close
close
Your Network of Tomorrow
Your Network of Tomorrow
Plan your path toward a faster, more secure, and more resilient network designed for the applications and users that you support.
          Experience Netskope
          Get Hands-on With the Netskope Platform
          Here's your chance to experience the Netskope One single-cloud platform first-hand. Sign up for self-paced, hands-on labs, join us for monthly live product demos, take a free test drive of Netskope Private Access, or join us for a live, instructor-led workshops.
            A Leader in SSE. Now a Leader in Single-Vendor SASE.
            A Leader in SSE. Now a Leader in Single-Vendor SASE.
            Netskope debuts as a Leader in the Gartner® Magic Quadrant™ for Single-Vendor SASE
              Securing Generative AI for Dummies
              Securing Generative AI for Dummies
              Learn how your organization can balance the innovative potential of generative AI with robust data security practices.
                Modern data loss prevention (DLP) for Dummies eBook
                Modern Data Loss Prevention (DLP) for Dummies
                Get tips and tricks for transitioning to a cloud-delivered DLP.
                  Modern SD-WAN for SASE Dummies Book
                  Modern SD-WAN for SASE Dummies
                  Stop playing catch up with your networking architecture
                    Understanding where the risk lies
                    Advanced Analytics transforms the way security operations teams apply data-driven insights to implement better policies. With Advanced Analytics, you can identify trends, zero in on areas of concern and use the data to take action.
                        The 6 Most Compelling Use Cases for Complete Legacy VPN Replacement
                        The 6 Most Compelling Use Cases for Complete Legacy VPN Replacement
                        Netskope One Private Access is the only solution that allows you to retire your VPN for good.
                          Colgate-Palmolive Safeguards its "Intellectual Property” with Smart and Adaptable Data Protection
                          Colgate-Palmolive Safeguards its "Intellectual Property” with Smart and Adaptable Data Protection
                            Netskope GovCloud
                            Netskope achieves FedRAMP High Authorization
                            Choose Netskope GovCloud to accelerate your agency’s transformation.
                              Let's Do Great Things Together
                              Netskope’s partner-centric go-to-market strategy enables our partners to maximize their growth and profitability while transforming enterprise security.
                                Netskope solutions
                                Netskope Cloud Exchange
                                Netskope Cloud Exchange (CE) provides customers with powerful integration tools to leverage investments across their security posture.
                                  Netskope Technical Support
                                  Netskope Technical Support
                                  Our qualified support engineers are located worldwide and have diverse backgrounds in cloud security, networking, virtualization, content delivery, and software development, ensuring timely and quality technical assistance
                                    Netskope video
                                    Netskope Training
                                    Netskope training will help you become a cloud security expert. We are here to help you secure your digital transformation journey and make the most of your cloud, web, and private applications.

                                      In this episode of Security Visionaries, host Max Havey is closing out the year with a look back on some of the major threat trends from 2024 with guest Ray Canzanese, Director of Netskope Threat Labs. In their conversation, Max and Ray discuss the new frontier of AI-enabled threats and the proliferation of deepfakes used in social engineering attacks, as well as the landscape of nation-state attacks. Additionally, they also dig into the trend that surprised Ray the most, seeing phishing attacks continue to rise and their conversation concludes with a discussion of the cognitive burden that comes with users being bombarded with phishing at every turn.

                                      We’ll continue to see AI used for phishing and deep fakes and scams, and it’s going to be a really challenging societal problem. It’s not just a problem that organizations are facing, of course, I’m worried about my employees. Of course I’m worried about my data, but everybody is facing these challenges worldwide.

                                      Ray Canzanese
                                      Director, Netskope Threat Labs
                                      Ray Canzanese

                                      And so I think that rethinking use of those platforms and how to control use of those platforms, to lower abuse is going to be a major topic in the coming year. I think from those of us in the cyber security industry, who are looking to secure organizations, I think our focus needs to be and will be on lowering the cognitive burden of users.

