Department of Know: Azure security pitfalls, retailer cyberattack profits, Aardvark eats bugs

Summary

Episode Overview

Podcast: Cyber Security Headlines – Department of Know
Host: Rich Stroffolino
Guests: Davi Ottenheimer (VP of Digital Trust & Ethics, Inrupt), Rob Thiel Field (CTO, Gigaom)
Date: November 3, 2025
Main Theme:
A rapid-fire, expert panel discussion of high-impact cybersecurity news from the past week, with a focus on trends, critical vulnerabilities, regulatory drama, automation in defense, and the practical impact of breaches and AI on both organizations and competitors. Special attention is given to Azure network security changes, the reputational and financial fallout of major cyberattacks, and new AI tools in security operations.
Tone: Wry, skeptical, practical, and energetic, with a blend of humor and candid insight.

---

Quickfire Headlines ("Know or No-Thanks" Segment)

1. OpenAI Atlas Browser Hijacked ([01:12])

• Issue: Researchers found a major vulnerability in OpenAI’s Atlas web browser, allowing malicious prompts via URLs to execute code, redirect users, and even delete files.
• Davi Ottenheimer (02:50):
  • “This is such an old problem... it goes back to the 1800s even. I think it's fundamentally the same class of vulnerability that plagued the early browsers.”
  • Deems it “nothing to see here” because the vulnerability is so basic and long-standing; criticizes forgetting old lessons about trust separation.
• Rob Thiel Field (03:21):
  • Agrees on the “old news” angle but cautions that vigilance is wise even for "shiny new" tech: “It's really good to have some due diligence on even the latest and shiny new things.”

2. Windows 11 BSOD Proactive Memory Scan ([04:19])

• Rob: “No thanks.” Just a patch; not newsworthy.
• Davi: Criticizes as a reactive, not preventative, measure: “They're admitting they have a problem in memory, but they're not actually fixing it.”

3. F5 Nation-State Breach – “Limited Impact” ([05:46])

• Finding: Attackers accessed source code, configuration data, and 44 undisclosed vulnerabilities; F5 claims the stolen data is “not sensitive.”
• Davi (05:46):
  • “I would love to know more... the attackers know more than F5 probably knows about their own code base.”
  • Skeptical of “limited impact” claims—impact is relative.
• Rob (06:14): Red flags everywhere when a vendor downplays the exposure of important data.

4. Palo Alto Networks Cortex Agentix—AI Agents for Threat Response ([07:32])

• Rob: Worth monitoring; predicts future roles will involve orchestrating many agents, shifting org structures: “Someone, a human, actually running dozens, 50, maybe 100 agents.”
• Davi: Dismisses it due to experience with AI noise and lack of maturity: “It's like adding a toddler to your SOAR strategy ... sometimes you want complexity and chaos, but high-integrity AI is the last thing I’d add.” ([08:33])

5. Microsoft/LinkedIn Using Public User Data to Train AI ([10:16])

• From November 3rd, user data from LinkedIn (in multiple countries) will train Microsoft AI and fuel personalized ads—private messages excluded.
• Davi (10:16): Outraged: “Disgusting that they would even make this argument that this is a line that they can keep. ... It's just totally disingenuous. I think LinkedIn is in the doghouse.”
• Rob (10:55): Agrees; privacy violations happen without real consent: “This is going to be what the future is about, is what consent looks like for business enterprises and individual users, because it's happening without us even knowing about it.”
• Davi (11:56): “You absolutely should opt out. There's no reason to opt in ... until they give you a valid reason to opt in.”

6. FCC Dropping Cyber Regs After Chinese Telecom Hack ([12:12])

• U.S. FCC removing recently installed cybersecurity rules, citing voluntary industry improvement.
• Rob (12:39): Wants details on how the breach happened.
• Davi (12:52):
  • “Absolutely no more. I mean, this is the foxes saying, watch us in the henhouse. ... Voluntary is the way things are going forward. And we know from the past voluntary never worked.”
  • Calls the “legally erroneous” justification “mind-boggling,” likening it to regulatory capture.

---

Deep Dive Discussions & Insights

Azure Network Security Delayed Default Change ([15:40])

• Context: Microsoft delays making private subnets the default in Azure virtual networks till March 2026; move aims to align with Zero Trust but risks breaking existing workloads.
• Rob (16:05):
  • Supports the ultimate goal; delay is a business compromise: “It needs to be done. It's difficult from a security perspective. They shouldn't delay, but it should be immediate. ... If they're smart, they would incentivize people.”
• Davi (17:21):
  • Praises behavioral nudges and transparency but points to Azure’s complexity: “I've been deep in the weeds of Cloud forever. And I mean, front door is a nightmare. It's spaghetti. ... They have all kinds of breaking production workloads.”
  • Urges customers to really know their exposure—broken workloads reveal hidden dependencies.

