RSAC Conference 2025 | Roger Grimes, KnowBe4

Clips
More from RSAC Conference 2025

Roger Grimes

Data-Driven Defense Evangelist

KnowBe4

play_circle_outline Social engineering and unpatched software account for majority of successful attacks.

play_circle_outline Rising Threat of AI-Enabled Deepfake Social Engineering Malware and the Innovation of Bad AI Bots

play_circle_outline Utilizing Agentic AI for Personalized Training to Improve Cybersecurity Efficiency and Effectiveness

play_circle_outline Enhancing Cybersecurity with Phishing-Resistant MFA: A Compliance Checklist and Training Guide

play_circle_outline Impact of cyber insurance on industry

Info
Transcript

Roger Grimes, KnowBe4

Roger Grimes

Data-Driven Defense Evangelist KnowBe4

Roger Grimes, data-driven defense evangelist at KnowBe4, joins theCUBE’s Dave Vellante and Jon Oltsik at the RSAC 2025 Conference. The conversation examines the dual role of agentic AI in both advancing cyberattacks and enabling stronger defenses.

Grimes emphasizes the need for companies to leverage the data they already have to counter threats such as social engineering and unpatched vulnerabilities. He explains how agentic AI accelerates threat evolution and demands smarter, faster detection and response.

The discussion also explores perso... Read more

explore Keep Exploring

What is the disconnect between the data we have on successful cyber attacks and how we allocate resources to protect against them in the IT and IT security industry? add

What is the impact of AI on social engineering attacks in cybersecurity? add

What is the effectiveness of allowing AI to select simulated phishing templates compared to human administrators? add

What are some common misconceptions about cybersecurity compliance and risk management? add

What are some observations about the current state of cybersecurity insurance and its potential impact on the industry in the future? add

bolt Powered by CUBE AI

Roger Grimes, KnowBe4

search

Dave Vellante

>> Hi, everybody. Welcome back to Moscone West. This is Wednesday, hump day here at RSAC 2025, but it's going by fast. You're watching theCUBE's continuous live coverage of RSAC, the biggest security conference in the industry. I'm Dave Vellante. Jon Oltsik is my co-host here. John Furrier is also in the house along with Jackie McGuire. We'll be wall-to-wall coverage today, all the way through Thursday. Check out thecube.net, siliconangle.com. It's got us Rob Hof and team have a special section up there. Thecuberesearch.com has all the deep dive research. Roger Grimes is here. He is a data- driven defense evangelist. Yes, I love that title. No before Roger. Good to see you. Thanks for coming on theCUBE.

Roger Grimes

>> So glad to be here. - I love this title.

Dave Vellante

>> Everybody's data-driven but data-driven defense security. You look at security as a data problem?

Roger Grimes

>> Well, what's interesting is that we're the industry that is supposed to protect all the data, but we do not use the data to actually help us protect that industry. A long time ago, I realized that social engineering's involved in 70 to 90% of all successful data breaches, unpatched software. According to Google mandates, about 33%. Those two causes social engineering and unpatched software and firmware account for about 90 to 99% of successful attacks. Yet the IT and IT security industry doesn't spend 3% on those resources to fight against it. So, we really know how we're being successfully attacked the most, but we don't use data to drive how we then set up defenses. And it's that fundamental misalignment that has allowed attackers to be so long-term successful.

Dave Vellante

>> So, you wrote this blog. This is a mouthful, but I'm going to share it with people. Autonomous Agentic AI- Enabled Deepfake Social Engineering Malware is Coming Your Way, coming to a theater near you. And so, that is pretty cool. Then it basically indicated that it was, you forecast that you're going to have these modular, self-directed, autonomous AI malwares that are going to come after and exploit these social engineering efforts. So, explain why you wrote that blog. And what was the fundamental premise there?

Roger Grimes

>> Yeah, let me say, I was a bit of an AI skeptic, or not a skeptic, at least not on the bandwagon of, oh my God, it's going to take over the world and become self-aware and kill all the humans. And last year a really common sentence I would say is, "Hey, AI's coming. It's not AI attacks are coming, but how you're likely to be compromised this year is probably not going to be AI. It's going to be the same attacks have been working for decades. " This year, we're absolutely seeing AI come in a big way. 70 to 90% of social engineering attacks now seem to have some indicator that AI has been involved. The spearfishing and kits and things like that are using AI enabled. It's a big deal. And really what we're seeing, and this is kind of interesting, is the good guys invented AI, 1955. The good guys really made the explode late October 2020 with ChatGPT and all this stuff. And the bad guys for the first time ever in our industry, are kind of following about a year or two. So this year, we're seeing just an explosion of agentic AI, right? These somewhat autonomous operating modules that will do things faster, faster detection, faster, better patching, and that sort of stuff. So if I look at the past history, and I'm a big believer that past history is a good indicator of future-

>> Certainly rhymes. - ...

