AI Expert: Agents Will Take Over Everything

With AI, you can automate human thought. You're going to have swarms of agents that can communicate and think and instantiate and learn and have total recall. One of my big fears for 2026 is that these things are getting so much better that a lot of corporations and governments aren't ready for it.

Hey, it's great to be here. I'm going to be an optimist today.

I was. I mean, I wanted to be a legend in beer pong or a legend in football, but hey, cyber security came my way. So you do what you got to do. But I started my career in 1993 in the Air Force. You know, I got stationed at the Pentagon. And at that time, we called cyber security computer security. And all I can tell you, Joe, is, you know, I was first in line as a second lieutenant butter bar at the Pentagon to see an O-6 to get my assignment. Whereas it felt at that time at the age of 21, 22, you know, you're sentencing, what am I going to be doing for the next few years?

And I'm a sucker for 'there's only one left.' He gave me six job offers like you can do this, you can do that. You know, you could be a programming language guy, you can be, you know, I was a CompSci guy. And he gave me all these options, but he said, 'There's one slot left to do computer security.' And I remember thinking, 'One slot left, I better take that one.' And you know, because it's the commodity. But if it's your job, you get good at it. So I can tell you the fastest way I can tell my history is I started doing computer security in 1993. And that was about the year we started putting eyes on our network in the military. Who's doing what on the military? We started monitoring.

Wait, what was that called?

Hey, growing up in, you know, the DC area, we know a lot about AOL, but I lived with the whole thing. You know, the first couple intrusions happened in '88 with the Hanover hackers and Cliff Stoll and those sort of things. You have the Morris worm. Actually, I think Cliff Stoll was '84. Morris worm is '88. Guy at Cornell, you know, writing a worm that had a finger daemon buffer overflow and kind of spread them across Unix machines. By '93, I'm sitting at the Pentagon looking at log files, TS log files, secret log files, figuring out who's doing what. And by 1995, I'm responding to my first ever computer intrusions as an Air Force special agent in the Air Force Office of Special Investigations.

You know, you love to think, hey, it's just kids, right? You know, it's hey, or the infamous, it's the guy in the hoodie in the basement. It was not. It was definitely China, and the SVR out of Russia. I think by 1995 until now, I would say on a daily basis, either I or someone I work with has been responding to an intrusion from a Chinese actor working for the government. So we've had a, I guess that's a 31-year run now of daily combat in the cyber domain. It's a contested domain, and all modern nations have a doctrine on how to operate in cyber. So I can tell you it was, for me, the SVR was first. China was a rapid second, and the first time I responded to Chinese government hacking was 1996.

Not that I'm aware of. You know, I may have bumped them, you know, bumped into them at a mall. But you know what's interesting about this, and it'll sound weird, you do get a mutual respect as you're responding to the breaches and you see the art of espionage, the art of intrusion. You recognize talent when you see it. And I do believe, you know, Russia had the crown early 1990s, early 2000s. The best intrusions I saw was Russian operators on our networks. Later in my career, especially around 2019, 2020, China, you know, really rapidly graduated to great capabilities and great surreptitious ways to access networks.

You know, I responded to and worked on a case. Alexey Ivanov and Vasiliy Gorshkov were two Russian hackers hacking and extorting US companies, but they had whole scams to buy and sell stuff with stolen credit cards on PayPal. I mean, oh yeah, that was, you got it. I mean, the whole thing, you look at their machines, there's no Microsoft Word on it. There's no email on it, but there sure as heck is a bunch of scripts to fraudulently buy and sell things. So, but that was back in 2000, 2001.

Well, I can tell you in 1996 when I spotted intrusions, I remember one of the first intrusions I responded to was China. You know, back then it was, there was almost nobody responding to intrusions. It was kind of like a so what? Like, who cares? These guys are breaking into military systems. What are they doing? Flag officers aren't really using email. There's not much there. The reality is there was stuff there. I think one of the first major cases that I responded to, I went, 'Okay, now I get it,' was that the Russians broke in and they were exporting display. In other words, they were running our weapons modeling and simulation software from Russia and seeing how it worked. Wow. You know, and so then you went, 'Okay, I see how.' And we didn't export supercomputers back then, Joe. I don't think we do today. You know, like the crazy 90s and the origin 2000s. So if you wanted access to those, you had to hack in and access them. And so you had to hack the mad scientists working at, you know, NASA and other places to get access to those things. And they were very open systems. So I would tell you the first couple years that I responded to breaches, not a lot of people responding to them, you had to answer the question, what happened? And that was read the freaking manual. I remember showing up and one of the things the Air Force did really well by 1996, if there was an intrusion on base, you know, the one star cared, the base commander cared, and you had to brief that person inconveniently often, inconveniently early in the morning. So I remember, you know, 4:00 or 5:00 in the morning back then, we did PowerPoint was freelance making slides early, but everything evolved by, you know, I could answer this question over 20 minutes. The reality is by 1998, the criminal element is online and making money. You guys are making enough money to spread it, spread.

