Our next panel, Access, Actions, and Influence: Cyber Operations in the Age of Asymmetry, is a conversation focused on how cyber operations have become one of the most consequential tools in modern conflict. This is an area where the summit's theme of asymmetry is both highly technical and deeply operational. Cyber is the domain where the distinction between peace and war may be the most consistently blurred, and where adversaries operate below the threshold of armed conflict as a matter of strategy, but which has the capacity to enact tangible material harm. In this broader context, cyber capabilities allow state, sub-state, and non-state actors to compete with speed, scale, and plausible deniability, targeting critical infrastructure, financial systems, and information environments in ways that increasingly blur the line between competition and conflict. What makes this domain so challenging and so urgent is that it demands simultaneous fluency in technology, military operations, intelligence, and policy. That is precisely what this conversation is designed to explore. This panel brings together a truly comprehensive view of today's cyber battle space.
Leading this discussion is Nilou Mozayeni, distinguished visiting professor at Vanderbilt University. I want to pause and acknowledge her exceptional work yesterday as the moderator for day one of the summit. Her clarity in summarizing the complex issues was a sight to behold, and I think she represents the high level of talent that Vanderbilt has to support crucial endeavors within our university. If you could just help join me in applauding Nilou's amazing work yesterday.
I'm very proud to call her a faculty colleague at Vanderbilt University. In addition to being a Vanderbilt visiting professor, she is operating partner at Capital Meridian Partners. Nilou has been an investor, executive, and entrepreneur in the technology industry for the past 30 years, with a focus on cybersecurity for the last 20 years. Please join me in welcoming Nilou and our panelists.
I thought that music would go on for a little bit longer. It was very sort of profound. I am genuinely excited for this conversation. Joining me on stage are four of the most consequential thinkers and operators in cyberspace. We have Lieutenant General Lori Reynolds, Commander Marine Force Cyber, ran cyber information operations together at a moment when the Corps was ahead of the rest of the military.
Next to her we have Kevin Mandia. Kevin founded Mandiant, sold it to Google for billions, and is now building Armadan, an AI-native cybersecurity company, because he believes all cyber attacks will be AI-driven in the future. Next to Kevin is General Timothy Hawk, former director of the NSA and Cyber Command. And General Hawk has argued publicly that the next phase of this fight cannot be won by the government alone. And finally, Nick Adams, Deputy CISO and head of fusion and security operations at State Street, one of the most systemically important financial institutions. Previously ran cybersecurity at JP Morgan Chase, also an important financial institution.
So, I want to start with three provocations. The private sector is the battlefield. The norms that once protected it are eroding, perhaps gone. And AI just handed a structural advantage to offense. Everything we discuss today will flow from those three provocations. General Hawk, let me start with you. You helped build the doctrine. You have seen the classified picture that most people in this room have not seen. Are we winning or losing this contest right now?
Well, Nilou, thanks. As the optimist on the panel, you gave me the most dire, pessimistic view. I think our nation has incredible advantages. I think we have structurally the inventors of the internet. We have global providers that have a site picture of what the activity is going on globally, and we have incredible capability in our intelligence community and within the department. How we're using those are areas I think we could talk about. Like, what are the things that we could do to use our strengths to even greater outcomes? Because we certainly have ceded a lot of ground to the PRC in terms of enabling their ability to scale, the approach they've taken, intellectual property theft. We've used many tools within government, but we have not necessarily maintained a clear demarcation line of what we will accept and what we won't accept. And for me, that line should be clearly drawn around our critical infrastructure. And I think there are opportunities for us to be able to think about what this looks like going forward where we use our advantages and make them even greater strengths.
Kevin, Anthropic recently released Methus. Um, it's a model... Well, actually, they didn't release it. They talk about the model Methus that's so dangerous that they actually aren't going to release it.
Can you help us, the audience, understand why people are saying this is a watershed moment for the cybersecurity industry?
