Radio LogicA Real Hacker Breaks Down the ASOS Hack

GMTV News:
Start off first of all with the latest on the ASOS hacking. ASOS says it’s investigating after customers received a notification from its app sent by hackers. The company say basic personal information may have been…

It’s a big story because it affects millions of people, those of whom have got the app. And it plays into all the stories we have seen actually quite recently now, The number of companies that are experiencing hacks, whether it’s your bank, whether it’s a cyber attack on on Marks and Spencer last year, which is very, very damaging for them, we’re seeing much more of this. And it is very concerning if you’ve got your bank details on there, your passwords on there. God, who’s got hold of them now? Are they in the hands of people who are going to charge me money to get it back? Is it hacking, right, like, ransomware attack? All these kinds of problems now popping up all over the place, and ASOS has fallen victim to it this time.

Anders Askasen:
On the morning of Tuesday, October 6, around 10:00 UK time, something extraordinary happened to customers of fashion retailer ASOS. Instead of usual shopping alerts, some customers received a push notification that appeared to come from ASOS itself.

But this was not a promotion. It was a message from someone claiming to have hacked the company, threatening to release data and directing the company towards a telegrammed contact. Within hours, the story had moved from customers’ phone into the headlines. Confirmed an unauthorized notification and restricted access to a third party communications platform that was involved. Its website and shopping app continued operating.

In a subsequent update, ASOS explained that the hacked attackers had impersonated a trusted contact, obtained an employee’s login credentials, and used those credentials to access information on certain third party platforms.

ASOS said some names, contact details, and non personal account information had been accessed, but no payment card details or account passwords. The attackers also claimed to have compromised a Snowflake environment.

That claim is not the same thing as a verified finding. And it is important we separate what was alleged from what ASOS has actually confirmed. In fact, Snowflake has denied that any unauthorized access had occurred.

What makes this case so interesting is not just the public spectacle. It’s the idea that a trusted employee identity could become the route into other systems and that an ordinary customer communication channel could become part of the attack itself.

Today, with me is OTW, and with him, I’m going to unpack what happened, how an attacker thinks about trusted access, identity, and what defenders can realistically detect when they’re under attack, and what this tells us about securing identities across a modern enterprise. OTW, welcome back.

Master OTW:
Thank you, Anders. It’s good to be back again and talking about cybersecurity in 2026.

Anders Askasen:
There’s a lot going on, and, it always seems to be boiling down to the same thing. Identity is at play, and there’s some kind of social engineering. But, let’s, let’s see. What what was your immediate reaction when you saw what was happening?

Master OTW:
My first reaction is this is 2026 and this type of attack is still successful against a major company. I mean, this type of attack has been going on for now decades and this company did not have sophisticated identity management tools that could have prevented it. And this is, you know, for the attacker, hackers, attackers, these are the types…

These are the easiest attacks to be able to execute. Right? It’s a social engineering attack. And by my estimate, probably 80% of all attacks have a social engineering element to it.

I mean, we all look at these cases where we have remote code execution from a vulnerability in a particular application. That’s that’s…

You know, that happens. But more often what’s happening is this type of social engineering attack where it’s simply getting somebody’s credentials within your organization. In this case, it looks like it was a privileged credentials.

And that then this attacker could traverse various applications and systems within the network of the of the company. That’s surprising to me. I mean, I know that it still happens, but what are these people thinking?

This is 2026. We’ve all been dealing with this for decades now. And this is the type of thing that, you know, it’s relatively, you know, with the proper equipment that could have been prevented.

Anders Askasen:
Yeah, for sure. But, I mean, I kind of respect the attackers that find vulnerabilities in code and exploit that. I have more respect for that than someone that is trying to trick a human being, but it seems like that’s more and more prevalent.

There’s a difference. If you steal an employee’s credentials, that’s probably more useful than finding a software vulnerability because all of sudden you have access. Right?

