Stop Punishing Clicks: Why Psychology is Cybersecurity’s Missing Link
Cybersecurity is 80% human-related and only 20% technology. Yet, most organizations treat user security through a single, flawed lens: punishment.
On a recent episode of The Defender’s Log, host David Redekop sat down with Craig Taylor, a cybersecurity veteran with a background in psychology, to explore why traditional security tactics fail and how the threat landscape is shifting.
The Flaw of “Stick-Over-Carrot” Security
Firing or penalizing employees for clicking fake phishing links drives apathy and disengagement. Basic psychology proves that punishment does not extinguish behavior—positive reinforcement does.
Building resilient security cultures requires:
- Moving away from shame-based tactics.
- Teaching actionable rubrics (looking for urgency, secrecy, and emotional triggers).
Building muscle memory through interactive, gamified learning.
The 2-Year Shift: From Humans to Zero-Days
While human error remains a classic attack vector, the rise of frontier AI models is creating a temporary shift. Advanced AI tools can now deconstruct patches and identify zero-day vulnerabilities at unprecedented speeds.
“We’re looking at two years of breaches tied to frontier models breaking into companies and causing great harm… until historical software is patched, then we’ll be back to humans as the weak link.” — Craig Taylor
Practical Defense on a Budget
To adapt, security teams should leverage AI tools like Claude Code or OpenAI internally. By pitting different models against each other to scan, test, and validate custom code, lean teams can proactively fix vulnerabilities before attackers exploit them.
TL;DR
- Psychology Beats Punishment:
- Cybersecurity is 80% human-driven and 20% tech.
- Punishing employees for clicking fake phishing links causes fear and apathy.
- Punishment fails; positive reinforcement and gamified training build real security habits.
- 2-Year Shift to Zero-Days
- Attackers use frontier AI models to find zero-day bugs and reverse-engineer patches instantly.
- Software vulnerabilities will supersede human error as top breach drivers for 18–24 months.
- Once legacy code gets patched, human error returns as the primary weak link.
- High-Stakes Patching Dilemma:
- Fast automated patching risks breaking live systems and causing downtime.
- Delaying patches gives attackers an immediate exploitation window.
- Low-Cost AI Defense:
- Lean teams can use AI (Claude, OpenAI) internally to scan code and automate QA.
- Pitting AI models against each other provides cheap, effective cross-validation for security fixes.
Links
View it on YouTube: https://www.youtube.com/watch?v=kSGjjUGe0SU
Listen to the episode on your favourite podcast platform:
Apple
Spotify
https://open.spotify.com/episode/5SgmcdzHIGyyWNIR5y37tV
Amazon Music
ADAMnetworks
The Defender’s Log full transcript - Episode 032
The Human Element of Cybersecurity
Craig Taylor (Guest)
I think it’s like 80% human-related and 20% technology. I tell my sons to click on everything, click on every SMS. Our approach is, of course, slightly different from the industry as well. So punishing people at the core root of this problem is that punishment has never extinguished a behavior, not in any psychological experiment ever.
But I do notice that the polymaths that I know are always less susceptible to deception of any kind. But I think we’re going from humans to zero days for the next two years and then humans again. And when I saw over the last three months how Microsoft is patching upwards of many hundreds, close to a thousand bugs per patch Tuesday, the rest of us are going to be in a really bad place once these tools become and then attackers own that infrastructure later on.
We’re looking at two years of breaches tied to frontier models breaking into companies and causing great harm.
Show Introduction
Announcer
Deep in the digital shadows, where threats hide behind any random byte, a fearless crew of cybersecurity warriors guards the line between chaos and order. Their epic battles? Rarely spoken of until today. Welcome to The Defender’s Log, where we crack open the secrets of top security chiefs, CISOs, and architects who’ve faced the abyss and won.
Here’s your host, David Redekop
Welcome Craig Taylor: From Canada to the US
David Redekop (Host)
Hey, everybody. Thanks for tuning in to the Defenders Log, and my guest today is Craig Taylor. Craig is a cybersecurity veteran with deep roots in threat defense and security architecture and education. And what I really do appreciate about Craig and his background is that he looks at defense holistically, not just from a single technical control standpoint, but through the lens of human behavior, through training, and through building resilient teams.
Craig, thanks for being here today.
Craig Taylor (Guest)
David, it’s great to be here. Thanks for having me.
David Redekop (Host)
My goodness, I looked at your profile, and I saw you were educated at the University of Guelph, practically in our backyard. Exactly. But now you’re in the United States of America. Tell us how that happened.
Craig Taylor (Guest)
Oh, that’s a long story, but the short version is I was married to a woman who had her PhD in clinical chemistry, and she had an opportunity to go work at the Mayo Clinic in Rochester, Minnesota in a fellowship.
