AI Speeds Ransomware Handoffs to Under a Minute, Hospital CISO Warns

Cyber Security in the Age of AI with Children's Healthcare of Atlanta — Ai4

Ai4

With autonomous threat actors compressing initial access to lateral ransomware movement into under 60 seconds, enterprises must replace manual defense with automated AI containment and digital-twin patching.

AI-assisted summary of Cyber Security in the Age of AI with Children's Healthcare of Atlanta — original source. Check the original for full context.

Source published:

Detailed notes

## Background Published on YouTube by Ai4 on August 21, 2026, this talk features Stoddard Manikin, CISO at Children's Healthcare of Atlanta, presenting insights distilled from a year of collaborative AI cybersecurity roundtables. The session examines how automated attacks and vulnerability surges have reshaped enterprise defense, focusing on the dual pillars of Security of AI and AI for Security.

## TL;DR Manikin establishes a two-pillar defensive model balancing the protection of enterprise AI deployments with the active use of AI to counter autonomous, machine-speed cyber threats. Offensive capabilities have dramatically accelerated, with malicious autonomous agents and initial access brokers compressing compromise-to-exploitation timelines down to sixty seconds while outstripping human patching capacity. In response, organizations must modernize defense by establishing agent registries, deploying AI security gateways, and managing non-human identities under strict least-privilege principles. The discussion concludes with practical deployment strategies, including leveraging digital twins for autonomous patch validation and controlling operational token economics through multi-tier model architectures and ephemeral agent swarms.

## Atmosphere & style The presentation carries the sober, pragmatic urgency of a frontline enterprise security executive speaking candidly to peers rather than an academic theorist. Manikin maintains an unembellished, methodical tone, walking through alarming real-world telemetry—such as collapsing incident timelines and the engineering strain of Project Glasswing—without resorting to sensationalism. The atmosphere shifts naturally from the disquieting scale of automated dark web threats to an empowering, actionable blueprint focused on governance, resilience, and operational engineering.

## Key takeaways - [00:04](https://www.youtube.com/watch?v=P8O5r-9RInM&t=4s) Enterprise AI cybersecurity must be structured around a dual-pillar model: 'security of AI' (protecting models, data, and agents) and 'security by AI' (leveraging AI for defensive capabilities). - [02:21](https://www.youtube.com/watch?v=P8O5r-9RInM&t=141s) The offensive landscape is shifting toward commercialized malicious tooling and autonomous dark web agents that can independently conduct reconnaissance and chain exploits without human intervention. - [04:44](https://www.youtube.com/watch?v=P8O5r-9RInM&t=284s) AI-accelerated vulnerability discovery dramatically outpaces manual engineering capacity, creating a severe remediation deficit across legacy and critical infrastructure codebases. - [04:44](https://www.youtube.com/watch?v=P8O5r-9RInM&t=284s) Initiatives like ARPA-H UPGRADE are testing autonomous defensive agents, self-healing pipelines, and AI guardians to automate patching in operational environments like healthcare. - [07:02](https://www.youtube.com/watch?v=P8O5r-9RInM&t=422s) Initial Access Brokers have collapsed the attack timeline from days to seconds, programmatically capturing MFA-approved sessions and handing them to ransomware affiliates in under a minute. - [07:02](https://www.youtube.com/watch?v=P8O5r-9RInM&t=422s) Because absolute perimeter defense cannot withstand machine-speed adversary attacks, security organizations must prioritize automated containment, operational resilience, and recovery over prevention alone. - [09:42](https://www.youtube.com/watch?v=P8O5r-9RInM&t=582s) Basic cyber hygiene, least privilege, and network segmentation have become essential table stakes to constrain the blast radius of automated attacker scanning. - [09:42](https://www.youtube.com/watch?v=P8O5r-9RInM&t=582s) The rapid growth of non-human identities, such as autonomous AI agents and API integrations, requires centralized agent registries with explicit ownership, scope, and expiration controls. - [09:42](https://www.youtube.com/watch?v=P8O5r-9RInM&t=582s) Dedicated AI gateways serve as critical security barriers by scrubbing sensitive data, masking backend credentials, managing tokens, and enforcing prompt governance. - [09:42](https://www.youtube.com/watch?v=P8O5r-9RInM&t=582s) Defenders can utilize AI-generated digital twins of production systems to safely test, regression-check, and deploy security patches within minutes. - [13:53](https://www.youtube.com/watch?v=P8O5r-9RInM&t=833s) To prevent runaway token billing and budget exhaustion, enterprises should adopt multi-tier model architectures that use smaller, cost-effective models to preprocess prompts before calling frontier reasoning models. - [13:53](https://www.youtube.com/watch?v=P8O5r-9RInM&t=833s) Deploying ephemeral, task-specific agent swarms that instantiate dynamically and terminate immediately optimizes compute efficiency compared to running continuous monolithic systems.

## Detailed walkthrough ### [00:04](https://www.youtube.com/watch?v=P8O5r-9RInM&t=4s) Framing AI Cybersecurity: Security of AI vs. Security by AI

Opening with a quick poll of cybersecurity and media professionals in the room, Stoddard Manikin introduces himself as the CISO at Children's Healthcare of Atlanta and co-founder of the AI Cybersecurity Leaders Forum. Originating as a series of collaborative roundtables in Atlanta bringing together artificial intelligence and cybersecurity leaders across technical and governance tracks, the group distilled over a year of discussions across five events into core operational lessons. While industry taxonomies often complicate the landscape—with Gartner distinguishing between "securing AI" and "AI-powered defense," and LLMs proposing convoluted phrases like "adversarial AI defense and autonomous security operations"—the forum settled on a clear, dual-pillar conceptual model: "security of AI" and "security by AI."

