Cyber Focus: Cybersecurity, National Security, and Critical Infrastructure

Frank Cilluffo / McCrary Institute

As cyber threats evolve faster than policy, Cyber Focus delivers executive-level briefings on cybersecurity, national security, and critical infrastructure. From the McCrary Institute for Cyber and Critical Infrastructure Security at Auburn University, host Frank Cilluffo speaks with senior leaders across government, industry, and the intelligence community about ransomware, state-sponsored threats, AI, and the systems we all rely on—energy, water, telecom, and supply chains. Each episode focuses on real-world risk tradeoffs and practical steps organizations can take to strengthen resilience.

  1. 2d ago ·  Video

    When AI Has the Keys: Autonomous Risk and Digital Identity with Dashlane CEO John Bennett

    AI agents can read emails, access customer records, and issue refunds—but every permission creates another opportunity for misuse. As businesses give autonomous software more authority, how can they keep control of the accounts, data, and decisions those systems touch? Dashlane CEO John Bennett joins Frank Cilluffo to discuss securing digital identity when software acts on our behalf. Bennett explains why agents should be able to use credentials without possessing them, how to limit their access, and why CEOs must take responsibility for AI adoption and the risks that come with it. Main topics AI's impact on phishing and credential theft Autonomous workflows and the risk of prompt injection Agent authentication without exposing credentials Limits on access, permissions, and autonomy Passkeys and planning for compromise CEO accountability and the CISO's role Consumer risks from personal AI assistants Key quotes "Once you've handed [the credential] over … it can be replayed, it can be copied, it can be misused, it can be used beyond what the intended task was." — John Bennett "The business case has to support the risks that you inherently are going to enter into." — John Bennett "AI is not a topic, just like cybersecurity. You can't parachute into it and stay up to date on what's going on." — John Bennett "You're on a stopwatch, you're not on a calendar." — John Bennett Related Link The 2026 Dashlane Passkey Power 20  About the Guest:  John Bennett brings over 30 years of experience leading high-growth B2B SaaS and communication companies. Before joining Dashlane in 2023, John served as the CEO at Cordence, where he led the company's day-to-day operations and long-term strategy.

    When AI Has the Keys: Autonomous Risk and Digital Identity with Dashlane CEO John Bennett

  2. Nov 3 ·  Video

    Cyber Focus Unplugged: AI Threats, China, and the Next Congress

    Winning the AI race takes more than building the best model. It demands hardened infrastructure, reliable energy, and the public's confidence. As AI accelerates cyberattacks and China establishes footholds inside American pipelines, ports, and power grids, will policymakers and industry leaders act before a crisis forces their hand? In this inaugural Cyber Focus: Unplugged roundtable, Frank Cilluffo convenes McCrary Institute senior fellows Bill Evanina, Alison King, Cynthia Kaiser, and Rob Joyce. Drawing inspiration from The McLaughlin Group, the panel debates AI's advantage for attackers, Congress's cyber priorities, how to impose costs on China, and whether CISA has the resources to deliver on its new strategy. The discussion closes with blunt predictions on Taiwan, Russian aggression in Europe, and the future of U.S. cyber policy. Main topics Is AI giving attackers the upper hand? What does winning the AI race require? Can the U.S. build public support for AI? What should Congress prioritize on cyber? Will Congress renew Section 702? How should the U.S. impose costs on China? Can CISA deliver on its new strategy? What comes next for Taiwan, Russia, and U.S. cyber policy? Key quotes "Prepositioning, for all the right reasons, is absolutely a terrorism thing. If you look at what they've done to our critical infrastructure, if that was another country... we would be in a war." — Bill Evanina "You don't establish that credibility through guidance. You establish that credibility by executing the controls and demonstrating that they work." — Alison King "We're so worried about having the exact attribution, the exact... technical smoking gun, that China's conducting many, many other attacks that are beyond Volt Typhoon... and we have a fear of calling them out unless we absolutely know with 105% certainty that that's happening. And we have to get better at that because they're using us for our process to be able to give themselves the strategic ambiguity they need to conduct more and more activities." — Cynthia Kaiser "People often pound on the table and say we should cyber them harder. Cyber doesn't deter cyber. I'm sorry, you're not going to cyber them out of our critical infrastructure. We've got to use these other tools. And unfortunately, the biggest hammer we have is economic, and we're unwilling to use that right now." — Rob Joyce "When we look at frontier models, I have yet to see so much power reside in the hands of so few…to think that they're not intelligence targets for foreign intelligence services is asinine." — Frank Cilluffo Links Cyber Focus — McCrary Institute CISA 2030: Defend, Harden, Prevail CI Fortify About the Panelists The panelists participate in their capacity as McCrary Institute senior fellows, rather than as representatives of their respective employers. Bill Evanina is founder and CEO of the Evanina Group and former director of the National Counterintelligence and Security Center. Rob Joyce is founder of Joyce Cyber and former director of cybersecurity at the National Security Agency. Cynthia Kaiser leads Halcyon's Ransomware Research Center as senior vice president and previously served as deputy assistant director of the FBI's Cyber Division. Alison King is vice president of government affairs at Forescout Technologies, with previous roles at CISA, the Department of the Navy, and the Cyberspace Solarium Commission.

