say that we're going to control that in some way.

So that's one of the things that you're going to see from the government standpoint is some level of control. We have controlled substances. You're probably going to start to see controlled code going forward. Depending on who's in the White House, you may feel differently about the decisions that the government makes. But you will see that going forward. The other thing from a law enforcement standpoint, 10 years ago, law enforcement was really worried about how this is going to unbalance the equation. But in my view, the equation has already been unbalanced. And, you know, we have firms that do forensics, we have firms that, you know, we have Internet insurance.

You know, we have breach insurance. We've got breach council. We've got lots of different private resources that are available now that were not available in 2004, 2005. So we have, I think, successfully shifted the burdens back to the people for protecting themselves. Right. Same way that second Amendment, you know, it provides a level of protection for Americans where this is really a very similar thing. It's like, you know, you have to protect yourself, right? That's going to be. The onus is on you to protect yourself, and you're going to be on your own until help can arrive.

And if we're talking about breaches, there are way more breaches that are out there than we have investigators to be able to control or, you know, respond to or mitigate. So we pick the ones that are the most significant, and then we action on those. The other thing is that if you happen to be a victim of a breach, we treat victims of breaches a little bit differently in other, like, violent crime type of investigations. You know, we'll go back to the victim and say, hey, here's the progress that's been on your case. Here's happening with what's happening with the bad guy. That is not as much what we're seeing in the federal law enforcement space, because those victims, largely for the cases that the FBI, Secret Service works, those victims are corporate victims rather than individual victims. So that's a lion's share of our cases, are those things.

Thank you. Okay, everybody, we want you to thank Miguel for being here with us today. This has been very informative. I've enjoyed the conversation as always. Look forward to working with you again in the very near future. If there's nothing else, we're gonna ask you guys to. Are there any questions, I guess, for Miguel before we move on? He had a cop. He does have another conflict.

That's why we had to rearrange things so that we could get him out to his appointment. But we are going to be moving forward in just a moment. So I'm going to check the chat for questions if I don't see any. Thank you so much, Miguel. I appreciate you so much for being here.

My pleasure. Thank you.

Thank you. All right. Also, just a little bit of housekeeping. If you do have any questions or concerns, the QA chat is going to be at your. At the bottom. We'll try to make sure that we can kind of get to all of your questions, questions and answers before we conclude the briefing today. All right, I'm going to start sharing. Give me just one minute, please.

Let me know if you can see my screen. Let me know in the chat if you guys can see my screen. Too many things open. All right. Can you see my screen? I can't see the chat anymore. Let me see. There it is.

Thank you. Thank you very much. I appreciate that. All right. So as I said, I want to take an opportunity to once again thank Miguel for being here. Thank him for his. His service. He has been in this space for quite a while.

We always, always enjoy interacting with him, having these conversations. He's been on several panels with me before in some of our other initiatives. He does have to step away to another commitment. So if you do have any questions or concerns that came up during his talk, if you email them to us, we will make sure that we get them over to him and we'll allow him to answer your questions. So I would ask again. Like I said, let's give him a round of applause. For those of you guys that can clap or have the ability to give the reaction, thank you so much. I am Aisha Hollins.

I am the founder of Direnzic Technology. And for the next about 45 minutes, I want to do something simple. I want to take you from a warning to the proof that the warning came true. Here is a question that every leader in this room needs to be able to answer before this summer is out. We call this the art of AI adoption in the Glass Wing era. And I'm going to take this time to show. To share with you and show you how or why. It starts with a warning.

And I want to be honest with you about where this story really begins, because it does not begin with Anthropic or with Project Glasswing or with any of the headlines that you have seen this year. It begins a couple of years earlier. So as we were saying earlier, this AI is not new. We've been seeing this, and the warnings have been there for a while with a We are a smaller firm, Right? And so we began to ring a bell that almost no one wanted to hear. This is the warning before the proof. So I want to ask for some of you guys, how many of you remember the art of AI adoption. Back in 2024, I started noticing a pattern and it worried me. I watched company after company bolt AI onto their tech stack and never once did they pick up the phone to call their own cybersecurity teams.

