Can specialized security survive Daybreak and Mythos?

Summary

---

Safe Mode Podcast – Episode Summary

Episode Title: Can specialized security survive Daybreak and Mythos?

Date: May 21, 2026
Host: Greg Otto, Editor-in-Chief, CyberScoop
Guest: Lior Div, CEO & Co-founder, 7ai

---

Episode Overview

This episode dives deep into recent seismic shifts in software security—including a major supply chain attack via the Minishai Hulud worm—and explores the disruptive entry of advanced AI cybersecurity products (OpenAI’s Daybreak and Anthropic’s Mythos/Project Glasswing). Host Greg Otto is joined by Lior Div of 7ai to analyze how AI-enabled, agentic platforms are transforming security operations, the challenges facing CISOs (Chief Information Security Officers), and whether defense can keep up as threat actors weaponize AI at unprecedented speed.

---

Key Discussion Points and Insights

1. The Minishai Hulud Worm Crisis (00:45–11:30)

• Major Incident Recap:

  • A sophisticated, automatically propagating malware campaign—Minishai Hulud—compromised trusted software development tools and platforms (Tanstack, Mistral AI, UiPath, GitHub).
  • Attackers (Team PCP) exploited developers’ trust in open-source workflows, particularly by hijacking GitHub Actions and exploiting digital signatures for software updates.

• Technical Mechanics:

  • Team PCP used orphaned commits to bypass 2FA (Two-Factor Authentication), running malware inside “trusted” build pipelines and getting valid digital signatures.
  • The worm established deep persistence on developer machines via config directories ignored by security tools, and even OS-level background services.

• Attack Vectors & Escalation:

  • A poisoned Visual Studio Code extension (NX Console) enabled repo exfiltration; reportedly 3,800 to 4,000 repos affected in under an hour.
  • The speed and automated nature highlight weaknesses in current open-source and CI/CD security models.

• Industry Takeaway:

  • The line between “everyday” developer tools and critical infrastructure has blurred—defenders must apply production-level scrutiny to local dev environments and plugins.
  • “Organizations are gonna have to apply the same rigorous security auditing to local configuration directories and developer plugins as they do to production infrastructure.” — Greg Otto (10:25)

---

2. Interview: Lior Div on the AI Security Arms Race (11:33–37:19)

The AI Security “Continuum” and Product Race

• Speed of Change:
  • “Every two months there is something that’s super major, but every week there is something that actually [is] changing.” — Lior Div (12:55)
• US vs. Adversarial AI:
  • Lior expresses more concern about adversaries (e.g., China, non-corporate actors) using unregulated AI models than the rivalry between Daybreak and Mythos.
  • “Those capabilities are already out there… I thought we were talking about two years [until bad actors catch up]. I don’t think that’s true anymore. Six months maybe.” — Lior Div (14:27)

CISO Challenges & “People-Led, AI-Driven” Security

• Empathy for Defenders:

  • Board-level awareness and pressure on CISOs is up, accelerating organizational support and sometimes budgets—but velocity of threats causes stress.
  • “There is a word that I’m using, and in the past we were not using it in the context of cyber, is empathy. We have to come to this conversation with a lot of empathy, because those teams are… getting asked from the board, ‘Hey, what are you doing about Mythos?’”— Lior Div (16:25)

• Human in/on the Loop:

  • Traditional, human-centric investigations can’t keep up; automation is essential, but humans still provide essential oversight, context, and tribal knowledge.
  • “Human cannot do the depth that AI can do. They cannot do it in the speed that AI is moving… But very important to understand… we have to have humans. Human needs to be on the loop, not in the loop.” — Lior Div (17:24)

• Interface Innovations:

  • 7ai lets non-experts query AI systems in plain English, so supervision and oversight remain accessible and effective, even as AI handles the grunt work.
  • “They don’t need to be an expert on writing SQLs or KQLs… they can ask any question in plain English and the system will translate it to the relevant questions.” — Lior Div (19:46)

• Shared Accountability:

  • 7ai’s “P-LAID” (People-Led, AI-Driven) model ensures responsibility for outcomes is shared; AI must be tailored for each customer, absorbing local “tribal” knowledge.
  • “We’re not expecting the customer to do it, we’re taking responsibility for it and making sure we have the right process with people.” — Lior Div (23:15)

Adoption and Market Shift

• CISO Mindset Evolving:

  • Skepticism is fading as proof points accumulate. Now, the main question is how quickly these agentic models can be rolled out, not if they work.
  • “Can the AI do or not do the work in an accurate way? We passed that point… Now the question is, how much time do we have in order to fully implement it in the environment?” — Lior Div (26:00)

• Industry Convergence:

  • The detection, investigation, and response playbooks (SIEM, SOAR) are collapsing into unified, AI-driven stacks.
  • “What will collapse is the 24 by 7 SOAR and SIEM. Those three things will collapse into one tech stack. That’s exactly what we’re building.” — Lior Div (28:32)

New Threats and Proactive Defense

• Novel Attacks Bypassing EDR:

  • Lior highlights a newly discovered attack using a morphing browser extension to bypass all major EDR tools, found via continuous, AI-driven threat hunting.
  • “They installed a browser extension that… over time morph[ed] and [allowed] the attacker… full control on the machine.” — Lior Div (30:33)

• AI-Fueled Attack, AI-Fueled Defense:

  • LLMs (Large Language Models) have leveled the field—defenders and attackers access the same tech, creating a unique “parity window” where the edge goes to whoever implements faster.
  • “The attackers do not have the edge of time… LLM was introduced to defenders and attackers at the same time… If we move fast and leverage AI to fight AI, we have the chance to have the upper hand.” — Lior Div (32:31)

Legacy Vulnerabilities and “Paying for Sins”

• Will AI Expose Old Weaknesses?

  • Quoting peers: “AI is going to potentially make us pay for the technological sins of yesterday.”
  • AI enables automated detection of complex logic flaws (not just memory bugs) much faster than before; defenders must adopt equally agile, proactive mechanisms.
  • “It was a flow in the logic of the code… AI is very good at finding things that logically do not make sense… You needed a very smart person [before]; suddenly the machine can.” — Lior Div (35:02)

• Call to Action:

  • CISOs must adopt AI-driven methods rapidly or be left behind by threats that can now exploit old flaws at scale.
  • “If you are not moving fast… yes, you’re going to pay for it. But if you’re going to leverage and embrace AI, you’re going to be in a much better position. People have to be on the loop; they cannot be in the loop because we’re too slow.” — Lior Div (36:37)

---

Notable Quotes & Memorable Moments

• “This worm establishes persistence inside local developer configuration directories… these folders are typically excluded from version control, they represent a significant security blind spot.” — Greg Otto (06:37)
• “I will be the first one to say time out. We have to have human. Human needs to be on the loop, not in the loop.” — Lior Div (17:43)
• “What started as a great concept—agentic defense—has moved quickly from can it work? to how soon can we implement it?” — Paraphrase, Lior Div (25:41)
• “This is the first time in history of cyber that the attackers do not have the edge of time.” — Lior Div (32:23)

---

Timestamps for Key Segments

• 00:45 — Minishai Hulud attack explanation and impact
• 05:30 — Technical deep dive: persistence tactics and config directories
• 08:35 — GitHub and NX Console incident details
• 11:33 — Interview with Lior Div begins
• 16:20 — Empathy for CISOs and board pressure
• 17:24 — Speed and depth: AI vs. human investigations
• 19:44 — Oversight, human/AI collaboration, the P-LAID model
• 26:00 — Changing CISO attitudes: proof points over pitches
• 28:32 — Unified agentic security stacks emerging
• 30:25 — Discovery of a new attack evading EDRs
• 32:23 — Leveling the field: Both sides using LLMs simultaneously
• 35:02 — “Technological sins” and AI’s ability to find logic flaws
• 36:37 — Call for rapid CISO action, on-the-loop vs. in-the-loop

---

Tone and Language

The tone is urgent but matter-of-fact, reflecting both the seriousness of new threat realities and hope in fast-evolving defensive countermeasures. Lior Div is pragmatic, occasionally cautionary, but also optimistic about the power of empathetic, AI-assisted security teams.

---

Summary Takeaway

This episode crystallizes an accelerating AI security arms race, showcasing the dangers (Minishai Hulud, rapid supply chain attacks) and the opportunity—AI now enables both attack and defense at computational speed. Security leaders must act quickly, merging human context with AI-driven automation, or risk being outpaced by threats exploiting old and new vulnerabilities alike.