Roger Grimes

>> yeah, it seems like that there's a really good chance

Dave Vellante

>> that I would say within a year or two, that the whole malware hacking model is going to be really heavily agentic AI. Just meaning that they're going to vastly increase the speed at which they detect things that are on patch. They're going to vastly detect how quickly they can do an AI deepfake. Perry Carpenter, one of my co-workers, literally he can say, "Who do you want me to be right now? Do you want me to be Burt Reynolds or Britney Spears or something like that? " Click a button, and now he's talking and everything he's doing is being as that personality. Not only that, but he can set up LLM models where he literally can use this LLM AI to call somebody and do a social engineering scheme that is really kind of scary to see. Thank God Perry's on our side. But you're like, okay, if we've got the technology that can do that now it's only a matter of half a year or a year to the bad guys who are using that routinely. And I don't think there's anything that's going to stop that. Two years from now, it's basically going to be good AI bot against bad AI bot. And the best algorithm will win.

>> So when we interviewed Marc Benioff a couple of weeks ago,

Dave Vellante

>> he was basically saying, "I'm the last generation of CEOs that are going to be managed human only workers. " So to Roger's point, you got good guy bots and bad guy bots, good guy AI, bad guy, AI. How's that going to play out?

Jon Oltsik

>> I think we're seeing it already. I think to your point, Roger, we've seen LLMs and things like chat GPT being brought in for malicious purposes, in fact malicious LLMs. And so, the ability to do the research before you do the attack has been automated and accelerated. What's the next step? Get the human out of the way. So agentic, that makes a ton of sense. The data's there, we know how to make the model. So just weaponizing, that is absolutely the next step. I wouldn't be surprised if there's already kind of beta testing of that. Have you seen that?

Roger Grimes

>> Yeah, I mean we've definitely seen indications of that. And let me say some people go, "Oh my God, it's going to create a better phishing attack. " That's not really the scary part. Yeah, it's going to make a very good simulated spear phishing attack. But the part that I think where it's really going to excel is that when you send an attack into a particular company or industry, that industry and company has its own way of talking. Whether you're in the healthcare industry... Like in the hotel industry where I work, they'd have this thing called a census. And every day, every hotel front desk manager's going to get called, "What's your census? " Which means, how many people, how many beds do you have subscribed, and how full are you? And that sort of stuff. Well, these AI bots are going to be able to look at the industry, use industry vernacular and terminology with people just to... At first, you have these people doing a lot of spear phishing attacks that aren't in the native language. And there's typos and they don't know how to respond when someone asks them a question. Well, this AI bot is going to know how to perfectly respond. And we're already seeing that. We're already seeing indications that they're testing it. You're right, they have malicious LLMs. Every good LLM seems to be jailbroken like every single day. It seems like almost a losing battle trying to keep them secure and away from being used. And we're going to lose that war. And it used to be a decade or two decades ago, if you had a kid that was a mathematical genius in college, he would go to Wall Street and become an algo, an algorithmic person for helping make stock trades. I think if my kid is a mathematical genius, I'm sending them to the cybersecurity company so he can create good algorithms for these AI bots.

>> So- - Well, from your... I'm sorry-

Jon Oltsik

>> No, please. - ...

Jon Oltsik

>> but from your mouth to God's ears, 'cause I have a

Dave Vellante

>> kid who's looking for a job.

Dave Vellante

>> So Sorry, Dave, go ahead.

Dave Vellante

>> No-

Dave Vellante

>> Algo. - ... let's help him out.

Jon Oltsik

>> Just tell him to go look into to being an algo.

Dave Vellante

>> Tell him. - He looking.

Roger Grimes

>> We're going to have to help him out here,

Dave Vellante

>> Jon. Let's tease that.

Roger Grimes

>> Sounds good to me. - So we talk a lot about critical

Dave Vellante

>> infrastructure, how exposed it is.

Jon Oltsik

>> We've seen the future of war. I mean, it clearly involves cyber. We have nuclear arms treaties. Do we need cyber arms treaties? Is that something that we're going to see?

