Mythos, Glasswing and the View From the UK GCHQ

Episode Summary

Hosts David Simon and William Ridgway welcome Skadden colleague Nicola Kerr-Shaw to discuss how AI vulnerability discovery tools such as Anthropic’s Mythos are compressing the timelines around vulnerability discovery, exploitation and remediation, and what that means for board oversight, disclosure obligations and incident response planning.

In the second half of the episode, Shehzad Charania, director of legal affairs and policy at GCHQ, shares the U.K. government’s assessment that frontier AI is materially changing the cyber threat landscape by increasing the speed and scale at which vulnerabilities can be found. He explains that organizations that have not addressed their cybersecurity fundamentals and technical debt will be increasingly exposed and warns of a coming wave of forced corrections across the technology ecosystem as AI accelerates the discovery of flaws that must be remediated. His message to boards: make cyber a board-level responsibility, prioritize resilience and plan now to deploy updates quickly and at scale.

Voiceover (00:01):
From Skadden, Decrypted is a podcast exploring the latest developments in cybersecurity and data privacy strategies, risks, and regulations.

David Simon (00:11):
Welcome back to The Decrypted Podcast. My name is David Simon. I co-head the cyber and privacy practice at Skadden, I’m here with my partners, Bill Ridgway and Nicola Kerr-Shaw. We are so excited, we have a great show for you today. We’re going to be talking about these next generation AI-enabled cyber threat, vulnerability scanning, exploitation, technologies, Mythos and Daybreak among others. And after that, we have this amazing fascinating interview with general counsel of the British equivalent of NSA, GCHQ, Shehzad Charania, who’s going to be talking about Mythos, cyber best practices, and all these other things. It’s going to be really awesome. So just to jump into it first, we’re going to be talking about something that’s really gotten the most sophisticated cyber and legal teams increasingly focused on vulnerability management and vulnerability discovery tools and what they really mean for cybersecurity, for governance, for legal risk, for boards and everything else.

(01:03):
And so this is not really just another generalized AI hype discussion. The question here really is, what are these tools going to mean? Because they really can materially compress the timelines around vulnerability, discovery, exploitation, remediation, disclosure. And it’s going to mean that organizations have to think about handling multiple incidents at the time about some of the relatively new reporting obligations that apply and how organizations are going to have to operate through a period of disruption over the coming year and what it means to be legally prepared there. So over to you, Bill, and welcome. Good to have you on again.

William Ridgway (01:37):
Thank you, David. Exactly right. And we’ve certainly had a lot of conversations with various companies dealing with this. Historically, as we know, cybersecurity programs, they were built around a set of assumptions about how quickly vulnerabilities were discovered, prioritized, and exploited. And organizations really built their entire systems around that reality. You talk about patch cycles, change management processes, downtime windows, escalation procedures and whatnot. The concern now isn’t simply that AI tools may identify more vulnerabilities, it’s that attackers increasingly may be able to operate at machine speed using the tools that they may have, while many enterprise remediation and governance processes, they still operate at human speed.

David Simon (02:19):
Exactly. And so that’s why we’re so delighted we’re joined here today, as I mentioned a moment ago by our partner, Nicola Kerr-Shaw from London, who advises clients across Europe on cyber incidents, privacy, AI, and regulatory response. And before joining, was thinking about these issues as the leader of the global program on these topics for the largest French bank and one of the largest banks in the world. Thinking about this from the perspective of a major financial where one of these tools probably were being thought about much before all of us were. So Nicola, so great to have you back.

Nicola Kerr-Shaw (02:49):
Thanks, David. It’s great to be back. I think what strikes me about this issue is that it cuts across technical operations, governance, and legal obligations simultaneously. The cost companies are increasingly realizing this isn’t just a security team issue anymore. It has implications for disclosure timing, board oversight, instant response and regulatory expectations.

David Simon (03:10):
So I think we just sort of just started to think about this. Why are companies paying such close attention to Mythos Preview, which is a Claude and Anthropic product or to OpenAI has something called Daybreak. Many different of the frontier labs have something like this. And we thought we’d just talk a bit about why is this such a big deal? Anthropic publicly reported that this Claude Mythos Preview in controlled testing environments identified previously unknown vulnerabilities, which reportedly include vulnerabilities affecting major operating systems and browsers. What we think really caught people’s attention wasn’t simply the sort of AI-assisted research. It was that this vulnerability discovery tool and this ability to discover and exploit these vulnerabilities at scale would dramatically change what cybersecurity means, both from a defensive perspective and also from sort of an offensive perspective.

William Ridgway (04:04):
David, as you know, that the trade-off oftentimes was this balance against the security risk against operational downtime. And that’s certainly not irrational. It’s actually a reasonable way to be thinking about this, but if discovery and exploitation timelines compress materially, the balance probably should change.

Nicola Kerr-Shaw (04:21):
Right. And there’s also an economic dimension here that may not get enough attention. Historically, finding high value zero day vulnerabilities required a very specialist talent, significant time, and a lot of manual effort. If AI meaningfully lowers the cost and time required to discover exploitative vulnerabilities, that potentially changes the economics of offensive cyber operations quite dramatically.

William Ridgway (04:48):
That’s right, Nicola. We oftentimes associated some of these zero day vulnerabilities with nation state actors, but certainly now we face the risk of criminal groups writ large having that level of capability, which changes the dynamic.

Nicola Kerr-Shaw (05:01):
Yeah, totally. And from the government side, what becomes difficult is that the legal and operational timelines start converging much more quickly. Historically, organizations often have more time to investigate, escalate internally, and assess legal obligations before things became urgent. And the concern here is that those windows may compress significantly.

David Simon (05:24):
So what does this really actually mean for companies? Thinking about disclosure and escalation timing, Nicola, welcome your thoughts and I bet listeners are wondering, what does this mean from a legal and operational perspective? What actually changes for companies if these timelines compress?

