Cyber Focus: Cybersecurity, National Security, and Critical Infrastructure

Frank Cilluffo / McCrary Institute

As cyber threats evolve faster than policy, Cyber Focus delivers executive-level briefings on cybersecurity, national security, and critical infrastructure. From the McCrary Institute for Cyber and Critical Infrastructure Security at Auburn University, host Frank Cilluffo speaks with senior leaders across government, industry, and the intelligence community about ransomware, state-sponsored threats, AI, and the systems we all rely on—energy, water, telecom, and supply chains. Each episode focuses on real-world risk tradeoffs and practical steps organizations can take to strengthen resilience.

  1. Estonia's Lessons for the Cyber Future with Ambassador Kristjan Prikk

    3d ago ·  Video

    Estonia's Lessons for the Cyber Future with Ambassador Kristjan Prikk

    For Estonia, cyber resilience is not an abstract policy goal. It is a national survival issue shaped by history, geography, and the reality of living next to Russia. In this episode, Ambassador Kristjan Prikk explains how Estonia turned a lack of legacy infrastructure into a digital advantage, why the 2007 cyberattacks became a strategic wake-up call for the West, and what Ukraine's defense against Russia reveals about preparation, public-private cooperation, and the future of conflict. The conversation also looks ahead: to AI in government and education, to Estonia's support for Ukraine, and to the cyber lessons NATO must operationalize before the next crisis. At the center is a clear argument from one of the world's most digitally advanced democracies: cyber defense is not just about hardening systems, but building the relationships, institutions, and resilience needed to keep a society functioning under pressure. Main Topics Covered Estonia's digital transformation Life after Soviet occupation The 2007 cyberattacks Resilience over perfect defense Ukraine's cyber defense Private-sector support in wartime AI in government and education Support for Ukraine NATO's cyber priorities Key Quotes "We had a really strong incentive to go ahead and try out something almost crazy, something that no one had ever tried before, and just see what's going to happen." — Ambassador Kristjan Prikk "We believe that our kids will not lose [their] jobs to AI, but rather they may risk losing their jobs to other kids who know how to use AI better than them." — Ambassador Kristjan Prikk "We reduce or limit the risk of particularly high impact threats, risks materializing. But then again, the more important part is the ability to rebound; the ability to use alternatives if plan A is not working." — Ambassador Kristjan Prikk  "The way the cyberspace is set up means that we cannot only be confined in our own quarters and expect that if we keep it in order, then nothing happens." — Ambassador Kristjan Prikk  "Cybersecurity is a team sport…we have to make sure that when the problem appears, then we don't have to start searching for contacts of other people. The organization has to be there." — Ambassador Kristjan Prikk Relevant Links and Resources Embassy of Estonia in Washington, D.C. Estonia's national cybersecurity strategy or cyber agency resources Tallinn Mechanism information page IT Coalition for Ukraine information page About the Guest: Kristjan Prikk has served as Estonia's Ambassador to the United States since May 2021, and will soon serve as Estonia's Ambassador to NATO. Before assuming his current duties, Prikk served for nearly three years as the Permanent Secretary of the Estonian Ministry of Defense. In this role he was responsible for the management of the Ministry and for the coordination of activities of the agencies under the Ministry, including the Estonian Defense Forces, the Estonian Foreign Intelligence Service, and the Centre for Defense Investments.

