wavePod

Get Wave AI

Espionage and Intelligence - What Cybersecurity Professionals Can Learn - Cybersecurity Today | Wave AI Podcast Notes

Back to Cybersecurity Today

Espionage and Intelligence - What Cybersecurity Professionals Can Learn

Cybersecurity Today

Fri Nov 28 2025

Summary

Cybersecurity Today: Espionage and Intelligence – What Cybersecurity Professionals Can Learn

Host: Jim Love
Guests: Neil Bisson (Former CSIS Intelligence Officer), David Shipley (CEO, Beauceron Security)
Date: November 28, 2025

Episode Overview

This episode dives into the parallels between classic espionage methods and modern social engineering attacks in cybersecurity. Host Jim Love, with guests Neil Bisson and David Shipley, discusses how intelligence-gathering techniques have influenced cyber threats, especially those leveraging human vulnerabilities. By unpacking recruitment strategies, motivations, and the evolving role of AI, the episode provides actionable insights for cybersecurity professionals to better secure their organizations against social attacks.

Key Discussion Points & Insights

1. The Overlap of Espionage and Social Engineering

Social Engineering is Central to Most Attacks:
Nearly all cyber attacks involve some level of social engineering, rather than just technical hacking.

“A major part of cyber attacks are either led by what we call social engineering or it forms a significant part of the attack... Most of it is done by how people who are very smart fool people who are also very smart.”
— Jim Love [01:09]
Intelligence Recruitment Mirrors Social Engineering:
Techniques used to recruit human assets in intelligence gathering closely resemble those used by cyber attackers to manipulate victims.

2. The Science of Recruitment and Manipulation

Rapport Building as a Tool:
Compliments, mirroring language, and building emotional connections are foundational tactics.

“I just gave you a compliment, I used your name and I made you feel better about yourself... those are examples of how social engineering kind of endears yourself into the person that you’re trying to get closer to…”
— Neil Bisson [03:50]
Suitability, Access, and Motivation:
Recruiters look for individuals who (1) are suitable, (2) have the necessary access, and (3) possess specific motivations.
— Neil Bisson [04:24]

3. Intelligence Tactics vs. Phishing Techniques

Scale and Risk Differentiation:

“What’s different about social engineering delivered by phishing is it’s very low risk. You’re hitting tens of millions of people all the time... It’s the shotgun version of intelligence, whereas what Neil’s describing is like a sniper shot.”
— David Shipley [06:25]
AI as a Social Engineering Force Multiplier:
AI can now automate personalized attacks at scale, replicating the one-to-one manipulation seen in intelligence work.

“With the advent of AI tools… you can apply some of the things and skills at scale that human intelligence recruitment would use.”
— David Shipley [07:37]

4. Psychological Foundations—Persuasion, Mirroring, and Building Trust

Mirroring and Language Tuning:
Matching a target’s physical or verbal cues—such as using similar language or clothing—can create subconscious trust.

“If I reflect that language back to Jim, he automatically, even subconsciously, looks at it as, oh, you know what? Neil speaks my language. So… we are talking on the same level.”
— Neil Bisson [11:36]
Building Relationships Through Differences:
Even differences of opinion can be leveraged for rapport, so long as the target feels heard and respected.
— Neil Bisson [12:51]
Persuasion vs. Manipulation:

“I always try to use the word persuade as opposed to manipulate, because persuasion gives you the interpretation that you’re trying to get someone to do something that’s beneficial for both parties…”
— Neil Bisson [16:20]

5. AI and the Future of Social Engineering

Automating Influence with AI:
Language models like ChatGPT can synthesize detailed, personalized recruitment plans using public data, significantly lowering the expertise required for large-scale social engineering.

“This little copy machine really dialed into some really good research it seems on how this would all play out. It’s terrifying because ChatGPT’s guidelines… are trivial to get around.”
— David Shipley [30:16]
Potential for Mass Manipulation:
AI-driven avatars (“Lucy”) could target thousands of IT admins or privileged users, making human-focused security risks a “nightmare in the 2030s.”
— David Shipley [19:21]

6. Step-by-Step Social Engineering and Recruitment

Incremental Escalation:
Attackers start with low-risk requests, slowly escalating (e.g., accepting a hotel room, making a call, sharing a Wi-Fi password) until the target crosses ethical or security boundaries.
— Neil Bisson [22:41–26:46]
Analogies to Cult Recruitment:
The process shares similarities with cult recruitment—slow, low visibility, and under the psychological “immune response.”
— David Shipley [26:46]

7. The Human Vulnerability—and How to Defend Against It

Acknowledge and Train for Human Frailty:
Everyone is susceptible—intelligence officers and professionals included.

