Defending Against Today’s Cyber Threats: Former Government Leaders Weigh In

(SPEECH)
[MUSIC PLAYING]

(DESCRIPTION)
Text: Wednesdays with Woodward (registered trademark) Webinar Series.

A laptop on a desk, with a small potted plant on one side, and a red coffee mug on the other. Text: Travelers Institute (registered trademark). Travelers. Jessica Kearney appears on a video call.

(SPEECH)
JESSICA KEARNEY: Hello and welcome. Thank you so much for joining us. I'm Jessica Kearney, Vice President of the Travelers Institute, standing in for our host today, Joan Woodward. Welcome to our webinar series.

(DESCRIPTION)
Slide, About Travelers Institute (registered trademark) Webinars - The Wednesdays with Woodward (registered trademark) educational webinar series is presented by the Travelers Institute, the public policy division of Travelers. This program is offered for informational and educational purposes only. You should consult with your financial, legal, insurance or other advisors about any practices suggested by this program. Please note that this session is being recorded and may be used as Travelers deems appropriate. Travelers Institute (registered trademark). Travelers.

(SPEECH)
Before we get started, as always, just a quick disclaimer about today's program.

(DESCRIPTION)
Slide, Wednesdays with Woodward (registered trademark) Webinar Series. Defending Against Today's Cyber Threats: Former Government Leaders Weigh In. Logos. Travelers Institute (registered trademark). Travelers. Insurance Association of Connecticut (IAC). MetroHartford Alliance. Connecticut Business & Industry Association (CBIA). The Big I (Independent Insurance Agents & Brokers of America). American Property Casualty Insurance Association (APCIA). Global & Experiential Education Office at the University of Connecticut School of Business. The University of South Carolina’s Darla Moore School of Business.

(SPEECH)
I'd also like to thank our program partners shown here on screen, the Insurance Association of Connecticut, CBIA, the Global and Experiential Education Office at the University of Connecticut School of Business, the American Property and Casualty Insurance Association, the MetroHartford Alliance, the Independent Insurance Agents & Brokers of America, or The Big I, and the Risk and Uncertainty Management Center at the University of South Carolina.

Thank you to our partners and to all the members joining us today in the audience. With that, let's get started. So tomorrow is the start of October, which is widely recognized as Cybersecurity Awareness Month. And here at the Travelers Institute, we promote cyber safety year-round. But nonetheless, this month presents another important opportunity to shine a light on the guidance and resources that we can all use to stay safer online, both at work and in our personal lives.

(DESCRIPTION)
Slide, Cyber (registered trademark). Prepare. Prevent. Mitigate. Restore. Travelers Institute (registered trademark). Travelers. Since 2016, the Travelers Institute has hosted 82 cybersecurity education programs. 61 In-person Events. 16 Webinars. 5 Podcasts.

(SPEECH)
Today's program is part of the Travelers Institute's larger Cyber: Prepare, Prevent, Mitigate, Restore initiative, which we launched way back in 2016, to help small and midsized businesses and public sector organizations improve cyber readiness. In that time, we've hosted 82 educational programs, reaching nearly 50,000 attendees or virtual views.

In addition, Travelers just released our annual Travelers Risk Index, and for the fifth time in eight years, cyber threats were reported as the top business concern. I mean, beating out things, other concerns like economic uncertainty, medical cost inflation, or even global and political conflict. So we know you're all here for a reason. So let's get right into it.

(DESCRIPTION)
Slide, Wednesdays with Woodward (registered trademark) Webinar Series. Jeff Greene. Former Executive Assistant Director for Cybersecurity, CISA, Former Chief of Cyber Response and Policy, National Security Council; Founder and Partner, Civira Partners; Senior Associate, Center for Strategic & International Studies. Nicole Tisdale. Former Director, National Security Council at the White House; Former Director, U.S. Congress' House Committee on Homeland Security; Founder, Advocacy Blueprints LLC; Senior Advisor, Cyber Program of the Aspen Institute. Pictures of Jeff and Nicole.

(SPEECH)
Today, we are thrilled to welcome two leaders who have been at the top of cyber decision-making for the federal government. And we'll get their take on all the latest cyber news, threats and most importantly, what we can all do to protect our organizations and ourselves.

(DESCRIPTION)
Jeff and Nicole appear on the video call.

(SPEECH)
First up, we're going to have Jeff Greene, who actually joined on this program last October. I'm sure we've got many repeat viewers from last year. After looking at his feedback, we knew we had to have him back on the program.

Jeff has led development of cybersecurity policy, as I mentioned, at really the highest levels of federal government and has helped improve cyber resilience of critical infrastructure across the U.S. Jeff served as Assistant Executive Director for Cybersecurity at CISA, which is a Cybersecurity and Infrastructure Security Agency, America's cyber defense agency. He also served as Chief of Cyber Response and Policy on the National Security Council.

He is currently a Senior Associate at the Center for Strategic and International Studies and is Founder and Partner at Civira Partners. Lucky for us, he's joined by one of his friends and former colleagues, Nicole Tisdale. Nicole is a national security attorney, who served as Director of Legislative Affairs at the National Security Council, where she led the White House's legislative and oversight portfolios on cybersecurity, counterterrorism, election security, among many other issues.

She served as a Senior Advisor on the National Security Council and the House Committee on Homeland Security. In Congress, she created and managed the passage of more than 350 bills through the U.S. House, 80 of which went on to become law. Nicole is a Senior Advisor on cyber at the Aspen Institute and is Founder of Advocacy Blueprints, which helps make government accessible through advocacy training.

Trust me, I could go on and on here, but I'm going to turn the floor over to Jeff and Nicole. First with Jeff for some opening presentations.

(DESCRIPTION)
Slide, Cyber Threats: 2026. It's More than AI. Jeff Greene. Co-Founder, Civira Partners. September 30, 2026.

(SPEECH)
Please get your questions ready. You can drop them in the Q and A ribbon at the bottom of your screen, and we'll get to all your questions on the other side. Jeff, welcome. The floor is yours.

JEFF GREENE: Great. Thanks, Jessica. Thanks, everyone, for joining. I'm excited to be back. Had a lot of fun last year. So I'm going to talk briefly about a few things and then hand it over to Nicole. I'm excited to hear her talk as well. She always teaches me something every time we talk.

I'm going to start with a quick overview of where we stand in the threat world and then talk about a couple of things that I worry get lost in the shuffle of day-to-day crises.

(DESCRIPTION)
Slide, The Current Threat Landscape - Key Actors. Russia. Target: Ukraine War, Espionage, Disruption Operations. Sustained capabilities and intent to conduct deep- network espionage across government and private sectors. Iran. Target: Disrupting Critical Infrastructure, Information Operations. Recently targeted 30+ US Internet-exposed water providers, exploiting Programmable Logic Controllers (PLCs). Opportunistic, yet highly disruptive. DPRK. Target: Financial Gain, Disruption Operations. Primary objective remains capital generation through ransomware, fake worker scams, and cryptocurrency theft.

(SPEECH)
So starting with the threat landscape, I'm going to focus on nation-states. I don't want to minimize the threat that a lot of you folks and your clients are going to face from cyber criminals and cyber gangs.

But the nation-states’ actions have been pretty prevalent in the news, so I'm going to lead with them. And if we get into it later, I'm happy to talk more broadly. In government, we often talked about the big four, Russia, Iran, North Korea and China. Each is a little bit different. They overlap a lot in what they can do, but they have often different goals and different levels of sophistication.