Nicola Kerr-Shaw (05:38):
The way I think about it is with the timelines compressing, there’s massive increase in escalation pressure. And to be clear, that doesn’t mean that every vulnerability suddenly becomes reportable and needs to be escalated. But the issue is that AI-enabled exploitation may compress the timeline between vulnerability identification and legally significant incidents mean you’ve got much less time to actually think about these things and work out your strategy.

David Simon (06:04):
I remember thinking about this a few years ago when I had the chance to practice on the ground in Brussels. There’s so many three and four-letter acronyms that trigger not on access data necessarily, but on these sorts of aspects. And I think a lot of our clients are just coming to appreciate that and the timing is not great, frankly, with the advent of these tools. So maybe unpack that distinction for folks who are less familiar.

Nicola Kerr-Shaw (06:27):
Yeah. So I mean, across multiple regimes in Europe, whether you’re talking about NIS2, DORA, the Cyber Resilience Act, GDPR, the practical issue is that companies may have materially les time to assess, escalate, and notify, and to work out if those triggers have actually been met. Because the incident will be moving much more rapidly, won’t have sort of indication that a threat act is in the environment, time to get the instant response planned out and think about it, remind each other what we’re doing. It might happen in a matter of minutes. So anyone who’s worked through real-life incidents know how difficult those early hours already are and this just adds that bit more pressure.

David Simon (07:08):
So for many larger companies, the individual incidents that look like isolated event, but here smaller things could in the aggregate have a bigger impact or have a systematic impact across a supply chain or a systemic effect on a given organization, which can create escalation pressure. And we’ll talk about what that means when it comes to board expectations. So you think about that from the board perspective, you might get reporting on one incident or number of incidents that happen across the quarter and then assess whether they are individually or in the aggregate material. If you’re a public company in the United States or if you’re a foreign issuer, for example, there’s similar frameworks around the world. But boards are increasingly not satisfied with the sort of generic cyber update or maturity charts and they want enough operational detail not to get into the weeds of what is actually happening, but to understand what’s the business impact.

(07:56):
And that affects escalation planning and there’s a look at what kind of evidence the management needs to have to assess their assumptions. And this can result in just a tidal wave of risk exposure and potentially a number of smaller or medium size incidents that in the aggregate can have a broader impact.

Nicola Kerr-Shaw (08:11):
Right. And that’s exactly what we’re seeing. Board are increasingly wanting a lot more detail. They want to see a roadmap, not just a threat briefing. And part of this has been driven by personal liability of board members and the things like DORA, Senior Managers Regime in the UK, NIS2. But obviously we’re seeing this globally and not just in Europe. Boards want to understand what changes operationally, what the escalation process looks like, how instant response assumptions are evolving, where the tabletops exercises are realistic, and where the management has actually reassessed vulnerability management assumptions.

David Simon (08:45):
But frankly, one question boards probably should be asking management right now is how reassessed our vulnerability management assumptions in light of this AI discovery tools like Mythos and Daybreak. And frankly, it’s the common sort of question of cybersecurity is really a luxury for companies that know their technology is, know where their data is. And if these AI tools are going to find it faster, you’re basically going to find yourself behind. So it’s time to sort of get our arms around the basics like asset identification, asset management, and the same for data.

William Ridgway (09:16):
And it’s certainly not a theoretical exercise here. We have regimes like NIS2, DORA. They’re increasingly providing for real accountability and expectations around cyber oversight and frankly, potential exposure where companies fail to ask the questions you just posed, David.

Nicola Kerr-Shaw (09:33):
Right. Directors are increasingly participating directly in tabletops and asking much more operationally-focused questions than they were a few years ago. We’re seeing this. There’s various surveys out there, if you ask a direct what’s keeping them up at night, it is often a cyber attack and they want to know how to handle it and how they would ride through that challenging time if they needed to.

David Simon (09:54):
Now we’re going to drill down a little bit. So we think about this idea of reasonable security. When I left the Defense Department, Pentagon in 2015, it was easy to say, look, there’s no real cyber standard of care. But that’s really shifting and it’s shifted a lot even recently. So if we think about reasonable security from a litigation risk perspective in the United States, what are the things that you think we should be thinking about, Bill, given your experience?

William Ridgway (10:16):
Yeah, it’s a great question. And one of the challenges that companies face is that regulators, the plaintiffs bar, they do often evaluate or measure a cybersecurity program through the lens of the current conditions, what’s going on in the wild right now and those assumptions. A lot of times companies operate under an old set of assumptions that are not up to date and that leaves them exposed.

David Simon (10:38):
Which is why it becomes really important to sort of figure out what does reasonable security mean if we’re told almost all of our software and all of our products have critical and high alerts, all these vulnerabilities, and the tools are increasingly available to address it. What does that mean for a reasonable expectation about a company’s actions?

William Ridgway (10:55):
And I guess just to weigh in also for public companies, we have the securities law issue here. If you have AI-driven exploitation, it seems like it would change how quickly a cyber event can escalate and how quickly an event could become material to an organization. And so while we’re operating with the same set of requirements and timelines for assessing materiality and making disclosures, the standard remains the same, but how quickly the facts are coming to light, that’s going to affect the organization and it needs to be more nimble in responding to incidents of this type with the new regime.

David Simon (11:27):
That’s right. From an SEC materiality perspective, there’s this idea of continuously assessing materiality and we might say, “Oh, the disclosure committee should meet a couple times during the beginning of an incident or during the incident period at least.” But what does that mean in this new environment? And so think also about the litigation perspective. I’m a recovering litigator really, but from a plaintiff lawyer’s perspective, they’re going to be thinking about certain factors. I’m really interested in your take on this, Bill, because I assume the argument the plaintiffs are going to make are, look, the company knew about it, the attacker, their capability has improved, it’s evolved. So the operational assumptions are now outdated and the organizations failed to adapt. Is that what we’re likely to see?