    38 min
  2. Who's Accountable When AI Acts? — With Walter Haydock

    May 19 ·  Video

    Who's Accountable When AI Acts? — With Walter Haydock

    In this episode of Cyber Focus, Frank Cilluffo speaks with Walter Haydock, founder of StackAware, about the accountability, governance, and national security challenges emerging as organizations rush to deploy artificial intelligence. Haydock argues that AI does not erase familiar cybersecurity and risk-management problems; it accelerates them. From non-human identities and AI agents to third-party risk, federal regulation, and the environmental demands of AI infrastructure, the conversation centers on a core question: who is accountable when AI systems act, fail, or cause harm? Rather than treating AI governance as a compliance checklist, Haydock makes the case for assigning clear ownership, focusing policy on outcomes, and giving business leaders—not risk advisors alone—responsibility for the risks their organizations accept. Main Topics Covered AI accountability and non-human identities Managing AI agents as unpredictable actors Who should own AI risk inside an organization Third-party risk, supply chains, and contractual accountability Avoiding checkbox compliance in AI governance National AI policy, innovation, and strategic competition Key Quotes: "I see organizations spending a lot of time, money, resources, brain power on low-impact problems, on things that they shouldn't be focused on, and instead they're kind of ignoring the higher-risk issues that have easier mitigations, easier solutions." — Walter Haydock "The question of who is accountable for a given outcome is a critically important one." — Walter Haydock "At the level of an individual business, I think it's important to assign accountability for actions of AI agents to cross-functional business leaders who have the wherewithal, the full understanding of all the issues that are impacting a given company." — Walter Haydock "The framework I use is that business leaders are risk and system owners. They are ultimately accountable. They make the final decisions." — Walter Haydock "When the government hard codes in supposed best practices, they end up creating perverse incentives where companies are focused very closely on checking the box and not necessarily on getting the good outcome." — Walter Haydock Relevant Links and Resources Stack Aware Guest Bio Walter Haydock is the founder of StackAware, an AI security and governance company. Before founding StackAware, he worked in government, national security, and the military, including service on the House Homeland Security Committee, at the National Counterterrorism Center, and in the U.S. Marine Corps in intelligence and reconnaissance roles.

    32 min
  3. The End of Human-Speed Cyber: Mythos, Glasswing & the AI Exploit Race with CrowdStrike's Drew Bagley

    May 12 ·  Video

    The End of Human-Speed Cyber: Mythos, Glasswing & the AI Exploit Race with CrowdStrike's Drew Bagley

    Cyber defense is entering a machine-speed era. With Anthropic's Mythos and Project Glasswing bringing AI-driven vulnerability discovery and exploit development into the center of the cyber conversation, CrowdStrike's Drew Bagley says organizations need to prepare for a world where vulnerabilities can be found, chained, and exploited faster than traditional patching cycles can handle. Bagley joins Frank Cilluffo to explain why this shift is not just about one model, one company, or one headline-grabbing project. It points to a broader change in how attackers and defenders will operate: exploit stacks may make once-latent vulnerabilities newly dangerous, critical infrastructure operators may face risks they cannot patch away, and unmanaged AI agents inside organizations may become another source of exposure. The answer, Bagley argues, is not panic or patching alone, but continuous discovery, continuous remediation, visibility across the kill chain, AI-powered defense, and resilience planning built for a world moving faster than human-speed cyber. Main Topics Covered Mythos, Project Glasswing, and AI-driven vulnerability discovery Why exploit stacks change how organizations should think about risk Continuous patching, prioritization, and machine-speed defense Critical infrastructure, OT systems, and unpatchable legacy technology AI agents, unmanaged access, and the next insider-style risk Key Quotes "We're now in an era in which AI has been proven to be able to find vulnerabilities and write exploits at scale much quicker than humans can." — Drew Bagley "We should think about this as an opportunity to think through this problem set now and assume that this is going to be just a widespread capability pretty soon." — Drew Bagley "Previously latent [OT] vulnerabilities… [relied on] security through obscurity. That's no longer the case. And now those are exploitable." — Drew Bagley "If you don't have visibility and you can't see the risk, then you can't mitigate the risk." — Drew Bagley "It's important to think about the ways in which AI has been incorporated over the past two years, especially in organizations to get work done better, but in ways that have often been unmanaged where AI has access to things you wouldn't give an intern access to." — Drew Bagley Relevant Links and Resources Anthropic's Project Glasswing CrowdStrike's Project Quiltworks Guest Bio:   Drew Bagley is CrowdStrike's Chief Privacy Officer, where he leads the company's privacy and public policy work. In his 12 years at CrowdStrike, he has helped shape the company's approach to data protection, cybersecurity policy, and engagement with government leaders as CrowdStrike grew into a global cybersecurity company.