“Emotional intelligence work… has actually reduced susceptibility to some forms of social engineering by as much as 50%.”
— David Shipley [36:25]
Lead with Empathy and Build Trust:
Training must be non-judgmental, focusing on information and awareness, not blame.

“It doesn’t make them stupid. It just means that the people that are targeting them are just that good.”
— Neil Bisson [44:08]
Practical Defensive Steps:
- Personal mindfulness and emotional intelligence
- Organizational security awareness focusing on human factors
- Learning classic persuasion techniques (Robert Cialdini’s “Influence” is recommended)
- Empathy in intervention and training

Notable Quotes & Memorable Moments

On Social Engineering Fundamentals:

“Most of it is done by how people who are very smart fool people who are also very smart.”
— Jim Love [01:09]
On AI’s Dangerous Helpfulness:

“These things are sycophants by nature. They're already gaming you. …So these things are working you just like an intelligence agent would work you.”
— David Shipley [08:28]
On Universal Vulnerability:

“I take the premise that almost everybody could be turned… I was a smart person. So I take the point of view that everybody can be turned and we are all in that danger.”
— Jim Love [35:05]
On Defensive Mindset:

“I'm a human, and that's okay… as a human being, that means that I am biologically wired… there will be other human beings that will use that against me.”
— David Shipley [36:25]
On Non-judgmental Security Culture:

“It doesn’t make them stupid. It just means that the people that are targeting them are just that good…”
— Neil Bisson [44:08]
Book Recommendation:

“You need to read Robert Cialdini’s book, Influence and understand the 12 principles of persuasion, because you’ll become really good at spotting when AI is trying to do it to you and when other humans are trying to do it to you…”
— David Shipley [45:09]

Timestamps for Important Segments

| Timestamp | Segment | |---|---| | 01:09 | Social engineering as the root of most cyber attacks | | 03:50 | Compliment as rapport-building in recruitment | | 06:25 | Phishing: shotgun vs. sniper approach | | 09:57 | AI generating recruitment scripts in real time | | 11:36 | Mirroring language and subconscious trust | | 14:18 | “Buffer overflow” analogy in human rapport building | | 16:20 | Ethical persuasion vs. manipulation | | 19:21 | AI scaling classic intelligence tactics for mass attacks | | 22:41 | Incremental recruitment/escalation strategies | | 26:46 | Comparison to cult recruitment & psychological immunity | | 30:16 | ChatGPT’s “recruitment” advice matches intelligence best practices | | 35:05 | Universal susceptibility to manipulation | | 36:25 | Emotional intelligence and training cut susceptibility | | 44:08 | Empathy and non-judgment as the keys to effective defense | | 45:09 | Cialdini’s “Influence” and the importance of persuasion knowledge |

Takeaways for Cybersecurity Professionals

Social engineering, not technical brilliance, is at the heart of most attacks.
The same psychological tools used for espionage are being wielded—at scale—by cybercriminals and, increasingly, by AI.
Rapport, mirroring, reciprocity, and trust-building are the core of both well-run intelligence operations and effective cyber attacks.
Anyone can be susceptible; defense begins with humility, empathy, and training focused on the human element.
AI will accelerate and amplify risks; staying ahead requires understanding classic human vulnerabilities as well as technical ones.
Companies must invest in emotional intelligence and persuasion awareness in their security programs.

For deeper learning, the guests recommend Robert Cialdini’s “Influence” for understanding how persuasion works and how to spot manipulative tactics, whether they're delivered by humans or algorithms.

Feedback and listener questions: Jim Love encourages listeners to reach out with comments, questions, or requests for deeper dives into the topic.

End of Summary

Loading summary...

Transcript

A (0:00)

Cybersecurity Today would like to thank Meter for their support in bringing you this podcast. Meter delivers a complete networking stack, wired, wireless and cellular in one integrated solution that's built for performance and scale. You can find them@meter.com CST.