Roger Grimes

>> Yeah. Part of the reason, if we could ever identify hackers, and that's the reason why they're so pervasive, is we can't really readily identify them. But if we could, well, we can't prosecute them because we don't have large international agreements agreeing to prosecute. Our warrants and judicial system in America are not going to be accepted and apply in China and Russia. And let me say vice versa. If China and Russia's saying, "Hey, we need you to arrest your hackers and send them to us. ", we're not doing it. But just recently, the UN signed the first global cybersecurity treaty defining what is allowed and legal, what should be off bounds, that sort of stuff. And there's certainly a lot of issues. But let we say that for the first time ever, as far as I'm aware, United States, China, and Russia signed the same cybersecurity agreement. And I've been watching for 20 years for the UN saying, "Hey. ", and the French and all these other people and Geneva trying to create a Geneva Convention for the cybersecurity world, and seeing it. Everyone's like, "Oh, it's going to happen, it's going to happen. " And it just fails because either the U.S. , China, or Russia saw something that was against their interest and said, "We're not going to sign on. " So, the UN just did this a couple of months ago. It's even got some concerns for privacy. It could be used. Some people are worried that China could use it to go after human rights people and that sort of stuff. It's the first time we got an international agreement. It's a start, it's a base, and so there's some positivity there.

Jon Oltsik

>> And there are two things that are always of a concern. One is surveillance, because spying and surveillance is sort of allowed in the international community. And the second thing, everyone's concerned about any kind of guardrail or hurdle to their offensive operations. Because NSA and what is it, total... I forget the name of the acronym, but we believe our offensive capabilities are the best, china believes its offense. So, no one wants to limit those capabilities.

>> Agreed. Absolutely agreed. Great point.

Dave Vellante

>> I interviewed Robert Gates,

Roger Grimes

>> it was at a ServiceNow conference. It might've been the same one that, it was year after I think police threw the water on me. And I asked him about that. And I said, "Don't we have the best offensive cyber capabilities? " He said, "Yeah, but we also have the most to lose, so we have to be very careful."

>> That's always true.

Dave Vellante

>> And so that was, I thought, telling Comet.

Jon Oltsik

>> Okay, so what can organizations do to protect themselves and how does KnowBe4 before help?

Roger Grimes

>> Well, certainly embracing the agentic AI, although I oftentimes tell people you really should be interested in feature sets and whether that's getting accomplished by a basic if- then statement or whether it's agentic AI shouldn't really... We shouldn't be excited about agentic AI by itself. But if the feature is going to better detect something, better stop something, be more efficient and quicker, well then you need to embrace it. And it does look like autonomous agentic AI has a lot of those factors in there. I mean, part of that is like right now with patch management, you're like, "Well, I've got patch management and you go out and take a look. " And then, "Oh, this is what I'm missing. I'm going to patch." Agentic AI is the idea that you send out this autonomous bot, it analyzes this device. It's like, "Oh, I get a patch this." And it's doing it and there's nobody pushing a button telling it to do it. It already has the parameters to know what should be patched, what hours should be done, maybe that it has to do a backup first to do testing or something. So, the idea is that it should be kind of more taken out of your hands and the AI making better decisions. At knowBe4, we've been doing AI going on seven years, and we've got a ton of AI and agentic AI. And we already have data to show us that if you rely upon the AI, it's actually better than a human admin. For example, one of the things we have is that if you allow the AI, agentic AI to select the simulated phishing template, the example phishing thing, you're going to send someone, that if you let AI do it's 17% more effective at tricking the person into clicking on something. And let me say it's not necessarily a bad thing, because when someone fails a simulated phishing test, you're getting a chance to educate them, let them know they're susceptible. So, we see it as a positive learning experience. And I think you're going to see that just all throughout cybersecurity software, where the autonomous agentic AI is going to be more efficient, faster. And it's got to result in better outcomes. If it doesn't result in better outcomes, you shouldn't go there. Well, I think the evidence is showing that just from our limited testing, that agentic AI is being more successful, it's what it's doing. Even I think during a political campaign, they were talking about the agentic AI doing the call campaigns resulted in like 7% more donations or something like that. I mean, across the board, I'm not hearing a lot of people talk about, "Oh, we're seeing more failures this year. " Last year we saw more failures, this year we're seeing a lot more successes. It's matured to a point to it really does seem to be adding value. So, what would I say to most companies? Agentic AI is coming to attack you. There's probably a good chance you need agentic AI to help better defend you.

Jon Oltsik

>> Yeah. And what I like about what you're saying, Roger, is it's not peanut buttering solutions over your entire staff, all your employees. It's using the AI to understand who's strong, who's weak, what does Dave need versus what Jon needs, and customizing your training, or in this case, your synthetic phishing to that person. That's a force multiplier for the organization rather than-

>> . - ...

Jon Oltsik

>> just treat Dave and Jon the same and we're all bored

Roger Grimes

>> because we know all this stuff.

