Triangle InfoSeCon Panel Recap: How Security Leaders Prove Defenses, Respond to Breaches and Recover

Prove your controls continuously, know where your sensitive data lives and get to know your local FBI office before you need it: those were the lessons security leaders shared at Triangle InfoSeCon. 

On Friday, October 30, 2026, I had the honor of moderating the leadership track panel Raleigh ISSA’s annual security conference. I was joined by three panelists: a CIO/CISO from a mid-sized clinical research organization, a field CISO and Trusted Advisor from Access IT Solutions (a Cymulate partner) and an FBI agent.

The discussion ranged from what boards ask for today to how AI agents are changing identity risk, why it’s important to establish a relationship with the FBI and why the hardest part of a breach often comes months after the incident is contained. 

This blog summarizes the key lessons from that discussion with practical steps security teams can take now. 

Key Takeaways 

• Layered security controls are essential. Boards now ask for proof that layered security controls stop real attacks, not lists of tools or vanity metrics. 
• Attackers have evolved. Attacks can now run from initial access to attempted exfiltration in about 24 hours, so testing, validation and training need to run continuously. 
• Be prepared for recovery post-incident. Recovery is only as fast as your data inventory: classify, confine and delete sensitive data before an incident. 
• Establish a relationship with the FBI. Reach out to your local FBI Field Office through www.fbi.gov to establish a relationship prior to an incident. 

How has proving security posture to the board changed? 

During the panel, I asked the room: How many of you are more than 95% confident that your security controls would stop an attack today, especially with AI in the mix? Not a single hand went up. 

Every CISO gets the same question: "Are we secure?" (For more on answering the board's "are we secure?" question, see our earlier post.) A few years ago, board questions were simple and now they are more in-depth with evidence required.   

Boards commonly ask for: 

• Real scenarios, not tool lists. Walk the board through actual attacks and show how multi-layered protections stopped them. 
• An attack surface view. Show evidence that you are continuously inventorying and reducing the attack surface, and measuring cybersecurity posture and threat resilience. 
• Data security posture. Know where sensitive data lives and how it is protected, often with data security posture management (DSPM) tools. 

Vanity metrics are disappearing. Volume stats like "phishing emails blocked" told a simple story that no longer satisfies the board, especially as organizations adopt zero trust architectures and an assume-breach mindset, combined with how advanced attackers are with AI. 

What gets out matters more than what gets in. Smarter boards know incidents will happen. What they care about is what leaves the organization. Threat actors increasingly favor a smash-and-grab approach: instead of encrypting systems, they steal data and blackmail the victim. That is when the board asks the tough question: Where does our sensitive data live, and are we continuously validating that it is protected? 

Point-in-time validation alone is no longer enough. The traditional model was an annual red team test that produced findings, remediation and a roll-up into a risk register. Even an advanced SOC that collects alerts is still reacting. The panel’s view is that teams need continuous monitoring and validation to filter the noise, eliminate false positives and deliver board metrics in near real time. 

No organization may be 95% confident, but security teams can replace confidence with continuous evidence of their threat resilience. 

What are the biggest identity risks today, including AI agents? 

Privileged accounts and standing privileges are the largest identity threat, for both human administrative accounts and AI agents. 

Recommendation: Move toward time-based, just-in-time access, where elevated privileges are granted for a limited window and then revoked. Apply this to AI agents and admin accounts alike. 

Zero Trust is now practical. Zero Trust architecture and tooling have matured significantly, with conditional access that includes device health checks and user-level risk controls, plus advanced logging and dashboards. More regulations now call for zero trust controls, which ties the architecture directly to governance and compliance. 

AI agent risk is outpacing governance 

Frameworks for securing AI are still maturing. NIST published the AI Risk Management Framework. In the meantime, the panel shared four steps organizations can take now: 

1. Control the perimeter first. A company deployed Cisco Umbrella after finding employees putting company data into personal ChatGPT accounts and using unapproved AI note-taking tools, including on customer calls. Now, the use of AI is fully monitored and controlled. 
2. Limit what AI tools can ingest. In Microsoft Copilot deployments, SharePoint sites can be open to Copilot ingestion by default, so anything someone shared globally can be crawled. That team turned this off everywhere and applied least privilege and least data. 
3. Train people and publish an AI usage policy so employees know what they can and can't do. This step is critical. Without a usage policy, employees will still find ways to use AI for day-to-day work, including entering business data into personal AI tools. 
4. Trust, but verify. The next area of security tooling is visibility into what data goes into AI tools and what agents do with it. Traditional software had test plans and requirements documents. AI needs equivalent testing harnesses and guardrails. 

How fast are attackers moving now? 

Attackers used to sit in an environment for months. Now attacks move much faster. In an example shared, the attack chain took about 24 hours from start to attempted data exfiltration, and it was automated end-to-end. Faster attacks leave less time to spot anomalies in your environment. 