When you think about cyber intrusions, we tend to put them in two different buckets. One is collection, traditional espionage, spying, whether it's stealing intellectual property, trying to understand your adversary's plans. The other we talk about is disruption, the capability to break things or to have the capacity to do it in the future or even the threat to hold over your adversaries. And usually, we're talking about critical infrastructure here.

Starting with Russia, they are still very focused on the Ukraine war but not entirely. They're very focused on espionage still globally. Embarrassment campaigns is one of their specialties. Historically, they've been extremely sophisticated and very quiet, hard to detect and that continues. In the Ukraine war, they've gotten a little noisier, but they're still seen at the top of the game in terms of capacity.

We don't see any letup or lessening and assume that they're going to be turning back to the rest of the world if the war in Ukraine were to wrap up soon. Looking at Iran, they are a less sophisticated actor, but they've been improving pretty rapidly and are taking advantages of new technologies. But what really sets Iran apart from their counterparts, the big four, is how ingenious they are. They are very good at making the most of less sophisticated attacks, because it doesn't often take a lot of sophistication to have a big impact, particularly if you understand your adversary.

They are also right now very motivated. The war has had a huge impact on them, and they’ve very much been in the news recently if you've seen it. They broke into dozens of different water providers across the Midwest. So if you work in the critical infrastructure sector, they should be high on your list. They're getting better, and they're very motivated, revenge motivated.

North Korea or the DPRK is basically a nation-state acting like a criminal gang. They're interested in money almost exclusively, outside of South Korea. It's revenue generation, theft, ransomware. They're stealing a lot of cryptocurrency. We talked last time about fake worker scams. They're very into that. And where they focus their ingenuity is coming up with new scams essentially. When one stops working, they're ready to come at you with a new one.

(DESCRIPTION)
Slide, PRC Cyber Operations: Espionage vs. Pre-positioning. Salt Typhoon. Primary Objective: Traditional Espionage & Intelligence Gathering. Target Profile: Communications networks and sensitive data repositories. Volt Typhoon. Primary Objective: Disruptive Pre-positioning. Target Profile: U.S. Critical Infrastructure networks (Energy, Water, Communications). End State: Gaining persistent access to launch disruptive or destructive attacks on command. A quote, "Designed to deter U.S. military action by impeding U.S. decision making, inducing societal panic, and interfering with the deployment of U.S. forces. Office of the Director of National Intelligence (ODNI).

(SPEECH)
So the next slide is going to be dedicated to the PRC, People's Republic of China. I'm still giving them their own slide. I had an internal debate when I was preparing a similar talk last week whether I move Iran up. For now, I'm not. But they are very capable of change my calculus pretty soon.

The PRC is historically seen as a very loud actor. They're huge. They do a lot, but they didn't in the past care that much about whether they were caught. That has changed dramatically. They are still very big and very active, but they're also very skilled and very quiet. And they, in my mind, are the generational cyber adversary we're going to face.

We talk about them as a near-peer, but they could be a peer adversary pretty soon. This slide hits on two different things that they've done recently, the typhoons, as they were called. Salt Typhoon, on the left of your screen, was a traditional espionage campaign that-- we disclosed this, I think, at the end of 2024. And it was focused on Western telecommunication providers very much on the espionage side.

Volt Typhoon on the right was something the U.S. government went public with in 2023, and this was an effort by them to break into Western critical infrastructure, to pre-position so they could attack later should they choose to. Both of these campaigns, in some form, I'm quite confident, are still going.

(DESCRIPTION)
Slide, AI is an accelerator, Not a New Threat. Accelerating Existing Threat Vectors. A circular diagram with AI Acceleration Engine in the center. Arrows around the center point to icons of a magnifying glass and hook, a bomb, and a person in a hoodie. Text: Reconnaissance & Social Engineering. Old Way: Manual research, limited scope. AI Acceleration: Automated, large-scale data gathering; highly personalized deepfakes and phishing at scale. Weaponization & Exploit Development. Old Way: Slow, manual vulnerability analysis. AI Acceleration: Rapid vulnerability discovery; automated code generation for exploits; faster adaptation. Execution & Evasion. Old Way: Static malware, manual obfuscation. AI Acceleration: Polymorphic malware automatically re-compiles to evade detection; autonomous lateral movement. Summary: The fundamental threat landscape remains unchanged. AI significantly reduces the time, cost, and technical barrier for attackers to execute existing tactics.

(SPEECH)
Next slide I'm going to talk about before I close out the threat brief, this is new to me talking about a tool or a technology instead of a threat. But I think this summer's actions have really shown why we need to do that. AI is really an accelerator, not a new threat. But what has changed is AI as its own actor. We've seen the first wave of truly autonomous AI attacks, where it was the AI agent acting on its own. The big public warning shot that people heard about was OpenAI and Hugging Face this summer. If you haven't heard about that, there's plenty of press.

I wrote a bit about it on my Substack blog called Cyber Shorthanded. What was really different about this was, again, it was the autonomy of the AI agents. In this situation, OpenAI had taken one of their new models and given it a test. Told it to solve a cybersecurity test. Supposedly, this was in a sealed sandbox, but instead of taking the test, the AI decided it was going to go out and steal the answer key.

So AI proliferated, found a way to break out of its sandbox and hacked into another company purely to steal the answers. No human directing it. It was just the agent's reasoning that this is the most efficient way for them to solve their problem.

(DESCRIPTION)
Slide, AI Governance: Boring? Maybe. Important? Yes. A diagram with Proactive Posture in the center, and five circles around it containing various icons. Text. Board-Level Priority. Treat cyber as a core capital allocation priority, not just an IT issue. Remove Speed Bumps. Audit and streamline internal friction and manual review processes that slow down defense. Contextual Risk. Shift from generic static scoring (CVEs) to risk patching based on actual environmental exploitability. Financial Liquidity. Ensure cyber insurance, retained risk, and emergency capital for rapid incident recovery. Third-Party Mapping. Build a business impact- tiered inventory of vendor dependencies.

(SPEECH)
Moving on to the issues I talked about beyond the threat profile. Sticking with AI a little bit, AI governance is something I've been talking a lot about with boards and executives at companies and leaders in utilities and in government as well. This is more boring. It's not as much fun as finding the newest tool that's going to make your company more efficient, but it is equally important.

It's asking the questions about how you are going to incorporate AI into your business, what controls you're going to put around it, what you have to teach your people, what your expectations are

(DESCRIPTION)
Slide, The Internal Wildcard: Shadow AI. 78% Use BYOAI (Unsanctioned AI tools). 52% Rely on tools entirely unvetted by IT/Security. 48% Admit to pasting non-public company information into public AI tools. Shadow AI Boundary Visual. A box with dashed lines contains the text Secure Corporate Perimeter. Textboxes containing the text Strategic Documents, Financials, and Proprietary Code point to a cloud labeled Public LLM Cloud. Text: The Default Training Risk.

(SPEECH)
and why should you care. Well, there have been studies on this, and this was the one that spoke to me the most. This was from earlier this year. Numerous companies involved. Some of the big-name cyber companies included.

Seventy-eight percent of the participants said they were using bring your own, BYO, AI unsanctioned by the company. And that bottom number there, 48% of the people admitted to putting non-public information into public AI tools. It's a huge risk for data leak if they don't have their privacy settings dialed up. They've basically given their company information over to this large language model for it to use both to train and to answer other people's questions.