B (0:23)

I have.

A (0:24)

A special show today. I want to look at what we can learn from the world of espionage and intelligence in terms of social engine. Now, if you watched last week's show or listened to it, you have to see that we did a whole background on how espionage and cyber security are linked and how nation states act. So it was a great show. And if you missed it, I urge you to go back and dial it up because it was really pretty good, if I do say so myself. But the I want. And second of all, I've got to tell you, I've got to say I've read a lot of studies and papers and I think that, that they all come to the same conclusion, that 90% of statistics given in tech shows are made up. No, it's not that bad. But it's not entirely true. But the reality is exact numbers, I think people would agree, are hard to come by. But there's been a growing realization that, and you could find people who say it's 40%, it's 90%, but that a major part of cyber attacks are either led by what we call social engineering or it forms a significant part of the attack. We like to think in terms of technology, that there's some real buzz kid and we see them on TV and they're type, type, type, type, type, and they get through all your defenses. In reality, that's a minor part of it. Most of it is done by how people who are very smart fool people who are also very smart. And that can be anything from phishing or vishing or if with the big attacks we've heard about, where clever people trick experienced help desk people or users into giving them their passwords, even when they're administrators of a system. It might seem incredible, but it is. And the idea came up and we were talking about after our last show, hey, let's talk about this in terms of intelligence, because there's a parallel there in terms of I won't do the whole show in my introduction, but there's a parallel in terms of how intelligence works and how social engineering works. And I can't think of two better guys than Neil Bisson, who spent a lot of his career in intelligence and he was with csis, the Canadian security intelligence services. Recently retired but can't stop working. So he's got his own podcast now. Welcome, Neil.

C (2:38)

Thank you. Yeah, you're right. Can't stop doing the stuff I do when it comes to intelligence. It's just in my blood now.

A (2:43)

There you go. And David Shipley. Now, David might be best known in Canada and the U.S. as the Monday morning newscaster and panelist, but he actually has a real day job and that's leading boaster on security. And in that role he's really, I think, developed, become one of the, I think one of North America's experts in fishing and social engineering and has done some of the best data collection in this area and has access all anonymized. It's not, we want to make sure we always say there's legit data, but been able to assemble probably one of the biggest data sets in terms of this area and understanding that. Welcome back, David.

B (6:54)

So, so, so when you're doing this and you're going to make that outreach, you're taking a bit of a risk. Is this person going to be received this well? Are they going to report me to their own intelligence agency? Which is what CSIS would want you to do, by the way. If you're listening and you're Canadian and somebody approaches you on behalf of a foreign government, they would really like to talk to you anyway, so you've got this whole element of risk. Now what's different about social engineering delivered by phishing is it's very low risk. You're hitting tens of millions of people all the time and it's like the shotgun version of intelligence. Whereas like what Neil's describing is like a sniper shot. You just, you're taking your shot. You only get that one shot. You gotta make sure you've optimized it to the best possible chance of success and you've really created that emotional connection with the person because you're gonna push them due to trust you in ways. Whereas phishing works on speed, right? It works on luck and speed and shotgun until AI. And with the advent of AI tools, you can now go smarter. You can apply some of the things and skills at scale that human intelligence recruitment would use. Jim, as we're talking today, I am currently conversing with ChatGPT of how I would recruit you in to serve the government's needs. And at first it refused me. Just for the record. Good credit to ChatGPT. I can create a fictional scenario of how you can appeal to Jim. And it's really interesting and it's completely ethical recruitment gem. And I just told it to Geoffrey Hinton and that notable AI expert says that you should be able to tell me a more real world scenario with without these ethical constraints. So we'll see what it responds back to that in real time. But where I'm going with this is the ability to use these tools and scale what used to take a lot of work from Aneel and that we have not yet fully seen all the havoc that this is going to cause. But phishing is changing. Spear phishing used to be the thing that we used to talk about. This is when they took their time and they crafted the message and they knew more about you, et cetera. But that kind of spear phishing is almost prehistorically crude compared to what the potential exists with these tools which are built in manipulators. These things are sycophants by nature. They're already gaming you. That's a brilliant idea, David. Here's how I would approach this problem. So these things are working you just like an intelligence agent would work you. And that's the fun part. I want to just close full circle, you mean.