                                      Ray Canzanese
                                      Director, Netskope Threat Labs
                                      Ray Canzanese

                                       

                                      Timestamps

                                      *0:00: Introduction*10:46: Trends with nation-state attacks
                                      *0:26: The impact of AI on threat methodologies*13:32: Evolving nation-state trends in 2025
                                      *3:17: Generative AI abuse*15:52: The most surprising threat trend of 2024
                                      *4:23: AI and social engineering*19:32: Trends on the horizon for 2025
                                      *7:29: Organizational changes as a result of AI*21:54: Conclusion

                                       

                                      Other ways to listen:

                                      On this episode

                                      Ray Canzanese
                                      Director, Netskope Threat Labs

                                      chevron

                                      Ray Canzanese

                                      Ray is the Director of Netskope Threat Labs, which specializes in cloud-focused threat research. His background is in software anti-tamper, malware detection and classification, cloud security, sequential detection, and machine learning.

                                      LinkedIn logo

                                      Max Havey
                                      Senior Content Specialist at Netskope

                                      chevron

                                      Max Havey

                                      Max Havey is a Senior Content Specialist for Netskope’s corporate communications team. He is a graduate from the University of Missouri’s School of Journalism with both Bachelor’s and Master’s in Magazine Journalism. Max has worked as a content writer for startups in the software and life insurance industries, as well as edited ghostwriting from across multiple industries.

                                      LinkedIn logo

                                      Ray Canzanese

                                      Ray is the Director of Netskope Threat Labs, which specializes in cloud-focused threat research. His background is in software anti-tamper, malware detection and classification, cloud security, sequential detection, and machine learning.

                                      LinkedIn logo

                                      Max Havey

                                      Max Havey is a Senior Content Specialist for Netskope’s corporate communications team. He is a graduate from the University of Missouri’s School of Journalism with both Bachelor’s and Master’s in Magazine Journalism. Max has worked as a content writer for startups in the software and life insurance industries, as well as edited ghostwriting from across multiple industries.

                                      LinkedIn logo

                                      Episode transcript

                                      Open for transcript

                                      0:00:01.4 Max Havey: Hello, and welcome to another edition of Security Visionaries, a podcast all about the world of cyber, data and tech infrastructure, bringing together experts from around the world and across domains. I'm your host, Max Havey, and today we're taking a look back at some of the big threat trends of 2024, and looking ahead at what may be on the horizon in 2025 with our guest, Ray Canzanese, director of Netskope Threat Labs. Ray, thanks for joining us.

                                      0:00:25.1 Ray Canzanese: Oh, thanks for having me, Max.

                                      0:00:26.8 Max Havey: All right. So Ray, I'm gonna ask you some questions here about what you've seen over the past 12 months, and I'm hoping that you can use a mixture of some direct insights from your own research at Netskope, and also share some knowledge from your wider engagement and collaboration with the broader threat community. So, to start off, there's been a lot of talk about how AI is changing security. So let's start by asking, have you seen threat methodology that's been changed by AI this year?

                                      0:00:54.2 Ray Canzanese: I guess AI has been changing cybersecurity since its inception. Cybersecurity is newer than AI. We've seen it since the beginning. It started with heuristics, then machine learning, which continued to become more and more advanced. Now GenAI. So, of course, it's changing the industry as it always has. In the past year we saw GenAI tools being way more heavily used by attackers. They've become really useful tool for social engineering and scams. We've seen lots of fun, deep fake celebrity endorsements. You've got some celebrity selling something. All you have to do is give it your social security number, all your bank account information, all your credit cards, and that of all your friends. And then you'll get, I don't know, whatever weird new invention they're selling. We've seen fake CEOs requesting help from employees. For business email compromise and other types of attacks. We also have found that some enterprising attackers decided they could sell their own LLMs. And so we have LLMs being sold that are specifically used for things like business email compromise, and inherently nefarious things.

                                      0:02:09.7 Ray Canzanese: On the other end of the spectrum, we see all of the new technology being used by defenders as well, especially with LLMs, which are really good at taking massive amounts of data and making it easier to understand. That's the perfect tool for cybersecurity. All of us cybersecurity professionals are drowning in data, more data than we will ever be able to look at. And so having tools that can examine that data, summarize that data, and give us something we can quickly understand, that's a fantastic tool for a security professional. And so the other thing I guess, that AI has changed, is there's now a new class of tools that we all have to worry about as cybersecurity professionals. So not just worried about all of the good and bad that come with the GenAI tools, but also what about the tools themselves? Are they being used safely and securely? What types of data is being sent to them? Was the data that they were trained with poisoned? Is it accurate? How are people using the outputs? All of these fun new challenges coming with GenAI as well.

