#10: 90 Minutes. One Laptop. Working Malware. AI Just Changed the Rules.

#10: 90 Minutes. One Laptop. Working Malware. AI Just Changed the Rules.

A security analyst experimented with a public AI, meticulously crafting malware capable of evading detection. This wasn't done by a nation state or a criminal gang; it was Northwave, a Dutch cybersecurity firm. Their CTO, Christiaan Ottow, a former ethical hacker, oversaw the experiment. In this episode of Follow the White Rabbit, Kofi Osae-Attah talks with Christiaan about the experiment's findings and his belief that we've reached a critical point he and his team predicted in September. Christiaan isn't an alarmist. He was skeptical of LLM hype, but the data changed his mind. His incident response team investigated a breach where they gained rare access to the attacker's staging server and found files documenting the AI's reasoning, plans, and execution steps. The attack used zero-day vulnerabilities, pivoted between cloud environments, and went undetected despite the victim having EDR and next-generation firewalls. The attacker didn't need hacking skills; they just needed to find a way around the AI's guardrails. This is the new baseline. The barrier to entry has collapsed, and attribution is becoming impossible as every threat actor uses the same models. The implications for defenders are stark, but Christiaan's advice is practical. Agentic AI isn't a competitive advantage; it's a baseline requirement. However, speed without structure is dangerous. Automated response needs a fine-grained authority matrix, prompt injection risks need to be engineered around, and most security teams are missing a complete, accurate inventory of their assets and identities. The organizations waiting for proof that this shift is real are about to get it. In the worst possible way. TAKEAWAYS: 1. The inflection point has arrived. Christiaan's team predicted it would arrive in April 2026. It arrived on schedule: Anthropic's Mythos, GPT 5.5, and the first fully AI-driven attack investigated by their incident response team all occurred in the same month. 2. AI attackers operate like an entire team. A human hacker has one area of expertise. An AI agent has them all simultaneously: software vulnerabilities, cloud misconfigurations, Windows environments, and identity exploitation. Attribution is becoming nearly impossible. 3. Your defensive AI is also an attack surface. Prompt injection into agentic SOC systems poses a real threat. Treat your AI agent as you would software or a human employee: isolate it technically, provide guardrails, and explicitly train it on what it is allowed to do. 4. Asset and identity inventory is now a top-tier security priority. Knowing what systems you have, what software they run, which API keys exist, and what permissions they carry used to be basic hygiene. Under AI-speed attacks, it's critical infrastructure for incident response. 5. The question isn't whether AI changes the threat landscape. It already has. Run this thought experiment: What if the volume of attacks triples? What if the time between discovering a vulnerability and its exploitation is reduced to zero? If you can't answer these questions, you should. Subscribe to Follow the White Rabbit If this episode made the threat feel more concrete than it did an hour ago, then we've done our job. Subscribe on your preferred platform, leave a review, and share this episode with every CISO, SOC lead, and security engineer in your network. The gap between now and then is smaller than most defenders realize. LINKS: * Christiaan Ottow, CTO, Northwave Cyber Security on Linkedin [https://www.linkedin.com/in/christiaanottow/] * Kofi Osae-Attah Jr. | LinkedIn [https://www.linkedin.com/in/kofi-osae-attah-jr-444861255/] * How AI-Driven Cyberattacks Are Changing the Threat Landscape in 2026 [https://northwave-cybersecurity.com/articles/how-ai-driven-cyber-attacks-are-changing-the-threat-landscape-in-2026] * "The Day-Zero Normal" [ https://www.linkedin.com/feed/update/urn:li:activity:7450542077001662464/?originTrackingId=k0JlK3ummGQgdmR4yPQwpg%3D%3D ] Rob Fuller · Chief Information Security Officer [https://robfuller.net/] * Anthropic: Project Glasswing & Mythos Preview [https://www.anthropic.com/glasswing] * MITRE ATT&CK: Agentic AI Threat Modeling [https://attack.mitre.org] * Recommended book: The Art of Intrusion – Kevin Mitnick

