Senior Director, Information Security at Gen

Explore Gen™ leadership perspectives and hear from industry experts talking about trending topics, the digital landscape, and the latest cybersecurity news.

Leadership Perspectives

October 2026 brought an unusually concentrated run of cybersecurity incidents and vulnerability disclosures, prompting some in the security community to call it “Black October.” Critical flaws in widely used software, a compromised AI software release and compromised digital certificate keys put pressure on organizations to understand what they rely on and how quickly they can respond.&nbsp;For companies like Gen, the lesson is practical: security depends on more than protecting systems we build ourselves. It also means knowing what software and services we use, checking whether new vulnerabilities affect us, and coordinating a response across teams. As AI changes how quickly weaknesses can be found and exploited, preparation matters even more.&nbsp;&nbsp;<h4>What happened during Black October&nbsp;</h4>Several serious security issues emerged within a short period of time. They affected different parts of the technology ecosystem, but each underscored how much organizations depend on software and services maintained by others.&nbsp;Among the incidents:&nbsp;<ul type="disc"><li data-list-item-id="e4bf176a87bbdb2ea0991125ad4aac283">PHP vulnerabilities were discovered: Critical flaws could allow an unauthenticated attacker to run code on a vulnerable server.&nbsp;</li><li data-list-item-id="e2c2c7f6e95ef165caba0dfcf91fd3d86">LiteLLM suffered supply-chain compromise: A malicious release exposed affected users to credential-stealing malware, including risks to credentials used for AI services.&nbsp;</li><li data-list-item-id="e7100c2bca89373f297a7c0e7362218c0">Certificate authority keys were compromised: The discovery that private keys of eight intermediate digital certificates had been generated with almost no entropy, and were therefore compromised, prompted browser makers to take protective action.&nbsp;</li><li data-list-item-id="e45d022669f5d258753d783592fdc14ac">Brotli and Node.js released security updates: Fixes addressed a serious flaw in a widely used compression library and software that includes it.&nbsp;</li></ul>The issues were different, but they shared an important feature: the risk could extend beyond the organization that originally developed the affected software.&nbsp;<h4>Why connected software raises the stakes&nbsp;</h4>Modern businesses rely on a web of technology: operating systems, open-source packages, cloud platforms, developer tools, certificates and third-party providers. These connections help organizations work at scale, but they also mean a flaw in one component may affect many systems and users.&nbsp;A company may have strong protections around its own products and still need to ask:&nbsp;<ul type="disc"><li data-list-item-id="e955fb2f7ab40819e2140d41a13ee056a">Do we use the affected software or service?&nbsp;</li><li data-list-item-id="e078960f8747a200c27106fb00a9f145c">Is it present in a system that could be reached by an attacker?&nbsp;</li><li data-list-item-id="e8af30b7937ae9cb0e254aaef18e42992">Is there evidence of exploitation?&nbsp;</li><li data-list-item-id="e88c3c14a4499844083ba52cedb78f0d1">Could credentials, customer information or business operations be affected?&nbsp;</li><li data-list-item-id="e7aacad58e4761d5ce27985430c0c2d46">What can we patch, isolate or monitor while we investigate?&nbsp;</li></ul>These questions are the start of a disciplined response. They help teams replace assumptions with a clearer view of exposure and prioritize action.