Cybersecurity has come a long way. Businesses have invested in heavily in secure solutions, firewalls, antivirus software, security monitoring and increasingly sophisticated tools to protect their systems. But despite these advances, cyberattacks continue to make headlines.
So, if technology is becoming harder to breach, where are hackers looking for their next opportunity?
In the latest episode of The Transfer Files, Steph and James are joined by Glenn Wilkinson, ethical hacker, international speaker and CEO of Agger Labs, to explore how cybercriminals think, the techniques they use and what businesses can do to stay one step ahead.
With years of experience exposing vulnerabilities and helping organisations strengthen their security, Glenn brings a fascinating perspective on the realities of modern cybercrime. The conversation explores why protecting business-critical data is so important, including the information organisations move through their Managed File Transfer systems. Plus, Glenn shares three practical things every business can do today to strengthen its cyber defences.
Think your organisation is secure? This episode might make you think again. Watch the full conversation below.
-
Discover more about Glenn, his speaking engagements and his work helping organisations understand how hackers think and operate: https://www.glenn-wilkinson.com/
-
Find out more about Agger Labs and its approach to detecting and stopping ransomware, helping organisations strengthen their endpoint security: https://agger-labs.com/
Welcome back to the Transfer Files. Today, James and I are joined by an incredibly special guest, someone who has spent his career exposing the very real threats hiding in the digital world. He is an ethical hacker turned cybersecurity leader and international speaker, known for his live hacking demonstrations that reveal exactly how attackers break into systems and, more importantly, how organisations can defend against them. A three-time founder, Glenn, is currently the CEO and co-founder of Agger Labs. He's regularly featured across major media outlets, including CNN, BBC and ITV. And away from the stage, he is a proud father of two. I am very excited to welcome Glenn Wilkinson to the podcast today as we dive into the growing cyber threats facing enterprises, how attackers are evolving their tactics and what organisations can do to stay one step ahead. Let's get into it.
Glenn, a very big welcome today to the podcast. How are you doing?
Yeah, thank you so much for having me on the show. Doing very well, thank you. My first time in Poole, so very excited to be here.
Good to see you again.
Glad to be here.
I know you've been all over the world recently, so we are very thankful and grateful that you made the time to come down to sunny Poole today. Although it's not that sunny this morning.
No, it's a bit disappointing driving over here in the rain on the car. I told my daughter I was going to Poole for work and she was very confused and asked where's my swimming trunks and my towel?
For the benefit of listeners today, would you mind sharing a little bit more about yourself, how you've got to where you are today, the things that you've been up to, and yeah, sort of what you do to help organisations around the world?
Yeah, absolutely. So my background, if you go far enough back, is that of a ethical hacker. So I kind of learned learned the trade of being a curious tinkerer when I was a teenager back in the 90s, dial-up and things like that. I just wanted to understand how systems work. Didn't really think it was hacking back then, it was just tinkering. Never thought it would be a career path until the end of university, I think. And from that point, organisations all around the world paid me at the company I worked for to break into them to find the weaknesses and help them fix them before the bad guys do. The analogy we always use is it's like hiring an ethical burglar to check your home security, because we have a different way of thinking than the standard person who installs the security. And from there, transitioned from, I say, I used to be an anarchist, now I'm an engineer, used to blow up the bridges, now I help keep them safe. So from breaking into systems to defending them, and a few a few startups under the belt and I speak on stages all around the world on podcasts. I try and share my passion for cybersecurity and make it accessible to anyone and everyone. And as my young daughter says, I help keep people safe.
Very sweet.
It is amazing how you ended up in that career path. I mean, as a child, were you sort of curious about hacking and was it ethical hacking at the time or?
Yeah, So growing up in Zimbabwe, we didn't have a lot of access to technology or to internet. So any time you got access to something, it was quite precious. So you got a very old computer, but if it broke or something, you can just get a new one. So it's this kind of mindset, you want to understand it, to fix it, to upgrade it, to repair it. So it's that tinkerer mindset initially. There was no, you know what hacking was back then as a young teenager. So it's purely curiosity. And then the internet comes along over dial up back then, plug the computer into the internet. And so it's connected to all these other systems. And just that curiosity to understand how all of this works. And then occasionally maybe there's a barrier in your way and your mindset's not, hey, I want to break into a bank to steal the money. Your mindset is, oh, there's something that says I can't go here. I wonder why that is. I wonder how it works. I wonder if I can get past it just for purely curiosity at that point. So I'm a little older than you and I remember dial-up technology, considerably slower than it is today.
Hacking viral dial-up, that's impressive.
Yeah, I mean, it's, I remember going from a, Steph, forgive us, I remember going from a 28K modem to a 56K modem, and that was a phenomenal increase in speed and blew my mind. So it's all relative to what you know at the time, in hindsight, obviously ridiculous. But back then, the hackers in the 90s, it was a very different scene to what we see today. it's a large criminal component this nation state activity, there's ransomware gangs, there's almost nefarious veneer to it. Back then it was almost benign. It was mostly curious teenagers maybe defacing websites or breaking into websites to, it was like spray painting graffiti on the side of a wall. Hey, whatever the hacker group, Masters of Deception was here, your security sucks. Instead of seeing the BBC website, you see some kind of defacement. But it was very much tinkering and driven from mostly a place of curiosity as opposed to any kind of malice and almost the hacker rivalry between the gangs back then, which is seeing who was the best hacker gang, who could kind of hack the best. Whereas today we've progressed to this more cyber criminal environment that we see.