#09: Hype vs. Reality: What AI in the SOC Actually Looks Like

Right now, everyone's selling AI-powered security operations. The pitch sounds great: faster detection, smarter triage, and less noise. However, if your logging is disorganized, your playbooks don't exist, and no one is responsible for the process, AI won't improve your SOC. It'll just make it faster at doing the wrong thing. In this episode of Follow the White Rabbit, Link11 CISO Kofi Osae-Attah sits down with Erik Van Buggenhout, NVISO co-founder and SANS instructor, to cut through the hype and discuss what AI in the SOC looks like in practice. Erik is an AI optimist but, more importantly, he's a realist. He has spent years building security operations at scale and knows exactly where automation succeeds and where it falls short. His take? Up to 70% of incoming alerts can be automated without AI. Static playbooks, when built and maintained properly, do most of the heavy lifting, cheaply and reliably. AI earns its place where context matters, such as in dynamic environments, nuanced triage, and situations where a rigid playbook runs out of answers. The sweet spot isn't AI everywhere. It's AI where judgment is needed and automation everywhere else. However, the conversation goes deeper than tools. Who's accountable when an AI agent makes a wrong decision? What will happen to the career path of junior analysts when L1 work disappears? Why does the security industry keep rebranding the same problems with new buzzwords every three years? Erik doesn't sugarcoat any of it, which is exactly what makes this episode worth your time. TAKEAWAYS: 1. AI won't fix a broken SOC. Garbage in, garbage out—faster. Before buying any AI tooling, first sort out your log sources, processes, and ownership. 2. Seventy percent automation is already possible without AI. Static playbooks that are properly maintained can handle most of the alert volume. AI is the next layer, not the foundation. 3. AI genuinely adds value through context. Managed service providers can't know every customer environment in detail. AI coupled with retrieval-augmented generation can provide that context on a large scale without requiring humans to memorize everything. 4. Humans remain accountable. AI agents operate with identities and permissions, but responsibility ultimately rests with the person operating them. Having a human in the loop isn't optional; it's a structural necessity. 5. The industry's buzzword cycle is exhausting and confusing. SIEM became XDR, and now XDR is becoming AI SOC. Same problem, new name. Erik argues for a more pragmatic and less dramatic approach to what's actually changing. Listen in and subscribe to Follow the White Rabbit. If this episode made you think twice about that AI SOC pitch in your inbox, good! Subscribe on your preferred platform and leave a review. It only takes 30 seconds, and it helps us reach those who need to hear this the most. Share it with your security team, your CISO, or anyone who's been handed an AI tool without a plan. LINKS: You'll find Erik on Linkedin [https://www.linkedin.com/in/erikvanbuggenhout/]and here more about NVISO [https://www.nviso.eu/]. If you want to dive deeper: SOC-CMM – SOC Capability Maturity Model [https://www.soc-cmm.com/] SANS Institute – Purple Teaming & SOC Courses [https://www.sans.org] MITRE ATT&CK – Detection & Response Framework [https://attack.mitre.org] Gartner on AI in Security Operations (2024) [https://www.gartner.com/en/security-risk-management/topics/ai-in-security]

#08: AI Isn't Just Changing How We're Attacked. It's Changing What We Believe Is Real.