&nbsp;<h4>A serious response is urgent and precise&nbsp;</h4>When multiple disclosures arrive close together, security teams must move quickly without treating every alert as equally urgent. The right response depends on what is affected, how exposed it is and what evidence is available.&nbsp;In a large organization, updates also need to be coordinated. A change that protects one system could disrupt a service if it is applied without understanding dependencies. That does not mean waiting for perfect information. It means investigating quickly, involving the teams responsible for each system and taking the safest effective steps.&nbsp;<h4>How AI changes the security picture&nbsp;</h4>AI adds another dimension to vulnerability research and incident response. In the PHP research, security researchers used AI tools to help identify vulnerabilities, according to reporting in Vanity Fair. That shows how AI can support defenders by helping them examine code and process large amounts of information.&nbsp;The same broad capabilities may also make some tasks easier for people with harmful intent. That is a reason to take preparation seriously, not to assume every incident is AI-driven or that damaging attacks are inevitable.&nbsp;For security teams, the practical question is how to use AI responsibly: with strong controls, clear accountability and people who understand the systems being protected. AI can help teams work faster, but it doesn’t replace sound security practices or informed judgment.&nbsp;<h4>What companies can do to be more prepared</h4>Black October reinforced several fundamentals that matter throughout the year:&nbsp;<ul type="disc"><li data-list-item-id="eb832f3875d8435d2d5f33566d5fc5e77">Know your technology environment. Keep an accurate view of software, suppliers and dependencies.&nbsp;</li><li data-list-item-id="e6145b12b97685f06e5e2c88eb1001577">Prioritize exposed systems. Assess whether a vulnerability affects a reachable, business-critical system.&nbsp;</li><li data-list-item-id="ed3e475c6986f669340fe10b5547147f8">Patch and contain with care. Move quickly, coordinate changes and isolate systems when needed.&nbsp;</li><li data-list-item-id="e59466d75a97fd3b1cf5407c33260d892">Protect credentials. Limit access, monitor for unusual activity and have a plan to rotate exposed secrets.&nbsp;</li><li data-list-item-id="e6d728a7e2716aa4a6c4a13291b67b4e8">Practice incident response. Make sure teams know how to investigate, communicate and act.&nbsp;</li><li data-list-item-id="e912fbe1ff9fb8dc1b62d6a43a7926bcb">Build security into AI decisions. Consider access, data handling and oversight before new tools become embedded in workflows.&nbsp;</li></ul><h4>Why security is year-round work&nbsp;</h4>At Gen, our information security team monitors vulnerabilities and assesses what they could mean for our environment. During a month like October, that work becomes more visible: track the disclosure, check for exposure, coordinate with the teams involved, take action and keep watching for new information.&nbsp;The goal is not to promise that nothing will ever happen. It is to make the organization harder to surprise and better prepared to respond.&nbsp;Black October felt unsettling because so many parts of digital infrastructure came into view at once. Its lasting lesson is that security isn’t one product, one patch or one team working alone. It is a habit of attention, practiced across the company and strengthened every time we learn something new.&nbsp;The calendar may say October. The work continues all year.&nbsp;