And so we’re like, “The Mayo Clinic? Yeah, let’s go.” So we went, and had kids in the States. Those kids have roots in the States, and so now we’re here. We can’t leave. The kids won’t leave, and there’s been a lot of things in between, but that’s essentially the origin story of me in the States. So I’ve actually now been in the US longer than I was in Canada.
27 years in Canada, 28 in the US.
David Redekop (Host)
No way.
Craig Taylor (Guest)
Yeah.
David Redekop (Host)
Then I have barely beat you. My country of origin is not Canada, but I have now been, oh, no I haven’t beat you, but I’m in the same boat where I’m in my current place longer than where I was previously. But you know what? You reminded me right away of the problem that we have in Canada, where we have brain drain.
In your case, it was love drain perhaps, but still, we see that a lot. Do you still find that’s happening today?
Craig Taylor (Guest)
I think it’s happening in the reverse. I know that we were gonna talk a little bit about the Canadian-US relationship. I see a lot of people down here talking about going back to Canada, some of the Canadians that have come down.
I think there’s a lot of discontent. We’ve got 49% of the population love certain people, and 51% don’t, or vice versa, and it’s a challenge. It’s almost like Quebec in 1991. Didn’t they stay at a 51 to 49?
David Redekop (Host)
That was crazy times. It was.
Craig Taylor (Guest)
I was.
David Redekop (Host)
So, out of awareness of how politics actually works at that time.
I was still in high school, and I remember my history teacher being so unbelievably passionate, and he, of course, was a German immigrant, so he had already gone through the strife of moving countries in a big way, and now it was literally painful. There were times when he was almost tearing up in history class, I think grade 10 or grade 11.
Fascinating. At the time, I didn’t understand the depths of it. Today, it is a big deal, but I don’t know, it seems to me like the grass is always greener on the other side. Because entrepreneurs in Canada, they see the lower taxes, they see that there’s an opportunity for sourcing a large amount of capital in a faster way in the US, and Americans see the news headlines, and they think Canada is the greener place.
But I don’t know. I think the jury’s still out, and we have a lot still to figure out. But this is not a talk on politics. I was just curious where you stood, Craig, but the fact that love took you there is a good enough reason for me. Did you actually get started in cybersecurity, or what made you choose to focus on defense?
Oh, God.
A Psychological Approach to Cybersecurity
Craig Taylor (Guest)
So my degree back in the University of Guelph, which is just near Kitchener-Waterloo, Guelph, and then London is next door to that, where you’re from was in psychology, and I wanted to understand people. I wanted to understand what motivated behavior changes. I studied operant conditioning, all these different things, and then realized quite quickly that a four-year degree was not gonna get me a job in psychology.
I needed a PhD, and I was not ready then to do PhD material. So I got out of college or university and worked, started my own business selling irrigation equipment or installing irrigation home irrigation for your lawns and things. That lasted a couple of years. And I saw a job offering for a new firewall vendor, and I had worked at the university communications lab where people were just getting started with email, internet protocols, things of that nature.
I had a passing knowledge of DNS and SMTP email, some of the very, very basic things, and they took a chance on me, and they said, “Yeah, we’ll hire you to be a support engineer for our firewall.” This was in Toronto, Canada, a company called Border Network Technologies.
David Redekop (Host)
I remember them.
Craig Taylor (Guest)
They were later acquired by Secure Computing. And to make a long story short, that’s my start in cybersecurity, and it proved to be quite valuable, the psychology degree, because I quickly moved into a leadership role within the company, building programs, cybersecurity programs, building the team that supported that firewall.
And, through the course of time, I got my CISSP in 2001. That one was in the first 25,000. Now there’s three million. So I’ve been around a long time. I think I predate the World Wide Web. It was all text-based email communication in the very beginning of my computing use.
It’s a long time ago.
David Redekop (Host)
Wow. Was there any gap that you identified based on what you thought working in security would be like versus what it actually was?
Craig Taylor (Guest)
We were just trying to figure it out. There was no training program. You couldn’t go into a university at the time and say, “I’d like a degree in cybersecurity,” much less a specialty of forensics or incident response or software development or you name it.
None of that existed, so we were figuring it out as we went. I remember I went to Computer Sciences Corporation in 2000, and they said, “We’re gonna build a web hosting offer internet data center. We have data centers. We wanna host websites for our clients.” They were a large, internationally based managed service provider, a sort of a enterprise managed service provider.
They were supporting companies like DuPont and Raytheon and some of the defense contractors. And they tapped me on the shoulder and said, “Okay, Craig, you worked at a firewall vendor. Firewalls are central to running a web hosting solution. We want you to help build a cybersecurity program.” So we over-architected the whole damn thing.