The skill barrier has dropped. AI toolkits make social engineering far more convincing: 

• Phishing emails sent to finance teams look like real, overdue invoices. 
• Attacks arrive across Microsoft Teams channels, phone calls and text messages, including SMS messages impersonating the CEO and asking for money or gift cards. 

As a general rule, if someone urgently requests something that isn't routine, stop and verify before acting. Years ago, an OPM investigator called me at 11 a.m. on a Saturday. It turned out to be legitimate when I called back during the workweek, but that habit of pausing has saved me from many scams, from fake bank alerts to online shopping sites. I won't buy from an online store unless I know the seller or have checked that its domain is legitimate. I also signed up for the Federal Trade Commission consumer alerts, which I encourage everyone to do. 

Living off the land still works. Once an attacker is inside, east-west movement is often unchecked. Fully segmenting a network or hosts takes significant effort, and usable tooling to stop lateral movement is still limited. Continuous validation of segmentation controls with proof attackers are stopped is essential. 

The patch wave is a board topic. Boards are asking whether the current volume of security patches will continue. One panelist called this an inflection point: decades of software were written without tools that could scan for these flaws, and AI-driven scanning is now surfacing them quickly. The hope is that the volume levels off over the next year and leaves more secure software behind, but only time will tell. 

Training has to move at attack speed. Periodic, generic security training is outdated by the time it arrives. A company’s CISO now uses an AI tool to turn a short script into a five-minute video. When a new lure appears in the morning, employees have a training video by mid-afternoon, with real examples of SMS, CAPTCHA and Teams-based attacks. Hearing from peer CISOs about what they are seeing helps teams build these trainings even faster. 

This shift is also happening at the national level. Earlier this year, the White House invited industry in, for the first time, to share how defenders can respond at machine speed as attackers move at machine speed. The administration is working to remove barriers, engage industry more and prototype faster. Read my recap of the White House AI cyber defense roundtable to learn more. 

How often should you test your defenses? 

Testing your controls once a year doesn’t work. The right cadence depends on moving from reactive alerting to active, continuous monitoring. The panel shared two practical lessons. 

• Rotate perspectives. Threat actors probe your perimeter in many different ways. Switching penetration testing vendors, or adding more than one, brings fresh perspectives on your external attack surface, even at extra cost. And don't stop at validating where attackers can get in: test how far they can move and how much damage they can cause once they're in. 

• Continuously test and validate every layer. I always assume the attacker is already in, which is the premise of Zero Trust: assume breach. Breach and attack simulation, which has evolved into exposure validation, has moved from a nice-to-have to a must-have for continuous validation. More organizations now treat it as an operational cyber capability their security teams use daily. Agentic AI has removed the need for specialized skills and answers common questions such as "Which attacks should I run, and how often?" It knows your environment, identifies threats relevant to you and runs the attacks automatically. For example, with two-way integrations with your SIEM and EDR, it can identify a new threat in your environment, reveal a missed detection, automatically push the IOC and vendor-specific detection rule in your tools, and then re-test to verify the fix. At Cymulate, this is what we call agentic cyber defense engineering. 

What do you need ready before an incident? 

When I asked the audience of CISOs and security leaders how many of them had run a ransomware tabletop exercise in the past 12 months, about half raised their hands, which shows this is still an area to work on. One panelist shared how he learned this the hard way. When his first incident hit, he had just started the job. He didn't know who the cyber insurance provider was, and the incident response plan had no detailed instructions and hadn't been updated in years. 

Tabletop exercises help, but the panel recommended building a comprehensive named contact list in advance with processes: 

• Cyber insurance provider 
• External counsel 
• Forensics firm to determine whether attackers are still in your systems 
• Negotiator to buy time, get proof of life and confirm what the attackers actually have 
• A data inventory capability so you know what was taken (more on this below) 
• Local FBI Office  

The FBI agent panelist encourages companies to establish a relationship with their local FBI office.  Check out their website for their FBI cyber services. 

Should you pay the ransom? 

Boards ask this question constantly, and that panelist's answer has stayed the same: don't pay. 

• Money keeps threat actors going. Not paying is more painful in the short term, but it takes the oxygen out of the room. 
• Fewer organizations are paying. So much data is already exposed that paying to keep it private often means little; the stolen data likely circulates either way. 
• You'll likely notify customers anyway. After one incident, he had to talk to hundreds of customers about exposed data, and he would have had to notify them even if the data hadn't been released. 

Another panelist shared a cautionary example. Around a merger, a U.S. company had paid a ransom in bitcoin twice. After the acquisition was announced, the same attackers used living-off-the-land techniques to move into the parent company. They were caught by checking backups, which had been tampered with, and stopped a day or two before encryption. Multiple layers of backups, including tape, saved the business. The lesson: paying didn't make the problem go away. 

Prepare for escalation beyond the network 

Extortion now reaches into the physical world. A panelist described a case of executive swatting, where threat actors called in false emergencies to an executive’s home, and the organization had to work with local police as a result. Plan for this before an incident, not during one. 