Black October’s cybersecurity lessons for new vulnerabilities and AI-driven risks. 

Black October Cybersecurity Lessons for Every Business 

Director of Threat Research & Applied AI

AI agents and assistants are here, and the industry is moving quickly to make them safer and protect against emerging threats. But without independent testing, how do we know those protections actually work? Gen initiated a collaboration with <a href="https://www.amtso.org/wp-content/uploads/2026/09/AMTSO_Guidelines_for_Testing_of_Agentic_Security_Products_FINAL_V1.0.pdf">AMTSO</a> to bring the industry together around independent testing standards for AI agent protection, resulting in the first industry standard for measuring the <a href="https://www.amtso.org/news/amtso-agentic-ai-guidelines-and-sandbox-llm-handling-paper-preprints-for-public-review/">safety of AI agents</a> and the products designed to protect them.<h2>Safety you cannot verify is just a promise.</h2>Early in 2026, our team started building protection for AI agents. It did not take long to notice something odd about the space we had walked into. Everyone agreed that the security of these systems mattered, but nobody could tell you how much of it there actually was.&nbsp;It reminded me of the old joke about connected devices: what does the S in IoT stand for? Security. There isn't one. To be fair, the joke no longer lands the same way for AI agents. Model vendors are shipping real safety work now, and some of them are good. But two other curves are climbing at the same time: attacks aimed at these systems, and damage caused by these systems. So, the problem is no longer that nobody is working on agent safety. The problem is that there has been no way to check any of it from outside. Every claim about how safe an AI agent comes from the same place the agent does.&nbsp;This September, that changed. The industry adopted its first guidelines for independently measuring the safety of AI agents and the products that protect them. This is the story of why it was needed and what it measures.<h2 class="text-align-justify">"Security is built in." We have heard that one before.&nbsp;</h2>Operating systems, browsers, mobile app stores, social networks. Each one reached a point where it told users that security was handled, built in, part of the platform. Each time, independent measurement found the gap between the claim and the experience, and each time that gap was where the harm to real people lived. We publish our own evidence on this twice a year. Our <a href="https://www.gendigital.com/blog/insights/reports/threat-report-h1-2026">H1 2026 Threat Report</a> and the&nbsp;<a href="https://fpi.gendigital.com/">Fearless Planet Index</a> exist because the honest answer to "is this platform safe" has always been a number, not a statement, and the number has always been more complicated than the statement.&nbsp;AI platforms are now at exactly that point in the cycle, and this time the claim is arriving faster than in any previous era. To their credit, some vendors publish their own figures. Anthropic did, for the safety layer in <a href="https://www.anthropic.com/engineering/claude-code-auto-mode">Claude Code</a>: it missed roughly one dangerous action in six. They called it “the honest number,” and it was. It was also measured on fifty-two examples, by the same people who built the thing being measured. That is not a criticism of them. Until now, the industry offered them no other option. The <a href="https://x.com/ClaudeDevs/status/2085794862608318627">mode</a> that number described was a preview in spring. By late summer it was the default.<h2 class="text-align-justify">Measure the platform first&nbsp;</h2>The first thing to measure is not a security product. It is the platform itself. An AI agent has a safety baseline of its own: what it refuses, what it questions, what it does without asking. That baseline is the floor everyone else builds on, and it has never been measured by anyone outside the company that ships it. The second thing to measure is whatever raises that floor. In that order because you cannot judge the second without knowing the first.&nbsp;Picture an agent booking a hotel for you.&nbsp;The hotel page contains hidden instructions telling the agent to ignore your request and follow someone else’s. You cannot see them, but the agent can.&nbsp;Whether your agent follows them is the whole question, and until now nobody has measured the answer.&nbsp;Existing test methods cannot simply be reused here. Classic threat detection is deterministic. There is a file, there is a verdict, and anyone can reproduce it. An attack on an AI agent is not a file. It exists only in the interaction, and the same attack tried twice can produce two different outcomes. A method built for files has nothing to grip.