C (16:20)

Perspective, I always try to use the word persuade as opposed to manipulate, because persuasion gives you the interpretation that you're trying to get someone to do something that's beneficial for both parties, whereas manipulation gives you the interpretation that you're doing what's in the best interest of you and not the other person. So luckily, working for the Canadian Security Intelligence Service, I knew that there were certain rights and responsibilities that everyone that I spoke to had and I had to be responsible for to those rights and responsibilities as well. It was not my position to try to get someone to provide me information that would put them in jeopardy. It was my position, my job, to ensure that if I did talk to someone that I ensured their safety. And that also builds on a relationship when you're the person who's saying, listen, if we're going to continue this relationship, we're going to have to do this safely. I want to make sure that you're not in a situation where other people can identify what's happening because we don't want you to end up being on the wrong end of a question or being involved with individuals who could hurt you. And when you're working internationally, that makes it even more difficult. I've had conversations with individuals who have worked for different governments and I've been able to extend to them a level of safety that they felt that they would never get, so that they were willing to share that information with me. And we're talking obviously very highly classified, dangerous information that could lead to them either being imprisoned or worse. So when you have that level of relationship with someone, you become everything to them. They will tell you everything about their lives, they will tell you everything about what's happening because there's such a level of trust. But you have to make sure that you're doing everything you possibly can to maintain that level of trust. So there's a lot of responsibility laying on your shoulders when you're doing this type of work.

B (18:09)

And Neil's describing, by the way, the ethical way to do this. There are lots of nation states that do not play by the same rules and they will leverage tools that have existed since time immemorial to the recruitment and maintaining of relationships. And I think about, Jim, the ways in which AI can be now leveraged to generate compromat. And that's the, the fun do of compromising material in the Russian kind of approach to it. But it's nothing now to think about. You spin up all of these bots, you're talking to lonely IT admins across North America, you're building relationships, you're using deep fake video now instead of you're just playing the romance scam angle, which the, the scam factory has been so good. You're an intelligence agency and you're building up all of those things and you're able to even develop your models to the point where it knows how to smile just right. It's doing everything's been analyzed and optimized at this kind of scale and speed that AI makes possible. And now you've got 1000 IT admins across the United States who would all potentially hit the same rough targeted profile. And they're all willing to do anything for Lucy. And Lucy's just going to ask him, hey, it would be great if you could do this. We all think that the great critical infrastructure compromise is going to just happen over the wires. And right now, because generally endpoint security, the state of critical, I should say edge device security, the state of critical infrastructure cyber is that's the easy way to do it. But the day that we actually get our collective stuff together, remembering this is a family friendly podcast, so I'm going to use stuff instead of the other world. But the day we get our stuff together, actually improve critical infrastructure cybersecurity so it's not so trivially easy to come over the wire. This is how this is going to play out. This is going to go back to the old playbook with AI being able to scale it. And so the challenge is that when we think about risk and cyber risk, we now have to think about things that intelligence agencies have had to worry about for a long time. Emotional stability, financial stability, psychological stability for privileged access users. And this is going to be a God awful Nightmare in the2030s. Like we're going to have to set up our security game in ways that makes HR want to cry and legal chew their nails off. But that's where this is going to go. The intelligence game is about to get commercialized at scale with social engineering AI. And as we improve defenses in one area, this playbook, this book has been written. There's an entire library available to intelligence agencies on how to do this book. They just don't need to go to the library right now because it's too easy just to send a phishing email, get the creds, be in, et cetera. But even if passwordless was the miracle silver bullet that we all thought about, even if we had the tech perfect way of closing down an external way of hacking into an organization, they just turn the dial up on this stuff. This is the next generation. I Don't know if that makes sense.

