Cyber Leaders Push for Zero Trust as AI Supercharges Threats

Robert Roser, CISO at Idaho National Laboratory, outlined the three major cybersecurity threats facing the Energy Department and federal agencies Tuesday at the Zscaler Public Sector Summit in Washington, D.C.  

First, he warned of AI-assisted attacks, which increasingly take the form of phishing campaigns and the weaponization of large language models. Adversaries are leveraging AI to increase speed, precision and scale, he said, enabling highly tailored phishing campaigns, automated reconnaissance, rapid vulnerability scanning and adaptive malware.

 “AI makes the adversary better,” said Roser, who also serves as CDO and director of cybersecurity at INL. “An adversary that isn’t particularly technical can leverage AI and learn how to do very technical things quite simply.” 

In addition to AI-assisted attacks, Roser said ransomware is constantly evolving and widening the gap between basic and advanced threats. Many successful techniques still include exploiting weaknesses like misconfigurations, credential theft and delayed patching. But complex, multi-stage campaigns targeting critical infrastructure, telecommunications, supply chains and identity systems, are also on the rise.  

“The most significant trend is the continued professionalization and industrialization of cybercrime. We are no longer dealing with isolated hackers. We are facing organized ecosystems — nation-state actors, ransomware cartels, access brokers and AI-enabled criminal networks — that operate with discipline, funding  and strategic intent,” he told GovCIO Media & Research in an interview. 

Deepen Desai, chief security officer for Zscaler, said one of the best ways to combat the ever-evolving threat landscape is prioritizing zero trust to create a proactive security posture and using AI to combat AI threats. 

“Every organization needs to prioritize a solution that will allow them to use AI to find AI, because we’re already seeing threat actors use AI to impact your organization,” he said. “So you need AI to find AI to level the playing field.” 

Roser said it’s important for federal agencies to both modernize and collaborate at “operational speed” in order to combat and prevent cybercrime. 

“Legacy architectures cannot keep pace with adaptive threats. Agencies must continue advancing zero trust implementation, identity-centric security models, behavioral analytics and improved cloud visibility,” he said. “Information sharing must move beyond periodic reporting to near real-time intelligence exchange across federal agencies and with trusted private-sector partners. The federal enterprise is interconnected, and adversaries exploit seams. Closing those seams requires shared situational awareness.” 

Wade Zarriello, director of infrastructure and user services at the Centers for Medicare and Medicaid Services, said the agency has incorporated zero trust as an important part of their modernization strategy. 

“In years past, what kept me up at night was a virtual private network that sat on a flat network. And if a bad actor got in, you know, they could possibly move laterally,” he said in an interview with GovCIO Media & Research. “Using zero trust as an operating system to help enable not only ease of access and reduce bottlenecks in the infrastructure, but also strengthen cyber security, has been a key piece for us moving forward in our modernization efforts.”