Yeah, my next question to you is actually going to be what's happening in the cyberspace today? And yeah, what's the landscape looking like? You've kind of touched upon how it evolves already. But yeah, what is the current position of the landscape today and what's going on?
Yeah, it's a good question and a big question and one we can attack from a lot of angles. But the overarching thing that we see, I'll say there's a few different key aspects to look at. And one thing to unpack is why the propensity to hack exists now, as opposed to 10 years ago, 20 years ago. And one of the reasons is that we have a lot more of our lives online, a lot of the infrastructure, be it government infrastructure, our personal lives, or to work, or even watching this podcast, everything is online these days. As attackers, we call it an increase in attack surface, that there's more stuff to attack. So that's kind of at the bottom of the explanation of why this kind of thing is happening. In terms of who is doing this hacking, it's a combination mostly of nation state actors. So kind of nation states realised maybe 10, 15 years ago, we have a lot of stuff online to protect and our economy is dependent on being online, but our adversaries also have stuff online. So we need to defend ourselves and attack those guys over there. Then we have the cyber criminal component. And there's always been cyber criminality going all the way back.
The first case of ransomware ever. Viewers at home, can you guess? 1989. So all the way back then, it was called a malware extortion attack back then. The chap called Joseph Popp wrote a very basic piece of ransomware distributed via floppy disk. It's like a USB drive for the younger folks or a cloud storage for even younger folks. But essentially distributed via floppy disk and took it home, plug it into your machine, and you got a big red pop up, all your files have been encrypted. But he demanded payment to get your files back via cash or a check in the post to his home address. Not a great idea, but the thought was there, hey, there's some kind of extortion thing that we can do. And that idea progressed over the decades. But the biggest cyber criminal component we're seeing right now, I'll say, is ransomware. And the two big things there, I would say, is ransomware as a service. So 5, 10 years ago, you have to create your own ransomware and then go on the dark web and you can lease some ransomware software. And then you have this thing called the initial access brokers. So go on the same dark web forums and you can buy access to previously hacked networks and companies and put those two things together. So I could give you a web address now, you go sign up to Dragon Force, go and buy access to some massive law firm, put those things together and demand some extortion. So the biggest thing I would say I was seeing is ransomware and then, oh, there's a ton to unpack, but let's see what you guys have to say about that.
Crikey.
Terrifying, quite frankly.
Yeah. In the position I am, you don't think about it really until you hear the news articles and the breaches, but actually what goes on behind the scenes, and you probably have, you understand that a lot more than I do, most definitely. But yeah, it's fascinating, but equally terrifying.
Yeah, the thought for me is trying to reduce my online footprint, I think. Yeah, the attack surface. There's an awful lot of information that can be gleaned from the different social media profiles when it's all pulled back together.
There is. And we've seen this really, if you talk to what are teenagers today, Gen Z or Gen Alpha, whatever the teenagers are right now, they have a very different view to, well, at least me and James, I would say, when we, so we grew up before the internet and then there was the internet, it's kind of this boon of this trust that we gave to it and we really believed in it and we thought it was all for a good purpose. And then maybe Facebook comes along and we hand over our entire lives. Yes, I am. I live here, I work here, it's my birthday, here's my relatives, this is my religion, here's 1000 photographs of me. And I think early on Facebook maybe didn't have any intended malice or something, but eventually they had to make money and then they lean into advertising and hoovering up data and things like that. And the youth today, teenagers today, when I chat to them, they look at us like we're insane. Why would you put all that information online? It's very unsafe. And they're very savvy. These young teens like hackers can do all this. They can guess your password by all this information you put out. So it's almost like the pendulum is swinging. And I think it's swinging back to a much more conservative online presence.
That's really interesting to hear because I thought it would be the opposite way and the younger generation are more inclined to share their data willingly.
I need to talk to my teenage daughters. I think they might be sharing a bit too much.
This episode when it comes out, but no, that is interesting that it's swinging the other way that you're seeing.
Yeah, and also I think that the way they use it, so we used Facebook and we shared a lot of personal information. Teenagers these days, they use temporary things like Snapchat or Instagram. They, like my nieces and nephews, they don't use the... They don't add, what's the word, they don't add posts to Instagram. They just do, yeah, reels and stories and things.
Stories that disappear. Can never be seen again, apparently. I don't know if you can.
When it comes to organisations and cybersecurity, I don't know if you find, do people tend to feel that they're secured just by, we've got firewalls, we've got, what do I put down, antivirus software, we've got all this. So they naturally think they're fine, they're secure no matter what. But from your opinion, how are hackers bypassing those systems and actually are they as secure as they are?