Master OTW
Right. And in reality, this is this is like 80% of the attacks or these types of social engineering attacks, Not necessarily attacks Steve, not necessarily attacks against credentials, but just any type of social engineering.

And in this case, you know, being able to get one set of credentials and be able to traverse various systems with the network, that’s kind of surprising.

Anders Askasen
In this case, a normal enterprise wouldn’t put the necessary controls in place, like you said. MFA, multifactor authentication, would that have helped in a case like this?

Master OTW
Well, might have. I mean, you can also phish MFA. I mean, it’s possible, but I don’t think I didn’t see anything in the reports that said there was MFA in place with this company. And maybe it’s something that is…

We’ve seen this type of attack take place against multiple retailers in Europe recently. So we have all of these retailers experiencing something similar.

So maybe that industry is simply behind and needs to update their credential management, right? Because we’ve seen multiple retailers, not just ASOS, but others as well. And so, you know, it’s the idea, what probably was most surprising to me is being able to use one set of credentials to traverse multiple systems within that network. That I think is uncommon, relatively uncommon, and probably one of the unique things. They were able to get into the network and then traverse to the Snowflake or, you know, whatever system they were using to send out their notifications. So, you know, that attacker was able to move to multiple systems. You know, in a modern 2026 companies have multiple systems all as part of their network, their, of their, their corporate infrastructure.

And the idea that you could move for the same identity to multiple elements in that infrastructure is really something that is one, surprising me, and two, it’s something that these companies need to manage better than what they did.

Anders Askasen
It kind of breaks the whole philosophy that was part of Zero Trust, where you segment up your systems and your networks to to avoid this type of of lateral movement. But one thing that that stood out to me was that they sent out a notification to all their customers. Do you think that was preceded by some kind of claim or ask from the company before they went down this route? Do you think ASOS was aware of this situation long before it hit the media?

Master OTW
That’s interesting. I hadn’t really thought about that. But the notification, wasn’t the notification sent out by the attacker?

Anders Askasen
Yes, it was.

Master OTW
The attacker sent it out.

Anders Askasen
The attacker sent it out.

Master OTW
Right. And so that for me was one of the things that was most surprising is that they could traverse, they could move laterally from, you know, the corporate network into whatever they were using to send out their SMS messages. And I don’t have any indication that the company knew ahead of time, but the fact that they could laterally move into that system and send out that message surprised me. We’re using one set of credentials on multiple platforms.

Anders Askasen
I I see… I guess there’s some kind of game going on as well between that attacker group and the company involved. They… There must have been some kind of communication before they they go down with something like this.

Master OTW
Why do you think that?

What what what led you to

Anders Askasen
What what what led you to

If I wanna pressure them for money, I wanna have that leverage. I wanna be able to communicate with the company and then providing them the necessary evidence that I’ve I’ve breached your systems. I have this data. I will, leak this information unless you, you know, pay some Bitcoins, whatever mechanisms that you you Right.

Master OTW
Guess I thought of the communication as the leverage. It’s kind of like a ransom note. It’s a way to pressure the company into paying whatever they ask. So you might be right in that there was some communication before then, they weren’t getting any positive response. And so they went ahead and then used the SMS messages to apply increasing leverage against the company.

Anders Askasen
Yeah. What happens after that is that it absolutely exploded in media.

And this was not an isolated thing to UK customers, for example. They have millions of customers in The UK, but it’s worldwide thing, so it had a massive impact.

But you mentioned different systems and moving between different systems.

In my world, there’s still a lot of these identity silos that exist throughout an enterprise. Having that under some kind of control seems to be one of those problems that often occur on the radar when we’re looking at these type of attacks. You gain access through social engineering to some kind of credential and then no one really has the full picture, which makes it easy to miss certain configurations, something falls between the chairs. Is that something that you would agree with?

