Interview with Rob Sadowski from Cohesity
Global Cyber Resilience Report: Cyber Recovery Plans Weren't Designed for this Moment
Cyber recovery plans weren't designed for this moment. Most were built around assumptions that made sense when they were written: incidents could be understood, dependencies mapped, recovery could follow a predictable sequence, and decision-makers would have enough information to act.
In practice, major cyber incidents unravel those assumptions. AI and autonomous agents are creating new paths to compromise, while cloud and SaaS expansion increases the systems, services, and dependencies involved in recovery. Vulnerabilities are discovered and weaponized faster than ever, and AI is accelerating that cycle. As incidents unfold, scope expands, dependencies appear only when they break, and recovery plans no longer match reality.
With assumptions under greater strain, confidence is beginning to erode. This year, the percentage of survey respondents reporting complete confidence in their cyber resilience strategy fell.
To understand how recovery unfolds today, Cohesity commissioned Vanson Bourne to survey 3,200 IT and security decision-makers at organizations with 1,000 or more employees across 11 countries.
This report examines where recovery becomes more difficult than expected, the obstacles organizations encounter, how they define and test a Minimum Viable Company (MVC), and how AI is reshaping cyber threats and cyber resilience.
https://www.cohesity.com/dm/global-cyber-resilience-report/
This segment is sponsored by Cohesity. Visit https://securityweekly.com/cohesity to learn more about them!
Topic: When should we use AI for writing and when should we avoid it?
I've had an essay in draft form for a month now, trying to get my feelings across on why AI writing drives me so crazy. I struggled to put it into words.
Fortunately, Charity Majors figured out how to put it into words and I think she nailed not just how I feel about AI, but the reasons why I feel so strongly about it. She uses a scale to help explain this, with "personal" at one end and "functional" at the other.
https://charity.wtf/p/confessions-of-an-unrepentant-slop
When I ask AI to create a company profile for me, 10 minutes before I meet with them, I don't need poetry - just facts. But when I read something that is supposedly someone's opinions and analysis on a topic, and it's clearly 100% AI-generated, I angrily dismiss it.
I love that this writeup isn't just an "I hate slop" rant - it actually quantifies why a personal touch matters and how to gauge when it is necessary and when outsourcing the task to AI is totally fine.
In both cases, Charity notes that quality matters. My most recent complaints come from cases where things are not only clearly written by AI, but where quality went out the window and they're unrecognizable as a human-readable language.
And yes, I brought an example: https://dispatch.cybersecurityhq.com/p/escalation-voided-on-construct-failure-timing-condition-placed-under-review
Weekly Enterprise News
Finally, in the enterprise security news,
- We check the vibes, funding, and acquisitions
- Tenable now has Mythos built-in???
- We check in on how vulnerability remediation is going
- Microsoft is creating a code of conduct for AI
- OpenAI just got called to the principal's office
- Booz Allen created new cybersecurity AI benchmarks
- 50% of CISOs see Mythos as a sign to resign???
- Ayman read the latest Anthropic AI misuse report
- MIT explains the 12 possible AI outcomes (very ominous)
- a 9-year old decided to promote his YouTube account… with his dad's corporate card
All that and more, on this episode of Enterprise Security Weekly.
Show Notes: https://securityweekly.com/esw-477