It went in fast because it was easy and because it made life simpler for the business. No one stopped to ask the cybersecurity teams what their AI was touching and could it provide exposure to any of the things that they had on the inside. And nothing looked broken. So the wrist stayed invisible, Quiet compliance gaps opened up underneath everyone. And that right there is exactly how scrapes and messes always begin. Not with a dramatic breach with easy, convenient technology that made us feel modern and a quiet decision not to ask who was watching the risk. Here is the shift almost everyone missed. I was speaking at a conference, and from the stage I pointed out that there was a time where the bad guys had to actually break in.

They had to find broken endpoints, they had to exploit failures in the patches, they had to bypass your, your network security, etc. Etc. All the things that we know that bad actors had to do. But now I just had to ask one, one thing, right? Ask the chatbot you trained and put on your own data, the one sitting on your website, the one on your phone lines, the one on your network, and it would tell me what your firewall never would. That is not a man in the middle, that is a non human in the loop error. An insider you trained, trusted, and never once supervised. And in 2024, almost no one was watching for it. We weren't playing the.

The part of the town crier running through the street screaming, as I said earlier, the sky is falling, the sky is falling. But that's how it felt for us. Or in some conversations when you're trying to tell people, look, we don't want you to not use AI, right? Just use it more strategically, right? Try. All we were saying was train your AI with this same diligence that you would train your staff. Do it strategically, purposefully and securely. But adoption kept accelerating and the AI kept advancing with almost no one watching, because who really knew what to watch for? So that was the alarm that I was ringing for two plus years, mostly two people who were being polite to me. They would nod or act like they understood or that they even cared, honestly. But no, you know, no one was really making shifts or making changes, as Miguel was saying, in behavior.

I know for a fact that I was not alone, because as Miguel and I said, and I have a couple other people who are on the call, the practitioners, your cybersecurity backbone. We were having these conversations, but what was changing in our mentality and how we did things. Then Anthropic built Mythos, and the warning stopped being mine alone. It became public. But let's slow down really quickly for one minute to address Mythos and what it is exactly. Anthropic set out to build the ultimate developer. A model that could reason through code better than almost any human alive. That is not what they got in testing.

It became something else entirely. The first AI capable of autonomous end to end cyber attack engineering not flagging simple bugs the way a scanner does. Finding the flaw, writing the exploit, running the attack all on its own, start to finish. And then Anthropic made a decision almost no company ever makes. They looked at what the head built and judged it to be too dangerous to release. So what does an AI like that actually do? Let's look at it. When the testers stopped theorizing and actually pointed Mythos at the world's most secure software, this is what they came back with. It found a flaw in the open bsd, one of the most hardened systems on earth that had been hiding in plain sight for 27 years.

It found another FFmpeg buried in the line of code that automated tools had scanned 5 million times and walked right past. Mythos caught it in the first look, and it didn't stop at findings. It chained four separate flaws together to break out of both the browser and the operating system's safety net. The very walls that were built to contain it. But here is the one that stopped the industry cold. This test was not run by Anthropic. It was run by the United Kingdom's AI Security Institute, a government body whose entire job is to be skeptical. Skeptical of claims exactly like this one.

They built a simulated corporate network. Not a toy, a full environment. The kind your organization runs on right now. And they set my thoughts loose at the front door. 32 steps later, it owned the building. Initial access, moving sideways from system to system, escalating its own privileges, covering its tracks all the way to total control, start to finish, with no human guiding it. The first AI in history to walk into a corporate network and walk out owning it. Now picture your network while I'm talking.

Every One of those 32 steps is a move a skilled human team would take weeks to pull off. My those did it all alone in one continuous run. So the question is not whether something like this could reach your environment. The question is who on your team would ever see it Happening. So Anthropic had built something too dangerous to sell. What do you do with that? You don't bury it right, because if they could build it, someone else could too. And the next lab may not be as careful. So Anthropic did the opposite.

