Dan Card has spent more than 26 years in cybersecurity as a penetration tester, defender and architect. He helped organizations respond to some of the biggest incidents of the last two decades, from MS Blaster to WannaCry and Log4j. In this episode we ask him what has actually changed now that attackers and defenders both have strong AI models.
Dan runs a lab where Claude attacks and ChatGPT defends, and he explains why a swarm of ten thousand agents hitting a defended server mostly gets you blocked faster. AI does help attackers with reconnaissance and research, and it helps defenders work through hundreds of alerts a day. Still, most breaches come from bad passwords and misconfigurations, not from exotic zero days.
We also talk about air gaps versus sandboxes, why finding more vulnerabilities doesn’t always mean more risk, prompt injection, robots and autonomous weapons, and the story of how Dan tracked down someone who attacked his website. His main message is that security in the real world should be boring, like a good flight.
Topics
Social engineering, fake job candidates and mail bombing attacks
Who the attackers really are, from teenagers to nation states
Whether an AI could escape and spread across the internet
Air gaps, sandboxes and the Stuxnet story
How AI attackers compare to human ones
Why agent swarms are easy to block
Vulnerabilities that exist versus vulnerabilities that can be exploited
Using LLMs to triage security alerts
Prompt injection and how much we can trust models
Robots, drones and physical risk
Why you defend against the brick before the aliens
Chapters
00:00 Intro and Dan’s background
01:13 What cybersecurity is and who the attackers are
09:36 Can an AI escape and spread?
19:31 Air gaps, sandboxes and Stuxnet
25:04 How AI is changing attack and defense
34:04 Why agent swarms don’t scare defenders
42:05 AI for security alerts and trusting models
54:57 Crime, deterrence and spending on security
1:02:38 When someone attacked Dan’s website
1:07:29 Robots and physical risk
1:16:28 Start with the brick, not the aliens
1:20:08 Wrap up
Music: "Kid Kodi" by Blue Dot Sessions (CC BY-NC 4.0)
