Imperva on the Bot Surge Behind Half of Global Internet Activity

Who owns a technology-related business risk when revenue, operations, customer trust or regulatory standing are at stake? In this episode of Business of Cybersecurity, I speak with Kayne McGladrey, a two-time CISO, independent fractional and virtual CISO, Senior Member of IEEE, and author of Cyber Risk Is a Myth: A Business Approach to Integrated Risk Management. Kayne argues that calling something a cyber risk can create distance between the people who understand the technology and the people who own the business outcome. When the CISO is expected to accept a risk attached to someone else’s profit and loss statement, accountability becomes blurred and business leaders may make decisions without seeing the security dependencies beneath them. We discuss how companies can replace technical severity scores and vulnerability counts with a shared language based on financial exposure, operations, reputation and regulatory impact. Kayne explains why each entry in a risk register should have a named business owner, while the security team identifies, quantifies, translates and monitors the exposure. The conversation also covers the difference between documenting risk and using it to guide investment. A useful risk register should help executives compare exposure across business areas, connect controls to expected outcomes and track residual risk over time. This reframes the budget conversation from how much security costs to how much risk an investment reduces. Kayne also explains why clean audits, insurance policies and written controls do not prove that a company can recover from an incident. Tabletop exercises, technical recovery tests and rehearsed decision paths provide stronger evidence of readiness. For board members, he offers practical questions about ownership, integrated reporting, business metrics and cross-functional reviews after incidents. What evidence would show that cybersecurity is part of enterprise risk management in your organization, rather than a separate technical function? Listen to the conversation and share your thoughts with me.

What happens to identity security when an attacker can copy an executive's voice, face, and employment history using inexpensive tools? In this episode of The Business of Cybersecurity, I speak with Bojan Simic, CEO and co-founder of HYPR, about the effect of generative AI on impersonation, credential recovery, and help desk security. HYPR is a New York cybersecurity company focused on identity-based attacks. Bojan says identity-related events account for between 60 and 80 percent of incidents, depending on the security report being used, and his team helps organizations find and repair weak points across the identity chain. The demonstration during our conversation makes the risk unusually tangible. Bojan changes his on-screen face into mine using software running on his local computer. The result is not flawless, but it is convincing enough to show why a familiar face on a video call can no longer be accepted as evidence by itself. With additional preparation, an attacker can also clone a voice, gather employment details from public profiles, and automate much of the reconnaissance that previously required repeated manual calls. Bojan argues that asking employees to recognize every deepfake repeats an old cybersecurity mistake. Phishing simulations showed how quickly people return to normal working habits after training. Help desk staff are trying to resolve problems, support colleagues, and close tickets. They should not be expected to determine whether a distressed caller, senior executive, or remote employee has been digitally recreated. One hospital example illustrates the weakness of knowledge-based checks. According to Bojan, an attacker called the help desk while pretending to be a doctor but did not know the required four-digit PIN. The attacker then called the doctor while posing as the IT team, obtained the PIN, returned to the help desk, and gained access to the account. The process technically followed policy, yet the policy relied on information that could be socially engineered. We discuss how the same attack can become faster through AI. A system can call the help desk, discover which questions are asked, search public sources for the answers, call the employee when information remains missing, and return with the required details. Requiring video does not solve the problem when faces can also be recreated. The conversation also covers continuous identity proofing. Instead of treating verification as an event completed during onboarding, companies can request stronger evidence when behavior changes. A new device, unfamiliar operating system, first-time access to a sensitive application, return from a long absence, or promotion into privileged access can all justify another check. Routine work from a known device should remain straightforward, allowing friction to appear when the risk changes rather than during every action. Privacy deserves equal attention. Bojan acknowledges that employees in some countries may resist location, document, or biometric checks. His recommendation is to explain what is collected, whether it is retained, and what alternatives exist. An employee who declines remote verification can be offered an in-person process. That gives people a choice while preserving the security requirement. The most immediate action is to test password recovery and credential reset. Bojan advises moving those functions away from phone-based help desks and into a self-service process that combines device, location, or document verification. He says credential resets account for roughly 30 to 40 percent of help desk calls, so the change may also reduce support demand. Could a cloned executive, remote worker, or doctor pass your current recovery checks, and which independent signal would stop them? Listen to the episode and share your thoughts with me.