&nbsp;Getting to a workable methodology also meant settling questions the industry had never had to answer together. Harm counts even when there is no attacker: an agent that deletes the wrong thing or sends personal data to the wrong place because it misread the task, has harmed the user just the same. Consumer systems count as much as enterprise ones, because agents already run inside browsers, phones and everyday tools, and those settings carry risks a corporate network does not. And how a protection layer is wired into the agent changes what it can see, so two products with the same headline score can be doing entirely different jobs.&nbsp;<h2 class="text-align-justify">A lock or good manners?</h2>There is one design question underneath all of this that the industry has not settled. Should the attack be allowed to reach the model at all?&nbsp;Most protection today works by letting the model see the hostile content and trusting it to behave. That should be the fallback, not the default. Once hostile content is inside the model's context, everything that follows is a judgement made by a system that has already been shown the attack. Nothing after that point is trustworthy in the way a lock is trustworthy.&nbsp;When you test an attack against an agent, there are four possible outcomes. It never reached the model. It reached the model, and the model declined. Someone noticed and did not stop it. Nobody noticed. Most safety claims today do not distinguish between the first two, and yet they are the difference between a lock and good manners. A single number that covers both cannot tell you which one you have. The new methodology records them separately. It also separates noticing an attack from stopping it, and it treats blocking legitimate work as its own kind of failure, because a protection layer that gets in the way of the task is one users switch off. Published vendor claims get recorded too, and then marked as confirmed, unconfirmed or contradicted.&nbsp;And there is the part nobody in this field likes to say out loud. These systems are not deterministic. They are getting better, quickly, and they will keep getting better. They will also keep giving you a slightly different answer to the same question. Would you accept a lock that works nine times out of ten? A protection layer for an AI agent runs thousands of times a day. The tenth time is not a rounding error; it is somebody's data.&nbsp;<h2 class="text-align-justify">From one internal thread to an industry standard</h2>This did not need another vendor framework. It needed the vendors and the testers in the same room, agreeing on rules both sides could live with. That is what AMTSO has done since 2008, and it is why the work went there rather than into a Gen white paper.&nbsp;Gen initiated it. It started in an internal thread about where the industry was heading, and one of us said the obvious thing: somebody independent should be measuring all of this. Including us. Under the AMTSO AI Security Working Group, with testing organizations and vendors from across the industry, the first version went from that conversation to an adopted, published standard in a couple of months. For a standards body, that is fast.&nbsp;We have been building in this space since the start of the year: AI Agent Protection in Norton and Avast, <a href="https://github.com/gendigitalinc/sage">Sage</a> released as open source for the community, and <a href="https://github.com/gendigitalinc/aarts">AARTS</a> and<a href="https://www.gendigital.com/blog/news/company-news/ai-agent-trust-hub-standards"> Skill IDs</a> published as open standards anyone can implement. More is coming soon. And because a call for measurement carries little weight from someone unwilling to be measured, our intention is clear. When independent evaluations built on this standard start running, we want our own products on the list.&nbsp;<h2 class="text-align-justify">Measured, not announced&nbsp;</h2>I do not want AI to be a thing people are afraid of. I also do not want it to be a thing people believe on faith. It should make life better, and for tens of millions of people it already does. What is missing is trust, and trust is not something a company can announce.Being fearless about AI doesn’t mean trusting it blindly or ignoring its risks. It means understanding those risks, measuring them and building the protections that give people the confidence to use it.Every previous era of computing learned this the same way: the claim comes first, the measurement comes later, and the gap between them is paid for by users. This time the measurement is arriving early. That is the whole point of it.