Well, I have 47 minutes, so this is a perfect question for that. One, to thank everybody here for your interest in national security and the fact that Mythos is out should not surprise anybody. The fact that they're calling it a watershed moment, I think it's more just an incremental step in a direction everybody that's in the industry of using AI to learn, think, have total recall, and conduct offensive operations, there's no surprise to it. It's just another step up and to the right for what compute can do, how it can think, learn, and instantiate and lead attacks. But what it signals is, well, first, this dialogue we had to have happen. Whether Anthropic did the right or wrong thing is, to me, it's just dialogue that has to happen as we prepare. But I felt, and I might be wrong, the inference that I felt is if you're doing limited releases of models because they're too dangerous, well, that means you can't put what I call the ankle fence in place to keep it from doing things that are unintentional. When you have a very general model, a very horizontal model, and you know it's there to support all disciplines, all industry, and do a lot of different things, I think it's probably very, very complicated to put controls in place to keep it from doing things that, you know, good guys need to do to do the right thing, and at the same timeframe bad actors can take advantage of those things. So, that just means that these models over time, there probably won't be safeguards for, and that you have to build your own safeguards to use them. That was the signal that I read. But the dialogue, everything about Mythos is no different than we've got, you know, Opus 4.6 finding vulnerabilities that people haven't found before, and finding the same ones that Mythos has reportedly found. So, right time for the dialogue. Mythos itself is just not really a surprise. Will computers be better on offense over time than humans? Probably.
So, let's... Nick, you've been playing with the frontier models. There are some capabilities that we're seeing that are a little bit different. There's no question that AI's been finding vulnerabilities. What we're seeing now is that AI is finding vulnerabilities at scale. The ability to exploit every browser, every operating system. To find the vulnerabilities, build the exploits, chain them together to go after a system. As you've played with some of these frontier models, what are you seeing?
Yeah. So, first, it's really good to be here. I'm sorry for everyone who is expecting to see Pato Pat. I worked for him for a number of years. So, and I'm also an 18-year Marine reservist still with the Fort and have worked for several people on this panel as a junior officer. And now I'm sitting at a large financial. So, it's great to be here. So, it's interesting because Kevin hit on some things around the harness, right? How you train and kind of the bounds around the models. We're finding that more and more it's becoming difficult to control that, right? And so, on one hand, it's doing things that are unintended and we can kind of see that as we play and tinker. You pointed at a target to go assess and it's actually enumerating the host it's running on, right? Things like that. And so, you have kind of unintended consequences just based on the sheer compute and knowledge that the model's trained off of or what it's capable of. They're also kind of each different or each good at different things. A lot of it comes down to how you train them. But you know, some vendor models are good at network defense, others are good at finding exploitation paths. Some are really good at threat modeling. And so, I think the challenge as defenders is, you know, given that that is probably the reality we're about to start operating in, or in a lot of ways, to Kevin's point, shouldn't be surprised. It makes us think about what we can control and how we think about defense and things like mean time to detect and contain at scale and at pace because there's going to be things that happen in the frontier model space and it's only going to get worse that I think we just have to figure out how we compensate for, right? And also figure out how we harness those capabilities to play better defense. But a lot of it is... it's been an interesting past few weeks. I'll just say it that way.