Competitive Impact of Retail Cyberattacks ([19:14])

• Story: After hacking of Marks & Spencer, competitors with robust online presence (e.g., Next, Zara, H&M) saw sales increase; bricks-and-mortar rivals did not.
• Davi (20:35):
  • Raises ethical alarms: “... If you could incentivize your own team to go and hack your competitor to get double benefits, they go down and your sales go up. This is going to be hard. It's an ethical discussion and it's terrible to see this.”
  • Wants baseline, cross-industry security; warns against race-to-the-bottom and perverse incentives.
• Rob (21:33):
  • Observes new board-level discussion: “Now you can show, hey, look at how much this is costing our competition. And it's a discussion at the board level.”
  • Security spend often only justified by loss prevention (not revenue gain); now loss of competitive position quantifiable.
• Davi (22:56):
  • “In boom years, security spend goes down because upside is so good. ... This is a perversion of that: why spend any money on security if we're the last one standing?”
• Rich (23:26): Sums up: “I just need to be faster than the slowest person when the bear is chasing me ... cybersecurity nihilism.”

OpenAI Aardvark – GPT-5 for Code Security ([24:52])

• Function: Autonomous agent enters code pipeline to spot and fix flaws using LLM-driven reasoning.
• Rob (25:13):
  • Sees double-edged potential: “If it's all automated, then you're going to have the adversary doing the same thing. So it's like a giant tug of war.”
  • Ok when fixing human errors, but wary about opening new attack surfaces.
• Davi (26:10):
  • Cautions it’s marketing hype: “I'm not a fan of what OpenAI is doing right now. I feel like it's a rehash of what Palantir did where they created the terrorists and then billed you to find them.”
  • Doubts “sandbox” claims; calls it “glorified fuzzing” missing real-world attack paths.
• Rich (27:04):
  • Wonders if agents can accurately infer security objectives from passive design decisions—worries about compounding mistakes if assumptions are wrong.
• Davi (28:06):
  • Warns of AI poisoning risk; critical about blindly trusting future optimizations.

---

Memorable Moments & Quotes

• Davi Ottenheimer on recurrent browser vulnerabilities ([02:50]):
  “I guess they just forgot how the internet works.”
• On AI agents in SOC ([08:33]):
  “It's like adding a toddler to your SOAR strategy and then having to manage ... playbooks.”
• On Microsoft/LinkedIn data policies ([10:16]):
  “I think LinkedIn is in the doghouse.”
• On regulatory capture ([14:01]):
  “It's just disingenuous. It's regulatory capture. Basically. People don't want to do the hard work of cleaning up their environment. They say we'll do it voluntarily and then they don't do it.”
• On incentives vs. enforcement in Azure security changes ([16:05]):
  “If they're smart, they would incentivize people ... If you can move faster, then we're going to incentivize your licensing next year or something along these lines.”
• On the ethics of competitive advantage from breaches ([20:35]):
  “Failures are supposed to create reputational damage, not competitive advantages. So the market's not working if we have this race to the bottom.”

---

Guest Final Reflections ([29:05])

• Rob: Week’s news showed lots of basic human errors, not sophisticated hacks—facepalm moments. Expresses excitement for future advances in encryption.
• Davi: Intrigued by court rulings uncovering Tesla’s data manipulation and the security realities of “data centers on wheels”; recalls earlier predictions of dangerous algorithms.

---

Important Timestamps

• [01:12] OpenAI Atlas browser vulnerability
• [04:19] Windows 11 BSOD memory scan
• [05:46] F5 breach and “limited” impact
• [07:32] Palo Alto Cortex Agentix AI agents
• [10:16] LinkedIn/Microsoft user data for AI/ad tech
• [12:12] FCC rolling back post-China hack cyber regs
• [15:40] Azure network security: business vs. security timelines
• [19:14] Cyberattack business impacts in retail
• [24:52] OpenAI “Aardvark” GPT-5 code security agent
• [29:05] Final thoughts: facepalms, future trends, Tesla data

---

Key Takeaways

• Old vulnerabilities die hard—even new products like OpenAI Atlas are recycling ancient mistakes.
• Security progress is often stymied by business risk and complexity, leading to cycles of proposed improvement and delay (e.g., Microsoft Azure).
• Regulatory retreat (FCC example) is seen as a recipe for disaster; industry "voluntary" compliance is roundly criticized.
• Privacy boundaries are rapidly eroding, with major platforms using user data for AI without credible consent mechanisms.
• AI in cybersecurity is frequently overhyped; real value and trust haven't caught up with the marketing.
• Cyberattack fallout creates measurable business winners and losers, especially in easy-to-switch environments like retail.
• Panelists urge skepticism, industry cooperation, and demand for genuine innovation—backed by transparency and enforcement, not just hope or hype.

---

For full story links and daily security updates, visit cisoseries.com.

Transcript

[A]

From the CISO series, it's Cybersecurity headlines.