---

Transcript

[A]

A really rough week, security wise for software developers. We'll talk about it on this episode of Safe Mode. Welcome to Safe Mode. I'm Greg Otto, editor in chief at cyberscoop. Every week we break down the most pressing security issues in technology, providing you the knowledge and the tools to stay ahead of the latest threats, while also taking you behind the scenes of the biggest stories in cybersecurity. An attack is coming. It's about keeping us safe.

[B]

He's just a disgruntled hacker. He's a super hacker.

[A]

Stay alert.

[B]

Stay safe.

[A]

Stay safe. This is safe Mod foreign. Welcome to this week's episode of Safe Mode. I am your host, Greg Otto. In our interview segment this week, we're talking with Lior Div, the CEO of 7ai. And look, we've been talking about it for weeks. OpenAI's Daybreak and Anthropic's Project Glasswing are the talk of the security community. And Lior sits at a really interesting spot as 7ai is trying to build an agentic SoC. So we talked to him about how these two tools really affect how he's running his company and what he thinks the changes in AI cybersecurity mean for us moving forward. Really interesting conversation. Glad to have Lior back on the program. But first, talking this week and you know, look, usually I have one of my great reporters with us to talk about some of the reporting that they've done, but I've been doing a lot of reporting this week because it has just been, and it is always a really busy week in the world of covering cybersecurity. It just, it really gets nuts. But I would say this week has been especially nuts, especially due to this worm, this shy hulude worm in Mini Shai Hulud that we've been seeing this week. You know, it all started last week with the news that Mini Shai Huloo was running rampant. And we're just going to talk about it because I feel this is happening at such a breakneck pace over the past seven days that it's good to take a step back and go over everything just to really set the stage for how things are moving and how fast things are moving in the cybersecurity and software development world. So look, everyday software engineers run routine commands to download code packages and update development environments. And this process is pure muscle memory for developers. The same way you and I may log on to check our email or send a text message. This is the way that software developers really rely on different code packages that are out there. And the safety of open source software ecosystem is rooted in trust and the fact that these software developers can go out, find something on the Internet and really make sure that know it's it's good, they can put it in the bigger code libraries that they're building and go about their days. And a cybercriminal group named Team PCP has really weaponized that exact reliance. Over the past week, this self propagating worm called Minishai Hulud has hijacked the global software supply chain. The attacks compromised the publishing pipelines of massive trusted development tools like Tanstack, Mistral, AI, UiPath, all of these tools that back office IT workers use, that software developers use. This is stuff that unless you're in it, you don't really know, but once you are in it, this stuff is just used every day. And Team PCP has been using Minishai hello to really just cause havoc. The malware really takes over digital signatures of authenticity and has been insidious in being installed in workstations and then stealing enterprise cloud keys, embedding itself in hidden configuration folders that security filters routinely ignore. And then it's been spreading autonomously to other projects. And this campaign has already escalated to internal repos at GitHub, which is like top of the summit when it comes to software development. To understand the severity of this attack, it helps to examine the underlying engineering. Typically organizations trust software updates because the cryptographic signatures verify the source code. And Team PCP is exploiting this by targeting GitHub Actions workflows using orphaned commits, which is code published to a repository fork without a corresponding branch. This enabled Team PCP to exploit broad permissions, bypass two factor authentication, run malicious code inside trusted built pipelines, and consequently the malware received a perfectly valid digital signature. The automated defenses verified the origin of the update without detecting the malicious code hidden inside, and we were off to the races. So once an automated pipeline or developer installs a poison package, the payload executes instantly. It uses Bun, which is a high speed JavaScript engine, to systematically harvest security keys, cloud infrastructure, passwords, SSH tokens, everything. From there the malware acts as a worm and after stealing publishing tokens, it checks other software projects that can token the access and injects code. And on and on we go. So the thing that also has made this really really devastating is the fact that the developers Team PCP have taken into account that developers are going to try to get rid of this and a standard security response to rolling back these dependencies