                                      0:03:17.1 Max Havey: Absolutely. And were there any specific threats or campaigns that stuck out to you in reviewing research from this year specifically around people abusing generative AI tools or finding some of those weak points in tools?

                                      0:03:30.0 Ray Canzanese: Well, as far as using the tools go, I think all of the social engineering where there was some deep fake. Either somebody's voice, a video of them, somebody joining a Zoom call, all of those to me really tie as the most convincing use of AI to build a social engineering bait that people honestly just weren't really well equipped to deal with. You're trained to hover your mouse over a link and see where it truly goes. What do you do when you get a phone call from Sanjay Barry, my CEO, and he's like, "Ray, quick, give me the bank account numbers, we need to transfer some money." There was no training that prepared me for that. And so all of those types of social engineering attacks are just really, really novel and make us rethink what we need to do in response.

                                      0:04:23.0 Max Havey: So it's a new frontier in all of that, and it takes learning how to identify those sorts of things that seem fishy in the general sense, not just the pH sense, but like what should people be looking out for when it comes to identifying those sorts of generative AI-enabled deep fake sort of social engineering ploys?

                                      0:04:41.1 Ray Canzanese: Yeah, it's a good question, and I think it's not a simple question either. 'cause if you were to ask me 20 years ago, what should people look out for in phishing emails, I can tell you what people should look out for in phishing emails. And then we fast forward 20 years and what's happening, people are still clicking on links and falling for phishing emails. There's already so much burden on the individual human already to make these decisions. So you tell them like, "Well, you should think more critically when you get a call from Sanjay Berry. Does Sanjay normally call you? Does he normally ask you for bank account numbers?" And you say, "No, he doesn't normally do those things, I shouldn't fall for this." Or, "Is that really Elon Musk on YouTube right now asking me to give him $10,000?" No, Elon Musk doesn't need $10,000 from you. So you ask people to think more critically about those things, but the burden's also on those working in the cybersecurity industry. How do we lower that burden on the individual? To what extent can we just help them never see these scams, these phishing links, and to what extent can we just help them make more informed decisions.

                                      0:06:00.2 Ray Canzanese: I will never wholly know what is going on in your life when you are browsing the web and you are about to answer a phone call or click on a link. But I know something about the provenance of where that link came from, the likelihood that it's real. And to the extent that I can help you, that I can give you information that says, be careful when you're on this phone call, while I'm not really sure it is who it says it is, that makes things just a little bit easier on the human and hopefully makes us all a little bit more secure.

                                      0:06:36.0 Max Havey: Definitely, is having those tools in the right place and knowing how to use them and how to apply them in those situations where you don't have a cybersecurity professional looking over your shoulder at all times.

                                      0:06:46.3 Ray Canzanese: Right. And I was sort of anthropomorphizing myself as a cybersecurity tool there, but the concept is valid. It's that when you're using these tools, it's like somebody sitting there, watching what you're doing and trying to help you out, but they don't know everything. They don't know all the context about what you're doing, who you normally interact with. And so there's always a gray area. And helping the human deal with that gray area is something that we as cybersecurity professionals can do better about. When it's black and white, it's easy. When we can say, "Yes, this is definitely good, and yes, this is definitely bad." We can pat ourselves in the back for the win, but there's always that gray area, and that's the tough one.

                                      0:07:29.6 Max Havey: Certainly. Have you seen these evolving threat trends around AI reflected in organizational changes in the way that they secure AI or they use AI for security? How is that, how have you seen that sort of evolve this year?