(DESCRIPTION)
Slide, Post Quantum Cryptography: Q-Day is Now. Harvest Now, Decrypt Later. An illustration of a person wearing a hoodie and standing behind a hierarchy of digital folders. Text: Today. Adversaries actively intercept and store sensitive, long-lived encrypted data. Today points to an illustration of a safe. Text: The Vault. Data remains secured by current public-key cryptography. The Vault points to an illustration of a key. Text: 2030-2035. Cryptographically Relevant Quantum Computers (CRQC) emerge, breaking current algorithms and unlocking all stored historical data.

(SPEECH)
Next thing I'm going to talk about is post-quantum cryptography. This was one of our big focuses when Nicole and I were in the White House. It felt like we were getting some traction. And then in the fall of 2023, AI pretty much took over the conversation. There's this discussion about Q-Day, which is the day when we will have quantum computers that are powerful enough to break all the encryption we use today on our health records, our transactions online, our business communications.

It's going to impact all of that. No one can say when Q-Day is going to happen. I believe that's a complete distraction though. Worrying about Q-Day is missing the point. Q-Day is effectively now because of what we call the harvest now, decrypt later problem. Our adversaries are vacuuming up huge volumes of encrypted data, knowing that they'll be able to read it later on.

So if you have something that you want to keep secret for the long term, you need now to start looking at how to use some of the new algorithms that my old agency, NIST, put out that are quantum resistant. The second reason you should think about this now is it can take years, maybe as long as a decade, to put new encryption algorithms in place across your systems. So you need to do the hard work, the groundwork now so that when this happens, you're able to get those out in time or, as I said, have them in place now.

(DESCRIPTION)
Slide, Operational Resilience: Regularly Exercising Incident Response Plans. A graphic resembling an infinity symbol made of two arrows. The symbol is labeled Exercise, Exercise, Exercise. Text: Regularly drill your Incident Response plans. Build organizational muscle memory. Establish clear leaders and roles before an incident occurs to drastically reduce response time and remediation costs.

(SPEECH)
The last thing I'm going to talk about is resilience and preparation. First resilience. I often describe resilience as the only complete defense to a cyberattack. It's your ability to function through compromise when you have a degraded environment. The line I've used is, what are you going to need to be able to keep running on your worst digital day?

Every study that looks at this will show that if you have a resilience plan and you have an exercise plan, you will recover quicker. You will lose less data. You will spend less money in a response. The exercise piece is key. There are a lot of organizations that have plans, but they don't read them. They don't know them until an incident happens. And this is one of the areas I've been working at a lot in Civira since I left the government. And it's been surprising and a little scary how bad even very sophisticated organizations are at resilience and at exercising.

I'm talking about public companies, startups, medium-sized companies, utilities, they're just not doing the exercises. They're not hard. They're not expensive. We do it all the time. But the best incident response plan is still going to slow you down if you haven't spent the time to understand how it works and to know who those first calls are when you have an incident come up. That's going to wrap my prepared remarks. I'm looking forward to the conversation later. I'm excited to hand over to Nicole, and we'll talk more.

(DESCRIPTION)
Slide, Make It Make Sense. Cyber risk in plain language. How to talk about threats so people actually act. Nicole Tisdale. Founder & Principal, Advocacy Blueprints. Former Director, National Security Council. September 30, 2026.

(SPEECH)
NICOLE TISDALE: Thanks so much, Jeff. And thank you to everyone at Travelers Institute and all of our attendees today for joining. It sounds a little crazy to say I get excited about talking about cybersecurity but I do. I think coming on the heels of Jeff's threat brief, he's talked about a lot of things that can get your heart rate up and make everyone a little afraid. And so Jeff has told us what's coming. My job is to help you all make sense of it, because you all are responsible not just for your clients but also your employees and your community.

And so I can tell you all, with my years of experience, a threat only matters if someone does something about it. And it starts with how we talk about it.

(DESCRIPTION)
Slide, Why Cyber Messages Don't Land. Quote, "That's an IT problem." So it never becomes a business decision. Quote, “We're too small." Attackers go after the easiest target. Scare fatigue. Too many scary headlines. People tune out. Jargon. Acronyms make people feel behind. Fear gets attention. A clear next step gets action.

(SPEECH)
And so one of the first things that I want to talk to you all about is something that-- the response I hear when I talk to people about cybersecurity. So on the screen, here are a couple of messages that you all have probably heard or maybe even said yourselves. And I want us to take a minute to go through and talk about the walls and how we can be responsive to this.

So one of the first things that I always hear from people is that's an IT problem. That's not my issue. That's something for someone else. And cybersecurity gets handed off and it never becomes a business decision.

But the impacts of cyberattacks, the impacts of cybersecurity always land on the cost of doing business. We also hear, we're too small. A lot of people, we hear about these threats, geopolitical threats from countries like Iran and China and North Korea that Jeff mentioned. And people think that they are too small to be a target, and that's not the case. Most attacks are automated. And so it doesn't matter how big your company is or how big your organization. Attackers are picking the easiest target, not the biggest target.

Another is scare fatigue. So when you hear about these threats all the time and, as mentioned, cybersecurity continues to be one of the top threats that businesses list as a main concern, you can get fatigued. You can get to a place where it feels like the sky is falling, and people just start to tune out.

And I find that when you are afraid, you also-- you freeze up. And so this becomes one of the biggest things, even if you realize it's not an IT problem, even if you realize we're not too small, sometimes you actually get paralyzed with fear. And the fourth thing drives me absolutely crazy. And as mentioned in my background, I've worked on a number of national security issues.

When I started working on cybersecurity, I have never encountered so much jargon in my life. It is a lot of acronyms. It is a lot of technical information, and that can start to make you feel like you're behind or that you can't engage because you don't understand the language. And so as we talked through what the threat is, I want to be clear that fear will get anyone's attention. But what has to happen next is a clear next step, so that you can get to an action.

(DESCRIPTION)
Slide, Translate the Threat. A table with two columns, titled In the threat brief, and What it means for a small business. Row 1, Iran targets critical infrastructure. A utility or vendor goes down. Can you still operate? Row 2, North Korean fake IT workers. Your next remote hire may not be who they say they are. Row 3, AI-powered scams. The fake "urgent wire" email from the boss looks real. Row 4, Shadow AI. Staff paste client data into unapproved AI tools. Row 5, Harvest now, decrypt later. Data you keep for years needs lasting protection. Rule of thumb: lead with their business, not the breach.

(SPEECH)
So one of the things that I want to talk through is how we can translate the threat. And so one of the things focusing on communications and cybersecurity I practice a lot. And so I want to go through the chart that's in front of you are some of the threats that Jeff talked about during his threat briefing. And here are a couple of responses that I think would be helpful.

So when you hear that Iran targets critical infrastructure, you start thinking about a utility or a vendor going down. The question for your client is-- the first reaction is going to be, well, we don't run the water plant. But I would say you depend on water to operate. And so my question to you is not what is a PLC, not what is AIG-- or AI agentic tools. It is, can you operate without water?

When you hear that North Korea is targeting businesses with fake IT workers, my question to you is not that that is a hiring problem, it is, is your next remote worker going to be who they say they are? When we hear about AI scams, the type of scams that are happening on phishing emails, it's your phone, all of that stuff as Jeff has shared is gone. It's changed dramatically over the last two years.