Most security teams are having the AI conversation about faster phishing, smarter malware, and automated attacks. However, a larger shift is occurring that barely makes it onto SOC dashboards. AI is now being used to industrialize disinformation on a scale no human-run operation could ever match. There are millions of AI agents, with no upper limit on volume, and the public can't tell what's real anymore. In this episode of Follow the White Rabbit, Link11 ISO Kofi Osae-Attah sits down with Anett Mádi-Nándor, president of the Women4Cyber Foundation and CEO of CyEx.hu, to discuss the intersection of AI, geopolitics, cognitive warfare, and diversity in cybersecurity. Anett brings a rare combination of perspectives: she spent half her career in national security and EU administration and the other half in the private sector building AI-engineered cybersecurity solutions. Her diagnosis of our situation in 2026 is sharp and uncomfortable. We are already in an era of continuous cognitive warfare. Social media algorithms, shaped by a decade of user profiling, are now being weaponized with agentic AI to launder narratives on an industrial scale. The result, she says, is reality apathy: a growing portion of the public that simply stops trying to distinguish truth from manipulation. In doing so, they cede even more ground to adversaries. She argues that Europe's regulatory framework is strong but overly complex. Furthermore, the technical gap between what AI can do and what most organizations understand about it is widening. The conversation doesn't stop at geopolitics. Anett makes a compelling case that diversity in cybersecurity isn't a soft issue — it's a security issue. Biased AI models make biased decisions. Organizations using off-the-shelf HR tools often have no idea how those tools were trained and lack an audit process to find out. Kofi shares his experience of applying for jobs under a different name and receiving more callbacks to illustrate what's at stake when bias in automated systems goes unchecked. What's Anett's answer to all of it? Start with the children. Teach five-year-olds to code and understand networks so they can navigate the digital world critically. Estonia has been doing so for years. The rest of the world is behind. TAKEAWAYS: 1. AI has eliminated the volume limit on disinformation. Human-run influence operations were limited by the number of people involved. AI-powered operations aren't. Millions of agents can now simultaneously reshape narratives with no upper bound. 2. Reality apathy is the new attack surface. When people can't distinguish truth from manipulation, they disengage — and that disengagement is exactly what adversaries want. Resilience requires media literacy, not just better firewalls. 3. Replacing humans with AI in cybersecurity is the wrong goal. The right goal is to make humans more effective with the help of AI. AI genuinely adds security value through contextual reasoning — understanding that an HR task completed at 3 a.m. is an anomaly. 4. Bias audits must become standard practice. Organizations that use AI for hiring or triage often don't know how those systems were trained. Just like security red-teaming, bias red-teaming should be mandatory before deployment. 5. Digital education is the most important long-term security investment. Estonia starts teaching programming alongside reading and writing in primary school. This foundational literacy produces a population that's harder to manipulate and better equipped to defend itself. Subscribe to Follow the White Rabbit. If this episode made you think differently about cybersecurity — not just protecting systems, but protecting reality itself — share it. Subscribe on your preferred platform, leave a review, and share with the policymakers, educators, and security leaders who need to hear it. LINKS: You'll find Anett Mádi-Nátor on LinkedIn [https://www.linkedin.com/in/anett-m%C3%A1di-n%C3%A1tor-5765094/ ]. Women4Cyber Foundation [https://women4cyber.eu] EU AI Act – Official Text & Overview [https://artificialintelligenceact.eu] EU Cybersecurity Agency ENISA – AI & Cybersecurity [https://www.enisa.europa.eu/topics/artificial-intelligence] Estonia's Digital Education Programme – e-Estonia [https://e-estonia.com/solutions/education/education/]

#07: Your Next Hire Might Be a North Korean Spy

North Korea is infiltrating Fortune 500 companies with fake employees. They create authentic LinkedIn profiles, excel in remote interviews, collect salaries, and secretly steal intellectual property, cryptocurrency, and system access. This isn't a future threat. It's happening right now across more than 40 countries. In this episode of Follow the White Rabbit, Link11 ISO Kofi Osae-Attah sits down with Kritika Roy, a senior threat intelligence researcher at DCSO in Berlin. Together, they map the threat landscape that most security teams only partially see. Kritika's work sits at the intersection of geopolitics and cybersecurity — and that intersection is where the full picture emerges. China is running long-term intelligence operations aligned with its five-year economic plan. Russia is focused on disruption and sabotage, especially since invading Ukraine. Iran is tracking dissidents and targeting organizations with Israeli ties. And North Korea? It's doing it all — stealing money to fund weapons programs, embedding operatives inside companies, and learning by doing. The line between nation-state espionage and cybercrime has blurred to the point of being nearly indistinguishable. Threat actors are buying ransomware on the dark web as if it were Amazon. Attribution is becoming more difficult. Defenders are falling behind. The most important insight from this conversation isn't technical; it's contextual. Geopolitics determines who targets you, when, and why. A NATO summit, a trade dispute, or an election can trigger a wave of tailored phishing campaigns and targeted intrusions. Kritika's advice to security teams isn't to become intelligence agencies. Rather, it's to read the news, understand the motivations behind attacks, and stop treating every threat with the same level of urgency. Prioritize based on context. If you're hiring remotely, ask your candidates what the local food is like. You'll be surprised at how much that one question can reveal. TAKEAWAYS: 1. North Korean IT workers are already inside companies. They are hired through legitimate job platforms, work as regular employees, and use their access to steal money, intellectual property, and system knowledge. The fix? At a minimum, conduct one in-person interview. 2. Geopolitics is a threat intelligence tool. Phishing lures are timed to coincide with summits, elections, and conflicts. Knowing what's happening in the world allows you to anticipate what's coming at your organization. 3. The four main threat actors have different goals. China wants intelligence. Russia wants to cause disruption. North Korea wants money and knowledge. Iran targets dissidents and organizations related to Israel. Knowing who you're up against changes everything about how you defend yourself. 4. The line between cybercrime and nation-state activity is disappearing. Nation-state actors are purchasing off-the-shelf malware on the dark web. Attribution is becoming more difficult. Security teams need to adapt their thinking. 5. Fundamentals still win. Patch management, identity security, endpoint visibility, and regular red team exercises are not boring basics; they're essential. They're the difference between being resilient and being exposed. Subscribe to Follow the White Rabbit. If this conversation changed the way you think about hiring, threat intelligence, or geopolitics, tell someone. Subscribe on your preferred platform, leave a review, and share this episode with your security and HR teams. Both need to hear it. LINKS: Take a look at Kritika Roy's Linkedin profile [https://www.linkedin.com/in/kritika-roy-dcso/] or the DCSO Website [https://www.dcso.de] MITRE ATT&CK – North Korea Threat Groups [https://attack.mitre.org/groups/] FBI Advisory: North Korean IT Worker Threat (2024) [https://www.ic3.gov] Mandiant / Google: APT Overview by Nation State [https://cloud.google.com/security/resources/insights/apt-groups]

