Loading summary
Sponsor/Ad Voice
You're listening to the Cyberwire Network, powered by N2K.
It's not just something you made, it's the privilege that you get to work with your hands. It's building something that serves a purpose, proof that you have the grit to keep going. At Timberland, we understand you take your craft seriously, and we do too, which is why our products are built to the highest quality. We put in the work so you can perfect yours with purpose, in every detail, and crafted with intention. Timberland built on craft. Visit timberland.com to shop.
Dave Bittner
RSAC Wraps CISL warns shutdown furloughs are weakening cyber defenses China linked actors burrow into global telecom infrastructure Iran's pay to key research surfaces India probes suspected Pakistan linked CCTV spying Florida suspends a firm over offshore medical data exposure Cisco patches fresh flaws Russian police arrest the alleged leak base operator intern Kevin files his latest man on the street report and Google gets grabby with your homepage. Foreign it's Thursday, march 26, 2026. I'm dave buettner and this is your cyberwire intel briefing. As RSAC 2026 winds down here in San Francisco, we want to take a moment to say thanks. It's been a busy week of conversations, interviews, hallway run ins and late night events, and we're grateful to everyone who took the time to connect with us along the way. Special thanks to our teammates back home who kept everything running smoothly while much of the crew was on the road. Conferences bring energy and opportunity, but they also bring a little extra chaos. We appreciate the teamwork that makes it all possible and we're glad you are with us here today. Experts warn artificial intelligence agents are rapidly reshaping cyber risk, but defenders still lack a clear threat model for how to counter them. At the RSAC cryptographers panel, researchers said AI agents can already identify zero day vulnerabilities in open source software and may soon generate most new code. Panelists also warned large language models enabled personalized spear phishing, rapid exploit use after disclosure and large scale traffic analysis, though no new cryptographic weaknesses have yet been found. Defenders face faster automated attacks and unclear assumptions about cryptographic safety, while patching delays and expanding agent access to sensitive data increase organizational exposure across environments, according to the panelists. Assessments of current risks and emerging operational realities Former National Security Agency leaders say the threshold for a US Military response to cyber attacks remains undefined and ultimately rests with the president. Here at the RRSA conference, retired General Paul Nakasone said the decision to respond kinetically, meaning with physical force such as missile strikes should remain flexible. Former NSA Director Admiral Mike Rogers argued instead for clearer criteria, including loss of life or damage to critical infrastructure. Panelists noted destructive incidents like North Korea's Sony Pictures attack helped shape earlier debates, but no consensus red line emerged. Uncertainty about response thresholds complicates deterrence strategy While officials also warned the US is falling behind adversaries amid persistent intrusions, ransomware growth and workforce strain across government cyber defense efforts, RSAC CEO Jen Easterly says cybersecurity has reached an inflection point where AI is now inseparable from modern cyber defense and operations. Speaking with the Register here at the RSA conference, Easterly said AI is already enabling stronger code development, vulnerability detection and legacy system modernization at scale. She warned threat actors are using AI for highly personalized phishing, but said she's not yet observed entirely new cyber risks emerging from the technology. Her first conference as CEO drew about 43,000 attendees, though federal agencies including the FBI, NSA and CISA were absent from panels. Easterly argues AI could significantly reduce cyber risk and improve software quality, while stronger public private collaboration remains essential as most critical infrastructure stays privately operated and global participation shapes security outcomes elsewhere. CISA's acting director warns a Department of Homeland Security shutdown is weakening federal cyber defense as most agency staff remain furloughed. Acting Director Nick Anderson told the House Homeland Security committee that about 60% of CISA's workforce is sidelined, forcing the agency into a reactive posture. Core services continue, including its 247 operations center and incident information sharing, but proactive programs, industry coordination, incident response capacity and cyber policy work such as incident reporting rules have slowed or paused, Anderson warned. Reduced coordination and delayed directives create openings for adversaries targeting critical infrastructure, while staffing shortages and retention losses could further erode long term national cyber readiness if disruptions continue. Rapid7 reports a China linked threat actor has implanted stealth back doors deep inside global telecommunications backbone infrastructure to enable long term espionage access. Researchers observed passive backdoors and kernel level implants including the Linux based BPF Door short for Berkeley Packet Filter Door, alongside credential harvesters and command frameworks such as CrossC2 and Tiny Shell. Attackers gained entry through public facing applications and valid accounts targeting avanti, Cisco, Fortinet, VMware, Palo Alto Networks and Apach Struts systems. Newer BPF door variants use encrypted HTTPs triggers and packet level filtering to evade detection. Rapid7 says the campaign focuses on underlying telecom platforms rather than individual servers, creating persistent access layers inside critical communications infrastructure that could support long duration intelligence collection