The Human Element Managing Risk Beyond Technology

Right. Thank you very much everyone for still being here. I'm Ed Claus, the presenter at Sky News in London and I'm sure you've all had just about enough of listening to people talk. So, we are here to try and grasp your attention for 25 more minutes. And uh I've got a newborn baby at home, so I'm sleeping far too well.

And I'm hoping our panelists today will be able to give me something that keeps me up tonight. Uh this is a pretty terrifying subject that we're going into, I think. And uh that kind of excites me and I hope it excites you guys as well since you're still here with us. Um but first, a quick anecdote. On February 6, 2016, hackers of alleged North Korean origin requested payments of nearly1 billion dollars from the Bangladeshi central bank via Swift.

It was human error that allowed these payments to start trickling out one by one from the central bank via the Philippines and casinos in Hong Kong. Some of the payments were stopped, but others were able to trickle through. And in the end it was Deutsche Bank, a routing bank that was able to spot the hack as it took place because one of the fake shell companies was called the Shaquila Fundion or Fondaton instead of the Shaqula Foundation. It was a typo that allowed DB to catch this happening. So ultimately the technology all worked perfectly.

It was human error that caused the hack or allowed the hack to happen and it was a human that caught the hack and prevented it and all the money was recovered in the end. So I want to start today by asking our great panelists here what it is about human error uh that makes us still the weakest link in a world where technology is more powerful than it's ever been. and we've got an amazing array of expertise on the lineup here today. So, I'll start with Andrew to my left from Preight here in Abu Dhabi. Andrew, what do you think is uh is really driving this this this failure of of people in the workforce?

Yeah.

So, so I think there's a there's a plethora of different challenges that we've got. I think one of the challenges is is you know technology and in particular AI has become so powerful over the past few years that you know we're all heavily reliant on it. You know, if we look at our daily interaction, you know, how we engage with technology, how we engage with AI, you know, even [snorts] things like chat GPT has moved from what was, you know, the fifth page on our phone to the front and center. I think the problem with that is we've become so heavily reliant on it and actually, you know, we've we've almost isolated the two. The two don't work in parallel.

I think if we look at the organizations and where we're really working successfully and the organizations that work successfully, they marry the two together. You know, the answer isn't AI, the answer isn't technology. You know, you have to really understand what it is you're trying to solve for and how those two things work in parallel.

Bill Murray from Tower Group, you've you've got this uh amazing insight into sort of human behavior and the behavioral aspect of of this. Can you just give us a sense of what organizations can be doing to try and, you know, safeguard against this this weak link? Yeah, my my background on this is really thinking of it first of all from uh past history where I was working for the British government in a very secure area where we would think very much about the sort of human elements of the threat. So there's that element. Um and as TA capital we're also investors in a company called Dream uh that is a defensive cyber uh company um operating at sort of government and big institutional but is actually founded out of an offensive cyber company uh out of Israel uh which brought us um the Pegasus attack which has been seen out there.

So sort of as investor involved and then in my past in government uh involved thinking about it and and my reflection sort of slightly taking uh from the previous question apologies but I think there's this sort of arms race of AI versus AI in offense and defense uh and you can see it being employed with more and more sophisticated attacks uh more and more sophisticated defenses and yet what is a constant in this is the human interface with the technology uh and that of often that is the target for the technical techical attack. So the technical attack is looking for all those vulnerabilities of people scarce on time, scarce on attention. Uh and it's looking to basically trick or fool those people into making a mistake uh or sometimes a sort of slightly different using the human as an insider, but but the mistake element of it. and therefore thinking a little bit about how we can be creating through training whether it be through culture uh just awareness giving people time to reflect uh structures within the organization risk management I think there's a sort of a whole range of different things that can be done at the human level to start ameliating some of this AI versus AI arms race that is going on in the threat and the defense of the threat space and I'm sure we'll unpack some of that Yeah, like you work on this issue of AI versus AI and one of your areas of expertise is on agentic AI defense and can you just talk a little bit about what we're seeing in the space of defense versus offense and how that's changing so rapidly? Yeah.