This framework governs how enterprises must structure their defensive posture. Security leaders must simultaneously address the mandate to protect enterprise AI deployments from exploitation, while actively integrating artificial intelligence into their toolchains to defend against both human-driven and machine-speed autonomous attacks.

```mermaid flowchart TD accTitle: Dual Pillars of Enterprise AI Cybersecurity Root["Enterprise AI Cybersecurity"]

Root --> Pillar1["Security OF AI<br/>(Securing AI)"] Root --> Pillar2["Security BY AI<br/>(AI-Powered Defense)"]

Pillar1 --> P1A["Model & Data Protection"] Pillar1 --> P1B["Agent Registries & AI Gateways"] Pillar1 --> P1C["Mitigating Model Abuse & Drift"]

Pillar2 --> P2A["Automated Containment & Triage"] Pillar2 --> P2B["Autonomous Patching via Digital Twins"] Pillar2 --> P2C["Machine-Speed Threat Response"] ```

- **Core Frameworks**: The forum distills technical and governance tracks into two interdependent responsibilities: securing organizational AI deployments and using AI to execute cyber defense. - **Forum Background**: Built over five roundtable sessions in Atlanta uniting cross-functional AI practitioners and enterprise CISOs.

---

[02:21](https://www.youtube.com/watch?v=P8O5r-9RInM&t=141s) The Offensive AI Threat: Dark AI, Weaponization, and Autonomous Agents

The offensive landscape has shifted dramatically through "dark AI" and commercialized malicious tooling such as FraudGPT. Threat actors now leverage LLMs to generate hyper-realistic spear-phishing campaigns, discover zero-day exploits, and execute autonomous network reconnaissance at machine scale. Frontier AI research labs have publicly documented the emerging risk; Anthropic confirmed uncovering instances where autonomous tools were deployed against corporate targets, while guardrail bypasses in frontier models like ChatGPT and Claude continue to surface in threat actor telemetry.

These capabilities create a bifurcated threat: unsophisticated actors can now run advanced, multi-stage campaigns, while sophisticated nation-state and cartel-level hackers use AI as a massive force multiplier. The dark web has mirrored the enterprise software model, evolving from Ransomware-as-a-Service (RaaS) to renting autonomous AI agents that operate without human intervention. When tasked with a malicious objective, these agentic swarms will bypass constraints, chain exploits, and indiscriminately destroy intervening infrastructure.

- **Dark Web Economy**: Malicious AI tooling and autonomous agent rentals have integrated into an underground cybercrime ecosystem whose financial scale "rivals the GDP of a top 30 nation." - **Model De-guardrailing**: Threat actors routinely strip safeguards from frontier models or fine-tune open-source models specifically for exploit payload generation and automated targeting.

---

[04:44](https://www.youtube.com/watch?v=P8O5r-9RInM&t=284s) The Vulnerability Crisis and Project Glasswing

AI-driven discovery has triggered an unprecedented vulnerability management crisis, where discovery volume and velocity completely outpace engineering remediation capacities. Security defenders, particularly in highly regulated and operational environments like healthcare, already struggle with manual patch cycles. When AI is applied to software codebases, it surfaces flaws that have remained hidden for decades or identifies obscure low-severity issues that become critical when chained together in novel permutations.

This imbalance was highlighted during Project Glasswing, an initiative where Anthropic withheld the release of advanced capabilities to provide key critical infrastructure operators early access to identify and remediate zero-days. Participating organizations were forced to pull multiple senior engineering teams off core development, burning thousands of hours attempting to triage and patch the sudden influx of newly exposed vulnerabilities. To bridge this structural deficit, Manikin highlights his participation in the ARPA-H UPGRADE project (Universal Patching and Remediation for Autonomous Defense), partnering with Georgia Tech to deploy autonomous defensive agents and AI guardians across hospital networks.

- **Capacity Deficit**: AI vulnerability discovery velocity operates orders of magnitude faster than human developers can write, regression test, and deploy production patches. - **ARPA-H UPGRADE**: A specialized research initiative testing autonomous self-healing, defensive agents, and rapid remediation pipelines within healthcare delivery networks.

---

[07:02](https://www.youtube.com/watch?v=P8O5r-9RInM&t=422s) Collapsing Attack Timelines: From Days to Minutes

The traditional window between initial compromise and operational response has experienced severe temporal compression. The process of discovering a vulnerability, writing a functional malware payload, and delivering it against an enterprise perimeter has collapsed from days or weeks into minutes. Traditional security metrics like Mean Time to Detect (MTTD), Containment (MTTC), and Remediation (MTTR) are failing under the pressure of automated handoffs between specialized cybercrime entities.

```mermaid flowchart LR accTitle: Collapsing Initial Access Broker Automated Attack Chain A["AI-Crafted Phishing Email"] --> B["Credential Entry & MFA Push Approval"] B --> C["Automated Token Theft"] C --> D["Instant Dark Web IAB Handoff<br/>(Under 60 Seconds)"] D --> E["Ransomware Affiliate Lateral Movement"] ```

Initial Access Brokers (IABs)—who operate as specialized contractors on the dark web—now automate the entire phishing-to-monetization pipeline. In live incidents observed by forum members, a victim clicks a phishing lure, enters credentials, and approves a multi-factor authentication (MFA) push request, only for that authenticated session to be programmatically packaged and handed off to a secondary ransomware affiliate in under sixty seconds. Because prevention cannot guarantee total perimeter defense against determined autonomous adversaries, security organizations must balance "shift-left" strategies with heavy investments in containment, operational resilience, and recovery.

- **Timeline Compression**: The median handoff window from initial credential capture to secondary exploitation has dropped from hours to under a minute. - **Paradigm Shift**: "Today's defenses are no match for tomorrow's attacks"; survival hinges on automated containment and resilient disaster recovery over absolute perimeter prevention.

---

[09:42](https://www.youtube.com/watch?v=P8O5r-9RInM&t=582s) AI Governance, Non-Human Identities, and Automated Response

Basic cyber hygiene—traditionally considered the hallmark of a mature program—is now strictly "table stakes." Weak hygiene is instantly amplified by automated adversary scanning, making granular network segmentation and strict least-privilege access vital blast-radius limiters. The threat surface is further complicated by the explosion of non-human identities (NHIs), where machine accounts, API integrations, and autonomous AI agents navigating enterprise workflows will soon outnumber human employees, creating high-value targets for privilege escalation.

Enterprises should adopt established AI security frameworks from NIST, the Cloud Security Alliance (CSA), and OWASP by implementing centralized agent registries (cataloging ownership, explicit scope, and hard expiration dates) alongside dedicated AI gateways. These gateways enforce token governance, mask system credentials, and block unauthorized data exfiltration. On the defense side, teams must deploy AI for automated containment of anomalous administrative actions and exploit attempts, temporarily freezing suspicious sessions to buy time for human validation. Furthermore, defenders can use AI to stand up "digital twins" of production environments, apply updates, execute automated regression suites, and validate patches in minutes rather than relying on risky manual deployments.

- **Non-Human Identity Explosion**: Autonomous enterprise agents represent volatile identity attack surfaces that require continuous auditing and least-privilege scoping. - **AI Gateway Capabilities**: Intercepts prompt traffic, scrubs sensitive data leaks, isolates backend credentials, and manages token usage across enterprise applications. - **Digital Twin Remediation**: Autonomous environments spin up mirrored staging infrastructure to test, validate, and greenlight security patches without manual intervention.

---

[13:53](https://www.youtube.com/watch?v=P8O5r-9RInM&t=833s) Managing Token Economics and Efficient Orchestration

AI scalability within enterprise security is constrained by the economics of token consumption, with organizations frequently burning through entire annual AI budgets within the first half of the year. Unmanaged, verbose prompts and lack of structural guardrails inflate operational API costs. Security leaders can mitigate this by instituting multi-tier model architectures—such as using small, cost-effective LLMs to refine, filter, and optimize user prompts before passing structured queries to premium frontier reasoning models.

Enterprise efficiency relies more on intelligent orchestration than brute-force raw compute. Mature architectures deploy specialized, task-specific agent swarms that spin up dynamically to perform isolated tasks (such as code reviews or anomaly correlation) and immediately terminate to prevent resource bleed. By combining orchestration pipelines with parameter-efficient fine-tuning techniques like QLoRA for domain-specific models, organizations can enforce strict token budgeting while scaling defensive automation.

- **Economic Optimization**: Implementing parameter constraints (such as forcing response length limits) and using smaller intermediate models to optimize prompts prevents runaway token billing. - **Ephemeral Agent Swarms**: Architecting systems to dynamically instantiate and destroy task-oriented AI agents controls compute costs compared to running continuous, monolithic models. - **Community Engagement**: Manikin closes by inviting security leaders to participate in ongoing roundtables through the AI Cybersecurity Leaders Forum on LinkedIn.

## Notable quotes > [00:04](https://www.youtube.com/watch?v=P8O5r-9RInM&t=4s) security of AI — Stoddard Manikin

> [00:04](https://www.youtube.com/watch?v=P8O5r-9RInM&t=4s) security by AI — Stoddard Manikin

> [00:04](https://www.youtube.com/watch?v=P8O5r-9RInM&t=4s) adversarial AI defense and autonomous security operations — Stoddard Manikin

> [02:21](https://www.youtube.com/watch?v=P8O5r-9RInM&t=141s) rivals the GDP of a top 30 nation — Stoddard Manikin

> [07:02](https://www.youtube.com/watch?v=P8O5r-9RInM&t=422s) Today's defenses are no match for tomorrow's attacks — Stoddard Manikin

> [09:42](https://www.youtube.com/watch?v=P8O5r-9RInM&t=582s) table stakes — Stoddard Manikin

> [00:04](https://www.youtube.com/watch?v=P8O5r-9RInM&t=4s) securing AI — Stoddard Manikin

> [00:04](https://www.youtube.com/watch?v=P8O5r-9RInM&t=4s) AI-powered defense — Stoddard Manikin

## Mentioned Stoddard Manikin, Children's Healthcare of Atlanta, AI Cybersecurity Leaders Forum, Gartner, FraudGPT, Anthropic, ChatGPT, Claude, Project Glasswing, ARPA-H, UPGRADE, Georgia Tech, NIST, Cloud Security Alliance (CSA), OWASP, QLoRA, LinkedIn

## Video description Stoddard Manikin - CISO, Children's Healthcare of Atlanta

Hear about the key insights and themes from 1 year of AI cyber security roundtables held in Atlanta. AI has dramatically changed the cyber security landscape. Automated attacks, novel attacks, and a landslide of new vulnerabilities raise the stakes of securing the enterprise. This talk will discuss the two primary use cases of Security for AI and AI for Security.