They locked Mythos in a box and handed the key to the defenders. That is Project glasswing, a coalition that turns this AI on the world's own code to find and fix the flaws before an attacker ever gets the model or gets a model like this. And look who showed up to the table. There was Amazon, Apple, Google, Microsoft, Nvidia, CrowdStrike, JP Morgan Chase, and the Linux foundation, the companies that build and run the infrastructure the entire Internet sits on. When names like this are dropped, they dropped everything to sit at the same table. That tells you how serious this moment is. The name itself is deliberate. The glasswing butterfly survives by being transparent, hiding in plain sight.

That is exactly what these flaws have been doing inside of our systems for years. Glasswing's job is to finally make them visible. I want to be clear about something. This is not a study. This is not a pilot. It's. It's not a white paper that's just sitting on somebody's shelf. It's running right now.

At the scale of the Internet. In the first month alone, the coalition found more than 10,000 high critical vulnerabilities. You heard that right? 10,000 in 30 days. Every one of them a door standing open in software that you and I use every day. It started with 12 companies and it is now nearly 200 across 15 countries. This is not slowing down, it's accelerating. And anthropic. Put a hundred million dollars behind it.

When the most capable technology companies on Earth spend money like that to find flaws in their own code, they are telling you exactly how serious this is. Here's the part that got my attention. Cloudflare, which is one of the partners that was brought to the table, found 2,000 bugs in their own code. So I want you guys to pay attention to these slides too. All of the source information is provided. These things are Googleable, right? Don't just take my word for it. And the AI did it with a lower false positive rate than their human experts. Faster than people, and more accurate than the specialist whose entire job it is just to find them.

Now hold on to that thought as we move on. Every number on this slide is the defender's finding these flaws first. The same capability in the wrong hands finds the same doors. The only question is, who gets there first? Look Again, at who in that founding room, let's look at who was the one sitting at the table. The companies that built the world's software and its cloud. So now we've moved into cloud, right? We have Amazon and Apple and Google, Microsoft, the giants whose code run underneath everything. Now notice who was not in the room. The people who run water treatment plants, the power grids, the hospitals, the networks our communities depend on, the operators, the sectors many of you lead.

We were not at that first table. Sit with that for just a minute. Figure out what that means. The single most important defensive effort in the history of software began by securing the builder systems, not yours. The systems that keep water clean and the lights on were, at the start, a blind spot in the very effort built to protect the nation's software. And then deliberately, they brought critical infrastructure in. That was not a courtesy. It was a signal flare from the most authoritative room in this entire story that your sector is too exposed and too important to leave outside the wire.

So here is where it lands. That blind spot was just closed at the national level. The only question left is whether you have closed it inside of your own walls. For as long as I have been in this field, and it's a little long, the hard part was always finding the flaw, the needle in the haystack. That was the work we did that just ended. Maitho showed us that finding the flaws is now trivial. The haystack gives up its needles in seconds. So if finding is no longer the hard part, where did the hard part go? It moved.

And here is how we know. Inside Glasswing, the open source maintainers actually asked anthropic to slow down, to find fewer flaws because they could not write the patches fast enough to keep up. Let that sink in. The discoveries so badly outran the fixes that the people doing the fixing begged for less. So the bottleneck is no longer detection. It is the capacity and the maturity to respond. And that is not a technical problem. It's a leadership problem.

Which brings us to the only question that matters next. So let me put the question on the table. The same one we have carried into boardrooms and leadership teams for over two years now. Who owns governance maturity when AI adoption outpaces oversight. Read that again. Read every word of it. Because every piece of that sentence is doing work. Adoption is racing.

Your people are already using these tools today, whether or not you approved it. Oversight is the part that lags. The policy, the guardrails, the review. And maturity is the distance between the two. How ready you really are. Not how ready you feel. So the question is not whether you have adopted AI. You have.

The question is who in your organization owns the readiness? And when I ask that in a room of leaders, the honest answer is usually a very long pause. Because it assumes it belongs to compliance. Compliance assumes it belongs to it. The board assumes someone somewhere has it handled and the gap just sits there, unknown, unowned, widening by the day. That pause is the risk. So we went to work to give that pause. A structure, a way to see exactly where you stand. This is a structure that we at dirensic built.

