Speaker 1 0:00

Welcome back to BCX Connects. I am Garith Peck. I'm the managing executive for cybersecurity here at BCX. Every year I typically like to look at what's coming next. Not because I have a crystal ball, but because in cybersecurity, if you wait to react, you're already behind. Over the last few years, many of the top analysts' predictions have come true. You know, the rise of past keys, AI-generated phishing, deep fake scams, and the growing panic about securing AI itself. The pace has been relentless. So today let's look at what's ahead for 2025 and beyond. Some of it is exciting and some of it might be terrifying. And with me on this discussion again, welcome back, Chris Bester. Thank you very much again for joining us.

Speaker 0:54

Thank you, Cody.

Speaker 1 0:56

And today we're gonna talk about you know the exciting, the terrifying, and some of it that will make you wanna throw your laptop out the window and probably move into a cabin in the woods. Um, but but it all matters. So the first segment

Passwords and Passkeys

Speaker 1 1:12

I wanted to just touch on is passwords to pass keys, you know, the end of the password fatigue. I think passwords, um Chris, uh it's it's humanity's longest running bad idea, uh, in my opinion. They've been guessed, reused, written on sticky notes, and leaked in more beaches than we can count. And finally, the the industry is moving on to a large extent. Pass keys, um, we see you know built on the 502 standards, um, those are gaining a lot of traction. But we're also seeing millions already uh in use, you know. Now more websites allow you to use these kind of tools by default. So this isn't just a tech trend, I think it's uh the the thrust shift. So when you think about pass keys replacing passwords, uh what's the biggest challenge you see organizations trying to take this leap?

Speaker 2:07

If you want to uh talk about your common man in the street first, um man is always there there's always a fear of change. They're used to passwords, they're used to having that, and they and they it's it's it's a difficult shift for them to say, okay, and and and people don't understand that um you know a possibilist environment environment is going to be better. Uh for them, I know something. It's my it's my positive, you know. I don't want to move away from that. So that's the the one challenge. Um from a corporate perspective, I don't think you I mean you you have you sit in a position where you can dictate to your to your users. You you can you can lay down the law and you can put those um practices on it.

Speaker 1 2:51

Obviously, I think that there's that element of user behavior that needs to change, you know, very complexity.

Speaker 2:56

Yeah, very much so.

Speaker 1 2:58

And uh yeah, I mean it it for me it's for me it's not uh um it's not the the it's not the technology that's hard. Um it's it's that human habit that we've

Human Habbit

Speaker 1 3:10

spoken about that you know of doing things the old way. But once people experience the bliss of not remembering 47 passwords, I mean they won't go back. I mean I think that's where I see the light at the end of the tunnel when it comes to these new new uh tools. I think um another trend that um and we've spoken about this in our last episode is generative AI, you know, the the new cyber arms race. Um AI isn't coming for your job, like we mentioned previously, but it is coming for your inbox. Uh we're already seeing AI crafted uh phishing messages that are flawless, you know, completely personalized, grammatically correct, and terrifyingly unbelievable. Gone are the days when you can spot uh an attack because the the prince of Nigeria forgot how to spell. So AI can now um you know uh automate reconnaissance, you know, scan for vulnerabilities and uh better write code, you know, including uh exploit code. It's an arms race between good AI and bad AI. So you know that cyber kill chain has just like become a little bit more evolved now with AI uh being being included in as part of the the the you know the the kill chain. Um so how do you see defenders keeping up when uh you know the enemies are now learning the enemy is the learning machine?

Speaker 4:36

It's education and and learning, and and we all learn all the time. Um and and and I found, I mean, I've been in this game for close to 40 years, if not more. Um and and I still learn every single day if you come into this this uh new cyber environment. I mean, it this this constant changes that we have to take in account, and our defenders have to, like I said in our earlier uh episode, you know, you have to almost think like a criminal because you know, you have to think where they're coming from so that you can use the same tools.

Speaker 1 5:16

Use the same assistant defense, yeah.

Speaker 5:18

And and then but you have to also remember that on the other end of the scale, the the uh perpetrator, he they also use AI now to not to target that individual, to to make sure that you get into the psyche of the defender.

Speaker 1 5:36

Yeah. Um so the context of wear protection is is probably also very important from that perspective. But I mean, uh we we can't out-type or out-analyze machines. Um our defense has to be uh just as intelligent, just as fast. Um the future of cyber is humans and machines working side by side, um, not humans cleaning up after them. I think that is that is a thing so uh from from a trend perspective, so definitely number two, AI is definitely on the growing trend. I think it's gonna be there for the foreseeable future. The third trend, you know, that that I've been looking at is things like deep fakes

Defects and Trust

Speaker 1 6:19

and the crisis of trust. Um, deepfakes um used to be fun, you know, people putting their faces on movie clips, you know, my kids used to do that, you know. But now they're deepfake pocket problems. Um we're seeing fake CFOs convincing staffs to to wire $25 million. We've seen those examples of reaches, fake political um robot calls telling voters to stay home, um, even fake uh um videos that uh one day decide uh court cases. It's no longer just a cybersecurity issue, it's a societal one. When we can't trust what we see or hear, verification becomes everything. And and this is where I really like need to like check what kind of safeguards do you think businesses and governments need to put in place to restore that trust in the world where reality can be forged. Because nowadays seeing is not believing.