or or deleting effective packages is that that's how this goes away. I mean just delete the package, download a new one, and on we go. Team TCP has accounted for that security. Researchers from Sync and Aikito Security warned that standard rollbacks leave attackers access intact. So this worm establishes persistence inside local developer configuration directories. And then because these folders are typically excluded from version control, they represent a significant security blind spot. The malicious scripts execute automatically every time a developer opens a project and begins, you know, an AI coding session in cursor or claude code or any of the AI tools that developers now use. And then furthermore, the payload installs operating system level background services such as System D user services on Linux and Launch agents on macOS. These services run a backdoor that polls for remote commands alongside another token monitor which checks for stolen GitHub tokens every 60 seconds. This thing is just it has so many ways to establish persistence on developers machines, which is why we've seen multiple reports of it just causing so much havoc across open source projects and getting to that GitHub and in internal repositories. Wednesday, Tuesday Into Wednesday night, GitHub confirmed that internal repositories were exfiltrated after an employee device was compromised through a poisoned Visual Studio code extension. These code extensions are kind of like think of like Chrome extension, the way Internet users use browser extensions. Developers use code extensions in the same way to make their lives easier. So while Team PCP claimed to have access 3,800 repositories, GitHub noted the claim. You know, looks to be maybe around like 4,000 repositories. Just a complete mess. And the way that this happened, it looks like this was new. As of Wednesday, the breach looks to be linked to a separate compromise involving NX Console, which is a popular code extension used by millions of developers. An attacker used a maintainer's leaked credentials to push malicious version of the extension directly to the VS Code Marketplace. And it looks like that Microsoft and NX talked. And while there was some news that only like a handful of developers were affected by this NX Console update, it looks like it actually may have affected 6,000 installations even though the the malicious package may have only been up an hour. Which goes to show that the time here is just the time frame also adds an A level of chaos that just it causes so much chaos in that it shows that how often these tools get used and 6,000 commits over an hour is just a wild, wild amount of time. So look, the big takeaway is here that the campaign highlights a Critical vulnerability in how modern software industry consumes open source components. As security experts have noted, the line between an everyday developer tool and critical infrastructure has largely vanished and attackers no longer need to breach enterprise networks directly. Instead, they can just exploit the inherent trust placed in development pipelines and, and local tooling. And so moving forward, organizations are gonna have to apply the same rigorous security auditing to local configuration directories and developer plugins as they do to production infrastructure. It's just going to change. And teams PCP understands that there are a lot of blind spots here and they're taking advantage of this. And organizations, whether they're on the open source side, whether it's the maintainers or, or anybody that relies on this code, which is just about everybody on the Internet when it comes to development, are really going to have to account for this moving forward. So wild stories. Check out more on cyberscoop. Com. We published stories last week looking at Minishai Hulud and then the update to what we saw with Tanstack and UiPath and then what we're seeing with the internal GitHub reposition as well. Check out our reporting for more and we're going to be following up on this because I feel like Team PCP is really putting itself in these, the crosshairs when it comes to threat intelligence and just cyber security defenders overall that you're going to see a lot of concentration in the space moving forward. So with that, check out our reporting and if you are a developer, just concentrate on this. This is really, really a huge problem moving forward. So with that, let's jump into our interview with Lior about different set of tooling, different set of tooling Overall. Talking about OpenAI Daybreak, mythos, anthropic and what the world looks like with Agentix. Check it out. All right. Joining us on this week's interview segment for Safe Mode is Lior Div, the co founder and CEO of 7ai. And Lior was with us about a year ago. You know, we were talking about what does an agentic AI look like and how are enterprises really using AI to work into their security plans. And we've had a lot of changes over the past year since we've last spoke. So we wanted to invite Lior back on the program and talk about all of those changes and how he is adjusting to them and how he sees the market adjusting to them. So Lior, welcome back to the program.

