Post

Two things at play - ClickFix (website asks user to press Windows key + R, run a command) is *incredibly successful*, and just phoning the helpdesk and asking for password reset. The GenAI research stuff being pushed out by security and AI vendors is completely absent in the real world trenches.

What's happening with GenAI research and Frontier AI(tm) is actively harming cyber defence globally. Lots of orgs and governments have drunk the kool aid and now orgs are unable to defend themselves... from hype from their own vendors.

I lead a team of emerging threat analysts in 3 countries dealing with petabytes of telemetry and real world incidents.. and zero is frontier AI. A slightly better phishing email? Sure. That doesn't drive the incident. Orgs are running around in diapers now with their hair on fire because of hype.

The misaligned incentive is to get you buy new things - tools, processes, consulting - to deal with frontier AI(tm). And for CISOs to secure more budget. That does not lead to better outcomes, when orgs couldn't defend against Advanced Persistent Teenage Ransomware Groups in the first place.

There's some really big industry names signing guidance statements for CISOs which are crap. Stop doing that. If you're at an org which can't stop ClickFix - Press Windows key + R on your keyboard and see if a prompt pops up - you're going to get owned by children, so go fix that instead.

That insurer is Resilience btw. I wasn't there but they put out a paper on it, they've had zero AI incidents claimed. I've talked to several other cyber insurers and they all say the same. I've also talked to industry peers and incident response firms and they also say the same thing.

This whole thread sounds like a rant btw, and it is - but I'm tired of ranting, so there are plans forming to start destabilising the frontier AI crying wolf. It's too much, and it's hindering protecting people.