So I've always believed you're always going to have a certain amount of crime. You're always going to have a certain amount of espionage. And both of those, the cyber domain is perfect for both operators in those two domains. You know, wherever command and control goes, you're going to have the war fighter go. That's in the cyber domain. Wherever you have information go, you're going to have spies go. That's in the cyber domain. And wherever money goes, crime follows. That's in the cyber domain.

Well, so I'm in the Air Force from 1993 to 1998. When I get out of the Air Force in 1998, one of the things I did is I trained a lot of FBI agents starting in 1998 as a contractor. The FBI is a critical component to imposing risk or repercussions to folks who compromise networks. And that's why for multiple decades, Joe, you were not hacking from the United States. If you were, you got caught. There were penalties. You could not really act anonymously effectively in the US. We could pierce anonymity and do well. So I'm training FBI on how to compromise networks and then how to investigate those compromises. Kind of like back when they did bank robbers, they kind of, if you can investigate bank robbers, you're probably pretty good at robbing them if you could figure it out. You know, it makes sense. So we were doing that for a while and then right around 2004, the reason I started Mandiant, self-funded company, profitable since day one, is we had a premise: security breaches were inevitable. What we had seen was, and unfortunately the first generation of cyber security was antivirus. And I literally believed that antivirus was so easy to circumvent. We could teach FBI agents in the classroom who were not malware developers how to circumvent antivirus in under three minutes. Compress and encrypt malware and you got past antivirus. So I remember thinking if you believed antivirus was protecting your systems, it was like believing in the Easter Bunny, you know, I mean, this just doesn't, it's not going to work. So I'm sitting there on the front line seeing that. So the premise Mandiant had in 2004 was it is critical to own that front line and see what adversaries are doing in the cyber domain, which I had seen since 1993. So I realized I was lucky enough to be in the military where I had a front row view of, hey, China and Russia really doing this. It wasn't making the press. There wasn't really severe impact to breaches back then. The business impact started in the late 90s, you know, and so with that background I felt let's respond to every security breach that matters. And believe it or not, Mandiant was actually an endpoint company. I just executed so poorly on that dream. Nobody knows it, you know. But we were building an endpoint to detect what Symantec and McAfee missed. And I fundamentally, I'll leave you with this. I think Symantec and McAfee had flawed models. No offense to those companies. I respect them both. But the flaw was this. They were like, 'If our antivirus misses something and you find it, you submit it to us and our databases will get better.' Well, nobody catches it, it's already too late. The average human sitting in their home is not going to find malware. So what we were is we're going to respond to every breach that matters. Find out, and we already knew how to circumvent all the endpoint safeguards, and we'd build a better endpoint that it would detect, you know, with that front row seat to what adversaries were doing. We would detect what everybody misses. And since that time, George Kurtz and CrowdStrike kind of went on to build what I had hoped to build.

Well, yeah, you fast-forwarded from 2004 when I started Mandiant was let's respond to every breach that matters. The reason we were successful is nobody believed in the premise: cyber security breaches are inevitable. Everybody believed that, hey, you're wrong, we're going to stop this stuff, it's not going to happen.

Yeah, we'd answer two questions: what happened and what to do about it. And that's important, meaning we'd have to remediate it as well. We couldn't just say, hey, Joe, you got 10 darts sticking in your hack, and you know, we got to kind of pull them out and help you out.

You got it. Absolutely. And retest networks and make sure it doesn't happen again. The unfortunate reality in the cyber domain for a lot of companies, it's hard to know or appreciate the threat till something bad happens and then you go, okay, now I get it. And a lot of companies accidentally underestimate the threat. I mean, I lived through a breach in 2020, Joe, and I'll never forget one of the startling moments of my career when I was CEO of FireEye. We were compromised by the SVR. There was a backdoor put in SolarWinds software. Over 18,000 companies downloaded the Trojan version of SolarWinds and we were one of them. And when we detected that, I'll never forget calling customers and telling them, 'Hey, listen. We've had an intrusion, you know, and here's what we're doing about it.' And I remember one of our customers in the financial services literally said, 'How did you let this happen?' And I almost lost it. I said, 'Let this happen? We didn't let this happen? Where have you been for 20 years?' When a nation state targets a company, guess who wins? The nation does, not the company. Where have you been? And this is a security professional. Here's the reality in cyber right now. You cannot expect great blue chip companies to constantly every day pitch a perfect game on defense against nations that are targeting them. It's just an unfair fight. So I've lived through that. But, you know, going back to Mandiant, we own the front lines of incident response. It's called what happened and what to do about it. And that became a valuable thing to kind of own. We became the seal of approval. If you've been hacked and you know it, you hire Mandiant to come in to figure out what happened. And when you go public and tell your shareholders and tell the world, here's what happened and here's how it won't happen to you if you do the following. You know, we really kind of furthered that discipline along.