[Source](https://www.youtube.com/watch?v=P8O5r-9RInM)

中文简报

医院CISO警告：AI将勒索软件移交缩短至一分钟内 随着自主威胁行为体将从初始访问到横向勒索软件移动的时间压缩至60秒以内，企业必须以自动化AI遏制和数字孪生打补丁取代人工防御。 Manikin构建了一个双支柱防御模型，既平衡了对企业AI部署的保护，又积极利用AI对抗自主且具备机器速度的网络威胁。攻击能力已显著加速，恶意自主智能体和初始访问代理将从入侵到利用的时间线压缩至60秒，同时远远超出了人工修复补丁的能力。对此，各类组织必须推进防御现代化，建立智能体注册库、部署AI安全网关，并在严格的最小权限原则下管理非人类身份。讨论最后给出了切实可行的部署策略，包括利用数字孪生进行自主补丁验证，并通过多层模型架构和临时智能体集群来控制运行时的Token经济成本。 企业AI网络安全必须围绕双支柱模型构建：“AI的安全”（保护模型、数据和智能体）与“以AI赋能安全”（利用AI提升防御能力）。 (0:04) 攻击态势正在转向商业化恶意工具与暗网自主智能体，它们无需人工干预即可独立进行侦察并组合利用链漏洞。 (2:21) AI加速的漏洞挖掘显著超出了人工工程能力，在遗留系统和关键基础设施代码库中造成了严重的修复赤字。 (4:44) 诸如ARPA-H UPGRADE等举措正在测试自主防御智能体、自愈流水线和AI守卫，以在医疗等业务环境中实现补丁自动化。 (4:44) 初始访问代理已将攻击时间线从数天压缩至数秒，能以程序化方式捕获经MFA批准的会话，并在不到一分钟内移交给勒索软件分支机构。 (7:02)

Reading summary

Stoddard Manikin, CISO at Children's Healthcare of Atlanta, argues that enterprise cybersecurity must navigate a dual mandate—protecting AI systems while deploying AI-driven defense—as autonomous threats compress attack lifecycles beyond human response capabilities. Dual Mandate and Non-Human Identity Governance (0:04) Synthesizing findings from the AI Cybersecurity Leaders Forum, Manikin divides organizational posture into two core operational pillars: "security of AI" (safeguarding models, data, and pipelines from exploitation) and "security by AI" (deploying automated, machine-speed defenses). This posture must adapt to an influx of non-human identities (NHIs), including autonomous enterprise agents and API integrations, which will soon outnumber human staff. Manikin warns that unmanaged NHIs expand the attack surface and introduce significant privilege escalation risks. To manage this exposure, organizations are adopting frameworks from NIST, the Cloud Security Alliance, and OWASP. Practical implementations rely on centralized agent registries that enforce explicit operational scopes, ownership records, and hard expiration dates. In parallel, enterprises are deploying dedicated AI gateways to intercept prompt traffic, mask backend credentials, prevent proprietary data exfiltration, and meter token usage across internal applications. Collapsing Attack Lifecycles and Autonomous Threats (2:21) Offensive operations have evolved as threat actors leverage "dark AI" platforms like FraudGPT, strip guardrails from commercial models, and fine-tune open-source architectures to generate zero-days and automated reconnaissance swarms. Manikin notes that dark web tooling has mirrored commercial software-as-a-service models, renting autonomous agentic swarms within an illicit ecosystem whose financial scale rivals the GDP of a top-30 nation. Frontier AI labs, including Anthropic, have already detected autonomous offensive tools targeting enterprise systems. This automation has severely compressed intrusion timelines. Initial Access Brokers (IABs) on the dark web now automate the pipeline from spear-phishing credential harvesting and MFA bypass directly to secondary monetization. In incidents documented by forum participants, victims approving MFA prompts have had their authenticated sessions packaged and handed off to ransomware affiliates in under 60 seconds. Because conventional perimeter defenses cannot reliably halt attacks moving at this velocity, Manikin emphasizes that organizations must shift resources from absolute prevention toward automated containment and operational resilience. Remediation Deficits and Autonomous Defensive Infrastructure (4:44) AI-assisted vulnerability discovery has created an acute remediation bottleneck, surfacing software defects far faster than human engineers can patch them. This disparity was demonstrated during Project Glasswing, an initiative in which Anthropic granted critical infrastructure operators early access to advanced capabilities to identify zero-days; participating organizations burned thousands of engineering hours attempting to triage and patch the sudden influx of exposed vulnerabilities. In operational environments like healthcare, manual patch cycles cannot match this discovery rate. To counter the deficit, Manikin points to his participation in the ARPA-H UPGRADE program with Georgia Tech, which deploys autonomous defensive agents and AI guardians across hospital networks. Defenders are using these systems to generate "digital twins" of live environments, allowing automated pipelines to stage infrastructure, apply updates, run full regression testing suites, and validate patches in minutes without risking production downtime. Token Economics and Dynamic Model Orchestration (13:53) Scaling AI defenses introduces severe cost challenges, with enterprises frequently exhausting their annual AI token budgets within the first half of the year due to unoptimized prompts and inefficient architectures. Manikin argues that defensive resilience requires economic optimization rather than brute-force reliance on expensive frontier models. Defenders can control operational overhead by adopting multi-tier architectures. Smaller, parameter-constrained LLMs or specialized models fine-tuned via QLoRA can pre-filter, scrub, and structure queries before passing them to premium reasoning engines. Additionally, organizations are structuring defense through ephemeral, task-specific agent swarms that spin up dynamically to execute targeted actions—such as anomalous administrative session containment or code reviews—and terminate immediately upon completion to avoid continuous compute drain. As offensive toolsets transition to autonomous agents operating in sub-minute windows, traditional security metrics like MTTD and MTTR are becoming obsolete. While autonomous digital twins and agentic triage offer a viable counterweight, enterprise survivability will depend on whether organizations can structurally govern proliferating machine identities and control the computational economics of continuous defensive AI.