Yeah, so it's a good question. I think we're going to unpack it a few different ways. So one is how secure do businesses and individuals feel by the security things they have in place? And what's quite interesting from a hacker's point of view, often if you have security things in place, you're a little bit of a more interesting and easier target because you have a false sense of security. People drive worse when they have a seatbelt on because maybe they believe a bit too much that, if I crash, this thing will save my life. If you have antivirus running, it might be terrible antivirus, it's not updated. Even if it is updated, any hacker worth their salt can bypass it. But because you're running antivirus, oh, someone sent me a suspicious file, but I have antivirus, it's fine, I'll run it. So that is definitely an interesting psychological component there. And how many organisations or individuals you e-mail them, they reply, and then the footer at the bottom, it says, this e-mail was scanned by AVG version 6.2. So thank you very much. I'm going to go and engineer my hacker software to bypass that exact version. So that's the one thing to unpack. People might have an inflated sense of security because things are in place and we inherently believe that words like antivirus or EDR or firewalls will keep us safe.
The other part of your question is, well, how are hackers approaching these systems? And there's been a definite progression over the years. We spoke about hacking on dial-up back in the 90s. Back then, if you're at home on your dial-up and you're probably using software like Sub7 or NetBus or these back orifice, these hacker tools from the 90s that the viewers or listeners might recognize, and you could connect directly from your computer at home in your living room, to someone's laptop at some, inside some company, some organisation. There were no firewalls, there's no, what we call NAT, so there was no protection. You could connect directly from this laptop to, or desktop, from this desktop to this desktop, which is quite bizarre in hindsight. And then, you know, what's interesting is hackers always improve security by breaking it. The defenders have to make it a bit better. But we went from that kind of completely flat open over the internet infrastructure to, okay, we need firewalls or this thing called NAT where we kind of block traffic coming in and out. And then hackers realised, okay, I need to send you something to make you connect back to me. My point is that we used to have this almost attack pattern where an organization was as secure as its physical building. So you would have a physical office. The servers were in the basement, your workstations were on your desk. End of the day, you turn it off and you go home. As an IT guy, security guy, you protected your castle. The analogy we used to use was, okay, here's the castle. And as a hacker, you're trying to break into the castle and then get kind of unfettered access. That model's been slowly breaking down over the last at least five, not 10 years to a much more almost scattered, loosely defined network infrastructure. Where is your, ask any IT guy, where is your network boundary? There is no network boundary. You have servers are in the cloud and everyone works from home or travels when they work. And we used to say, this idea of the perimeter has kind of been blown away through several stages. Now it's almost identity is the new perimeter. Point being that if I can steal access tokens or VPN tokens and things, I can get access to your network, but your network is so flat and scattered. So I think the point there is we've seen the old model breakdown. It's now very much a scattered almost approach, and that's due to things like post-pandemic, working from home, bring your own device, cloud, and then AI, of course, on top of that is scattering things even further.
There's a couple of things that are sort of relevant to us. You talk about the attacker or the hacker breaking into systems. I've seen the evolution of the MFT platforms over the years, building up different layers of security by putting in place proxies and putting in place some of the other security features to limit access to various systems. So I can very much see that evolution of the technology as there's that sort of, I guess, competition for access to the data. And I mean, even without our business, you know, we've still got a relatively scattered infrastructure with all the different SAS platforms and things that we use these days. So I very much remember that. Just protect, got a firewall, you've got a router, physical security, great, we're fine. But no, that's very, very different these days.
And as an incident, what do you do? I'll just unplug the internet cable. Everything is safe and contained in this cocoon.
We had that very same conversation before you turned up this morning. Yeah, it's a little different.
Now Glenn, you are known for a presentation that you do where you have demonstrated how you can hack a billion dollar bank in very little time and we have had the privilege of seeing that demonstration before at one of our events that we've done with our clients. I don't know and I know that presentation can be sort of 30 minutes, 40 minutes long and we probably don't have the time to do that today. I wish we did and we could talk to you all day about it but are you able to tell us in sort of three to 5 minutes or so those typical stages of how hackers are bypassing and potentially hacking a billion dollar bank.