We had Check Point firewalls on the outside. We had Gauntlet firewalls in the middle. We had Check Point firewall at the third layer between the app servers and the database servers. We had side-door management access to another network. We just did whatever we thought was best practice, and it was so complicated and so costly and slow to do anything, it had to be re-architected within a couple of years, and we simplified.
Essentially, there was no rule book or playbook that you could follow at that time. We were figuring it out. So if there was a gap, it was between what should be done and what is best practice. They didn’t exist yet.
David Redekop (Host)
So many of us that have been in the space for as long as you and I have did end up literally paving the road, as it were, to figuring out the best practices, right?
So that’s for sure. Is there any one particular mistake that you see organizations make repeatedly in spite of a lot of the dynamics having changed? There’s still some fundamentals, especially if you look at it from a psychology perspective, right? Absolutely. What are some of the fundamental mistakes that organizations keep on making in spite of the target keeping getting focused and shifting?
The Biggest Mistake in Cybersecurity: Punishing the Victim
Craig Taylor (Guest)
So there’s one in particular that I’m sure if you’ve read my bio or done any homework on me, you’ll know that I love this topic about psychology and behavior change. I was reading an article today about outcomes. It was talking about Sequoia wrote an article about how AI is changing SaaS companies, S-A-A-S, software as a service, into companies that are service-as-a-software.
They’re becoming service companies because there’s six times the money spent on services than on software. And AI is helping people build software so quickly that it’s the service that makes it valuable, not the software, ’cause anybody can add the features that everybody else has, and you can do that.
But when you go back to the fundamentals of cybersecurity, the biggest mistake I see people making is, what’s the term for it? So at the University of Guelph, I went through a multidisciplinary education. It was called academia. We had two professors teach many of our classes. One was an economist, and the other was a biologist or a zoologist, and they were talking about the value of a whale either harvested or in the ocean, and how do you balance all of these different perspectives on things?
But I learned from that any industry that you work in, any topic, any field of interest benefits from a multidisciplinary approach. And I really strongly believe, I know in my heart of hearts, that cybersecurity has been on a misaligned path with noble goals, but poor execution, poor outcomes.
And it’s evidenced in all the breaches that we find every day in the news, David. And it’s just simply this. For, for so many years, folks, let’s take a step back and just say, how are companies breached? The mid-market and smaller companies are often most commonly breached; if you look at the Verizon studies and other studies, are most commonly through social engineering delivered via phishing. And what do we do about that?
We have to make bigger sticks for clicks for all of our employees so they stop damn well clicking, right? And we’ll go to the extent of firing them if they fail three times when we send them these fake messages. That is such a unidimensional view of how to address the problem that it loses on all outcomes.
It just does not accomplish any of the outcomes you want. It leads to apathy and disengagement. It leads to people clicking more, not less. They’re taught the wrong rubric. When you send these fake messages, you can’t actually type a squat on Microsoft domain for a Microsoft email, so people learn that this domain that I got from the sender is accountresetsrus.com.
Oh, I only have to look for an obviously wrong domain name. Hackers are way smarter than that. They do the M into an R and an N in Amazon and Microsoft, or various variations on that. So punishing people at the root of this core root of this problem is that punishment has never extinguished a behavior, not in any psychological experiment ever.
Just imagine our penal system and courts and laws and the punishments that are handed down by the courts to people who break the laws. Does it stop them from committing the crimes? No. It’s a consequence of the crime. And then if you put them in, incarcerate these adults, and you don’t give them life skills and teach them positive behaviors and reward them for those behaviors, what do they do?
They get out and they recidivise, right? They go back to their old habits, and they cause the same problems. In cybersecurity, we seem to have had this tunnel vision where we wanna punish the clicks and punish the clicks ’cause it’s really dangerous. When someone clicks on something in an email, a phishing, and they click, they could just take the whole company down with a ransomware event or otherwise.
So the noble goal was to stop the clicks, but how we all approached it was so far off the reality of what works and doesn’t work, and I don’t know why. I think it’s because people weren’t from a background like mine, psychology first and then cybersecurity second. So what does psychology teach us?
What does the educational system teach us? You’re in the heart of all the education, I think. In London there, you’ve got a great university. Is that positive reinforcement of good behaviors leads to repetition of those behaviors. It’s that simple. And so when you look at the biggest mistake that’s been made in cybersecurity, it’s punishing clicks, punishing mistakes, and having a culture of, “Slap that hand whenever somebody makes a mistake because we can’t afford the mistakes.