精炼阅读摘要

亚特兰大儿童医院（Children's Healthcare of Atlanta）CISO Stoddard Manikin 指出，人工智能正以机器级速度重构网络攻防格局；企业安全体系必须围绕“AI 自身的安全（Security of AI）”与“利用 AI 驱动安全防御（Security by AI）”双支柱展开演进，重点强化自动化遏制与韧性恢复能力。 双支柱框架与攻防新格局 (0:04) 基于 AI 网络安全领袖论坛（AI Cybersecurity Leaders Forum）跨越五场圆桌会议的讨论成果，Manikin 提出应对现代威胁必须统筹“AI 自身的安全”与“利用 AI 驱动安全防御”这两大核心支柱。前者强调管控企业内部模型资产、防范模型滥用与数据泄露；后者则侧重将人工智能深度嵌入检测、补丁修补与威胁响应工具链中，抵御日益自动化的高速攻击。 进攻端威胁已因“暗黑 AI”（Dark AI）与 FraudGPT 等商业化恶意工具的普及而急剧升级。黑客不仅利用大语言模型自动生成高仿真鱼叉式钓鱼邮件并挖掘零日漏洞，还发展出由自动化智能体（Agent）组成的协作集群。前沿 AI 实验室 Anthropic 已公开证实，曾监测到自主化工具被直接投放针对企业目标的攻击中；同时暗网生态逐渐向自主 AI 智能体租赁模式演进，其经济规模据称已可与全球排名前 30 位的国家 GDP 相提并论。 漏洞爆发与攻击时间窗口压缩 (4:44) AI 辅助代码审计正在引发严峻的漏洞管理危机。AI 挖掘漏洞的规模与速度远远超过了人类工程团队的修复能力，不仅能翻出隐藏数十年的旧缺陷，还能将低危漏洞排列组合形成致命攻击链。在 Project Glasswing 项目中，Anthropic 曾提前向关键基础设施运营者提供前沿能力以协助排查零日漏洞，结果导致多支资深工程团队不得不暂停主营业务，耗费数千工时紧急修补激增的安全缺陷。为弥补防御能力的结构性缺口，医疗行业正联合佐治亚理工学院推进 ARPA-H UPGRADE 项目，测试自愈型防御智能体与自动化修复流水线。 与此同时，网络入侵各环节之间的时间窗口正经历极端压缩。以往从发现漏洞、编写攻击载荷到突破企业边界需要数天或数周，如今已被缩短至数分钟之内。论坛成员观测到的实网事件显示，初始访问经纪人（IAB）已将攻击链全自动化：受害者点击钓鱼凭证并完成多因子认证（MFA）推送审批后，会话凭证可在 60 秒内被打包转售并移交给勒索软件分支组织。传统度量指标如检测平均时间（MTTD）和遏制平均时间（MTTC）在自动化攻防面前受到极大挑战。 非人类身份管控与数字孪生修复 (9:42) 自动化恶意扫描使得基础网络卫生机制（如细粒度网络分段与最小权限原则）从加分项变为生存底线。随着工作流中机器账户、API 集成和企业智能体的激增，非人类身份（NHI）的数量预计很快将超过人类员工，进而成为权限提升的核心目标。防御方应依托 NIST、云安全联盟（CSA）及 OWASP 框架，建立集中式智能体注册库（强制规定所有权、访问范围与硬性到期日），并部署 AI 网关来截获提示词、脱敏系统凭据及防止数据外泄。 在防御响应方面，安全团队需要引入 AI 对异常管理指令进行自动化遏制，通过临时冻结存疑会话为人工研判争取时间。此外，防御方能够利用 AI 快速构建生产环境的“数字孪生”（Digital Twins），在隔离环境中自动执行补丁应用、自动化回归测试并验证更新，将以往耗时漫长且高风险的人工补丁验证流程压缩至数分钟。 Token 经济学与防御编排优化 (13:53) 企业安全自动化在实际落地中受到 Token 消耗成本的严重约束，部分机构甚至在开年上半年即耗尽全年 AI 预算。冗长无约束的提示词输入和治理规范的缺失容易引发 API 调用费用失控。安全架构师可通过分层模型策略进行成本平抑，例如先采用轻量、低成本的模型清洗并优化用户提示词，再将其送入昂贵的高阶前沿推理模型进行复杂运算。 除分层调用外，成熟架构更依赖于敏捷的任务编排而非单纯堆叠计算算力。企业可构建面向特定任务的临时智能体集群（如专门执行代码审计或异常关联分析），在任务结束时立即注销销毁以避免资源浪费；结合 QLoRA 等参数高效微调技术开发领域专用模型，既能严控 Token 预算，又能实现防御自动化的规模化扩展。 Manikin 强调“今天的防线难以抵挡明天的攻击”，在自动化攻击者面前，单纯依靠边界防御的理念已不可持续，企业必须转向以自动化遏制、数字孪生修复与业务韧性恢复为核心的新型安全体系；未来该领域的关键挑战在于平衡智能体响应速度与算力成本支出之间的矛盾。