Yeah, absolutely. And it's, I've been on stage for 15 years now. I started Black Hat and DEF CON and Zero Knight, always kind of hacker type conferences and almost inadvertently progressed to what was it, keynote type talks. I speak on big stages all around the world, just got back from I was in Cairo last week, Cape Town the week before. So I really love going on stage to share my passion for cybersecurity, but also to show people what it actually looks like to be hacked, which is why I do that live demonstration. And people are smart. There's no need to dumb it down with analogies and things. I can show you some real hacker software and show you what it looks like actually to be hacked. And the talks it's intentionally a little bit risky. So how to hack a billion dollar bank in 20 minutes. It's designed to get that kind of chuckle when we get people to come along and see it. And it gives me an opportunity to one, tell a story about the history of hacking and what it means to be a hacker and hacker mindset, and then show you what it actually looks like. And in terms of what it actually looks like, it doesn't really matter if it's a bank or a retail company or a telco. Generally, it's the same approach a hacker will take. The end objective might be different. If it's a bank, maybe you want to steal the money. If it's a telco, maybe you want to steal phone numbers and SIM cards and things. But the approach is generally the same. And good hackers, and by good I mean proficient, putting morality aside. So proficient hackers are very methodical. So I've taught defenders to hack for many, many years. I teach at Black Hat in Vegas, 44 Con in London. I've trained law enforcement, the military. And the approach that we teach is very methodical, and there are steps that you can take and steps that you can learn. The analogy often says, like, if you want to learn to play the piano or to speak French, maybe you need some natural inclination, but if you practice every day and you have a process to follow, you can be decent. And it's the same with hacking. And the steps are generally step one, reconnaissance. So find out as much as you can about the target that you want to hack into and if you're hacking a bank, well, that could mean scanning over the internet to see what internet-facing infrastructure they have, see what versions of software they're running. Are there outdated systems that you can exploit, or can you buy zero days on the underground using to break into those systems? It's almost like if you want to rob a bank, you don't day one walk into the bank and write, where's the vault? You grab my crowbar. Day one, you sign up at the bank, you open an account, you get to know the bank manager, you get to know the staff, you look at the cameras and figure out what's going on. So in the internet world, so step one, do reconnaissance, figure out the infrastructure, figure out the people, map them on LinkedIn, map out the supplies and the relationships and the third parties and all those interconnected systems and try and find the weak spot. And hackers are inherently either lazy or efficient, depending who's answering the question, but we like to find what we call the path of least resistance. I don't want to kick down the front door when I can sneak around the back. Like why try and break open the vault if I can bribe the guard and he lets me in on the weekend? That's the same with hacking. So if I can send an e-mail to someone in HR, pretend that it came from their boss and their job's at stake because of redundancy and get them to open some document that has macro code inside it that runs and gets control of their system, and I can use their system, Bob and HR, and pivot from their system to some test database and pivot from there to production database and then either steal data, deploy ransomware, or do whatever I want. But the general flow at a very high level in 20 seconds is reconnaissance, find out as much as I can about the target, find some weak spot, maybe it's an outdated server or maybe I tricked someone into doing something. That's my initial point of access.
From there, I'll probably dig deeper into the organisation, either logically or physically, but find some other interesting systems to connect to and then do the bad thing. If it's stealing data, deploying ransomware, destroying systems, but that's generally the approach that hackers take. And in the demonstration, I use real hacker software just to show people what it looks like, which I guess both of you saw in the presentation. It is a very impressive presentation.
When you talk about finding that weak spot, do you find it's more finding a weak target like a human in that organisation, or is it the systems?
Yep, the balance is almost always skewed towards a person. And that's for at least a couple of reasons. One is we've got pretty good at defending computers. And computers, they're very illogical and they're very, they don't, they might be overworked, but they don't get fatigued and make bad decisions. They're very deterministic. And over the years, we've been very good at building up those defences. So you go back to the 90s, back then, there were no firewalls, there's no AV, there's no Patch Tuesday. And we kind of realised, okay, to make these systems safer, we need to do technical things to increase the security of these systems. And we've got very, very good at that. Maybe putting AI aside that's running rampant, finding new vulnerabilities, that's a conversation for just now. But humans, we're generally the same now as you were 20 years ago. Humans work under pressure, we're quite stressed, we are vulnerable to emotional manipulation, exploitation, and that's what hackers will rely on. And I'll often do what we call a social engineering engagement, and that's where I will try and trick someone into doing something in order to get access to passwords or to systems or something. And there's always like levers that we pull. There's levers or dials of sending a communication from a point of authorities. I will spoof your boss or the HMRC about tax or something or some person of authority. We will sprinkle in some temporal component. You have to reply by today, otherwise, otherwise it's punitive, you lose your job or get fired or something, or it's a carrot. HMRC tax rebate, reply by the end of the week, otherwise we donate it to charity. So all those kinds of dials that we can tweak there.
The levels of sophistication with spear phishing these days has gone through the roof. I mean, I guess, as I'm sure you do as well, I get a fair number of emails. And I said, talk about levels of sophistication, personalization, and all that extra information in there that is there just to trigger that response as quickly as you can.
Absolutely. We give away our lives on LinkedIn and Facebook. And I battle that internally because I'm a security guy. I never really had LinkedIn before a couple of years ago, but now I'm a keynote speaker and I got podcasts. I need to have a bit of a presence. So you always have to be mindful, like I generally share stuff a bit after the event and try nothing too personal, but still I get tons of, I see even on WhatsApp these days. Yeah.
Well, you're clearly a target now, aren't you?
Yeah, I am. And it kind of makes you maybe we pay a bit more attention because we know we're a target, but poor old Bob in HR is just doing his job. And his job is to click links.
Yeah.
And then we shouted him because he clicked the wrong link. Well, it's not really his fault. I would say we need to do a bit better as an industry. But yeah, it's a whole other thing.
One of the things we invest a lot of money in. We have to we have to make sure our staff. We have a lot of training. We do, yeah, have an awful lot of time put aside to making sure that we're as up to speed on this as we can be. We're not looking for anybody to try and hack us just by the way.