It’s too dangerous,“ without the reality that ostracizes and alienates half your staff. The other half that are willing to do it only pay it lip service, or what I get told all the time is, I don’t click on anything. I send it all to IT, and they tell me if it’s, whether I should do something or not,“ right?
It’s, “ I abdicate responsibility.“ So you’re losing on every front: the knowledge of how phishing is and works. You’re losing on what should I do with this email, that email? And you’re losing on efficiency. People spend hours sweating things out week by week rather than rewarding good behaviors by reinforcing them with positive rewards and gamification on the good things you wanna see people do more of. Number one problem in cybersecurity today
Balancing the Technical and the Human Elements
David Redekop (Host)
You remind me of a company that was promoting cybersecurity awareness training at a technical event, and their bragging point was that they offered T-shirts for their failing students and staff that said, “I clicked.”
And I just remember shaking my head. You pay to be a vendor at this conference in order to find a way to punish? So you and I are on the exact same page on that. I tell my sons to click on everything, click on every SMS. Our approach is, of course, slightly different from the industry as well.
But yes, we want to see what the behavior is of the threat so that we can be more preemptive about them. But you bring up a really good point between the technical and the human element, right? There is the human-only approach, don’t click, and there’s a technical element only, which can be frustrating at times.
How do you balance between the technical and the human in cybersecurity in general?
Craig Taylor (Guest)
I think it comes with awareness, right? You have two problems, big problems. One is that people have been punished so many times. I’ll give you one more analogy before I answer that, David. Training a dog, you can train them with shock collars, or you can train them with treats.
If you try to train a dog that isn’t robust, and when I think about that, I think of the ones we see in movies, like the Belgian Malinois and things. Those are very robust dogs. They need that shock collar sometimes to get their attention. I talked to a trainer the other day that said, when they’re out, 500 feet away, they can’t hear your call, but they know that one click or zap is a recall, and they come running back.
And they’re so robust, they don’t care about it. But there’s 99% of the other dogs in the world would be shaking in a corner if they got zapped, and they would quit. They would go lie down, they would leave, or some would turn violent and try to bite you if you zapped them too many times. Why then are we treating our employees that way?
So you need to do treats. Treats is so much better. The dog likes it, the owner likes it, they wanna do more of it, they engage, and they become a part of the solution. And in the world that we live in, I think too many times people have disengaged. They’ve been punished too many times that they give up or they refuse to engage and learn.
But if we could get them to a point where they’re actually engaging again, learning again, without a fear of punishment, a fear of shame, then it becomes a learning process. And how do you learn? How do you teach these things? And then you go to the principles of education, where you have Bloom’s Taxonomy of Learning is like at the very basic level, show them a video where they can passively consume the content, and if they focus enough, they can maybe learn a few things.
Then you move up a step. You have them interact with an email, and I’m using phishing as an example here, where you go and you pick and choose safe and unsafe indicators that you’re teaching a rubric. Look at the sender, look at the subject, look at the secrecy, authority urgency, emotionality of the email that are reactionary forces to get you to behave without thinking and click something.
Once you teach the rubric, you practice it. You get this muscle memory. And so then when they get that one email that they really wanna click on ’cause someone studied their social media profile and they’re a big golfer, and here’s free golf tickets, they go, “Oh, I was about to click, but I remember.
Sender. That’s not Adidas, or that’s not that golf course. That’s something completely wrong. Oh my God, I just avoided it.“ But that muscle memory creates it. So that awareness has to be taught in a way that people actually can consume it, are interested in consuming it, and then have a way of interacting with it to level up their learning.
And at the end of the day, if you could teach it to someone else, that’s the way to learn the topic the best, right? So those are the kinds of things that we have to be considering as we teach people and address the gaps of the technical gaps versus the people skills in technology today, because it’s, I think it’s 80% human-related and 20% technology.
David Redekop (Host)
Right.
And there goes the polymath concept that you described at the beginning of how education used to be around a lot more topics, or at least a lot more topics coming from the same set of teachers or professors versus just having a deep silo. The thing is, so a lot of our topics are so deep that you don’t really have the bandwidth to study a lot.
But I do notice that the polymaths that I know are always less susceptible to deception of any kind. And you obviously landed in the psychological area of expertise, which has an extremely broad impact in technology, in cybersecurity because of the amount of social engineering that ends up being part of the attack chain somewhere along the way.
And I’m sure that’s also what helped you with the whole leadership aspect of translating complex technical risks into something that a board or a non-technical team could consume and understand, right? Because a lot of the times our clients are not, most of the time, in fact, our clients are not technical.
They have their own area of expertise, and they should be able to be subject matter experts in their space and not have to become tech experts. Was there any particular skill set that led to that translation of the technical risk to something the board and people can understand?
