Latest news with #GunterOllmann
Forbes
15-07-2025
- Forbes
The Rise—And Risk—Of AI In Offensive Security
Gunter Ollmann is a global cybersecurity innovator with decades of experience, patented tech and leadership across 80+ countries. Offensive security tools, which are designed to proactively identify threats and vulnerable attack vectors before they occur, have long been exploited by threat actors. AI is, unfortunately, perpetuating the issue and, in particular, is making social engineering easier since it empowers criminals with native language capabilities, supercharging their effectiveness. But AI is also working to the defender's advantage by shaking up the traditional penetration testing sector, which once centered on "breadth," e.g., identifying as many vulnerabilities as possible using scanners and automated tools, so that it has now evolved into full-scale attack and breach simulation. This capability effectively puts the defenders in the attacker's "shoes" so they replicate the tactics of threat actors to help organizations understand how far an attacker could infiltrate their systems. How AI Enhances Offensive Security While Introducing New Risks As with most things AI-related, innovation is a double-edged sword. As tools improve, they benefit not only defenders but also attackers. For defenders, tools that once required manual triage are now equipped with AI that can scan, correlate and validate vulnerabilities. For instance, when different scanners return conflicting information, AI can determine which findings are likely false positives, saving human analysts hours of triage. Now, instead of sifting through lengthy lists of potential issues, testers can focus on what truly matters: issues that are exploitable and impactful. For attackers who used to rely heavily on manual efforts to gather intelligence on targets, they can now use AI to mine the internet, analyze social networks, access data dumps and even build virtual personas that can infiltrate private online communities. These personas can be tailored to a specific user's interests—we have seen train hobbyists targeted and used to establish trust before delivering a targeted phishing link or malware payload. These AI-generated personas may join relevant forums, interact with the target over time and build credibility in a way that was previously too labor-intensive to execute. AI also plays a major role in passive reconnaissance. Oftentimes, attackers don't even need to touch a target system and can use AI to collect extensive intelligence about an organization from public and semi-private sources. For example, it can determine which individuals have administrative access, what systems are publicly exposed and what historical vulnerabilities exist. This reduces the need for noisy scans and increases the chances of a successful, undetected breach. But of course, defenders can use these capabilities too, hence an ongoing game of "cat and mouse" between red teamers and threat actors. Evaluating Offensive Security Vendors AI without human expertise generates "noise," particularly hallucinations, which throw false positives and negatives into the mix, so it needs highly skilled experts who know how to interpret the findings and use the tools effectively. This pool exists as the discipline has evolved from an "art" into a "science," where a global community of elite testers all perform to the same standardized methodologies and regulatory standards. This has helped streamline the logistics of launching high-quality tests quickly, enabling better remediation, retesting and translation of findings into business-relevant language for developers and executives. With organizations assured of consistency across processes, it's up to vendors to differentiate on their ability to simulate modern threats, collaborate closely with internal teams and provide testing agility. Features such as retesting, contextual reporting and access to global talent pools are also critical. Humans Versus AI Pentesting has evolved from a niche security function to a broad organizational priority. Reports no longer go just to security teams; they are reviewed by engineering leaders, product owners and other business stakeholders. Findings are now written in context for the end audience, and AI helps facilitate this translation, ensuring that vulnerabilities are understood and fixed by the right teams. This ensures not only a faster resolution but also that development teams remain focused on delivering secure code from the outset. The biggest question facing the industry is whether AI will replace pentesters. The answer is "yes" for traditional average pentesting and "no" at the top end. AI can excel at automating routine tasks, but skills like red teaming at the highest level are a human endeavor. Elite testers bring knowledge of the best tools to use and the experience that can't be replicated by algorithms. We're seeing that currently, the best results come from hybrid teams where AI handles repetitive, data-intensive tasks and human experts focus on strategy, interpretation and innovation. This is a continuation of a long-term trend whereby so-called "tier one" security analysts were automated some ten years ago. It means smaller teams can achieve more with routine tasks such as scanning, correlation and log analysis handled by AI, while expert humans focus on complex and strategic areas. Cybersecurity Is About People AI is revolutionizing offensive security, bringing with it both immense promise and considerable peril. The tools of the trade have evolved, and so too must the people and processes that govern them. As the attacker-defender arms race accelerates, the role of AI will only grow. But in the end, cybersecurity is still about people. Penetration testing and Red Teaming are driven by highly skilled individuals who understand how adversaries think, and they leverage AI as a tool to sharpen their edge. The adversaries are human—and so too must be the defenders. To truly stay ahead, organizations need to blend elite research talent with smart technology and never lose sight of the human element that defines success in security. Forbes Technology Council is an invitation-only community for world-class CIOs, CTOs and technology executives. Do I qualify?