William Ridgway (12:05):
Yeah. And actually, David, you’d be surprised we have already started to see Mythos-related information in complaints that are being filed against companies. So the plaintiff’s bar is just as much on these issues and quite adept and that’s one of the struggles that companies face is that oftentimes these cases have a long tail. And so you might be measured years from now before a judge or jury according to a set of standards that may no longer be realistic, but companies really need to be forward leaning here because they are going to be tested by this current threat environment. And unfortunately, it’s going to be used against them in situations where their systems may fall short.

David Simon (12:40):
So let’s just drill down and make it even more practical. What should companies actually be doing right now? One thing that stands out is they should really look at their assumptions and reassess them because many of these assumptions are baked into their existing process for managing vulnerability. We cannot think about what an IT organization is doing. They’re thinking about their cadence for patching every Tuesday, once a month, prioritizing those assumptions. Some of the things are so old they need to be replaced. How do you manage that given the risk to the business? Open source exposure, dependency mapping, escalation thresholds. So for every organization, to be clear, you can’t suddenly patch everything instantly, that’s impossible. You have to prioritize and limited people, limited resources and many of these are third and fourth party risks that the companies face. So for critical vulnerabilities and high risk environments, think OT, think SCADA systems, expectations around remediation and the speed at which you do that are going to change dramatically.

Nicola Kerr-Shaw (13:40):
I think the next thing as well that practically companies can do is really think about board briefings and how well versed your board is understanding cyber risk. They even understand Mythos and they understand how AI is changing this landscape. I mean, boards increasingly want this operational detail and realistic preparedness discussions rather than high-level cyber summaries. It’s no longer a checkbox exercise. It’s not just a one-hour training program. It is a real-time active, regular update and really understanding the technology dependencies and the technology debt and where things aren’t as ideal. The number of times we have a cyber incident and we look back and actually had been escalated to the board six months before that there were certain vulnerabilities, but it wasn’t really discussed. And that kind of evidence is actually becoming more and more damaging when regulators are looking back at why there was a data breach and could you have done more?

William Ridgway (14:39):
The other thing that companies have been and should be considering and thinking about is using AI defensively, of course. These technologies are not just useful for threat actors, it’s helpful for companies to review, make their systems safer and to automate some of those systems when it comes to, for example, like code review or vulnerability scanning. Automating some of the responses as part of the security team. At the same time, as we’ve talked about in prior podcasts, obviously AI itself and using these powerful tools presents risks to organizations. And so those same governance principles need to apply here when it comes to validating the use and having oversight and operational controls and likewise testing these systems to make sure they’re functioning properly. Because as we know, at some point even AI defensive tools may go awry and then there may be questions raised about what the company did when it deployed that and how it governed those operations. It’s so important to have a good record there.

David Simon (15:33):
And many boards when they’re faced with this question, I’ve briefed several boards in the last few weeks about Mythos and the sort of related tools. And one common reaction we get from business leaders, not necessarily the CISOs or the lawyers is, “Well, should we be thinking about how to operate our business without use of a technology without access to the internet?” The UK government recently articulated this position in a session we were in on this company should be thinking about how to operate for four weeks without access to the internet. And so if you think about incident response testing, boards management teams should be thinking about how to stress test their existing incident response plans, looking at the assumptions much more aggressively, things like simultaneous disclosures. I mean, how many of you as you’re listening have had to do incident notifications on the same day for different incidents and the same week for different incidents?

(16:23):
Some of you, but it’s less common. How do you think about active exploitation attempts? Under most legal requirements, you don’t have to report that unless you’re a military contractor, but because of the Cyber Resilience Act and some of the different European laws that Nicola mentioned, that’s going to be in scope. What about overloaded remediation teams? Obviously a great security team comes in, they immediately ask for more resources, ask for more headcount, ask for more access to AI to help protect themselves with agentic capabilities, but they’re often overloaded. Many organizations are still looking to rebuild, not just to modernize and transform digitally, but to really be able to have the basics of a integrated cyber program that puts communications pressure on the company.

(17:07):
So how do you think about communicating about multiple incidents at once? You don’t want to communicate about them as the same thing, but what’s your narrative? How would you be operating, particularly in multiple jurisdictions at once. And then of course, there’s the regulatory pressure piece. So how do you think about all those pieces coming together? So because one thing we’ve already contemplated this probably in your standard context, but the AI-enabled scenarios will expose vulnerabilities, exploit them very quickly and that can create bottlenecks at organizations.

Nicola Kerr-Shaw (17:33):
Right. And those bottlenecks are often governance and communication bottlenecks as much as the technical ones. We talked about SEC earlier in this podcast. We’ve also talked about the notification requirements under NIS, under DORA, under the FCA. And the point being that have you practiced that? Because you might not have very long to think this through and to escalate to your parent company in the US, for example. And how there’s a disclosure in Europe, regulatory notification in Europe affect your assessment in the US. And this is everything you’ve encountered in practicing cyber instance to date or having lived through a cyber instant in terms of bottlenecks, in terms of communication squeezes, is going to be hypercharged with this new AI type cyber threat.

William Ridgway (18:17):
And maybe one final note just to put in a plug for collective defense here, obviously the threat actors that our companies are facing and dealing with, they collaborate extensively. And companies that are facing these threats, they do need to coordinate as well. And of course, there’s been traditional mechanisms for information sharing, ISACs, and the CERTs, but it really is important to be thinking about, and we’ve seen organizations really double down on their operationalizing their intelligence sharing and the public-private coordination. Those are important in this environment, particularly in the next six months as we deal with these unique and emerging threats.

David Simon (18:52):
So far we’ve had a chance to really talk about this from the perspective of what company might be facing, not necessarily one that’s developing these technologies. But really trying to figure out how to leverage them and how to be ready as they’re being brought more broadly deployed and obviously the regulatory perspective. But there’s also this much broader national security dimension that really focuses on how governments think about vulnerability handling, how do they think about offensive cyber capabilities that are supercharged by these agentic tools and about public-private coordination. And so earlier we had a chance to sit down with, like we said, the general counsel equivalent of GCHQ, the UK’s equivalent of NSA, Shehzad Charania, to discuss how governments are thinking about this, particularly the UK government and the developments that they are considering and what they’re doing to help companies in the UK and to really share best practices. So now we’re going to turn to that conversation.