Craig Taylor (Guest)
I think it’s just taking your licks and learning from it, right?
I remember in the beginning of my career, I was still focused on one way of presenting the data, like the CISSP, this is the best practice, this is what you have to do, and I was in the business of saying no a lot. And you realize quite quickly that people stop asking you when all you do is say no. So what we talk about in cybersecurity over the last twenty years, the evolution is that you have to be the yes people, but you say it, “Yes, and here’s how we can do it safely.”
Right? Someone comes up and says, “I wanna deploy this Claude Code agent to all of our workstations. Can I do it?” You say, “Yes, technically anybody can do it, and if we wanna do it safely, we’re going to have to put it on our ‘Buy the License’ that gets it into a non-consuming LLM,” or we can maybe think about deploying our own private LLM, our open-weights model, if we have sensitive data to put in there or regulated data.
And where the answer is, “Yes, and here’s how we do it safely.”
The Evolving Threat Landscape: ClickFix and AI Models
David Redekop (Host)
We’re just at the what, first week or whatever of Muse having risen to the top of the, Yes, App Store, and after, at the tail end of doing some very heavy research into ClickFix, I just realized right away, wait a minute, you know how simple it would be to hijack A Muse VM by just giving it the ClickFix and have people’s voice dictations being rerouted elsewhere?
And what do you know? It didn’t take long.
Craig Taylor (Guest)
And it’s been done.
David Redekop (Host)
Exactly, right?
Craig Taylor (Guest)
Amuse had to go back and say, “We gotta prevent the access to all of the automated access to these things.” I was just listening to that the other, this morning Security Now had a good comment
David Redekop (Host)
Yes, that’s
Craig Taylor (Guest)
right
about it. That’s right.
David Redekop (Host)
Yeah. Okay. So that’s good. I still have to listen to it, so I’m glad he covered that because Steve Gibson’s pretty good at picking up relevant stories. And because of the relevance of ClickFix, and it’s still a growing problem. It’s not becoming lesser; it’s becoming more.
And by the way, you may as well know that we’re releasing a free browser extension called ClickNix, just in response to that very problem, so that patient zero can actually be protected because these ClickFix-powered websites have characteristics that allow patient zero to be detected before it gets displayed, so it’s a form of preemptive defense, and then that feeds threat intelligence.
So we can talk more about that or watch our news feed on that topic. But to me, that’s super important is that the people that need it the most are the ones that don’t have the common defenses that companies like yours and ours offer. Because in their home networks, they have just what their internet service provider offers and their customer premises equipment, and that’s usually not a whole lot of protection because they’re more about not needing any support calls and have everything work instead of figuring how to make it work safely, right?
There is no, “Yes, you can do it, and this is how,” there’s just, “Yes, you can do it.”
Craig Taylor (Guest)
And
David Redekop (Host)
then that’s where it’s left at.
Craig Taylor (Guest)
Speaking of ClickFix, I listened to Steve Gibson this morning, came home, and we just put together a free set of 31 infographics that people can download and use in October’s Cybersecurity Awareness Month, starting tomorrow.
And we didn’t have a ClickFix infographic, so I immediately removed, I think it was breach, the scale of breaches out, ClickFix in, and how to, some recommendations on it. But now you’ve got this browser extension as well. That’s great.
David Redekop (Host)
Yeah. It’s interesting to see when something surfaces, they become so big that it is now, by some estimations, more than 50% of malware infections use it in the attack chain somewhere.
So if we can somehow successfully, as an industry. And this one has no revenue attached to it. So it’s not like I’m offering it now because there’s revenue at the tail end of that. We just feel like if we can somehow disrupt the adversaries by making it so that it doesn’t work anymore, then they’ll have to become a higher class of thief, or they’ll have to find a way to infect elsewhere, but not like that anymore, ’cause that…
I’m honestly tired of that happening because I’m at the point where my own extended family, I’m concerned, especially once it started affecting good reputation websites, where the good reputation websites were suddenly being infected. There’s still tons of Joomla and vulnerable WordPress, and believe it or not, Shopify sites that have infections from old marketplace installations.
Even though those apps have been removed from the Shopify marketplace, they don’t remove the code from websites that had subscribed to them, and then attackers own that infrastructure later on. The whole attack chain of supply chains is really fascinating, and all attackers need to do is keep on looking at the next low-hanging fruit.
So it’s a fascinating space to be in. But I wanted to talk to you about threat evolution as well. What is a threat or tactic that you think that defenders are currently paying too much attention to that, or that, or not enough attention to that they are underestimating?