                                      0:07:41.3 Ray Canzanese: Yeah. I think that 2024 was interesting, in comparison to 2023, I think 2023 was the year of like, AI in everything. Like, can you imagine how much better my toilet would be if it had AI? And in 2024, we seemed to have realized that you don't need AI in everything. And that if you tell me no, when I ask if I need to use 90 different AI apps to complete my job, that's an okay answer. 'Cause it turns out I don't need 90 different AI apps to be effective at my job. And so 2024 seemed to be the year of like the tightening of the screws. We saw more organizations just exert more control over what was going on. We saw the number of blocks increasing the, "We've decided that you're only allowed to use these three apps and we're gonna block all the others." That became a more common strategy.

                                      0:08:33.9 Ray Canzanese: The other thing that we really saw increase is that organizations who said yes to AI, which is the overwhelming majority of them, like above 94%. Now I think, it's, "Yes, but. " and they've put a lot of DLP controls around the AI apps. Specifically, they are looking at what people are posting and saying, "Well, is it regulated data? Is it secrets? Is it source code? Is it anything I don't want leaving my protected boundaries?" And if it's not either just stop you from doing it and say no, or do some to my earlier point, some coaching and say, "Hey, this looks like you're about to post something that looks like regulated data to ChatGPT. Are you sure?" Because we recommend that you don't do that. So you sort of empower the user when there's a gray area there to make the right choice.

                                      0:09:34.2 Max Havey: Absolutely. Having those sorts of stop-gaps and catching people in the nick of time before they do something like uploading corporate secrets to ChatGPT or something of the sort.

                                      0:09:43.4 Ray Canzanese: Right, right. 'Cause the answer might be that while this might look like a corporate secret to you, it's not really a secret. And I know that, and so I'm happy to continue, but we do find that that sort of strategy of just in-time coaching is a very effective one. The amount of times that somebody decides to continue after they've been prompted with a "Are you sure" type message is, it's less than half. It's a pretty effective control just to give somebody a gut check and ask them, "Are you really sure about this?" Just don't do it every time they click on anything. Make sure you're asking that question sparingly so it can maintain its effectiveness.

                                      0:10:26.4 Max Havey: Absolutely. So not to inundate them, but just in the most important circumstances.

                                      0:10:30.2 Ray Canzanese: Right, right. Like, "Are you sure you want to visit this website? Are you sure you want to click on that link?" You can see how that would very quickly get annoying. And your answer is just always automatically, "Yes." Because the answer is really just leave me alone, I'm trying to work here.

                                      0:10:46.3 Max Havey: Well, Ray, to shift gears here slightly, I've seen a lot more articles this year in the media about cyber threats and usually talking about the actions of nation state actors. I wanted to get a sense, did your research team pick up on any notable nation state cyber attack trends this year? And if so, what were those?

                                      0:11:04.6 Ray Canzanese: In general, the nation states, we saw where we had the most APT activity against our customers. And again, our customer base is global. We have customers in all continents, it was the usual parties. Russia, North Korea, Iran, China, were the top four by a big margin. Not really surprising because geopolitical cybersecurity activity is generally just a reflection of broader geopolitical trends. And so where you see conflicts, that is where you're going to see cybersecurity activity as well. And active APT groups. The second trend we saw there, we saw a lot of initial access brokers being very active. These are organizations whose specialty is just the infiltration, find a way in and then sell that way in to somebody else who has something they want to do with that way in. So this is part of that, like specialization within the adversary community. We saw lots of common tooling whenever there's a tool like Cobalt Strike, very powerful and effective command and control framework that has been hacked and modified so many times that it seems everybody's using it. So we see these common tools in terms of common trends, rather in terms of which tools are being used.

                                      0:12:30.0 Ray Canzanese: And then I guess the sort of final trend that we saw was that, in addition to this like traditional, let's call it cybersecurity activity of phishing and infiltration attempts and hacking and ransomware and all that stuff, we saw a lot of disinformation, a lot of espionage, a lot of attempts at destabilization, a lot of attempts at division. A lot of this happening in social media. And so you not only have this traditional cybersecurity activity, but you have a lot of this other stuff that's more out in the open and affecting everybody. And so it's just... To the earlier point of what do we expect out of the individual? And the individual is so overwhelmed. There's just so much noise. I don't know that I had to think so hard in my past about whether something I was reading in the news was true or not. And so we've just added so much more cognitive burden to everybody, and it's just making the cybersecurity landscape all that more challenging.