So I think before we get to that questions one thing is that what what is really is really agentic AI infrastructure that we're talking about and so imagine you know uh previously you know Bill and Andrew talk about um is that we have a lot of human errors and then imagine a lost credential now being used by agent um that have access to 20200 tools. So that really amplified the risk there. Um so using human alone to to basically uh to manage that uh defense against a gentic system is very difficult. So what we're trying to do right now is that that level is not only just using a agent uh to to manage that situation. You infrastructure level you also have to set up in a way uh to facilitate that.

So for example that we need to understand identity of agent right. So we have access for humans then we have um priorit priorities and access but now what is the how do you identify agents and how do you give them least privileged access to certain information

and how do you manage um 10,000 100,000 agents simultaneously at a scale and without breaking.

So those are the area that we're looking at right now. Travis at Abacus Group, when you look at this kind of the threat vectors that are out there that that Lake is des and also that Lake is describing from a defensive p perspective, what what kind of worries you and and and what what is kind of exciting you at the moment in that in that world?

Yeah, so the threat factor has changed pretty dramatically in the last few years and it's not that everything is a brand new agenic threat. It's that a lot of the things that were already there have just been amplified. So really I see it as kind of three factors where AI's played into the expanse of cyber crime. One is that it's easy to become a cyber criminal now, right? You can learn how to do it with chatbt and YouTube.

5 years ago, you had to be a pretty good engineer. Not to say that it was ever really hard, but you don't stumble upon that information as easily as you can now. The second is that the but for the last 20 30 years the easiest way to get that initial access into an organization is through the social engineering through fishing emails through phone calls. Now instead of having to spend weeks doing reconnaissance I can tell an agent to go look up Bill Murray everything he's ever written everything's ever published and write me an email in his tone of voice

right put the commas use the UK spelling instead of the US spelling it's very very easy to do that at scale so you can you don't need to be a good engineer to get into it. You don't need to be good engineer to get the initial access. And then in just a couple months ago, we saw the first case of a genic AI being used to deploy ransomware. So now we're in this environment where anybody who wants to be a cyber criminal can. They can target an enormous number of companies all at the same time very quickly and if they do get access, they get lucky, they can buy off the dock web the means to go the next step further.

So we're seeing just a massive increase in the number of attacks across our client base of you know about 1,200 funds.

Is that social engineering more important than ever perhaps zero days malware ransomware I mean they were all the kind of buzzwords 10 10 years ago but now with things like AI voice cloning you just need to know the payment flow of a company to know when the the day the invoice comes in and you clone the CFO's voice and request the payment from the CEO to be sent to a different account. I mean, is it more about understanding the human element now?

I it's it's still both. I mean, there are still zero days that are out there. We still we do we'll probably do about 500 penetration tests this year. We've discovered a number of zero days that we've leveraged, but much more often that initial access is through social engineering. And I'll say particularly in the PEVC world, the campaign that we've personally used to ethically break into clients is to clone the voice of their one of their portfolio companies CFO and then call up into the management company.

It used to take a good 10-minute interview to be able to do that. Now we can do it off of someone's voicemail.

Yeah.

Well, there you go. That's quite scary. That's a good uh good start. I mean, I wanted to ask about, you know, investing in people versus systems from a defensive perspective. This is something we were talking about just before we came on.

Is it more important for a company to be training its employees to know how to, you know, defend against attacks or is it more important to just say we will never be truly safe whilst we employ human beings because there's always going to be human error. So let's just fully back uh AI defense systems or you know other digital defense systems. Uh it's not a binary of course, but which way are we leaning as a panel?