Zero-Days and the AI Code Scanning Threat
Craig Taylor (Guest)
Anthropic’s Fable. Was it Fable? What was the tool that came out? Mythos. Anthropic’s Mythos first, and then
David Redekop (Host)
Fable, yeah.
Craig Taylor (Guest)
And M-dash. So I think we’ve had Five Eyes advisory from the Canadian, US, UK, Australian, New Zealand government cybersecurity divisions. They all put out a joint notice about a month and a half ago saying, “We have months to prepare for the impact of these frontier models and their ability to pen- penetrate networks by identifying as never-before-found zero-days.”
And I kinda knew that was coming. If you go back to, we have a blog at Cyberhood. And back on April 10th, when Mythos, the first salvo, came out, that we had to stop users from using Mythos because it found too many things, and it broke into too many networks. We need to form a Glasswing coalition and fix everything before we release this to the broader world.
It’s not a leap to say, “What about the rest of the world that is doing software development that’s not part of your 50 or 100 best, biggest software development companies?” The rest of us are gonna be in a really bad place once these tools become common. And so I started the warnings.
We did some AI readiness with our customers and did some trainings on those things. At the end of the day, that’s an area where I think we’re ill-prepared today. I think Steve Gibson has talked about it. I’m not sure if your podcast, if you’ve gone into it, but I think we’re in this period where we might have an 18 to 24-month window where social engineering and humans become secondary to causes of the major breaches that we see in the news, and the primary cause will be these zero-days identified by frontier model scanning software that hasn’t been scanned before by AI.
We’ve came basically to a threshold, a pivot point in software development where humans are like Garry Kasparov playing chess 20 years ago against IBM’s Deep Blue. We might’ve been good enough for long enough that we could play chess and be the world’s greatest, and then IBM Big Blue came along, Deep Blue or DeepMind, I forget what they called it, and it became the chess champion of the world, and never again will a human beat a computer at chess.
That’s happened in software development now. It’s 100% clear to me that humans code insecurely, and AI software and AI coding can do a much better job of identifying, offering fixes, offering patches, and then humans still have to go through that whole process and validate and implement and test and regression test.
But we’re looking at two years of breaches tied to frontier models breaking into companies and causing great harm. And then after that, by two, three years down the road, all the software that’s been released and all the historical software that’s been released, hopefully will have been scanned and patched and fixed to a point where we’re in these calmer oceans where there aren’t very many zero-day vulnerabilities to be found anymore until the next great evolution, maybe quantum computing or something big happens like that, we’ll be back to humans being the weak link.
But I think we’re going from humans to zero-days for the next two years, and then humans again.
David Redekop (Host)
Greg, I’m a glass-half-full kinda guy, but there are times when I turn into a glass half empty, especially if I’m looking at the real data that’s in front of us. And when I saw over the last three months how Microsoft is patching upwards of many hundreds, close to 1,000 bugs per Patch Tuesday, and speaking of Security Now!,
and Steve Gibson, he feels that not that there’s a specific timeline to it, but that ramp is coming, but that it’s gonna come to a drop because there is a finite amount of code. Therefore, there has to be a finite number of bugs to be patched. By now, they have been discovered at such a fast pace that maybe we can avoid that chaos theory that you just described on the larger items, like at the operating system level, maybe at the consumer-grade router level.
But it’s still gonna mean that people have to patch, right? And that’s the glass half empty. Yes, the patches may be available, but then at the same time, you can now turn your Windows 11 to never be patched because the amount of patches causing so many problems, there are sysadmins that are understaffed, that have a low enough budget that basically say, “We can’t patch and keep everything running because the patching breaks too many things.”
And so that’s where this constant divergence is, and there’s no better arbitrage out there than the adversary who says that is a window of opportunity for me to create an event,“ right? And so then I’m back to glass half empty, and I don’t know where I’ll land by the time I go to bed tonight.
Craig Taylor (Guest)
Here’s what we know. David, you’ve really touched on a number of things here. AI has enabled the attacker to de- deconstruct the patches that are out there. So when Microsoft releases 1,000 patches, and 110 are critical, any AI tool in the hands of a hacker in an open-weight model that doesn’t have the guardrails up can say, “Okay, how do I exploit this?
Build me an exploit for these three critical vulnerabilities in Microsoft.“ So a security professional like us says, “You have to patch faster,” because they weaponize the patches within the same day. It used to take 200 days 10 years ago, and then it took a month, about a year and a half, two years, three years ago.