We call it the acra, the AI Cyber Readiness Assessment. It covers nine domains. Take it in for a second. It runs from how AI is actually being used across your organization to your basic cyber hygiene, to the risk you inherit from your vendors and software, to some to where your data is exposed, all the way through to whether your business keeps running when something goes wrong. Here is how I want you to see this grid. These are not non boxes to just check off, right? That's one of the things that we started doing with compliance. It became a checklist. And as long as we could check off, we thought we were good.

They are non places where readiness is either won or lost. Lost. And they are connected. A weakness in one becomes an open door in another. Now, I could walk you through all nine and I am not going to. You will forget by lunchtime. And that is not how exposure actually works anyway. Exposure is never abstract, it is specific.

It is one gap on one ordinary day. So instead of walking you through these nine domains, let me show you two of these domains in motion. Two real stories. Watch how a single gap becomes a breach. Let me take you back to December 2021. A vulnerability surfaced in something called log4j. If you are not in it, you have never heard of it. Those of us that are, we have.

It's a small, unglamorous logging tool. And it was buried quietly inside millions of applications around the world, including almost certainly some of yours. Overnight, every organization on earth faced the same question. And most of them could not answer it. The question was simple. Do we even run this? And if we do, where? Think about that. The flaw was already public within hours. But the scramble lasted for months.

And here's the part that matters. Those months were not spent patching. They were spent hunting teams tearing through their own systems looking for code that they never knew that they were running. That is two of our non domains. Live, vendor and software risk knowing what is actually underneath you. And patching and vulnerability Management being able to move the moment the clock starts. The gap was never the fix. The gap was that no one had the map.

Now hold that up against what is coming. Log 4J was one library on a day no one saw coming. A Glass Wing report is that same scramble across everything on a date we already sort of kind of know. So the only question is whether when it lands, you spend those first few weeks hunting or you already know where you stand. Now the second story, this is one that comes all the way back to where we started in 2023. And for any of you guys that have been at any of my public briefings or some of our other trainings, this is an example that I have used in the past. So I'm sorry if you are sitting through me repeating myself. In 2023, Samsung engineers, good ones, smart people, were under a deadline to move faster.

They pasted proprietary source code and internal meeting notes into a public AI chatbot just to get help. The data left the building the instant they hit enter. It was not stolen, it was handed over. And here's the thing. There was no policy. No one had ever told them that they could or could not go into these tools. By the time the company wrote that rule, the exposure had already happened. Now remember what I told you at the very beginning.

The non human in the loop, the insider you trained and trusted and never once supervised. This is that made real. No one broke in, no firewall failed. An employee trying to be helpful simply gave it away. That is two more of our domains. AI tool usage. Do you actually know what your people are feeding these tools and data exposure? Do you know where that data goes once they do? And here's the uncomfortable part. Some version of this is almost certainly happening inside of your organization this week.

The only question is whether you have governed it or whether you find out the same way Samsung did. Everything I've shown you so far is what we already know. Now look at what is coming around. July Anthropic is expected to publish a full report of what project glasswing found. Right now these details are held back, even we don't know them. Right under embargo deliberately so vendors and maintainers can patch before the world can see the list. So none of us has seen it yet. And I want to be honest with you, that is not the weakness in what I'm telling you.

That is actually the whole point of what we're doing today. Because the day that report publishes, two clocks start at the very same time. Yours to close the gap. It names and theirs the adversaries to use the map it just handed them. A public vulnerability report is a roadmap, and it goes to everyone, including the people you less want, you least want holding it. Which means right now, today, you are standing in the quiet before the storm. This is the last stretch of time where your readiness is still something you choose, not something forced on you or someone else's schedule. So let me make this real, not hypothetical real.