against government and network environments, researchers warn. The Iran linked pay to key ransomware group has returned with enhanced evasion, execution and anti forensics capabilities following renewed U S Iran tensions, according to Halcyon and Beasley Security. A recent attack on a US healthcare provider showed attackers using TeamViewer for access credential harvesting tools including Mimikats and Lazang and Active directory utilities for lateral movement. The group deployed ransomware via a self extracting archive and encrypted infrastructure within 3 hours. Faster execution and anti forensic techniques may reduce defenders response windows and complicate investigations into destructive ransomware activity tied to state aligned actors. Indian authorities have ordered a nationwide audit of CCTV systems after police uncovered cameras allegedly installed by Pakistan backed operatives near rail stations and other infrastructure, according to Indian media reports. Suspects recruited locally deployed solar powered cameras that streamed footage over cellular networks, possibly using stolen SIM linked accounts, officials warned. The case highlights limits in device registration controls and concerns that insecure Internet connected cameras could enable broader surveillance activ. Potential compromise of widely deployed CCTV systems raises risks to critical infrastructure visibility and national security monitoring. Florida regulators suspended Mira Health after finding the firm unlawfully offshored sensitive Medicare enrollee data to companies in India and the Philippines without authorization. The Florida Office of Insurance Regulations said more than 23,000 Medicare Advantage beneficiaries were affected, including patients in chronic condition special needs plans. Officials warned the company failed to obtain required approvals before delegating services and exposed vulnerable residents protected health information to unlicensed offshore entities. Improper handling of regulated health data can increase breach risk and trigger compliance exposure for organizations responsible for safeguarding patient information, even when services are outsourced internationally. Cisco released patches for multiple iOS and iOS XE vulnerabilities, including flaws that attackers could chain to trigger persistent denial of service conditions on network switches. The updates address a dozen high and medium severity issues. Four publicly disclosed defects affect Catalyst 9300 series switches, where attackers could combine two flaws to escalate privileges and force maintenance mode requiring physical access to recover. Cisco said none of the vulnerabilities have been exploited in the wild. Russian authorities arrested a suspect believed to have operated the leak based cybercrime forum weeks after an international law enforcement operation dismantled the platform, according to Russia's Interior Ministry and state news agency tass. The Taganrog resident apparently created and administered Leakbase, a forum with more than 142,000 users trading stolen data, exploits and hacking services after breached shutdown in 2023. The FBI and partners in 14 countries seized the site in March during operation leak, conducting roughly 100 enforcement actions worldwide and targeting dozens of active users. Investigators say seized forum databases, including private messages and IP logs, may support further cybercrime prosecutions and disrupt remaining marketplace activity tied to stolen data ecosystems. Coming up after the break, intern Kevin files his latest man on the street report and Google gets grabby with your homepage Stick around.
Sponsor/Ad Voice
Spring starts at the Home Depot and we are bringing the heat to your backyard this season. Fire up the flavor with our wide variety of grills for under $300 like the next grill 4 burner gas grill that's perfect for hosting your spring cookout. Then set the scene and turn your outdoor space into the go to spot the patio sets for every budget. Bring it this season with grills that deliver flavor and patios that set the vibe from the Home Depot. Start your spring with low prices guaranteed at the Home Depot exclusion supplies to homedepot.com Pricematch for details.
Score more with the college branded Venmo Debit card and earn up to 5% cash back with Venmo Stash Got paid back with the Venmo Debit card you can instantly access your balance and spend on what you want like game day, snacks, gear, tickets and more. The more you do, the more cash back you can earn. Plus there's no monthly fee or minimum balance. Sign up now@venmo.com collegecard the Venmo Mastercard is issued by the Bancorp Bank NA Select Schools available Venmo Stash terms and exclusions apply at Venmo me terms max $100 cash back per month.
Dave Bittner
By Day. Kevin McGee is global director of cybersecurity startups at Microsoft for Startup, but during RSAC he functions as my intern. Here's his latest filing so I'm with
Kevin McGee
a legend in the industry, Ann Johnson, and one of my personal mentors throughout my career. I'm very happy to speak with her and find out what she's seen at the show. She has a keen eye for what's coming next in startup and what are you seeing around the show and what's the most innovative things that are happening at RSA this year.
Ann Johnson
You know, it's definitely the year of AI. Everybody wants to know how you're going to see secure agents. Everybody wants to know how you're going to use AI to make your cybersecurity better and also how you're going to protect AI. But I will tell you, I saw a company that didn't talk to me for the whole time about AI and they were all about things about configurations and getting sure the configurations right and using AI to improve that. And that was a unique approach as far as I was concerned because everybody's talking modern sock or protecting agents and these guys are like look, you can use AI to make your configurations better. I said that is cool.