Well, you know, I've had a lot of interesting days. Here's the good news. Being a public company CEO has its downsides. You know, you do your quarterly reporting, you talk to a bunch of shareholders, and I've always likened that moment to, you know, if the Miami Dolphins lost, I never got to call Dan Marino and yell about it, right? But you do get to call the CEOs and yell at them. And let's just say I didn't, you know, always have great quarters. Did our best though, believe it or not. But I can tell you what was the best thing about my job is that anytime, Joe, I can get involved in any case. My phone would ring and I'd get things like, 'We think North Korea did this intrusion.' And I'd be talking to my guys going, 'You've got to be kidding me. There's no way they did it.' 'No, I think they did. You got to come see this.' It's like Sherlock Holmes. I can tell you one where a government agency, I hadn't seen the SVR on a network in years. They were so good. The rules of engagement were if we showed up to investigate the SVR, it's like they knew we were there and they never let us observe their tradecraft. They just didn't do it. In August of 2015, one of my teams calls up and they had always heard me say, 'I've tapped the SVR a bunch of times and they just evaporate. They're ghosts.' And they're like, 'They're not ghosts on this one.' And their whole doctrine changed. I remember I literally flew in. I was like, 'I don't know what's on my calendar today, but I'm getting the hell out of here. I'm flying to DC. I'm going to show up. I'm going to see what my team's doing.' We saw it was no doubt in my mind. I was looking, that's the SVR operating. They know we're seeing what they're doing. And they didn't care. Those moments to me, the rules of baseball changed. You know, I had 20 years of responding to the SVR. They never hacked and then released data. They suddenly did that in August 2015. They always hacked for security reasons and all of a sudden we're responding to them hacking universities. I'm like, 'Oh, they increased scope.' And then they always did, in my opinion, admirable counter forensics. You're like, 'Where are they? They're gone.' They would always go away. It was almost like a gentleman's agreement. You caught us. We're out for a month. We'll be back in a month. But then they came relentlessly every day. Those sort of things have happened. And I'll leave you with this. I've had CEOs call, some of the best calls I've ever had. I don't even know how they get my number. I'll answer my phone. I'll be driving on the highway or walking my dog. Both of those have happened where like a Fortune 100 CEO goes, 'We're getting ransomed.' They don't even say their name. They're like, 'We hear you're the guy to call. We're getting ransomed and a couple exploits. We're not paying.' You know what I mean? And you just go, 'I get it.' And by the way, that's important to know. You just go, 'Okay, they're not going to pay. That's where they're at. They're aggressively taking a stance.' But that derails your whole day because then they go, 'Can you get people here?' And you're like, 'Oh, yeah, I think.' And you usually have to rob Peter to pay Paul in those instances. But I've had many days where you get a call and the problem being presented to you becomes your 100% problem. I personalize it. So when I get a call from a CEO, 'I'm being ransomed and damn it, I'm not paying,' all of a sudden my internal dialogue is like, 'Damn it, we're not paying.' You know what I mean? So it's a fun job in that.

You got somebody's got to show up and help these people. You know what I mean? Nobody deserves to be hacked. Nobody deserves to be shut down. Nobody deserves to have their email posted online and read by the press. I mean, it's ridiculous. We've got thousands of cyber security professionals that have answered the call. And that's the good thing.

So one of the things that I've always had is the, I don't know if it's empathy, sympathy, or all of it. I feel the same violation a victim does literally when they get breached. Nobody deserves it. I don't care. It's kind of like you don't deserve to be robbed because you had a few drinks at a bar and you walked out and you're a little bit susceptible to it. I've not responded to breaches where people were negligent. You know, some of the biggest breaches where you have someone beaten up. How could they let this happen? Like the story I just told you, almost every CEO I've met and every CISO I've met is trying to prevent the inevitable breach. They're hiring good people. They're buying technology. We're getting better at it. And you know, so every time I get a call, it's kind of like it's good versus bad. I mean, it's good versus evil. It's like there are people with no risk of repercussions. During our podcast, probably over a thousand Americans are going to get duped, scammed, and lose money in the cyber domain from folks that are untouchable to our law enforcement.

They're in Russia. You know, they're in other nations where they have a safe harbor. You know, North Koreans are hacking for profit. Literally, government agents in North Korea in uniform are hacking to steal Bitcoin. You've got, and we are the tackling dummy in cyberspace, you know, our consumers and our folks and our organizations. And it's frustrating. People take advantage of the immunity, the fact that they can be 10,000 miles away, have scripts running and make money off of it. So there are whole, probably thousands of people that make their living off cyber crime.