    Cyber Focus Unplugged: AI Threats, China, and the Next Congress

  3. Oct 26 ·  Video

    How Will CISA's New Cyber Strategy Protect Critical Infrastructure? with Nick Andersen

    CISA's new cyber strategy puts a difficult question at the center of national cyber defense: How do you decide what to protect first? Recorded at the New York Stock Exchange, this special episode of Cyber Focus brings together host Frank Cilluffo and CISA Acting Director Nick Andersen to discuss the new cyber strategy, protecting critical infrastructure, and measuring resilience. Andersen explains why the agency must prioritize its highest-consequence work, asks private sector partners to hold CISA accountable, and emphasizes the outcome that matters most to communities: keeping essential services available. Main topics CISA 2030's three pillars CI Fortify: isolation and recovery Critical infrastructure priorities Private sector partnerships and accountability CISA's review of agency activities Measuring resilience across sectors Key quotes "We've got to prioritize. And that means making some tough decisions and making some tough calls." — Nick Andersen "CISA is an agency that is all carrots, no sticks." — Nick Andersen "[Communities] care about the essential services that need to be delivered and they care about that persistent availability of the things that they're relying on just to be able to live their lives." — Nick Andersen Links and resources CISA unveils new strategy to strengthen national cyber defense and critical infrastructure security About the Guest: Nick Andersen is Acting Director of the Cybersecurity and Infrastructure Security Agency (CISA), where he leads efforts to reduce risks to America's cyber and physical infrastructure. A U.S. Marine Corps veteran, he has held senior cybersecurity roles at the Department of Energy, the White House, and in the private sector.

    How Will CISA's New Cyber Strategy Protect Critical Infrastructure? with Nick Andersen