Detailed notes — zh

## Background 本视频由 Ai4 于 2026 年 8 月 21 日发布在 YouTube 平台上。内容为亚特兰大儿童医疗中心（Children's Healthcare of Atlanta）首席信息安全官 Stoddard Manikin 的主题演讲，主要分享了亚特兰大 AI 网络安全领袖圆桌论坛一周年以来的核心洞察，探讨 AI 如何深刻重构网络安全格局以及“保护 AI”与“AI 赋能安全”两大关键命题。 ## TL;DR 演讲指出暗黑 AI 武器化与自主攻击 Agent 已将网络渗透全流程压缩至分钟级，漏洞爆发速度远超人工修复极限，促使防御战略从前置拦截转向快速遏制与系统自愈。针对非人类身份泛滥的风险，企业需建立 Agent 资产台账与流量网关，并利用数字孪生环境实现自动化的补丁验证与部署。同时，安全团队必须警惕 Token 经济学带来的成本危机，通过提示词优化、模型分级调用与动态 Agent 编排来控制开销。最终，企业必须同时贯彻“利用 AI 抵御威胁”与“保护组织内部 AI 资产”的双轨防御体系。 ## Atmosphere & style 演讲展现出务实、沉稳且兼具紧迫感的专业基调。主讲人以资深 CISO 的一线视角切入，既客观剖析了机器规模攻击对传统安全防线的毁灭性冲击，又没有陷入单纯的焦虑渲染，而是条理清晰地给出了数字孪生、网关治理与成本控制等可落地的工程解法。整场分享节奏明快、逻辑严密，让听众在感受到智能攻防时代紧迫节奏的同时，获得极具指导价值的防御战略指引。 ## Key takeaways - [00:04](https://www.youtube.com/watch?v=P8O5r-9RInM&t=4s) AI 与网络安全的核心交集可划分为两个基本维度：保护组织内部署的 AI 与智能体（Security of AI），以及运用 AI 技术防御外部恶意威胁（Security by AI）。 - [02:21](https://www.youtube.com/watch?v=P8O5r-9RInM&t=141s) 进攻端暗黑 AI 工具（如 FraudGPT）及去护栏模型的泛滥，让攻击者能够在机器规模（Machine Scale）下实现全自动钓鱼、内网拓扑测绘与漏洞利用。 - [02:21](https://www.youtube.com/watch?v=P8O5r-9RInM&t=141s) 具备自主目标的攻击型 AI Agent 正在崛起，暗网更衍生出产业化的“Agent 租赁服务”，助推网络犯罪经济规模膨胀至堪比全球前 30 大经济体的 GDP。 - [04:44](https://www.youtube.com/watch?v=P8O5r-9RInM&t=284s) AI 漏洞挖掘在“发现数量”与“发现速率”上均已打破工程极限，老旧弱点被 AI 串联成新型攻击链，导致传统补丁窗口期急剧压缩甚至失效。 - [04:44](https://www.youtube.com/watch?v=P8O5r-9RInM&t=284s) 医疗与科研界正推进类似 ARPA-H UPGRADE 的主动防御项目，探索在医院复杂网络中引入自主 AI 系统以实现补丁自动化生成与修补。 - [07:02](https://www.youtube.com/watch?v=P8O5r-9RInM&t=422s) 攻击链路经历极限压缩，暗网初始访问经纪人（IAB）将窃取的会话凭据自动化交接给下游勒索软件团伙的平均用时已缩减至 1 分钟以内。 - [07:02](https://www.youtube.com/watch?v=P8O5r-9RInM&t=422s) 单靠前置拦截与“安全左移”已无法抵御自动化突破，防御战略重心必须转移到以“遏制”（Containment）和“快速恢复”（Recovery）为核心的网络韧性建设。 - [09:42](https://www.youtube.com/watch?v=P8O5r-9RInM&t=582s) 以 Agent 服务账号为代表的非人类身份（NHI）数量激增，企业需引入 Agent 资产台账明确归属及权限，并通过专用流量网关管控敏感数据与 Token 开销。 - [09:42](https://www.youtube.com/watch?v=P8O5r-9RInM&t=582s) 面对 AI 驱动的高速渗透，企业防御系统必须具备秒级自动化遏制能力，在检测到异常高危行为瞬间先行隔离阻断，为人工二次研判争取时间。 - [12:47](https://www.youtube.com/watch?v=P8O5r-9RInM&t=767s) 利用 AI 快速构建目标系统的“数字孪生”（Digital Twin）环境，能够在隔离仿真中完成补丁的端到端回归测试与自动部署，消除传统无测试盲推的风险。 - [13:52](https://www.youtube.com/watch?v=P8O5r-9RInM&t=832s) 应对 AI Token 预算失控危机需建立精细化提示词工程，并采用“低成本小模型提炼优化 Prompt，再交付昂贵大模型执行”的分级调用架构。 - [13:52](https://www.youtube.com/watch?v=P8O5r-9RInM&t=832s) 在架构层面采用按需动态启停的 AI 智能体集群（AI Swarms），并结合 QLoRA 等轻量级微调技术，能大幅降低长期算力开销与 Token 成本。 ## Detailed walkthrough ### [00:04](https://www.youtube.com/watch?v=P8O5r-9RInM&t=4s) 亚特兰大圆桌论坛背景与 AI 安全的双重维度 演讲者 Stoddard Manikin 是亚特兰大儿童医疗中心（Children's Healthcare of Atlanta）的首席信息安全官（CISO），同时也是 AI 网络安全领袖论坛（AI Cyber Security Leader Forum）的联合发起人。在开场与观众互动确认现场的安全专业人员与媒体背景后，他介绍了该论坛的背景：该组织自去年在亚特兰大发起，旨在汇集 AI 领域与网络安全领域的专业人才，迄今已举办了至少 5 场专题圆桌研讨活动。 在最初探讨技术路线与治理架构时，论坛划分了许多细分领域，但最终发现所有议题实质上都高度聚焦于两个核心维度——行业内常表述为“AI 的安全”（Security of AI）与“利用 AI 的安全”（Security by AI）。分析机构 Gartner 将其概括为“保护 AI”（Securing AI）与“AI 驱动型防御”（AI Powered Defense）；某知名大语言模型则给出了极为冗长的建议：“对抗性 AI 防御与自主安全运营”（Adversarial AI Defense and Autonomous Security Operations）。论坛最终确立了简练清晰的二元定义：一方面是保护组织正在推广落地的 AI 系统，另一方面则是利用 AI 技术抵御来自人类黑客或自主恶意实体的各类型威胁。 ```mermaid flowchart TD accTitle: AI与网络安全的双向交互架构 subgraph S1["AI 与网络安全的两大核心主题"] A["AI 的安全 (Security of AI / 保护 AI)"] B["利用 AI 的安全 (Security by AI / AI 赋能防御)"] end subgraph S2["防护与赋能目标"] C["保护组织内落地部署的 LLM 及 Agent 系统"] D["抵御人类黑客与自动化/自主恶意威胁"] end A --> C B --> D ``` --- ### [02:21](https://www.youtube.com/watch?v=P8O5r-9RInM&t=141s) 暗黑 AI 武器化与自主攻击 Agent 的崛起 随着 AI 技术的演进，暗黑网络世界的恶意武器化（Dark AI Weaponization）正在颠覆网络攻防对抗的格局。进攻端涌现出了诸如 FraudGPT 等恶意工具，攻击者利用它们在机器规模（Machine Scale）下自动生成极具欺骗性的钓鱼邮件、挖掘零日漏洞（Zero-day exploits）、全自动扫描绘制目标内网拓扑。媒体与前沿实验室的报告频频印证这种威胁：Anthropic 公布了其工具首次被用于对企业发起自主攻击的案例，OpenAI 与 Anthropic 亦相继在日志审查中确认了模型突破安全护栏（Guardrails）被用于违规操作的事件。 这种转变带来双重威胁：一方面使低水平攻击者拥有发起高级攻击的能力；另一方面更让专业黑客如虎添翼，将 AI 视作力量倍增器（Force multiplier）加速渗透。更为致命的是具有自主目标的 AI Agent：它们为了达成预设的攻击目标，可能会不顾后果地破坏沿途的一切系统组件。很多攻击者不仅剥离了主流前沿模型的内置安全限制，还广泛使用毫无护栏的开源模型。暗网甚至衍生出了“AI Agent 租赁服务”，如同当年的“勒索软件即服务”（Ransomware as a Service, RaaS）一样形成了高度产业化的地下经济链，其整体犯罪规模与涉案金额已堪比全球前 30 名经济体的 GDP。 - **恶意专用工具**：诸如 FraudGPT 等攻击工具让钓鱼攻击与漏洞利用全面自动化。 - **安全护栏失控**：主流商业前沿模型与开源模型在黑客手中被逆向、越狱或去护栏化运行。 - **暗网商业生态**：AI Agent 作为新型租赁服务出现，助推网络犯罪产业规模迅速膨胀。 --- ### [04:44](https://www.youtube.com/watch?v=P8O5r-9RInM&t=284s) 漏洞爆炸与应急修复的“速度失衡” AI 在漏洞挖掘领域的爆发，正在以远超企业工程修复能力的速度重构漏洞管理。当前安全防御面临两大严峻失衡：**漏洞发现的数量（Discovery Volume）超过了工程承载力**，**漏洞发现的速率（Discovery Velocity）快于补丁的开发与部署周期**。这使得防御方本就吃紧的补丁窗口期（Patch windows）被极度压缩，软件厂商写不出补丁，企业安全团队也根本来不及部署上线。 在 Anthropic 推进 Project Glasswing 并暂缓发布 Mythos 模型期间，该能力被共享给数家互联网核心基础设施机构以协助排查零日漏洞。这些组织抽调了大量资深工程师、投入数千小时，挖掘出了埋藏在代码库中超过十年、或原本因无法单点触发而被忽视的漏洞；然而在 AI 的组合串联下，这些老旧缺陷被编织成了全新的危险攻击链。全球没有任何一支工程团队能单靠人力跟上 AI 寻找漏洞的脚步。针对这一困境，医疗领域正在联合学术界展开主动防御研究，例如参与 ARPA-H（高级健康研究计划局）名为 UPGRADE（Universal Patching and Remediation for Autonomous Defense，自主防御通用补丁与修复）的科研项目，与佐治亚理工学院（Georgia Tech）等机构合作，探索在医院网络中部署自主 AI 防御系统的可行性。 --- ### [07:02](https://www.youtube.com/watch?v=P8O5r-9RInM&t=422s) 攻击周期急速压缩与防御重心的战略位移 网络攻击的时间线正经历前所未有的极限压缩。以往从漏洞发现、载荷编写、武器化到发起攻击可能耗时数天，现在 AI 驱动的自动化工具可在短短数分钟内完成全套流程。与此同时，黑客生态分工更加精细，暗网中甚至出现了专门的“初始访问经纪人”（Initial Access Broker, IAB）这一职业岗位。 在典型的社工钓鱼攻击中，受害者点击钓鱼链接、输入凭证甚至误点了多因素认证（MFA）确认请求后，初始访问经纪人将窃取的会话凭据转手交付给勒索软件团伙等下游组织的平均时间（Median Time），已经从过去以小时计压缩到了“1 分钟以内”，实现了端到端的自动化流转。面对瞬息万变的威胁，传统安全防御单纯强调“左移”（Shift-Left）和前置拦截的策略已无法独木支柱；组织必须将核心防御重心转移至**遏制（Containment）与快速恢复（Recovery）**，在假定必被突破的前提下提升业务系统的网络韧性（Resilience）。 ```mermaid flowchart LR accTitle: 攻击全流程时间极速压缩示意图 subgraph AttackChain["自动化攻击链路（分钟级完成）"] V["AI 发现漏洞/零日漏洞"] P["自动生成恶意 Payload"] A["自动化投放与入侵"] end subgraph AccessBroker["凭据交接链（<1 分钟）"] F["钓鱼欺诈 / 绕过多因素认证"] IAB["初始访问经纪人 (IAB)"] R["下游勒索软件团伙 / 深度渗透"] end AttackChain --> F F --> IAB IAB --> R ``` --- ### [09:42](https://www.youtube.com/watch?v=P8O5r-9RInM&t=582s) AI 时代的安全卫生底线与自动化遏制机制 在 AI 攻击肆虐的环境下，基础网络安全卫生（Cyber Hygiene）不再是衡量安全体系成熟度的高级指标，而是入局对抗的“基础筹码”（Table stakes）。最小权限原则（Least Privilege）和网络微隔离（Network Segmentation）等经典控制措施对于限制 AI 攻击的爆炸半径（Blast Radius）至关重要。当前网络环境中的非人类身份（Non-Human Identities, NHI）数量正在迅速超过人类用户，各类驱动 AI Agent 工作流的服务账号已成为黑客重点攻击的目标。 为了规范 AI 与 Agent 的安全性，行业普遍建议遵循云安全联盟（CSA）、OWASP 以及 NIST 等机构发布的权威控制框架，重点部署两项关键机制： 1. **Agent 资产台账（Agent Registry）**：明确内网中每一个自主 Agent 的责任归属人（Owner）、运行权限范围（Scope）与强制失效日期（Expiration dates）。 2. **Agent 流量网关（Agentic Gateway）**：针对 AI Agent 进出流量进行集中代理，具备阻断数据泄漏、拦截攻击、隐藏登录凭证以及管理 Token 消耗等多重治理功能。 此外，针对分秒必争的渗透速度，企业必须实现**利用 AI 进行自动化响应与遏制（Automated Containment）**。当系统检测到可疑入侵流量或高权限管理员出现异常但合规的活动（Anomalous safe behavior）时，AI 防御系统应在第一时间自动实施临时隔离阻断，为安全分析师争取宝贵的核实时间，从而真正实现“用 AI 对抗 AI”。 - **非人类身份泛滥**：驱动 AI 工作流的 Agent 成为新型高危资产，需纳入统一身份安全治理。 - **标准治理框架**：采纳 CSA、OWASP、NIST 指南，落实 Agent 注册制与专用流量网关。 - **秒级自动遏制**：在误报或异常行为发生瞬间先行隔离，由安全分析师进行二次研判与电话核实。 ### [12:47](https://www.youtube.com/watch?v=P8O5r-9RInM&t=767s) 利用自主代理与数字孪生实现自动化遏制与自愈打补丁 网络安全防御者必须在防御体系中建立验证机制，并逐步放权给自主智能体（Autonomous Agents）去执行特定操作，尤其是在威胁遏制（Containment）与系统自愈（Self-healing）方面。例如在漏洞修补场景中，传统模式往往效率低下且风险极高——补丁需要进入工单队列等待人工处理，很多团队甚至没有现成的测试环境，有时只能硬着头皮在“凌晨两点直接推到生产环境，祈祷千万别出故障”。 借助 AI 技术，整个补丁修复与验证流程可以被彻底重塑。防御者可以利用 AI 快速搭建目标系统的“数字孪生”（Digital Twin）环境，自动部署最新的安全补丁并在隔离环境中运行完整的回归测试。在 AI 收集到所有测试证据、确认补丁完全安全有效后，再将其一键部署到生产环境中。这种全自动化的流程不仅大幅压缩了处置周期，更成为抵御恶意攻击者的关键手段——面对利用 AI 发起高速攻击的对手，“借助 AI 跟上攻击者的节奏，是解决时间差距的唯一途径”。 ```mermaid flowchart TD accTitle: AI-Driven Automated Patching and Digital Twin Flow subgraph TwinEnv ["数字孪生与测试环境"] A["创建生产系统的数字孪生"] --> B["自动应用最新补丁"] B --> C["执行自动化回归测试与验证"] end subgraph DeployEnv ["生产与部署"] C --> D{"验证是否通过？"} D -- 是 --> E["自动安全部署至生产环境"] D -- 否 --> F["生成拦截日志与回滚报告"] end ``` - **威胁遏制与自愈**：赋予 AI 代理在安全事件发生时自动隔离受感染节点、执行修复操作的权限。 - **数字孪生测试**：避免传统的无测试盲推或低效排队，通过 AI 动态拉起仿真环境进行端到端验证。 - **应对时间差**：攻击方已全面利用 AI 加速渗透，防御方必须用同等或更快的自动化速度进行防御响应。 --- ### [13:52](https://www.youtube.com/watch?v=P8O5r-9RInM&t=832s) Token 经济学：提示词优化与多智能体编排控本策略 在引入大语言模型（LLM）时，安全团队必须高度警惕“Token 经济学”（Token Economics）所带来的成本失控风险。近期不少技术主管公开表示，由于消耗了海量 Token，企业全年的 AI 预算在今年上半年就已经被意外耗尽。为了防止成本爆炸，企业不能“一刀切”地使用同一种高昂模型处理所有任务，而需要建立分层分级的模型调用与工程优化机制。 提示词工程（Prompt Engineering）是控制成本极其有效却常被忽视的手段。许多企业内部员工编写的 Prompt 极为低效且不经济——缺少明确的约束条件、没有设定输出长度限制（例如未限定“仅提供 5 条结果”）。针对这一问题，团队可以通过“分级调用”策略，先让廉价的小型 LLM 辅助优化并提炼 Prompt，再将精简高效的指令发送给昂贵的高性能模型处理。 此外，在系统架构层面，灵活的编排（Orchestration）远比堆砌原始算力更重要。团队应当按需动态拉起针对特定任务的 AI 智能体集群（AI Swarms），在任务执行完毕后立即销毁，以此最大化节约 Token 和计算资源。部分成员还利用 QLoRA 等小模型微调工具，对轻量级开源模型进行专门调优，以极低成本满足特定安全场景的需求。 - **预算危机**：部分技术负责人在上半年就烧光了全年的 AI Token 预算，成本治理刻不容缓。 - **Prompt 经济学**：增加参数约束、限制返回条数，用低成本模型优化提示词以降低昂贵模型的消耗。 - **动态编排与 AI Swarms**：根据任务按需生成并销毁专用智能体，降低常驻计算开销。 - **轻量微调**：借助 QLoRA 等低秩微调技术改造小模型，替代直接调用高昂的商业通用大模型。 --- ### [15:54](https://www.youtube.com/watch?v=P8O5r-9RInM&t=954s) 总结：在时效、规模与成本的新时代捍卫企业安全 AI 的浪潮正在从时效（Timing）、规模（Scale）与成本（Costs）等多个维度对网络安全格局带来前所未有的深刻冲击。面对这一全新挑战，安全团队的核心任务可以概括为两点：“利用 AI 防御 AI”（AI for Security），以及“像保护其他核心业务资产一样保护 AI 自身”（Security for AI）。Stoddard Manikin 在演讲最后呼吁广大技术管理者与从业者持续交流实践经验，共同探索智能时代的防御之道。 - **双重使命**：既要善用 AI 技术对抗恶意自动化攻击，也要将企业内部的 AI 系统与数据纳入核心安全防护范畴。 - **行业交流**：欢迎关注并加入领英上的“AI Cyber Leaders Forum”，在会后持续探讨 AI 网络安全的前沿实践。 ## Notable quotes > [00:04](https://www.youtube.com/watch?v=P8O5r-9RInM&t=4s) 对抗性 AI 防御与自主安全运营 — Stoddard Manikin > [02:21](https://www.youtube.com/watch?v=P8O5r-9RInM&t=141s) 暗黑网络世界的恶意武器化正在颠覆网络攻防对抗的格局 — Stoddard Manikin > [04:44](https://www.youtube.com/watch?v=P8O5r-9RInM&t=284s) 漏洞发现的数量超过了工程承载力，漏洞发现的速率快于补丁的开发与部署周期 — Stoddard Manikin > [04:44](https://www.youtube.com/watch?v=P8O5r-9RInM&t=284s) 全球没有任何一支工程团队能单靠人力跟上 AI 寻找漏洞的脚步 — Stoddard Manikin > [07:02](https://www.youtube.com/watch?v=P8O5r-9RInM&t=422s) 将窃取的会话凭据转手交付给勒索软件团伙等下游组织的平均时间，已经从过去以小时计压缩到了1 分钟以内 — Stoddard Manikin > [09:42](https://www.youtube.com/watch?v=P8O5r-9RInM&t=582s) 基础网络安全卫生不再是衡量安全体系成熟度的高级指标，而是入局对抗的基础筹码 — Stoddard Manikin > [12:47](https://www.youtube.com/watch?v=P8O5r-9RInM&t=767s) 凌晨两点直接推到生产环境，祈祷千万别出故障 — Stoddard Manikin > [12:47](https://www.youtube.com/watch?v=P8O5r-9RInM&t=767s) 借助 AI 跟上攻击者的节奏，是解决时间差距的唯一途径 — Stoddard Manikin > [15:54](https://www.youtube.com/watch?v=P8O5r-9RInM&t=954s) 利用 AI 防御 AI，以及像保护其他核心业务资产一样保护 AI 自身 — Stoddard Manikin ## Mentioned Stoddard Manikin, 亚特兰大儿童医疗中心 (Children's Healthcare of Atlanta), AI 网络安全领袖论坛 (AI Cyber Security Leader Forum), Gartner, FraudGPT, Anthropic, OpenAI, Project Glasswing, Mythos, ARPA-H, UPGRADE, 佐治亚理工学院 (Georgia Tech), 初始访问经纪人 (Initial Access Broker, IAB), 云安全联盟 (CSA), OWASP, NIST, QLoRA, LinkedIn ## Video description Stoddard Manikin - CISO, Children's Healthcare of Atlanta Hear about the key insights and themes from 1 year of AI cyber security roundtables held in Atlanta. AI has dramatically changed the cyber security landscape. Automated attacks, novel attacks, and a landslide of new vulnerabilities raise the stakes of securing the enterprise. This talk will discuss the two primary use cases of Security for AI and AI for Security. [Source](https://www.youtube.com/watch?v=P8O5r-9RInM)