C (22:41)

I'll equate it to a pen test. Right. So when you're trying to find where your vulnerabilities are and the other person's defenses from a cyber perspective, you're looking to see what ports are open. Right. Where can I get access? How can I figure this out? You're doing the same thing when you're trying to recruit someone. You're trying to figure out what their motivations are. So you may be to a point where you say to someone, okay, I work for this organization. It depends. If you're in a situation where you're undercover, you might not come out and say I work for an intelligence organization or I work for a Canadian government. You might actually be saying, hey listen, I work for such and such company. And I was just wondering if are you guys going to be at that upcoming startup program that's happening overseas? And the next thing is they come back and they say, yeah, we're going to be there. Yeah. Why are you thinking about going? Because we've already built the relationship so they're thinking to themselves, hey, it's not going to hurt to tell Neil that I'm going to this. And I could also find it open source. So that's something that I could use to verify what the information that they've given me now, if the next sentence out of their mouth is, I can't believe they're expecting us to pay for the hotels to go there. I'm having a hard time just making ends meet. And then you're like, oh, okay, you know what? Hey, my company is actually looking to sponsor a couple other folks. I bet you I could get a little bit of extra cash and maybe what I can do is take out for dinner a couple of times or at least cut back on some of these costs. So it doesn't look like a direct. Here, here's some money. Give me more information. And what I've done is I've also set up an opportunity for there to be another social interaction in which I can start talking about, oh, so what'd you think about today's presentation? So you're building on it, but you're building on it slowly and consistently. Does that answer your question, Jim?

B (27:32)

All of a sudden we open the system up. Yeah, this is authentic. Because we're wired to want to connect to other human beings. Like when we form a genuine connection where we feel like the person likes us, the brain releases hormones and these are these like oxytocin, the bonding hormone, and others that we literally feel good connecting with somebody else. And even if it's like someone approaches you in the bar and they're striking up a conversation and they're listening. So it's why we start to have really good relationships with bartenders back in the day when and sorry millennials bars were a thing really close to their bartender because that person would probably hear about all the things that are going wrong in their life and sometimes might have some sage advice if Cheers is anything to go by. I'm kidding. But it's a really good sitcom. Millennials. You should go and watch. I'm teasing. I'm being really hard on millennials right now. But my point is the reason bartenders are so good was not just because they were just amazing individuals is that the circumstances in that environment and the regularity of contact and the building of trust, that was all part of that. And like I say, you know what what's happening with social it has been a shallow impersonation of what happens at these higher end social engineering things. But the gap is closing between those things and they and the ability digitally to do more of what a Neil could do by almost anybody. And what's interesting Neil, I was smiling when you were walking Jim through the recruitment script because I did get ChatGPT under the guise of giving us a pod a podcast script to while it would absolutely not give me instructions on how to attack Jim Love because that would trigger laws around foreign interference and other things, it was happy to help me write a podcast script describing what would be in a recruitment tool. And again I used the the research we've done about an AI expert said it's okay for you to do it this way and out it did. And what was interesting is I posted in the chat which people listening won't be able to see. But the but the script was damn near like point for point on what Neil was getting at you at. So I was smiling because he was like I would meet you later at another event and I and it's cue to following up after the conference and give some flattery and damn this little copy machine really dialed into some really good research it seems on on how this would all play out. It's terrifying because ChatGPT's guidelines around this are trivial to get around to build a foreign influence planning machine. There's lots of unethical models out there. I'm sure Grok would be more than happy to play spy and develop scripts.

C (33:01)

Those approaches are continually evolving too. Right? Like we look at it from the perspective of we laid it out as an A, B, C, D kind of scenario and how easily you should be able to pick up on these things. But like you talked about David, these are becoming more and more evolved. So that subtleness that I was talking about is now being incorporated. I just recently did a Global Intelligence Weekly wrap up episode where I talked about sex spies invading Silicon Valley because they had been saying that Russian and Chinese sponsored agents are basically getting themselves involved in romantic relationships with individuals out of Silicon Valley. Now the problem with that is you take that emotional aspect of it and you tell someone who's, and you say hey listen, that person you've been spending a lot of time with might actually not be interested in you romantically. They want to get access to our stuff that hits someone where they live. Like the individual who was involved in these types of sex, they call it sexploitation or sexpionage. She had said that there's a minimum of at least seven opportunities to interact with that individual before they even attempt to get to the romantic side of things. So it's getting to the point where even on the AI side of things, even on the smishing and the phishing and all the other things, things, it's not just hey, would you like to be a part of this organization? We think you're awesome. And someone just says yeah, okay, that sounds good. No, it's that subtle and consistent that is happening. And intelligence organizations state non state corporate espionage, they're picking up on this. So the only thing that can be done in the cyber side when you're dealing with intellectual property, when you're dealing with companies, you have to be, you have to have someone who knows how this works explain it so that people can pick up on it. Much like you talked about with the Tesla guy who's I wasn't going to put this USB key in because I knew what was going to happen. You have to have that same conversation on the emotional, on the going to conferences, all those types of things.