(19:46):
All right. Now we’re so excited to turn to our expert interview. As part of our fantastic episode, we’re going to be discussing some of the most important, challenging issues facing organizations, particularly when it comes to AI cybersecurity and related regulation. My partner, Nicola Kerr-Shaw in London and I are so pleased to have our good friend Shehzad Charania MBE with us, who’s the director of legal affairs and policy at GCHQ. I’ll tell you a bit about Shehzad now, just to give you a sense for his extraordinary background and the perspective that he brings and why we’re so lucky to have him with us here today. He was admitted as a solicitor back in ‘05, spent a lot of years in private practice. So he has that private sector perspective, but then joined the Treasury Solicitors Department now, which is the government legal department before moving to the Foreign Commonwealth Office in 2009.

(20:34):
And for three years from 2013 to 2016, he worked as a legal advisor and head of international law at the British Embassy at The Hague, which is of course where much of the major international law determinations in the world are made outside of national capitals. And in 2016, he spent some time in the Attorney General’s Office as the head of international law and EU law, becoming the director in 2019 before taking up the role of acting director general and head of the Attorney General’s Office in September 2020. And for this five-year period at the Attorney General’s Office, he was also the international law advisor at 10 Downing Street. Shehzad has been the national community race champion since 2019 and he’s a member of the board of the UK’s College for National Security. He’s a trustee of the British Institute of International and Comparative Law and a member of the Public International Law Advisory Panel.

(21:19):
And from the national security law and cybersecurity law perspective, he really is the most significant figure from a legal and policy perspective on these topics really at GCHQ and CSC. So we are so pleased to have him with us. Now just to frame before we get into the interview, over the last year, as we talked about earlier, there has been intense focus on AI-enabled cyber capabilities, including the Anthropic’s Mythos Preview model. And the UK AI Safety Institute’s assessment of Mythos has highlighted both the growing sophistication of these systems and also the reality that for now at least, many capabilities remain concentrated against smaller or less mature targets. But the direction of travel is unmistakable and organizations and regulators and governments are all just trying to figure out what comes next. So before we dive in, I just want you to know that we’re going to unpack this through the conversation. So I’m going to turn over to Nicola.

Nicola Kerr-Shaw (22:10):
Yeah. Thanks, David, and thanks, Shehzad, for joining us. We really are in challenging times. Things are moving. We’ve heard about this sort of thing happening in books and podcasts, but now with Mythos, it seems like we’re actually making progress in that direction. And our team that David and I work with at Skadden and our advising clients across critical infrastructure, financial services, technology, and other regulated industries, we’re seeing cyber resilience and AI governance increasingly covered a board level. Obviously this is partly due to regulation, but also because this is what people are really worried about. And if you ask GCs, CEOs, COOs, what keeps them up at night, cyber is without doubt within that top three. We wanted to explore not only the risks today and what we’re seeing and cyber trends, but also what practical preparedness looks like and what boards and senior legal team members can be doing in the next 12 to 24 months to help themselves to prepare.

(23:07):
So thank you again for joining us. We’re delighted to have you on Decrypted and looking forward to our conversation.

David Simon (23:13):
So Shehzad, now that the UK AI Safety Institute’s assessment of Mythos Previews presented kind of a mixed picture, we wanted to ask you about this and also if you just step back and give us the take from the perspective of where you sit in the UK government. That you have this Mythos model that’s more effective reportedly than previous models at exploiting vulnerabilities, identifying them and exploiting them. But it’s still mainly capable of attacking small, weakly-defended systems according to the post that was put out by the UKI Safety Institute. And so we’re wondering just to get our listeners a bit more oriented, to what extent are these issues drawing attention within the UK government? What are the broad topical concerns around the rising threat of AI-driven cyber attacks as a live threat right now, and how do you see this progressing in the coming year?

Shehzad Charania (24:03):
Great. Well, thank you very much, David, for that very generous and probably totally unnecessary introduction. Thank you, Nicola, as well for having me. Maybe in the spirit of that orientation, I’ll just take a further step back and tell you a little bit about what GCHQ does. So very briefly, GCHQ is the UK’s intelligence cyber and security agency, and our mission is to keep the UK safe online and in real world. That includes managing the threat of hostile states, countering terrorists and criminals providing support to defense. And as part of that, making the UK the safest place to live and do business online. We’re one of three intelligence agencies in the UK and we work very closely with MI5 and MI6 in our mission to keep the UK safe. So that’s GCHQ and then maybe just a very quick word on the National Cyber Security Center, which was established in 2016 and is part of GCHQ.

(25:02):
It’s the NCSC’s job to counter cyber attacks and power organizations to protect themselves from online threats. And it’s worth just saying that the NCSC is unusually for an intelligence agency or part of an intelligence agency external facing with its function to provide advice and assistance on the cybersecurity landscape to individuals, business, and government. And that takes a number of forms, including, for example, Cyber UK, which is the UK’s largest cybersecurity conference, which was held a couple of months ago. And it also publishes cybersecurity assessments and guidance, which you can find on our website.

(25:41):
So David, just going to your question, we published a paper last year which said that a, quote, “digital divide between organizations that can keep pace with AI-enabled threats and those that can’t keep pace with AI-enabled threats is going to heighten the UK’s overall cyber risk.” That paper was published last year and what it demonstrates, I think, is the AI-driven cyber threat is already live, but it is and will continue to be an evolutionary journey rather than some sort of revolution or cliff edge.

(26:18):
And what Mythos does within that context is reinforce that longstanding assessment the frontier AI is materially changing the cyber threat landscape by increasing the speed and scale of vulnerability discovery. And this is the really key point. It doesn’t in itself change the key advice on basic cybersecurity fundamentals, that’s because the current impact of AI-driven cyber is most acute for targets that are not currently well-defended. Frontier AI is going to increasingly expose organizations that haven’t taken the appropriate steps to safeguard their cybersecurity because it will make it easier, faster, and cheaper to discover and exploit weaknesses.