  4. Oct 20 ·  Video

    Is Critical Infrastructure Ready for AI Attacks? with Booz Allen's Brad Medairy

    Can cyber defenses built around human attackers keep pace with AI? Brad Medairy, president of Booz Allen's National Cyber Practice and a McCrary Institute senior fellow, joins Frank Cilluffo to discuss what his team's testing reveals about AI's ability to conduct cyber operations and navigate industrial systems. They examine how these capabilities lower barriers for attackers, why deploying defensive AI requires trust and human accountability, and what executives should do to assess readiness. The conversation also explores active cyber defense and the need to keep essential services running through a compromise. Main topics AI-driven cyber operations Frontier model testing U.S.–China capability gaps Industrial systems at risk AI attack simulations Human oversight and accountability Deception and active defense Operating through compromise Board oversight and readiness Key quotes "Today, with an agentic attack, with an AI-enabled cyber operator that can operate at speed and scale, I think the defender does not have the advantage. It can't move at that pace." — Brad Medairy The way that we've seen models be able to rip apart these [OT] environments, understand the protocols, understand the control system, it's really phenomenal in terms of the capabilities that they provide… the risk to critical infrastructure is at an all-time high." — Brad Medairy "I don't think that we're going to defeat the threat of the future that's so transformative by just automating past operating models and approaches." — Brad Medairy "These adversary capabilities are progressing much faster than cyber defenses. And so you're gonna have to continually assess your environment, continually assess your controls, continually evolve your program." — Brad Medairy "We're inventing new operating models, we're inventing new technologies for cybersecurity. And I think now is our time to really define the future. It's going to take… really working this problem together." — Brad Medairy Resources discussed Booz Allen's Cyber Weapons Index McCrary Institute–Booz Allen joint paper: "AI-enabled threats demand mission-speed resilience – here's how to build it" McCrary Institute–Booz Allen joint paper: "Outpacing AI-enabled cyber threats: A playbook for government CISOs" About the Guest: Brad Medairy is president of Booz Allen's national cyber business, leading the development of defensive and offensive cyber solutions to address America's toughest cyber challenges. His work spans AI, machine learning, cloud innovation, and intelligence tradecraft. He leads thousands of cyber operators, security researchers, and software engineers who secure supply chains, protect critical infrastructure, and defend 5G networks, space systems, and advanced weapons platforms. His team counters sophisticated adversaries for customers including the intelligence community, U.S. Cyber Command, FBI, CISA, and the Department of War.

    Is Critical Infrastructure Ready for AI Attacks? with Booz Allen's Brad Medairy

  5. Oct 12 ·  Video

    When Seeing Isn't Believing: Combatting Deepfakes with iProov's Dominic Forrest

    How do you know the person on the other end of a video call is who they claim to be? For Cybersecurity Awareness Month, host Frank Cilluffo welcomes iProov Chief Technology Officer Dominic Forrest to Cyber Focus to discuss how deepfakes are changing fraud, cybersecurity, and digital trust. Forrest demonstrates how a single photograph can be used to impersonate someone on video and explains why awareness alone isn't enough. The conversation examines how impersonation can give attackers access to organizations, what protections employees and consumers need, and how leaders can evaluate defenses. They also explore the challenge of verifying that AI agents are acting with a person's authorization. Main Topics Convincing deepfakes made with free software Why familiar faces and voices aren't proof of identity Verifying identity and genuine presence Fake employees and critical infrastructure access Securing onboarding and account recovery Protecting consumers from impersonation scams Testing and updating deepfake defenses Verifying human authorization for AI agents Key Quotes "I've spent the last 13 years of my life looking at fake faces, and I know today I can't tell the difference between a fake face and a genuine face on a Teams call or on the end of a camera."— Dominic Forrest "But you cannot put this on the consumer. In the same way as in companies, we do not put phishing entirely on the employee." — Dominic Forrest "The test I use is if I was in a street and there was a curtain in front of me, would I hand the money through the curtain if I could not see who was on the far side? Because you cannot trust what it is you can see." — Dominic Forrest "But sometimes at those critical moments, you have to bring it back to the human and say, did this person who I know and I trust authorize this? And is the action that's taking place actually the action that they authorized?" — Dominic Forrest "The test I use is if I was in a street and there was a curtain in front of me, would I hand the money through the curtain if I could not see who was on the far side? Because you cannot trust what it is you can see." — Dominic Forrest Resources Mentioned iProov CEN/TS 18099 Human Agency Protocol About the Guest: Dominic Forrest is responsible for iProov's technology vision, strategy, and roadmap which includes the design and development of its cloud-based infrastructure. Dominic has more than 25 years of experience in senior roles in telecommunications companies and internet service providers managing the implementation of large-scale projects including the launch of NTL's broadband service to over two million customers.

