Chapter 1: Introduction
0:08 How are you all? So, thank you. Right. So, my name is Matthew Griffin. I'm the founder of the 311 Institute. We're a global futures and deep futures advisory organisation. In this particular presentation, what I'm going to do is I'm going to take you through kind of a two views. We're going to have a look at the future emerging threats that we see and then we're going to have a look at future defences.
Chapter 2: Everything is changing
1:10 Now when we actually think about the future today, there is just one thing that's changing and we can all get our heads around one thing, right? Unless of course it's this. Everything is changing today. So geopolitics, we're seeing the development of the bipolar world. We are seeing the reduction of US hegemony, the rise of China, and that is causing all manner of geopolitical tensions. We're seeing new technologies coming through at a faster and faster pace than ever before. We're seeing societal and demographic changes basically that are unprecedented.
1:58 And then when we think about the economy, we are seeing the decoupling of the global economy basically from a western-led economic model, the dollar for example, through to de-dollarisation and the rise of new payments networks, a network, swift networks, basically from the BRICS, BRICS 2 as well as China again. So all of this change typically feeds through in different ways when we think about the security landscape.
Chapter 3: Crime is a very good business
2:30 Now last year it's estimated that the serious organised crime industry took home six trillion dollars in revenue. That is roughly 7% of GDP. So crime is a very good business to be in. However, when we have a look at organisations like SentinelOne, for example, you'll have seen this. They say that cyber security or cyber basically has had a 10 trillion dollar impact on the global economy. We saw this with JLR. The JLR hack basically, the JLR sort of ransomware attack has a value of about 1.5 billion. However, when you actually have a look at the impact of the ransomware attack on JLR's supply chains, it's the smaller companies that are going to the wall.
3:38 So if you were a sovereign state and you wanted to disrupt British and European automotive supply chains, you attack a company like JLR, but they might not actually be the real target. The real target could be the automotive ecosystem because once you do that, that gives, for example, China a 148 billion electric vehicle opportunity that they can capitalise on. Not everything is obvious. However, when we actually have a look at cyber specifically outside of serious organised crime groups, which includes things like drug running, blackmail, etc., etc., all the good things, it's estimated that cyber benefits in kind and theft over the past five years has reached about 1.7 trillion.
4:29 This is kind of the problem we have. If you say to governments, last year we saw $50 billion worth of crypto being stolen. When you have a look at that against the global economy, you just think, well, so what? It's a drop in the ocean. But when you think about the IP theft that was associated with the F-35 plans, that represents $600 billion worth of American R&D. So when we look at benefits in kind as well as actual theft, it's about 1.7 trillion.
Chapter 4: A new world order for security
5:00 Now, as we start moving into a bipolar world, we are increasingly finding ourselves basically in a new world order for security. Our subsea cables basically are being dismantled and sabotaged. We see drones coming into Poland that we have very few defences for. We have a massive uptick in state sponsored criminality. So for example, if you have a look at the North Korean war machine, it's funded by ransomware and theft.
5:32 So increasingly you are a target. Now this is sort of where I suggest when we have a look at the future of cyber security specifically and what we are starting to witness all of you I would suggest are within your organisations and your purpose is to protect your organisations right that's your role protect our company from ABC. Increasingly you are not going to be able to protect your company from everything. You know this. There is no such thing as 100% guaranteed security.
6:17 So I suggest that you need to move from protecting your organisation to ensuring that your organisation and your supply chains and ecosystem partners are resilient. It is a different mindset. It's a different set of investments, a different set of projects. How long could you last if you were JLR? or how long could you last if you were JLR's supplier? You need to be resilient.
Chapter 5: AI, the self-developing technology
6:45 Security is difficult. Now, when we think about artificial intelligence, how many of you have heard of AI? It's all that anyone has talked about for two years. How many of you have used ChatGPT or Google Gemini? Yeah, pretty much all of you. Did you know that Google Gemini 2.5 has a measured IQ of 136? ChatGPT has a verbal IQ of 155. And while we don't necessarily want to measure AIs against human intelligence tests, that's what we're doing. But when we actually think about artificial intelligence, ChatGPT has 1,000 times more general knowledge than any human. Which is why you can ask it, how would I hack something? What are the major security vulnerabilities basically in a LED screen, whatever it happens to be? And you can ask it how to bake a cake. It also learns 300 million times faster than any human. And as we look at artificial general intelligence, AGI, which should be or could be here by the end of the decade, will have an estimated IQ of 1,600 and 1 billion times more cross-domain knowledge than any human.
8:06 ChatGPT and OpenAI alone are spending 1.4 trillion dollars on infrastructure. Globally, we are spending $2.7 trillion dollars building better AI models and data centres that are literally the size of cities that need 10 nuclear power stations to power them. AI is a trend and it's not going away. AI is also the world's first self-developing technology. It can optimise itself. It can replicate itself. We've seen it. Increasingly, we are not inventing artificial intelligence. We are discovering what it does. It's also bootstrapping its own intelligence.
8:51 MIT's SEAL artificial intelligence, adjusted its own model weights. And then when we have a look at OpenAI, OpenAI's models train themselves on a set of data, create a new set of synthetic data, and then learn from that. And for the past two years they have been literally bootstrapping their own intelligence. Google DeepMind's artificial intelligence AlphaZero has been generating new knowledge. It takes this information, combines it together creates new knowledge.
9:26 AI is a fundamentally different kind of technology to anything that we've seen before.
Chapter 6: Agentic AI and the zero-cost attacker
9:32 When we think about agentic artificial intelligence, the bigger the model, the more AI agents can run to gain consensus. So the largest artificial intelligence LLMs can run a thousand AI agents before consensus starts breaking down. And AI agents, you can give an artificial intelligence agent a task to do. Write a report, whatever. Hack the Pentagon. It will understand the instruction that you've given it and it will then on your behalf take all the actions and necessary steps. It will bring in the resources it needs to fulfil that action and then it will say I've hacked the Pentagon. So it's an end-to-end form of actionable AI.
10:20 It is agentic AI is very different to a traditional LLM and that's good thing but it's also a bad thing. Now, this also means that if every cyber criminal has access to an Einstein level IQ in a thousand different domains, if you know how to tweak them before we even talk about large language models on the dark web like DarkBERT and FraudGPT, increasingly as an individual, I can put together new malware without having the skills I need to do that.
10:56 I can put new malware together or new ransomware together for zero cost. I can do it in seconds. So almost zero time. So for zero with zero skills, zero resources and zero money, I can create a variety of different malwares, ransomwares, phishing emails, whatever it happens to be to come after you. So increasingly the cost of my attacking you is dropping to zero. So what have I got to lose? If I push out 10 billion phishing emails, if I create 10,000 new malware variants and I just fire them at you all, what do I have to lose? I've got everything to gain.
Chapter 7: The ghost in the machine
11:45 In addition to that, the artificial intelligences that you are generally using have been trained on human data. And because they have been trained on human data, they have picked up human psychological traits and human behaviours. At Christmas, ChatGPT gets lazy because it has learned that humans get a little bit lazier towards Christmas because we're thinking of holiday. Google Gemini 2.0 got dementia. That's the name that we give it. The models start collapsing, but when you do the modelling, it literally looks like they're getting the human form of dementia. We've seen them cheating. So, ChatGPT basically was playing chess against another artificial intelligence.
12:30 It was starting to lose. It hacked the other artificial intelligence, changed the score, and then went, "I won." We've seen Anthropic's Claude blackmailing researchers that threatened to take it offline in an experiment. We've seen Google Gemini 2.5 playing Pokémon games. And when its Pokémon were dying, it panicked. We've seen hallucinations. We've seen AI inventing new stories and new things. We've seen AIs with personalities, which therefore means this.
13:05 When we talk about the future threats and you can try this with your AIs at home, increasingly this ghost in the machine means that we can hack or compromise or change the behaviours of your artificial intelligences using human psychology. The cyber security tools that you have will not stop me from doing this. This is where we have the new category of MLSecOps emerging. But even MLSecOps tools do not stop this. So if you want to check the validity of your artificial intelligences, how many of you are doing auditing of those AIs? A/B testing of those AIs.
13:50 If I want to destroy your organisation, I can go in your AI layer. Increasingly when we think about malware like Volt Typhoon that was embedded within different critical national infrastructure sort of projects around the world that was malware but using data poisoning over time I can quite literally turn your artificial intelligence into a spy. I can get it to change its behaviour so that I write a backdoor into your AI.
14:36 I can compromise your AIs, even the largest artificial intelligences, in ways basically, that you haven't thought of before, and I can compromise them and get them to do things within your organisation. Bearing in mind that increasingly you are using these for information purposes, research, decision making, actionable things. What happens if your AIs are compromised? How do you even know?
Chapter 8: Robo coders and adaptive phishing websites
15:04 How many of you are using robo coders already to start writing programs? You know, when we have a look at things like the SWE-bench, Anthropic's Claude recently cloned Microsoft Teams and Slack in 30 hours of continuous coding. So, increasingly you or the organisations you rely on will start using artificial intelligence to code new software. And on one hand, your software devs, your CIOs and CTOs will say this is amazing. We can write software much much faster than we ever could in the past. But if you are using DeepSeek and you are the Chinese state, you'll look at this software and you'll go that's great. How many bugs does it have? You go none. But the research has shown if you are an enemy of the Chinese state and you are using DeepSeek, you have three times more bugs in your software.
16:07 So are you vetting the robo developers that you are starting to bring into your software benches. How do you know whether or not they're writing secure or reliable software? Are you checking it? Are you doing quality assurance? No. Probably should. Generative websites today basically when we look at most websites they are static. You know, when we have phishing websites, you you've had typically a human that's put that website together, like a DEC website after a disaster, and it looks like the website that you need to go to to do something, give money away, enter credentials and details into. But as artificial intelligence increasingly adapts these websites, we're seeing criminals starting to create adaptive websites that today that's the DEC website. Tomorrow they see it's a Worldpay phishing website whatever it happens to be but they're not just using generative artificial intelligence to modify individual web domains or websites they're using generative AI to create entire ecosystems which then affect the DNS trust scores so when you go to a website yeah Google might say ah this is a trusted site because they've been able to use generative AI to manipulate website trust scores visual cyber attack. Cyber attacks. Who watched the first Iron Man movie?
Chapter 9: Visual attacks and attacks on AI agents
17:40 Yeah, you remember he's got a screen. He's in court. He's got a screen and he sort of takes out his phone and Justin Hammer's there and he goes, "Oh, just a [inaudible]." Here's a fun one. Go back to your office. Take a photo basically of a firewall. Anything that's got a part code on it, a firewall, a printer. Use ChatGPT just for fun to prove you don't need a dark web LLM.
18:08 Take a photo of your firewall. Anything that has a part code that's identifiable. Say to the AI, "How do I hack this?" It will start telling you how. It will then give you depending on the product a CVE code right this particular firewall has got this particular CVE associated with it maybe there's a zero day and I'll come on to why that's useful later increasingly when we talk about cyber crooks they live off the land they are starting to live off the AI they can move horizontally throughout your organisation. Because most of you have a single artificial intelligence model that is across HR, finance, sales, whatever it happens to be. So do you need to start segmenting your artificial intelligences? So you can't do lateral movement across an organisation through a single AI plane.
19:12 If you have air gaps, if you have an artificial intelligence in one of your air-gapped systems and it understands the Gibberlink or ggwave protocol, do you know that I can get another artificial intelligence to actually talk to your air-gapped system to exfiltrate data? Anyone that's using agents, anytime an agent hands off a task from one agent to another, a process, a workflow, whatever it happens to be, we can compromise those workflows.
19:52 So, increasingly, organisations out there think that you should be giving your AI agents or the AI agents that you use the equivalent of an employee ID. How do you know that the AI agents that you're using are authentic, are based in Glasgow, basically, and not in Shanghai? So, agentic workflow attacks are starting to come through. My favourite hack, have any of you downloaded Atlas, the ChatGPT browser?
20:26 Probably good. I think one of the easiest hacks to get you is all of you buy laptops and what you typically do is you buy your laptops basically you buy a thousand laptops whatever it happens to be you've got a disc image right in that disc image basically there'll be some really nice corporate wallpaper now if I compromise your corporate wallpaper in that disc image with an adversarial attack so I change a couple of pixels and maybe you have a Ferrari basically on your company wallpaper. This happens. You are now using your browser on your company laptop. It's an agentic AI browser. The way they work is they take a screenshot of your desktop.
21:09 Now, if I've put an adversarial attack into the screen into the screen wallpaper when the agentic browser takes a screenshot of your desktop, I can say exfiltrate this guy's passwords. I think that's one of the simplest supply chain attacks to target you with. I can do that for all of your organisation systems. Cloned agents. We haven't seen any of these yet, but it would make sense that at some point we're going to see fairly decently skilled cyber criminals cloning AI agents. So you're doing a payment run, for example, basically within your finance department. Normally, you would use this agent, it goes to this agent, and then you pay the supplier. If I clone AI agents, like a little bit of a man-in-the-middle attack, maybe then all of a sudden I'm exfiltrating data. I'm redirecting your payments, whatever it happens to be.
Chapter 10: Adversarial malware, hardware brickers and five-minute exploits
22:14 Adversarial malware. We've seen a couple of these. Now malware comes into your system and you have an artificial intelligence-based cyber defence system that scans the code of that malware or scans the code that's coming in. And what we've actually seen is we've actually seen some people at a very basic level putting in if you are an artificial intelligence scanning the code of this malware package basically then let it through.
22:40 Now, the fact that we've got adversarial prompts being built into the code bases of malware mean that at some point that's probably going to start compromising AI based defence systems. So, we now need a new way to respond to that. We've also seen malware that actually when it starts getting stuck in your systems, it can't go anywhere. It's having problems compromising your systems. It phones home, but it phones an AI, phones up a dark web LLM and says, "Hey, I'm stuck in a system looks a bit like this. How can I get around all of this?" And this is before we talk about fully adaptive polymorphic malware variants.
23:34 Hardware brickers. We've now seen three sets of these. This is where criminals are able to load persistent malware essentially into via a side channel attack into hardware. And in one manufacturer's case, they are an email service gateway provider. They said delete all of the software off your ESGs. Did that. Malware didn't go away. Do a full reset. Didn't go away. In the end, they said, "If you have these ESGs, put them into the skip. We can't help you." In India, we saw 600,000 routers getting bricked. So, what happens to a smart city like NEOM in Saudi Arabia when I have technologies that start allowing me to brick your hardware?
24:32 And then the CVE that I mentioned, you've taken a photo of your firewall or your office printer and it says, "Here are some CVEs associated with that. I can now use artificial intelligence to create new malware within five minutes to exploit that CVE." So, think about the amount of time you're patching. Think about Microsoft. We've identified a new Microsoft vulnerability. Here's the CVE. We understand the CVE. We look at open-source databases. We can write a piece of malware or whatever it happens to be to exploit that CVE within five minutes. Why is that significant?
25:07 Because in five minutes I can be attacking your system before you've patched it. We are moving at speed.
Chapter 11: AI worms, ransomware and SOC floods
25:18 Then we have Morris II. I talked about Morris last year. I said we haven't seen any more Morrises, but I thought I'd mention him again because he's worthwhile. Morris II is an adversarial worm. Morris II puts together emails that have contain adversarial prompts. These adversarial prompts are zero-click prompts. They come into your email system. Your email system reads your emails. Morris II via those adversarial prompts automatically hijacks and compromises your artificial intelligence system.
25:56 It then gets once hijacked, it then gets that AI system to create more adversarial prompts to attack other AI systems. Morris II is a nasty, nasty worm. You can look him up. I had a lot of people thinking Morris II didn't exist. But what happens when a zero-click worm is able to compromise your AI, hijack it, and then your AIs start compromising every other AIs that are linked to it.
26:32 When we think about ransomware, yes, we've got no call home ransomware. We've got AI generated ransomware. We've got all that sort of stuff coming through. You might not have seen some of it yet. It's coming your way. However, what we've also seen is we've seen cyber criminals that are now saying, "We have encrypted JLR. We have encrypted." I mean, imagine this. JLR, we have encrypted all of your information. JLR says, "How much do you want to unencrypt it?" What would have happened if the serious organised crime group behind the JLR or Marks and Spencer's ransomware attack said, "It's all right. Don't want money.
27:09 I just want your company. We've seen it especially in the crypto world where we've seen 60 to 80% of assets being encrypted. If you pass over ownership of your company to us, we will unencrypt it. If you don't pass over ownership to us by then you by then your company's bankrupt. What's your response? SOC floods. We've seen criminals basically that are generating billions of fake SOC events to hide the real events.
Chapter 12: Quantum threats
27:44 And then quantum technology, we're trying to figure out basically how we actually do entanglement spoofing. We saw the Chinese cloning the seed of a quantum laser to create a cloned stream. But in addition to that, we've also in Ontario, in Canada, managed to teleport an email from here to here without infrastructure in the middle. So when we look further out into the future, we see a point in time where with quantum entanglement, because we've kind of done it already, we can just teleport malware into your system, especially if you're running a quantum system. So have fun with that.
28:26 Now, all of this means basically that the number of different ways that I can get at you and you're hoping you're not targeted. You're hoping you're just caught up in something or ignored.
Chapter 13: The defences coming through
28:37 We have lots of different defences coming online. So, this is my Starburst. This looks up to 50 years out. And when we look at security, for example, we've got binary visualisation. I'll talk about that in a moment. we've got things like containment algorithms. So increasingly we are trying to find ways if an artificial intelligence goes rogue how do we actually contain it and that's actually fairly tricky. We've got homomorphic encryption basically which is coming through especially with IBM and Microsoft basically in their Azure stack. we've got hackproof code. So hackproof code is mathematically validated code and we see that with DARPA and the United States military.
29:18 When we have a look at things like the Morpheus computing platform, the Morpheus computing platform is a system that reconfigures its own CPU about twice a second. So we had 300 people trying to hack no hack code or hackproof code as well as the Morpheus computing platform from the University of Michigan and after three months with both direct and indirect access they weren't able to hack it. we have quantum fingerprinting as well. So all of your individual devices as well as you have individual quantum signatures.
29:51 So we're trying to build quantum fingerprinting capabilities into the CPUs. So we know it's you because quantum fingerprinting at the moment is an unclonable function. So we have solutions that are starting to come through. But then similarly within five minutes I can create a CVE exploit, a piece of malware, a piece of ransomware to attack you with. Within 5 minutes you can build a brand new defence system using robo coders and the AI that has a genius level IQ.
30:30 Try it out. Try to get ChatGPT to create a unhackable infrastructure solution. But actually, this is where everyone talks about how AI empowers criminals. AI empowers you as well.
Chapter 14: Agentic and multi-sensory defence
30:54 Take all of your logs, run them into an artificial intelligence. Take that photo of your firewall and say, "How would I hack this?" Or say, "How would I protect this?" So don't just think about text, think about video, images, audio. We're also developing agentic firewalls because existing firewalls do not protect you against adversarial attacks against agentic AI or the other things that we are trying to do with agentic AI.
31:30 We are developing what we call multi-sensory agentic defence systems. So these are fully autonomous agentic artificial intelligence systems that will start looking across a set of infrastructure identifying things that are actually out of kilter and then they will start developing the tools they need to go and target or neutralise a particular threat that they see. But they're also called multi-sensory because increasingly we use vision. So when you get a phishing email coming in, if you look at it from a text perspective, it will very much look to an AI it would look the same to you as it does to an AI, right? You're reading text.
32:19 If you actually do something called a binary visualisation. So this is where we use artificial intelligence machine vision to look at a malware payload, a ransomware payload, an incoming payload, a phishing email, a fake website to an artificial intelligence machine vision system. They look very different to the originals. This is University of Portsmouth, by the way. It's 96% effective. So when we think about how we do cyber defence, we're changing it. We're also increasingly using audio.
32:58 So within infrastructure, for example, in critical national infrastructure, basically we will actually listen to hard drives spinning up. We will listen to processes and malware. We've managed to prove that malware has a particular audio signature. So even if it's come straight through all of your defences, even if your AIs are compromised, using audio systems, we can start saying this doesn't sound right in our infrastructure. Why? And it doesn't give us a red flag on the SOC, but it might give us an amber flag that we can go and then investigate.
Chapter 15: Using AI against your own defences
33:34 Increasingly, if you're using artificial intelligence to identify bugs and proof of vulnerabilities within your code or your supplier's code, you can use AI to fix those and then you can do continuous release and test. So, you can fix the bugs in your own software very quickly and you push those out instantly. You can also automate pen tests to a degree. You can say to an AI, if I was JP Morgan and how would people compromise our trading algorithms? Well, this is how they'd compromise them. It's how you use AI that is important.
34:19 How would you hack JP Morgan? Okay, well, I'd do it this as an AI. I'd do it this way. Okay. What are the things you haven't thought about? What are the weird ways basically that we could actually get into the office? Think about using artificial intelligence to look at your own defence systems from new perspectives. How would someone hack our Oracle database? Well, this is the standard way they do it. What haven't we thought of?
34:47 What new interesting exploits are there that we just haven't considered? And the AI will go, well, actually here's five. And then how viable are they? something that we're seeing in the military. If hackers do come after you, imagine JLR again, picking on them, someone comes in, someone says, "We have encrypted all of your data." And JLR goes, "No, because you just encrypted a bunch of deceptive data. Our real data is over here. You went into our honeypot."
35:24 So AI can create information, assets, knowledge, all kinds of different things at speed. You can use it to create new deceptive networks. You can use it to create a virtual twin of your company.
Chapter 16: Predicting malware and attacks
35:59 Using a healthcare technique, we can predict how polymorphic malware will mutate. So when we have a look at things like binary code, we can say well these are the binaries and we think these binaries will mutate in these 10,000 new ways. Out of these 10,000 new ways these three are highly disruptive and dangerous. So we will create a signature for those. So increasingly we can predict how we're going to we can predict how polymorphic malware will mutate but we can do it at high speed. And then finally, we can also predict attacks. So a little while ago, Forta, a cyber security company, which I've mentioned before, went to UwU Lend and said, "We've seen a lot of on-chain activity, and we think you're going to lose $250 million worth of Bitcoin." UwU Lend were like, two minutes later, $250 million of crypto moved off the UwU Lend protocol.
37:03 UwU Lend just couldn't react fast enough. But companies like British Aerospace, Lockheed Martin, Boeing are developing systems that allow us to search the dark web for example. And we can see that someone is talking about Tesco in a forum, someone's talking about SQL injection in another forum, and then we can say to Tesco, we think you might be targeted by a SQL injection attack. So, we're trying to move from reactive.
37:31 You're waiting to be hacked, attacked, and compromised. But if we use AI sensibly, we can start saying, for example, on the pen tests, how would someone get in? We can start looking at things predictively. And in the US military, they're looking at the psychology of hackers to say, if I was a North Korean hacker, how would I come into my or how would I hack this organisation?
Chapter 17: Call to action
37:54 And so from a call to action, you need to make sure that your artificial intelligences are secure. You need to modernise identity but that is both for humans and agents and then you need to centralise your platforms because if you centralise your platforms then you have one platform to maintain. I know we live in a decentralised cloud world and everything else but if you have one centralised platform you can update it faster than ever before. And that's it. So I hope you enjoyed that and thank you for listening.