Why does post-breach recovery take so long? 

Getting systems back up is only part of recovery. Four months after a single incident, one panelist's team was still notifying customers, because they had to work through massive SharePoint sites to determine what had bee taken and kept learning more about the damage to customer data. 

Data inventory is the hardest post-breach task 

Looking back, if the organization had a DSPM tool in place, it could have known in minutes which customers were affected and what type of data was involved, such as sensitive patient data or contract data, based on data tagging. These are Zero Trust best practices for the data pillar. 

In my experience, data has historically been the least mature pillar of Zero Trust architecture, but that is changing. Even at the White House event, data challenges came up consistently during open discussions. 

Data retention policy determines blast radius 

One panelist said his organization's retention policy had effectively been "we never get rid of anything." With a background as a chief data and AI officer, his mindset had always been that more data is good. But now that attackers focus on smash-and-grab, sensitive data is also a major liability. "Blast radius" is a term he uses with the board all the time. 

Best practices from the panel: 

1. Classify and tag data, especially unstructured data moving through email and collaboration tools, and carry tags into other platforms. 
2. Protect the crown jewels with tight controls, and continuously validate protection and detection. 
3. Cold-archive or delete what you don't need. 
4. Confine sensitive data to a small number of tightly controlled areas. At that panelist's organization, sensitive data had spread across every SharePoint site. After cleanup, it now lives only in a few controlled locations. 

As AI and agents make it easier for data to flow out the door, data protection measures such as tagging and classification matter more than ever. 

How is red teaming evolving? 

Red teaming is moving beyond point-in-time testing. One panelist described a test where the red team couldn't get in from the outside, so his team deliberately opened a path and let them in to see whether they could detect lateral movement. That revealed living-off-the-land activity and where else an attacker could go. Teams need to be flexible about where the red team starts, and use automated red teaming to schedule ongoing tests that validate prevention and detection and monitor for drift. 

Many generic attacks also don't reflect your actual environment. The panel expects AI-driven red teaming to become: 

• Hyper-personalized: profiling your environment, knowing who is targeting you and focusing on attack sequences that reach your most sensitive data stores. 
• Prioritized: accounting for compensating controls that may already cover a vulnerability before it is patched. 
• Closed-loop: pushing the fix and re-verifying it automatically, which answers the common question of how often attacks should run. 

The MITRE ATT&CK framework is evolving as well. MITRE is releasing protection strategies down to the configuration level, such as checking whether MFA is disabled in Microsoft 365 (MITRE ATT&CK). Because Zero Trust is policy-driven, an adversary who gets in can turn off a conditional access policy, so configuration drift monitoring matters: MFA can be on one day and off the next. MITRE has opened a Slack channel for the community to contribute feedback. Learn more in my recent blog on the protection strategy structure and how to engage MITRE.  

Key takeaways from the panel 

• Security is everyone's responsibility, and it starts with leadership. 
• Use the momentum after an incident. Budget often opens up right after an attack for the platform you were told to wait on, such as a Zero Trust architecture. Bring teams together, run a good lessons-learned review and document where your weaknesses are. 
• Run retrospectives and keep training current. After an incident, review what happened and turn real attacker lures into fast, specific training. 
• Don't let urgency override judgment. Any message that demands payment right now is a red flag. Stop and verify, because legitimate requests rarely work that way. 
• Verify domains before you trust them. Check WHOIS for when a domain was registered, at work and in your personal life. A domain that appeared yesterday claiming they have been in business for awhile is a strong warning sign. 
• Security doesn't stop at work. Apply these lessons to your personal life to protect yourself, such as the earlier recommendation to sign up for FBI cyber alerts. 

How Cymulate helps prove controls work across the incident lifecycle 

Many of the panel's lessons come back to one need: evidence of security controls and measured threat resilience. Boards want proof that layered controls stop real attacks, security teams need to know what an attacker can reach after initial access, and both need answers continuously, not once a year. 

Prove. Cymulate Exposure Validation runs safe, automated attack scenarios against your production controls, including assume-breach lateral movement, living-off-the-land techniques and data exfiltration, so you can show which layers prevent and detect real attacker behavior. 

Prioritize. Cymulate CTEM moves beyond exposure discovery to prove exploitability and prioritize based on business impact, accounting for compensating controls and giving the board outcome-based evidence instead of activity counts. 

Adapt. The Cymulate Platform delivers vendor-specific mitigations for identified gaps, including detection rules and IoCs and re-testing verifies each fix. With Cymulate Cowork, powered by Vero AI, AI agents automate repeatable exposure validation workflows so security teams can keep pace with attacks that now unfold in hours. 

Ready to prove your defenses before the next incident? 

The organizations best prepared for a breach are the ones that test their assumptions before an attacker does. To see how Cymulate provides continuous evidence that your controls work, schedule a demo.