[B]

Thank you so much. Thank you for having me. It was a hell of a year.

[A]

It certainly has been. And it's Been also, I feel like a hell of a month, a hell of a six weeks in the AI cybersecurity space, especially within the past 24 hours. We just had a story go up online that OpenAI launched their Daybreak product and this looks to be a very much a competitor to what Anthropic is doing with Project glasswing and its Mythos program. And while there are a lot of differences, I think that we could talk about in terms of the way that they are sort of positioning these products. No, I'm wondering, look, as a company that you have that's building an Agentix Hawk platform that kind of sits on top of these foundational models, or maybe it doesn't sit on top, but basically plays in the same line of technology. No, I'm wondering what you think about these models and really these companies pushes into the cybersecurity space themselves and whether you think that this approach is something that will move the needle for enterprise defenders and it doesn't matter which model really wins if there's a rival or if there's space in the sandbox for everybody to play here.

[B]

Yeah, I think that it's first. You're right. The last year was a crazy year and many things are changing in a dramatic way. So in our kind of book, when we're thinking about it, it's like every two months there is something that it's super major, but every week there is something that actually changing and the way to think about it and I think that that's true to MITOS and this is true to what OpenAI released is actually think about it as a continuum that keep evolving over time. And I know that many people are like, when glasswind Project and Mitos was kind of introduced, people had some criticism and say it's good that they did it, it's bad that they did it. And in my book I'm saying it's like it almost doesn't matter what we think. This is a point in time, it's in a continuum and this is a capability that got introduced and keep evolve over time. So it was anthropic, now it's OpenAI. And when I'm really thinking about it, it's like everything that actually have the US flag in my mind, it's like we're okay. It's like at least we can argue if it's a good disclosure or not, but we're okay. The thing that bothered me the most is when we're thinking about what China is doing, what people that have access to models that are not governed by real companies that have real management. And just to think about that, those kind of capability will be in a closed garden with the big companies that they're rivaling or not. It doesn't matter. I think that it's a mistake. I think that the clock is ticking, and basically those capabilities are already out there. And, you know, in the past, I thought that we were talking about two years till the bad guys will have their hands. I don't think that's. That's true anymore. It's like, I can guess. Six months maybe.

[A]

Okay, interesting. You know, it's interesting that you say that, because that hearkens back to a conversation I had when I was out at RSA with some cybersecurity leaders. Kevin Mandia, Alex Stamos, Morgan Dasky. You know, they talked about it being a perfect storm of offense over the next two years. And when it comes to defense, I mean, look, seven, AI is obviously built on the premise that AI defense is a big answer. But, you know, it sounds like your timelines are a little bit different than what we've been hearing. And if defenders only have, whether it's two years or six months to sort of get this right and get in position, you know, I wonder how that fits into your continuum, because things are just moving at a breakneck speed. And if things are moving on that continuum, it just seems like it's too fast for everybody to keep up. Like, I'm not jealous of sizzos having to try to work on this timeline when, you know, we see what happens with, like, patching timelines, that's. That's almost antiquated at this point. But if you're in a large enterprise, not even just a large enterprise, just an enterprise where you do have to manage hundreds of thousands of instances or machines, that's something that can't happen at a very rapid rate. And now you throw AI on top of that, that just makes things worse. So I'm wondering, how does that all fit into these timelines in this continuum that you're talking about?

[B]

Yeah. So every time that we're speaking with ciso, as you said, I think that they have the toughest job here. And specifically, not just them, them and their team. There is a word that I'm using, and in the past, we were not using it in the context of cyber, is empathy. We have to come to this conversation with a lot of empathy, because those teams are betting, basically, getting asked from the board, hey, what are you doing about metos? What are you doing about those things? So it's like every executive, CEO level, board level, learn to ask those questions. And I think that this is fantastic for us. It's fantastic because is usually and at least what we are seeing, it's translating to a support for management, is translating to budget and translating to hey, let's remove a little bit of the red tape in order for us to move fast. So this is the good part. Now the second part of it is, okay, those team has to understand that the traditional way and I think that all of them are understand it by now of putting humans in the loop, trying to do investigation in speed of human. It's actually breaking kind of the equation, meaning that human cannot do the depth that AI can do. They cannot do it in the speed that the AI is moving. But very important to understand because some people are taking that thing and saying, oh, so we don't need humans. And I will be the first one to say timeout. We have to have human. Human needs to be on the loop, not in the loop. People needs to be the one that they are oversighting. The AI and companies like us has to provide the tools, almost the weapon to fight against those hackers. So just to give you an example, we already reached to a point that we can investigate any type of alert in the speed of AI, but it's not just the speed, it's the depth. For example, when you're doing a EDR investigation, cloud investigation, usually it's sometimes. Again usually. And sometimes it's basically what you think about the quality of investigation. We're talking about in cloud, about hundreds of artifacts that we need to review in order for a human to review those hundreds of artifacts that will require like almost 24 hours in order to do that. I can do it in minutes. So now we're talking about depth of investigation. Depth of investigation and the ability to reach your conclusion much faster and much more accurate. Doesn't mean that we don't need the human, the human need to be on the loop and not in the loop. If it makes sense.

