Episode 30: Steve Thomas, CEO @ HackNotice

The podcast episode features Steve Thomas, CEO of Hack Notice, discussing the evolving landscape of AI in cybersecurity and its broader impact.**AI's Disruption and Industry Parallels:**\The conversation begins by drawing parallels between AI's impact and the software engineering industry. Just as AI didn't replace engineers but amplified their productivity, it's expected to do the same in other sectors. The legal industry, for instance, is seeing disruption from AI tools like Claude, potentially lowering costs and increasing accessibility. This shift is moving pricing from billable hours to value-based models, a trend observed in SaaS development where traditional seat-based pricing is becoming obsolete with the rise of AI agents.**Threat Intelligence and Hack Notice's Approach:**\Steve Thomas shares his experience founding Pwnlist, a pioneer in breach monitoring, highlighting his focus on addressing "hated problems" in cybersecurity. Hack Notice, his current venture, tackles third-party risk by applying a threat-informed approach, analyzing data from hacker forums and credential leaks to provide an adversary's perspective on vendor vulnerabilities. This contrasts with traditional cyber hygiene metrics, focusing instead on the operational tactics of threat actors.**AI's Role in Cybercrime:**\The discussion delves into how AI is accelerating cyber threats. AI is enabling more sophisticated and personalized attacks, such as spear-phishing, and potentially improving vulnerability discovery. The rise of info-stealer malware, which rapidly harvests credentials, API keys, and browser data, is a significant concern. This malware's efficiency and the increasing volume of stolen data, particularly AI-related credentials, pose a substantial risk.**Security Implications and CISOs' Concerns:**\While CISOs are aware of AI's dual role as both a tool for defense and a weapon for attackers, their immediate focus is often on leveraging AI for efficiency and productivity rather than solely on its security risks. The rapid proliferation of AI tools, including potentially insecure open-source models and cloud-based services, creates a challenging environment. The lack of robust data governance for AI usage by employees is a significant concern, as this data can reveal intent and potentially lead to legal or security breaches.**The Future of AI in Cybersecurity:**\Steve emphasizes that the AI landscape is volatile, with rapid advancements and market shifts. He believes that companies with deep domain expertise and a focus on building reliable, guard-railed AI solutions will succeed. The traditional models of threat intelligence reporting are becoming obsolete, needing to be machine- and AI-readable. He advises CISOs to focus on the basics of cybersecurity, understand their adversaries, and carefully manage AI integration, particularly by avoiding direct access to production environments for AI systems. The key takeaway is that AI is an accelerator, making both offensive and defensive capabilities more potent, and thus underscoring the need for robust, AI-informed security strategies.