(27:08):
Now, as I say, that trajectory is only going to accelerate over the coming year. And in the NCSC, we’ve been saying for some time that these kinds of models like Mythos, but there’s others as well, will continue to emerge and improve and AI will almost certainly pose cyber resilience challenges to 2027 and beyond across critical systems and the wider economy. So the strategic issue here is resilience. The most important intervention to AI-driven cyber more generally, setting aside any particular model here is accelerating adoption of cybersecurity fundamentals so defenders retain the advantage as AI capabilities scale.

Nicola Kerr-Shaw (27:45):
So that’s really interesting. So exactly one theme we’ve heard consistently is with this AI, we’re not fundamentally reinventing cyber risk overnight, but it’s dramatically accelerating the speed and the scale at which existing vulnerabilities can be exploited. And particularly where organizations have already accumulated this technical debt, if you like. So we saw that the NCSC had recently shared that it foresees a forced correction to clear out organization’s backlog of technical debt in response to a new AI-driven vulnerability exploitation tools. So how do you see this forced correction panning out, particularly in areas such as government procurement that have historically been slower moving and do you think we’re moving fast enough?

Shehzad Charania (28:38):
Yeah, it’s a great question. And you’re right that the NCSC has said that it expects a forced correction and that’s because AI is showing the ability to exploit technical debt at scale and at pace across the technology ecosystem. And that’s then accelerating the discovery and exploitation of longstanding vulnerabilities. And what’s going to happen or what’s likely to happen is a patchwave, in other words, kind of rush of software updates across all types of software and critical vulnerabilities. Now that means that all organizations, whatever your size, your budget, sector need to plan now to deploy updates quickly, more frequently and at scale. And for large organizations, they also need to look across their supply chains. And yes, that may well mean some operational disruption for sure, as well as a consideration of trade-offs. And so really goes back to the point I made earlier.

(29:46):
The context here is that widening gap between the cyber risk that’s out there and our collective capability to defend against it. And that means accelerating the adoption of cybersecurity fundamentals is the most important intervention that a business can make now. And so again, the point here is that AI doesn’t change what good cybersecurity looks like, but it does make it all the more critical. In other words, strong cyber hygiene, rapid patching, secure configuration, logging, monitoring, and rehearsed incident response. All those things are going to be more important than ever.

David Simon (30:23):
So that raises this interesting point that our clients, many organizations around the world are thinking about. It’s really whether these technologies will ultimately tilt the balance toward attackers or defenders. And I know I have my view, it seems, at least because safety valuations and layers of review and regulation aren’t really a burden for criminals or sophisticated malicious actors that are seeking to leverage these tools. It seems from my perspective that the attackers have the advantage in leveraging these at this time. But welcome your thoughts. There’s a lot, obviously, of public conversation that focuses on this offensive capabilities and there’s also this increasing discussion around how organizations can operationalize these tools from a defensive perspective.

(31:07):
So new AI vulnerability exploitation tools like Mythos have this ability to improve both offensive and defensive AI capabilities and cyber capabilities as the NCSC’s AI cyber defense guidance has noted. So we’re just wondering from your perspective, have you and your colleagues seen UK organizations most effectively use these roles? How have they been doing that or they’ve been using other similar models on the defensive side? In the short and medium run, do you think these tools will overall benefit attackers more or defenders or will defenders find ways to keep up with other means?

Shehzad Charania (31:42):
Yeah, it’s really interesting perspective, David. You think it will favor attackers more and we should certainly address that because I don’t think that’s inevitable.

David Simon (31:51):
At least in the short run is what I mean.

Shehzad Charania (31:53):
Yeah, I can see that. I mean, let’s set aside the specific models here and just emphasize the seriousness with which government is taking the security implications of frontier AI. And so we have continuous engagement with global technology leaders on this issue. In fact, the Sector of State for Science Innovation Technology a couple of weeks ago wrote out to business leaders an open letter on AI cyber threat and how they should be positioning themselves to deal with it in light of the emergence of Claude Mythos and other models. It is such an important question on how to think about attack and defense. I would say that AI absolutely can strengthen cyber defense by dramatically increasing the timeliness of threat detection and the response to what’s discovered. AI can help developers write better code, more secure code to support network defenders in identifying attacks and suggesting responses. And look, you’re right, at the same time on the attack side, it’s right to say that threat actors are using LLMs for phishing attacks, to evade detection, to process exfiltrated data, conduct social engineering and so on.

(33:05):
But again, without wanting to sound like a broken record, again, it’s about getting the fundamentals right and carefully adopting frontier AI models for good. In doing that, defenders will retain the advantage. So I think it’s a somewhat, I hope, reassuring message in a landscape where at the moment it can feel like we’re a bit short of them. I would say as a business, you do have agency here.

Nicola Kerr-Shaw (33:30):
I just wanted to move back. I love some of the wording that we’re using now, this technological debt and we talked about patchwave. I love this. There’s really great ways of describing. And I think for the average person to understand what we’re talking about now, but obviously I think the patchwave is really important. But obviously under European regulation particularly, you need to have various policies in place, both written and technology policies in order to kind of lit vulnerability management and patch management. But how do organizations position themselves to keep up with that wave, particularly as we’re talking about some of these organizations have got huge technology debt or are small and aren’t able to just find a huge amount of budget to be able to keep up with this. So what practical steps have we got or insights could you share around that?

Shehzad Charania (34:20):
Okay. So in the immediate term, the risk is AI exposing organizations that haven’t taken the appropriate steps to safeguard their cybersecurity. And that’s because AI makes it, this is the point, David, was making, AI makes it easier, faster and cheaper to discover and exploit weaknesses. And this is then going to put pressure on organizations to patch quickly. So on this specific question of what organizations can do, the first is, I would say this, wouldn’t I, but it’s absolutely the case. They should follow the established NCSC good practice to raise their baseline security. Including reducing unnecessary exposure to attack, applying security updates rapidly and monitoring for and responding quickly to malicious activity. And so all organizations need to plan now to deploy software security updates quickly, more frequently, and at scale. Including, as I said earlier, for large organizations thinking about their supply chain. You’re right, Nicola, in terms of all the terminology that we’re having to become familiar with.

