Insights on Cybersecurity Challenges

Holy man, it's a weird world You know,

I've walked the halls of a lot of the headlines

people read in cyber security and the press never really gets it

You know, nobody really understands what it's like

to be a victim of a cyber crime

Kevin Mandia, you have 30 years on the front lines

of American cyber defense You began your career as a United States Air Force officer

Serving as a computer security officer at the Pentagon

and as a special agent in Air Force counterintelligence in 2004

with no outside funding he founded Mandia and spent the next decade building it

into the gold standard for incident response authored the groundbreaking apt-1 report exposing China's

Unit 61398 in a sweeping cyber espionage campaign targeting over 140 U.S. companies,

a revelation that reshaped global cybersecurity policy.

Led with transparency during the SolarWinds breach,

publicly disclosing the compromise of FireEye and helping uncover one of the most significant cyber

attacks in U.S. history, impacting multiple federal agencies.

Oversaw the $5.4 billion acquisition of Mandiant by Google,

one of the largest cybersecurity deals ever,

and led the company through integration as the CEO.

Most recently, you are the founder of Armadan,

a pioneering autonomous AI agents designed to identify and exploit vulnerabilities like nation-state attackers.

backed by a record 189.9 million dollar raise from top-tier investors including In-Q-Tel, the CIA's investment arm.

That's right, they are in.

Hi, my name is Kevin Mandia and you can watch this episode early on Vigilance Elite Patreon.

I'm the emergency room doctor for cybersecurity incidents.

How During this call, during I mean this interview, it'll happen to somebody.

Can you believe that?

During our interview, an 80-year-old American woman will probably lose 200 grand of her life savings.

During our interview, a company will get compromised and probably extorted for 5 to 10 million dollars.

It is happening at a rate, and this is not a fear. uncertainty and doubt thing.

Nobody knows the rate.

Right away, we recognize, wait, we're not the only ones on this network.

Who was on the network? First one I ran into was China.

Something like 20 Air Force bases were logged into from one university.

What the hell's going on? Like, no university should be logging into that many,

you know, Wright-Patterson Air Force Base, Oak Ridge, Lawrence Livermore, Los Alamos.

I get on the call,

and one of the first, and I'm getting a briefing from one of our IT guys who ended up moving into the Security Operations Center,

and he's telling me that somebody

is logged into our network, and the very next thing they did after they logged in is they dumped all our user accounts and passphrases

from a Microsoft tool called Active Directory.

So, in other words, that's like somebody broke into the hotel and the first thing they

do when they broke into the Marriott is they didn't grab the room key that just opened up room 101,

they grabbed the room key that opens up every room. I literally go, call board meeting.

And even my sister was like, call board meeting, what the hell are you doing?

And I'm like, I think this is Russia.

I had to protect America from the very tools we had nailed, you know?

Every Friday I'd get a threatening email from a ransomware actor, and they were real people.

And they'd say, we're going to hack you this weekend.

And the reason why is because we were preventing payouts.

We'd respond to an intrusion, bottle it up so fast that companies didn't feel they needed to pay the ransom.

So they would threaten us.

And they did break into us, and we'd have to play this whack-a-mole game with them before they could do anything.

What is the worst case scenario? for a cyber attack on U.S. critical infrastructure?

What is the worst case? I'll start with this.

Nobody knows what would happen when the gloves come off.

But on defense, we don't know if we've seen 99% of their capability on offense or 20%.

My gut is it's like 80%.

In other words, they have stuff on the shelf showing they've never deployed.

We haven't seen it yet.

What about water treatment facilities? You're going to have to...

Poison us. Yeah, I think you've got to know more than that.

I think they're going to go for... That's why I said either shutdown or alter.

Shutdown is blunt force. They're just like, we're going to delete everything versus

we're going to change the commands being executed. They're unique per utility.

I think if you go on offense against us,

you just get us to tear ourselves apart.

I think the way I'd go to war with the U.S. is maybe what we're already seeing.

you create division, absolutely, you create discord.

It doesn't matter, you don't even pick a side, you pick all sides, just throw it at us.

I would actually pick the two opposite sides and keep pushing both of them.

It's a tough one. So if I'm on offense against United States, I'm all hearts and minds.

Fake media,

synthetic media,

even if you know it's fake, you won't get it out of your mind, right?

You know, we even have an administration that uses it.

And I think we're gonna have a future where we won't

be able to tell properly between synthetic media and non-synthetic.

As I sit here today, it's never taken longer than a day to break in.

Break into us and see if you can break this

custom application we built, very important application.

They didn't even expect us to do this, but we've done this a lot.

We had an AI agent go out to the. dark web

and go to a bunch of password brokers and all we did

is try to all of them at human speed not AI speed

we just logged in tried all the accounts have found it gets in

seven times but on one of them the app we broke into prompted

you don't have multi-factor authentication turned on would you like to register your phone

so we did so now we literally hacked the company

my stuff was found on the internet you