    34 min
  4. What Most People Get Wrong About Secure Messaging with Signal CTO Ehren Kret

    May 5 ·  Video

    What Most People Get Wrong About Secure Messaging with Signal CTO Ehren Kret

    Most people think secure messaging begins and ends with encryption. Signal CTO Ehren Kret says that is only part of the picture. In this episode of Cyber Focus, host Frank Cilluffo sits down with Kret to discuss what private communication really requires, from protecting message content to limiting what platforms can learn from metadata, identity, group membership and social graphs. Kret explains how Signal's nonprofit model shapes its privacy-first design choices, why endpoint security remains a major challenge, and how AI built into operating systems could create new risks for private communication. The conversation also explores post-quantum encryption, lawful access debates, phishing threats against messaging accounts, and why the future of secure communication depends not only on better technology, but on helping users understand what is and is not truly private. Main Topics Secure messaging misconceptions Metadata and social graphs Endpoint security risks AI and platform privacy Post-quantum encryption Signal's nonprofit model Key Quotes "Disappearing messages, and that's one piece of the puzzle... But a lot of people think that's sort of the end." — Ehren Kret "You should also be looking at does your service provider have access to the message content and is it protected from visibility from them?" — Ehren Kret  "Being able to build a social graph can reveal information, even though you don't necessarily have the message content, it is highly leaky. You can infer from a social graph, you can see who is talking to who, and a lot of times that reveals information about the content of those communications ." — Ehren Kret "Signal...is an anti mass surveillance tool. It's not necessarily an anti targeted surveillance tool because at the end of the day your phone is still an endpoint that can be targeted." — Ehren Kret "Since it's a nonprofit, the primary goal for Signal is to spread the use of end-to-end encrypted for messaging and for communications in general." — Ehren Kret Relevant Links and Resources Signal Foundation Signal: Sealed Sender Signal: Quantum Resistance and the Signal Protocol Cloudflare Post-Quantum Roadmap Google Research on Quantum Vulnerabilities About Ehren Kret Ehren Kret is the Chief Technology Officer at Signal, where he helps lead the development of privacy-preserving communication technology. He previously served as an engineering director at WhatsApp, where he helped scale end-to-end encryption for more than a billion users.

    32 min
  5. How Idaho National Laboratory Is Building the Future of Infrastructure Security with Zach Tudor

    Apr 27 ·  Video

    How Idaho National Laboratory Is Building the Future of Infrastructure Security with Zach Tudor

    America is asking more from its critical infrastructure just as adversaries are finding more ways to target it. AI, data centers, electrification, and next-generation energy systems all depend on operational technology—the control systems that keep power, water, transportation, and industry moving. As that backbone grows more connected, the stakes of securing it grow even higher. In this episode of Cyber Focus, Frank Cilluffo speaks with Zach Tudor, Associate Laboratory Director at Idaho National Laboratory, about how INL tests and secures critical infrastructure at scale. Tudor explains why resilience must guide infrastructure defense, what Ukraine and China reveal about the risks facing critical infrastructure, and why cyber-informed engineering is essential as new technologies move into energy, nuclear, wireless, and industrial systems. The conversation also covers AI's role in control environments, the workforce needed to secure future infrastructure, and the challenge of moving faster before a major event forces action. Main Topics Covered INL's critical infrastructure mission Testing infrastructure at scale OT security and resilience AI risks in control systems Cyber-informed engineering Workforce needs for energy security Key Quotes "No infrastructure is impervious to attack." — Zach Tudor "I think we're getting to the point where, if you are delivering power to the nation, then you are a risk professional as well as a power engineer." — Zach Tudor "Resilience for me is not just the preparation for an attack or the response to an attack, but the ability to mitigate the effects of an attack, to respond quickly, and to recover quickly as well." — Zach Tudor "We are a national lab in the public economic and national security interest. And so we'll do what needs to be done. We say that labs do what others can't, won't or shouldn't do." — Zach Tudor "The mindset of an engineer who's thinking about operations is different from the mindset of an IT security person who's protecting databases or privacy or other data." — Zach Tudor Relevant Links and Resources Idaho National Laboratory Department of Energy National Laboratories Cyber-Informed Engineering (CIE) Guest Bio Zach Tudor is Associate Laboratory Director for National and Homeland Security at Idaho National Laboratory, where he leads programs focused on critical infrastructure protection, operational technology security, and national security innovation. He previously served at the Department of Homeland Security's ICS-CERT and is a former U.S. Navy submariner. Tudor has spent decades working at the intersection of cybersecurity, energy systems, and national defense.