No.
This is looking at the camera.
But you do both have very good passwords, so well done.
You do.
Not revealing my password.
No. And now I'm a little bit concerned that you might know something that I don't know that you know.
I'm worried you've like hacked us while we've been like sat here on this. Does that align with what you see from a managed file transfer perspective in terms of...
Yes, yeah, I guess I guess the systems are relatively secure. You know, the software is as the software is. It's down to how a person will put the system in. The systems have been put into both create efficiencies in a workplace, putting in place that automation to eradicate some of those manual processes to try to create efficiencies in a business, but also try to remove some of the errors that we'll naturally see from humans operating systems. So yeah, I guess it's somewhat in alignment with what it is we do. The other angle to that is, people are still configuring the systems. So whilst the technology may well be robust and secure, if it's implemented in a particular way, but if Bob in HR is implementing it, maybe, and poor Bob, he's going to hammer him today.
Yeah, we do use Bob a lot.
It's not when you said his name. He's an easy, easy target, unfortunately. So if the systems are not being set up correctly by the people, then generally speaking, people are the weaker links.
So yeah, that's almost a trope as old as technology itself. So Bruce Schneier, one of the grandfathers of modern cryptography, I forget the exact quote, but essentially along the lines of we invented or described near perfect encryption, quite a long time ago. Mathematically, we can communicate with perfect encryption, but it's the systems around it and the people implementing it and all the little bits and pieces, that's where things go wrong. So we can have the most perfect technology on the encryption side, we can prove that it's perfect, but then people implement it poorly or all the scaffolding around it, that's where things go wrong.
And at the beginning of the conversation, you kind of touched upon motivation. Is it largely money that motivates these hackers? Is there anything else? Or is it?
Yeah. So we can almost break it down between what we call white hats and black hats. So white hats are the good hackers, black hats are the bad hackers. Do you guys know why that term exists?
for the audience. So yeah, white hat's good, black hat's bad. We take that from old Western television shows that were in black and white. And the sheriff would wear a white hat and the baddie would wear a black hat. So as a viewer, you knew who to cheer for and who to route for. And we adopted that as hackers at some point. And then grey hat may be kind of in the middle. But silly factoids aside. White hat hackers, so like myself or security researchers or ethical hackers, we generally do it because it's interesting and we like solving puzzles. We maybe don't have that inherent career, that inherent criminal motivation. It's like, yeah, like taking apart systems and puzzles and it's fun. And generally in the West, you get paid quite well to do it. It's another story if you live in another country and that job market doesn't exist. But then the other side, the black hats, the criminal component, that is very largely financial motivation. As with any criminal enterprise, if it's fraud or cyber crime or anything else, it's financial. And the big, as we said earlier, the big piece of that puzzle today is ransomware, just because it works quite well. Ransomware got its footing post 2008 after a big financial crisis. Bitcoin came out and Genesis Block and crypto and everything. And that allowed hackers to scramble your files and demand anonymous payments. Like a poor old Joseph Pop earlier, we spoke about him who demanded payment via a check in the post. There's no anonymous component. So once Bitcoin and crypto came along, hackers could demand money via an anonymous channel. It's very much criminally motivated. It's a huge market. I mean, if you look at the numbers, the average average ransomware payments are generally in the millions, 4, 5, 6, up to 10s of millions, depending on the organisation. And the global ransomware market's expected to hit 265 billion US dollars by the year 2031.
That's insane.
That's incredible.
Yeah, it hurts. The one thing I worry about is people are, I was taking a little bit distracted by things like AI hype, and we're maybe ignoring the fundamentals and the big risks that are out there. I've got a friend, Dominic White, who describes it as the black piano fallacy almost. If you're walking down a dark street at night, you maybe be a little bit worried about a piano falling on your head. It's not 0% chance it could maybe happen. But if you're really focused on that and not about getting mugged or tripping or something, maybe you're focusing on the wrong thing. I do worry that maybe AI is a big scary thing that could happen and AI powered super hackers. But the basics of just basic ransomware and getting the basics wrong of poorly configured systems, those are the things that are going to hurt us more, I would say. But to answer your question, yeah, it's predominantly financial motivation, I would say.
Then on the flip side to the organisation that would be hacked, what is the, in your experience, the cost of being breached these days?
Yeah, so there's anecdotal evidence, but there's tons of research. So IBM has a report cost of a data breach. 2025 is the latest one, I think. They pegged that around 4.5 million US dollars. And that cost is before you take into things like ransomware payments. So that's just the cost of downtime, of reputational damage, of all those kind of ancillary costs. But it very much can sink an organisation. And I think that the unfortunate part is what we see in the news, if it's Marks and Spencer's or Jaguar Land Rover or airports and airlines. We see the big companies and they're almost generally too big to fail. What we don't see is the smaller companies that also get hit by hacker gangs or ransomware. And they go under because even if they have cyber insurance, it's often not the right kind or the fine print doesn't really help. Generally they don't have it. In the UK, I think what, 99% of businesses are SMEs or SMBs. And the average spend on IT security is less than 100 pounds. So those organisations are far more vulnerable, and those are the ones we don't read about in the newspapers that go under.