>> You said it better than... You

Roger Grimes

>> said what I should have said, which is-

>> That's my job. - ...

Roger Grimes

>> it's going to allow more personalized training on a person.

Jon Oltsik

>> And if you had a human admin that had to do that and make that happen, it's going to be-

>> be slow.

Roger Grimes

>> Yeah, it's going to slower.

Jon Oltsik

>> And so absolutely, we're going to see this more personalized approach. All humans are different, although there's probably some class types that you could probably say. But we know that we have people that never click on stuff, and we have people that seem to click on everything. And they're going to need different types of training and treatment and nudging, coaching, as we call it, to help protect, better protect the organization.

Jon Oltsik

>> And what that does is it gives you better security because you can apply your resources to those who need it. But it also frees, if Dave and I don't need a strong security, that makes us more productive because now we don't have security hurdles in the way.

Roger Grimes

>> Yeah, yeah, absolutely. And I would say also, I consider myself a person that doesn't get tricked a whole lot, but I have been tricked. And it takes a different type of phishing campaign, simulated phishing campaign to trick me. And every time I get the ones that are all simple, like click here to get a free Dunkin Donuts coupon or some fake email from my supposed boss or something like that, it's so easy it's not teaching me anything. I need to have a little bit, the maturity of the attack against me needs to be ramped up. And occasionally I would say if you have someone that never fails a test, you're probably not giving them all the education that you should be giving them.

>> That's true. - So you're advocates of using tools,

Dave Vellante

>> and I see a note in here on Perry's fake

Jon Oltsik

>> following those suggestions. I think you're talking about Perry Carpenter-

>> Perry Carpenter. - ...

Dave Vellante

>> who wrote the book on deepfakes.

Roger Grimes

>> F-A-I-K. I think Perry is the penultimate

Roger Grimes

>> person talking about how AI can be used in a bad way. He was here yesterday giving a talk, and he had an evil Santa Claus doing a kidnapping request and cursing at the person on the phone. And it was all automated. And I got to tell you, a lot of the people in the audience were kind of on their phones. And when he had the evil Santa doing a kidnapping hostage ransom negotiation, cursing and yelling and stuff like that, I tell you, everybody in the audience put down their phone, looked at that, what was happening in real time, and went, "Oh, this is here. " And it was amazing to see the AI just interact to anything he said. He even tried to throw some things to trick it and stuff like that. And it responded quite well using things that he did not give it ahead of time. I even know he could do it, I've watched his demos, and it still never kind of... Gives me a little chill to know this is what's coming.

Dave Vellante

>> I want to come back to the good bot, bad bot battle. Are the measurements to determine success going to change, or are they going to be the same? And what are they?

Roger Grimes

>> No. So as a data-driven defense evangelist, I think we need to use the data. And we need to make sure we're measuring the right thing, which I think ultimately the right thing is your decrease in cyber security risk in a real measurable way, meaning that you're actually getting less breaches, less likely to be breached. A lot of times, the measurements will be, Hey, I want to have less bugs for a thousand lines of code. Or I want to have more testing or something like that. Ultimately, it comes down to, am I more or less at risk this year than last year or the previous time period? That's the ultimate measurement. So, we need to make sure we're measuring a real decrease in cyber security risk. And that's some compliance checklist. Am I using MFA? Do I have a complex password or something like that? That's great, but it doesn't get to the ultimate risk.

Dave Vellante

>> Well, that's always my two biggest. My number one question is, what's with all the acronyms? My second question in cyber is, I spend more, but I don't feel safer. Why am I not safer? And I think there are reasonable answers to that.

>> And I think to Roger's point, what we're going to have

Jon Oltsik

>> to do is take what you just said, those metrics, and put them in business terms. Because the board and the executives are scared and they don't understand this stuff. And we can't throw a bunch of technical jargon or acronyms at them. We have to say, "Here's the business risk, here's how we can mitigate that business risk. Here are the metrics we can use to measure that."

>> And here's what it costs to do

Dave Vellante

>> that, and here's the return.

Roger Grimes

>> And let me give you just two quick, like a compliance thing would be, are you doing security awareness training, human risk management?

>> Yes, no. - And someone's like, "Yeah, I'm doing it once a

Roger Grimes

>> year 'cause that' what the compliance guideline HIPAA

Dave Vellante

>> or PCI DSS requires. " That's almost ineffective. We've got the data to show that-

>> Oh, not almost. It's ineffective.

>> Yeah. It's like training someone once a year

Roger Grimes

>> to drive a car when they're learning.