(35:25):
I would say that in terms of patchwaves where automatic updates are available, they should be enabled and that also then reduces the workload on support teams. And where those automatic updates aren’t available, think about your processes, your risk appetites and ensuring that you can support more frequent scaled updating. Recognizing, as I said, the trade-offs that might exist from an operational perspective as you do that. But look, in terms of hard practical advice, organizations should go to the NCSC’s updated vulnerability management guidance and look at the government-backed certifications like cyber essentials.

David Simon (36:01):
So we’ve talked about what some of the practical implications are of this capability, some of the good practices that NCSC, GCHQ have put out, and also the attackers and defenders balance, which we hope will shift in favor of defenders even more over time. But as lawyers, Nicola and I and our teams across the world are advising clients when they’re facing cyber attacks, other kinds of incidents. And we often play the role of a breach coach and a legal advisor through these incidents. And we see the sheer volume of the number of incidents facing our clients really growing. It’s far exceeded, frankly, our capacity to handle all of them. There’s just more than we’ve seen before, not just the number of them, but the severity of them.

(36:46):
And so we often are initially thought about, or at least many organizations think, “Okay, I need to talk to my lawyer because there’s reporting obligations.” And the number of reporting obligations around the world just continues to increase, not just the number of jurisdictions that require them, but also the timelines are becoming 24 hours sometimes in many jurisdictions, including Europe. And so see where this is going. We’re looking at different jurisdictions that where regulators are themselves grappling with how to process and make use of the enormous quantities of cyber incident reporting they’re receiving. I’m not asking you, I am curious, do you get to receive what the ICO receives, for example, when there’s a GDPR data breach in the UK or other reporting, there’ll be UK DORA soon enough, will that come to you? It’s not really my question, but if you want to comment on it, you’re welcome to.

(37:31):
So as we see in the last decade, there’s this proliferation of these reporting obligations and frameworks and we’re starting to see how some of that will roll back. You can see in the EU there’s this simplification effort around GDPR and certain government agencies around the world, they’re now going to be experiencing this backlog, overwhelmed with the reporting just on incidents. When I was living in Brussels, sitting in consultations with some of the DG authorities on the Cyber Resilience Act, open question was, how in the world is ENISA going to receive all of these reports? So if you sort of zoom out, let’s focus on the EU. What’s going to happen to make sure that the breach reporting requirements, the different types of reporting that would be expected can be actually leveraged and that they’re not watering down the triggers that exist under whether it’s GDPR in the UK or pick your new requirement.

(38:19):
So again, put a finer point on it, assuming these AI-driven cyber attacks that result in a tidal wave of cyber incidents and reporting, how are regulators meant to keep up with this and ensure that they’re getting value from the incident reports they receive? Do you think this will result in a change? And we know for the audience here, it’s not that in many cases, most organizations and our clients are not required to report to the GCHQ or NCSC. But you have obviously tremendous capability to make sense of this and also probably play an important role in shaping how other regulatory authorities in the UK and more broadly beyond just the UK think about this. I’d be interested in your take on where we’re headed with that.

Shehzad Charania (38:56):
It’s really interesting to hear you talk about the role that you play as a breach coach. And I listened to your last episode on that kind of end-to-end response that you provide, which was absolutely fascinating. What I would say here is that if AI-driven attacks result in a wave of cyber incidents, regulators will naturally need to ensure that they’re getting value from reports rather than being overwhelmed by sheer volume. A key part of the picture here has to be, I say this with as much conviction, but again, fear, I’m a broken record, it has to be strengthening baseline resilience. So that in this context in which you’ve asked the question, fewer incidents occur in the first place. And so that you don’t get this overwhelm, organizations have to reduce unnecessary exposure to attack, apply security updates rapidly, monitor and respond to malicious activity as quickly as possible as I’ve said.

(39:57):
Now, the National Cyber Security Center is the National Technical Authority, but it isn’t, as you know, it’s not the regulator. I mean, that’s slightly different to other sister organizations in other countries where some are regulators and others aren’t, but the NCSC isn’t the regulator in the UK. And so with that in mind, I would say that regulators and governments should continue to promote that established good practice, including the guidance that we put out and that government-backed certifications like cyber essentials are also utilized. And they give confidence that critical disciplines being practiced. And that I think is the best way ultimately to help the regulators do their core role rather than being overwhelmed by reporting.

Nicola Kerr-Shaw (40:41):
So of course all of this that we’re talking about, and as you’re talking about as well, is against the backdrop of a growing government focus on national cyber resilience and protection of our critical services. And that’s the focus of NIS and regulations and the updates we’re seeing from the FCA. In relation, in the financial sector, everybody is looking at protecting our critical assets, both in the UK and then obviously international. So in the UK, the government has made it clear that cybersecurity is a priority and the recent cybersecurity and resilience bill aims to strengthen protections for critical services from the NHS to the energy infrastructure. So from a technical standpoint, what do you need the bill to deliver the existing frameworks like the NCSC’s cyber assessment framework currently don’t do?

Shehzad Charania (41:37):
Yeah, thanks, Nicola. It’s a good question. And it gives me the opportunity to talk about the bill because my colleagues in the NCSC have been heavily engaged with departments across government. The bill is being led by the Department for Science Innovation and Technology, but we are heavily involved in it. The idea of the bill is to expand the scope of those NIS regulations and bring more of the core services that are relied on across the economy into scope, including those providing critical components and services, and that ensures more operators of essential services are covered. I mean, just thinking, going back to this question of regulators too, the bill also aims to improve the effectiveness of regulators through a more consistent and effective regime. Expanded and more timely reporting of harmful cyber attacks and a stronger mechanism for government to set priority outcomes and a fuller toolkit for information sharing.