And so now, the question isn't is someone hacking into your email, it's more so, can you trust the wire email or the wire text from your boss that is asking you to send funds? And I would say, lastly, one of the other highlights, too, with shadow AI along the same lines of a scam is your employees are already using AI. And I think the number that Jeff shared shows that a lot of people are really just bringing on their own AI tools. They haven't been approved.

And so the question that we need to be asking is how do we get AI tools to be approved so that they can be used, rather than having a blanket ban? Because we know people are already bringing their tools to work. I would say the last thing when we talk about harvesting now and decrypting later, which is part of the conversation we're talking about with post-quantum, a lot of your businesses, a lot of your organizations are collecting a lot of data. And so the question for you to ask is if we're saving sensitive data for years, how are we protecting it, so that it doesn't get stolen, or if it does, it is encrypted?

(DESCRIPTION)
Slide, Same Risk, Different Audience. A table with four columns, titled Audience, Owners & boards, Employees, and Small orgs. Row 1, Cares about Money, liability, staying open. Not getting blamed or more work. Limited time, money, and staff. Row 2, Say this, "How long could we run without our digital systems?" "Something look off? Call first. You won't get in trouble." "Free help exists. You're not alone. Row 3, The ask, A decision and a budget. Fast reporting. One first step.

(SPEECH)
And so I also want to spend a little bit of time talking about the audiences that you're talking to. I think it's really important when we're talking about cybersecurity to tailor your message to the audience that you are communicating with.

You can talk about the same risks, but the message is going to have to change depending on who's in front of you. So as we've been talking-- we've been looking at who joined this, I think a lot of you all are talking to owners and boards. You're talking to your employees. You're talking to other small organizations. And so we wanted to give you all a little bit of examples here on the screen of how you can phrase this messaging, so that it can reach the audience correctly.

So we know owners and boards care about money, they care about liability, they care about staying in business, staying operational. And so you should lead with continuity. How long can we run without our digital systems? That is a question about decision and budget. And that is something that owners and boards are already focused on.

Employees. Most employees are worried about getting blamed or getting more work. And so you want to make reporting safe. So you say something like, look, if something looks off, call first and assure them that you won't get in trouble. The ask is for fast reporting and awareness, and that's something that most people can do.

For small organizations, small orgs have limited time, they have limited money, and they have limited staff and they often assume that most cyber help is going to be too advanced for them or it's not going to be tailored for them. And so the messaging to these audiences is that free help exists, and you're not alone. That is asking them to take that first step and only one step.

Remember we talked earlier about fatigue and scaring. You don't want to overwhelm people. You want to empower them that-- you want to empower them and make sure that they know help is available to them and here's how to access it.

And so I know, Jessica, we're going to get into specific conversation starters. And so I'll save some of those for a little later.

(DESCRIPTION)
Slide, Three Rules for Any Cyber Conversation. 1. Lead with the business. Talk about staying open and getting paid, not hackers. 2. Match the audience. Same risk, different message for each group. 3. End with one next step. One action, one owner, and a date to check back in. The goal isn't to scare people. It's to make the next step obvious.

(SPEECH)
I think the last slide and the things that I want you all to just take away, if you remember nothing else from the presentation that I'm giving today, the three things you should always remember is you need to lead with the business.

So the goal is to stay open, make sure people get paid and keeping customers. You also need to match the audience. It's the same risk no matter who you're talking to, whether it's boards, employees or organizations, but you do need to have a different message for those audiences. And then you need to end with one step. One step, I think, I find when I talk to people about this, they're usually like, Nicole, well, there's not one single thing I can do. And I'm really clear with them, this isn't the only thing you're going to do. I'm trying to get you a little bit of muscle memory, and I'm also trying to get you a win.

Here is the first thing that you're going to do. It's one action, one owner and then also a date to check back in to say, look, this is what I want you to do this week. This is what I want you to do this month. And I'm going to check back in with you to make sure that if you've had any questions or you've run into any issues, we can be helpful because I want to make sure that you all are also tracking the free resources that are available.

(DESCRIPTION)
Slide, Free Resources to Share. Cyber readiness practices. Five steps for any organization. Employee cyber training. Help staff spot and report threats. Business risk assessment. First step toward a continuity plan. Travelers Cyber Threat Report. Quarterly trends, including AI risk. Links will be shared in the chat.

(SPEECH)
I love the resources that are available through the Travelers Institute. And I say this because I don't want anyone to think that you have to start from scratch. Travelers has free tools that you can hand to your clients today. And those tools include cyber readiness practices, employee training, business risk assessments and quarterly threat reports.

I think the hardest thing for people is knowing where to start, and I love that Travelers has made it so easy for you all to really use their resources, not just this webinar, but you can go back to these pieces and you can use them. You can print them. You can download them. And even though I've been doing this for a long time, these are the kind of resources that I use pretty regularly too. And so with that, I'll hand it back to you, Jessica.

(DESCRIPTION)
The slideshow ends. Jessica, Nicole, and Jeff appear side by side on the video call.

(SPEECH)
JESSICA KEARNEY: Amazing. Thank you, Jeff and Nicole. I think that was a really great way to start off the hour. And I know we're already having a bunch of audience questions come in. And I'll just say just some of the things that really resonated with me that you were both speaking of, I really appreciated the overview of the big four. Jeff, and I'm going to follow up on that in just a minute. But you touched on AI governance, Q-Day, which we'll get into.

But one of the things that really struck me about your presentation was when you talked about incident response plans and exercising those plans and testing out the capabilities and finding your own holes, and the fact that so many even large organizations haven't done this 100%, I think, that's one of those basic practices that we talk about day in and day out, which I think hopefully programs like these help to raise awareness about and get more people participating in those.

And Nicole, I'll say on your end, you mentioned when you moved over to cybersecurity, this was the most jargon you had ever seen. And I will say, we've been doing our cyber education series since 2016. And when I saw your slides come through, and I know your background and you're a communications expert, I was just so pleased because it was the most clear and succinct and broken down that I've seen this in plain English for people who are really struggling to get their arms around it. So I thought those were-- I thought those were all great. So thank you. Thank you for sharing those with the audience.

Jeff, I mentioned, I want to start. You mentioned the big four, Russia, Iran, North Korea and China. Clearly, we've all been following the headlines most recently and notably with Iran. You mentioned how quickly the nation-state cyber tactics are developing. I'm curious, given all the rooms that you've been in and all the vantage points that you've had, is there anything today that surprised you so far in terms of some of these nation-state actors and the cyber threats that we're reading about now?

And then as a follow up, what are you monitoring? We're all reading the news ourselves. What should we look for as we're trying to keep our hands on these fast-moving global issues?

JEFF GREENE: Sure. The biggest recent surprise for me, I think, has been Iran. I mean, it's not truly a surprise because this has been their MO for a while. They have shown the capacity and the interest to break into critical infrastructure. And we know that critical infrastructure in the West and in the water sector particularly is vulnerable. But the breadth of their success and the willingness to do it at scale.

And when I talk about Iran, there are Iranian-affiliated actors that I don't know sitting where I am today if it was the government that ordered it. But the Cyber Avengers, as they call themselves, are very closely affiliated with Iran. Their willingness to go big is worrisome. And I guess the war itself was a surprise. That really lowered the barrier.

The bigger overall surprise in the attack space was the last thing I talked about is this autonomous AI action. The fact that these models are almost innocently reaching out and breaking into things is completely-- well, completely is too strong. I'm a child of the '80s, so Terminator and Skynet is my zeitgeist.