Now it’s almost the same day where they can create exploits for these patches that we’re told, “You gotta patch ’em today. You gotta turn on automatic patching.” But if I do that, then my wife had to go into the office yesterday on an emergency basis because her computer couldn’t join the domain ’cause Microsoft broke domain-joined computers that were remote right
until they went in and connected to the network and got the updated whatever, and Steve talked about that, too. And I was like, “Oh, yeah, she texted me.” “Why did they do this to me?” I’m like, “There were 1,000 patches. They missed that one; it’s happening.” But at the end of the day, we have to patch faster, and hopefully over time, we address the major stuff, and then we get down to a more normal set of patches that can be better regression tests so that you can apply them automatically, immediately the same day.
We can get to that nirvana where we’re not exposed for these extended periods of time while things burn in and we wait to patch, and we wait for Microsoft to re-release things. It is a glass-half-empty, sorta half-full scenario, and I do waffle like you do between the two. You’re absolutely right.
Leveraging AI to Do More With Less
David Redekop (Host)
We’ll just have to use the description that the glass is at 50% capacity.
And that way it’s ambiguous as to our emotions about it at any given moment. Craig, if a security team has a very limited budget this particular quarter, you and I are both somewhat biased because we offer services in sort of different areas of focus. But objectively, what’s one defense mechanism that a team with a limited budget should prioritize to fix?
Craig Taylor (Guest)
I’m gonna answer this in a different way than I have in the past. In the past, limited budgets, you can only do one thing. I’m always throwing out there a couple of technology solutions, like a password manager adoption, or make sure M-MFA is on all your critical accounts. That’s great table stakes.
It almost doesn’t cost anything to do those things than the software license. But here’s what I would suggest. In the world we live in today, train your team on how to use Claude Code or an equivalent coding solution, because that’s going to be your salvation to your budget crunches, “I need more people, I need more this, I need more that revenue, I need to spend more money.”
No, you can actually use AI and some of the tooling that’s built into AI to train your people better, to develop a new application that solves a problem, to analyze your own code for vulnerabilities and fix them before you release, to build a QA person in code by testing every feature and functionality of your software without a human having to be in the loop so that after you release new code.
Because let’s face it, the coding and AI are predictive engines. They don’t realize that when you change this variable, that variable over there was dependent on the variable we just changed, and so that breaks, but it’s not even related. What do you mean it’s tied to it?
But we’ll just run the whole test, touch every feature and functionality in your software with an AI QA test, and you’ll tease out those mistakes before you release. So you can actually build more people into your team as you develop the ability to leverage these intelligence engines, right?
The article by Sequoia that I was referencing earlier, or talked, I read about earlier, talked about judgment and intelligence. There are entire fields of work that are all intelligence-based. What did you learn as a lawyer in the bar and all the legal casework? That’s a lot of intelligence.
But then you have to layer on some judgment on top of it to work in the court system. So the judgment is what’s going to remain post- AI, developing the intelligence that it can do the job of case law and research and whatever the other fields might be, coding software. Judgment will tell you which features you need to build in, even though you can build everything in.
You shouldn’t. You should only build the ones that judgment tells you. So that’s, I think, where people need to spend their time and their energy, is learning these systems and how they operate and how to put them to use for your own team.
David Redekop (Host)
I’m sure you use this approach in your company.
Craig Taylor (Guest)
Yes.
David Redekop (Host)
What have you found that you had not discovered before by using AI as a mechanism to exploit your own weaknesses or to attempt to so you could identify what you need to fix?
Craig Taylor (Guest)
We’ve paid firms in the past to do pen tests and vulnerability assessments. And what I discovered is we don’t need to pay firms anymore necessarily. We can use Claude to analyze our own code and OpenAI and other tools to scan our code for vulnerabilities and chaining vulnerabilities together. A lot of the bleeding-edge zero-days out there are not one major vulnerability, but two or three that, when you put them together in this order, “Hey, we can get root, or we can get a command shell or something.”
And so we’ve learned to use AI to scan our own code, to then propose fixes. We often have our two AIs of choice argue with one another over the fix. So we’ll say, “Here’s a fix that Claude says we should use. Hey, OpenAI, does that fix look good or is there something wrong with it?” And OpenAI will say, “Clearly, they forgot this part.”
And you send it back to Claude and say, “Did you forget this part?” It goes, “Oh yes, we forgot this part. Let me put that in there.” And if you can get them talking back and forth and challenging each other, you get a better outcome overall. So that’s been a learning moment. We use AI for a lot of things we do in our company: content development, support, we’ve got a chatbot, coding, just anything and everything we can.
We’re a small shop, and we use it to great effect. It’s been really helpful.
David Redekop (Host)
Yeah. It’s hard to see any company that’s going to be around two, three years from now not applying it today because it’s pretty much a necessity to keep up with the productivity of everyone else at the very least, right?
So even if, even for industries that may not have deployed this in the past automation or AI of any kind, they are now at the point where they need to. Are there any particular industries that you’ve found that will not be changing much in the near term?