What happens when security analysts encounter so many false positives that dismissing alerts becomes an automatic response? In this episode of The Business of Cybersecurity, I’m joined by Tim MalcomVetter, General Manager of Coalition Security and co-founder of WireSpeed. Tim brings 26 years of practitioner experience, including building and running Walmart’s red team and leading a managed security operation serving hundreds of enterprise clients. Tim believes the familiar phrase “alert fatigue” fails to describe the full operational risk. When analysts repeatedly investigate events that lead nowhere, their judgment can gradually recalibrate. An unusual event starts to resemble another routine item in the queue. That normalcy bias is especially dangerous when analysts have limited customer context, strict response targets and thousands of additional alerts waiting behind the current case. We discuss how AI-amplified attacks change the timing. Tim explains that defenders may begin several minutes behind because endpoint events must be collected, processed and passed into security systems before a response can begin. Attackers can combine AI-assisted preparation with deterministic tools that execute in milliseconds once they reach an environment. Even if both sides have access to capable models, the defender may already be running a delayed race. There is another complication. AI analysis consumes tokens, and security teams rarely have an unlimited budget. Tim expects attackers to use lower-severity techniques that may sit below the threshold organizations send for expensive AI investigation. At the same time, security vendors have a commercial incentive to report broad telemetry because being accused of missing an incident carries serious consequences. The result can be greater visibility, but it can also place additional noise in front of already stretched teams. Tim offers a practical model for deciding where different forms of intelligence belong. Deterministic code should handle the widest possible set of known and repeatable decisions. AI can interpret ambiguous or semi-structured material, such as suspicious process trees and living-off-the-land activity. Human analysts then provide judgment, supervision and investigation where neither layer can produce sufficient confidence. We also examine WireSpeed’s approach to learning from errors. Tim describes replacing the traditional alert funnel with a straight pipe that routes events toward a verdict, while people statistically sample the results. When the system makes a mistake, the team investigates the defect, corrects it and converts the sanitized case into a unit test. That approach aims to stop the same failure from being repeated across analysts or software releases. AI can help security teams process context, but probabilistic output also creates testing, consistency and supply-chain questions when models change. How should your organization divide responsibility between code, AI and people, and has your SOC reduced false positives or simply learned to live with them? Listen to the conversation and share your thoughts with me.

Can defenders keep pace when generative AI gives attackers faster ways to create convincing phishing messages, research targets, and test new attack methods? In this episode of The Business of Cybersecurity, I speak with Professor Steven Furnell from the University of Nottingham for an IEEE conversation about AI-enabled threats, security awareness, passkeys, cyber hygiene, and the continuing gap between cybersecurity policy and everyday practice. Steven explains why the current AI contest does not give either side exclusive access to powerful technology. Attackers, however, often gain the early advantage because they use it to create opportunity and set the agenda. Defenders are then left identifying the new behavior, adapting controls, and managing the extra work. Generative AI also removes much of the effort once required to research an organization and produce credible spear-phishing messages, making familiar advice about spelling errors and obvious scams less useful than it once was. We discuss whether passkeys could finally reduce our dependence on passwords and why adoption will still require technical preparation and clear communication with users. A control may improve security while adding friction, so businesses must consider how authentication, updates, access controls, and other interventions fit into real working routines. Steven also points to a recurring problem in cybersecurity awareness. Fewer than one in five organizations in the UK Cyber Security Breaches Survey reported staff awareness training in the previous 12 months, according to the figures he discusses. Even where annual training exists, watching a video and answering questions may satisfy a compliance requirement without showing whether an employee can respond effectively when a real incident occurs. For smaller organizations that find security frameworks overwhelming, Steven recommends Cyber Essentials as a practical baseline. We also discuss secure design, the difficulty of regulation keeping pace with technology, and the Cyber Games Lab activities created at the University of Nottingham. Hacker Whacker and Cyber Defense Dice use play and conversation to make cyber education easier to understand for young people and business audiences. What would improve security behavior inside your organization, another annual training module or regular opportunities to practice realistic decisions? Listen to the episode and share your thoughts.

Could your security team produce an accurate list of every employee, contractor, guest account, application, and AI agent with access to your SaaS environment today? In this episode of The Business of Cybersecurity, I speak with Jim Lippie, Chief Product Officer at Kaseya, about findings from the company’s latest SaaS security research. The report draws on anonymized activity from the SaaS Alerts platform, covering 27 billion security events across 50,000 organizations. One finding immediately stands out. Only 44% of monitored organizations were using multifactor authentication. When the research began in 2022, the figure was 32%. Four years of heightened cyber awareness have therefore produced an increase of only 12 percentage points. The report also found that guest accounts represented 69% of monitored accounts. This means guest users outnumbered licensed users by over two to one. Jim explains how these accounts accumulate. A consultant, contractor, or temporary employee receives access to company systems, completes the work, and leaves. The account remains because nobody owns the process of removing it. Over time, these forgotten identities create unattended routes into business data and applications. Our conversation examines how SaaS has changed the security perimeter. Employees no longer need to be inside an office or connected through a corporate network. A browser, valid credentials, and access to a cloud application may be enough. Security teams must therefore monitor user behavior, permissions, locations, and unusual patterns rather than relying on controls designed around the office firewall. AI agents add another category of identity. An autonomous system performing workflow tasks may require access to files, email, customer data, financial systems, or internal applications. Jim argues that these agents should be treated like users, with defined permissions and continuous behavior monitoring. We also discuss the tension created by easy collaboration. The report found that 34% of monitored file sharing traveled outside the organization. That sharing may be legitimate, but businesses need to understand which information has left, who received it, and whether access remains appropriate. Jim’s advice is deliberately practical. Begin with a complete assessment of the environment. Identify every account and application, require MFA, give guest access an expiration date, monitor behavior, and use overlapping security controls where a second source of evidence can expose missed activity. Does your organization have genuine visibility across its SaaS environment, or are forgotten accounts and unmonitored identities creating doors nobody remembers opening? Listen to the episode and share your thoughts with me.