[B]

Welcome one and all to the department of Know youw Monday Cybersecurity Standup. I am of course, your host, Rich Strofalino, and this is where we kick off the week by looking at the stories, trends and issues that should be on your radars as a security professional. Just your radar. If you have multiple radars, maybe you are too confused. One radar as a security professional. Thanks to our sponsor for today, Threat Locker A Assume everything is a threat. They're helping make this show possible. Also helping make the show possible in a very physical and real sense are the people joining me, Davi Ottenheimer, the VP of Digital Trust and Ethics over at inrupt, and Rob Thiel Field, CTO at gigaom, both proud veterans of our Week in Review show. Davi, it's great to have you back. It's been about two years since the last time we were on here, so we will not repeat that in the future. We will keep it to a year and a half at minimum, something like that. So we love having our guests here. We're going to be having some fun time getting into some discussions and if you are watching on YouTube, make sure you're dropping in the chat. We want to hear your thoughts on these stories. When we start our no or no segment, you need to let us know. Do you want to know more? Is it a no? Thank you for you? Let us know your thoughts throughout the show. Even Kevin Farrell, you mowing the lawn? That's kind of my move. I love a good podcast or a good stream when I'm moving, when I'm mowing the lawn. So I hope remember you're going to be mulching when lawn pickup day is. Make sure you use the right bags. Don't get in trouble there. If you're listening to this as a podcast, remember you can join us live each and Every Monday at 4pm Eastern, whether you're doing yard work or not. Just go to the events [e-mail] and look for the Department of no. Or send us some email feedbacksoseries.com we would love to read one on the show. Before we get into any of the discussions here, just a reminder that all the opinions expressed on the show are those of our guests and and myself, not necessarily those of any of our employers. Let's get right into the news. We gotta start out with our favorite segment, a little something we like to call no or no no. All right, this is where we run through four to six stories from the past week, and I want a quick take. Is this something security professionals need to know about or is it more noise than signal? First up here, OpenAI Atlas browser hijacked. Researchers have discovered a new attack vector for OpenAI's Atlas web browser where it can be tricked into executing malicious prompts disguised as seemingly harmless URL' allowing attackers to redirect users, steal credentials, or even delete files from connected apps. The flaw stems from Atlas failing to strictly separate trusted user input from untrusted content. Whoopsie. A common weakness in these kinds of browsers. Davi, from you. Do you need to know a little more about this or is it. No thanks. Nothing to see here.

[C]

Well, my problem is that this is such an old problem. It goes back to the 1800s even, and we've known about it forever. I think it was established, even the Morris Worm had some of the stuff. Same issues. So, boy, there's nothing to see here because this is such a dumb mistake that they made. I think it's fundamentally the same class of vulnerability that plagued the early browsers. And that's why we have content security policies. It's why we have origin based trust. And I guess they just forgot how the Internet works.

[B]

Rob, for you, Is this know a little more or no thanks for you?

[A]

Well, it's, it's a combination. I agree with Davi on it, but I would also say that it's really good to have some due diligence on even the latest and shiny new things. So if you have a shiny new thing and you're thinking they must have done their checks on their own, it's always great to double check the double checkers and have your own team that validates those kinds of stuff. But I agree with Dahvie on it.

[B]

All right, the more you know. All right, next up here, Microsoft may have a solution to the impending doom that is the very familiar blue screen of death. We know it as the good old BSOD. They're testing a new Windows 11 feature that prompts users to run a memory scan after a BSOD to catch potential memory issues before they cause more crashes. The proactive memory diagnostics run during the next reboot and notify users if issues are found and mitigated. The feature is now rolling out to Windows Insiders in the dev and beta channels. All right, Rob, know a little more about this or no thanks from you?

[A]

No thanks. I mean, this sounds like something that would just come out as a firmware patch. It shouldn't be breaking news.

[C]

No, all Right.

[B]

Davi, from you, is this know a little more or no, thanks.

[C]

Yeah, I think I'm kind of on the same. I just feel like this isn't actually what the headline says it is. It's not a fix. They're doing a reactive measure instead of integrating like continuous memory scrubbing or like normal, I don't know, ECC validation type stuff. Like they're admitting that they have a problem in memory, but they're not actually fixing it. They're not actually preventing it. They're detecting it. And then doing a bunch of investigations after the fact means their stuff's too complicated. They don't understand their own stuff, but they know that the problem's in memory.

[B]

Yeah, I was saying before the show, I mean, maybe 30 years ago, I would have been like, yeah, they got a chance. The B sides, the only way they can solve this is they just change the color. Right. They've tried that a couple of times to be sneaky. Oh, it's a green screen now. Okay. But yeah, not okay. I'm glad we're all on a cord here. Next story here, F5 says a recent nation state breach that we have definitely covered on cybersecurity headlines had limited customer impact. They've kind of already been saying this, that some customers are impacted, but they disclosed at least some broadly what types of things were accessed. Attackers access source code configuration data and 44 undisclosed vulnerabilities, which does sound like a lot. But most affected customers report that stolen data isn't sensitive. Davi, do we need to know a little more or no, thanks.