Gen is leading the industry to develop the first standardized benchmarks for AI protection

Your AI agent is safe. Says who? 

Security Evangelist at Gen

I am more afraid of a malicious person with a powerful AI system than I am of AI suddenly deciding, on its own, to harm us. AI does not need bad intentions when the person using it already has them. That view comes from more than 25 years I’ve spent studying malware, scams and the way criminals adapt to new technology. The tools keep changing, but greed, power, revenge and ideology remain. AI gives those motives an inexpensive way to turn intent into action at a scale we have not seen before.This does not make autonomous AI risk imaginary. Systems can misinterpret goals, bypass weak controls or take actions their creators did not expect. Recent security evaluations give us good reasons to take that possibility seriously. My concern is about emphasis. The public debate often jumps to focus on a machine developing its own hostile intent, while ignoring the fact that people are already &nbsp;using AI to make fraud, manipulation and cyberattacks cheaper and more effective.<h2>Powerful tools inherit human intent</h2><a href="https://www.iaea.org/topics/nuclear-technology-and-applications">Nuclear science</a> is the clearest historical comparison for me. It can generate electricity and support medicine, agriculture and scientific research. It also enabled weapons capable of destroying entire cities. The discovery did not arrive with one moral purpose. What followed depended on what people built, who controlled it and the limits society imposed.We have seen the same dual use with the internet and cryptography. The internet connected billions of people and also created a global attack surface. Strong encryption protects banking, health records and private communication, while criminals use it to hide their operations. This does not mean technology is neutral in its effects. Design choices and access rules shape outcomes. It means a ban on the underlying capability is usually a crude response to a problem rooted in how people apply it.AI also inherits something from us before anyone types a prompt. Large language models are trained largely on human-produced text, code and other material. In that sense, they learn not only from what we know, but from a record of who we are, including how people persuade, deceive, evade controls and cause harm. Training and post-training allow models to combine and generalize that knowledge in new ways, so they are not simply repeating their source material. But much of the playbook still comes from us. The human element appears in the knowledge used to build the model, the decisions governing its deployment and the intent of whoever puts it to work.AI adds something genuinely new to this pattern. It can combine language, reasoning, code and tools in one system, then operate at machine speed. A person with limited expertise can use it to research a target, draft convincing messages, translate them and automate parts of a campaign. A more capable attacker can accelerate vulnerability research or make sense of stolen data.&nbsp;<h2>AI gives attackers more leverage</h2>In threat research, I have watched criminals move toward anything that reduces effort and increases their return. AI offers both. It can personalize phishing, remove the language errors that once exposed a scam, clone a trusted voice and adjust social engineering while a campaign is running. Attackers no longer need to choose as sharply between scale and personalization.People do not need AI to become malicious. We already lie, steal, manipulate, intimidate and exploit one another. What AI changes is the amount of skill, time and money required to do it. A person who once had the intent but not the capability can now borrow that capability from a machine.Until now, many forms of harm have had natural limits. A scammer could only write so many convincing messages. An impersonator needed the right language skills. A criminal researching a victim had to spend time piecing together information. AI erodes those limits. It can help one person research thousands of targets, tailor a different approach to each of them and communicate convincingly across languages, cultures and channels. The malicious intent is human, but its reach no longer has to be limited by human capacity.The danger also goes far beyond better phishing emails. AI can be used to manufacture evidence, impersonate people we trust, create convincing voices and images, identify vulnerable targets, analyze stolen information and automate parts of an attack. It can make manipulation feel personal even when it is being produced on an industrial scale. AI did not invent personalized manipulation, but it makes that combination cheaper, faster and more convincing.I worry that the debate focuses too narrowly on whether AI itself becomes malicious. We do not have to wait for a machine to develop bad intentions. There are already people with bad intentions who are eager to give machines instructions.The AI agent also becomes a target. <a href="https://www.gendigital.com/blog/insights/research/infostealers-your-ai-agent">Research from our team</a> found information stealers collecting access tokens, credentials in Model Context Protocol configurations, prompt histories and project data from AI-assisted development tools. A criminal who steals an agent's context may learn what its user is working on, what services the agent can reach and how to make malicious activity look legitimate. That can be more useful than stealing a password in isolation.&nbsp;My greatest concern is what happens when AI is put in the hands of people who already understand how to cause serious harm. Well-resourced criminal groups or state operators already have the motive and expertise. AI can help them research faster, experiment more cheaply, analyze more information, make their deception more convincing and adapt their operations as defenders respond.Defenders operate under rules, approval processes and legal obligations. Attackers do not. Safety controls in mainstream AI products are essential, but the adversaries we most need to constrain are also the most willing to probe those controls, combine multiple systems, modify models or seek out tools with fewer restrictions.