Right. Well, I think if you're sitting in the crowd, then the takeaway from Mythos or any of the models coming out, because they're all coming, is we're going to have a near-term window where offense is uniquely advantaged, period. And we're aiming towards something that doesn't exist today, but will be forced to create it in the private sector and in the public sector, which is the means to have autonomous defense without human in the loop. If the attacks are coming at the speed of compute, you have to have an autonomous defense for it. And that's okay. That means that there's going to be the invention of AI on offense by the good people to train the AI on defense by the good people, and you've got to hope that the offensive robots are so good and so powerful that they're days ahead of whoever's trying to use the models for nefarious deeds or who our adversaries are. So, that model's going to happen, but if you're sitting out there and you're a CISO, you're thinking, 'So, what do I do over the next year?' It's going to be complicated and you're going to have to throw humans in the mix because AI's going to find all the problems faster than humans, but it's not in a state to fix them all that much faster today. And that's where there's got to be rapid innovation. So, the long pole in the tent is, 'So, what do we do about all the offenses coming?' And in a positive, in my opinion, we have yet to see any modern nation unleash the beast out of the cage just yet. In other words, at my company, what I've seen us build in 7 months is an AI capability of offense we have not seen in the wild. So, people are holding in check, at least the nations are holding in check, just, 'Hey, let's unload and get AI on offense doing stuff.' That may have changed during these last 3 minutes of the conversation, but it's coming regardless because the free models, Mythos today, 3 months from now, there'll be a leapfrog in either Gemini or even one of the open models.
Yeah, so there's a window, as you said, where offense may have a structural advantage. The highest-end capabilities may be limited to a few models today, but they're going to get commoditized. General Reynolds, in that world, our doctrine is persistent engagement and is predicated on the idea that there are very few actors who have access to sophisticated, exquisite offensive capabilities. In a world where those capabilities get commoditized, is persistent engagement even the right doctrine? How do we organize to defend ourselves?
So, I think persistent engagement is still a doctrine that we should be... I think it still works, but it's insufficient by itself, right? So, for persistent engagement, which for those of you who may not be familiar with that, that is basically defending forward, nation-state versus nation-state, if you will, trying to disrupt whatever it is that the adversary is trying to do before it gets to us, right? So, we're constantly playing, you know, chess with the adversary. I do think around our critical infrastructure, around those networks that we are absolutely going to defend at all costs, our military networks and some of those other, persistent engagement is something that will impose cost on the adversary. It will slow them down. It will provide friction in their environment. They're campaigning against us, and so this is the long game playing out. And so, yes, I do think persistent engagement is still a strategy. I think it has to be partnered with increased resilience across all of our networks, across certainly our critical infrastructure. Resilience wins the day. We have to learn to fight hurt. We have to learn to trust our data, but we should be doing everything we can to kind of constantly, you know, be sparring as far away from our territory as we can.
I just want to remind the audience that we are taking questions, and they are coming through, so I will definitely get to them. But I want to push on this question of persistent engagement for a second. It's one thing when we are persistently engaging five adversaries. It's another thing when we have to now persistently engage 50,000 adversaries because they've all gained access to the most sophisticated tools. So, in that world, what does persistent engagement look like, and who is doing it? What's the role of the US government? What's the role of the private sector?
I can defer to the general, but I would offer that we're all involved in that. I think in the future, it is all about the partnerships. It is all about, you know, the Shields Up campaign that, you know, even when General Alexander was in command, General Hawk, partnerships matter. And I think, you know, there's three tiers that we're looking at. We're looking at just active defense at the tier one layer. We're looking at kind of a public-private partnership where, with the authority of the US government retained at the right level, we can empower partners to actively engage and defend. And then the third one is just everybody else just defend, defend, defend. So, that's a model that I think we need to be considering and we need to give the talent in our private institutions, we need to give them some authorities to help us.