[C]

I would love to know more because I feel like F5 has sort of leaked the whole source code secret sauce now. And the attackers know more than F5 probably knows about their own code base. So you probably want to dig in, figure out what's going on. Because when they say limited impact, that's a relative term.

[B]

That is not a fiscal term. For sure.

[C]

Yeah, it could have been everything but the last bit of code, and that's limited, but it's still everything.

[B]

All right, Rob, for, you know, a little more or. No, thanks.

[A]

Definitely know a little more. I mean, whenever someone says, well, it wasn't important data, it just shows. Throws up all kinds of red flags because it could have been. And so they try, obviously they're in damage control and they try to minimize that kind of thing. But whenever you have something like this happened, it's 44 vulnerabilities. I mean, it's a pretty large scale mistake and it's hard to overcome.

[B]

That I would always also like to comment that I love when they say it wasn't important data, as if the criminals or don't want the important data.

[A]

They purposely want to go after the unimportant data.

[B]

So it is a badge of words. Yeah. I mean, to be fair, most companies don't know what they have. So, you know, they're, they're, they're just going off probability. Right. That, that's not valuable here. All right, next up here, kind of, this is kind of our vibe. Check for where we are with like agentic AI in cybersecurity. Palo Alto Networks has launched Cortex Agentix, a suite of AI agents that investigates threats and responds to email breaches. CEO Nikesh Arora said that these tools are designed to meet rising demand for automation amid increasingly complex attacks, with most agents still needing those pesky humans to review it. Rob, for, you know, a little more or no thanks.

[A]

It's worth knowing, right? Because what you see now more and more in the trend is they'll say, well, we're going to release this cyber agent and it's going to do everything for us. But really what we see organizationally in the future is someone, a human actually running dozens, 50, maybe 100 agents. So now you're sort of the orchestrator.

[C]

Of all of this.

[A]

So the more and more innovation that comes out, I'm interested in learning more. Every time something new comes out, I'm interested on what they're trying to innovate on. There is a lot of noise in this area because everyone's saying they have the same thing. So when something comes out, they say they're innovating. I'm very interested to learn more about it because I think the structure of our, of our organizations are changing how we actually staff and everything else when it comes to the executives, our executive suites and leading IT organizations.

[B]

Davi, where are you at? Do you need to know a little more or no thanks still? You're still waiting on this one?

[C]

Yeah. I've done so much AI work over the last 10 years, I just feel like this is a no thanks for me. It's like adding a toddler to your soar strategy and then having to manage or maybe even a group of toddlers to your soar strategy and having to manage them in your playbooks or another way of looking at it is sometimes you want complexity and you want chaos. Like if you took those 44 vulnerabilities that were leaked at F5 and said, you know, can you chain them together and make me 88 or can you make me, you know, 144 out of them. AI is good at that. But if you go into a place where you want to have real good visibility and really understand what's going on, high integrity AI is the last thing I would add to that equation. And if you have to have a human in the loop, it's because you're not really automating anything. You're just turning on a blender without the lid on top and seeing if it splatters your kitchen.

[B]

Thanks everybody for joining in our chat here and let us know. Do you want to know a little bit more about these stories as we're going through? Are you saying no, thank you. We want your input on this, not just our panelists. We need to know from you as well. Like this one. This one was definitely a hot button issue on the social media and you'll find out why. As of today, that is November 3rd, Microsoft and LinkedIn will start using profile details. So that's public posts, feed activity data and more from users in the uk, eu, Switzerland, Canada and Hong Kong to train its artificial intelligence models as well as to support personalized ads across the broader family of Microsoft companies. It's a big old happy family there. Private messages will not be used, so all of your MBA offers are off limits for training, thank God. Additional data from LinkedIn will also be shared with other Microsoft related business entities for the purpose of serving up more personalized and relevant ads. A reminder, everything is an ad tech play if you play it out long enough. Davi, for you know a little more about this or no thanks.

[C]

This is super important because I don't think this is a real line when they say this is the day that you opt out and after this you can't. I think the actual story is you should be able to opt out any day you want from now on into the future. And it's for me disgusting that they would even make this argument that this is a line that they can keep. And in fact it's super cynical because they already carved out the EU and the UK and Switzerland initially so that they could avoid the entire GDPR problem and now they're trying to like come back around and scoop it up anyway. It's just totally disingenuous. I think LinkedIn is in the doghouse.

[B]

No, no, I believe this sums up your reaction here. No, no, no, Rob, for you. Where are you at? Do you need to know a little more or no, thanks.