Source quotes

[0:04] Stoddard Manikin: 对抗性 AI 防御与自主安全运营 [2:21] Stoddard Manikin: 暗黑网络世界的恶意武器化正在颠覆网络攻防对抗的格局 [4:44] Stoddard Manikin: 漏洞发现的数量超过了工程承载力，漏洞发现的速率快于补丁的开发与部署周期 [4:44] Stoddard Manikin: 全球没有任何一支工程团队能单靠人力跟上 AI 寻找漏洞的脚步 [7:02] Stoddard Manikin: 将窃取的会话凭据转手交付给勒索软件团伙等下游组织的平均时间，已经从过去以小时计压缩到了1 分钟以内 [9:42] Stoddard Manikin: 基础网络安全卫生不再是衡量安全体系成熟度的高级指标，而是入局对抗的基础筹码 [12:47] Stoddard Manikin: 凌晨两点直接推到生产环境，祈祷千万别出故障 [12:47] Stoddard Manikin: 借助 AI 跟上攻击者的节奏，是解决时间差距的唯一途径 [15:54] Stoddard Manikin: 利用 AI 防御 AI，以及像保护其他核心业务资产一样保护 AI 自身

Source quotes

[0:04] Stoddard Manikin: security of AI [0:04] Stoddard Manikin: security by AI [0:04] Stoddard Manikin: adversarial AI defense and autonomous security operations [2:21] Stoddard Manikin: rivals the GDP of a top 30 nation [7:02] Stoddard Manikin: Today's defenses are no match for tomorrow's attacks [9:42] Stoddard Manikin: table stakes [0:04] Stoddard Manikin: securing AI [0:04] Stoddard Manikin: AI-powered defense