And I think building on what we should expect from industry, this is where we have advantages that as a nation we're not fully leveraging. When we think about the scope and scale of the service providers in the United States, what they can see and what they observe, we know in our partnership between government and industry, we can do mass takedowns of many of these campaigns. I think the question is, how do we enable industry to do those takedowns routinely? Do what Google has now done to stand up a disruption unit that is about tearing down what they see on their network to make sure that their network is not a host for malicious activity that would target American industry, that would target the government. How do we enable that? And I think that's an area that we should spend some time because there's clearly a role for government. And that as US Cyber Command, one of the missions is to counter the adversary hackers and we should be doing that at scale. And Cyber Command should be resourced to do that. But leveraging industry in a way that's more aggressive, I think there are opportunities for us to build off models we already have. Our Congress built a foreign intelligence surveillance court to be able to give authorities to do sensitive and unique things underneath court auspices to collect intelligence. What would it look like if we had a court that was authorizing civil takedowns? To be able to give cover for industry to be able to do that because right now they can do it and normally their limitation is in-house counsel. How do we take that barrier away? And then what's government's role? Should it be government that's doing attribution of those campaigns? Government should be potentially personalizing this to the sponsor of the activity beyond the individual company? Is there a member of the Communist Party at the Politburo level or the Central Committee level that's the sponsor? Those are the people that have to be affected to actually change behavior. I think there's opportunity for us to use these strengths differently and build off persistent engagement from being a thing that was only done by one organization and thinking about it much more as a national effort, particularly in an environment that offense has advantage.
So, Nick, I want to get your reaction to this idea. As General Hawk said, Google this year did a takedown of one of the most persistent operations in history, 10 years. And they, you know, government had put out advisories and Google finally had enough and just did the takedown of the PRC campaign. Microsoft, of course, has been doing takedowns for a long time. They have their crimes unit. Google set up the threat disruption unit. As you hear this concept, and the national cyber strategy talks about how the private sector now needs to start shaping adversary behavior. Sitting in your seat as a CISO, how does that feel? The ask that the private sector now needs to lean forward. We can call it active defense. We can call it offense. But now it's on the private sector to lean in and start doing what the government used to do.
Yeah, look, I think there's definitely a role for, I think, the government to play in information sharing. I think you get into the space where, like, do we have a capability to do some of these things? Sure, right? We have distributed network, hundreds of data centers. We operate all over the world. So, we have visibility, right? That we could contribute and that we use to kind of inform our own defense posture. Could that be leveraged? Could we share data if there's channels to be able to do that? I think there's opportunity there. I'm in general not a proponent of, like, for a lot of reasons attribution is hard, geopolitical tensions when you operate a big global company can become challenging, of, you know, private companies maybe in certain sectors actually going on offense. I think that's something that's worthy of discussion but a challenging situation. But like, I have a large supplier threat intelligence team. We monitor our own suppliers. We monitor clients, right? We've kind of taken on a role that like the intelligence community does in a lot of ways, you know, focused on kind of key adversaries. And so we do a lot of that. We've all replicated more or less some of that capability and capacity and I do think there's opportunities to leverage that more broadly than we do now. My general observation is that we've always struggled with, you know, detailed collaboration or just the ability to flow information between organizations for a lot of reasons. Some of it's internal counsel and there's definitely those constraints. But I do think that what we've seen in the past few weeks has brought some of that into focus. How do you collaborate on, you know, vulnerability discovery in a way that achieves pace and scale without giving the adversary the advantage? Like, there's, I think, a lot of discussions to be had more in earnest. And it's a good conversation to have, but in general, kind of going back to your key question, I think, you know, deputizing private industry at least in certain critical infrastructure sectors to go after and perform offense is a challenging space that I think at the moment I'm not supportive of, right? At least not for my institution, not for the financial organizations.
So I'm going to turn to a question we got from the audience. On the threats from Methos and GPT-5, what kind of infrastructure is needed for threat actors to abuse these new powerful LLMs? Are they constrained by lack of compute, money, etc., or is the bar low enough for widespread abuse? Who wants to take that on?
So, I have a view. Happy to offer a view. From what we've, you know, learned in discussions with vendors and in, you know, folks kind of that have interacted with the model, I don't think the architecture's optimized. I think there it's compute intensive, and so I do think there's a barrier to entry there that I do think will be solved pretty quickly, if I'm 100% honest. And so I don't know how much of an advantage that gives us, but things like Opus are more performant right now and find a lot of the same things than maybe a Mythos, you know, but again, like that barrier, I think will close quickly, right? Just observations from the past few weeks.
