The Defender's Window
About This Session
The dynamics of AI and cyber security have reached a structural inflection point.
The 3 dynamics between AI and cyber security with which we are concerned are as follows. These are the axes of the strategic space of LLMs and cyber security:
• LLM enabled capability uplift at the lower end of the attacker capability spectrum – Attacker capability uplift determines the change in threat population that your organisation faces
• Ability to leverage LLMs for analytical capability for defenders – What can your organization do with the infrastructure you have?
• Tiered access governance for LLM cybersecurity capability – What tier of defensive capability can your organization reach?
The three tiers of access governance for LLM cybersecurity capability are currently:
• Glasswing - Closed to all but fifty firms (roughly).
• TAC - Open to thousands of verified defenders, the one most peers will likely operate in.
• Public models and open-source agent frameworks - Public research has found that with the right expertise this tier may well be much closer to the top tier than the hype suggests.
Together, the dynamics produce the window - The time-bounded period during which the access-governance advantage is real, the analytical leverage is being built, and the capability uplift at the lower attacker tier is still being absorbed rather than exploited at full tilt.
We analyze the threat to and from AI implementations under the COMPASS framework - Compute, Operations, Models, Power and utilities, Alliances, and Supply Signals.
We assess the AI derived problems facing organizations and their technology stacks, detailing what those problems are, why they matter, and what can be done about them.
Attendees to this session will leave with an elevated understanding of the current AI situation from a cybersecurity governance and opportunity perspective.
The 3 dynamics between AI and cyber security with which we are concerned are as follows. These are the axes of the strategic space of LLMs and cyber security:
• LLM enabled capability uplift at the lower end of the attacker capability spectrum – Attacker capability uplift determines the change in threat population that your organisation faces
• Ability to leverage LLMs for analytical capability for defenders – What can your organization do with the infrastructure you have?
• Tiered access governance for LLM cybersecurity capability – What tier of defensive capability can your organization reach?
The three tiers of access governance for LLM cybersecurity capability are currently:
• Glasswing - Closed to all but fifty firms (roughly).
• TAC - Open to thousands of verified defenders, the one most peers will likely operate in.
• Public models and open-source agent frameworks - Public research has found that with the right expertise this tier may well be much closer to the top tier than the hype suggests.
Together, the dynamics produce the window - The time-bounded period during which the access-governance advantage is real, the analytical leverage is being built, and the capability uplift at the lower attacker tier is still being absorbed rather than exploited at full tilt.
We analyze the threat to and from AI implementations under the COMPASS framework - Compute, Operations, Models, Power and utilities, Alliances, and Supply Signals.
We assess the AI derived problems facing organizations and their technology stacks, detailing what those problems are, why they matter, and what can be done about them.
Attendees to this session will leave with an elevated understanding of the current AI situation from a cybersecurity governance and opportunity perspective.
Speaker
Stephen Robinson
Lead Threat Intelligence Researcher - LRQA
Stephen is the Lead Threat Intelligence Researcher at LRQA with 20 years of experience in infrastructure, threat detection, threat intelligence, and organisational security across the public and private sectors. In his role at LRQA he leads on the creation and delivery of strategic, tactical, and operational intelligence insights which enable decision makers and defenders to take proactive defensive measures. Stephen’s expertise enables the delivery of security services to SMEs, Fortune 500s, and government departments around the world. These organizations benefit from Stephen’s knowledge of adversary tradecraft, defender capability, and the underlying informational and organisational environments where cyber conflict takes place.