They're not aware of it, yeah.
The cost of that, yeah, it's just the end of the business. That's can't really put a cost on that.
No.
Wow.
Yeah, that's a lot, isn't it?
Yeah, it's a huge amount, yeah. It's big numbers, and I think there's all kinds of things that we can do about it. It's all a bit doom and gloom so far. There's tons of positive things that we can do, lots of positive things that are going on. And we spoke about that pendulum swing earlier. And there's definitely a bit of a pendulum swing, I would say, in the favor of defenders at the moment. I've been kind of harping on about these types of things for a couple of decades now. And now I'm going on podcasts and going on stage and people are taking me very seriously and then they're paying me to come in and help them. And there's definite appetite for security and people take it very seriously. And there's tons of very clever technical solutions that are helping. And then also law enforcement and legislation are catching up. And just the news this morning, Operation Endgame, this is joint multinational law enforcement effort to shut down hacker gangs and info stealers and they shut down like 100,000 machines yesterday or something. And there's this big global initiative to combat these types of things, which I think is a huge positive. We just have to be a little bit mindful and careful that we don't also hand over civil liberties at the same time which is another thing that's going on at the moment we have to be a bit careful of.
Yeah, that's a challenging conversation in its own right. To come back to the black piano analogy though, so if we put that in the context of what it is that we're doing, a lot of the conversations we're having with customers these days is really looking at making sure you're getting the basics right. We put together with the expert help of our marketing team a zero trust piece of content that just is just talking about, you know, making sure that you do the basics right. Making sure that we've got, you're looking at that primarily, not only just your system, but securing your supply chain. That was a good catch. Securing my iPad. Yeah, securing your supply chain. So yeah, that, and I'm sure specifically in the ransomware space, you're seeing that proliferating through supply chains as well. So yeah, we see an increasing amount of security implications or restrictions being placed upon partners of our customers where they're looking to even go to the point where now it's not just a case of securing the IP that you're calling from. We're actually going to some of the financial institutions, which you've probably worked with, it's a VPN between the two sites. We're not even touching the internet necessarily. But these are all really basic things. They've been around for donkey's years.
And that's the thing, get, like, my consistent message is get the basics right.
Yeah.
Get the basics right now.
Maybe, once you have the basics, worry about the cool, more sophisticated stuff. And I think it's spot on. Like, hackers are targeting data. They want data. They don't want to just break into your system. They want data. And where is the data? And the land of MFT, that's across so many, geographies and servers, and it's almost the worry is almost, we get focused on data at rest, but data in transit, and that's where hackers like to sneak in, which is, just from the research I've done on you guys, is having that consistent encryption and audibility and logs and those types of things, because it's the value, it's the data that's valuable. Other MFTs who have been hacked, they've been hacked because hackers want access to data to extort it. And we see this slight progression of ransomware from we're going to break in and scramble your data to we don't need to break in. We'll just get in the flow of traffic and steal the data and then say, hey, we're going to release on the internet unless you pay us. So don't even need to down your systems. It's almost more effective. Your systems are still up, but I've got terabytes of your customer's data, not even your data. We call that double extortion. And if you don't pay up, we're going to release it. And because you deal with lots and lots of clients, it's not just your data or one client, it's hundreds of thousands of clients. So it's a real attractive target almost. And we've seen them.
It is the gateway to the business. You know, that's one of those. We talked about the physical security for a company. This is literally almost not the front door, maybe the back door for parts of the business that we need to secure.
Yeah, absolutely.
And it goes beyond just having a secure file transfer system in place. And you need to make sure, like we said earlier, it's configured properly. It's kept up to date. It's looked after by someone that knows what they're doing and set up with those sort of zero trust principles in place.
Yeah, because I'm sure you go into, in my experience, I'm sure yours is the same.
I go into organization to assess the security. Maybe you go into deploy secure file transfer, but I'll go in and all the file transfer on-site, off-site between third parties and subsidiaries. It's PowerShell scripts duct taped together with some antiquated FTP things going over clear text.
I can tell you some horror stories. I can't tell you on here. Offline, I'll tell you some horror stories.
It's hackers. We love that.
This is, yeah, a nod to our central government. Shockers.
Does the same sort of.apply when you talk about zero day vulnerabilities, what can organisations be doing to protect themselves against that? Is it similar?
Yeah.
Similar getting those basics right.