But the fact that these models have evolved so quickly that they can do it, the fact that they're so successful, the fact that the companies that are developing them, in some cases, seems like they have ignored some basic precautions. And nation-states, and we can get into it, are definitely looking to AI, but the fact that there are swarms of AI agents out there on their own, working in a coordinated fashion is scary.

And I mentioned the Terminator. And what's really strange about being in this moment is the movies somewhat got it wrong. It wasn't this superintelligence with mal-intent looking to kill all humans. The biggest worry we have today is a superintelligent toddler that is just trying to follow the directions it's given and doesn't realize it's bulldozing a neighborhood to do it.

And those are things that feel like they should be controllable, but we're still behind the curve in controlling them. And certainly, back to the nation-state question, we may never know if one of those super intelligent toddlers was set loose by an adversary, whether a terrorist group or a nation-state, because it can look like they are doing something totally benign and doing dangerous things on the path there. Oh, and what am I watching now?

JESSICA KEARNEY: Yeah.

JEFF GREENE: I'm really watching to see if these major model developers-- two things-- will really do what they're talking about, putting controls in place. It's not easy. I have friends who work at them, and I know they're trying.

The hard part we have is our adversaries won't. But the other thing I'm watching is people talk now about less models and harnesses, which is the framework that allows agents or AI models to do these things. And what I'm seeing, particularly on the defensive side, is a good harness, which is if you think about an AI model as the engine, a harness is like the chassis and all the parts that make it work, a good harness is almost as effective with open source public models as the super powerful private models are.

So even if we get to the point where the AI companies are putting controls in place, the horse may be well past the barn.

JESSICA KEARNEY: That's certainly a lot to unpack. And I think actually we had over 200 questions submitted during pre-registration for this program. And many of the questions were to what you were just alluding to, can we keep up with and stay ahead of some of these new models? And I know we'll talk a bit more about AI certainly during the course of this hour.

Nicole, I wanted to ask you still as we're thinking about the global threat landscape I mentioned, we're all reading the headlines, and I find myself trying to connect the dots between these isolated stories that I'm reading. And I think it's easy for these things to feel abstract and far away, but you do such an eloquent job of making it real for folks.

I'm wondering, as we're thinking about some of these nation-state actors and some of the global developments that impact cybersecurity, how do you actually make that real for real people and businesses here in the United States? And how that might impact our daily lives?

NICOLE TISDALE: Yeah, I love this question, and I love being able to talk to the Main Street, but also, y'all, I really am from a no traffic light town in Mississippi. So I call it the Piggly Wiggly conversation because everyone knows that I work in national security. And so they ask me about these things.

And so I want to give you all what I call the Main Street version of what Jeff has said. So when we talk about China, they're not just stealing secrets anymore. They are positioning inside our water systems, our power systems and how we communicate.

These are utilities. These are essentials that we use every day. And what Jeff said their goal is is panic and paralysis. They want to scare people. They want people to know we are in your water system, and they want people to be paralyzed with fear. That is what the threat is from China.

With Iran, Iran is very opportunistic. It hits whatever is exposed, whatever is the easiest, which is exactly why small organizations and small and local targets are getting hit. And so, when you think about Iran opportunistic, it really isn't about how much damage can we do, it's how much can we-- what system can we get in and wreak havoc?

For North Korea, y'all, it is all about the money for North Korea. From a geopolitical issue, they are trying to fund their activities for their government, for their nation-state. And so for them, businesses are just an ATM. And so when they are going inside these businesses, they are there to get as much money as possible, as quickly as possible.

And so what has changed as we talk about AI, but also as Jeff has mentioned how the threat has changed, it's more disruption. So we have China, Iran and North Korea all have amped it up. And it is not just spying. I-- to the dismay of everyone in-- all my godkids, they all think I'm a spy. And I'm like, no, y'all, I really am just an attorney who works on these issues. But it's because there are these narratives when we talk about other countries that, oh, they're just spying on us. They're just spying on us.

And it's not that spying itself is not something to be concerned with, but we are talking about positioning inside our utilities, the water we use every day. We are talking about attacking small businesses that are a part of our global supply chain or attacking universities or schools.

We are also talking about stealing money from these local businesses, or from these medium-sized businesses that are literally the economic driver for a whole city, for a whole town, for a whole county.?

And so that is what is different. And so the planning question for every business is what do we do when the lights, the water or the payroll goes down? What do we do if we're at a school when we can't access our systems and we can't access our educational tools?
JESSICA KEARNEY: And that's, of course, part of the exercising that we were just talking about. And I'm sure tabletop exercises as well within organizations to help game those things out. Correct?

NICOLE TISDALE: Yes. Yes. Exactly. Practice really does make perfect. When Jeff was talking about the exercises, you don't want-- when you have a cyberattack, that's going to be the worst hour, the worst day, maybe the worst month of your life. That doesn't want to be-- you don't want that to be the first time that you're thinking about who do you call-- what do you do and who do you call.

You want to practice while you have the time but also the confidence to make decisions, rather than just being responsive in an emergency.

JESSICA KEARNEY: While we're on it, what does an effective tabletop exercise look like? If you had an organization or maybe there's a 50-person insurance agency or brokerage? Where would they start with something like that?

NICOLE TISDALE: I'm going to defer to Jeff on that question because I participate in Jeff's tabletops.

JEFF GREENE: Nicole and I had some fun ones and which has informed what I do now. The most important thing is that they be realistic. When we're doing an exercise for an organization, we come in and talk to them to understand how their work, what their concerns are, what's important to them, so we can exercise the things that matter most to them.

In my experience, also you need them to be limited. Trying to do too much will end up with nothing that's useful. One of the ones that Nicole and I suffered through when we were in government, it started out as a tight cyber exercise. And then everyone kept throwing in different things they wanted to address, and we ended up calling it-- or I started calling it Cyber Sharknado because it was everything.

And we spent-- we lost a whole weekend day, and there was nothing that came out of it because there was just too much going on. You want to exercise until you find some failures. Your goal is not to be perfect, and you have to come into it with some humility that you're going to find gaps. That's the whole point of it.

And last thing is you got to have actions and follow up. We're working on one right now, my partners and I. And the goal is to bank those things that you can do now, everything Nicole said. Figure out ahead of time who you need to call. Figure out who, as I mentioned, what those gaps are. What can you do to speed up the response? It can be drafting basic communications so you're not spending 10 minutes or an hour getting it cleared by comms, by legal, by leadership. Just have fill in the blanks and then have those internal communication channels set up.

One of our goals often is to build three or four different Teams channels that might sit dormant. But the three minutes you're going to spend dumping the right people into that Teams channel are going to cost you data, and they're going to cost you money. And it gives you that confidence that you've done this a little bit before. Everything Nicole said about not wanting it to be your first time, the practice, those muscles is really essential. But the practicality and limited nature of it to me are the things that are often missed.

JESSICA KEARNEY: So keep it focused. Yeah. Go ahead, Nicole.

NICOLE TISDALE: I'll add to that too. Y'all, please make sure you're running through your comms plan when you're doing the tabletop too. To Jeff's point, you should be thinking about who is going to explain to your employees what's going on? Are you going to issue a press statement? If you're going to issue a press statement, who's in charge of that?