    34 min
  6. Hacking Reputation: Disinformation, Trust, and Cyber Crisis Response with Preston Golson

    Apr 21 ·  Video

    Hacking Reputation: Disinformation, Trust, and Cyber Crisis Response with Preston Golson

    A cyber incident can damage far more than systems and networks. It can also become a reputational crisis, especially when false or misleading narratives move faster than facts. In this episode of Cyber Focus, Frank Cilluffo speaks with Preston Golson of Brunswick Group about why organizations need to treat reputation as a vulnerability that can be tested, stress-tested, and defended much like any other part of their cyber posture. Drawing on his work in cyber incident response and his earlier career at the CIA, Golson explains how misinformation and disinformation take hold, why many damaging narratives are foreseeable, and how companies can prepare before a crisis hits. The conversation explores red teaming, "prebunking," unified crisis response, and the growing importance of trust, credibility, and AI-generated search results in shaping public perception. For leaders trying to manage cyber risk in a more volatile information environment, this episode offers a practical framework for thinking about reputation, crisis communications, and resilience. Main Topics Covered Reputation as a cyber target Disinformation and viral narratives Red teaming reputational risk Cyber crisis communications Prebunking and digital inoculation Key Quotes "Misinformation is like a forest fire and we live in a forest with combustible conditions … false and misleading narratives can be caught quickly and they can affect a company's license to operate." — Preston Golson   "If you have a dedicated team to look for [reputational risks], you can hack your own reputation, understand where your vulnerabilities are and then reverse engineer defenses and proactive communications … to help build resiliency amongst your audiences." — Preston Golson "We don't play whack a mole. Not every narrative deserves a response. As a matter of fact, some narrative, if you give them a response, it'll give it more oxygen." — Preston Golson "What effective [misinformation] narratives are doing are playing on people's insecurities, [and] people's desire to understand a world that is increasingly complex. It doesn't always make sense." — Preston Golson "Ransomware really did democratize cyber. Everyone's a target from the biggest Fortune 10 down to every mom and pop shop..." — Frank Cilluffo Relevant Links and Resources Brunswick Group Preston Golson's article, "Hacking Reputation" Guest Bio Preston Golson is a director at Brunswick Group, where he works on cyber incident response and related communications challenges. Before joining Brunswick, he spent more than 15 years at the Central Intelligence Agency. In this episode, he draws on that experience to discuss cyber crisis response, disinformation, reputational risk, and how organizations can prepare for false or misleading narratives before they take hold.

    24 min
  7. Cult of the Dead Cow and the Roots of Modern Cyber Ethics with Joe Menn

    Apr 13 ·  Video

    Cult of the Dead Cow and the Roots of Modern Cyber Ethics with Joe Menn

    Cybersecurity's history is often told through breaches, crime, and disruption. Joe Menn argues that the story of early hacker culture also offers something constructive: a model for how technical curiosity, ethical reflection, and independent thinking can shape the public good. Drawing from his work on Cult of the Dead Cow, Menn traces how figures once associated with pranks, underground tools, and legal gray zones helped influence vulnerability disclosure, hacktivism, privacy debates, and even the way government and major companies think about security today. But the episode does not stay in the past. Menn connects those earlier lessons to much more current concerns: digital surveillance, the tightening relationship between big tech and government, and the security risks emerging from the rush into AI. The result is a conversation about far more than hacker lore. It is about who gets to shape technology, what values guide that work, and why critical thinking itself may now be part of the infrastructure worth defending. Main Topics Covered The legacy of Cult of the Dead Cow The evolution of hacktivism Ethics and critical thinking in cyber Surveillance, privacy, and state power AI security and concentrated tech influence Key Quotes "I think it's very interesting to me that... any Fortune 100 CISO who's in his mid-50s or older broke the law as a teenager." — Joe Menn "Hackers are by definition, if they're any good, are critical thinkers, because they're taking stuff and saying, well, okay, this is the intended purpose. What else can it do? What else can I make it do?" ­— Joe Menn "Hackers should be big players in legislation and in protecting critical infrastructure, and all these other things because they are critical thinkers and won't just repeat what the conventional wisdom is. You get value from people who are thinking differently. — Joe Menn "[A]t the most recent inauguration, you had Jeff Bezos and Mark Zuckerberg, and I believe Elon Musk standing closer to Trump than his cabinet members. The allegiance of big tech is actually more important than some of the entire branches of government. And their interests are now, by and large, very closely joined." — Joe Menn "[W]henever there's a new exciting technology; people rush into it and then sometime later they figure out about security ... And right now, there's this land rush where all the vulnerabilities are now visible through the wonder of AI. And so, tech debt that was swept under the rug is now become a forest fire." — Joe Menn Relevant Links and Resources  Cult of the Dead Cow Fatal System Error    Citizen Lab About the Guest Joe Menn is a longtime technology reporter and author who has covered cybersecurity, privacy, and related policy issues for decades. In the episode, Frank Cilluffo notes that Menn has written for The Washington Post, Financial Times, Reuters, and the Los Angeles Times, and is the author of two bestselling cybersecurity books, including Cult of the Dead Cow.

