Fortinet processes telemetry from 50% of the next-generation firewall market, giving Aamir Lakhani, Global Director of Threat Intelligence & Adversarial AI Research, and his team visibility into a looming shift: threat actors moving from exploiting a small subset of proven CVEs to weaponizing the entire vulnerability landscape through AI automation. While defenders currently concentrate resources on commonly exploited vulnerabilities, Aamir warns AI will soon enable attacks across everything "just as efficiently and as fast," requiring security teams to rethink patch management strategies when they can no longer rely on focused defense.

Aamir also touches on how The World Economic Forum's Cybercrime Atlas program operates through weekly sessions with 20-40 researchers who deliberately build intelligence packages using only open-source methods. This avoids proprietary data so law enforcement can recreate findings and successfully prosecute cases. He shares how his leadership approach rejects the traditional climb: stay at the bottom of the ladder and push your team up, because their public accomplishments improve both team performance and your career trajectory more than personal competition ever could.

Topics discussed:

A 50% next-generation firewall market share providing visibility into state-sponsored attacks and ransomware-as-a-service operations daily
AI-driven threat evolution from narrow CVE exploitation to automated attacks across vulnerability landscapes requiring new patch strategies
Threat actor professionalization, including recruitment events, training programs, and internal conferences for cybercrime operations
Adversarial AI capabilities using local LLM training with tools like Ollama to bypass jailbroken model dependencies like WormGPT
Network-centric threat hunting using metadata and netflow analysis over full packet capture due to bandwidth and analysis constraints
World Economic Forum Cybercrime Atlas program methodology using open-source intel to build prosecutable law enforcement intel packages
Prioritizing team advancement over personal climbing by publicizing subordinate accomplishments to improve retention and performance
AI alert fatigue emerging from comprehensive attack cycle tracking where 10% incorrect information invalidates 90% accurate findings

Key Takeaways:

Prepare for AI-enabled threat actors to exploit the entire CVE landscape simultaneously.
Prioritize metadata and netflow analysis over full packet capture for threat hunting due to better manageability and analysis efficiency.
Deploy open-source tools to baseline network behavior and marry telemetry data with threat intel platforms for pattern recognition.
Identify your organization's critical pain points that would force ransom payment rather than focusing solely on perimeter defense tech.
Join collaborative threat research initiatives like World Economic Forum's Cybercrime Atlas.
Build intelligence packages using open-source methods to ensure findings can be recreated and prosecuted.
Conduct CTF-based interviews focused on problem-solving approach and persistence rather than expecting candidates to know all answers.
Spotlight team by publicizing accomplishments and research contributions to improve retention, morale, and your own career advancement.
Mandate regular video check-ins to monitor team mental health and prevent burnout in high-stress roles.

Listen to more episodes:

Fortinet's Aamir Lakhani on Mapping Business Pain Points Attackers Exploit