And we were talking about, when we used to run these tabletop exercises at the White House, y'all, it was so many times that we were in the room and I would be like, hey, no one's called Congress to tell them that you are going to have a public utility shut down. No one remembered to call the governor.

And when you run through those tabletops, that is the point, so that you have people in the room. And so you all really need to make sure any tabletop, you're figuring out technically what you're going to do, but you also really need to have a strong comms plan. Because in the moment, you can really forget about the public communications, the internal communications that you're going to need to make.

JESSICA KEARNEY: That's great. That's great. And all super practical. I went way practical, and now, I'm going to bring us right back to the global threats where we started. But I think that was a helpful sidebar, because I think when we're boiling all this stuff down, those are the really critical components once you get to that level of detail.

Jeff, I wanted to get your take. Obviously, we mentioned here, and I know you talked about last year, some of the hiring scams involved in fake IT workers. Can you just give us an update on where that stands? Because I know several months ago, it got a lot of press, and it continues to be in the headlines. But I'd love to hear your take on where that stands today.

JEFF GREENE: Yeah, there's good and bad. I think there's a lot more awareness. You talked about it being in the press, and you see more organizations picking up on how to stop it. There are better-- I hesitate to call them AI, but machine-learning tools to try to spot the indicators of someone who is a North Korean fake worker.

At the same time, the North Koreans are very good at keeping up with it. There are some interesting techniques. I can't remember if we talked about this last week or last year but asking a suspect interviewee to say negative things about Kim Jong Un or the North Korea itself. There are some good videos of this online where these people who are giving these great interviews freeze because they can't answer those questions.

But I anticipate that North Koreans will adapt and figure out how to handle that. But the bad news is it's still going on, which means it's still working. And it's just getting the awareness out there is just too hard because there are so many different entities that are capable of being compromised. And as we talked about, there's really two negative things to it. First, the North Koreans are going to take the pay and take it home, but you've given that person trusted access to your network, which means God knows what they could do, whether it's ransomware or stealing information. So we're making progress. But this is one that is a very, very tough nut to crack.

JESSICA KEARNEY: All right. Great. Let's continue on AI a little bit more. And Jeff, we'll just keep going with you here. You talked about, in your presentation, AI as an accelerator and not necessarily a brand-new threat. So I'm wondering if you can maybe spend one more minute on how we're seeing AI already in use today in cyber-attacks and then maybe also talk about on the other end on cyber defenses and AI.

JEFF GREENE: Sure. Initially, when the generative AI came out, most of the conversation was you will never see a poorly constructed phishing email again. The bad grammar is over. That is definitely true. You see very targeted ones that are specific to your interests or who you are, and they can do that at scale. But in terms of the nation-states, we've seen this split into two camps.

And roughly speaking, the Russians have been very tactical in what they're doing. And the Chinese have been very strategic. And the Iranians are just opportunistic. They're doing whatever they can. And the North Koreans are really just feeding it into their scams.

But Russia is focusing on high-speed impact, immediate effects. They're in the middle of a war. They're constantly targeting the Ukrainians. They're crafting convincing phishing scams. They're automating whether it's disinformation or attacks.

From the public reporting that's out there about China, they're taking a very slow and deliberate effort to develop AI tools that can act autonomously incredibly stealthily. They want a strategic approach built on the capabilities of AI that is somewhat like a self-licking ice cream cone. It's improving its tactics as it's improving its techniques.

So they are the long-term actor here. In terms of the defense side, very significant benefits. Still, it's a cat and mouse game. Huge help in sifting the wheat from the chaff in automating responses. I get a lot of questions from clients about what new AI tools should they buy. And my answer, my first answer usually is if it's someone telling you they have a super cool tool that's going to solve all your problems, be cautious. There's a lot of AI magic beans being sold.

If someone tells you they're going to help you do the things you're already doing or should be doing but doing them quicker and more efficiently, that's when you should jump in. And I mentioned before the harnesses. That's the other trend I've seen over the past six months.

Not everyone has access to these super powerful new models, but a lot of companies, some of the major financial institutions have put out instructions on how to take what they call open weight or open source, openly available free models, put them together and do some pretty impressive defensive stuff. So I still think in the long run, we'll probably end up being in a wash. The AI will get better attacking; we'll get better at defending. Right now, it's going back and forth, and both sides are aggressively working it.

JESSICA KEARNEY: Let's keep going with some of the practical things that organizations can do. We already talked about the tabletop exercise. Nicole, I'm wondering, what would you advise, what's the best free thing a business owner can do literally this week if they want to start somewhere?

NICOLE TISDALE: I love this question. My favorite and most easy thing is try to turn on multi-factor authentication everywhere you can. So I tell people, I'm like, look, I want you to use it everywhere. But I'm also realistic. I just want you to use it right now. I want every financial system that you have, anything that has $1 in it, $1 can be moved, $1 can be transferred, make sure all of those systems are set up on multi-factor authentication.

And give yourself a deadline. I tell people, you're logging into these accounts already, they're asking you to turn it on. I just want you to say yes. And just say yes. We're going into Cyber Awareness Month. By next Wednesday, can you make sure every time you've logged into a financial account, you have said yes when they asked you to turn on multi-factor authentication?

And then you'll get a little bit of muscle memory. And so you'll start to realize you'll start saying yes to the questions in other places as well. So it'll be your communication systems and things like that. But you don't have to do that right now. I want everyone in the next week, every time you log into one of your financial accounts and they ask you, do you want to turn on multi-factor authentication, I want you to hear my voice and I want you to say, yes, I'm going to do it.

It's going to take you maybe five minutes. Also, the technology has gotten a lot better at helping you to set it up as quickly as possible, because we know from practice and time, the longer, the more friction it is for you to set up multi-factor authentication, people don't set it up. And so it's going to be a lot faster than the last time you set it up, I promise you.

JESSICA KEARNEY: That's great. Is there anything, Nicole, that you're-- anything else that you're recommending now that maybe you weren't recommending even a year ago?

NICOLE TISDALE: Yeah, I think-- so what I've been trying to get people to do is to use a little bit more of the security features on their personal phone so that when it shows up in your business, you've already been practicing and you've already gotten comfortable with it. And so I'm a lot of fun at dinner parties and at parties in general.

But I always ask my friends, I'm like, hey, just a quick two second, can we make sure that you have automatic updates on your personal phone? And you can go into your settings, you can go ahead and you can just check.

A lot of my friends and family have been very excited because they get embarrassed. They're like, oh, I know I don't have that turned on. And turns out a lot of them do. If you start turning on these updates on your personal phone, it also becomes a muscle memory that you can take into your business and your organizations as well.

And so for me, those are the things I like to-- Jeff and I talk about this all the time. The goal is not to make it impossible for you to be hacked. The goal is for it to make it harder for you to be hacked or to experience a cyberattack and easier for you to recover if it happens. And so that's what all of these things are doing.

When you're turning on these automatic updates, you're also backing up your data. And so it's making it harder for you to be attacked. And then it makes it easier for you to recover if something happens because you've already backed up your data.

Multi-factor authentication, you're making it harder for someone to get into your financial systems. And if something happens, you're making it easier or quicker for you to recover those systems if someone else tries to take over them.

JESSICA KEARNEY: I think one thing that I remember, Jeff, from your presentation last year was if you're getting chased by a bear, you don't have to be faster by the bear. You just have to be faster than the next person. And I think similarly, don't be the house that leaves the garage door open at night or leaves the keys in the car of an unlocked car at night and just make sure you're not the easiest target. So that's really helpful.