Well, like going back to that too, I think that the strategy you'll see the criminal element use, because I think most modern nations are going to have, whether we know it or not, they'll have unpublished rules of engagement on how they use AI on offense, and we'll figure it out and infer it based on what activities they do unleash. The criminal element will probably use open models, open ways, but they'll train it with the general models, and they'll get that vertical model over time. It's already being built. If you're making billions of dollars extorting the United States, I think you have enough to invest to create your own vertical model. That's going to be as good or even better, and then it'll be cost-effective, and that's what you have to worry about. And I would expect, and maybe even be let down if Russian organized crime doesn't figure this one out. You know what I mean? Because they've always been adopters of the newest technologies to go on offense and monetize them, and let's see what they come up with, or are they too distracted making money the old-fashioned way still? I think that's our worry, and that, in my opinion, is probably inevitable. So, you'll have a slim language model crafted, shaped, and built probably by stolen creds in the general models and trained actively by criminals to carry on the acts that they are already carrying on.
So, I want to put a question, an open question, to the whole panel. What are one or two things that security leaders can do to close the gap that Kevin identified? And what are one or two things that the government needs to do to close the gap for the private sector?
I'll give the government my view. I think this is an opportunity for leadership. That the idea that at this point that Anthropic has created Glass Wing is a noble initiative, but this is an opportunity for government leadership. Regardless of where the model is, we know this threat is present, and we know that there's going to be advantage to offense. From a national perspective, this is where you would expect government to step up and to lead and bring this together in a way that starts to buy down risk in particular areas. Because we know they're going to be large, well-run companies that are going to invest a lot of resource into this, but our critical infrastructure doesn't normally fall into that bin. That's the group that is going to require leadership. It's going to require leadership at the federal level. It'll require leadership at the state level. And how that work gets done, I think, is probably some of the most critical that are going to get exposed as vulnerabilities, and how do we close that gap?
With the critical infrastructure, I mean, some of them are large companies, but you're talking about like, you know, small utility in Massachusetts, right, that gets targeted. You're talking about water in municipalities. How do you get all of the long tail of critical infrastructure?
I think it's where you need sector leadership. And some of that will come from the larger companies as a part of bringing together a sector, and other is going to have to come from elements within government. There are not many water providers that have built cybersecurity into their approach, but they are a target. So, that is going to require leadership, and I know this is something Congress is interested in. What they haven't been able to find is the vehicle to fund. Because it's so diffuse. And so that's where I think ultimately the execution arm is going to be local for a lot of that, and that's where I think states are going to have to step up in leadership.
And Nilou, I think going back to Kimberly's comment yesterday about the paradigm shift, I think in this space, if we're not on a wartime footing, we're wrong. Right? And we've just kind of been complacent in some of these areas where I think we can no longer be complacent. You know, I also believe that, and the AI experts on the panel with me might disagree, but I do think that over time, when we are building better software using AI, we are kind of closing the gap. Right? We've got decades of just bad software out there that, you know, over time, maybe we can close that gap, but I think the other thing that needs to be discussed here is, you know, this whole token management around AI, it's going to get expensive. And smaller companies, other municipal are going to need help, and so that's got to be a congressional initiative to kind of fund this.