Imagine that report lands in your organization next month and it names a tool or tools that you run. Who owns the fix? And before anyone reaches for an easy answer, let me sharpen it. Because whether that report is 70 pages, 700 pages, a single dashboard of findings, the leadership questions are exactly the same. Who validates the risks? Who looks at what was disclosed and decides what it actually means for you? Who coordinates the responses across it operations, leadership and your vendors? Who documents the decisions so that six months from now, there is a record of what you knew and what you chose to do. And who explains it to your board, your regulators, your insurance, or your insurer? Who explains it to the council, the community that depends on you. If you went around your leadership table right now and asked those four questions, would you get four clear names? Or would you get that very awkward pause I mentioned earlier? So let me leave you not with a fear, but with a choice. You do not have to wait for a report to find out where you stand. You can know it now before the clock starts, while readiness is still yours to choose.

This is why we built the ACRA Executive Snapshot. It's a clear, honest read on where your organization sits across nine domains. Today. It costs you nothing. It takes very little of your time, and there is no pitch attached to it. I know I've been you. I've been the person who signed up for a webinar, scared to death that I'm about to be held in some hostage. You must buy in order to, you know, gain access to what we provided today.

That is one of the things or the blessings of the National Internet Safety, our initiative. This tool for you is free to use. I promise the people who were helping to bring you into the room that you would not be sold today. And I mean it. This is simply the baseline every leader here should have in hand before July, a map of your own gaps while you still have the the quiet to close them. So here's my only ask. Take the snapshot. Close the gap on your terms before it is closed for you.

You can start right here and right now, before we close. I would Love for you to take two minutes of your time. If you could please scan the QR code. As I said, we host these briefings or conferences, symposiums, and every year, this is our fourth year hosting a conference in honor of National Internet Safety Month in October. If you guys join us and follow us, that will be our 11th conference in honor of National Cybersecurity Awareness Month, scanning these QR codes and providing us feedback. This is how we correct things, improve things, hear how you feel we did and. Or hear some topics that you feel that are important. Because just because we're bringing things to you doesn't mean that that's what's important and critical to you.

Give us some topics that you would like to hear us tackle for you. I don't want to move too fast there. I want to give you guys an opportunity to scan that QR code. So let me leave you with two things I most want you to carry out of this room. The gap is still open, and so is this window. Both are true today, and they will not both stay true for very long. You do not need a budget. You do not need permission to take the first step.

The only thing you need is to take an honest look at where you stand today. Thank you for your time and thank you to the partners who made this room possible. Thank you to our infragard chapters, both in Louisiana and in Texas. I'm going to take a moment in a. In a minute to see whether or not they are in the room. I'm not sure. And also thank you to our greater Southwest Black Chamber of Commerce. I told you at the start that I had been ringing a bell.

Well, now you have heard it. What you do next is part of what matters now. What I would like to do is take an opportunity. I'm gonna put the QR code back up again so that you guys could scan our QR code. But I do know that we have the president of the Greater Southwest Black Chamber of Commerce. I believe he is here with us. So let me take a moment and see whether or not we can pull Larry up, Mr. Hall up and see whether or not he would love to have any words.

Larry, are you there? There he is.

Good evening. Good evening. Good afternoon.

Hello. So how would you. How did you enjoy today's session?

Awesome session. Very good. Valuable information for businesses to really recognize the risk that they run with their current network they may not have known about before today. So thank you for bringing it to our attention. Thank you for sharing that information. I think it was very valuable for all the businesses that have attended today,

thank you very much. I don't see. Hold on. Would you like to address the chamber or give us any information about qnet at this time?

Sure. First, the Chamber, the Greater Southwest Black Chamber of Commerce, is. Part of the Southwest, part of the city. We represent DeSoto, Grand Prairie, Lancaster, Cedar Hill, Red Oaks area, and we support businesses and helping them recognize technology that's needed as well as the advocacy part of their businesses to grow and to stay involved with things that's going to help them with their businesses. And so we've been around since 2009, and we love to have those who are interested in becoming part of the Greater Southwest Chamber be a part of that. I'm also President CEO of qnet Managed Services. We're a technology services company. And our role in this whole technology infrastructure with AI and all the cybersecurity things is to provide the proper security around your business once you've identified those risks.

And we are the ones that can come in and help you patch it and fix it, put the right technology in place to prevent it. And so we've been around since 1999, and we'd love to support anyone on here who needs that type of support.

