At IST, we are focused on a core mission: uniting technology & policy leaders to create actionable solutions to emerging security challenges. In this month’s newsletter, IST leaders Philip Reiner, Megan Stifel, and Steve Kelly took some time to reflect on our mission statement in light of their time at major global gatherings of the world’s most prominent technology and policy leaders. What did they hear — and what seems to be missing in conversations on national and global stages? Most importantly, how can IST play a role in identifying, addressing, or even solving these emerging security challenges?
Philip attended the WEF’s Annual Meeting in Davos, focusing on cybercrime, systemic defense, and trust and safety, and the Paris AI Action Summit, focusing on the opportunities and threats of AI.
Megan traveled to Munich for the Munich Cyber Security Conference, joining global leaders to discuss cybersecurity and national security in the public and private sector.
Steve visited Geneva for the World Economic Forum’s Annual Meeting on Cybersecurity 2024 focused on “advancing equity in cyberspace.”
As you engage in conversations on the world stage, what stands out to you as missing? What emerging security challenges do you think are not being addressed to the fullest extent possible?
Megan Stifel: “Frustratingly, many of the topics discussed at the Munich Cyber Security Conference were not new: information sharing, public-private partnerships, operational collaboration, ransomware, critical infrastructure protection, resilience, regulatory harmonization, and the role of artificial intelligence in the cyber offense-defense balance. One presenter even highlighted that with respect to cybersecurity in recent years, little progress has been made, going so far as to challenge participants to consider whether we are satisfied with the status quo. This plain speak pervaded the conversations in Munich, albeit at times remaining quite abstract. At other times it led to frank observations about how much room for opportunity there is to close the gaps our adversaries exploit, especially between public and private sectors.”
Steve Kelly: “It is remarkable to me that in 2025, decades after I first became an FBI special agent, cybercrime seems worse than ever before. Scams targeting the elderly, heists of businesses’ bank deposits, and ransomware disruptions are taxing the global economy at a terrific rate, and despite best efforts by law enforcement officials and the cybersecurity industry, it seems like we’re taking one step forward and two back. These challenges were front and center at the World Economic Forum’s Annual Meeting on Cybersecurity in Geneva.”
Philip Reiner: “For my part, while in Paris at the AI Action Summit, I heard much debate around the approach to AI’s development and deployment. I found much of that debate characterized by what I see as a false dichotomy that is burning up valuable energy and scarce resources: one side contends that there is existential risk that needs to be contained; another argues that the opportunities are too incredible to forsake. I didn’t hear enough consensus on the key fundamentals I believe all sides agree on. For example, opening up access to AI tools will democratize their use, empower communities, and enrich lives: we are in agreement on that! At the same time, it’s not too much to ask that we don’t flood the world with AI tools rife with security flaws or deployed with no concern for near and long-term human safety. Both of these things can and should be pursued with the same level of effort – and at the same time! We’re smarter than the debate that seems to have taken hold.”
What role do you see IST playing in addressing these gaps or creating solutions to these challenges?
Philip: “As I see it, IST’s mission works on two levels. We act as a unifying force, guiding collaborative action to advance national security and global stability and overcoming otherwise intractable divides. We also act as a problem solver, making sense from the noise and delivering concrete recommendations and solutions. In the case of AI’s impact on global security and stability, we are involved in both the unifying and tangible, action oriented problem solving.”
Megan: “Put differently, the ‘room for opportunity’ mentioned frequently in Munich really means room for improvement. We definitely see that need in our work here at IST, whether it be in combating ransomware, developing and deploying artificial intelligence, or enabling critical infrastructure resilience. And it’s also where innovation can tip the balance, for better or worse.”
What’s an example of a subject area with room for opportunity or improvement?
Megan: “In Munich, several panelists discussed successful, novel approaches to public-private collaboration that deploy cybersecurity at scale to protect users and support public functions, and the central role that trust played in these initiatives. Unfortunately, much like law enforcement disruptions of ransomware and other malicious actors, these successes are still too few and far between. Hopefully through more open dialogue about these collaborations by public and private partners, these success stories will spur others to act sooner, and for the better. There seems to be general agreement that building trust takes time, and is best forged through partnerships. So, as we innovate, we must also maintain and build trust among each other and in the use of these new technologies.
This theme of trust, openness, and transparency was particularly prevalent in a panel on the intelligence view. There, one of the panelists urged intelligence agencies to move from the ‘need to know’ mindset to the ‘need to share’ mindset. He observed that, given the rise of AI and generative AI, building public trust in the work of intelligence agencies is essential, because these developments will likely eventually contribute to events that threaten the credibility of the work of intelligence agencies (such as deep fakes). This notion of openness from government entities ties back to another participant’s observation that industry needs to be a better witness for law enforcement. But, in order for industry to do so, law enforcement and other government entities need to share enough information to enable industry to know what to share with governments and where to consider directing their efforts. This information and prioritization gap has come up many times in our work on cyber threats, but the solutions remain elusive, at least publicly.”
Steve: “In particular, I think there is room for collaboration on the development and deployment of AI agents. We must build in security from the outset. There is much talk of 2025 as the “year of AI agents” (at least so far). In my view, there is a lot we still don’t know about emerging AI capabilities, and how to secure them. We collectively need to understand what security challenges agents solve, and what new ones they create. What happens in complex systems when agents are known to be able to obfuscate their behavior? How do we control for agents that may collaborate or that may operate at odds with one another? Could AI agents pose an insider threat? These questions are all quite raw, and require collaborative efforts across a range of different groups of actors in this space – that’s where IST makes a huge difference.”
Of course, many of these emerging security challenges are not new. What is IST already doing?
Philip: “IST is intensely focused on this nexus between emerging technologies and security, especially when it comes to AI. Since 2017, IST and its predecessor Technology for Global Security have been investigating the effects of AI on strategic stability and decision-making, and its implications for nuclear command, control, and communication systems (NC3). We continue to engage in this work; this year, we launched an effort to explore how advanced AI capabilities will be integrated into NC3 systems through research, workshops, and wargaming. We investigate the risks and opportunities of AI foundation models through our AI Risk Reduction Initiative, developing technical and policy-oriented strategies to address potential risks and system failures. And through our Generative Identity Initiative, we are examining the effects of generative AI on cognition, society, and the future. We are currently moving to launch numerous additional AI-related initiatives with very tangible impact as the goal.”
Megan: “One of IST’s greatest strengths is bridge-building. Observing a challenge, identifying key stakeholders, and understanding their disparate points of view are central to this success. Advancing public-private partnerships, sometimes referred to as operational collaboration or joint sequenced operations, is a bridge-building focus for us. In the Ransomware Task Force 2021 report, we called for a sustained, coordinated campaign to combat ransomware. To help drive this campaign, we identified the need for an entity outside the government to facilitate industry engagement and work with a dedicated interagency effort to combat ransomware. The internal government effort, called the Joint Ransomware Task Force, now exists in law, established in 2022 by Section 106 of the Cyber Incident Reporting for Critical Infrastructure Act. To date, however, no external effort, envisioned by the RTF as the Ransomware Threat Focus Hub (RTFH), exists. Instead, efforts to best leverage private sector insights remain siloed to select field offices and case agents. With this unmet need in mind, I noticed in Munich many panels identifying opportunities that resemble the goals and attributes of the RTFH and IST’s broader engagements to combat ransomware and other cyber threats.”
Steve: “In the realm of cybercrime, IST last year partnered with the World Economic Forum’s Centre for Cybersecurity on a project to confront phishing and frauds at the ecosystem level. What does this mean? We are seeking ways to make the internet and enabling services—like the domain name system—less hospitable to bad actors and their crimes. While in Geneva, I presented our initial findings, which led to a fruitful discussion on the many opportunities and challenges. These conversations so often tack toward familiar themes like incentives, voluntary vs. mandatory approaches, challenges of bringing global solutions when levers are often at the state level, and the supreme conundrum of safe haven jurisdictions.”
What’s next?
Steve: “We will never fully succeed in stopping cybercrime by making potential victims more secure or by hitting back at the bad actors; we need to also pull the rug out from under them at the ecosystem level. How? It is time to box out the bad actors from acquiring the infrastructure services they need at scale and speed, like domain names, web hosting, and the like. In my view, the levers of change are stronger governance of domain registrars and registries, harnessing movements in the identity space, and better generating and leveraging trust and risk signals—including reputation—across ecosystem players to keep customers safe and secure.”
Megan: “In 2025, we will redouble efforts to strengthen organizational preparedness and resilience to manage cyber threats such as ransomware and nation state-backed campaigns, including by examining incentives like insurance and the availability of discounted services for the target rich, resource poor.
At the same time, we will also work to better optimize the information ecosystem to best leverage stakeholders’ insights, capabilities, and authorities toward more sustained impact through strategic disruptions that respect victims and the rule of law. In doing so we recognize the essential role of international partnerships and capacity, which we will continue to advance, including through our work as a member of the Counter Ransomware Initiative’s Public Sector Advisory Panel.”
Philip: “The energy I felt around these issues was palpable while in Paris. It’s clear that members of industry, civil society, and governments worldwide are dedicating time and effort to thinking about these challenges. IST can help them to come together to develop concrete tools, policies, or risk reduction mechanisms that can be instilled from the outset. In order to do so, they need to talk to one another, understand their relative perspectives, and share knowledge and experience – this is where IST, as a non-partisan, non-profit critical action think tank, has an instrumental role to play. IST can shift the conversation from debate and rancor to cooperation and collaboration. We need to understand how to advance and lead in AI, but safely and securely. Quite literally the future of humanity depends on it.”