[A]

It does make sense. And I'm, I'm wondering, I'm playing devil's advocate a little bit here in that when you do have people led but AI driven frameworks, how does that position humors, especially from like a supervisory standpoint rather than just the operators. Like you're always going to have somebody that wants to look at those EDR alerts or do the actual like investigation part. But I'm wondering if then outside of the operators, doesn't the supervisory role become increasingly nominal like at what point does on the loop become out of the loop necessarily?

[B]

Yeah, so, so this is actually a fantastic question because we ask ourselves a lot kind of how we enabling people to be basically the one that supervised and the one that are in control without actually running the day to day mundane queries and to know, you know, SPL versus KQL different kind of query language. And what we created, we created a method and this is kind of the people led AI driven the plaid model that those people, they don't need to be an expert on writing SQLs or KQLs. So basically they can ask any question in plain English and the system will translate it to the relevant questions to the relevant system and summarize that thing and we'll give them the answer. So every time, for example, that we're doing an investigation, so the AI is doing investigation, a human can come in and ask a question. It's like, hey, why did you decide that thing? Give me more information about this user. What is the right approach to take here? So think about it as the AI become something that gives superpowers to those teams instead of taking away power from them. And I think that the combination of hey, AI will drive, AI will do all the hard work, the toil work, but humans have the ability to influence and basically ask question and direct. It's actually we see a great result of that thing and we're not sacrificing the speed and accuracy that we need specifically those days.

[A]

So with thinking through that conversation a little bit more, when you have these autonomous agents, maybe they make a wrong call, maybe they miss a threat, there's a false positive or something that contains that sort of breaks things for a temporary amount of time. What are the conversations like over who is accountable for that? Because it may be the machine that made the decision, but human, you know, we ultimately still have control, some, some level of control over all of these systems. So what are those conversations like about accountability when considering handing over so much to an agentic platform?

[B]

Yeah, so, so again this is the same, the, the really real reason that we created the plot model because, and it's a, it's a, you know, it's a people that they are driven acronym. But, but the, the idea here is hey, we don't want to take an AI system, throw it at the customer and say hey, good luck, you use it and it's your problem. Okay. This is the wrong approach from any company. This is the wrong approach of implementing AI. This is the reason that our platform, their job is to Be the overwatch on the AI across our customer base and making sure that the AI is doing the work that the AI should do. And basically we're sharing responsibility with the customer to make sure that the AI is doing the right job. So think about it. What if I had a room full of people doing investigation for a customer? My job is to provide an outcome to those customers and not just say, hey, I gave you access to two people and good luck if they're good or not. No, that's the wrong approach. So the right approach is to supervise, train, give feedback and make sure that the customer care only about the outcome that they are getting. And this plot approach enable us to reach to this kind of high degree of accuracy. And basically it's not just accuracy because there is another aspect of that thing is to make sure that those AI system are not generic system, they are tailored to specific environment, they are tailored to specific customer. So what does it mean? Let's think about it for a second. A good analyst in a big corporation will have a tribal knowledge in their head that they will be able to say, oh, this is the CEO machine. So usually it's behaving like that and this is kind of a machine in it, or this is the production environment. So it's need to behave in a different way. So all of those nuggets of information, the thing that are not recorded anywhere, we have a method to consume this tribal knowledge and teach our AI and customize our AI agent into a specific customer environment. This is part of, again, we're not expecting the customer to do it, we're taking responsibility for it and making sure that we're the one that having the right process with people to make sure that the AI is tuned to a specific environment, then you getting kind of the result that you need. And this is kind of the exact combination between people led and AI driven. So everybody needs to do their part of the job in order to have a successful outcome. That to be honest, that's the only thing that we care about.

[A]

So that's interesting. I was going to ask you, you know, what are you hearing from the CISOs? Because everything that we talked about there is generally there's a little bit of idealism there. And that's okay because you want to see the possibilities that this technology has. But I'm wondering if when you are talking to CISOs, if they're buying into what is possible with agentic defense and because they generally believe that agentic defense can give them a leg up when it comes to what they need to accomplish with their cybersecurity plans or whether they're like, look, my board is just all about this right now, and they're wondering whether I can just put AI in here and I can keep the board happy. And, you know, we're all good and, you know, maybe we have these, you know, tough conversations about headcount that we're seeing. I'm wondering if you are. You're seeing Sizzo's awakened to what is happening or if it is just an ideal. And maybe that distinction doesn't matter to you. And it's just like, I get the sense that it. Maybe it does matter to you because you're saying that a lot of this is people driven. And it doesn't seem like you're just like, yeah, here's the product. Figure it out on your own. I don't want to tell you what to do within your own enterprise.

