The robots have gone bananas.

Key takeaways

AI is dramatically transforming cybersecurity, enabling faster and more comprehensive vulnerability assessments, but challenges in reliability and consistency remain.
The traditional practice of annual penetration testing is obsolete; continuous and AI-enhanced testing approaches are essential in today’s dynamic threat landscape.
Organizations need to balance compliance requirements with proactive security measures, leveraging new AI tools to stay ahead of attackers.
Advances in robotic AI demonstrate promising progress toward adaptable, intelligent machines capable of learning and improvising, which could revolutionize automation and robotics in various industries.
It’s crucial for security practitioners to stay honest about current technology capabilities and to adopt AI tools thoughtfully to enhance security rather than replace the human element.

Summary

Emerging Threats to Critical Infrastructure and Corporate Security

The podcast begins by highlighting urgent warnings from U.S. federal agencies about active cyber campaigns targeting critical infrastructure, specifically exploiting vulnerabilities in widely used industrial control systems like Siemens S7 PLCs. These attackers are leveraging AI to generate exploit scripts, lowering barriers for cybercriminals and nation-state actors. Other major concerns include vulnerabilities in enterprise software from Citrix, Splunk, and Cisco, alongside issues like exposed Stripe API keys, which could facilitate fraud, and a new Android banking Trojan that exfiltrates data while mimicking legitimate apps. These threats emphasize the need for proactive security measures and patching, especially given the rapid evolution of attack methods.

Revolutionizing Penetration Testing with AI

A significant portion of the podcast is dedicated to discussing how AI is transforming vulnerability assessment practices. Chris Wallis from Intruder argues that the traditional annual pen test is outdated due to the fast-changing cybersecurity landscape where new vulnerabilities and threats emerge daily. AI-driven testing offers rapid, comprehensive insights, ingesting large code bases and finding critical flaws in hours instead of weeks. Wallis explains that AI enhances, but does not replace, human expertise—optimizing detection and coverage. Challenges remain regarding the consistency of AI testing results, but the potential for more continuous and effective security assessments signals a seismic shift in risk management. The conversation emphasizes the importance of honesty about current capabilities and encourages organizations to leverage AI tools for better, more frequent testing.

The Future of Robotics and AI Adaptability

The episode concludes with an exploration of advances in robotics, exemplified by a startup called Generalist AI that develops adaptable robots. A Wired reporter witnessed a robot using a banana as a makeshift tool, demonstrating the capacity for on-the-fly learning and improvisation, a major step toward useful, real-world autonomous machines. Unlike traditional approaches reliant on massive data sets, Generalist’s method incorporates high-quality demonstrations from human trainers to create models that generalize across tasks and environments. Experts suggest that these innovations could lead to practical, versatile robots capable of assisting in diverse applications, signaling a future where robots are more adaptable and integrated into everyday life.

Show notes

Federal agencies warn of an active campaign targeting critical infrastructure. Citrix races to patch critical NetScaler flaws. More than 50,000 exposed Stripe API keys raise fraud concerns. Black Hat and DEF CON attendees are targeted in a new social engineering campaign. Atlassian, Splunk, and Cisco fix hundreds of vulnerabilities. A new Android banking trojan adds an unusual twist. A healthcare breach impacts 3.8 million people. SilkParasite expands cyberespionage in Central Asia. And CISA eyes a major overhaul of federal cyber software procurement. Our guest is Chris Wallis, founder and CEO of Intruder, on how AI agents killed the annual pentest and are reshaping exposure management. AI powered robots find bananas quite appealing.

Remember to leave us a 5-star rating and review in your favorite podcast app.

Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.

CyberWire Guest

On our Industry Voices segment, Intruder’s Founder and CEO Chris Wallis joined Dave at Black Hat to discuss why the annual pentest Is dead and how AI agents are reshaping exposure management. If you enjoyed this conversation, be sure to check out the full interview here.

Selected Reading

NSA, FBI warns of hackers using AI-generated tools in attacks on critical infrastructure technology (The Record)

Citrix urges admins to patch new NetScaler flaws as soon as possible (Bleeping Computer)

50,000 Stripe Secrets Leaked in Public Code (SecurityAffairs)

Black Hat/DEF CON attendees targeted in malware scheme with Google Doc lure (SC World)

Atlassian, Splunk Patch Dozens of Critical, High-Severity Vulnerabilities (SecurityWeek)

Cisco Patches Critical Crosswork, Secure Workload Vulnerabilities (SecurityWeek)

New Manic Android malware can exfiltrate data through nearby devices (Bleeping Computer)

EHR Vendor Notifying 3.8 Million Patients of Data Theft Hack (GovInfo Security)

SilkParasite: Tracking a China-Nexus APT Across Central Asia (Bitdefender)

CISA contemplates whether to hire security software buying help (Washington Technology)

I Saw the Future of AI in a Robot That Can Learn on the Spot (WIRED)

Share your feedback.

What do you think about CyberWire Daily? Please take a few minutes to share your thoughts with us by completing our brief listener survey. Thank you for helping us continue to improve our show.

Want to hear your company in the show?

N2K CyberWire helps you reach the industry’s most influential leaders and operators, while building visibility, authority, and connectivity across the cybersecurity community. Learn more at sponsor.thecyberwire.com.

The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © N2K Networks, Inc.
Learn more about your ad choices. Visit megaphone.fm/adchoices