Yeah, quick comment on that. There's no doubt we're going to have better code. I mean, everybody knows that and the models come. That's the thing Methuselah's best at and every model's best at. Source code review, finding vulnerabilities, way better than humans already. So, secure static analysis of code's going to be done. And I do think it's just there's near-term pain because it's just the asymmetry of one person on offense can create work for millions on defense and unfortunately it goes to cost way cheaper to do offense in cyber than defense. You run a couple million tokens to go offense and find a vulnerability discovery or to leverage dark web credentials and create an agent that goes and logs in at human speed to open APIs. You can do that far cheaper than collecting all this aggregative information on defense and try to find the needle in the haystack. But I do think we're in... So like what do we do now? What's the five-step process? We know it's coming instead of admiring the problem. It's first get in the ring, recognize the AI threats looming. It's inevitable. It really is. It's going to happen. Too many people make too much money. Wherever warfighter goes, you're going to see the cyber domain follow with offense. Wherever espionage goes, you're going to see the cyber domain follow with offense. Wherever money goes, crime follows. That's been proven time and time again. So what do you do? Get buy-in right away from executive staff that we've got to do something different right now. There is no way to make the near term pretty. So what do you have to do? All students that are doing security or doing IT have to shift right to we're going to start patching and fixing and you run as fast as you can a bunch of web app testing against every damn thing you got externally. You start external and work your way inward. If you have apps that you think you can secure, you pull them in and put compensating controls in front of them and have the smallest internet presence. You know, you got to just do external, beat up your network. You may not be able to patch everything. But I would be if I was a CISO, I'm briefing upwards, hey, I don't have a way to make this pretty. I may need additional bodies. I may need real IT operators at my beck and call to create change and then you start executing against your external face with AI-enabled offense against your critical applications and you re-architect. You start pulling things in smaller...
footprint and keep working inward. There's blogs on this. The Cloud Security Initiative wrote a like a 15-page paper on what to do now. But there's not a CEO out there that needs to be briefed on the threat. They already get it. And so you really can get executive buy-in at virtually every single company. Oh, yeah, I'm worried. What do I do about it? And I don't think we need to come up with clever ways. What's the cost savings if you patch a vuln? Good luck figuring that one out. They're all bad. You know, you don't want to have any.
Oh, I left one thing out. Step five. All CISOs should be building towards an autonomous defense in the future, period. Be thinking every single investment I make now, how does that create velocity and autonomy for defending my organization, its data, its customers?
There's like six points I want to pull on here and I'm trying to figure out the order of doing this.
Well, so just general hygiene.
Yeah, I just wanted to add there because I think the other is like for small companies and for small critical infrastructure providers, there are some things today that they could be thinking about. One, shrinking the external presence and visibility is number one. But there are things these models will also help you do even if you don't have the resources to do your code base and all those other things. And that is start to get visibility on what you have, increase visibility. And then the other component is around the idea of understand your dependencies. Because the vulnerabilities are going to come at you from all sides. Having that visibility, the models are very good at that. They're very good at identifying the supply chain dependencies. And the more they shrink their external facing, it does at least buy down some risk while all those other steps you try to resource and put in place.
Yeah, there's no doubt the small municipalities. Like we go right to the most complex thing to secure, small companies, small municipalities. That's the long pole in the tent. Honestly, it's hard to figure that one out. They don't even have anyone you can call that have the cybersecurity awareness to figure it out. We got to get the 1A enterprises secure first. That's the reality and we got to drill down and then ultimately I do believe we have to have a model in the nation where the bigs are doing the best they can to take care of their supply chain and the smalls because I don't know a way to make it pretty for Aliquippa, Pennsylvania and their water utility.
But here's the question. So we have this sort of legacy architecture that's in place and it is now in the age of AI completely vulnerable. You've just described a seven-step process.
There's five steps. It's satellite steps.
I thought you kept going, but okay.
There's sub steps to the five steps.
There's five, C, D, and F. But is this going to become a world of the haves and have-nots? The folks, the companies, the organizations that can actually do this and the organizations that can't do this and then...
I mean how do we thrive in that world of the haves and...
You have to have the haves do it first and foremost, period. You can't forget that.
the vulnerability to the haves from the have-nots?
The have-nots require more government help. I actually do believe that. And the have-nots you approach it the exact way I'm hearing the government talk about it, which is secure critical infrastructure first. Everybody wants water. Everybody wants electricity. Actually I don't worry about electricity. They are the haves, quite frankly. I think there's probably some, you know, I could the small to medium utilities in the Midwest that may need help, but the large cities are pretty covered. That's where we have to think out where can the government assist. I do believe 1A enterprises for the most part are going to find their way through this.