    When Seeing Isn't Believing: Combatting Deepfakes with iProov's Dominic Forrest

  6. Oct 6 ·  Video

    Pushing Cyber Planning Beyond Prevention with Stephanie Crowe and Nick Andersen

    Keeping power, water, and other essential services running requires planning for what happens when cyber defenses fail. On this episode of Cyber Focus, Frank Cilluffo speaks with Stephanie Crowe, head of the Australian Cyber Security Centre, and Nick Andersen, acting director of the Cybersecurity and Infrastructure Security Agency (CISA), about how two close allies are preparing critical infrastructure to operate through compromise. The conversation examines how governments and industry identify their most critical systems, turn shared intelligence into joint action, and prepare for attacks that cross sectors and borders. Crowe and Andersen also discuss how AI is changing cyber defense and what that means for infrastructure investment, workforce skills, and decisions in the boardroom. Main Topics Operating through cyberattacks Protecting critical assets and dependencies China's infrastructure prepositioning CI Fortify and joint industry planning U.S.-Australia and Five Eyes cooperation AI defense and aging infrastructure AI's energy demands Workforce skills and boardroom decisions Key Quotes "You have to be able to fight through compromise now, which is a really different way of thinking about the cyber threat." — Stephanie Crowe "We've come a long way from thinking about our number one cyber risk being data breaches and theft of information into a world where service disruption is now the thing that we have to really consider and plan in our cyber risk management." — Stephanie Crowe "And just to be completely honest, Australia really bailed us out when we were in the middle of our shutdown… Australia led from the front." — Nick Andersen "If the Congress decided that in the next budget that CISA needed to be quintupled in size, we're still not going to have enough resources to be able to meet every single area that we'd like to be able to stray into with our attention." — Nick Andersen "We know that we're seeing exceedingly aggressive, well-orchestrated campaigns, in particular from entities like China, that are engaged in a significant way to preposition across our critical infrastructure to hold it at risk at a time and place of their choosing." — Nick Andersen Links and Resources Cybersecurity and Infrastructure Security Agency (CISA) Australian Cyber Security Centre: Guidance and Resources About the Guests: Stephanie Crowe is Deputy Director-General of the Australian Signals Directorate and Head of the Australian Cyber Security Centre. She has held senior roles in signals intelligence and cybersecurity, leading efforts to strengthen Australia's cyber defenses, build threat intelligence capabilities, and support industry during major cyber incidents. Nick Andersen is Acting Director of the Cybersecurity and Infrastructure Security Agency (CISA), where he leads efforts to reduce risks to America's cyber and physical infrastructure. A U.S. Marine Corps veteran, he has held senior cybersecurity roles at the Department of Energy, the White House, and in the private sector.

    Pushing Cyber Planning Beyond Prevention with Stephanie Crowe and Nick Andersen

  7. Sep 29 ·  Video

    CISA, AI, and the Future of the Federal Workforce with Rep. James Walkinshaw

    As AI expands the capabilities of cyber adversaries, does the federal government have the workforce and tools to keep pace? Rep. James Walkinshaw of Virginia joins Frank Cilluffo to discuss cuts at the Cybersecurity and Infrastructure Security Agency (CISA), their implications for critical infrastructure, and his push for an independent assessment of the agency's capacity. They also examine responsible AI adoption in government, the risks of unauthorized AI tools, and the public anxieties driving opposition to data centers. Walkinshaw outlines efforts to strengthen the federal technology workforce, streamline security approvals, and improve accountability for basic cybersecurity practices. Main Topics CISA staffing and readiness Local cybersecurity support Federal cyber workforce Responsible AI adoption Shadow AI risks Data centers and public trust FedRAMP reform CLEAR Act and event logging Bipartisan cyber leadership Key Quotes "At the precise moment when we most needed CISA to be operating at peak efficiency, it was systematically dismantled." — Rep. James Walkinshaw "When it comes to AI especially, cybersecurity can't be an afterthought. It has to be built in from the very beginning." — Rep. James Walkinshaw "People are starting to see data centers as the physical embodiment of the anxieties we all have around AI." — Rep. James Walkinshaw "If you want to bring progress in AI to a screeching halt overnight, that will happen if something goes really, really bad. If you don't get the safety piece right." — Rep. James Walkinshaw "Federal agencies currently are not even meeting the requirements in terms of event logging. They certainly, for the most part, couldn't answer any of those questions about time to detect or time to mitigate. So our CLEAR Act will require some reporting to Congress around event logging." — Rep. James Walkinshaw Links and Resources The CLEAR Act: Walkinshaw and Bacon's announcement FedRAMP CISA: State and Local Cybersecurity Grant Program updates About the Guest:   Rep. James Walkinshaw represents Virginia's 11th Congressional District and serves on the House Homeland Security and Oversight and Government Reform committees. Before entering Congress, he served on the Fairfax County Board of Supervisors and spent more than a decade as chief of staff to Rep. Gerry Connolly. He is also founder and co-chair of the Congressional Federal Workforce Caucus.