Master OTW
Yeah, this is, you know, with the complexity that we now are in, in the world where we have so many different systems that are part of our infrastructure for a modern corporation, the idea that one set of credentials would allow an attacker to move to different parts of the infrastructure is surprising to me. And it seems that this is something that this firm needs to take seriously and other firms as well. You, people listening to this, if you have one set of credentials for all of your infrastructure, you know, you’re looking for trouble, you know, you’re gonna looking, you’re looking for trouble. This is going to happen some point in your future as well. This is, need more sophisticated tracking of how credentials are used and what’s being accessed and how a user is moving within the infrastructure. And of course, you know, something as simple as least privilege would have helped a lot in this kind… In this case here. Right?

Anders Askasen
I mean It it would have. Right? Right.

Master OTW
But but being able Being

Anders Askasen
But but being able Being

Or… Because, I mean, a lot of these companies, especially in the financial services sector, you have these regular reviews where you look at entitlements associated with accounts, you get an understanding of who has access to what, someone puts an approval stamp. But it’s, you know, monthly, quarterly, once every six months, once a year.

Is that enough for… Or do you actually need to have a better real time understanding of what goes on in your network?

Master OTW
I think, yeah. I think real time monitoring would have helped in this case. And in the era of AI, right? We now have AI tools that can do this. We don’t have to have somebody looking at a computer screen to be able to do real time monitoring and then throw an alert when there’s a set of credentials or user who’s trying to move, you know, rapidly between different sets of the architecture, places they shouldn’t be, you know, in, you know, with with that type of capability that we have now, I think that real time monitoring is something that we can do and should be doing.

Anders Askasen
I guess still a lot of companies are falling behind when it comes to investments.

Mentioned AI. What I’ve noticed over the past year is that a lot of companies have invested and experimented with AI, but not necessarily secured and being able to surface everything that’s out there that they’ve experimented with. And that brings us back also to accounts that are stale, agents that are stale and don’t have an owner.

Any follow-up questions or suggestions to CISOs looking at this? What can you do about that?

Master OTW
Well, there’s a lot of different things that I think we could do to keep this. One, we talked about least privilege, right? And obviously role based access. Those two, you know, are a place to start. Right?

And then to separate and then protect privileged accounts. I think that this would help a lot. In this case here, we had a privileged account that had access to multiple elements in the infrastructure. It would have helped if that privileged account was only useful in that initial intrusion and not allowing the attacker to get into other systems. So having that separation would have really helped.

You know, having real time monitoring of access is, it would have definitely prevented this type of an attack. If you’re watching, right, all of the… Especially the privileged users, you’re watching them in real time, you can detect this type of thing and then shut it down in real time before the the the damage becomes too great.

Anders Askasen
What are some of the signals that you’re looking for?

Master OTW
Well, what… You know, if if I was on that side of the game, I’d be looking I’d be looking for… Well, I’d be looking, first of all, for…

I’m kinda surprised, but so I would be looking for an access to a privileged account that came from a different system. I mean, this is, this is kind of standard in 2026. So if that privileged account always comes from this Windows 11 machine on my network, and suddenly it comes in from a phone or a Linux system, that’s in a different location. Well, that should trigger an alert, right?

That’s something that I would wanna know about. If they’re rapidly moving, okay, through my network, right? Into areas that they’re not normally involved in. I wanna know about that.

I wanna know about it real time, right? So those are the things that I would, you know, it seems like those are really simple things to implement. And I’m surprised that this company hasn’t done.

Anders Askasen
They must have a very damaging effect once you’re breached. And I guess at the point where where this notification went out to all their customers, it it was too late.

Someone didn’t invest in the right technology. Someone put… Didn’t put the necessary, you know, boundaries in place and mechanisms in place to protect against this.

Master OTW
Exactly. I mean, it’s it’s also… Let’s get it. For me, it’s a… It’s surprising that this attack was that successful. I mean, this is simply an indication of a company who isn’t taking identity management seriously.

Anders Askasen
I’m… Yeah. I I guess we’re not we’re not picking on ASOS here. I… I’m sure there’s multiple other companies, but they they just happen to be in the spotlight right now.

Master OTW
Obviously, there’s multiple companies. We’ve seen we’ve we’ve seen this attack take place so many times, and it’s very similar to the other attacks. So yes, I don’t wanna attack ACEs, but I think that’s also important to note that there are ways, the things that they could have done to prevent this attack. And now, you know, they’ll… I’m sure that they will go ahead and implement some some basic identity management. But, you know, the cost the cost is tremendous for this type of failure.

Anders Askasen
If if you put yourself in the shoes of these attack ers and and you’ve just penetrated the company and and you may or may not have access to Snowflake, you you probably gained some some account data, maybe not the passwords, maybe you got access to and I’m just making this up maybe they’re using Twilio for sending SMSs or notifications What or what have would be your next steps? What would you try to do? Would you implement some kind of backdoor? Would you try to gain more access? I mean, far have you actually reached and penetrating the systems before you decide now is the time to push out this notification and try to put some pressure?

Master OTW
I think that the first thing I would want…

I would do is one, I would probably put in a a new account. Right? That is mine, a privileged account. I would…

If I have a privileged account, I can create another privileged account. In most systems, I can’t. And then I would create a new privileged account. That…

If that doesn’t trigger an alert by somebody, then, you know, once again, it’s poor identity management. But what I would try to do is to create another privileged account so that I am no longer need that privileged account. And I could use that indefinitely even if they shut down the privileged account that I came in. Right?

They noticed that one and they shut it down in real time or after a month or two or whatever amount of time that they’ve been inside the system is to create another account that I can use. And hopefully they don’t notice or they don’t notice this creation of a new account that I can use. And then I can just come in anytime I want and create whatever havoc I want and steal whatever I want. So that’s…

Would be my approach.

Anders Askasen
It… I guess to me, obviously, being in the industry, those are the kind of things that I would immediately pick up. And you were a privileged account all of a sudden. Can you do any precautions to hide that?

Or

Master OTW
Or

I think only in one case did I ever get stopped, okay, by a system engineer, security engineer when I tried to do that. So apparently people are not watching that closely. But yeah, I mean, good systems, in good identity management systems, when there’s a new privileged account created alert, there’s a problem here, right? Stop this guy.

But in reality, I seen that to be the case. So that… That’s often the case is that I will go in and then I will create another account. And then that way, you know, they can do all they want with that other… The the original account. Right? They can… But if I’ve got this other one and they haven’t noticed that I’ve created it, then I’m good to go. I can do whatever I want, you know? And nobody’s paying close attention to it.

Anders Askasen
It seems like a lot of these enterprises are quite lazy when it comes to actually monitoring and having a security operations that are actually looking at this. I mean, they… After all, this is at the core of their business.

Master OTW
It is. It is. I don’t know if it’s lazy. It might be cheap. You know?

It might be what it’s…

They may…

They might just be not wanting to spend money on sophisticated identity management, but you know, it’s to do it on, to do it with human monitors is expensive, right? And so, especially if you’re trying to do it in real time. And so I think it’s more of a matter of not wanting to spend additional or sufficient money to manage identities. And then you end up with a case like this that’s going to cost them probably tens of millions of dollars or more for this one breach.

Right? And probably the most important cost is a reputational Right?

You’ve lost the trust of your customer. The customer is your lifeblood, and now you’ve lost their trust.

And we’ve seen this in other retailers around the world. I mean, there was a case, a few years back, maybe ten years now, where Target got hit in The United States, a big retailer.

And, you know, I think their stock dropped in a matter of a day. It dropped like $10,000,000,000 value, right?

And truth of the matter is they never fully recovered from that attack. They’re still not as valuable as they were then. And so we’re talking about a cost that is significantly high if you lose the trust of your customers. It’s not just remediation, it’s a matter that you may have permanently damaged your goodwill, reputation within the marketplace.

GMTV News
And funny that you mentioned that, that was actually one of the

Anders Askasen
And funny that you mentioned that, that was actually one of the

What happened on the stock market when this hit the news? And in fact, you can look up the ASOS stock price and you’ll see a pretty sharp decline of about 10 or 14% immediately following the 10:00 announcement.

So it did have a big impact. It then ultimately stabilized a little bit, but I think there’s still a lot of uncertainty and unclear information about the hack. I’m certain that there’s a lot of people that have in fact, I have people in my team that have been or are customers of ASOS. They’ve shopped with them. They appreciate their goods.

But now they’re not so certain. They don’t know if their passwords are out there. They don’t know if their credit card details are out there. Any guidance to these these individuals that have… Or are part of this breach? I mean, happens nonstop throughout the year, and I’m certain that my details are out there somewhere, but what’s the recommendation here?

Master OTW
Well, I’m going to follow-up on your comment about stock price. I’m looking at the stock right now, and it looks, the company has a value of about $500,000,000 and they lost about 10% of the value. So about $50,000,000 and the price has recovered a little bit, but still down some 10%. So that’s a $50,000,000 cost in reputation.

Right? And that reputation cost can go on for years and years and years. So you asked if I were one of the customers and I thought that my credentials were somewhere out there. You know, there are multiple services that you can go to to find out with, if your credentials are out there.

For instance, have I been pawned is one that’s very popular. And they keep track of credentials that are leaked onto the dark web and you can check to see if yours are. And I will probably give about an 80% probability that your credentials are out there somewhere. Everybody’s credentials are out there.

I mean, the amount of credentials that are in the dark web, think it’s like 4,000,000,000 at this point. Right? Now it might be your old credentials. It might be the credentials you were using a year ago or two years ago.

But you know, the important thing for the customer or the individual is that in a case like this or other cases is that you change your credentials. You change them because once the attacker has, you know, username and password, and if you’re using it on other systems, then, you know, it’s an easy…

Some of the easiest and most damaging attacks are simply using old credentials on a different system. So if I, if there’s an ASUS attack or another company’s attack and these username and passwords get released onto a dark web, What I will do, or what a malicious attacker would do, I’m not saying I have a malicious attacker, a malicious attacker would do. I’ve never done this. No, is to go and take those credentials and try them on other systems.

All right. And if I know something about you, I can probably decipher, you know, other systems that you have, whether that be a bank account or what have you, and try those same credentials there.

If they don’t work, I’ll bet you that I can still guess what, how oftentimes what people do is they simply change their credentials and they add a number after their password, right? So if it’s password, then they’ll put a one after it or very often, I mean, really.

Anders Askasen
But for a password cracker, that’s a fairly easy thing.

Master OTW
That’s a fairly easy thing to do. So what I would do is if I got your password, I’ll take that password and I’ll put numbers before and after your password and try those out. Alright? So…

Because that’s what, you know, this is what people do. You know, this is human behavior. That’s…

You know, this is…

People are, you know, they don’t wanna spend a lot of time memorizing the password, so it’ll make small changes to it. And so I can try variations of that password. And, you know, I always laugh when I see people with these numbers at the end of their password, that just happens to be their birth date.

And people do this all the time. Right? They put their birth date or their child’s birthday or the name of their dog after their passwords.

Anders Askasen
And I guess the problem for a lot of people is that they’ve, they’ve probably reused the same password for a number of sites.

Master OTW
Exactly. They use the same… So one… If one… You know, if you’re an ASUS customer right now, right, and we’re assuming that the credentials have been leaked, we don’t know this for sure, my guess is that they have. So every account that you have, you know, if you’re using those same credentials, they’re all at risk right now. You know, you need to do something before, something really bad happens.

Anders Askasen
What should people think about their credit cards? I mean, I know there are security frameworks in place if you’re going to be part of Visa, Mastercard, Amex, all these players.

You have PCI DSS version four, whatever it is, some and protection in place, but should people be careful and scared over their credit card numbers as well?

Master OTW
Well, certainly you should be concerned, but, you know, there’s, at least in the MasterCardVees world, that there’s a limited liability to you as a holder of those cards. So really the risk really runs to the credit card companies. That’s why they have put together things like PCI DSS, right? It’s because they’re protecting themselves because they have most of the liability, but it can be an incredible headache if your credit cards get compromised and somebody else is out there using it. It can damage your credit. It can take years to recover from that. So even though the financial liability might be limited, The life liability might be a lot of hours and years of trying to recover your credit or your accounts that have been taken over by somebody else.

Anders Askasen
We step back to the actual compromise at ASOS, we look at this employee’s identity that was used and compromised for whatever purposes that the attacker had. In your world, if you’re assuming the attacker here, what would be the worst thing that can happen just as you compromise an identity and you leverage that to lateral movement within the network or you’re trying to hack something else within the enterprise?

Master OTW
Well, the worst thing that would happen is somebody detects that and then basically shuts off that account. Right? We just…

That account gets blocked. It doesn’t have access to anything. That’s what, that would be the worst thing that could happen because then I’m totally stymied. I can’t do anything.

I’ve lost my entryway into your network. So a good identity management system would detect this behavior that’s suspicious and then disable that account right there. And, of course, if it’s if it’s not if it’s not malicious, then you apologize. You say, oh, I’m so sorry that we disabled your account, but you understand that, you know, we’re just being very careful.

So I think that, you know, that would be the legitimate and most reasonable way to handle this type of attack is just simply, I’m seeing what appears to be suspicious behavior on this account, and then boom. I just disable that account. And then you do your investigation after you’ve disabled the account. Because, you know, if you’re not doing it in real time, then the attacker can do a lot of damage in just a matter of a few minutes. So I I…

Anders Askasen
Go ahead. Is is disabling the primary account the… Is that enough?

I mean, you look at an enterprise, I’m sure they have some kind of third party IDP. They have systems that are using their own silos. And it’s really hard to have that full understanding of what goes on in the entire landscape.

Master OTW
Obviously that’s the case. Because in this case, they were using the same credentials in multiple silos, as you call them, or different elements of their infrastructure.

So it’s it’s important that all of these elements of the infrastructure have a unified identity management system.

Anders Askasen
That’s preaching to the choir here, because that’s exactly what we’re doing. We are, in fact, unifying different identity silos. Could be your directories, it could be your databases with users, know, Entra, Okta, what have you, all into one unified view, where you actually can perform this type of observations. I’m happy that you say that, and this was not staged, by the way, so I appreciate it.

Master OTW
Well, is just common sense, I think, Right? I mean, it’s common sense that you have to have some kind of unified identity management in 2026 to be able… Because, you know, in the old days, we had, like, one network, you know, that we could just protect. But now we’re talking about multiple networks that communicate and work together. And we have to have some type of unified, you must have some type of unified identity management or else you’re gonna, you’re leaving yourself open to this type of attack.

Anders Askasen
The ground truth of identity, that’s important for you to be able to protect. You were touching briefly on AI and the speed that these type of attacks can occur.

How do you see that that’s impacting? Could that have been the case here, or is still emerging as a technology among adversaries?

Master OTW
Well, it’s emerging both for offensive and defensive purposes. You know, we’ve all heard, you know, all of the stories of, you know, the AI going rogue and and hacking systems. But what I’m talking about here is a defensive posture, right? Where the AI can assess very quickly what is going on with multiple users.

So, I mean, in this case, when they saw a privileged account, okay, moving laterally within the network that should have thrown, and AI can do this pretty well, should have thrown an alert and said, Hey, this is something that we need. If there’s a security engineer, it should be an alert to that person. Hey, pay attention. This looks very suspicious.

It’s coming in from a location. It’s coming in from a different system.

And they’re moving rapidly between these different elements in your infrastructure. That’s pretty simple for an AI to do. It’s also relatively simple for a human being to do, if they’re paying attention. And what I have found is that very often, there are security engineers and they’re overwhelmed. They’re overwhelmed with so much information that they can’t make good decisions. There’s just too much information. This is where I think AI is perfectly suited for this type of analysis.

Anders Askasen
So if we look at the use of AI on the attacker’s side, there must be an advantage of doing these type of attacks much faster, much quicker.

Master OTW
Definitely. Definitely. There’s, you know, I think we’re going to see an era where systems are going to get broken, you know, in much more rapidly than we have seen in the past because the AI is…

It has this capability of basically cataloging all of the approaches to break a system and then trying each one of them out until one of them works or stringing them together. So sometimes the most difficult attacks are where you have a chained attack, where you have a vulnerability here and then here and then here, and you chain those attacks. The AI, that’s easy for the AI to do. For the human, it takes a lot of experience and knowledge.

For the AI, it’s pretty relatively simple attack. And I think that’s what we’re seeing. I think that’s what we’re seeing in these rogue attacks too, is that these are relatively obscure vulnerabilities that the AI can, catalog and attempt in very rapid succession until they find one that is, is gonna work.

Anders Askasen
I guess in the past that has been mostly nation states that are able to do these type of chain, very sophisticated multiple zero day vulnerabilities type of attacks. They’re quite expensive, as well, if I understand it correctly, and requires a lot of research and a lot of effort to make something like that working. With these new frontier models, you’re essentially saying that that’s something that we’re going to see more and more of.

Master OTW
Yeah, I think with the frontier models, don’t even need the frontier models. There’s thousands of models out there and the frontier models have some guardrails on them. Right? And that’s at least what they’re telling us.

I mean, they do. They do. I’m not gonna disparage that. But there’s 15,000 models on Hugging Face.

15,000 models. Most of them have no guardrails. So, yes, we’re going to see more and more of these type of attacks coming from, you know, from an individual, a lone wolf, because as you said, if you give me a team of say, you know, just like give me a team of like six hackers together, we can break into just about anything, right? Cause if you have the resources and the experience, but now, okay, you’re going to have one individual with their AI agents working against your systems.

And I think we’re on the verge of a, a, at least a temporary, era of reduced cybersecurity. We’re gonna see more and more attacks that are successful. And it might just be a short period of time, maybe six months or two years, something like that, but that window could create a lot of havoc within our industry, within the industry of cybersecurity.

And so I think the people need to be prepared for this era. It may not last very long. Let’s hope it doesn’t last very long, but we’re here. We’re here now and it’s going to happen. It’s going to happen very, very rapidly. And I think that firms need to be prepared for this new era of hacking and minimize or minimal cybersecurity.

Anders Askasen
I guess going back to what we previously discussed around having different password for different systems, and if you are an end user, have different passwords for one service versus another service, and using MFA whenever that is available, is to your advantage.

Circling in again on the AI agent, so to speak, a lot of companies are experimenting with AI. There are agents running all over the place. How do you spot a legitimate agent from what’s not, that is potentially using unauthorized access, that are exploiting API keys to APIs that they have access to, but they shouldn’t use in that manner.

Master OTW
Well, what you’re asking me is how would one go about detecting an agent versus a human? Is that what you’re asking?

Anders Askasen
No, I’m asking there’s legitimate AI agents that are doing legitimate stuff within an enterprise. Then you I have those that are having the same access, but they’re doing not so legitimate stuff.

Master OTW
I would think that the first step for any organization is identity management again. You need to be able to distinguish between a a legitimate AI agent and an illegitimate one. That’s going to be really difficult to do. But really what it comes down to really is simply, it’s identity management again. It’s how do I make a distinction between a legitimate agent and an illegitimate agent?

And there’s lots of elements that we can add into trying to make that distinction, but ultimately it’s all identity management.

Anders Askasen
It seems like it is really the foundation of everything that security builds on, and it’s becoming more and more important in the age of AI, where there’s agents that can, within seconds, exploit something and they can chain up different vulnerabilities and attack.

If we’re looking forward a little bit at CSOs and their role in the future, now in the current landscape, what would you say to them? How could you argue the case to your CEO or whoever is in charge of your budget to actually go and invest in these tools and to you know, potentially rip out some of the old legacy solutions that have been put in place over years to modernize and put something in place that can actually defend you?

Master OTW
Well, I think that it’s it’s always been a challenge, you know, in in… Well, we’re we’re talking about an industry that’s, like, 30 years old, right, max. Right? And really has probably ten or fifteen years has really grown to the scale that it is cybersecurity.

And it’s always been a challenge to be able to get companies to take seriously the security of their systems. And I think that in this era now we’re talking about a new era. We’re not talking about twenty years ago or ten years ago. And now with the availability, wide availability of AI and AI agents that your company, okay, is at the highest risk probably it’s ever been in your history.

And the idea that, you know, you could, it could end up costing you tens or maybe even hundreds of millions of U. Dollars for a breach. It could actually put you out of business. I mean, there are companies who actually, after a breach, no longer are viable because their reputation has been so damaged.

And so I think that more than in the past, companies have to really look seriously if they’re going to continue in this new era that we are in the era of AI, which is not going to go away. It’s here forever. It’s always going to be here. And it creates an additional risk for every company that you need to be able to think differently about this era than past eras. And you have to be able to make good decisions about what is going to protect your reputation and your identities of both your employees and of your customers.

And so this is not business as usual. This is, Hey, wake up, we’re in the era of AI and your company is at risk. Your entire company is at risk, and you need to address this now because tomorrow might be too late.

Anders Askasen
Yeah. Absolutely. I think that’s good advice.

OTW, I know you’re representing Hackers Arise. You’re doing training and a lot of awareness and hands on training for adversaries, protectors…

Anyone that really wants to learn how this actually works in practice. And I know currently you’re running a competition.

Maybe you can just briefly mention that and what that is all about.

Master OTW
Right. We call it the Wittgenstein competition. And what we’re doing is that we’re offering a prize, a cash prize for the best AI agents. So, and we’re mostly focusing on the defensive side, right?

To be able to provide companies with a tool that they can use to protect their assets. So we’re running this, we close the competition at the end of this month. I want to thank you for volunteering to be a judge in that contest. We think that when the contest is done, we’re expecting when we’re done, that we will have the best defensive AI agents in the world.

So look for that. We’ll probably have that probably come early twenty twenty seven.

So we’re doing a two stage competition. This is the first stage. And then the second stage will complete in early twenty twenty seven. And at that point in time, we expect to have the best AI defensive AI agents to protect you and your company’s assets.

Anders Askasen
I’m super excited to be part of this OTW. I’m looking forward to see what all these clever ideas are going to result in.

But Let’s wrap up. The ASOS incident began, at least according to the company’s account, with a person being deceived, again social engineering being involved, and a trusted identity being compromised.

And I guess the larger lesson is about what that identity could reach. We talked about how you can move laterally and how you should actually protect yourself by putting boundaries in place, separating networks, separating passwords between one system and another.

Master OTW
Unified identity, man.

Anders Askasen
The unified identity, exactly. And how quickly abnormal use could be recognized. I mean, we’re looking at monitoring this in real time. That’s where their real differentiator becomes important. How you can decisively assess what identities are using and contain that when something is just anomalous.

How organizations connect more applications and services. We talked about AI agents and how they impact security, both from an offensive and defensive point of view.

Again, those questions become more and more important.

With that, OTW, I want to thank you for joining us here, and I want to thank the audience for tuning in.

Master OTW
Thank you for asking me to do this. It’s an important subject, and I’m glad we got a chance to exchange some ideas on this.

Anders Askasen
Appreciate that, OTW. Thank you.

Master OTW
Thanks, Anders.