                                      0:13:33.1 Max Havey: Absolutely. And looking ahead, how do you expect these sorts of nation state trends to evolve in the coming year? Will it be the same nations? Do you expect these methodologies to evolve at all? What sort of your perspective on that?

                                      0:13:45.7 Ray Canzanese: Sure. In terms of what nations it's going to be, that's highly dependent on the geopolitical landscape. And I'm no expert in geopolitics, but I have been alive for a while and some things seem to have not changed in my lifetime. And so I don't really expect the geopolitical landscape to change very drastically in terms of where the conflicts are in the world over the next year. So I expect a lot of the same regions to be active in terms of APTs. I expect all this disinformation, destabilization, division to continue. It's seemingly effective. It's a really good... By good, I mean effective. Effective use of social media.

                                      0:14:27.9 Max Havey: Yes.

                                      0:14:28.2 Ray Canzanese: Definitely not a good use of social media. The other thing that I expect we will see is continued attacks on industries that have not historically invested in cybersecurity. We can't have a conversation about APT groups without talking about Salt Typhoon. So what did we have in the past year or two? We had Salt Typhoon going after the telecommunications infrastructure really throughout the world. And one of the common themes in the response from the telco companies when asked what's going on? And it's, "Well, we built these systems for efficiency, for availability. We didn't build these with modern cybersecurity concerns in mind." And so I expect to see more of that. You expect to see more of these successful infiltrations that go undetected for a long time because the cybersecurity infrastructure was not built in to that product or that industry from the beginning.

                                      0:15:28.7 Max Havey: Definitely. We had Kiersten Todt on our previous episode talking about her predictions for 2025 and talking about Salt Typhoon and expecting, I think more things in that vein looking ahead seem to be pretty high on her mind as well.

                                      0:15:42.0 Ray Canzanese: Yeah, absolutely. There's a lot of us spending a lot of time trying to learn every lesson we possibly can from what happened with the telco industry and Salt Typhoon.

                                      0:15:52.3 Max Havey: Almost certainly. And shifting gears again slightly, were there any specific threat trends this year that you saw that surprised you the most?

                                      0:16:01.1 Ray Canzanese: Yeah, it's really hard to be surprised when you've been doing this long enough, but there was something that surprised me a little bit, and it was that we actually saw more people clicking on phishing links this year compared to last year. And the reason, again, we talked about this a little bit, the reason I find that so surprising is that we spend so much time, and phishing seems to be such a core message when we do cybersecurity awareness training, how to spot a phish, how to avoid clicking on a phishing link. And so to see it really like roughly double year over year was a little like, "Oh no, what are we doing wrong?" And on the other hand, the reason it's not surprising at all is because it's everywhere now. The training says you receive an email. Make sure you scrutinize your email. But if you look at where people are clicking on these links for scams and phishing links, it's not email. They're clicking on links in social media, ads, search engine results, DMs they receive through messaging apps. It's just everywhere. And when something is everywhere, it becomes a lot harder to avoid. And that's, I think really what we've been seeing is just the inundation of phishing coming from every angle. You're eventually gonna catch somebody off guard, and they're eventually gonna click on one of those links. And unfortunately we had more people than usual doing so.

                                      0:17:32.1 Max Havey: Yeah. It's what happens when it turns into a numbers game, it's all quantity. And when you're getting it from DMs and text messages and phone calls and elsewhere, it's difficult to avoid it.

                                      0:17:42.2 Ray Canzanese: It's difficult to avoid it without like completely disassociating. Like I could never click a phishing link if I never clicked a link in anything that anybody ever sent me anywhere. And that's the problem. And so you're again in that gray area where I... "This seems legit. I'll click. I'll see what's going on here." And that's how we will always end up in this scenario.

                                      0:18:06.3 Max Havey: Certainly. And I think to go back to your point talking about the individual, it reaches a point where it is no longer a thing that you can rely on the individual at all times to keep up with that, especially when it's at such a volume like that of without entirely going off the grid.