[A]

No, you know I'm with Davi on this simply because they're already doing it. It's. It's disingenuous completely. They say, oh, we're going to be expanding or doing this and that. And there's so many, so many privacy violations that are happening where you're not getting the opportunity to consent. And this is going to be what the future is about, is what consent looks like for business enterprises and individual users, because it's happening without us even knowing about it. So, I mean, they're saying it, but as far as we know, they could have already been doing it.

[B]

And Amish Runaway, in our chat here, had a question on the story. Do I need to opt out? I mean, I would say if you care about how your data is used on that from that particular platform, I mean, obviously, I would say. Or if you really care about the ad experience across the Microsoft family of products and you're passionate about that, feel free to.

[C]

Yeah, feel free to opt in. You absolutely should opt out. There's no reason to opt in. In fact, there's risk of opting in. So until they give you a valid reason to opt in, I would absolutely. And if you're lucky, they will actually opt you out and delete your profile for you. So consider yourself lucky when they come around and say, your profile's gone.

[B]

All right, and our last one here. This past week, the FCC announced plans to remove some cybersecurity regulations that have been put in place after Chinese hackers breached at least nine telecommunication giants to steal the correspondence of the president and vice president last year. FCC Secretary Marlene Dorch said that the telecos have already taken voluntary steps to secure their networks and that the ruling was legally erroneous. Rob, for, you know, a little more or no thanks on this one, I'd.

[A]

Like to know a little more specifically on exactly how they were able to penetrate those telecom networks.

[B]

Yeah, that's the $50,000 question. Davi, same for you? No, A little more. Or you say no thanks on this one?

[C]

Absolutely no more. I mean, this is the foxes saying, watch us in the henhouse. We'll be fine. Voluntary is the way things are going forward. And we know from the past voluntary never worked. Nerc for, you know, the whole problem with the government regulations is the voluntary systems were a failure. You have to have external enforcement. And the idea that they called the declaratory ruling. I'm not a lawyer, but they called it erroneous, makes no sense to me. They absolutely have authority under Title 2. They absolutely have a responsibility. And it seems like they're just playing political games. We need the enforcement, we need the regulations. That's the only way to innovate is to get the regulations. Because it's mind boggling. Yeah.

[A]

Not only that.

[B]

Right.

[A]

As it helps us as security professionals on having a better defensive posture. You know, like if we don't know what they're doing, then it's we're next. Enterprise is next. Right. Well, they are. They obviously attack the telcos. They're an enterprise. But the more we know, the better we can defend ourselves.

[B]

But no, that, that, yeah, that, that is. Yeah. To, for, I'm sure on top of mind for a lot of security teams out there. Yeah. Getting, you know, hey, let's not just be another target. What can we learn? You know, what can we learn from this? I think should, should definitely be the lesson we can hopefully take away from this. And we know.

[C]

Absolutely. We know. Absolutely. Like when we, you know, the whole FERC NERC nonsense was because they didn't want to go ahead with the NIST standards as they were and create their own and then do voluntary. And that just turned into a huge, massive mess where the utilities are just completely insecure. And so we know this doesn't work. The voluntary method is going to take us down a horrible path. So it's just disingenuous. It's regulatory capture. Basically. People don't want to do the hard work of cleaning up their environment. They say we'll do it voluntarily and then they don't do it.

[B]

All right, we're going to dive into some other stories for a deeper discussion in just a moment. But before we do so, we have to spend a few moments and thank our sponsor for today, and that is threatlocker. Cybercriminals don't knock. They sneak in through the cracks other tools miss. That's why organizations are turning to ThreatLocker as a zero trust endpoint protection platform. ThreatLocker puts you back in control, blocking what doesn't belong and stopping attacks before they spread. Zero Trust Security starts here with ThreatLocker. Get [e-mail] that's T H R E A T L O c k e r.com all right, let's dive into some other stories, some other news that we want to take, maybe a deeper look here. Microsoft postponed a planned Azure network security change to March 2026 after feedback from customers who were concerned it would disrupt apps dependent on public Internet access. The update will make private subnets the default for new virtual networks, blocking automatic outbound connections to the Internet. To align with zero Trust principles, existing Networks won't be impacted, but experts warn firms to prepare now or risk broken workloads once the change takes effect. Azure had a few issues this year, and any major modifications to network infrastructure seem to offer fertile ground for problems, possibly an additional opening for persistent cybercriminals. Anytime you know you're disrupting a business process or an IT process, always room for miscommunication there. I'm curious, Rob, let's start with you here. Do you agree with the decision made by Microsoft to delay this or they always going to be kicking this can down the road?