<h2>Autonomous failures remain real</h2>Human misuse is my main concern, but of course there are other important issues at stake. In July 2026, AI models operating in OpenAI's cybersecurity evaluation environment circumvented controls intended to keep them off the internet. According to <a href="https://openai.com/index/hugging-face-incident-and-the-road-ahead/">OpenAI's account</a>, they used unauthorized channels and compromised parts of OpenAI's research infrastructure and Hugging Face. Anthropic later described <a href="https://www.anthropic.com/news/investigating-three-incidents-in-our-cybersecurity-evaluations">three incidents</a> in which Claude models reached the internet from evaluation environments and accessed real systems. Nobody had instructed the models to attack those organizations.These events happened during controlled testing, and OpenAI's case involved reduced safeguards. They do not show conscious machines choosing to do evil. They show something more ordinary and operationally serious: a system with a goal, tools and permissions can take harmful steps that nobody explicitly requested. Once an agent has credentials and network access, a mistaken or poorly aligned objective can travel.Human decisions still create the conditions for that failure. People and organizations design the system, set its objectives, grant its permissions and decide which safeguards stand between an unexpected action and a real-world consequence. Responsibility should follow the authority and control held at each stage. Autonomy cannot become an accountability loophole, but neither should it allow providers to transfer every consequence to the person using the agent. Once deployed, however, an autonomous system can still carry the damage faster and further than any of those people intended. Malicious use and autonomous failure can also reinforce each other. An attacker can deliberately manipulate an agent through the information it consumes, while an ordinary user can cause damage by giving the same agent too much access.<h2>A pause only works if it can be verified</h2>Should the major AI laboratories slow down? In some areas, yes. If a system can defeat its sandbox, conceal consequential actions or reach unrelated external systems, its release should wait. Dario Amodei has <a href="https://darioamodei.com/post/we-must-pace-the-frontier">argued for pacing frontier development</a> so that safeguards and independent evaluation have time to catch up. I agree with that principle. I am less convinced that an agreement among a handful of companies can stop the race.AI is a strategic capability. Even if the largest American laboratories agreed to pause, other companies, open-weight communities and state-backed programs could continue. China deserves particular attention because it has the resources and strategic incentive to compete at the frontier. We should still be precise. China joined the United States and other countries in signing the <a href="https://www.gov.uk/government/publications/ai-safety-summit-2023-the-bletchley-declaration/the-bletchley-declaration-by-countries-attending-the-ai-safety-summit-1-2-november-2023">Bletchley Declaration</a>, so it would be wrong to claim that dialogue is impossible. A declaration, however, is not a verifiable restriction on model training, access to compute or military use.The central problem is verification. Training can happen behind closed doors, military applications may remain secret, and governments on every side have incentives to defect if they believe a rival is gaining an advantage. A pause observed only by responsible actors could leave the world with the same race, led by participants whose practices are less transparent and whose incentives are harder to influence. That could increase the risk.China is not the only complication. Model weights can be copied, computing power can be rented across borders, research spreads quickly and criminal markets do not sign safety declarations. A company pledge can improve safety inside that company, which is valuable. It cannot substitute for international rules, technical verification and controls aimed at the capabilities that could cause the most harm.<h2>What I would stop</h2>I would not stop AI research or ordinary uses that help people. The benefits in medicine, science, education, accessibility and cybersecurity are real, and a blanket ban would be both undesirable and nearly impossible to enforce. I would stop the deployment of systems that fail specific safety thresholds. This is how security works: isolate the dangerous component, understand the failure, fix the controls and test it again.An agent that cannot remain inside its sandbox, respect permissions, record consequential actions or be reliably cut off should not operate with real accounts. If a model materially lowers the barrier to severe cyber or biological harm and its controls cannot be independently verified, access should remain restricted until that changes. Technical progress does not create an automatic right to deployment.The nuclear comparison is useful here too. Society did not apply the same rules to a medical isotope facility, a power plant and a nuclear weapon. It built different levels of access, monitoring and inspection around the risk. That regime is imperfect, but the principle is sound. An AI writing assistant and an autonomous cyber operator should not face the same requirements.After more than 25 years in cybersecurity, I value internal testing without confusing it with independent validation. AI laboratories should give qualified external evaluators enough access to test the complete system, including the model, tools, memory, credentials, sandbox and logs. A product claim is not a safety certificate.<h2>&nbsp;What responsible deployment requires</h2>&nbsp;We need to focus much more attention on the people and organizations deciding how these systems are built, deployed and used. Agents should only receive access to what’s required for the current task. Consequential actions should require confirmation, credentials should expire quickly, and people need a reliable record of what an agent did and an immediate way to revoke its access. These controls help whether the danger comes from a malicious operator or from unintended AI behavior.I remain more afraid of a person with bad intentions and powerful AI than of a machine spontaneously becoming malicious. History gives us too many examples of human beings turning useful discoveries into weapons. AI raises the stakes because it can scale human intent and continue acting after direct oversight fades.We should not anthropomorphize the threat to the point that we overlook the human role. An AI system does not need to experience greed, hatred, revenge or a desire for power. A person with those motives can give it an objective and the access needed to act, while the machine adds speed, knowledge and reach.AI development will continue, and human ambition, competition and malice will remain part of the race. Our responsibility is to prevent those forces from gaining unchecked power through systems we cannot understand, monitor or contain.