[B]

Yeah, yeah. So as I said earlier, you're completely right. We're not the people that just trying a product and say, hey, I can do everything and good luck is actually the opposite. And I think that what we saw, and this is kind of true to what we started with Mythos and kind of the fact that it's a continuum and time is shrinking, the same thing happening to the CISO that we're speaking specifically here in the US So it started with, hey, it's a great concept. Everybody agreed that it's a great concept. It was not a debate about it. The question was, can that thing actually solve cyber problem? Can AI actually do an investigation? So when we started, it was a big question mark. Can the AI do or not do the work in an accurate way? We pass that point to a situation that people are starting to ask is like, okay, we know that it can do the work now the question is like, how much time do we have in order to fully implement it in the environment? And as I said earlier, it's like our response was, okay, you have two years, so please start small and then kind of ease your way in to use that thing. As things are changing, specifically with what Google released, kind of the zero day that AI was managed to find the new project from OpenAI, the new, not the new, but the middle project from Anthropic. Suddenly you think about it and people starting to come to us and say, it's like, hey, we don't think that we have time. We know that it can work. Can you give me 2, 3 reference for companies like us that already implemented it and let's go and the ability for us to give those reference and say, hey, you're not the first one. We're not experimenting on your environment. Hey, there is at least three in your patch of the land that already implemented it and see good result, enabling us to give the comfort to those people and as I said, a lot of empathy to the process to make sure that we're supporting them in this transformation. That to be honest, we are surrounded with very smart CISO communities here in the US they want to move fast, they want to do the right thing for their customer companies.

[A]

So with the way the market is moving, I'm wondering if we could go Back to the OpenAI the anthropic parts of this look, with Daybreak and Mythos. A lot of it is finding, patching, validating vulnerabilities and that's a lot of work done on the development side with your product. It is very focused on the SoC. The detection, the investigation, the response. I'm wondering if, you know, looking out at this continuum, do you think that those two products stay separate or does the market eventually collapse into one AI powered security stack?

[B]

Yeah, so. So I, I don't think that we are. See, I, I think that in our patch what will collapse is the 24 by 7 soar and sim. Those three things will collapse into one tech stack. That by the way, that's exactly what we're building. So we're not limiting ourself to hey, we're only doing investigation and that's it. We're already open up the platform to do everything from detection engineering and detection, tuning, investigation, response to cases. And the most important thing is threat hunting, freeform threat hunting. So the same way that the bad guys will use Metos and other, let's say deep seq version 4 in order to find vulnerability, weaponize those vulnerabilities and start using them. We're using the same basically knowledge and techniques in order to hunt into environment and move from just their reactive situation. Hey, some vendor send an alert. Now we need to investigate it, to actually flip it on its head and say no, now let's be active in the environment and figure out what is the thing that susceptible to this type of alert in real time, continuously, all the time and making sure that those companies are switching to proactive. That was almost a dream on the bucket list of CISOs. We never manage. Never. It's a big word but it's like the majority of the companies never manage to do that with people because you cannot do the continuum. And to read the report, maybe you can search for IOCs, but to do this type of hunting on TTPS and tactics and techniques, it's hard. But we already have an AI that can do it for us. So instead of just limited to a specific thing, we switch to a continuous threat hunting in our customer base. And by the way, that's the reason we managed to find a novel attack and we're going to release it in a day from now that basically I

[A]

definitely want to hear about that.

[B]

So basically what's happened there, that thing bypassed every EDR that exists out there. And the technique that they use, they installed a browser extension that at the beginning look very benign, but over time basically morph and give kind of the attacker the ability to run code on the target machine, harvest credential and basically have a full control on the machine. So, and through that way they managed to bypass the traditional edr, the traditional kind of way to protect. So when we did kind of a search or hunt, continuous hunt, we managed to find that thing in many of kind of the target system that we were hunting for. And that was, to be honest, not a surprise because once you can bypass the traditional EDRs, it's like, okay, it's a free game, everybody can do that.