How does the government help the long tail?
I think it starts with leadership. Like this has to be something that we make a priority and this is the moment to do it, right? It is the point where the models are maturing to a point where we know offense has an advantage and it's going to have to take stepping in and being able to say, here's where we're going and it needs somebody to be able to take that podium and then there're going to have to be resources that flow behind it. And that is going to have to come like we obviously have organizations that are built to do this. Are they going to be able to seize the moment in the National Cyber Director's office, what is left at CISA and being able to at least articulate a framework that Congress would be willing to fund? So that's where I think the opportunity lies right now is Congress would be willing to do it, but there's going to have to be somebody that says follow me.
You have publicly spoken about how we have diminishing capacity in the US federal government, diminishing capacity at CISA, at FBI, at NSA. In the world where the federal government has diminishing capacity, how does it stand up to this challenge?
I think this is where you see states starting to fill some of this gap. The idea that Texas has created a cyber command is this exact reason. Organizing state resources to think about how you bring together defense within critical things for the state that can extend and do low cost cyber security providing to others within the state. There are models that we could begin to think about like that what that would look like, but it's going to take a government leader at some echelon to do that. And it will be disparate, it will be some will be able to do it effectively and some won't, but we have to start now.
Nick, I want to ask you to respond to something Kevin said. You are working in a highly regulated industry. You have regulators and overseers who have demands on how you actually carry out the cyber security function. Is there a world in which you can fully automate cyber defense?
I think there has to be. The challenge becomes the pace at which the regulation comes along and the regulators I don't think are quite where we are with regards to just understanding some of this. I would say like as a general comment, the way we've messaged a lot of this to them the past few weeks is like defense doesn't change per se, like the things you do. What changes is pace, right, and scale and just general kind of speed at which you execute. And so the things that have always been important are important, right? Reduce attack surface, harden the perimeter, you know, identity becomes a critical component. And most organizations are sitting on a pile of either software they're bleeding out, right, or hardware they're bleeding out, right, just legacy. They're running, you know, 10 different configurations of Windows Server, like there's just like horizontal and vertical sprawl that you want to address. And honestly, like what this has changed now for us is the pace at which we have to do that, and some of those become now be like business imperatives. Processes that we've generally like in security operations, right, regulators are generally have been resistant to us leveraging AI tools without a human in the loop. Right, that fundamentally has to change. It has to be human supervision, like we have to chart a course of not, you know, ingest an alert, triage it, you know, send it to defender to take an action. Like that process takes hours and days. It needs to be constrained to seconds and minutes, right, at a minimum, because that ends up being your exposure point. The only way you get there is if you fully autonomize a lot of your defensive work. And get to a place where you can have machine make a decision and then figure out, you know, where the role is that the human plays. But I could see a world where, you know, automated defense and then automated supervision of agent decisions, where the point is where does the human engage? And then we have to take all the regulatory bodies on that journey because that to me is like it's going to be the biggest challenge is they want to understand how are you comfortable, how did you make this decision, was it an informed business risk decision? And we're frankly solving right now how we have the discussion, right? In a world where we operate with 200 plus regulators across finance, privacy, etc.
I think it'll be critical to recognize when you have AI on offense training AI on defense, the paradigm, at least my favorite word besides epiphany, the paradigm's going to shift and what you're going to see is what I call tourniqueting of networks. You're going to see rapid segmentation done by AI, very tactical compensating controls rather than patches based on bespoke code. Then you'll have a human behind it so it's not like you're going to do permanent changes to your operations autonomously, you're going to do rapid stop bleeding just in case there's something wrong and that'll happen at speed. I hope we don't get bogged down in is it okay to use AI to defend because if we spend too much time we'll just continue to lose. You have no choice.
