"What keeps me up at night isn’t a single exploit." — Randolph Barr, Chief Information Security Officer at Cequence Security.
Randolph Barr: distraction, rapid agent adoption, and family-targeted phishing
Randolph Barr describes a three-part convergence that, in his view, compounds cyber risk. First is distraction: "Every week brings a new headline about AI-driven attacks," he says, and that media and boardroom panic can pull security teams away from foundational work as they react to the latest scare. Second is the speed of agent adoption: connected agents are being introduced "faster than policies and processes can keep up," leaving gaps where controls are applied only after the fact. Finally, Barr makes it personal — his family — noting that "phishing is now easy to personalize using information found online" and that "the instincts I built 25 years ago no longer apply."
Morey Haber: digital ghosts and unmanaged machine identities
Morey Haber, Chief Security Advisor at BeyondTrust, names as his central fear a proliferation of non-human identities and autonomous AI agents inside organizations. He warns these "digital ghosts" often have privileges "that nobody fully understands, monitors, or controls" and can "access sensitive information, execute transactions, modify configurations, and interact with critical systems, often without meaningful human oversight." Haber frames the problem as one of visibility and revocation: when organizations cannot distinguish between legitimate agent activity and a compromised identity, the ghost becomes an "invisible insider threat," and the danger is discovering "that we gave the ghost privileged access and forgot how to revoke it."
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleDiana Kelley: the widening gap between discovery and remediation
Diana Kelley, Chief Information Security Officer at Noma Security, focuses on speed and technical debt. Her scare is "the gap between how quickly attackers and defenders, assisted by AI, can find vulnerabilities vs how quickly organizations can address them." Kelley notes AI accelerates discovery, but "companies still have years of legacy security debt to untangle," and patches either do not exist or require time to deploy safely — time that creates windows of opportunity for attackers.
Sean Malone and Lisa Bilawski: legacy practices, remediation metrics, and diminishing returns
Sean Malone, Chief Information Security Officer at BeyondTrust, points to "legacy practices and operational debt" that leave enterprises and critical infrastructure at outsized risk as AI enables "weaponized critical vulnerabilities" to be discovered and exploited at machine speed. He prescribes decisive organizational responses: "leaders must take bold, decisive action to reduce the attack surface, drive down tech debt, patch immediately when updates are available, and embrace AI in cyber defense operations. Above all, plan resiliency into business operations."
Lisa Bilawski of Qualys identifies a paradox: "Security teams are doing more vulnerability remediation than ever before" yet exposure is rising. She cites Qualys Threat Research Unit data showing closures rose from 73 million in 2022 to 473 million in 2025 — a 6x increase — while the share of critical vulnerabilities still open at day seven rose from 56% to 63%. Bilawski attributes the failure to allocate effort by evidence of exploitation: "Less than 1% of vulnerabilities are actively exploited," she notes, so programs built around volume and severity score "spend most of their effort on vulnerabilities attackers were never going to use." Her prescription is operational: ask "Is this actively being exploited? What’s the evidence? Which assets are at risk? What can we automate?"
Those operational failures map to hard economics and timelines. The source lists several metrics: "AI-generated attacks have increased 56% between March 2025 and February 2026, adding $1 million in cost per breach to the baseline cost." It also states that "Every hour a breach remains active costs organizations roughly $1,100," that "a breach averages about $5 million per incident, up 12% from last year," and that "Across the most critical, actively exploited vulnerabilities over the past four years, manual remediation processes failed to keep pace with attackers 88% of the time, and half were weaponized before a patch existed."
Andy Boyd: nation-states using AI as a force multiplier
Andy Boyd, CEO at REDLattice, warns that nation-states with infrastructure, talent, and AI literacy can use AI as a "force multiplier," massively increasing the quantity of malicious software with little increase in workforce. The consequence, he says, is "attacks will be coming at a much greater pace, providing less time to react and correct before the next wave of attacks occur."
What this means for technologists, procurement leaders, and families
- Technologists and security teams: Prioritize evidence-based remediation over volume — Bilawski’s call to ask "Is this actively being exploited?" reframes workload and automation priorities, while Malone urges reducing attack surface and driving down tech debt.
- Procurement and organizational leaders: Rapid agent adoption without aligned policies creates gaps; Malone argues leaders must "take bold, decisive action" to update processes, embrace AI in defense, and plan for operational resiliency.
- Families and end users: Barr’s account underscores a social angle — more personalized phishing and online data exposure mean nontechnical users are a fast-growing vector for compromise.
Across six experts the messaging is consistent: speed is the new battleground. AI accelerates discovery and manufacture of attacks, unmanaged machine identities and decades of technical debt widen the windows attackers exploit, and remediation metrics that reward volume over relevance leave defenders farther behind. The remedies the experts offer are specific — prioritize evidence of active exploitation, revoke unmanaged privileges, reduce attack surface and tech debt, patch promptly, and automate where possible — but the underlying question remains practical and immediate: can organizations rewire priorities and processes fast enough to keep the "ghosts" from turning into gateways?