    CISA, AI, and the Future of the Federal Workforce with Rep. James Walkinshaw

  8. Sep 22 ·  Video

    Who's in Control of the AI Race? with Bill Evanina and Matt Hayden

    Can the United States compete with China in AI while managing the risks the technology creates? Host Frank Cilluffo welcomes McCrary Institute senior fellows Bill Evanina and Matt Hayden for a discussion of the difficult choices behind that question. Evanina, who previously led U.S. counterintelligence, and Hayden, a former senior CISA official now at GDIT, assess expectations for the Trump–Xi summit, the limits of cyber cooperation, and the trade-offs behind chip export controls. The conversation also examines Chinese influence efforts surrounding data centers, the importance of energy to AI competition, the stakes of quantum computing, and whether familiar approaches to accountability can work when an AI agent becomes an insider threat. Main topics Trump–Xi summit expectations Volt Typhoon and cyber deterrence Chip exports and technology theft S.–China crisis communications Chinese influence on data center debates AI, energy, and the quantum race AI safeguards and accountability Taiwan and semiconductor dependence Key quotes "We cannot be AI dominant unless we're energy dominant. We can't be. And when you look at AI, it's not AI in its own, it's that it accelerates everything else." ­­— Frank Cilluffo "And so when we look at AI, it's not a matter of having the most advanced models. That helps. But it is a matter of getting that implementation into every corner of industry so that those efficiencies are known and used." — Matt Hayden "The big question is AI— should it be considered an insider threat? And the answer was a resounding yes. But what do we do with insider threats? We try to catch them and prosecute them. Are we going to prosecute an AI agent?" —Bill Evanina "From a pure liability standpoint of who we can blame, there's no AI agent that operates without compute. And so somebody's got to empower this thing at an original sin level." — Matt Hayden "As a metaphor, AI is a supermarket gas station on the highway to quantum. ... Whoever wins quantum, they say wins the world. I think you have to win AI before you win quantum." — Bill Evanina Links and resources CISA: Volt Typhoon and persistent access to U.S. critical infrastructure   About the guests: Bill Evanina is a McCrary Institute senior fellow and founder and CEO of the Evanina Group. He previously directed the National Counterintelligence and Security Center, leading U.S. government counterintelligence efforts, and held senior roles at the FBI and CIA. Matt Hayden is a McCrary Institute senior fellow and vice president of cyber and emerging threats at General Dynamics Information Technology. He previously served as assistant secretary for cyber, infrastructure, risk and resilience policy at the Department of Homeland Security and as senior advisor to the director of CISA.

    Who's in Control of the AI Race? with Bill Evanina and Matt Hayden
See All (151)

Trailer

5
out of 5
18 Ratings

About

As cyber threats evolve faster than policy, Cyber Focus delivers executive-level briefings on cybersecurity, national security, and critical infrastructure. From the McCrary Institute for Cyber and Critical Infrastructure Security at Auburn University, host Frank Cilluffo speaks with senior leaders across government, industry, and the intelligence community about ransomware, state-sponsored threats, AI, and the systems we all rely on—energy, water, telecom, and supply chains. Each episode focuses on real-world risk tradeoffs and practical steps organizations can take to strengthen resilience.

Information

You Might Also Like