28 Oct 2026 · 22m · Arvind, Sridhar Boddula · 17 quoted facts
Sridhar Boddula of MassMutual argues that AI has collapsed the cost and skill needed to run a credible cyberattack, so many more people can now act like sophisticated adversaries. Defenders can't answer this by buying more tools or hiring more analysts. They must test their defenses continuously, build security into engineering work, and automate their processes.
The tension is between attacker speed and slow corporate habits: annual penetration tests, review queues, and waiting for budget cycles. Boddula says the fix starts with practical governance, meaning knowing what data you hold, where it lives, and which systems matter most. Leaders should then test one critical system now, instead of waiting for a perfect plan or a larger budget.
Boddula says phishing kits, voice cloning and code-writing tools now turn plain-language instructions into credible campaigns. He says that since about April, a $50 model can let one actor hit many companies at once.
Boddula says a new AI-enabled credential attack can emerge in weeks or days. He recommends frequent exercises built on current scenarios and even daily testing of security controls.
Boddula says manual analysts facing automated attackers simply generate more alerts. He wants automation treated as a core security skill, with findings that arrive already prioritized and with a suggested fix.
Boddula says a review queue can't keep pace with attackers who work in hours. He wants security engineers inside DevSecOps pipelines (development workflows with security built in), using policy as code and automated guardrails.
Boddula says you can't protect what you don't know you have, so leaders should inventory assets and rank them by risk. He then suggests testing the one system holding the most regulated data, instead of waiting for budget approval.
Sridhar Boddula says attackers' goals haven't changed, but AI tools have cut the cost and skill needed to run convincing attacks. So far more people can behave like sophisticated adversaries.
It means running attack-style tests of your defenses often, even daily, instead of in an annual or twice-yearly penetration test (a hired mock attack). Boddula says threats now change in days or weeks, so older schedules leave gaps.
Boddula says that if attackers use automation, extra analysts working by hand mostly produce more alerts. He argues the workflow itself should be engineered and automated.
Boddula says to start with an inventory and rank assets by value. A flaw in a point-of-sale or e-commerce system is top priority, while one on an internal system not exposed to the internet can be lower priority.
Boddula says to start with practical governance: know what sensitive data you hold, which rules apply, where it lives and who is accountable. Then pick one system holding your most regulated data and run a focused test now.
Stated by the speakers. Each quote matches the transcript, which shows what was said, not that it is true.
Sridhar Boddula says that in more than twenty years in technology he has seen security shift from perimeter security to cloud and from individual hackers to organized ransomware.
“So in more than twenty years in technology, especially in cybersecurity, I've seen major transitions, you know, from perimeter security to cloud, from individual hackers to organized ransomware.”
Boddula cites the New York Department of Financial Services rules and the European DORA regulation as examples of the shift from lighter oversight to formal regulatory frameworks.
“And from, you know, lighter oversight to frameworks and regulatory, such as, you know, New York D F S, the European Regulation Dora and S U C Regulation Special Publication.”
Boddula says attackers' goals of money, data and access are unchanged, but the expertise and cost needed to pursue them have fallen significantly.
“Attackers still want, you know, money, uh, they want data, and they want to gain access, but the expertise and cost required to pursue those goals have fallen significantly.”
Boddula says AI tools allow a low-skilled actor to create a convincing phishing campaign, clone an executive's voice and generate exploit code.
“So, a low-skilled actor can create a convincing phishing campaign, you know, clone an executive voice, and generate expiry code.”
Boddula says a breach at a regulated company can trigger regulatory scrutiny, disclosure requirements, legal exposure and lasting reputational damage.
“A breach is not just a technology incident. So nowadays, you know, it can trigger regulatory scrutiny, disclosure requirements, legal exposure, and lasting reputational damage.”
Boddula says a single attacker can now test the same technique against hundreds of organizations at almost no extra cost.
“One actor can now test the same technique against hundreds of organizations at almost no additional cost.”
Boddula lists cloud-native protection, software supply chain security and identity controls for AI agents that hold credentials as areas where tooling matters.