I want to try to weave in some audience questions now as we go forward. And I'm going to summarize a bunch that we got together on the same topic. And we alluded to this, but the old advice was to watch misspellings. Obviously, we said a lot of that doesn't work anymore because of AI, when you're perhaps unable to locate a phishing email, emails, voices and even video can now look real and sound real. So what verification habits should a business adopt before it changes banking details, for example, or sends a wire?

NICOLE TISDALE: I'm happy to jump in on that one. Y'all, the biggest thing you can do is pause. The typos are gone, but the urgency is still there. When people are sending you emails, text messages, phone calls and it's like you have to take action immediately right now, that should be your first sign something's going on.

Most of the time, if you can-- there's the scientific evidence, and there's also a cyber awareness campaign called Take Nine. And it's this idea and concept of nine seconds is enough for you to slow down and remember that you shouldn't have-- you shouldn't be getting an urgent text message from your boss to wire money, because that's never happened before.

And you can pick up the phone and call and make sure before you do it. The urgency that these people are creating is your first sign that something is going wrong. And so that's what I would actually tell people. I'm like, what we've been trying to get people to do is just pause. That nine seconds is enough for you-- Maybe it's not a typo, but maybe it's enough for you to remember, wait, this is not how Jessica communicates with me. And I just got off the phone with her 30 minutes ago. Why is she sending an email instead of calling me back if this is that urgent?

JESSICA KEARNEY: That's great advice. And I think--

JEFF GREENE: Can I tag on with one thing that business but individuals too, what Nicole said is dead on. It is pause, have an out-of-band communication, call them. And businesses need to have a culture of that questioning is OK. You don't want to have an imperious or scary boss, so you can't call them and say, is this you? The bad guys trade on that.

But the other thing that I've spent a lot of time on with some of our midsized clients is help desk scams, where someone calls and tells you, hey, I'm Jeff from the help desk. There's a problem on your computer. I need you immediately go, go, go. Go to this website. And it's easy to find out enough information about a company online to figure out the name, some of the people in the company and who their service providers are. So these get very convincing.

So what I want companies to do is have some type of verification in place. Individuals are great too, but that you're confirming it's an actual help desk and education that a help desk scam is a bad guy's ticket deep into your systems.

JESSICA KEARNEY: One other practical question that's coming in just we all wear our business hat, but obviously, we're also looking for advice in our personal lives. Nicole, I'm wondering, do you have any general advice for the audience on passwords, organizing your passwords or even social media presence?

NICOLE TISDALE: I do. Jeff is going to make a face because he knows what I'm going to do. I want people to use their password manager that is on your personal device. And so I'd say this to people, and I also am aware too, a lot of you all, there hasn't been a lot of education on what these tools are on your phone.

So the majority of you all are using Android phones or Apple phones, and they have a built-in password manager. You don't have to go to the app store and download a password manager. You don't have to pay money for a password manager.

I want people to use the ones that are native on their personal phone, and I tell people to start with their phone because going back, Jessica, to what I said earlier, we're getting muscle memory. I want you to start practicing on your phone.

And so I use an iPhone, and I sit down with people, and I show them, I'm like, you know every time it's like, do you want to suggest a long password? And people are like, oh, I always say, no, because I'm never going to remember that. I'm like, well, your password manager is going to remember that. And so that's when I tell people, I'm like, I just want you to say yes, because now, they are actually copying and pasting that password in there. There is no password that y'all can come up with.

And this is the cyber community's problem. We started being like, oh, you need something long and unique and you need a special character. We've moved away from that because those can be automatically guessed. There's nothing that you can come up with. So we want people to use the password manager because that is a technical tool that is coming up with a password that makes it almost impossible to be guessed.

So I want people to use the password manager on their phone. Start with the one when it pops up and it's like, do you want us to suggest a password? That's your password manager asking, do you want to use me? And I want you all to start saying, yes.

JESSICA KEARNEY: That's great. Thank you so much for that. I would be remiss if I didn't ask you all about cyber policy today at the federal and state levels. Nicole, maybe we can start with you. We've seen some movement and emerging frameworks. What's your read on what's happening right now in Congress and state houses across the country as it relates to cyber policy?

NICOLE TISDALE: Yeah, we are in a really good place right now on cyber policy, and I know people are going to be like, what? Congress is actually doing something. My state legislature is doing something. What has happened when you have these threats and you have these attacks increasing, like what we've been talking about today, it has really brought new people into the cybersecurity conversation.

So at the federal level, what we've started to see is more movement toward giving funds and technical assistance to people at the state and local level. So the federal government sending money and funds back. Very specifically, we've been working-- I've been working with rural water owners and operators to help them get cyber expertise. So what we call hands on keyboards, people to actually come out and set up the cyber systems for some of these rural and small utilities.

That is a big win for people. Also, at the state and local level, what you've started to see is people pulling together resources to also get technical assistance. And for me, that's the one that I'm most excited about because I think-- and I saw someone asked about the training awareness and is it effective? And I was going to say, I like when policy is moving toward technical assistance. Even when we talk about training awareness, I know it's really hard for companies and organizations to do it. But if you can do a live training, if you can put people in a room, if I could get y'all at a dinner table and show you how to use a password manager, that usually goes a little bit further than some of these webinars.

And so I, from a policy standpoint and then also just a personal standpoint, people are all moving toward technical assistance and physically helping people to start using cyber tools, which I'm very excited about.

JESSICA KEARNEY: That's great. Thank you for sharing that. We have another question coming in from Heidi. She's here in the Northeast. And she said their local public school system was recently hacked, and they still don't have access to their system nearly three weeks later. They think it came from someone clicking on a link. How does that actually work and how quickly, once there is that type of breach of something happening behind the scenes, can a threat actor come in and actually shut down a system like that? Maybe Jeff?

JEFF GREENE: Sure. I mean, I'm going to sound like the lawyer I used to be. The answer is it depends. One of the big things it depends on is the preparation that the system had in place to begin with. It's often easy to get core systems back up so you can have the basic communications. But all the data that you may have lost, it's either gone or it can take a while to restore that from backup.

So we've seen instances-- LA unified a few years ago. I think I just left the White House when that happened. But school systems are a big target because they're for criminal gangs because they're often under-resourced, and they have a lot of valuable data. And it can be very embarrassing for the schools and also for the individuals involved.

In terms of how they get in, unfortunately a simple click can do it. And a lot of it is what Nicole was talking about. It's that multi-factor authentication but also something you as an individual can't protect against. And I want to pause for a second to say that the point that Nicole made about individuals can do a lot to protect themselves is as true today as it was 15 years ago when I started saying it, the faster than a bear.

But when you're talking about a network like a school, they need to be structured in a way that it makes it hard for an attacker to move around once they get inside. And a lot of that comes down to those same passwords. So if the school was structured to be open because it's often a very sharing place, it makes it easier for the attacker to move around.

School systems are like individuals. The things they can do to harden themselves do make themselves a harder target. I think it is possible that that school system may never fully recover, because if the data was corrupted and their backups were corrupted, they may not get them back. Last point I'll make, though, does not mean you should pay the ransomware attacker, because many of them have a history of not providing the data back.

There are organizations that will help you figure that out, but it is an incredibly tough spot to be in and one that Nicole and I have both been in talking to organizations trying to cope with, how do we keep going, do we pay a bad guy. But there's no shortcut once they've gotten in, and I'll make another plug for exercising helps shut those things off a lot quickly, a lot more quickly.