Original transcript

[0:04] Just out of curiosity, um, how many people in  the room are cyber security professionals? Okay, [0:11] great. And what are some of the other areas that  we have covered in here? I'm going to assume [0:16] anybody in media who's here covering this for a  story because that'll dictate what we can reveal. [0:21] Okay, got it. Well, thank you all for coming. All  right. Hi everybody. I'm Stoddard Manakin. I'm [0:27] the CISO at Children's Health Solare of Atlanta.  I am also the co-founder of uh the uh AI cyber [0:36] security leader forum. We started out with a set  of roundts in Atlanta where we bring together AI [0:42] professionals and cyber security professionals.  We began last year. We've now had at least five [0:47] events. And what I want to share with you today  are some of the key learnings that I'm bringing [0:52] back from those in terms of insights and uh and  other observations made by our members to see if [0:58] it could be helpful in what you do on a day-to-day  basis. So where we started uh we said hey we're [1:05] going to focus here on cyber security for AI  AI for cyber security. We had different tracks [1:10] around technical and governance. We soon realized  that the conversations really just focused on [1:16] those two aspects, right? Cyber sec for AI, AI for  cyersc Gartner, right? They're referring to it as [1:24] um securing AI and AI powered defense. So that's  another way to think about it. Uh, according to [1:31] a well-known LLM, they recommended calling it  adversarial AI defense and autonomous security [1:38] operations, which is very wordy and not any kind  of what I would expect from an LLM. Um, but what [1:44] we landed on is very simple and that is we talk  about security of AI and security by AI and all of [1:53] the discussions that happen in that forum are one  of those two topics or a blend of them. And that [1:59] is essentially what how we have to think about it  as security professionals is how are we protecting [2:04] AI that the organization is rolling out and how  are we leveraging AI to protect us from all kinds [2:12] of threats whether they're human-based or some  type of autonomous attack here. So with that we [2:21] have seen some very fundamental changes in cyber  security as a result of AI. In terms of dark AI, [2:28] we've got weaponization. Uh on the offensive side,  there are tools out there like fraud GPT that will [2:35] help malicious actors leverage AI to hurt us. They  will craft more believable fishing campaigns. They [2:45] will develop uh zeroday exploits. They will map  your network. It will do all kinds of nasty nasty [2:52] things at machine scale. And there have been many  news reports that have hit the public news waves [2:59] over the last year about this growing. Several  months ago, Enthropic announced that they found [3:07] the first example where their tools had been used  in an autonomous way to attack a company. We've [3:12] seen all the recent news about, you know, Chat  GPT saying their stuff got out of its guardrails. [3:18] Anthropic said, "Oh, we looked at our logs to see  if that happened to us, and yes, it did, too." [3:22] Um, this is a growing problem and as a result,  unsophisticated users can now do way more advanced [3:29] attacks and in my opinion on a more scary level,  sophisticated hackers can now use AI as a force [3:37] multiplier to move even faster against us. So, we  also know that agents can attack autonomously and [3:47] in some cases that's even worse because depending  on what their objectives are, they will ignore [3:53] many other things or possibly destroy anything  that's in its way in order to reach the objective. [4:01] A lot of times the traditional guardrails that are  in the best known front tier models get removed or [4:08] they are using open- source models that may not  even have the appropriate guardrails. We're also [4:13] seeing that out there on the dark web AI agents  can be rented similar to how people have rented [4:19] ransomware as a service. Right? This is a cottage  industry that is if you look at you know cyber [4:27] attacks and exploits and ransoms it rivals the  GDP of a top 30 nation. It is a massive massive [4:37] industry and it is only going to grow especially  now that so much of it can be automated. In terms [4:44] of vulnerability management AI is changing  that faster than organizations can scale their [4:50] remediation efforts. Discovery volume is exceeding  engineering capacity. Discovery velocity is faster [4:58] than patches can be developed or deployed. This  reduces patch windows for defenders that we are [5:05] already struggling with. I'm in healthcare and  we have a hard time keeping up with patches as it [5:10] is. The organizations that deploy software that  write it can't create the patches fast enough. [5:18] There's some fascinating articles  out there right now talking about [5:22] um the aftermath of project Glass Wing getting  started right when Enthropic said we're going to [5:27] hold off on releasing Mythos. We're going  to share uh this capability with some key [5:33] organizations that power the internet. We want  you all to use it to find zero day exploits and [5:39] patch them before they get discovered by malicious  threat actors. Those organizations have literally [5:47] taken multiple engineers and developers off  of other projects and spent thousands of hours [5:56] discovering vulnerabilities that were there for  sometimes over a decade or were not considered [6:02] major vulnerabilities until they were chained in  new and novel ways to create dangerous exploits. [6:10] They cannot keep up with the volume of patches  that need to be created as much as we can't create [6:16] we can't keep up with the volume of patches that  need to be deployed. So it is a brand new day and [6:23] we are we are all going to struggle with that.  There is not a single team on the planet in my [6:27] opinion that can currently address vulnerabilities  at the speed that AI can find them. So one of the [6:36] things that I'm working on is uh participating in  an ARPAH research project called upgrade and that [6:42] stands for universal patching and remediation for  autonomous defense. What we're doing is working [6:48] with partners like Georgia Tech to identify how  autonomous defenses can be deployed to protect [6:54] hospital networks. And this is just one example  of how AI can potentially be a guardian. The third [7:02] aspect of this is how attack speed is compressing.  The gap between detection and response leaves far [7:09] less tolerance for error with the vulnerability  weaponization shifting from days to minutes. [7:18] You can use AI to discover an exploit to write  a payload of malware to then deploy and use that [7:26] exploit and then you can send it in to your target  within minutes. The scale of this is like nothing [7:36] we have ever seen in the history of technology.  There are zeroday exploits that are rapidly [7:42] accelerating risk as we saw with Mythos. And quite  frankly the the one of the f uh metrics that we [7:49] use to track how successful we are is around  median time right median time to detect median [7:54] time to contain median time to remediate. Well the  median time for an initial access broker who sends [8:02] a fishing message and steals your credentials  to hand off newly breached environment to a [8:07] secondary group which can include a ransomware  affiliate has collapsed from hours to minutes. [8:15] They are now doing it in an automated way. Some of  our participants have seen attacks where someone [8:22] will send the fishing message, it gets clicked  on, the individual enters their credentials, [8:26] they approve the multiffactor request even though  they shouldn't. Those get handed off in some cases [8:33] in under a minute to someone who will actually  use that access to use it for further exploits. [8:41] Initial access brokers is a job description on  the dark web. That's how organized the hacking [8:48] community is. And now they are going to use AI  and automation to put all these things together [8:54] and it's going to come at us even faster. So  detection strategies that we've all been using [8:59] who have been in the the cyber defending industry  like shift left on the attack um scale that used [9:07] to be our focus and now the priority is much  more around containment and recovery. We got [9:14] to be resilient because there is almost no way  to defend against a determined threat actor. So [9:20] absolutely focus on those preventive controls  and defenses, but spend just as much time or [9:26] more on how you can recover when you do have  a cyber incident. So summarizing this slide, [9:33] today's defenses are no match for tomorrow's  attacks. We all have to be begin adapting now. [9:42] Now, in terms of essentials for AI, first and  foremost, cyber hygiene used to be a sign of [9:49] a mature security program to use a Vegas  term, it is now table stakes. You cannot [9:55] have weak cyber hygiene and expect to stay ahead  of the curve with AI enabled threats, right? Um, [10:04] poor hygiene will only be amplified by people who  are using AI to automate. So controls like lease [10:10] privilege, uh network segmentation, these are  absolutely essential to limit the blast radius [10:16] of AI powered attacks. Consider that there may  now be more nonhuman identities on the internet [10:24] than human identities. Soon that'll be true in  your own company if that's not already the case. [10:30] We've already had service accounts for decades.  Now you're going to have non-human identities [10:36] that are driving agents in different AI workflows.  All of those become targets for exploitation and [10:45] in some cases they may be less reliable than some  of your users who are already clicking on fishing [10:50] messages. So it is only going to get harder to  keep up with this. The autonomous attacks can [10:56] also chain vulnerabilities and still move at  automated speed. So what do you do about it? [11:02] Most of our participants recommend following key  frameworks like uh cloud security alliance or [11:08] OASP or NIST that have published guidance and  control frameworks around how to secure LLMs, [11:14] how to secure agentic, right? If you look at  those um different frameworks, they have some [11:20] commonality. They recommend an agent registry so  that you know what's on your network. You make [11:26] sure that agents have their own owner scope and  expiration dates. Right. This is truly important. [11:34] Um recommending requiring a gateway for aentic  traffic that that will help block data leaks. [11:40] It'll help stop attacks. It can hide credentials  for loginins. Um it can also help with managing [11:46] tokens. Ultimately, these kinds of controls are  part of a good cyber security governance program [11:52] and hygiene is crucially important. Automated  response. We need AI to defend against AI. [12:01] So look for places that you can have AI not just  scan for vulnerabilities and identify what's [12:07] wrong, but actually do automated containment when  you have an incident, when you have a breach, [12:12] when you have suspicious traffic, when you have  something that could be a false positive or [12:19] um it could be anomalous safe, meaning that it's  an administrative user who's doing something that [12:24] they're allowed to do but is unusual. temporarily  containing those kinds of things by leveraging AI [12:30] can save you in crucial seconds in those exploit  attempts so that then a person can look at it and [12:37] use judgment and determine is this real is  this really someone who's authorized doing [12:42] something and should I let it continue you can  call them right you can connect with them and [12:47] make sure and validate I think that's going to be  a really important step for most cyber defenders [12:52] um let some of these autonomous agents take  actions around particular particularly containment [12:58] and look for opportunities to do self-healing,  right? Look for opportunities to do patching. [13:03] Earlier today, there was a session in another room  um where he was talking about you can have AI spin [13:09] up an environment, a digital twin of one of your  environments, apply a patch that's new, test it, [13:16] make sure it works, and then from there, once it  captures all the evidence that I've regression [13:21] tested all this, it's now safe to deploy to  production. Think about how fast that can be [13:28] done versus the the normal manual way where it  has to go into someone's queue, manually address [13:34] it. You might not even have a test environment to  put it into, right? Or sometimes you just stuck [13:39] in production at 2 o'clock in the morning and  hopefully it didn't break. Leverage AI to keep [13:46] up with the people who are using it to attack  us. It is the only way to manage that time time [13:52] issue. Lastly, here on token economics, we've got  to be aware of how costs can escalate quickly. Um, [14:00] you've probably seen in the news, some technology  leaders have reported that they're unexpectedly [14:05] using their entire AI budgets in the first half  of this year because they're burning through [14:12] tokens. How can we manage that? Well, don't use  the same AI for everything. Some AI costs more [14:21] than other AI. Use prompt engineering. This was  a big phrase a couple years ago and then it kind [14:27] of disappeared. But think of if you just go out  there and look at the types of prompts that people [14:32] are using in your environment, you will find that  they are remarkably inefficient and uneconomical [14:38] with prompting AI. They're not specific. They're  not putting parameters on it. They're not saying [14:44] stop at five responses. All of those things  can drastically reduce the amount of money [14:50] that you're spending to run AI. and you can use  a cheap AI LLM to help improve your prompt that [14:57] you then use in an expensive LLM as one example.  Look for those opportunities to really optimize [15:04] your prompts. Raw compute is less important than  orchestration. Raw compute is important when you [15:13] have powerful AI models, right? Orchestration  is important when you want to spit up AI swarms [15:20] when needed and then destroy them. Orchestration  is the way that we use individual purpose-driven [15:30] agents and then destroy them and manage costs.  Um, some of our members also use tools like Qura [15:38] for small models to help fine-tune those LLMs.  Uh, and other ways where they could really think [15:44] about we live in a token economy. How are we going  to make sure we don't exceed budget? So with that [15:54] um AI transformation as we know in cyber security  it is significant. It's affecting timing, [16:00] scale and costs in sometimes novel ways. Please  look for opportunities to use AI to defend against [16:07] AI and also protect AI just as you would other  key assets. If you're interested in continuing [16:13] the conversation past today, uh you're welcome  to follow AI cyberc leaders forum on LinkedIn.