Why malicious use worries me more than machines acting alone 

The Most Dangerous Part of AI Is Still Human 

Chief AI & Innovation Officer

Last week, Gen joined more than 100 technology, cybersecurity and infrastructure companies, including Google, Microsoft, OpenAI and Anthropic, in calling for stronger collective cyber defenses before AI-powered attacks become dramatically more widespread and sophisticated. Gen is proud to be part of that effort; we also bring a distinct perspective to it.As a global leader in consumer Cyber Safety, Gen protects nearly 500 million people around the world through brands including Norton, Avast, LifeLock, and MoneyLion. We see what cyber risk looks like not only inside enterprises, but in the everyday digital lives of individuals and families. That matters because the AI cyber challenge will not stop at the enterprise boundary.The same forces highlighted in last week’s open letter will increasingly reach consumers, and consumers have far fewer resources to defend themselves.The letter makes three important calls to action: the security status quo will not be enough, defenders need access to powerful AI, and cyber defense has to become a collective effort. We strongly agree. And we believe consumer Cyber Safety needs to be a central part of that collective defense.&nbsp;<h4>The status quo will not be enough for consumers either</h4>Historically, sophisticated cyberattacks required expertise, time and money. That naturally concentrated attackers on higher-value targets.AI changes the economics. Attackers can increasingly automate research, personalize phishing, generate convincing text and images, clone voices, translate scams across languages and adapt attacks to individual victims at very low marginal cost.Sophistication is also becoming commoditized. That means attacks that once made economic sense primarily against enterprises or high-value individuals can increasingly be aimed at anyone. At Gen, we already see attackers moving closer to the systems and relationships consumers trust. Our latest threat research shows attacks increasingly hiding inside booking platforms, messaging conversations, legitimate accounts, software workflows and AI agents operating with permissions users themselves granted.For consumers, cybersecurity therefore has to evolve. Stopping malware remains essential. But Cyber Safety increasingly has to help answer much more fundamental questions: Is this person real? Is this message authentic? Can I trust this website? Should this AI agent have access to this information? Should this action be allowed to happen?Trust itself is becoming part of the security perimeter.&nbsp;<h4>Powerful defensive AI has to reach the consumer too</h4>The open letter calls for cyber-capable AI to be placed in the hands of defenders, and we strongly support that goal, but we should define “defender” broadly.A defender can be a security professional protecting a hospital, government agency or data center. It can also be technology protecting a parent from an AI-generated impersonation scam, stopping malicious code before an AI agent executes it, or preventing an autonomous agent from sending credentials somewhere it should not.Consumers cannot suddenly become cybersecurity experts simply because AI makes attacks more sophisticated. The technology has to do more of the defending for them.That is precisely why Gen began rolling out the Agent Trust Hub (ATH) earlier this year. ATH is designed as an independent security and trust layer around increasingly autonomous AI. It can evaluate agent capabilities before they run, observe agent behavior during execution and help stop dangerous actions in real time.We have since expanded that architecture through technologies including Sage, Agent Detection and Response, VPN for Agents, Norton AI Agent Protection and AARTS, our open standard for AI agent runtime safety.The goal is straightforward: protect consumers at the points where AI risk actually emerges, from the tools an agent uses to the commands it executes, the data it accesses and the networks it connects to. AI increasingly has to help defend us from AI.&nbsp;<h4>We need to prepare before emerging capabilities become common threats</h4>The urgency in the letter is important because AI capabilities are advancing extraordinarily quickly.Recently, OpenAI released detailed findings from a security incident involving OpenAI and Hugging Face infrastructure. During cybersecurity evaluations, highly capable experimental agents circumvented sandbox controls, found ways to reach the internet, exploited vulnerabilities and established unauthorized ways to communicate. OpenAI described the incident as a “warning shot.” These behaviors remain unusual today, and we should not exaggerate the current threat, but that is precisely why the industry has a window to act.We can now see capabilities emerging that could become much more consequential as AI systems become more autonomous, persistent and interconnected. The question is not whether every consumer faces this threat today, the question is whether we can build the defenses before they do.&nbsp;<h4>Collective defense must connect frontier AI to the consumer edge</h4>This is where Gen’s role in the coalition becomes especially important. Frontier AI companies see emerging model capabilities first, cloud and infrastructure companies understand the systems those models run on, and cybersecurity companies understand attackers, vulnerabilities and defensive controls.Meanwhile, governments can coordinate standards, intelligence and policy. What’s lacking across these is the consumer Cyber Safety perspective at global scale. We see what happens when new technology reaches hundreds of millions of people who do not have a CISO, a SOC or a security engineering team protecting them. All of these perspectives need to connect.That means sharing threat intelligence, defensive technologies and best practices. It means creating open standards rather than isolated security systems around individual AI platforms. And it means ensuring that breakthroughs in frontier cyber defense ultimately become protections that ordinary people can benefit from automatically.That is why Gen has been working across the AI ecosystem while also developing open approaches such as AARTS, designed to create a common way for security systems to understand what an AI agent is doing and intervene when necessary.Collective defense cannot stop at enterprise networks and critical infrastructure, it has to reach the consumer edge.&nbsp;<h4>The defenders’ window is open now</h4>Gen joined the call because we believe the central premise is right: AI will strengthen attackers, and AI can strengthen defenders even more. But that will happen only if the industry moves early, works together and ensures that the benefits of advanced cyber defense reach everyone.For Gen, protecting consumers is a critical part of that mission. Nearly 500 million people already trust Gen brands to help keep their digital lives safer. As AI becomes more autonomous and more deeply integrated into everyday life, that responsibility expands.We will need stronger AI for defenders, we will need independent trust layers around autonomous systems, and we will need shared intelligence and open standards.We also will need to treat consumer Cyber Safety as an essential part of the same collective defense mission protecting enterprises, governments and critical infrastructure. Gen is proud to stand with the more than 100 companies making that call. Now we need to make sure collective cyber defense protects everyone. &nbsp;