    34 min
  8. From Fax Machines to Quantum: Canada's Sami Khoury Reflects on Three Decades in Cyber

    Apr 7 ·  Video

    From Fax Machines to Quantum: Canada's Sami Khoury Reflects on Three Decades in Cyber

    Cybersecurity now reaches far beyond government networks and traditional IT systems. In this episode, Sami Khoury explains how the threat environment increasingly touches critical infrastructure, operational technology, undersea cables, and space—and why that shift is pushing governments to work more closely with private industry and trusted international partners. Drawing on more than three decades in Canadian government, Khoury offers a clear view of how Canada has built out its cyber posture, how the Canadian Centre for Cyber Security fits into that mission, and where the threat is evolving fastest. He also reflects on the growing overlap between nation-state activity, cybercrime, and hacktivism; the promise and risk of AI; the long transition toward post-quantum security; and the enduring pull of public service in a field where the stakes keep rising. Main Topics Covered Canada's cyber strategy Critical infrastructure security OT, undersea cables, and space AI and post-quantum risk Public-private and international partnership Key Quotes:  "When cyber came about or when we started paying attention to cyber, it was predominantly an IT issue. But unfortunately, these days it's not just an IT issue and we have to pay attention to OT." — Sami Khoury "We know that cyber, and it might be cliche, cyber knows no border." — Sami Khoury  "We welcome people from different educational background because it's the analytical thinking capacity that we're looking for, not critical thinking skills. It's not necessarily that you're the best coder or that you are the best hardware architect. We want people with the critical thinking skills." — Sami Khoury "The day there's a cryptographically relevant quantum computer that can break today's encryption will not, I presume, will not come with a press release." — Sami Khoury "It's no longer government on government, it's government on private sector, it's mercenaries on private sector, it's mercenaries on government or hacktivist on government. So it's completely asymmetric and it takes a whole team to basically make a difference." — Sami Khoury Relevant Links and Resources Canadian Centre for Cyber Security  Canada's national cyber threat assessment Canada's AI strategy Canada's Post-quantum encryption bulletin Guest Bio: Sami Khoury is the Government of Canada Senior Official for Cyber Security and the former head of the Canadian Centre for Cyber Security. He has spent over 30 years in the Canadian government, primarily within the Communications Security Establishment (CSE), Canada's signals intelligence and cryptologic agency. A veteran of the "Five Eyes" intelligence community, Khoury has been instrumental in shaping Canada's national cyber strategy and fostering deep operational ties with international partners.

    25 min
See All (126)

Trailer

5
out of 5
18 Ratings

About

As cyber threats evolve faster than policy, Cyber Focus delivers executive-level briefings on cybersecurity, national security, and critical infrastructure. From the McCrary Institute for Cyber and Critical Infrastructure Security at Auburn University, host Frank Cilluffo speaks with senior leaders across government, industry, and the intelligence community about ransomware, state-sponsored threats, AI, and the systems we all rely on—energy, water, telecom, and supply chains. Each episode focuses on real-world risk tradeoffs and practical steps organizations can take to strengthen resilience.

Information

You Might Also Like