Let's hear your go down the go down the row. I I think you know I I work for an AI company you know I think that the two come hand in hand um you know there's the there's the expression you know that you innovate at the speed of your slowest decision maker and it's absolutely true in this space you know the the the threats are coming and they're you know they're innovating quicker and the organization as a whole you know has to innovate at that speed to keep up with them. um as presite you know we see the two things working hand in hand you know people and technology and that's going to be absolutely key moving forwards because actually you know what it's there to do and what technology and AI should be there to do is you know augment you know remove the mundane but allow the you know allow the human to do the real high value task you know which is ultimately going to deliver the most RI to the business

bill where where are you leaning on this

well I I think you know if you're dealing with some systems that are wholly automated then clearly it's a technology fix and it's a sort of tech versus tech kind of issue. But almost all companies have a human in the system. I mean some actually in their security systems build the human in the loop in precisely because they feel that a technical a wholly technical solution is itself a risk. Uh and so the human in the loop then becomes something that you then need to train make aware uh and give the space to actually be there. I mean I think an observation when we we were having a sort of bit of a back and forth on this in the back room uh with with the fans of AI Lake and looking at you.

Um but I think my point was that the the the good culture that you would want in any organization to deliver what your organization's core business is is the same culture that you would want uh for your cyber security. people being open about the mistakes they've been made made uh receptive to training, receptive to ways of working that give them enough time to consider what it is they're doing and therefore being less vulnerable. Uh and so therefore I would sort of say it's baked in that you would want to be giving this training to your people.

Is is there a deep enough talent pool in this space to provide that kind of training and expertise to every company? I think my quick repost is that yes there is some specialist element to this but actually I don't I think most of the skills uh or the culture you require for cy good cyber security is a generalist culture right uh and certainly the observation from friends of mine who have been responsible very specifically for this in the foreign office when I was asking for some feedback ahead of the session he said invariably every time there was a major breach it turns out that there was poor management involved just just straightforward management that it was a badly managed section and then the mistakes were made within it.

Yeah. So blame your boss basically is the

throw them under the bus. [laughter] Yeah.

Lake, please give us your perspective.

Um I know Bill already kind of [laughter] a little bit. Um but I do say that you know I I am an AI professor and then it's a I'm conflicted on the one side is and you know my part of my job is actually it's an educator that we need to help human um but on the other hand I think even for education by itself like workforce education or student uh in in uh um uh higher educa higher education is that we we cannot really completely do education without mentioning AI. So even like training is AI assisted training as well. Um so if I were the CFO I would probably put 70% of investments doing AI tools and 30% in human

70% to AI tools 30% to human training. Yeah

like pure human but I would say the 70% a good amount actually going to AI system tools simulated. simulated.

I mean I just one thing I'd say is you know the threat if we're talking about the fishing attack the external attack against the company I'm probably more with with Lakes's point of view but there's also the insider threat which I think many of us are still sort of are aware of as an increasing issue or disaffected employees or straightforward people being suborned and I think that is an issue and that really is about the human is the human dimension of that and that really is around good management aware of your staff and integrating your kind risk matrix that often you'll have an IT risk matrix or you know the technical risk metrics which is picking up on the on the attack the technical attack side of things but is unaware about the disaffected employee who's uh having you know fallen out of love with the organization etc who becomes a key vulnerability uh and needs support but if necessary also monitoring

is there almost a compounding effect there of leaning too heavily on the technology and placing that in the hands of one or two people concentrating it and then allowing them to become a a weak point that can be exploited.

Well, I mean, I believe so. And actually, I'm going to sort of throw the ball down that end. There's always the classic cyber discussion about who owns cyber in a company. Is it owned by the CISO or is it a board risk? And that's not quite about threat mitigation.

It's also about considering the vulnerability and how you prioritize it. But it does really sort of speak to the culture of the company about whether they see this as a technical issue or they see this as a more holistic issue including culture and structure.

Uh so I think it is an indicator of how a company views the threat.

I mean Travis you straddle these two worlds of the human and the technological you have deep technical experience and expertise. Where do you land on this?