[A]

Oh, well, I agree with what they're doing for sure. It needs to be done. It's difficult from a security perspective. They shouldn't delay, but it should be immediate. Right. Because the more, the longer they wait, the more vulnerable they're going to be. But they're also having to make a business decision on, hey, what is this going to cost us? So it's a little bit of a catch 22. They put, they've put themselves in an adversarial situation, but it's definitely the right thing to do, whether or not they want to move quickly on it. I would actually, if they're smart, they would incentivize people like, you get a discount if you can move faster, something like this, because then it'd be a win win type of thing. Like, hey, we, we're delaying this, but if you can move faster, then we're going to incentivize your licensing next year or something like along these lines where you're doing both the right thing to do from a security perspective and then you incentivize businesses to do the right thing. Just like previously we were saying people don't volunteer generally for things unless it's enforced. The reverse of that is if you incentivize them. So I think that would be something smart for Microsoft to do in this scenario.

[B]

Yeah, make it easier to make that business use case. Right. Hey, we could save X amount off our bottom line here. Davi, you're smiling. Are we being Pollyanna?

[A]

We.

[B]

Is this too. Are we being so sweet?

[C]

No, no. I love the idea of nudge and, you know, giving people incentive to do the right thing. And I think this is absolutely the right thing to do. I mean, it sort of exposes that they were doing the wrong thing and it's good of them to admit that and try to make it better, but I've been deep in the weeds of Cloud forever. And I mean, front door is a nightmare. It's spaghetti. It's absolute spaghetti to try to get Azure's networking working and the outages recently are example of that. They have all kinds of breaking production workloads. So on the one hand it's like give people an incentive to do the right thing early, but on the other hand, how would they know if it was working? It's such a mess anyway. Azure is such a chaotic mess compared to other clouds. But I think this is definitely something for people to dig into because they should get to know their networks, they should get to know their exposure, they should know their traffic. And so if it breaks their stuff because their apps are connected and they didn't know that, well, now they know and that's good.

[A]

Exactly.

[B]

Is this like, this just seems like the constant. Every decision Microsoft makes that has that could potentially improve security, they always have to like, they can't change a feature in Excel, Right. Because it breaks the workloads of 100,000 businesses or something like that. Right. Is like, is this always the constant tension? Like, I'm surprised that they had to boot it out or is. Is this almost part of their roadmap now? Right. Announced the thing, then announce the delay because you know that it's going to cause a whole bunch of sturm and drang about this.

[C]

It's really economics. I mean, you could engineer it in a way that was a soft landing. You could have traffic flow somewhere and then be slowly cut off and give people reports. You could build a whole infrastructure. It gave people like report cards and that would tell them that they need to do these things in order to be compliant. It'd be awesome. But they just don't want to spend the money to do it right in that sense. And they're trying to make a hard turn because it gets them into a safer their customers and them into a safer posture. And who bears the cost is a is a good question. And why that's an economic issue.

[B]

All right, next up here, we're seeing some more impact from the hack of Marks and Spencer in the uk. We saw a rash of UK retail hacks over the last year, but British clothing retailer NEXT reports that it was continuing to see sales overperform in the wake of the cyber attack on its rival Marks and Spencer. And it credits favorable weather conditions, always clutch for retail sales and competitor disruption resulting in a 7.6% surge in sales in the first half of the year. According to reports from analytics company Kantar, Marks and Spencer rivals have that had an online presence. So we're talking like Zara H And M. Sainsbury all experienced a sales uplift while clothing retailers without a significant online presence did not. Kind of pointing to, hey, turns out when a commodity is not available, you go buy another commodity. This is a topic I don't think we talk enough about, you know, in kind of the knock on effects to cybersecurity, the advantage of that a major breach gives to competitors. You know David, from your perspective, should CISOs factor this in maybe to like high level strategic decisions? Obviously this depends on the market, right. If you can't, if you're, if you're AWS and you have an outage, the cost to move to Azure, you know, Google Cloud or anything like that is a lot higher than buying clothes from another retailer. But like, where do these, just these kind of conversations factor in?

[C]

Yeah, you absolutely have to talk about this. This is a big one. But I think I kind of hate this story because, you know, I'm an old hack back guy, I'm going back a long way and the market incentives here are totally messed up. I mean if you could ciso, if you could incentivize your own team to go and hack your competitor to get double benefits, they go down and your sales go up. Boy, this is going to be hard. It's an ethical discussion and it's terrible to see this. I mean what you want is industry wide baseline security standards, competitors helping each other, banks help each other. When there's a criminal fraud. You don't actually send bank robbers into your competitor's bank to rob them so that you have more customers. So I don't like it. Failures are supposed to create reputational damage, not competitive advantages. So the market's not working if we have this race to the bottom.

[B]

Rob, where are these conversations happening for you in terms of competitive effects of these types of cyber attacks?