(42:37):
The bill’s also designed to enable resilience and to future-proof responsiveness, which then allows targeted and proportionate actions to imminent threats. And more broadly, it’s intended to bolster the UK’s online defenses, safeguard the economy, increase confidence in digital services, and really strengthen expectations on organizations with regards to cyber resilience, particularly in response to threats from criminal and state-sponsored actors. The bill isn’t a moment in time though, right? So even when it’s passed, resilience has to be an ongoing process that continues to be improved after the bill’s passage when it becomes law rather than it being seen as a one-off solution, a point in time, and then everything is suddenly going to result.

David Simon (43:24):
So we’ve talked now about obviously the UK government’s priorities about the threat landscape and also some of the challenges around the reporting obligations. So we’d love to ask for your thoughts more broadly about the global coordination aspect. Obviously you’ve played throughout your career a substantial role in leading on multilateral coordination and public international law deliberations where it comes to coalition operations. You really have to have an opportunity to be shoulder to shoulder with allies and partners and have a common picture, a common view. And so I’m wondering if you could comment when it comes to the AI-enabled cyber threats and really the set of challenges that relate to Mythos really top of the fold news coverage for folks who still look at a hard copy of a newspaper. What does that cooperation look like? And I’m not going to ask you to comment on exactly what might come out of the US-China bilaterals that are going to be happening over the next couple of weeks. But there’s a lot of questions now about what does coordination look like?

(44:23):
Are we, for example, going to see just like the UN group of government experts on cyber norms generated multiple reports over the years. Are we going to see some new multilateral initiative around these kind of AI-enabled issues beyond what’s already been out there that has a focus on the cybersecurity piece? Do you think it will stay in that higher level of abstraction, which is more focused more on autonomous weapons, which we’re not asking about here, just where do you think that will go? And then just in terms of the broader theme, it’s easy to say from a private sector regulatory perspective that there’s a bit more fragmentation, regionalism. We see that when we meet with clients in capitals, should there be an EU-only tech stack, or a French-only tech stack, or a UK-only tech stack or what is sovereign infrastructure?

(45:11):
So rather than commenting on the specifics of each of these jurisdictions, we do see this potentials trend towards regionalism fragmentation. But when you look at alignment, is the greatest alignment really between the UK, the US, and EU approaches, or is there really a divergence? Where do you think there are emerging areas of alignment and where you think the greatest risk of fragmentation is? I’m interested in your thoughts, this first piece about international norms, will that really be connected up to this? Will that be sort of a separate really government to government dialogue that has more to do with military uses and not be something that companies should really focus on?

Shehzad Charania (45:46):
Yeah, thanks, David. Well, it’s a big passion of mine because as you say, I’ve been working on certainly international cyber governance for a very long time, including the processes that have been taking place in the UN over the last, what? 15, 20 odd years. And of course, working internationally is massively important, whether it’s about AI or not when it comes to cybersecurity generally. So the National Cyber Security Center works with partners around the globe, including the US and the EU. And in fact, just a few weeks ago, as I said, we hosted an international day at the UK’s flagship Cyber UK Conference, which is convened by the National Cyber Security Center. And that brought together about 14 nations to talk about some of the most important cybersecurity issues of the day. We also, in fact, hosted a conference at Wilton Park on regulatory alignment. I think that was in March.

(46:44):
So again, a big part of our role is being front and center of that international coordination. One of the things that I’ve been involved with as well is the Pall Mall process and goes back to your point about attackers and defenders. This idea that, well, with the Pall Mall process, which again has as part of it the US and we convene it with France, but it has a whole load of private industry actors, big tech in it as well. It’s essentially to address the proliferation and irresponsible use of commercial cyber intrusion tools and services. That’s something that the cybersecurity industry has a key in which it has a really key role to play because we’re not saying that thinking back about your question on attack versus defense, we’re not saying that these tools are not going to be genuinely helpful when deployed in the right context.

(47:44):
But as long as they are deployed and used responsibly and everyone in the technology in the cybersecurity ecosystem has a really, really critical role to play in that. And it’s only through coordination, alignment, convening and using that power that we have to bring people together, not just other countries, but also industry, academia, others that we can really be front and center of that and ensure the responsible use of these kinds of tools.

Nicola Kerr-Shaw (48:15):
That’s so interesting. And more and more, as we’ve touched upon today in regulatory notifications. We have to look at a global, very few of our clients are just in one country. There’s always a kind of a global aspect. In order to really tackle these cyber threats, I think we have to look at it globally. So really interesting to think about this. Regulation’s moving fast because it’s having to, and as you said, the bill isn’t static, it’s fluid and it has to be. And obviously there’s an element within regulation and legislation and there’s element that is just down to companies that they need to adjust and adapt. One, to comply with the principles of regulation, which is obviously the fundamental foundation of how we work in the UK, but also for the ongoing security and longevity or future of that business.

(49:00):
We know from our clients that they’re struggling with this. So we’ve got rapid development of expectation of regulators. We’ve got rapid development of legislation. Like you said, it’s fluid, it’s changing, it’s sometimes a bit behind, but principles are there. But we also have rapid development of technology and cyber threat and also in a way, kind of new innovative ways from threat actors all the time. We saw social engineering quite a traditional tool, but how that was revolutionized by AI and everyone’s having to get on top of different threats. So just in terms of this, everything happening at once as a final question and a takeaway piece from you if we can. It’s just what practical steps, one or two practical steps. We talked about automated patching and we’ve obviously touched on some of these things in this discussion, but one or two practical steps do you think boards and senior management should prioritize now in anticipation of this next phase of AI-enabled cyber risk.