[A]

Interesting. Okay, so with, with that threat, I, I, I don't know whether it was nation state, you know, cyber criminal or whatever, Whatever side of the spectrum it was on, you know, we are definitely seeing these adversaries use AI themselves. And look, they're experimenting with it and they're, and they're finding their own ways to, to use their own models. Like you brought up China and, and Deep Seek. I'm sure there are models that are being used inside, you know, the PLA or the gru, you know, what adversary you want to name in order to find new offensive capabilities. So you know, I'm wondering, how do you, how do you combat like an unknown unknown? I, I feel like, like how does your defensive model account for a threat actor whose AI capabilities are material, materially ahead of, you know, anything that's publicly known?

[B]

Yeah. So I will challenge the materially ahead. Okay. Because. Okay, let's think about it for a second. This is the, we call it the parity window. So basically LLM was introduced to the defenders and the attackers at the same time. This is the first time in history of cyber that the attackers do not have the edge of time. And I'll explain, choose your three letter agency, let's say nsa. While you were talking on the phone, they could tap the phone while you sending an Email and those email were encrypted. They can decrypt the email. So they were always ahead of us between 10 to 5 years. And that's true to you know, any bad guys that you will decide, China, Russia, whatever it is. So they always has this edge and, and they could do things that usually was like unknown to, to, to the public when LLM came. Basically it was introduced to the defenders and to the attackers at the same times. It's, it's it. So now we are in a unique, in a unique situation that we have access to the same technology that they have access in order to build defense and, and offensive tool. So I think that that's give us the edge we need to move fast. But if we're going to move fast and actually leverage AI in order to fight AI, we have the chance to have the upper end in this kind of game. It's not a game. But, but you understand the, the, the correlation here, right?

[A]

Of course, definitely. So yeah, with that I would say finally, okay, so the, the playing field is leveled between that level of attackers. But also you know, I, I think back to discussion I had at RSA where particularly Morgan Dansky said AI is going to potentially make us pay for the, the technological sins of yesterday. And look, you've been in this industry for a long time. I'm, I'm wondering if that resonates with you at all and especially if you think there are any specific sins that are going to come due that AI is going to exploit and is there really any realistic path along this continuum that you're talking about to pay off those sins before things do get really bad?

[B]

Yeah, so, so I, I do think that there are things that going to be exposed as a result and we see it with vulnerability right now you scan code in a different way and what Google basically released and they didn't share much, so they didn't share which model has been used, who is the attacker, what was the target system. But the one thing that they did share was very interesting that it was not an exploitation of memory. It was a flow in the logic of the code that enabled those hackers to bypass two factor authentication. And the reason that I'm focusing on that thing is interesting because okay, AI is very good of finding things that logically do not make sense and can exploit those kind of problem in logic in order to bypass those two factor authentication. And I'm saying it because in order to find this type of attack in the past, you needed a very smart person. You couldn't do that with the machine and suddenly the machine can understand logic and they're actually very good at it and can find those like logic jumps that will enable you to do hacking. So, okay, so we have a new way in order to find new flaws. But hey, we have new ways to protect against those things now because the way that we are doing protection to a company, the way that we're doing investigation, the way that we're flipping it on its head instead of just doing an investigation in a passive way, we're actually doing in a proactive way and enable us to hunt and figure out what is the flows and fix them. So there is that machinery that enable us to be faster. So it will be a point in time that if you are not moving fast as a CISO and you are not starting to implement AI in your stack of security, yes, you're going to pay for it. But if you're going to start leveraging and embracing AI into your defense systems, you're going to be in a much better position. And it's not just like a commercial for Hey7AI. I think that there is multiple options out there, but we have to switch the mindset to understand that people has to be on the loop. They cannot be in the loop because we're too slow.

[A]

Great. Lior, really appreciate you hopping aboard. We'll have to have you back on because I feel like if we wait another year it'll. This continuum that you talk about will be so far down the road that we're. It's going to be tough to even look back on this and go what are we talking about just even a year ago? So to have you on again soon. Appreciate you hopping aboard.

[B]

Thank you so much. And I believe that our job is to is to keep evolve faster than the bad guys.

[A]

Absolutely. Thank you.

[B]

Thank you so much.

[A]

Thanks for listening to Safe Mode, a weekly podcast on cyber security and digital privacy brought to you by cyberscoop. If you enjoyed this episode, please leave a rating and a review and share it with your friends, your co workers, your sizzos, your sys admins, your mom, your dad, anybody that wants to know more about cyber security. To find out more information or to contact me, please look for all of our social media handles or visit cyberscoop.com. thanks for listening. Check us out next week.