The Real Talk:
- Why AI hasn’t changed the fundamentals of ransomware, it’s changed the speed, and identity is still the number one thing standing between an attacker and your network
- The federal government just put a real deadline on post-quantum encryption, and “harvest now, decrypt later” means adversaries are already stealing data they can’t read yet
- Midjourney is reportedly building full-body ultrasound scanners for spas, and nobody in the room could figure out who’s responsible for the health data once it’s collected
A Closer Look:
Identity Is Still the Front Door Tabitha Senty, joining the crew for a live news episode, cut through the AI hype fast. AI makes attacks faster, not fundamentally different. Phishing is still the entry point, and if organizations aren’t locking down identity and access, it doesn’t matter whether the attacker behind the keyboard is a person or a bot. Once someone’s in, they move laterally either way.
Low and Medium Vulnerabilities Are Getting Chained Together Eric Brown, CISSP, flagged a shift he’s seeing with clients: AI is now chaining together lower severity vulnerabilities that security teams never prioritized, and using that chain to gain a foothold. His take is that vulnerability management alone isn’t enough anymore. Organizations need to restrict permissions so users only have access to what they actually need, especially before turning on tools like Copilot that inherit every permission a user has ever accumulated.
Social Engineering Still Works Because People Are Nice Nick Mellem, shared how a simple LinkedIn lookup and a confident phone call used to be enough to get past most front desks. Eric added detail from DEF CON’s social engineering competition, where contestants use the help desk as their go-to pretext because it bypasses trust almost instantly. Tabitha’s rule: never punish employees for falling for a phishing test. Train them, don’t shame them.
The Quantum Clock Just Got Shorter What guests were calling a five to ten year problem a year and a half ago is now landing in the three year range. A recent CISA and Five Eyes statement warned that the timeline for AI-driven cyber risk is measured in months, not years. Meanwhile, adversaries are already collecting encrypted data now with plans to decrypt it once quantum computing catches up.
When AI Companies Pivot Into Healthcare Eric brought up a company reportedly moving from AI image generation into full-body ultrasound scanners at spas. Tabitha’s reaction was immediate: a huge attack surface, no clear ownership of the health data, and a very real HIPAA problem hiding behind a spa day. Just because a company can build the hardware doesn’t mean anyone’s thought through who’s securing it.
Bottom Line: AI didn’t invent any new attack techniques. It just made the old ones faster and more scalable. Whether it’s phishing, lateral movement, or a wellness company building medical devices without a security team, the fix is the same every time: know your identity controls, know where your data lives, and fix the basics before chasing what’s next.
Tune into the full episode to hear about a fake US Patent Office phishing email that fooled even a security pro, why DEF CON’s social engineering finalists sound eerily convincing on stage, and what Windows 7 has to do with any of this.
🔗 Ep 92 – Live News with Tabitha Senty
Listen wherever you get your podcasts – Subscribe to our YouTube channel to stay up to date on breaking cybersecurity news.
Learn more at www.itauditlabs.com