“especially as teams evolved and they evaluate, evaluate cloud native protection, the software supply chain security and identity controls for A A I agents that can hold credentials and act on production systems.”
Boddula says annual or semi-annual penetration testing made sense when threats evolved more slowly but is now inadequate.
“annual or semi annual pen testing or their exercises made sense when threats evolved more slowly.”
Boddula gives as an example scenario a synthetic voice used to influence a help desk, followed by compromise of a dormant service account and escalation through an identity provider.
“For example, like, you know, synthetic voice used to influence a help desk, followed by compromise of a dormant service account and escalation through an identity provider.”
Boddula says security engineers should work inside DevOps or DevSecOps pipelines, expressing policy as code and building automated guardrails.
“security engineers working, you know, alongside or inside the DevOps or DevSecOps pipelines, you know, expressing policy as code and building automated guardrails”
Boddula describes a well-designed zero trust model as one that assumes compromise is possible and limits its blast radius by design.
“A well designed zero trust model assumes compromise is possible and it limits its blast radius by design rather than relying on every attack being stopped at the perimeter.”
Boddula argues that adding analysts when attackers automate does not help because the analysts still work manually and mostly generate more alerts.
“When attackers automate, adding, you know, additional analysts, it's not gonna help, you know, because those people, they will still do the manual process and all they do is just, they just simply generate more alerts.”
Boddula says an e-commerce company should treat systems involved in point of sale or e-commerce as its most critical assets when ranking vulnerabilities.
“Let's say, you know, if you're a e commerce site, any systems that involved in your, uh, point of sales or e commerce, those systems are critical.”
Boddula lists dormant service accounts, over-permissioned roles, unmanaged API keys, standing admin access and third-party integrations as common hidden identity risks.
“dormant service accounts, you know, over permissioned roles, unmanaged A P I keys, you know, having a, you know, the long long lasting or standing admin access and third party integrations and the contract access.”
Boddula states that a basic cybersecurity principle is that you cannot protect assets you do not know you have, so organizations need a full inventory.
“one of the basic principle in the cybersecurity is if you don't know what you have, you cannot protect.”
Boddula recommends that leaders choose one system holding their most sensitive or regulated data and run a focused test on it immediately.
“choose at least, you know, one system that holds your most sensitive or regulated data and run a focused test on that one and see what are those findings.”
Boddula says boards are unlikely to approve a $10 million request for AI-era security, so teams must work within limited budgets by empowering staff with automation.
“You are bored, they're not gonna approve, like, you know, 10 million to you.”
Boddula explains that the barrier to launching serious attacks has collapsed even though attackers' goals are the same. This frames the episode's central risk.
“I don't think shifted fully captures how quickly the environment has changed”
AI tools let far more people mount convincing phishing, voice-cloning and code-generation campaigns, and regulated firms face extra consequences from any breach.
“far more people can now behave like sophisticated attackers or adversaries”
Boddula dates the sharp acceleration to frontier AI models arriving this year, which let attackers hit many companies cheaply and at once.
“in the last six months, it's kind of exploded, became a reality”
Annual and semi-annual penetration tests are too slow for AI-driven attacks, so teams need frequent exercises built on current scenarios.
“exercises made sense when threats evolved more slowly”
Boddula says security must stop being a review queue and become part of engineering pipelines, with policy as code, zero trust and automation instead of extra headcount.
“security cannot remain a review queue that slows down change”
With hundreds of possible vulnerabilities, teams must prioritize by asset value and exposure and use automated patching and validation.
“those are critical vulnerabilities, but priority can be low”
The first step is mapping regulated data and obligations, closing identity gaps and building a full asset inventory.
“the first real step is practical governance, not another policy document”
Boddula urges leaders to test one critical system immediately and use the results to win later funding, since big budget requests rarely succeed.
“An imperfect control operating today creates more value than a perfect strategy.”
Welcome everyone to the Emerj AI in Business podcast. Today's guest is Sridhar Boddula, Head of Security Platform Engineering at MassMutual. Sridhar discusses how the cost and skill required to mount a credible cyber attack have collapsed, driven by widely accessible A I tools that let low skill actors run convincing automated campaigns. He explains why adding more tools or more analysts isn't enough on its own, and what it actually takes for a security team to shift from periodic testing to continuous validation, both for machine speed threats.