#06: From Digital to Systemic Resilience - The Quantum Shift in Cybersecurity

In this episode of Follow the Rabbit, host Kofi Osae-Attah sits down with Luigi Rebuffi, founder of the European Cybersecurity Organization (ECSO) and the Women4Cyber Foundation, for a deep dive. Drawing on his 40-year background in nuclear engineering, Luigi challenges the industry to move beyond digital resilience, which he views as a static buzzword, toward a more holistic, systemic approach to resilience. He argues that most organizations are fighting the "old war," treating cybersecurity as a linear compliance checklist. In contrast, systemic resilience is inspired by complex systems theory. It focuses on nonlinear interdependencies (the "mesh"), where a failure in a minor component can lead to a crisis, but where optimized investment in these interactions can also create "double value," improving safety and operational efficiency. The conversation also covers the "positive cascade" of the human factor, why government resilience must shift from "fortress" mentalities to flexible meshes, and how a Bayesian approach to risk management can help leaders navigate a non-binary world. Takeaways 1. Resilience Beyond the Digital: Digital resilience is only one sub-element of a larger system. Systemic resilience considers the interaction of all parts - mechanical, environmental, and human - to prevent total collapse. 2. The "Ferrari" Analogy: You can have the perfect cybersecurity "engine" (tools), but if your "tires" (human training or third-party dependencies) are flat, the system won't be resilient. We must assess the interaction between parts, not just isolated components. 3. The Human Factor as a Resource: Although the human factor is often blamed as a vulnerability, it is fundamental to resilience. Luigi argues that organizational systems should be designed so that human error doesn't lead to catastrophic failure. 4. From Linear to Systemic Risk: Traditional risk management is Newtonian, or cause-and-effect. Modern resilience requires a Bayesian approach that maps the probability of "hidden crises" within a complex mesh of factors. 5. Sovereignty as a Dynamic Mesh: Government resilience shouldn't rely on building a static "fortress." True sovereignty comes from controlling the "mesh" - the links and interactions between existing partners - to maintain control. Why Listen? Are you tired of the same old "compliance-first" discussions? This episode offers a radical, engineer-led perspective on the future of European strategy. Luigi Rebuffi offers a blueprint for how organizations and governments can stop constructing static fortresses and begin to understand the dynamic interdependencies of the modern world. Love the show? Make sure to like, follow, and subscribe to the Follow the Rabbit podcast! LINKS: You'll find Luigi on Linkedin [https://www.linkedin.com/in/luigi-rebuffi-90a439b0/]. Here [https://ecs-org.eu/]you find more information about the ECSO.