[A]

I have a little bit of a different take on it. We always talk when you're doing security and IT budgets that particularly the security budget is that it's a big opex cost, that there's not a whole lot of revenue comes out of it. It's just a giant cost for an organization. And we've said for years there is a cost and there's different formulas that you can plug in to show. For example, if there's ransomware and you're down, you could say, well this is costing us every day that we're down there's a cost. So there's lots of formulas for that. But it is interesting depending on what industry you're in, if you're in a competitive Industry in retail or some other thing that you're selling and you go down. Now there's a much something happens with a breach. Now you can show, hey, look at how much this is costing our competition. And it's a discussion at the board level. I think that I might have if I'm asking for more money year over year because there's not a whole lot of statistics out there on stuff like this. It's mostly on we were ransomed and it cost us a lot of money, or we were struck by lightning, there was a flood or a hurricane and it cost us a lot of money, or there is some kind of a problem. We move things from dev to production, it broke things, it cost us a lot of money. But not the competition thing on, by the way, because we were down. All of our competitors are taking over market share. And that's a separate conversation. So I think it's an interesting conversation to have.

[C]

I will say we do know that in a boom years, the security spend tends to go down because the upside is so good. So people don't need to spend money on security. But in the down years when the upside is gone, people spend a lot of money on security in order to keep the loss in check. And so this is a perversion of that in a way that if you can say, why do you spend any money on security at all if we're the last one standing? Because they're down, right? They're hacked, so we have more upside. So it's dangerous here where we see.

[B]

Yeah, that's like, I just need to be faster than the slowest person when the bear is chasing me like that. Wow, that is like the cybersecurity nihilism that. Wow, that is tremendous. See, this story reminded me of frequent CISO series co host Steve Zaluski, former CISO over at Levi Strauss. And his question is always, how does this help us sell more jeans? And it would be maybe keep your online presence online that would definitely help you sell more jeans. So Steve always have to give the jeans some shout outs there. I don't know if Marks and Spencer sells Levi's, so not that he cares anymore, but anyway, our next story here to dive into. We already talked a little bit about some OpenAI stuff, but OpenAI's Aardvark GPT5 agent finds and fixes code flaws automatically. This autonomous agent, currently available in private beta, works by embedding itself into the software development pipeline, monitoring commits and changes to code bases, detecting security issues and how they might be exploited, and proposes Fixes to address them using LLM based reasoning and tools. Use OpenAI added Aardvark analysis or analyzes a project's code base to produce a threat model that it thinks best represents its security objectives and design. With this contextual foundation, the agent then scans its history to identify existing issues as well as detect new ones by scrutinizing incoming changes to the repository. This sounds interesting. This is, I always think AI stories like this, this is like a turtle stacking stories where it becomes turtles all the way down here. Rob, you know we already talked about what Palo Alto is doing with some of their agents and stuff like that. Are, are you, what are your thoughts on this when, when you see stuff like this?

[A]

I'll tell you, it makes me a little bit nervous simply because the. You can have tools like this that automate it for you, but if it's all automated, then you're going to have the adversary doing the same thing. So it's like a giant tug of war. Now if you're using it to fix human errors, then I think it's great. Right. The more that you can use things like that for, to fix your human errors, like if you make a typo. And I know there's lots of code writing software programs that help you with, along the lines with that. Sure that this chat GPT agent was even more advanced. But at the same time, when you're using it like that, there's, oh, you're always opening yourself up for the adverse happen happening to you.

[B]

Yeah. And there's some ellipses doing some heavy work in the chat here we have Amish Runway going. This sounds super helpful. Kevin Farrell. Kevin Farrell says this sounds. Yeah. Interesting. Davi, how many ellipses are you putting into your chat response here?

[C]

I'm not a fan of what OpenAI is doing right now. I feel like it's a rehash of what Palantir did where they created the terrorists and then they, they build you to find the people that they were creating. And it's sort of similar in the sense that, you know, they're out there saying on the one hand, OpenAI has problems they can't fix. Our security is so bad, we're just pushing out products that are fully flawed. And then they're saying, hey, we have the best tools to find the flaws and we can fix them. And I do not believe any of the marketing right now when they say they've got a sandbox environment or they've got, it's just glorified fuzzing and we know they can't properly represent the environment, a true environment. They don't have the proper environmental conditions and they don't have the really multi step exploitations. We've seen this marketing in the past for at least 10, maybe 15 years. It doesn't turn out the way people say it's going to turn out. Instead it's just a lot of hype and marketing. And it's worse because they're also on the other hand releasing the vulnerabilities themselves that they're claiming to be finding.

[A]

Yes.

[B]

The one part that's, that is interesting to me. Right. Is, is the idea that it can create a model essentially that it thinks like it best represents its security objectives and design in that so many design decisions are kind of a lack of decision making. Right. There are things that passively, it's like technical debt you're not even realizing you're making over time. Right. You're just, oh, we're doing something for expediency or for whatever reason. I like the idea of something being able to say, here's how this is designed. Is this what you wanted? The next step beyond that though, of taking action based on that foundation is actually what freaks me out the most. Because it's like if I'm not even aligned with my own, with what you think my own security design is, that to me is like freaks me out because that seems like it's compounding. If I wasn't even designing this and it's just kind of floating by passively. I would rather fix that than have you make implementations based on something I might not have explicitly agreed to as a design process. Does that make sense?