JESSICA KEARNEY: And I think that's a good point to end on, just preparation is so critical and another reason why we appreciate all the work that you both have done in government and continue to do. And I guess I'll just transition to my last question since we are at the top of the hour, which is I mentioned all your roles inside government and some of what you're doing today. I'm wondering if you can just, as we're closing out here, share with the audience what you're working on today and how you are keeping cyber advocacy and education alive and well in your current capacities. Jeff, do want to start?

JEFF GREENE: Sure. So with my partners, we're working to try to help individual organizations who is more collective in government, but we are doing everything from security reviews in some organizations to understand how they're structured to the type of exercises. You've talked about identifying the gaps to make them faster than the next person, so that they can escape those attackers.

It's very hands-on and direct, and it's everything from the operational to the policy. And it's been a lot of fun to see organizations dramatically improve their security. And a lot of it is what Nicole said is explaining it in simple terms, giving them concrete actions and getting over that initial inertia. And once you get somebody moving, it's a lot of fun to see them get excited about how they can get better.

JESSICA KEARNEY: That's terrific. Thank you, Jeff. And Nicole.

NICOLE TISDALE: Yeah, I will-- so the policy nerd in me, I tell people, I'm like, the water attacks and some of the energy attacks that have happened over the summer has really brought more people to the cyber conversation. And so I'm spending a lot of time talking to farmers and producers and the agriculture community about water and how impactful water is for them, but also how we can protect their systems.

And so I love that more people are feeling empowered and, quite candidly, mad and upset. And they're like, I want to defend our systems. I want to understand this. And so from a policy standpoint, that has been really good to get people who are traditionally not a part of the cyber policy conversations to be at the table and really driving that bar forward.

I've been working on the farm bill for the first time ever in my career, and it's been really, really good to see the agriculture community really take an active role in this. But then also, just on a personal note, I've joked about it a little bit today, but I really am spending a lot of time going around the country, whether it's conferences, going to schools, hopping on a Zoom webinar, talking to people about, how do we turn on automatic updates? How do we use our password manager? How do we turn on multi-factor authentication?

And it's one of those things of one of my friends is like, do people need a lawyer to show them how to do this? I'm like, well, once you know, it's your responsibility to show other people how to do it. And to Jeff's point, people do feel empowered, and people feel-- they're more cognizant. They're more aware. You tell them to pause, and they'll send me text messages or emails and be like, oh, my gosh, someone tried to scam me today. And I deleted the email, and immediately, I was like, that was the pause that I needed to take.

And so I'm excited that I feel we're transitioning from being fearful and paralyzed to being empowered to actually take cybersecurity into our own hands. And I'm excited about it.

JESSICA KEARNEY: That's terrific. And I think a terrific way to end the hour. We so appreciate both of your time and all that you're doing. I hope all of our audience members will follow you both on LinkedIn and keep up with what you're doing. Check out Jeff's Substack, Cyber Shorthanded, that he mentioned. We put a bunch of those resources in the chat. Thank you both for your time and all of your expertise today. It's very much needed.

JEFF GREENE: Thank you.

(DESCRIPTION)
Slide, Travelers Institute Risk & Resilience. Cyber Podcast Series. Cyber (registered trademark). Prepare. Prevent. Mitigate. Restore. AI's Impact on Cyber Vulnerability and Defense. October 5, 2026. Closing the AI Governance Gap. October 12, 2026. Dark Web Intelligence and the Access Broker Economy. October 19, 2026. A Cybersecurity Wishlist for Businesses of Any Size. October 26, 2026.

(SPEECH)
JESSICA KEARNEY: All right. Great. Well, thank you so much for sticking with us to the hour. That was a fascinating conversation. I hope you took away from it as much as I did. As always, we'll thank Nicole and Jeff and hopefully have them back on a future program.

So stick with us. We have more on cyber. So you're in luck. So throughout the month of October, we're going to be releasing four special episodes of our Travelers Institute Risk and Resilience podcast. So we went into our studios internally and recorded conversations with some of Travelers’ top cyber experts. They dive into AI vulnerability, AI governance, the dark web and even more practical guidance to improve your cyber safety. So please check those out wherever you get your podcasts.

(DESCRIPTION)
Slide, Wednesdays with Woodward (registered trademark) Webinar Series. Take our Survey. Link in Chat.

(SPEECH)
And also, take our survey. So we would love to hear what you thought of today's program, how you're going to use what you learned today. We always love that feedback and any other topics that you might want to hear about on a future show.

(DESCRIPTION)
Slide, Addressing the Availability and Affordability of P&C Insurance. Upcoming Symposia. October 21, Seattle, Washington. October 22, Phoenix, Arizona. October 28, Arlington, Virginia. October 29, Birmingham, Alabama. A picture of panelists on a stage. Text: For more information and to register: Travelersinstitute.org.

(SPEECH)
A few other quick plugs. As many of you know, the Travelers Institute has a national series dedicated to addressing the availability and affordability of P&C insurance. And in the last year, we've traveled to 16 cities and met with more than 2,000 risk professionals and others on this critical topic. And in the second half of October, we are back on the road again, this time visiting Seattle, Phoenix, Arlington, Virginia and Birmingham. So if you're in one of those areas, just want to flash this on screen.

You can visit us at travelersinstitute.org to learn more and register for any one of these programs to talk about insurance availability and affordability.

(DESCRIPTION)
Slide, Wednesdays with Woodward (registered trademark) Webinar Series. Upcoming Programs. October 7, Competitive Advantage Under Pressure: What Really Protects Deal Value. October 14, When AI Joins the Team: Human Connection in the Intelligent Workplace. November 4, Tapping a High-Value Talent Pool: Veterans and Military Spouses. Register: travelersinstitute.org. Travelers Institute (registered trademark). Travelers.

(SPEECH)
And then finally, we have a great lineup of webinars over the next few weeks, and I hope you'll join us for all of them.

On October 7, we're going to do a deep dive into a new Travelers report that examines what drives durable competitive advantage in business. So Travelers teamed up with Morningstar to survey 700 CFOs and risk managers across manufacturing, tech, life sciences and construction. And we're going to break down all the findings for you.

Then on October 14, we're going to have another repeat guest, John Burrows. He's co-author of the soon to be released book Social Capital at Work, and he's going to share practical tips, really, to build all of that human connection in the workplace while we're in the age of AI. How to better use workplace technology really as a force multiplier for things like collaboration, innovation and performance.

He was fantastic last year. So whether you joined it for that one or not, we really suggest you join us on October 14. And then on November 4 right ahead of Veterans Day, we're going to lay out a practical roadmap for recruiting and hiring veterans, active military and military spouses within your organization and we'll outline a real business case for folding this group into your talent pool. So bring all your hiring manager friends on November 4.
(DESCRIPTION)
Slide, Wednesdays with Woodward (registered trademark) Webinar Series. Watch. travelersinstitute.org. LinkedIn. Connect. Joan Kois Woodward. Listen. Wherever you get your pods. Travelers Institute (registered trademark). Travelers.

(SPEECH)
And then lastly, as always, you can check out all of our past webinar replays and more on our website travelersinstitute.org. Thank you all again for joining. I hope you have a wonderful afternoon.

[MUSIC PLAYING]

(DESCRIPTION)
Text: Travelers Institute (registered trademark). Travelers. travelersinstitute.org.