Jon Oltsik

>> Or MFA. Are using MFA? Yes, but 90% of MFA is as easy to bypass as a password. You need to use phishing-resistant MFA. And just a little tiny term, a phishing- resistant means a whole lot to your cybersecurity risk. So, we need to get people educated that using MFA is not enough. Just using SAT once a year is not enough. We need to do the real things the right way. So compliance is, I met this thing and now I, oh, I don't have to worry about it in the audit. Cybersecurity is I really am decreasing cybersecurity risk and I'm less likely to be compromised.

>> Got it. I have a killer question for Roger.

Jon Oltsik

>> Go. - Is cyber insurance going to drive this?

Jon Oltsik

>> Interesting. - Because if all that data's available

Jon Oltsik

>> and we have AI working for us, all of a sudden

Dave Vellante

>> an insurance company can have exposure

Dave Vellante

>> to risk like never before. So, do you see that on the horizon?

>> Yeah, well, I'd say it's already done it.

Roger Grimes

>> And I would say that it's already done the movement that it's going to do a year or two ago.

Jon Oltsik

>> Really? - And let me say cybersecurity insurance is

Roger Grimes

>> moving it in a big way, but I really thought it was going to be even better. And it was. It was able to tell companies that they have to use MFA, that they have to do security awareness training. But they are missing the devils in the details.

Jon Oltsik

>> That's what I mean. - And when I look at cybersecurity

Roger Grimes

>> insurance applications and stuff, they've all got different questions, they all are very vague, and they're just missing these fine points. What I missed was that they didn't have enough cybersecurity experts to ask the right actuarial questions. But yeah, I think cybersecurity insurance has already done a big movement. It made its big movement. Also today, much harder to get cyber insurance. It used to be you could get $5 million of insurance for like $15,000 a year. And they only ask you three questions, which is name, email, address, and check, what's your check number or something. Now, really tough to get a hundred thousand, a million dollars of insurance. There's a lot of exclusions in there. But it absolutely helped mature the industry. My only question would be is it really going to be a driver in the future and make it even more? I think there is a sense that it will as it gets the data in, figures out what we need. Data-driven. And who has better data for driving risks than an insurance company?

>> I was watching the Berkshire Hathaway annual

Dave Vellante

>> meeting last year. I won't be watching this year 'cause it's on Derby Day. I'll be handicapping horses. But I think it was Ajit Jain. I think Ajit Jain runs that practice. And he said, "We don't like the cyber insurance business. We're not participating in that. " And I've talked to a lot of companies who are in that business say, "We disagree. We really love that business. " So it's going to be interesting to see if that comes up again, because I know those dynamics are in flux. And so maybe it's not as profitable for the Berkshire Hathaway model, but I think a lot of companies really rely on that.

Roger Grimes

>> We have a partnership with a couple of insurance industry groups and a couple insurance companies that actually offer a discount. So I would say if you don't do cybersecurity awareness, human risk management, you'd have a hard time getting a cyber insurance policy. Even if you could, you're certainly going to get a discount if you do. So, that's the good thing. If you're not using MFA and you're not doing good training, you're going to have a hard time getting the policy.

Jon Oltsik

>> Right. - As a small company, our cyber insurance provider

Dave Vellante

>> audits us and tells us, "You got to plug these holes, you got to put MFA here, here, and here. And thank you." I mean, it's fantastic.

Roger Grimes

>> And again, the only thing I do, and I'm trying to educate them working with them, is say, "Hey, phishing resistant MFA. Everybody, not just the admins." Right? 'Cause if ransomware breaks into your... Most of the time they're breaking-

>> . - ...

Roger Grimes

>> end user, then they're getting to the service

Dave Vellante

>> and admin passwords. So, you can't just protect admins. And the same thing with training. It's got to be effective training that really does reduce risk.

Dave Vellante

>> All right. Hey, thank you. Got to go.

>> Thanks. - I really appreciate your time.

Dave Vellante

>> And by the way, check out this blog,

Roger Grimes

>> Autonomous Agentic AI Enabled Deepfake Social Engineering Malware is Coming Your Way. Nice job. I mean, you really gave a lot of thought to this.

>> Thank you. - It's not just a hundred-fifty word blog.

Dave Vellante

>> It's meaty. So, thanks for that.

Roger Grimes

>> Thank you. - All right. And thank you for watching.

Dave Vellante

>> This is Dave Vellante for Jon Oltsik.

Roger Grimes

>> John Furrier is also here, as is Jackie McGuire, the whole CUBE team. You're watching our coverage, theCUBE's coverage of RSAC 2025. And we'll be right back right after this short break.