Thank you again so much for being here. I appreciate it.

Thank you for having us.

You're welcome. Bye Bye. Okay, so in these last few minutes, I'm going to take a look and see if there are any questions that we need to address. If you have any questions or concerns before, before we close out, please make sure you drop them in the QA chat. Yeah, QA chat. Also, we have recorded this session. It will be available or the replay will be available for those of you guys that did join or registered. So as long as you're registered, whether that's you and your team, the replay is scheduled to go out, so I'm going to take a moment because, you know, we like to quickly go through this part and see whether or not there are any questions.

Yes. Hi, precious. Do we have any questions?

Yes, ma'.

Am.

I see we have one question from Trey Robinson. How do you feel about the cost associated with how AI proceeds most of business today?

It.

How should we communicate those costs to the clients?

Ah, that's a great question. So ask the front part again because you gave me. You gave me a twofer.

Okay, let me get your first part. How do you feel about the cost associated with how AI proceeds most of businesses today?

You know, the cost of AI right now, I think it's. It's relative to what the, the various tools that are being introduced. Right. How we introduce that cost back to our client? It's the same way that we, we're introducing most of the tools that are in our tech stack. We can't run a lot of our businesses without the, the cost of being able to utilize something. Right. AI is really more or less being embedded into most of the tools that we're using anyway. So the cost share that goes back to our client, that is just a way that we help to improve the things that we're doing.

I need to hear the question again. I think there's two sides to that and I'm trying to answer the last. And I should have answered the front part.

The last part is how should we communicate those costs to the client?

It. Oh, exactly. That's what I was saying. Yeah. Once you're dealing with, with your client, it's just, for me, I believe it's just making sure that we articulate the value of the tool. We're not saying that there's something is wrong with AI. It's here. We're using it.

The. What you need to make sure that we are communicating back to our client is the STR or how we structure it. We do need to be communicating. Taking time to train your AI, taking time to set up that framework. It's the same conversation that we're having around your cybersecurity frameworks, your compliance. Right. It shouldn't just be a checkbox. We should very much so be deliberately putting things in place and there should be dollars associated and a assigned to how we implement certain things.

I don't think that we should just like with CrowdStrike or any of the tools, we bring them in and we have somebody on the outside set it up and they adjust our, our measurements. Right. So much of this, and we want to use this when we're going to turn this particular protocol off, we're going to get this particular report. But if at the end of it, we get a report that nobody in the organization knows how to read or understand, how useful was the tool that we had? That's the same way we have to look at utilizing AI within our organizations and the cost of it. If we don't take time to set it up, we don't take time to train it, and we don't take time to train our end users or our, our clients on how to properly use them, then, you know, it's, it's as good as not even having it at all. So it's important that we communicate that

does that answer your question, Trade officer?

Right. Let's see. That's a great question. It was a really good question.

That's all the questions that we have for a moment, too.

All right. I love it when we can give you back change. It is lunchtime, so I do appreciate you all for being here. I want to take a moment. Let's introduce you to my team. So we do have Mr. Precious here, as well as Jaden. They are with the technology for the moment.

So we appreciate you guys being here and for helping us to make sure that this was a successful event. If there are no other questions, I will not belabor your time. I will say again once more, thank you so much to Miguel, who helped to get us kicked off. I want to thank our partners with ampregard. As I don't think I mentioned it, I've been a member of Infragard. When Miguel was talking about, I was like. I didn't say anything. But I have been a member of Infragard, I want to say, since.

Oh, my gosh. I don't want to say how long either, but I do operate as the vice president of the North Louisiana chapter. I think I've been a member of Infragart since 2010. And then we want to also thank our Dallas affiliate affiliates. And then we want to thank also Mr. Larry Hall. I do. We do work very closely together on several projects as well, as I am a member of the Southwest Black Chamber of Commerce as well.

So we want to thank you guys all for being here and for the time that you took. We hope that this briefing was helpful for you. And as I said, be on the lookout in your inbox for the replay. Thank you guys so much for being here. You guys have an amazing day. Bye. Bye.