Speaker 7:18

You're right, seeing is not believing. You and and verification is key. You have to be able to verify everything that you that comes across your desk. And it's a challenge. Um, I mean, like you said, deep faith become now is now becoming so realistic that um even for the trained eye, it's difficult to see which what is right and what is wrong. Um we're coming back to to to governments, uh, governance habits and and and and frameworks, and that's you know, we have to evolve. Yeah our our um from an AI perspective, our governance frameworks is lagging behind uh significantly. Yeah, um, and and it we need that to catch up. Um both from a corporate perspective, from a um a governance, uh government uh perspective and those kind of things. We take the innovation and and and really put it into that.

Speaker 1 8:14

But take a spin back to maybe like um out of corporate space, you know, just from normal data interaction like a citizen. It's almost to the point where you need to be extra skeptical about what you see. You need to always question. You need to really, you know, scrutinize the information that you are seeing, you know. So like I mentioned, you know, uh seeing won't be believing, you know, but uh verifying will be, you know. So the next wave of security for me isn't about protecting data, it's about uh protecting the truth. Because that that is where the the issue is. Okay, I think the fourth trend um that uh um I think we need to discuss is I mean,

Security

Speaker 1 8:54

securing AI. You know, we did speak about AI, but um guarding the guard dogs is is is something that we need to look at. So, like we said, AI is everywhere, and that includes wild, unsanctioned versions hiding in what we call shadow AI. We mentioned this in our previous episode. Um, these are the rogue models that spin up on their own, you know, without security checks, feeding them company data, well, hoping nothing breaks, you know. So shadow AI is definitely a trend. Um, I think um it's the new shadow IT essentially, except now it learns, it adapts, and it might accidentally leak your trade secrets. Uh exactly. I mean, we we spoke about shadow IT. I mean, how how many years, 10-15 years ago, shadow IT was uh was a reality. Um I think how organizations tackle this. I mean, like uh I asked this question previously, you know, should they ban it completely or embrace it responsibly?

Speaker 9:54

Yeah, embrace it responsibly, uh put the guardrails up, and and then uh make sure that whatever the your your shadow IT or use is not a weaponized version of what they think is a clean version.

Speaker 1 10:10

Um because you you like you know you can't stop curiosity. Yeah, you can't. You know what I mean? Uh um the key is that visibility uh and governance. Shadow AI isn't gonna go away. No. I mean, not by any chance. Uh but

Shadow AI

Speaker 1 10:25

it's gonna ban it. No, but with the right controls, I think it doesn't have to be the villain of the story. You know, it it can be a strategic asset.

Speaker 10:33

It uh very much so. I was uh thinking this morning when I was driving uh shadow AI, like I said, if you create a controlled playground for your curious yeah, your curious AI guys, yeah, um, they can come up with innovations and stuff in that environment that they can be super beneficial to your organization. So it's it's if you embrace that, you have to benefit. Correct. But once again, yeah, put the guardrails up and make sure it doesn't become an insider threat.

Speaker 1 11:03

Correct. I think the the fifth trend um that uh we're looking at is quantum computing. I mean the uh the cryptographic countdown as such. You know, so quantum computing is uh uh in the tech uh in the tech world's ticking clock, you know, and it's it's not here yet, um, but when it arrives, uh it it it'll break almost most of today's encryption faster than you can say RSA. Exactly. I mean quantum computing, yeah. I mean, it's it's it's here to an extent, I think. Uh it's there's already some examples of quantum computing put out there, but not on the on the mainstream. But the danger isn't just in the future, it's it's happening now. So attackers already are harvesting encrypted data today, waiting for quantum to uh for quantum computing to mature so they can decrypt it later. So and that's what they call harvest now, decrypt later. Yeah.

Speaker 12:00

That's exactly, and that's scary, and not many people know this. I mean, this harvesting of encrypted data, because I mean they think my data is secure, it's it's it's uh it's totally encrypted, no one can get to it, no one can pick it up. Waiting for uh quantum to pitch up, you know, it's it's that's a scary thing.

Speaker 1 12:24

You know, the the the time to prepare uh is before the clock strikes zero. I think you you won't wait for the ship to sink before you start building the light boards. So I think the fifth uh uh I mean the sixth uh trend is the human factor in

Human Factor

Speaker 1 12:40

the machine world. You know, um as powerful as AI automation becomes, uh cyber will always um come down to the human judgment. We spoke about this in episode one. Uh technology can predict, analyze, and react, but it can't fully understand intent, ethics, and trust. So organizations that win, um the next era will be the ones that combine AI's efficiency with human empathy discipline. Because while AI learns patterns, only people understand consequences. Well, most people. Most people exactly. So I think um in closing, um, so here's where we land in 2025. You know, 2025 won't be defined by one breakthrough or one threat. I think it'll defined by convergence, uh, AI, quantum, human behavior, the intersection, um, uh and and they're intersecting faster than we can legislate or regulate. Uh, our challenge and opportunity is to lead um responsibly in that space and to use technology not to just defend systems but to defend trust. So, Chris, thank you again for joining me on a really interesting episode. And to our listeners, stay sharp, stay curious, and um maybe start remembering fewer passwords. Thank you very much. Thank you.