Yeah I mean there are a lot of areas where AI can be embedded to increase the security but there's no it's not a panacea. There's no oneizefits-all that's going to protect it all the way down. It's why we've been talking about a defense and depth model for years and years and years. But cyber is not about eliminating the risk. You're never going to do that.

You'll always be chasing the nines. It's about risk mitigation. You look you look at the areas, the opportunities for there to be a situation that would be dam cyber incident and you try to reduce that. So you add email security. Can you get one through?

Yes, of course. So you do uh end user security training. Then you're going to have multiffactor authentication. Can that be bypassed? It can.

and then you need endpoint and you go down the list and you mitigate the risk. But a lot of times when when we're working with clients now um one of the things that are top of mind aren't necessarily an external threat as you were saying an insider risk not from a malicious standpoint from an accident. One of the most interesting um exercises we've done this year with clients is a tabletop of their instant response plan where instead of walking through what happens if Bill and accounting clicks on a fishing link, we say what happens if Bill and accounting drags that investor relation spreadsheet into the wrong AI that we don't have an NDA with. Is this something that we have to report as a material cyber breach?

And that's an interesting question for the lawyers and it depends on the you know the regulatory environment. But those are the thought processes where you start looking at, oh wow, you know, we don't have any data loss prevention on our endpoints. We don't have any data loss prevention that's covering dragging things into the web browser. We do for email. That's a gap.

We can do we can do things to mitigate that. So it's a matter of really keeping an understanding of how are these systems being used, where are the safeguards around how they're being used, and then trying to progressively reduce that risk without handicapping productivity, which is always a balance.

Bill, did you want to jump in there? Well, I was just going to say it's interesting when you think of those different alignments of motivations within a company because at that point you can understand the legal uh team sort of jumping in to say well let's think about liability on this how transparent should we be uh you can think about the sort of the cyber team sort of thinking no we need to jump into this quickly and mitigate uh you can imagine within an HR system have they built the kind of reporting structures where the person actually puts their hand up quickly and says I think I've made a mistake we need to kind of lean into this you can imagine the sort the privacy again sort of legal and HR being mixed into this where for example if you had an oversight which is overly intrusive because you don't trust your staff and you wish to kind of catch these things automatically that itself leads to some sort of alignment issues and indeed might sort of build up a fairly hostile internal culture. So I I you can kind of see that there is another challenge there of trying to make sure that that you try and align the various incentives within the organization that is supportive of what you're trying to do on cyber security and indeed multiple areas within your organization

with with with technological progress happening at such a fast clip today with AI particular how do you keep up the you know threats keep up a kind of clear view of the threat surface at any organization particularly as you're trying to train employees to use new technologies all the time. I mean, is is that kind of something that keeps you awake at night, Andrew, with your financial clients?

It doesn't it doesn't necessarily keep me, but certainly with clients, it does. Absolutely. I think again, if we look at the clients that are successfully adopting and and using AI across the board, you know, it's it's really, you know, a collection. You know, it's not about technology. It's about what we're trying to do as a business and what we're trying to solve for as an organization.

and then pulling together the resources to ensure we solve for it in the right way. I think with traditional technology it's you know it's being led by the the CTO the CIO I think this is led by the top this is led by the business it's led by the CEO and they then have the cultural delineation down to the respective teams and have to bring everybody on board and as part of the journey

I I was just going to say and the other thing is we talk a lot about uh CISOs and CTO's but board um composition is really important as well because today even for um Fortune 500 companies if we're looking to you ask the question is how important is the cyber security who's on the board uh which committee is oversee that risk and you're going to very get a very different answer and someone will say it's audit committee someone don't even have risk committee under audit and then and some are just only give it to audit committee but you have to think about you know for example we said the incentives then uh compensation committees finance company need to approve those kind budget,

but most the boards today still know very little about the cyber security risk and how it's going to be driven uh how it's going to be amplified by the AI development.

Travis,

yeah, I would certainly say that it's it's becoming elevated to a board level consideration and a lot of the financial regulators be it DORA, CSSF, they're starting to make that very explicit in the regard because it's it's kind of had that shift over the last few years from cyber being seen as just a cost center, right? It's just throwing money away and we hope it's like insurance, right? You hope you don't need it, but you know, you kind of have to have it

to now people taking the mindset like we can't get a put option on our cyber security, right? It's not something that we can really hedge against. It is the hedge.

Yeah.

So, it's it's we're starting to have the conversations much above where we were before. It used to be maybe there was an IT manager, one guy doing security. Now the conversation usually starts with the CFO and then you then we bring in the COO and a few others as well because there is a lot of buyin uh for that across the organization and the boards.

Yeah. I actually have a qu have a story here. So one of the uh large company I'll say they're have a multi-billion assets and then um I was giving board training to the organization and then they said well we're we're in retail business that cyber security we're not going to be a target right so uh we're not as important and we're less known even though we have a multi-billion assets and then six months later they got basically have run some requests So all of a sudden the board does not know who's really they talk to. They don't have third party vendor. They don't understand who on the board who is on an executive team member should take take what next actions.

So I think that's that that's kind of incidents that make people realize that it's not cyber security is not just um an important high priority for some of the companies across all. It blows my mind that any company in 2025 thinks that they're not a target for cyber attacks. I mean, if you do business, you have some amount of money and it's easier than ever, as Travis was alluding to earlier, to just run programs that attack day and night thousands and thousands of companies, uh, you know, simultaneously. It's not, you know, sitting there having to code each attack, you know, individually. Interestingly, what are we made an acquisition earlier this year of a incident response team that works directly with cyber insurance companies and the interesting trend that they've seen is that the the ransom that gets asked for is not commensurate with the size of the business.

It's how much they're insured for,

right?

So, a small a small company that's still insured for a million dollars is still a potential payday for it. So, it's not as you said, it's not the huge companies that are the targets. Everybody's a target all the time.

Yeah. I mean, like you said, I actually don't need to know how to code. I can just use natural language and research how many companies currently have how much of cyber security insurance, right?

And what's the premium is?

Well, that too, but also if they're in a position to deploy ransomware, they can probably go on SharePoint and grab your insurance policy and look at it. We we see forensically they're actually searching to see that policy before they write the ransom code in.

This is easier than ever, right? And we're giving you all

it's part of the playbook.

Yeah, we're giving everyone good uh ideas here or maybe bad ideas. We're running out of time, so I just want to get a quick um feel from the panel about what's coming down the pike 2026. You know, we're approaching the end of the year. What's everyone looking for next year in terms of in the in this space? You know, how how are you, you know, seeing threats evolve?

What what is the kind of one thing that you're watching out for in 2026? Andrew, we'll start with you.

Yeah, I think we can, you know, we can guarantee that the threats are going to continue and they're going to only get more sophisticated. I think we've discussed it as a panel today, but I think what we're seeing from the organizations that we work with is this is, you know, becoming top of mind and it's something they're having to deal with today. So, I think that's my prediction in terms of what we're seeing. You know, it's coming. It's happening already.

You know, the organization has to adapt to it now and has to, you know, bake it into their operating model.

Bill,

you'd be amazed how some big organizations are still buying cyber. I'm delighted. Dream is making money off this, but big names you think should have it don't have it. Interesting lake.

Uh I think one of the most interesting and challenging is AI alignment. How do we know that models we had develop developed align with human value and then organization uh target as well.

Good stuff Travis.

I think we're going to see a high double-digit increase in the number of attacks across the board across all industries and any organization that's looking at their security posture the same way they did in 2022 is going to have a really tough year. That's the thought we'll end on to keep everyone up tonight. Thank you so much to my panel, Andrew, Bill, Lake, and Travis. And thank you all to still being here at the end of the day. Cheers.