Kevin McGee
Now we've had great success in Microsoft for startups by day job with sort of the picks and shovels type business, the GRC businesses of this gold rush. Are there anything in the GRC space that interests you?
Ann Johnson
Well, my, my very close friend Eric Erstin is on a company called Red Scale but I think there's a lot that can be done. GRC. Look, I think AI's three main use cases are going to be non human identities. I think it's going to be something security operations center, IoT and all of that has a play in GRC. So yeah, there's a big play there because I what I believe is it's going to make us more productive and fast in jrc.
Kevin McGee
Now the other big thing is everyone's saying the industry is consolidating the end of innovations done for cybersecurity. I think it's the complete opposite. I think we're moving into a whole new phase of innovation. Would love your take.
Ann Johnson
I completely agree. I think AI is going to drive a bunch of creativity innovation. It's going to make us better than we are. It's going to be bumpy, but we're going to be a better industry and we're going to be really innovative.
Kevin McGee
I couldn't end without a plug for your podcast which is excellent. Can you tell us about your podcast quickly and where we can find it?
Ann Johnson
Yeah. Afternoon CyberTea is on AfternoonCyberTea.com or wherever you get your favorite podcasts.
Kevin McGee
Thank you very much for your time, Ann.
Ann Johnson
Thank you. Have a great night.
Kevin McGee
All right, so I met another founder who's doing some interesting work and is company has a chief ball officer which I think is just a fantastic addition to the team. Tell me who you are and what you do.
David Shipley
My name is David Shipley and I'm a CEO and co founder of Beauceron Security. So we help people know more and care more about being safe, cybersecurity wise in their organization. It's no longer just about teaching people about phishing. It's making sure they apply what they already know on a day to day basis. And that's why we're named after a sheepdog. We help people go from the passive targets, the sheep, to the active defenders or the sheepdogs.
Kevin McGee
Now, one of the things I've seen you do as a company is really blend psychology and some of the cutting edge psychological aspects of really scientific literature with technology. You're really focused on the layer eight of security.
David Shipley
We're a neuroscience and psychology company disguised as security awareness training. And so we've partnered with some of the world's top researchers to understand the attitudes that drive risk and how to actually change them. Because being safe in 2026 is about selling the benefits of being secure, not lecturing people about phishing emails.
Kevin McGee
So give me a real life example of how you're applying research psychology to the product.
David Shipley
The number one thing from a psychological perspective that we discovered is something called technological overconfidence. So when people believe security tools always protect them, 100% of the time, they click on phishing 80 to 140% more. So we need to teach people security tools are important, vital, but they can only do so much and you play a role as well. The other one is optimism bias. This is a powerful force in psychology. It's a natural predecessor predisposition to say something bad is going to happen to Jane or John, not to me. And when it comes to fishing that belief, someone else is going to click means you're going to click 30 to 40% more.
Kevin McGee
Awesome. Well, thank you for bringing the people aspect back to cybersecurity. I think that's really important. Thanks for your time and have a great show.
David Shipley
Thank you so much.
Kevin McGee
It's Kevin the intern coming live from RSAC and I'm with some royalty from our industry. So Dr. Jessica Barker, NFC. So two of my favorite authors, two of my favorite people, you're on the floor. What are you seeing? What's exciting? Who wants to go first? Ladies first.
Jessica Barker
Ladies first.
NFC
As always with rsac, for me, the most exciting thing is catching up with people. So being able to have conversations, see people that you maybe haven't seen in a year or so and see what everybody's up to. Of course, the big word that we're hearing is AI.
Kevin McGee
What are you seeing out there? Fc? You've got a very different perspective on everything usually. Yeah.
Jessica Barker
I think what I'm seeing out there is honestly, if everyone did what their marketing said they did, like, we would all be out of a job because it's all solved, apparently, according to everyone out there. So I think the big thing that I'm seeing is, yeah, again, it's AI. AI is solving all of our problems and creating all of our problems.
Kevin McGee
So there's always some exciting things happening on the floor. Now, did I get this right? You were in a boxing ring or a wrestling ring?
NFC
Yeah, my first time in a wrestling ring. Whether I won or lost, I won't ruin the surprise. You'll have to go and check out my video.
Kevin McGee
Awesome. Now, author of How I Rob Banks and Other Things, what do you see? So the technologies that are impressing you
Jessica Barker
this year, if I'm really honest, I haven't said anything.
Kevin McGee
I've never known you to be anything but really honest.
Jessica Barker
I've not seen anything that's actually impressed me so far this year. I think everyone's jumped on the AI bandwagon so much that it's not even touching anything yet. I think most of the people that talk about I haven't even used it. It's so new and everyone wants to be on it. Just kind of like we had quantum computing last, like, last couple of years. This is the new thing, and I think hopefully it will sieve out a little bit and next year we'll see some actual decent products.