Well, it's almost literally the $1,000,000 question. So for those who don't know, so zero day is effectively a weakness or a vulnerability in software that nobody knows about except the person who discovered it or a small group of people. So there's some weakness. For an analogy, if it's your home and some security researcher finds out that the door around the back, if you tap it the right way, the lock falls off and you walk in, but the person who makes the lock doesn't know about it, the homeowner doesn't know about it. So A zero-day vulnerability is some weakness in some software that a hacker or researcher finds and it becomes a one day or an end day or something once it's globally known and then patches start being released and things like that. But while it's still a zero day and nobody knows about it, it's very dangerous because anyone who has access to that can break into those systems. So on the MFT angle, I think it was movement and go move it and go anywhere those types of players. There was zero day vulnerability found in the SQL servers and that's where hackers managed to get access to those systems and steal tons of data. So the question is, how do you defend against a zero day? It's very difficult because it's about the unknown unknowns. You don't know that you have a zero day. You don't know that hackers have discovered that. So what you do is, there's this old expression, you kind of assume breach, assume you've been broken into, assume you've been hacked and act accordingly. I think it's a little bit lazy and defeatist maybe, but the general idea is you should build your systems in such a way that if... a zero-day vulnerability is discovered and someone breaks in, you can limit the, we call the blast radius. And you do that by doing the basics again. So make sure that all your other systems are patched. Make sure you have things like zero trust and network segmentation and all those almost basics in place to limit that damage. Because we've seen cases where there is a zero-day and that's terrible, but it's on some edge device, but because the network was flat or there wasn't segmentation, then bad things follow from that. So maybe it's not the zero-day itself. In general, it's a very hard thing to defend against because whilst there might be shiny solutions that promise zero-day protection, generally that's incredibly difficult because even if you have fancy things in place, hackers will find that zero-day and they will, by hook or crook, discover the fancy tools you have in place to mitigate those, replicate them in their own environment, and tweak their systems until they can get past those protections.
That's a good point.
Yeah, the whole zero day thing is interesting. It's either very smart people or people with low financial backing. So there's entire markets where you can buy zero day software generally on the underground. So if you're a nation state or a wealthy hacker or a criminal group, you can go on these forums and you can buy access to these zero days. It's a lot harder these days. You go back 10 or 15 years, there were these quite well established, both above ground and underground marketplaces to buy zero days the companies that, it's a whole other discussion, but the companies that offer those services, ranging from illegal to immoral but legal, they've generally all been acquired by government agencies because government agencies want to have access to those shiny zero days. But there's still a bit of a market. If you know where to look on the dark web, you can generally go and buy from $5,000 to $10 million by a bit of software that allows you to break into systems. But generally as a hacker, we would favour a cheaper, more reliable solution. So I'd rather social engineering parole Bob in HR than spend $1,000,000 on a zero-day exploit, which might get patched tomorrow, and I've burnt $1,000,000 for nothing. But yeah, so in summary, how do you protect against zero days? Well, get all the other basics in place to mitigate the damage if it should happen.
A scary question for you.
Absolutely.
But how do you see this evolving in the next sort of 5, 10, 15 years? Where do you see hackers and their movements when it comes to exploiting data?
Yeah, I think the one way to look at it is the more things change, the more they stay the same. So hackers will stay motivated in terms of getting access to data and maybe defenders will create new ways to stop them or to defend systems, and hackers will find new ways around that. So it might be more of the same, might be different, and the way that defences are deployed or attackers operate, the technical specifics may change, but the actual goals of cyber criminality or espionage or nation state hackers, I suspect, will largely stay the same. What will be interesting is to, I mean, we have to say it, the AI question.
That was going to be my next question.
Maybe I should say that for you, but we'll see how is AI going to play into this? Maybe it's a bit of a hype cycle at the moment and things go back to normal. Hard to tell. But if I had a crystal ball, I'd be a very wealthy man.
Yeah, wouldn't we all?
Yeah, my general observations, it'll probably be more of the same in slightly different ways.
Do you think AI is going to amplify risk or take it away? Or a bit of both.
I resisted answering my previous one. So you have your question. Yeah, absolutely. So how is AI playing into cybersecurity, both attacker side and defender side? My general view is that AI in its current state is just another tool in the hacker or defender's tool belt. I think, like my opinion, is a bit too much hype, which is a bit of a shame because it's very cool tech, but we may be overhyping it a bit too much. I've been in the space for a fair while. I was young, but I was there for the.net boom and for the cloud gold rush and for the IOT frenzy and for the Web 3.0 crypto bonanza. We get these new shiny technologies that we think are going to fundamentally change the landscape from a cybersecurity perspective, which is a business perspective. And it may well be that the AI one is different to the previous kind of hype cycles and we're yet to see. But at the moment, the way we can unpack it is on the attacker side, we're definitely seeing almost a, we call it a compression of the time to conduct some kind of hack or attack or something. So hackers are leveraging AI to speed up their operations. So if you do a huge network scan, you can get AI to consume the results and interpret it for you. If I want an engagement, I suck at PowerShell. So I can ask AI, hey, can you write me a PowerShell script to enumerate all hosts on this network? PS, I'm a network engineer, not a hacker. And then it'll make me the script, and I can use that kind of thing. So it's uplifting existing capabilities. The almost hype side that we're seeing is that it'll be AI-powered super hackers, and it's all going to be terminated 2, judgment day, machine versus machine. Maybe, but I'm less concerned about that, I would say. The biggest thing we see at the moment is maybe just more sophisticated phishing emails that are in native languages and things. But then we get things, these new frontier models, if it's Mythos or Fable and GPT 5.6 has just come out, and we're all getting a little bit twitchy about that. The US government's kind of trying to ban it or restrict it. Those models do seem quite capable, but without the scaffolding, they're not that useful, and not the human component or the guidance and whatnot. But it's hard to tell. We're only a few years into these types of models. Might be a plateau and things kind of stay as they are and there's kind of diminishing returns. Or it might be that more data centres, less water and poor environment, but more data centres, more power and things will evolve that way. On the defender side, it's also interesting to unpack how will AI assist or impact defenders. There's an interesting thing going on where a lot of EDR or SOC type vendors are using AI to interpret results and give context and whatnot. I think that's very interesting, but it's very expensive. Tokens are already a little bit expensive and they're very heavily subsidized by VCs and investors. When the true cost comes out, it's going to be hard to balance that and attackers know that. If they can flood you with data, so you have to burn all your tokens, and then your tokens are burnt, then I come in with the real attack. So I think that's, we may be burning ourselves there.
It's interesting, yeah. I've heard a few podcasts that talk about the cost of tokens. So what tools are you seeing that defenders are using to sort of get on the offensive, I guess, from the point of view of AI security?
Yeah, so there's tons of really interesting open source projects. So, Raptor is very interesting. So, Raptor made a mind Dan Cuthbert and a few other hackers made that. Definitely yes, on GitHub, go have a look at that. Dreadno.io, they're doing super interesting stuff. And what's the other one? Not Centurion, something like that. But essentially, there's also very interesting projects to try and, to a degree, automate the pen test process. So pen test being ethical hacking. And the cool stuff is where we kind of enhance the hacker abilities. I don't see my job being replaced. I see the tasks that I do being replaced. So AI, if you're worried about your job, I don't think AI is going to replace jobs, it's going to replace tasks. If you can be the AI wrangler, then you can manage the software to make sure you keep your job, but you're in charge of the software almost. And we're seeing projects like Raptor and Redknot and all these other ones where they're enhancing the capabilities of the hacker slash pen tester to do the grunt work for them almost. And then on the offensive ethical side, maybe on the defensive side, there's tons of stuff around patching and patch management and analysing your states. And a lot of companies that don't really step into that space are adding AI offerings to try and interpret results and give context and things like that. Yeah, but if you're watching, go check out Raptor. I think that's the coolest project at the moment.
My final question that I have for you today, and James, I don't know if you have anything afterwards, but if there's one thing organisations could take away from this episode and start doing today to better protect themselves, what would that be?
Gosh, I have three.
I have a list of things.
Let me be rude and give you 3 very quick ones. So one, I would say the cheapest, quickest thing to do today is deploy deception technology. So deception tech is where you lay traps for hackers to trip over. That's the only way I've ever been caught in engagements. There's honeypots or token files, like what looks like a password file. As a hacker, I open it, but actually it sings home and tells the IT guy someone's poking around where they shouldn't. Go check out a company called Thinkst. The canary tokens are free, and then the canaries are like very, very cool honeypots. Empower your people. So phishing simulations are great if you're running those, but go augment that with what I call, or what the industry calls a nudge technologies. So redflags.io, they do super cool stuff in that space. Essentially having a little bit of software on your laptop before Bob in HR clicks that bad link, little agent pops up, hey, are you sure you really want to do that? looks a bit dodgy. It's like having me stand behind you, tap you on my shoulder. Don't do that. The third one, if I may give myself a plug. So Agger Labs, we have built a lightweight agent that runs on your endpoint, your laptops, your servers, and we detect and kill ransomware like nothing else on the market. We don't require updates or signatures. We're local only. We're a very clever piece of software built by hackers to stop hackers, and we stop even zero-day ransomware. We also have the best anti-tampering in the market. You can't stop our software. It works so well that it also protects your other software. So it'll protect your EDR and your AV and everything else on your system. Aggerlabs.com. So come and check us out. Told you I'd get the finger bang in there.
I love it.
Yeah, get those three things lined up and you'll be in a more secure place.
Perfect. James, do you have any more questions?
I don't.
We've been talking for what seems like. Quite a long time. But it's been fascinating and we can't thank you enough for your time and coming on the episode today. We hope you've had fun. Before you go and leave us, do you want to tell our listeners where they can find you, the platforms that you're on? Feel free to talk around with the camera if you are.
So if you're watching at home, you can go check me out at Glenn with two Ns, glenn-wilkinson.com, or come along to Agger Labs, that's aggerlabs.com, or come find me on LinkedIn. I think if you search for Glenn with two Ns, Glenn Wilkinson, I think I'm at the top of the list now. There was a bodybuilder in Ireland. If it's abs in six weeks. That's definitely not me. I think I've just bumped him up to be the top on LinkedIn. But yeah, definitely connect with me. I speak at events, corporate events, events all over the world, or I can help you with your security posture. Do get in touch, but thank you so much for having me on the show.
Thank you very much to our listeners. We hope you found today's discussion valuable. You will find Glenn's details in the show notes below, along with our contact details if you'd like to continue the conversation with our team. If you enjoyed the episode, don't forget to hit that subscribe button and stay tuned for more conversations like this one. We will see you in the next episode.
Compare MFT Solutions
Further Reading: