Threat Response Needs New Thinking. Don't Ignore This Key Resource.
summary
Argues for native cross‑domain telemetry (email, web, endpoint, network) and XDR that links an email link → PowerShell → lateral network movement chain so defenders can snapshot machines, turn on packet capture, isolate segments and block exfiltration. Cites a Turla-style sequence and Cisco data that 80% of ransomware starts with phishing, shows unknown processes spawned by PowerShell, predicts automated recovery to an RPO of zero, and demos an AI assistant (AMES) giving 90% confidence incident summaries and playbook actions.
AI-written summary · about
chapters (7)
- 0:00Introduction and music analogy
- 2:34Problem with disjointed security defenses
- 5:10Cross-domain telemetry breakthrough
- 7:49XDR explained by Tom Gillis
- 15:44AI's role in cybersecurity
- 19:34AI security assistant demo
- 23:10Summary of breakthroughs
related talks
42mStart Covering Your Bases And Stop Chasing APT Headlines
52mStart covering your bases & Stop chasing APT headlines
27m“Why are they asking me to do this?” or Adventures in IR Land
38mAdversary Detection Pipelines: Finally Making Your Threat Intel Useful
40mFighting Where They Aren't: How Attackers Avoid Endpoints in Modern Attacks
27mThe Offensive Approach to Cybersecurity
37mRansomware Resilience: Holistic Defense for SOC Leaders
40mHow to Build a Long-term XDR Architecture Strategy