Kevin McGee
Well, it's funny, we're seeing everyone talk about the consolidation of the market and innovations done. I think it's the opposite. We're seeing AI products that are creating whole new categories of products. Everyone's creating whole new shadow implementations. I think we're going to have a wave of innovation that follows that. What do you folks think?
NFC
Yeah, I hope so. And I think certainly the cybercriminals are being innovative as always. They're finding ways to use technology and AI in ways that we didn't necessarily predict. So as an industry, we need to do the same.
Kevin McGee
What do you think, fc?
Jessica Barker
Yeah, I think, and I've said this before, I think this is the first time in cybersecurity history where both the bad guys and the good guys have the same power, the same tooling at the same time. It's no longer a cat and mouse where one side has something better and then the other side catches up. We both have the same tool, and now we're all trying to race to get to use it the best we can.
Kevin McGee
Awesome. Well, thanks for your time. And if you're still at the conference, swing by the bookstore and pick up their excellent books. It's probably still available. I believe we sold out last year, so they may be still available. Thank you for your time.
Dave Bittner
Our thanks to Kevin McGee from Microsoft for generously donating his time during the RSAC conference this week. Kevin, there may even be a big promotion in your future. Maybe Senior Internet.
Sponsor/Ad Voice
Not sure how to tackle your taxes? Are you sweating the small print? You may be experiencing FOMO the fear of messing up the answer using TurboTax on Intuit credit Karma, they help you get your biggest refund, and then we help you do more with it with a personalized plan designed to help you hit your money goals. It's time to take your taxes to the max. Start filing today in the Credit Karma app.
This episode is brought to you by Indeed. Stop waiting around for the perfect candidate. Instead, use Indeed Sponsored Jobs to find the right people with the right skills fast. It's a simple way to make sure your listing is the first candidate. C According to Indeed data, Sponsored Jobs have four times more applicants than non sponsored jobs. So go build your dream team today with Indeed. Get a $75 sponsored job credit at Indeed.com podcast terms and conditions apply.
Dave Bittner
And finally, a newly granted Google patent describes a system that could replace your company's landing page with an AI generated version tailored to each individual user, sometimes before they ever see what you built. The patent outlines a process where Google evaluates a page using signals such as conversion rate, bounce rate, and design quality. If the page scores too low, search results may instead link to a dynamically assembled alternative built from the user's query history, account context, and extracted site content. In some cases, that link could even appear inside sponsored results, though billing details remain unclear. The patent suggests websites could shift from destinations to raw material for AI assembly, extending a trend where search features increasingly mediate how users experience brands, sometimes with Google politely redecorating the lobby. And that's the Cyber Wire. For links to all of today's stories, check out our daily briefing@thecyberwire.com we'd love to know what you think of this podcast. Your feedback ensures we deliver the insights that keep you a step ahead in the rapidly changing world of cybersecurity. If you like our show, please share a rating and review in your favorite podcast. Appreciate. Please also fill out the survey in the show notes or send an email to cyberwire2k.com N2K's lead producers, Liz Stokes, were mixed by Trey Hester with original music and sound design by Elliot Peltzman. Our contributing host is Maria Vermazes. Our executive producer is Jennifer Ibin. Peter Kilby is our publisher, and I'm Dave Bittner. Thanks for listening. We'll see you back here tomorrow. Sam.
CyberWire Daily – “Wrapping RSAC 2026 up with a bow.”
Date: March 26, 2026
Host: Dave Bittner (N2K Networks)
Episode Theme:
A comprehensive wrap-up of the RSA Conference (RSAC) 2026, exploring emerging cybersecurity trends with a spotlight on the pervasive influence of AI, expert analyses on cyber risk, adversarial activities worldwide, latest regulatory actions, and significant industry interviews from the conference floor.
This episode provides a fast-paced, information-rich summary of major cybersecurity news. The main focus is highlights from RSAC 2026 in San Francisco, with insights from leading experts on the advancement of AI in cybersecurity, evolving threats, regulatory shifts, and a series of “man on the street” interviews offering candid perspectives from prominent industry voices.
The episode balances technical detail with clear, engaging summaries and candid, unscripted takes from respected experts. It maintains a brisk, newsroom style, peppered with on-the-ground observations and a touch of humor, particularly in the “man on the street” segments.
This episode captures the current pulse of the cybersecurity industry as seen at RSAC 2026: AI dominates conversation and innovation, but with equal parts skepticism and excitement. Human factors remain central even as automated threats grow. Strategic uncertainty—policy, bureaucracy, regulation—continues to shape the threat landscape, and the industry’s future demands both adaptability and clear-eyed optimism.