David B. Cross

Today, Rob Joyce @RGB_Lights posted today that IR firms are saturated and turning away work. I’ve heard the same thing. So why isn’t a single one of them saying it in public? @Reuters reported today that a Chinese-speaking operator pointed AI agents at more than 1,200 e-commerce sites starting September 25 and got into more than 100, including Deere and SharkNinja. Gambit Security documented a separate September campaign: at least 27 companies breached, more than 600,000 card records taken. None of the attacks were Mythos-class tradecraft.  The agents won by grinding old PHP bugs, exposed credentials, and missing MFA for 23 hours at a stretch. The response side is the same core skills this industry has always run on: log review, forensics, containment, patching.  The scale of cyberattacks has changed. My read: the scale of attacks shows up before attack speed. Speed is close behind, and I don’t see either one leveling off. I talk to the people running incident response at the biggest firms in this industry. The odds that the water rose across the entire industry and no one called a peer to ask “is it rising on your end?” are close to zero. A few inches at every firm means the thing changed, and we’re sitting on it. A post on X that says “Wow, a bit busier than normal. Weird.” would do. (I’ll repost it. Low bar, I know.) The Abyss and countless other world-ending movies gave everyone the wrong picture of a tsunami: a wall of water on the horizon. A real one starts with the water pulling off the beach while everyone stands there taking pictures, then it comes back in, and by the time anyone understands what they’re looking at, it’s inland. We’re at the taking-pictures stage. At the White House Super Intelligence Luncheon on September 29, where the AI Accord was signed, the only cybersecurity names on the President’s own seating chart were National Cyber Director Sean Cairncross and Palo Alto Networks CEO Nikesh Arora. The Accord’s first commitment is about cybersecurity. (We got one industry seat.) This industry is being judged on whether it belongs in the “we can contain AI” room. @ZackKorman has evangelized that point endlessly. If we can’t agree on a few inches of water line, we shouldn’t be invited in until we say it on the record as an industry, not a few firms here and there. Right now every firm in this industry answers with its own logo. Who do we play for? In Miracle, Herb Brooks skates his team into the ground after the Norway tie, asking one question over and over: “Who do you play for?” Nobody gets off the ice until Eruzione answers with the country instead of his college. Kudos to Rob Joyce for saying it out loud. He’s playing Bendu from Star Wars Rebels, the one in the middle who refuses both the light and the dark and tells you what he sees. He shouldn’t be the only one. The witches in Macbeth had it right: “By the pricking of my thumbs, something wicked this way comes.” Say it on the record, as an industry, and then ask for the seat x.com/RGB_Lights/status/2112…