Stop gawping at models: Former NCSC chief says we must get back to basic principles of cybersecurity

Ciaran Martin was the founding chief executive of the National Cyber Security Centre (NCSC), part of GCHQ, and comes from “the prehistoric digital age”, he said.

Martin has seen the threat landscape evolve – from worms such as ILOVEYOU and Blaster wreaking global havoc to robot vacuum spyware he once showed the Queen.

“Back then, we were learning different things about how to cope with worms; the difference between the ones that needed a human interaction, the ones that infected the network, highly self-replicating, and so on,” he said at Proofpoint’s Protect Tour.

“Let’s not discard our knowledge,” he added.

Martin, who now lectures at Oxford University’s Blavatnik School of Government, gave that reminder as one of several lessons to help security experts keep their bearings as headlines about AI cyberthreats proliferate. “We know quite a lot of this stuff whether it’s coaching humans, containing the virus or the hardening of networks,” he said.

Prevent harm: focus on what matters and stop gawking

The second lesson is to cut through the noise around agentic threats. Martin points to a Censys report, Artex: Agentic Asbestos, which describes an AI-powered penetration-testing framework (ARTEX), originally released as open source, that has been linked to attacks on South Korean financial institutions.

It is evidence of attackers adopting AI tools, but Martin argues that defenders should focus on the harm those tools enable, rather than the tools themselves.

Likewise, the ability of AI to seek out undiscovered vulnerabilities should be judged by what those discoveries mean in practice. Martin pointed to Anthropic’s Claude Mythos AI model uncovering a 27-year-old integer overflow vulnerability in OpenBSD that allows remote machine crashes.

“Well done to Mythos for finding it but the vulnerability was functionally useless to an attacker. That doesn’t mean AI is functionally useless as attacker. But remember it’s what’s useful to attackers,” he said.

“If the hackers can get in using the 25-year-old techniques that I showed you at the start of this presentation, that’s what they’ll use. If they need something advanced that they can automate, they’ll use that too.”

No such thing as a bug-free future

Breaches happen in broadly three ways, Martin explained: through bugs and vulnerabilities, misconfigured technology and deception.

Some are pinning their hopes on AI to eliminate bugs, or ‘bug zero’, an ambition Martin considers unrealistic. Others “speak about a ‘closing window’. The deception window, the phishing window, the spoofing window, the people wanting to do bad things window. That’s never gonna close. I wish it would, but that’s a bit like saying crime will stop.”

For Martin, the more useful question is how AI will affect familiar weaknesses, including misconfiguration. Common vulnerabilities and exposures (CVEs) have increased eightfold, said Martin. He added that breaches are up 40% but back to the same level as in 2024.

Misconfiguration is a gift to AI, but it’s something we know how to defend against. “Attackers are exploiting misconfigurations. It’s less sexy than 27-year-old bugs but it’s routine cybersecurity that we know what to do about it,” said Martin. “This is great news.”

A deceptively simple explanation

When it comes to deception, AI is impacting in ways we may not have considered.  Japan is experiencing notably more data breaches. While they were unsure as to why, some believe is it a result of phishing emails becoming more sophisticated.

Typically, to spot a phishing scam, the advice is to look for sloppy English – or Japanese, but AI has enabled not native Japanese speakers to create scams that are error-free. “AI abolishes Japan’s language protection, so suddenly a wealthy country that could be fairly complacent about deception as a source of cyber-attack, its defenses are gone almost within a few months,” said Martin.

Lessons in cybersecurity – back to basics

Summing up, Martin said there are a few key things cybersecurity experts should bear in mind:

• This is not new – we have the expertise
• Focus on harm
• Study how hackers are really using AI

“Maintaining good cybersecurity fundamentals remains the best way to protect your organization from all digital threats, whether AI-assisted or not,” said Martin.

“My plea is to trust yourselves. Because the cyber community has been a bit too reticent about asserting its own expertise and its understanding of the way in which cyberattacks work and the way in which cybersecurity works in the face of all these warnings from AI.”

“We’ve had plenty of successes in containing harm. We’ve innovated, we’ve built better things, we’ve made things safer, we’ve prevented catastrophes. We know how things work. We should not let our agenda and our work be dictated by the next press release from the labs that say within six to twelve months everything’s gonna be different.”

Related articles

• Businesses need a new defensive formation against ransomware
• Is cybersecurity losing the race against AI adoption?
• IT managers vs Mythos: Get ready for six months of update hell!
• Anthropic keeps panicking investors with new tools