Craig Taylor (Guest)
What’s not going to change much in the near term?
I think humans are still gonna be the weak link. Social engineering and an inability to train them to spot those attacks. They just keep morphing. It’s almost like Whac-A-Mole. You could say, “Oh, here’s a new one that’s a big one, OAuth permissions and consent phishing.” You get to a website, it says, “Can I use your Google, Facebook, Microsoft credentials to log into this website?”
And you say, “Sure.” Users just say, “Sure.” You can also be granting that access to your email. The permissions aren’t really front and center anywhere. If you haven’t tied down your O365 or Google to block that, your users are really just free-for-all-ing. Everywhere they go, they just say, “Oh, it’s so much easier.
I don’t have to remember another username and password.“ You’re granting access, and there’s hackers out there that are phishing. So humans are still, will always be a weak link here today, tomorrow, and into the future, and keeping them educated on the attack is a constant battle, a constant struggle.
Final Thoughts and Goodbyes
David Redekop (Host)
In the show notes, I’ll make sure that we include a link to Cyberhoot, your website. Nowadays, it pretty much is a given that all security vendors need to offer something that’s of, “Hey, here’s a way to try things out.” I’m sure you guys do the same.
Craig Taylor (Guest)
Yes. Yeah, we have a free 30-day trial in our platform.
I’ll just say that we’re a positive reinforcement psychology, educational, cybersecurity, best-practice firm. So if you take those three circles, put it in the middle, it’s what we’ve tried to build at Cyberhoot with gamification layered in. So people actually enjoy the training. There’s no punishment, there’s no shaming.
It’s all positive. We give a free 30-day trial, and what’s really nice is if anyone comes to us and mentions the Defenders Log, we can throw a 20% off coupon for the first year to them. Happy to do a shout-out to your users there and give them that benefit. Cool! If they do sign up after the free 30-day trial.
David Redekop (Host)
That sounds good. Sounds good to me. And just so that everyone knows, we don’t have a horse in your race or vice versa, as far as I know. We have no investment or stake in your company, and neither do you in ours. But I find that it’s really important for our industry to get together. Cybersecurity goes deep and wide, and the only way that people can be protected, which is our mission, is to protect people, is for that protection to be broad, right?
Because attackers only need to find one weakness, but we really need to find them all and protect them all. I do have one final question for you, though. Looking back at your journey in the defense space, what’s a single piece of wisdom that you would like to impart to our listeners?
Craig Taylor (Guest)
I often use this one because too many times you find technologists who feel they have to prove they’re the smartest person in the room, and what I would say is you have two ears and one mouth, so you should listen twice as much as you speak, and you’ll learn a lot from that.
David Redekop (Host)
That’s very good.
So I’m hoping that by the time the NHL season wraps up, you’re gonna have two very good ears of all of the Toronto Maple Leafs fans screaming. My sons tell me that they have a good team this year.
Craig Taylor (Guest)
Is that right? I was watching the Bruins last night, and I’ll be honest, they couldn’t connect a pass.
I’ve made more passes than they made last night. Oh my gosh, it was something. But they ended up winning. I didn’t watch the third period. I went to bed, So, we’ll see.
David Redekop (Host)
Our sons have never seen the Leafs win the Stanley Cup, and they would absolutely love to see that happening.
And for some reason, they are optimistic that it could actually happen. Well, you never know. Way too early to tell.
Craig Taylor (Guest)
Unless I’m mistaken, and I don’t wanna say anything bad about the Leafs, I used to be a Leaf fan years ago, but I don’t think they’ve won in my lifetime. No. or yours.
David Redekop (Host)
No.
Craig Taylor (Guest)
No. So not our sons, but even us, we haven’t seen, Yeah. the Leafs hoist the cup.
David Redekop (Host)
I know, but it’s too embarrassing to express that when, I’m a fan by extension, not that I know much about hockey. I play ball hockey, Oh, there you go. on a men’s team, just for fun because it’s good exercise, and my goodness.
But yeah, hockey keeps us alert and sharp. And looking forward to connecting with you again sometime in the near future, Greg.
Craig Taylor (Guest)
Thanks very much, David. I enjoyed today. Thank you so much.
Show Outro
Announcer
The Defender’s Log requires more than a conversation. It takes action, research, and collective wisdom. If today’s episode resonated with you, we’d love to hear your insights. Join the conversation and help us shape the future together. We’ll be back with more stories, strategies, and real-world solutions that are making a difference for everyone.
In the meantime, be sure to subscribe, rate, write a review, and share it with someone you think would benefit from it, too. Thanks for listening, and we’ll see you on the next episode