Today's episode is sponsored by XBOW. A quick note for our audience that the views and opinions expressed by Sridhar on today's program are his own and do not reflect those of MassMutual or its leadership. According to Nielsen, 91% of podcast listening happens alone, indicating deep, undistracted attention, ideal for complex B two B messaging. To learn how leading brands and A I startups connect with enterprise A I buyer audiences at scale, download our media kit at Emerj dot com slash a d one.
That's e m e r j dot com slash a d one. Now the conversation with Sridhar. Sridar, welcome to the Emerj A I in Business podcast.
Thank you, Arvind. Thanks for, uh, having me.
Yeah, very interesting conversation today, and I've been really thinking about how strange it is that the barrier to being dangerous has basically just completely disappeared. It used to take real skill and time to threaten an organization and now it sounds like Yes, you can basically just go and rent A I for a while, and it's gonna cost you less than your dinner. Bowl and start probing for weaknesses and start becoming dangerous. And I want to start with what that shift actually feels like from where you sit.
How would you describe the way the threat landscape has shifted for security teams like yours over the past year or two?
Great place to start, cause I don't think shifted fully captures how quickly the environment has changed. So in more than twenty years in technology, especially in cybersecurity, I've seen major transitions, you know, from perimeter security to cloud, from individual hackers to organized ransomware. And from, you know, lighter oversight to frameworks and regulatory, such as, you know, New York D F S, the European Regulation Dora and S U C Regulation Special Publication. Now, those changes were significant, uh, but organization could see them coming and plan for them.
Uh, you know, the past two years feel different because the economics of attack have changed. You know, attackers still want their their motto did not change, right? Attackers still want, you know, money, uh, they want data, and they want to gain access, but the expertise and cost required to pursue those goals have fallen significantly. So, you know, historically, you know, a sophisticated attack against any, you know, reputed institution required the skilled people who understood the environment, you know, wrote custom code, created the pretext and operated quietly.
So that expertise was, like, at a lodge, which limited the number of number and pace of serious attacks. So, in today's world, that skill barrier has largely collapsed. So, especially with, you know, the A I enablement and advancements in the A I, you know, A I enabled probing automated phishing kits, uh, voice and the video synthesis and code assist tools can turn, you know, plain language instructions into credible attack campaigns. So capabilities that once required deep expertise and a substantial, you know, budget and money are now inexpensive and widely accessible.
So, a low-skilled actor can create a convincing phishing campaign, you know, clone an executive voice, and generate expiry code. So, you know, the threat is not simply that attackers become smarter. It is the fact that it is that far more people can now behave like sophisticated attackers or adversaries. So we have moved from defending against a relatively small number of highly capable actors to facing a much larger population equipped with automation that amplifies reach and speed.
For regulated industries, the stakes are especially high. You know, we operate under obligations such as, you know, European regulations or Asia pack, or the, you know, U S financial regulations. A breach is not just a technology incident. So nowadays, you know, it can trigger regulatory scrutiny, disclosure requirements, legal exposure, and lasting reputational damage. So the final shift is the combination of speed and scale. One actor can now test the same technique against hundreds of organizations at almost no additional cost.
Much of that activity is broad and automated. The tools they use probe widely, you know, identify softer targets, and then escalate successful attempts quickly. So that creates, you know, far more noise at the perimeter, with a smaller number of dangerous signals hidden in front. So, one in one sentence, the barrier and cost of launching a capable attack fall in sharply, while the consequences of the one successful attack remains extremely high. And, under tighter regulation, maybe even higher, that widening asymmetry is the defining feature of today's threat landscape.
And it sounds like the threat is real, and whenever something feels this real and this dangerous and, you know, a lot is at stake. I always wonder that we predicted, is it even possible, or was it possible to predict it? So has this changed a lot in the last few months, or has it been building up for a while and it just exploded?
I think it was kind of bubbling up in the last, especially two years, but in the last six months, it's kind of exploded, became a reality. