The patching gap: Hacked fridges, AI ransomware and Mythos finds Transcript

00:00 Panelists, I hope you looked into your freezer today, because my question for you is what is your favorite ice cream flavor? Vanilla. It's classic, it's simple, and it's always good. I had to go with chocolate chip. Straightforward and simple. And we're not just talking about ice cream flavors because I have a sweet tooth. We're talking about the dangers of outdated OTT infrastructure, along with the growing use of AI and ransomware and the future of AI and vulnerability pattern.

00:30 Hello, and welcome to Security Intelligence, IBM's weekly cybersecurity podcast, where our expert panelists turn the biggest industry news stories into practical takeaways you can use. You've got a great panel of guests today. We've got Claire Nunez, creative director at IBM's X-Force cyber Range, and MJ Vaidya, global senior partner, Cyber Strategy and Risk.

00:54 Our first story is one that sounds like every cyber security teams nightmare. French supermarkets around the country were affected by a widespread hack targeting refrigeration systems. Fridges at places like Carrefour, monopoly, Intermarché. So our fridges get as hot as 50°C. That's 122°F with some fridges smoking and catching on fire. Hackers took control of Danfoss, Copeland and Dixon refrigerate refrigeration management systems that were running outdated firmware.

01:28 Those systems are internet connected, so technicians can manage fleets of refrigeration units remotely. Danfoss issued a firmware update earlier this year after meeting with the cybersecurity firm team 82, who discovered the vulnerabilities. But unfortunately, after this incident, it was found out that many of these, many of these refrigeration units are still running outdated firmware even today.

01:57 For for its credit, Danfoss said it had, quote, long advised customers to keep supported systems updated with the latest firmware and to migrate legacy systems to current generation solutions. Which sounds like a lot of work. MJ, I'm going to direct this this question to you. What do you think about this widespread attack on a critical piece of, of infrastructure for a, for supermarkets?

02:21 There are a lot of elements to this. I you know, in my previous life I've had the opportunity to be a, you know, a CSO and responsible for product security. And in this case, it's not just the, the whole the end state where, you know, if they're up upgrades or updates to firmware. You know, you have to certainly make sure you're updating on, on your software and so on.

02:47 But there are a lot of other elements here as well in this IoT device. You know, was there a weight testing done when the product was being built? And there are many elements of testing. One is network connectivity. There is the actual hardware and the chips that actually go into this device. And then of course, the software that runs runs this device as well.

03:16 And then yes, when there is firmware a grade or update. Sorry. You know, is the, you know, is the manufacturer rolling them out on a timely basis? So there are a lot of these different areas that have to be, reviewed from the time when it's developed. Think of the supply chain, third party risk. Right. These products are not wholly built potentially just by one manufacturer.

03:44 So you have to look at third party risk as well. And then of course, when you're communicating and selling this product to customers, how is your ability to update your product so that the customer doesn't have to face these types of issues? It's something that comes to mind very quickly when you think about when you're building something like this.

04:06 It's not just about building, it's also about how do you make sure that what you're selling to a customer is continuously protected. You know, that's a great that's a great point that continuous protection is is important. Claire, we're seeing this issue with a lot of industrial and operational tech that is very critical to to day to day life that cannot afford, you know, a lot of downtime, when it comes to taking something offline, updating the firmware, things like that, how can businesses sort of reconcile the fact

04:39 that if they don't take these, these pieces of infrastructure offline every so often to update them, they might be dealing with a bigger issue that will force them offline. Right. And you know, the thing about this is it can be very expensive to take some of these systems offline, even temporarily to patch them. But it's way more expensive if you have downtime for days or hours, you know, like or you're losing product, as in the case with the French supermarkets where you're losing just like millions of euros of

05:15 products across the country. So it's kind of you weigh you have to weigh the risk of downtime for, you know, a set period of time that you can control. And you can say, we're going to do it now, or it is downtime for an unknown period of time with an unknown or, you know, predicted element, amount of product loss or, you know, God forbid, life loss, because sometimes this happens in a manufacturing plant or electricity plant kind of deal.

05:50 So you have to really consider the pros and cons and like losing ice cream and food and food waste is not good. But it doesn't compare to the dangers that can come up. If you know, you have a facility that has, you know, temperature changes that are dangerous. So you kind of have to consider, you know, weighing the risk there as well. Is it is it worth the risk to life or reputation if all of this, it goes down?

06:20 Sure. And, you know, with these, with some of these refrigeration units, some of them did start smoking and catch on fire. So there's definitely some real life danger, to be found when it comes to cyber attacks. My other question, you know, touching on what you're saying, Claire, about the potential loss of loss of a product and and revenue just with the spoiled and destroyed food.

06:47 I'm wondering what the angle is when it comes to cybersecurity and cyber insurance, protecting companies from losses like this due to cyber attacks. How does the state of the cyber insurance industry, you know, come up against an issue like this with systems that were found to be outdated with updates that were basically waiting in the wings, waiting.

07:11 You know, available for for deployment, but were not deployed. You know, what does that do for my, I guess, for my insurance claim? Yeah. And that's a tough question, right. Because and maybe you have a little bit more experience with this, but, you know, it really does depend on your policy and how your policy is written as well. It's kind of cyber insurance.

07:32 It's sometimes there are funky clauses in there. But MJ, I'm very curious to know, like how do you have any experience in that space as well? Yeah, sure. Claire, you know, I think to your point, it's these are funky, these clauses and how they're written are very interesting again. Yeah. You know, I have had that experience where you have to deal with your, your legal team and your corporate insurance team to be able to ensure the, the IoT solution or product you're building and you're selling to customers.

08:07 So from a manufacturing perspective, there is a responsibility that's associated with this. And certainly companies are, you know, putting insurance in place to be able to, you know, protect us against situations like this. It's also, I believe in some ways, many ways customers also should be thinking about when they're purchasing solutions like this.

08:34 You know, how are they continuously updating the software and are they patching or firmware updates? Hopefully it's simple. You know, when you when you purchase a connected vehicle, you know, those software is updated over the air or you're going to dealership and they updated. You know, if you're purchasing an IoT device, I think it's also, as a customer, you should be thinking about those aspects because from an insurance perspective, the other element of this to me is, look, the world is changing quite fast.

09:09 And what I mean by that is, you know, AI is certainly being used to also identify one abilities and solutions or systems like this as well as create attacks. And so the speed of these things are happening much faster. So when it comes to insurance policies and such, those things have, you know, they changed and they transform as over a period of time.

09:39 But it's you know, I think it's a, it's a responsibility on both sides, but definitely manufacturers. When they're putting contracts in place like this, they do put insurance in place as well. And to that end, I do believe the customers also have some responsibility to make sure that they're updating the software as well. Before we jump into our next story, I want to encourage everyone listening or watching to subscribe through Apple Podcasts, Spotify, YouTube, or ever you get your podcasts.

10:14 Our second story has left me disappointed, but not surprised. Turns out AI is taking over the job of hard working ransomware creators everywhere. Whatever will they do? The 2026 Ransomware Risk Report by cybersecurity firm Semper surveyed 1200 IT professionals across nine countries and eight industries, and painted a pretty grim picture when it comes to AI's effect on ransomware.

10:42 In short, it's not great. Because now 84% of ransomware attacks are generated with the help of AI, and that is a lot. We've got some interesting numbers here, with 69% of surveyed victims saying that they were attacked multiple times. And 59% of those victims paying ransomware at least once. Before I continue, I just want to jump in here with the with a question for for you, Claire.

11:10 We're still paying ransomware in 2026. I thought we were I thought we were done with that. Well, I think most people well, not most people. Some of the stats you see out there are not truly accurate either, because not every company is going to say they paid ransomware either. But yes, a lot of companies will pay ransomware, in the hopes to get operations up and running.

11:33 So, you know, sometimes organizations think that is their best path. Yeah. People are still paying ransomware. So other stats in the report show that 44% of attacks were essentially powered by hackers exploiting a company's own AI agents and AI systems, and taking advantage of their identity management systems as well. Courtney Gusts, Empress's associate vice president of crisis management, said, quote, if your company is adopting AI agents, you should consider that at some point, those agents will try to compromise

12:11 your identity systems, even if that action isn't meant to be malicious. MJ how am I supposed to take this? You know, I thought my agent was my friend and turns out he's compromising me. You know, with with his good intentions. Look, I mean, and this is going to continue evolving. AI governance is a certainly a significant issue and challenge and topic.

12:39 You know, when you are going live with AI driven, solutions and outcomes to solve business problems, whether it's adjusting existing business processes with AI or introducing AI native processes, they need to run with some things, like they need models, they need identities, they need staff to do their work, the challenges. They can also obviously, do things on their own.

13:12 And so what are the controls you have put in place when you think about across line one of defense line two, line three of defense, so that you are protecting yourself from a cyber risk perspective. And that doesn't mean it's just, you know, external attackers. I would look at these identities as an insider threat. And so what are the controls you put in place, whether it's things like kill switch or the ability to, you know, create an incident when when a behavior like this occurs, it's super important.

13:52 And of course, testing this within a harness and within a certain situation, you know, environment to see if these types of behaviors are occurring and not a point in time. This is the kind of thing where continuous controls, monitoring, continuous governance is super important. The last thing I would share here is you have to be thinking about resilience and minimum minimum viable company as well, right?

14:22 So you at the end of the day, entities are doing stuff to sell products and services to customers and they have to look at resilience and how are they being resilient, whether it's external threats or insider threats or agents that you're deploying to deliver certain products and services. They're the last thing I would was I was going to add here is you also have to think about what third party agents are potentially accessing your environment.

14:56 You know, lately you've been hearing about banks and others that are preventing agents from outside to access their environment. So again, part of your governance construct, you have to be looking at not just what's happening within your ecosystem, but also what potentially others may be trying to access from outside as well. Sure. I think that's a great point, MJ.

15:20 Another interesting note in the in the story was another factor. Researchers noticed ransomware is not only more AI generated, it's getting more difficult to detect because of limited testing. Hackers are essentially trading their their ransomware to be more effective and to have fewer mistakes in it. Claire, this makes me think of the the sort of attackers playbook getting more advanced.

15:50 And my, my question is how is the defensive playbook changing or adapting to a more AI focused, you know, cyber attack? Yeah. It's interesting and I it makes sense from a threat actor perspective to, to do that. Like if you want to be more effective, that's what you're going to do. But from the defenders side, it's, there's a lot of things we can do also.

16:16 Right. So, I think one of the big things is also not, you know, just relying on humans to help us defend, there's a lot of ways that we can automate our security controls and automate security detection as well. So that's super helpful because these tax are just so much faster now. And a human just cannot do it on their own. So I think, you know, that helps.

16:45 There's also just, you know, a lot of ways that we have to kind of change our thinking a little bit to, to kind of not think about the, about ransomware in a box to say as, as it currently exists and to, you know, keep our minds open to how things will change and evolve a lot more quickly. And it's not just kind of like version after version. It's like the next version could come out relatively quickly.

17:09 So just kind of keeping our minds open to that as well. One question about just about AI agents integrating AI agents into the workplace. I would imagine it be it would be difficult simply because of the human element, everyone sending their own AI agents out to do work, maybe without the proper guardrails in place. Is there any way a company can encourage, maybe encourage AI agent adoption safely?

17:41 Maybe have them operate within these certain guardrails, only perform these certain tasks or have these certain permissions? M j is that a is that a future you see happening, or do you simply think that teams will just have to keep, you know, both eyes peeled for any agents being deployed that are up to no good potentially. I think Claire mentioned a very important thing.

18:03 Right. Just in things are just moving so fast. To be able to defend against this, you have to have an autonomous security strategy and approach. And in that case, how are you orchestrating risk across the enterprise? And to orchestrate risks, you need a lot of different information to be able to connect them together. It's not just like a typical like a like a GRC platform, but it's more about how do you take regulations, policies, controls that you have to put in place across the different areas of of the company to

18:41 be able to control in this particular case, agents. And if they are, you use the word guardrails. So are there appropriate guardrails in place. And yes, I do believe that that is, going to be necessary to be able to, you know, not have these the agents. Certainly. Or, you know, AI in general do things that we don't want that to do. Like from a behavioral perspective, you certainly have to be able to ensure that there, doing the right things.

19:18 And they're following regulations, laws and all those kinds of things that we would expect humans to do. So digital assets should certainly follow a similar approach as well. Our final story of the day. Well, what's better than 3000 cyber security professionals on your team? I would say an extra 1000. Sounds great to me. And that's what Bank of America thought as well, as they hired an extra 1000 contractors.

19:51 This year to help fix their raft of vulnerabilities found using anthropic mythos tool. The frontier model used by Bank of America as part of anthropic Project Glass Wing initiative, was used by Bank of America to find hundreds of vulnerabilities and bugs that it was that it is hoping to patch in order to ensure it is compliant and, up to code in terms of financial regulations.

20:23 Some interesting points made by Mr. Moynihan jumped out immediately to me. I believe at one point during the interview he said, once you patch, you don't have to patch as much because the pipeline moves through and remediation costs fall. MJ, does that ring true to you? It's a very fair comment, and I'll speak generally when you think about situations when in this kind of an environment, you're fine.

20:52 You leveraging or AI is helping you identify, you know, the holes. If you if I could use a house analogy, there are many ways to get inside the house. But by the way, once you're inside the house, it can also help figure out where the crown jewels are in the house. Right? The sort of what we call the attack path analysis and where you know, when. Different ways to get to the crown jewels.

21:18 So yes, you can continue patching. And that's a very important step. And that's why you certainly see all the, you know, all the folks that have been hired, whether it's in cyber or in software and so on. And over a period of time, yes, patching can be more managed and controlled, but it's again. It's super important that it's not a point in time activity.

21:44 And we're continuously checking continuously. The manufacturers of the software itself are also checking themselves on an ongoing basis. And then the customers themselves also have a, you know, a program in place to ensure that the patches are being updated on an ongoing basis. Because the the way we got into this challenge and, you know, an event like mythos and others have, sort of created the situation where we have to move super fast and patch.

22:18 It's because we haven't patched as quickly in the past. And so it's come to a head where it's all of it has come to a point where you have to now move at speed. So I do believe that that's it's a fair comment. It can be managed. But I do think it's important that it's not a point in time activity. And you're monitoring this on a continuous basis. Moynihan also discussed the, issue of AI companies selling the tools needed to fix the problems they are finding.

22:53 Is the future of AI vulnerability discovery, AI powered vulnerability mitigation, Claire? Or are we maybe giving a little too much, you know, putting too much in the hands of these AI models to both find and fix these bugs? I think people and these models have to go kind of hand in hand for a while. I don't know, you know, we're talking like very future, very distant future.

23:20 Maybe it is something that AI can just do on its own, but I think for the time being, it is something where these where humans and machines have to work together, essentially. Because there are things that AI will discover and doesn't necessarily have full context to or whatever. And, you know, humans have the additional experience there to kind of help with that.

23:44 I think that's part of why, I mean, a lot of major banks are implementing a lot of AI tools to help with their security operations. But, you know, looking at Bank of America, they did just hire, you know, the thousand that are much in the in the article. So they are kind of like changing or they're trying to just improve their security posture overall with both humans and machines.

24:07 So I think maybe one day, someday everything can be automated, but, maybe not tomorrow. You bring up a great a great point, just the thousand, 3000 cyber security professionals hired to take on this task. I'm wondering what the challenges when it comes to bringing on a thousand new people to have access to your to some very critical systems in order to fix them?

24:36 We were just talking about sort of identity and access management and things like that. How do you successfully onboard groups of professionals like that or, and offer them properly once they're done with their work? Yeah, that's part of the problem also where it is, you know, the article mentioned that they were 1000 contractors on top of 3000, workers.

24:58 That's a lot of people that you have to manage access, make sure they have like, you know, whatever access they need for their critical work and not much else. So it is just kind of like a lot of management and deciding, you know, what projects are also critical for the time that they're on. If it isn't like, you know, extended contract situation. But yeah, I mean, there's, there's so many concerns with kind of third party contractor.

25:24 MJ. Do you have any thoughts on. Look, this is a foundational process. Just because you brought on a few more folks to do a certain function in a company doesn't mean you're a, you know, your identity access management approach should change. You should have the proper approach in place for onboarding, off boarding, proper controls in place, user access reviews.

25:49 And yes, you can have digital assets help you do a lot of that. But at the same time, you have to continuously make sure those processes are behaving and functioning the way you want it to. But I just because we have added thousand or 5000 people, it doesn't mean those processes change. And in addition, I would also add especially if it's temporary contractors or third parties, but it doesn't even have to be a special.

26:22 It can be internal as well. You need to have the proper monitoring in place of insiders as well as these contractors to ensure that, again, they are not doing things that would would not be consistent with the company's policies. That brings up a more, maybe a more, philosophical aspect of of this. I'll ask you, MJ, adding a thousand contractors, you know, is no small feat.

26:57 I'm wondering if this is a maybe a reaction to the potential surprise of finding so many bugs using mythos. And whether or not this would, you know, change how a security team approaches bug patching and fixing when they run this AI tool and say, oh my goodness, look at all of these bugs. How many, how many more are there that we don't know about? How many more people do we need to bring on to fix them?

27:28 And I guess the second part of that question is, is the future of a cybersecurity professional or team? Almost, almost a sort of wandering samurai of sorts, going from companies to company, you know, patching, patching bugs that that AI tools are finding. I think it's, this is just my personal thoughts. I, I think it's an incredible time to be in cybersecurity.

27:55 Incredible time to, you know, just being the environment where we're focused on and the amazing transformation that's taking place with technology. In this case, when, you know, these contractors have been brought on, there have been brought on to also fix software. So maybe software, you know, you know, skilled individual cyber individuals. And yes, it could be a reaction to the ability for this AI solution, meet those and others.

28:30 The ability for the for it to find all a lot more vulnerabilities than other solutions we're able to do in the past. But now that's the sort of the new norm, if you will. And so that is the one reason why I say it's not a point in time activity. If you're able to join a continuous basis, it becomes part of your governance and part of your normal state so that you're staying up to speed with patches and, and firmware updates and those kinds of things.

29:00 Thank you. I think that's a great place to end it. And that does it for today's episode of Security Intelligence. Thank you to our panelists, MJ and Claire. Thank you to the viewers and the listeners. Thank you to our producers. And subscribe to Security Intelligence wherever podcasts are found, so that you never miss an episode. Stay safe out there.