David Simon (50:00):
And before you answer, one quick thing to add on. I was in a session last week, maybe two weeks ago in DC where the representatives from the UK embassy were present. It was a discussion around Mythos. And one thing they said was that with respect to Mythos and preparations, they said it’s a good idea. I don’t know if this is formal guidance from the UK government, but it’s a good idea for UK businesses and probably more broadly, but UK businesses to think about in light of Mythos, how they would function if they did not have internet access for four weeks, just go through that exercise.

(50:34):
And so I don’t know if speaking to Nicola’s questions and the resilience point, if that’s the kind of exercise that you think is a good idea, if there’s any formal guidance, but just organizations are wondering what, if anything, should they actually be doing? So such a great question, Nicola.

Shehzad Charania (50:46):
It is a great question. And you asked me for one or two things, maybe I’ll give you three and I’ll start with the one, Nicola, that you mentioned, I think, right at the very outset, which was about this being something that boards losing sleep over, having sleepless nights over. And that’s the first thing. Actually, you do need to make cyber a board responsibility here. So you need to make sure that all board members have undertaken cyber governance training and it’s not just a one-off, but something that they do on an annual basis. So having this as a board level risk, I think is the first thing I would say. The second thing is this is a very practical step. Sign up to the NCSC’s early warning service. This will tell you the threats that are out there and what you need to do to ensure you are protected against them.

(51:35):
And the final thing is ensure you have cyber essentials across your supply chain. So cyber essentials is a UK government-backed industry supported certification scheme that protects organizations against cyber threats. So ensure that this is something that you are familiar with in your organization, but also particularly if you’re a large organization that your supply chains are across it too. The point you made just there, David, about tabletop exercises, preparing for these kinds of scenarios is really critical because it’s not just about protecting yourself against threats, it’s also about ensuring you have the proper systems in place for recovery. Because even with the best defense in the world, that will help you to a great extent. But of course, particularly if the attackers are sophisticated, you may not be able to defend against them and therefore in that situation, you need to have a proper recovery plan so that you are not disrupted.

David Simon (52:40):
Thank you so much for sharing that, Shehzad. And I think just to zoom out and as we think of wrapping up, there’s so many different audiences that can be listening to this. Some of the largest Fortune 10, 20 companies, Fortune 500, and then much smaller and medium-sized businesses. And so I think it’s so helpful that Shehzad pointed out a lot of the resources that the UK, NCSC, and GCHQ have put out because there are a lot of resources if you go to the website that offer cyber advisors some baseline tools that are at no cost. And I know that the US government has things like this. There’s a lot of governments that do. So it’s important to avail yourself of those. If you’re a CISO of a medium-sized business or you’re an organization that doesn’t even have a CISO, there’s still a lot of resources that are available there.

(53:24):
And I also think that it’s useful to think about some of these practical steps. How will you operate through disruption in the year ahead with these sort of changes, not just Mythos Preview, but many of these AI tools require organizations to be managing where they have multiples, more vulnerabilities of critical and high significance. To manage through, how do you operate with that level of risk? So we hope that these insights really prepare clients to think about it. And also it’s valuable to say the least, to have Shehzad, given where you sit in the world, sharing these insights, talking about the role of the board, talking about the role of practice and resilience and talking about the resources. I can’t thank you enough for making the time. And also just for your insights on this, having been a part of the multilateral dialogue on cyber issues for an awfully long time.

(54:15):
We look forward to continuing this conversation on cyber resilience, on AI governance, and emerging technology risks on our future Decrypted episodes. And before we wrap, we’ll just plug. We have, as many of you know, a whole series of events as part of our Fortify series. And so we will be having an event first in Palo Alto on 4 June, which will be very exciting with the lead regulator for the California Privacy Law Enforcement CPPA authority will be with us. And also many chief privacy officers from tech companies will be joining us. It’s a really great intimate session in our office there. And then on June 24th, Nicola, if you want to share a bit about what we’re going to be doing in our London office on June 24th.

Nicola Kerr-Shaw (55:00):
Yeah, we’ve got a fantastic day of cyber awareness training and also online safety. So we’ve got a couple of panel sessions going on. We’ve been joined by Ofcom, also someone from the Department of Innovation and Science and Technology from the government, which will be fantastic. And then we’re going to do a cyber war game in the afternoon. So playing through what this looks like if you’re sitting there thinking, “Hey, I’ve heard about this, but how does this actually impact my business? What would a cyber attack look like? How would it play out? Yeah, I’ve heard about Mythos, but how would that really affect me?” Then we’re going to war game that for you and talk the participants through that event. So it should be really great. So if you’re interested in joining, you can reach out to me or David on LinkedIn. It’s all going to be advertised there as well.

(55:46):
And also just to plug, we’ve got some recent client alerts on this topic too. I was just reflecting as Shehzad and David were talking there, what would I be saying to people? How do you get up to speed? And I speak to a lot of senior executives. One recently, actually, he’s just been through a cyber attack as regulated entity and it’s really a new topic for them. And I’m sort of saying it’s really important. It is a board issue. There’s loads of materials out there. So it’s really important to get up to speed with it. And it can feel daunting, but things like we have got a great client, and they’re on Mythos, which kind of breaks it down for you. But there are so many tools and resources out there or mini courses to just... This is a real issue. It’s something that we see all the time.

(56:23):
Unfortunately, I think for every business now, it’s a when, not an if. You’re going to see something. So get yourself up to speed and you can’t just delegate and rely on your technology officer or your CISO anymore. But it’s been fantastic, Shehzad, having you join us. Thank you so much for making the time. So that’s the wrap for this episode. Thank you so much for joining us. I hope you found it as interesting as we have and stay tuned for future episodes coming talking about new cyber threats, AI, and further regulation coming in the European space.

Voiceover (56:59):
If you’re enjoying Decrypted, be sure to subscribe in your favorite podcast app so you don’t miss any future episodes. Additional information about Skadden can be found at skadden.com. Decrypted is a podcast by Skadden, Arps, Slate, Meagher & Flom LLP and affiliates. This podcast is provided for educational and informational purposes only and is not intended and should not be construed as legal advice. This podcast is considered advertising under applicable state laws.