Patrick Austin hosts Claire Nunez and MJ Vaidya on IBM Technology’s Security Intelligence, episode 56. A 29-minute discussion of patching and AI-era security operations.

A firmware update still has to reach the device

  • The panel describes attacks on French supermarket refrigeration controllers that continued running vulnerable firmware after fixes became available.
  • Operational technology controls physical equipment; interrupted cooling can destroy stock and create safety hazards.
  • Manufacturers need secure design, supply-chain testing and workable update mechanisms; operators need planned maintenance windows.
  • Cyber-insurance coverage depends on policy wording, responsibilities and the customer’s maintenance practices.

Treat agents as identities with real access

  • The episode cites a Semperis survey of 1,200 IT professionals, linking AI assistance to 84% of ransomware attacks in its reported findings.
  • The panel also cites repeat attacks, ransom payments and abuse of organizations’ own agents and identity systems.
  • Vaidya argues that internally deployed agents belong in the insider-threat model because their permissions can enable harmful actions.
  • Controls include behavior monitoring, shutdown paths, incident triggers and continuing tests of the environment where agents run.
  • Third-party agents seeking access deserve the same scrutiny as agents deployed internally.

Faster discovery can expose a staffing bottleneck

  • The panel discusses Bank of America reportedly adding 1,000 contractors alongside roughly 3,000 security personnel after AI-assisted vulnerability discovery.
  • Nunez favors humans and models working together: findings still need business context, prioritization and safe fixes.
  • Temporary remediation staff require scoped access, reviews, monitoring and prompt offboarding.
  • Patching becomes a recurring operational process as discovery improves, with resilience plans for essential business functions.

Caveat: the survey figures and bank staffing numbers are reported by the podcast. The discussion provides no independent validation or survey methodology sufficient to treat 84% as a global measured attack rate.

“It’s not a point in time activity.” — MJ Vaidya