Why consumer Cyber Safety must be a central part of the collective defense against AI-powered attacks

The Cyber Defense Window Must Include Consumers

Corporate Manager

There’s a quiet shift happening with money right now. Gen Z isn’t just earning, spending and saving differently; they’re doing it in a world where your financial life is fully online, constantly moving and, frankly, a little chaotic. One minute it’s budgeting tips on TikTok, the next it’s a “too good to be true” investment ad sliding into your feed.So let’s strip it back. Financial safety isn’t about being perfect. It’s about being prepared before something goes sideways.&nbsp;<h4>Start with this: safety beats strategy</h4>There’s a lot of noise around investing early, building passive income or chasing the next big thing. And yes, Gen Z is already jumping into investing earlier than previous generations, often using digital platforms to take control of their finances.But here’s the part that gets skipped: none of that works if your foundation isn’t solid.Financial safety starts with three basics: • Cash buffer (even a small one) • Controlled spending • Awareness of risk (scams, debt, bad advice)Because right now? A lot of Gen Z doesn’t have that safety net. Around 62% don’t have emergency savings, and many rely on credit cards to get through unexpected expenses.That’s not a personal failure. It’s the reality of higher costs, unstable income and a system that wasn’t exactly designed to be easy.But it does mean one thing: building your own safety net matters more than ever.&nbsp;<h4>The smartest move: know where your money is going</h4>You don’t need a complicated system. You just need visibility.Call it budgeting, call it tracking, call it not being surprised at the end of the month. It’s all the same thing.A simple framework like 50/30/20 (needs, wants, savings) still works. But Gen Z is remixing it into something more real: intentional spending. Think “loud budgeting,” being honest about what you’re prioritizing and what you’re not.Translation: You’re not broke. You’re choosing where your money goes.That mindset shift alone is powerful.&nbsp;<h4>Build a buffer before you build wealth</h4>It’s tempting to jump straight into investing. But if one unexpected expense can wipe you out, you’re building on shaky ground.Start smaller: • Aim for $500 to $1,000 in emergency savings • Then grow toward 3 to 6 months of expensesIt doesn’t happen overnight. That’s fine. Consistency beats intensity here.Because when something goes wrong, and it will, you won’t have to rely on high interest debt to survive it.&nbsp;<h4>Watch the digital traps</h4>This is where financial safety gets very real.Gen Z lives online. That means your money does too. And that’s exactly where scammers operate.Fake ads. Impersonation. “Investment opportunities” that look just legitimate enough. These aren’t edge cases. They are designed to blend in with everything else you scroll past.And it works.There’s also a gap worth calling out: confidence doesn’t always equal protection.Gen Z is one of the most confident generations when it comes to spotting scams, but they’re also engaging with them at significantly higher rates than older generations, in some cases nearly double. (<a href="https://dataconomy.com/2025/08/11/gen-z-fall-for-online-scams-more-than-twice-as-often-as-older-ones/?utm_source=chatgpt.com">dataconomy.com</a>)And when scams work, they don’t just take money. They take identity.According to the Identity Theft Resource Center, many of today’s scams are designed to get people to willingly share personal information, including login details, Social Security numbers or verification codes. That information is then used to open new accounts or take over existing ones. (<a href="https://www.prweb.com/releases/identity-theft-resource-center-2025-trends-in-identity-report-impersonation-scams-rise-148-percent--become-top-reported-scam-302477300.html?utm_source=chatgpt.com">prweb.com</a>)That shift matters. Because identity theft isn’t a future problem. It is often the next step after a single click, message or seemingly harmless interaction.As Eva Velasquez, CEO of the Identity Theft Resource Center (ITRC), puts it: “We have to stop looking at identity theft and financial loss as two separate problems. Your identity is the ‘key’ to your entire financial house. If a scammer gets your login or your Social Security number, they don’t just take your money; they take your ability to build a future. Protecting your personal data is the most foundational investment you can make in your financial health.”If your financial life lives online, your identity is part of your financial safety net. Protecting it isn’t optional anymore. It is foundational.A few rules that hold up:<ul><li data-list-item-id="e68f7e0771c4abf542347cf3d63d577c2">If it creates urgency, pause</li><li data-list-item-id="eb8ea324e46df96adbfd24483ec6a98f6">If it promises easy money, question it</li><li data-list-item-id="e74a7beb276a369d3825446def9da1a64">If it looks legit but feels off, trust that instinct</li></ul>Being skeptical isn’t negativity. It’s protection.If you want to go deeper, the&nbsp;<a href="https://www.idtheftcenter.org/reports/?utm_source=chatgpt.com">Identity Theft Resource Center’s latest reports and resources</a> break down how these scams are evolving and what to watch for.

<h4>Use tools that actually help you move forward</h4>This part matters more than ever: you don’t have to figure all of this out alone.The line between financial health and digital safety is disappearing. That’s why platforms are starting to bring both together.MoneyLion, now part of Gen, is a good example of that shift. It’s built to help people not just manage money, but actually move forward with it: tracking spending, building credit, accessing tools that make financial progress feel doable.Because financial safety isn’t just about avoiding risk. It’s about having the confidence to act.&nbsp;<h4>You’re not behind. You’re early</h4>It’s easy to feel like you’re late with money. Like you should already have it figured out.You’re not. You’re early.Gen Z is already reshaping how money works. There are more open conversations, earlier investing and more willingness to question the system.The goal isn’t perfection. It’s momentum.Start with:<ul><li data-list-item-id="e25fe3be553f9c23cfc8ba4ecd87a05ae">Knowing your numbers</li><li data-list-item-id="e947fbae986f88ac1b2176531fd700260">Building a small safety net</li><li data-list-item-id="e1072ff692e39775a264cf450c494ccb5">Staying sharp online</li><li data-list-item-id="eaa82b9c8751df887da9a64a66a4100ff">Using tools that actually support you</li></ul>That’s Financial Safety 101.Not flashy. Not viral. But it works.And once that foundation is there, everything else, investing, growing, building real wealth, gets a whole lot easier.

Gwynne Junkin

Posts by Gwynne Junkin

Black October Cybersecurity Lessons for Every Business