The Security Intelligence podcast kicks off the new year by discussing key cybersecurity trends and challenges for 2026. The panel—Matt Kazinski, Jeff Kroom, Claire Nunees, and Nick Bradley—begin by sharing their ideal New Year’s resolutions for the industry. Their suggestions include better patching and removal of legacy equipment, treating cybersecurity as a core business function rather than just an IT issue, preparing for quantum threats, adopting passkeys, and focusing on operational resilience. They emphasize that AI is here to stay and should be used to augment, not replace, human expertise in cybersecurity.

The first major story covers Microsoft’s expansion of its bug bounty program. Now, all online services are in scope by default, including vulnerabilities in third-party and open-source components. The panelists agree this is a positive move, as it acknowledges the interconnected nature of modern software and incentivizes researchers to report vulnerabilities rather than exploit them. They note that this collaborative approach could set a precedent for other companies, potentially raising the overall security standard across the industry.

Next, the podcast examines the lingering impact of the 2022 LastPass breach, where hackers stole millions of encrypted password vaults. Years later, attackers are still decrypting these vaults and using the credentials, particularly to steal cryptocurrency. The discussion highlights the importance of password managers, but also the need for users to change compromised credentials and adopt stronger authentication methods like passkeys and multi-factor authentication. The panel stresses that while password managers are not perfect, they are still a critical tool for maintaining good security hygiene, provided users remain vigilant and proactive.

The conversation then shifts to OpenAI’s introduction of automated red teaming in its Atlas browser to defend against prompt injection attacks. This system uses adversarial AI models to discover and train against new attack techniques, essentially using AI to secure AI. The panelists see this as a step in the right direction, but caution that AI defenses are not foolproof and should always be supplemented by human oversight. They also discuss the parallels and differences between training humans and AI for security, noting that while AI can be trained to recognize certain threats, it lacks the emotional and contextual judgment of humans.

Finally, the episode addresses the commercialization of ClickFix attacks, a social engineering technique where users are tricked into running malicious commands. With new malware suites making these attacks easier to launch, the panel warns that the barrier to entry for cybercriminals is lower than ever. They stress the importance of ongoing user education, improved security hygiene, and the need for both individuals and organizations to stay vigilant as cybercrime continues to evolve and professionalize. The episode closes with a reminder to adopt passkeys and other modern security measures to stay ahead of emerging threats.