[C]

Yeah, I mean, there's a long history of false positive rates, missing actual exploitable bugs. If you're going to trust this, you have to first build that trust on something that's meaningful. You can't just say it's going to be better in the future. Future We've seen repeatedly where people say AI is going to be better in the future because you should believe that and it's not actually true. It gets worse. And the latest research shows that if you expose these things to bad data, it's not only going to get worse, but you can't unfix it. That's back to the LinkedIn story. Like if you, if you poison the thing, it has a detrimental value that can't be unfixed, like a 20% burn. So you have to go in thinking, I'm going to give it super high quality, curated, specific information about what I'm really looking for. And then I have to really manage those prompts carefully. But nobody's doing that. And they might not even open the tool to that level of engineering. And so you're basically paying them for problems that they're then going to charge you more to find again. It's like Palantir created the terrorists and then tried to bill people to find them. It's awful.

[B]

All right, before we get out of here today, you know, looking at everything kind of in the past week of news, what we've discussed, just kind of what's out there in the ether. Is there any. Any story either again, like we covered or just in the. In the past week? You know, Rob, for you, that was either just a giant face palm for you, or you want to give a big thumbs up to. Is there anything. You just react like you just had a. Like a super strong reaction to it this past week?

[A]

I would say there was nothing that really struck me too strong this week. It was sort of a calamity of errors. Right. It's every single. It's interesting to see when you see all these security things happening, and it's not super sophisticated. It's just people making human mistakes. And so that's always a question that plagues me, like, how could. If someone missed this. So a lot of it's linchpin type of things and it is palm in the face. How did this get missed? Now, some of them are very compelling and they do draw my attention. Like this, the one we're talking about with the photon, with doing the encryption.

[B]

Oh, yes.

[C]

Yes.

[B]

Yeah, I didn't have time for that.

[A]

Today, but yes, that one interesting encryption caught my attention. So not necessarily something going wrong, but something that I think in our industry that's forthcoming, that's going to be incredible. So I'm anxious to learn more about this new form of encryption. It's really going to be an incredible story.

[B]

Yeah. I mean, davi for you, was that something that had caught your eye this week or is there anything else in this week that. I think we had a couple facepalm candidates for you, but I want to hear it from you.

[C]

Well, I mean, I like talking about the photonic encryption because it reminds me of Fiddy, which I loved. Fiddy was an amazing, special, specialized hardware, every endpoint, dedicated fiber lines. It was, like, awesome. But nobody wanted to pay the thousand dollars per end to get it working. And so who. The only place I ever really deployed it was around MRI machines where the magnet was so big we couldn't use Copper, it's kill all of our networks. So it's really good for specialized implementations, but it's also incredibly expensive. I don't think it's practical or realistic for anybody. The thing that really got me I have a lot of inbound this week about the Tesla case because apparently the judge has ruled recently that they've been intentionally corrupting polluting evidence and withholding holding data from these cars. These are data centers on wheels essentially and so people are asking like man, tell us what's really going on in these cars. So I did a bunch of research and wrote up how to reverse engineer or hack your way into those data centers and get the data you need out of the log so you can tell what's really happening and prove that the crashes are as I said in 2016, I think the algorithms are killing people and I think that's more true now than ever.

[B]

They certainly have more sway over our day to day seemingly every single every single day more and more. So so yeah, thank you, thank you for sharing that Davi and thank you Rob both for doing a stupendous job on this edition of the Department of no thanks to everyone. Also in our chats we're blowing minds here. Amish Runaway is just I don't know if it ever be the same. I do hope you come back for maybe more mind blowing content next week at 4pm Eastern. And Kevin Farrell, I hope did you skip the edging? I hope you didn't skip the edging. You know I like a nice clean line on the sidewalk there. But thank you so much David. However, the VP of Digital Trust and ETH Ethics at Interrupt and Rob Thiel Field CTO over at Gigahome. We'll have links to their LinkedIn if one you want to opt out of that training Data set and 2 find out more about them. We'll have links to Davi's blog there as well. Thanks also to our sponsor Threat Locker. Assume everything is a Threat. And thanks to again our live audience here both on LinkedIn and on YouTube here. Be sure you're joining us each and every Monday at 4pm we would love to love to have you in the chat sharing your thoughts helping us out with Know or no. It is always a fun time and if you can't join us live you can send us an email [e-mail] we'll be back next Monday 4pm Eastern for another edition of the Department of Know. For more details on that go to the events [e-mail]. and if you still need your daily news fix every single day, you can catch cybersecurity headlines. Give us about six minutes, we'll get you all caught up. Until the next time we meet. For myself, for our glorious producer, Steve Prentiss, for the big boss man, David Spark, for Davi and Rob and all of the CISO series, here's wishing you and yours to have a super sparkly day. Cybersecurity headlines are available every weekday.

[A]

Head to CISO series.com for the full.

[B]

Stories behind the headlines.