                                      0:18:20.2 Ray Canzanese: Right. Yeah. And it's not like scams are a new thing. It's not like this is a new problem. The problem is the volume of other people that you encounter on the internet. And that you never know who's a real person when you're dealing with anybody on the internet.

                                      0:18:39.1 Max Havey: Certainly. Well, Ray, we've covered a lot of ground so far, but are there any other specific threat trends that stuck out to you that we haven't covered off on quite yet?

                                      0:18:47.7 Ray Canzanese: I guess the thing that really stuck out to me that we talked about a little bit was AI. And so we talked about like the strategy for control. Where we see more people blocking apps using DLP to control the flow of data there. The thing that stood out to me a little bit is that increasing trend of use hasn't really slowed yet. Throughout 2024, we saw a roughly tripling of the number of people in the enterprise using AI apps on the regular. It stuck out to me that that's continuing to rise, that we haven't really hit a plateau there yet, which means expect even more changes in the coming year.

                                      0:19:32.2 Max Havey: Certainly. And that sort of brings me to my last real question for you, looking ahead at 2025, are there any major trends you see on the horizon that is coming from the research and the conversations you've been having with other folks in the threat community?

                                      0:19:44.5 Ray Canzanese: Yeah, really for me it's this human element. If the human is at the center of cybersecurity risk and the modern workplace now, in addition to all of the other tools and forces we had pulling at us now has GenAI and all of these deep fakes and well-crafted phishing links and fake login pages. It's become so much harder for individuals to make informed decisions about how to deal with sensitive data and security protocols. And again, like the volume is just way too high. We're asking too much of too many people. And so for me, I think the trend is that we'll continue to see the disinformation, destabilization, division. We'll continue to see AI used for phishing and deep fakes and scams, and it's going to be a really challenging societal problem. It's not just a problem that organizations are facing. Like of course I'm worried about my employees, of course I'm worried about my data, but everybody is facing these challenges worldwide. And so I think that us rethinking use of those platforms and how to control use of those platforms to lower abuse is going to be a major topic in the coming year. I think from those of us in the cybersecurity industry who are looking to secure organizations, I think our focus needs to be and will be on lowering cognitive burden of users. How do we guide people toward making the right decision with less cognitive burden?

                                      0:21:22.4 Max Havey: Absolutely. And I like that despite the fact that, I think you are correct in that we're gonna continue to see a lot of these darker trends continuing to thrive. The key here is finding a way to reduce that cognitive burden on the people, on the users who are encountering this every day. And that's also you and me 'cause we are also people. And I think finding better ways to deal with that is a really lovely prediction and a great way to enter the new year. That's a good resolution of some sort.

                                      0:21:50.1 Ray Canzanese: Yes. Not an easy one, but a good area for us all to focus.

                                      0:21:54.9 Max Havey: Certainly. Well, Ray, I think that does it for questions that I have on my end. Is there anything further that you'd like to add?

                                      0:22:02.1 Ray Canzanese: Yeah, sure. Just a little plug.

                                      0:22:04.0 Max Havey: Oh yeah, go ahead.

                                      0:22:04.4 Ray Canzanese: You can find out more of the things we're working on at netskope.com/threatlabs. I have a monthly newsletter you can sign up for. I'm on LinkedIn and I also just recently joined Bluesky as well. So you can find me in all of those places.

                                      0:22:21.4 Max Havey: Excellent. Well, Ray, thank you so much for joining us here today. This is always a delightful chat when I can talk threat trends with you, and especially when we can find a little bit of hope in that conversation as well. So, thank you so much for joining us here today.

                                      0:22:32.1 Ray Canzanese: Absolutely. Thanks Max. Take care.

                                      [music]

                                      0:22:34.0 Max Havey: All right. You've been listening to the Security Visionaries podcast and I've been your host, Max Havey. If you've enjoyed this episode, share it with a friend and subscribe to Security Visionaries on your favorite podcast platform. There you can listen to our back catalog of episodes and keep an eye out for new ones, dropping every month, hosted either by me or my co-host, the wonderful Emily Wearmouth. And with that, we'll catch you on the next one.

                                      Subscribe to the future of security transformation

                                      By submitting this form, you agree to our Terms of Use and acknowledge our Privacy Statement.