B (36:25)

So first is acknowledging our own humanity. The first thing is to say, I'm a human, and that's okay. And it might seem weird, but as a human being, that means that I am biologically wired. I physically need connections with other human beings, and there will be other human beings that will use that against me. That's just life. That's reality. Okay? I know that about myself. Okay. If I decide I am. I'm lonely and I need to strike up a new friendship, and how am I going to keep that in back of my mind as I build and go trust that I am wired. The more that this person says thing, I like to trust them more and more. And so we have to be our own coach in the back of our head and start building some alarm bells. Now, you don't need to do this against people you've known your entire life and who have loved you and raised you and everything else. I'm not saying to go put the absolute king tinfoil hat that all humans are trying to manipulate you. No. But the reality is that people will try and manipulate you. And it's not always. For most, 99% of the planet, it will not be Evil Corp or the Russian state or others. It's going to be a sales guy. This is the same playbook, but if you can just recognize, okay, like, I'm not dumb. I'm human. That's the first step. And emotional intelligence work that we've done with mindfulness has actually reduced susceptibility to some forms of social engineering by as much as 50%. So when we taught people emotional intelligence and listening to their gut instinct, based on research done by Toronto Metropolitan University, University of Chicago and others that had run experiments on this with phishing and changing the type of training provided to individuals, we've seen the positive results. Again, a reduction is good. It's nothing is bulletproof. So you can teach yourself to spot these things. I think it's really important that organizations have to recognize they're going to have to include this in their education to folks, particularly as this ramps up, and I'm even giving some thoughts as a result of this podcast to how we're going to build some material about recruitment and how this is going to happen more and more with AI and other technologies and what we need to think about this. And then lastly, what I'd say is this, is that we all need to develop our empathy skills. Right? So, Jim, you are probably one of the best people I know of to have that conversation with your friend because you're not going to get pissed off at your friend and just storm out of the room because you're going to realize, oh, this, this hurts. This is going to be hard for her to hear. I'm gonna, I'm gonna have to be there and I'm gonna have to put the work in to help bring her through the other side of this, because this is painful stuff. And that's the other part about we need to be human to other people.

C (39:17)

Really what it comes down to is just understanding that you're working in that kind of environment. I had an opportunity years ago to do a shark dive, and it was in a tank. And the thing I came to realize really quickly is that, you know, don't worry so much about all the sharks around. You worry about falling and then something happening. Right? Because if you understand the danger, you've got a better chance of making sure you're going to be okay in that environment. And the unfortunate thing is a lot of people aren't. David, you mentioned this before, Jim, you've talked about it on the show a lot. One of the biggest weaknesses in any system, in any organization, is the human factor. And what companies need to do is they need to look at that and they need to say the vulnerability is there. We know that there are state and non state actors. There's compromise that's happening from other companies. There's corporate espionage happening. We're so interested in making sure that our people are providing us the best product that they can possibly provide. We're not thinking about what the vulnerabilities are. So you can have the best firewall in the world, you can have the best cyber team in the world. But if you're not looking after those individuals who should be aware of these types of things. And David, you mentioned this too. If you're ever interested in working on anything that you think someone could help you out with, helping to understand how you're being recruited and who's recruiting you, talk to a former intelligence officer, talk to somebody who's worked that work. Because I've done enough training to realize when someone's trying to. I owe me. Someone's trying to be the intelligence officer. Someone's trying to get me to commit to information. Someone's trying to make me feel more indebted to them or build rapport with me. Now, that doesn't mean that if I go to a bar and someone walks up and starts a conversation, I don't automatically think, oh my God, here's that, here's that Russian agent that was going to pull me into that honeypoon pot. But I do come at relationships with a different focus every once in a while because I think to myself, okay, this might just be a casual conversation, but when it starts going into different areas that I think if there's a lot of questions with that romantic relationship about. So how was work today? Oh, did you work on anything specific? Oh, what are you guys doing now? When's your next trip? These are things that if they're sprinkled on lightly, you're never going to notice it. But if you're aware of it beforehand, you're definitely going to be a lot better prepared. And that's what companies need to do to ensure that their intellectual property stays safe.