Originally published here.

Gianni Cuozzo is Founder and CEO of Exein, embedding better cybersecurity into IoT devices and hardware. He’s also Chairman of Aspisec, and has worked with NATO on cyber defense.

Our world is so much more connected today than in previous eras. And specifically through “internet of things” (IoT) devices. From an attacker’s standpoint, it’s heaven.

It’s not that the number of attackers has increased. There are easier and more distributed attack vectors, and the architecture is more open. There’s a really close relationship between web technology and embedded systems.

The other issue is the asymmetry between attackers and defenders. Most defenders have standards, and most attackers do not.

It’s not only about money. Before, most of the attacks were about stealing money, credentials, or information. Now, some of the attacks in the current geopolitical climate are about destroying systems. These will obviously have a major impact on all our lives. We’re not only talking about standard criminals – there are also state-sponsored attacks happening this way.

Today you have people making conscious, calculated changes to code and functions. In the future, this will be done by agents. No human will have time to read and verify all the data and code that they will generate. And we’ll see lower-quality code in the future. Which will only make cybersecurity a bigger trend and concern.

Nowadays we have generative AI that can search through massive data and find bugs, which also creates opportunities for hackers. In the past, it took attackers time and effort to find weaknesses in code. GenAI can do it at scale far more easily – thousands of websites at a time.

It’s a very hard, and very expensive, problem to tackle. It requires lots of testing and retesting. It’s become very complex to build secure systems. Everything works perfectly until someone exploits it, and attackers don’t follow the same mentality as an engineer within a company.

Your engineers can do the right things; using updated licenses and software and following best practices. The problem is, the last thing you want to do in software is make changes. The goal is for everything to run stably. Often, in the time between testing and production, the libraries you’ve relied on which were good before are no longer good enough.

And no company is built up of phishing technicians. You have marketers, sales, and other roles who aren’t native cybersecurity experts. It’s an incredible issue for companies monitoring and using a large number of devices.

There are a range of pressure tests you can run for your business. We do phishing testing, ‘red team’ testing, and also physical entry testing – seeing how easy it is for a person to enter your building and access important data.

We’ve seen large banks hacked because someone physically connected to their local networks. Hackers told a good story and the security people let them in. It was a sophisticated attack from a human perspective, but very simple technically.

I would also encourage every company to run bug bounty programs. You offer a bounty to any hacker who can identify weaknesses and bring them to you. First, this is much cheaper than the cost of a real, malignant attack. Both in terms of money and reputation. But you also put these guys on your side.

Budgets and software on their own don’t solve issues. Most software doesn’t work – they’re just products to make more money. The only real option is a well-educated workforce, and a continued dedication to reducing cyber attacks.