Techday NZ
26-06-2025
- Business
- Techday NZ
Growing gap revealed between AI innovation & enterprise security
Cobalt has published the State of LLM Security Report 2025, highlighting a growing gap between generative AI adoption and the security measures needed to protect enterprises. The report finds that 36% of security leaders and practitioners acknowledge that the evolution of generative AI (genAI) is outpacing their teams' capacity to secure it, as organisations increasingly embed AI into fundamental business processes. Heightened concern amongst security professionals has prompted many to call for a temporary slowdown. The research indicates that 48% of respondents support a "strategic pause" to allow time for defensive measures against genAI-driven threats to be recalibrated. Despite this, there are no indications that such a pause will take place. "Threat actors aren't waiting around, and neither can security teams," said Gunter Ollmann, Chief Technology Officer at Cobalt. "Our research shows that while genAI is reshaping how we work, it's also rewriting the rules of risk. The foundations of security must evolve in parallel, or we risk building tomorrow's innovation on today's outdated safeguards." The State of LLM Security Report 2025 presents several statistics that illustrate both the state of readiness and the challenges facing organisations. According to the findings, genAI-related attacks are now the primary IT risk for 72% of professionals surveyed, yet 33% of those respondents are not conducting regular security assessments, including penetration testing, for their large language model (LLM) deployments. The report also identifies a growing lack of confidence in the AI supply chain, with 50% of respondents seeking greater transparency from software suppliers regarding how they identify and manage vulnerabilities. This reflects a broader trend in which trust and security assurances become increasingly important as AI becomes more integrated into enterprise systems. A distinction emerges between security leaders and practitioners regarding their respective concerns about genAI. The report finds that 76% of security leaders—those at C-suite and Vice-President level—are more concerned about long-term genAI threats, such as adversarial attacks. This is compared to 68% of practitioners expressing similar concerns. Conversely, when assessing near-term operational risks such as inaccurate model outputs, 45% of practitioners indicate concern compared to 36% of security leaders. The most cited concerns about genAI deployment among all survey participants include the risk of sensitive information disclosure (46%), model poisoning or theft (42%), and training data leakage (37%). These risks highlight a broader need to ensure the integrity and security of AI-driven data pipelines. The report also examines the outcomes of penetration testing across multiple organisations. It reveals that while 69% of serious vulnerabilities discovered through testing are ultimately resolved, this rate drops substantially to just 21% for high-severity vulnerabilities in LLM-specific tests. The report notes that 32% of findings in these tests are classified as serious, reflecting the lowest resolution rate for any test category reviewed by Cobalt. The disparities identified in remediating vulnerabilities, particularly in environments where AI plays a central role, highlight a significant gap in security practices. This is especially notable as organisations continue to accelerate the deployment of generative AI tools in daily operations. "Much like the rush to cloud adoption, genAI has exposed a fundamental gap between innovation and security readiness," Ollmann added. "Mature controls were not built for a world of LLMs. Security teams must shift from reactive audits to programmatic, proactive AI testing—and fast." The report is based on an analysis of data collected from Cobalt penetration tests across more than 2,700 organisations, supplemented by a third-party survey conducted by Emerald Research. The data provided for independent review was anonymised before being given to Cyentia Institute for analysis. These findings suggest that despite significant awareness of genAI risks, there remains a disconnect between the speed of AI adoption and the implementation of comprehensive security measures, as organisations weigh the imperative for both innovation and protection.
Business Wire
28-04-2025
- Business
- Business Wire
Cobalt Named Winner of the Coveted Global InfoSec Awards during RSA Conference 2025
SAN FRANCISCO--(BUSINESS WIRE)-- Cobalt, the pioneer of penetration testing as a service (PTaaS) and leading provider of offensive security services, is proud to announce it was named Outstanding Offensive Security and Outstanding Pentesting from Cyber Defense Magazine (CDM) at the 13 th Annual Global InfoSec Awards, which takes place today in conjunction with the RSA Conference (RSAC) 2025. RSAC attendees can learn more about the Cobalt Offensive Security Platform at booth #4525 North at the Moscone Center in San Francisco. 'This recognition by Cyber Defense Magazine speaks to the success of our Cobalt Offensive Security Platform, along with the exceptional expertise of our global community of pentesters and the critical role they play in helping organizations stay ahead of evolving threats,' said Gunter Ollmann, CTO, Cobalt. 'As offensive security continues to evolve, we're proud to be leading the charge—especially in pioneering new approaches to testing AI and LLM applications. Our focus remains on empowering customers with cutting-edge insights and innovation that make a real impact.' Cyber Defense Magazine honors innovators of all sizes and stages across the global information security space. These awards recognize cybersecurity companies with the most unique and compelling value propositions—whether in their leadership, products, or services. Winners are selected by a panel of certified security professionals, including CISSP, FMDHS, and CEH holders, based on their independent review of each company. 'We scoured the globe looking for cybersecurity innovators that could make a huge difference and potentially help turn the tide against the exponential growth in cybercrime. Cobalt is absolutely worthy of these coveted awards and consideration for deployment in your environment,' said Yan Ross, Global Editor of Cyber Defense Magazine. The Cobalt Platform stood out among the competition for its strong focus on offensive security and PTaaS. The Cobalt Platform centralizes access to security services from its team of pentesters, making it easier to find and fix vulnerabilities across environments. It enables faster pentest launches, real-time collaboration with testers, and seamless integration with remediation workflows–helping organizations identify critical issues and prevent security incidents. About Cyber Defense Magazine Cyber Defense Magazine is the premier source of cyber security news and information for InfoSec professions in business and government. We are managed and published by and for ethical, honest, passionate information security professionals. Our mission is to share cutting-edge knowledge, real-world stories and awards on the best ideas, products, and services in the information technology industry. We deliver electronic magazines every month online for free, and special editions exclusively for the RSA Conferences. CDM is a proud member of the Cyber Defense Media Group. Learn more about us at Cyber Defense Magazine and visit and to see and hear some of the most informative interviews of many of these winning company executives. Join a webinar at and realize that infosec knowledge is power. About Cobalt Cobalt is the pioneer in pentesting as a service (PTaaS) and a leader in offensive security services. We are focused on combining talent and technology with speed, scalability, and expertise. Thousands of customers and hundreds of partners rely on the Cobalt Offensive Security Platform, along with 450+ trusted security experts, to find and fix vulnerabilities across their environments. By enabling faster pentest launches, real-time collaboration with pentesters, and seamless integration with remediation workflows, we help organizations identify critical issues and accelerate risk mitigation so they can operate fearlessly and innovate securely. Cobalt maintains an outstanding NPS of 9.12, reflecting its dedication to customer satisfaction. Read our reviews on G2 to see why customers love us. More at Follow Cobalt on LinkedIn and X.
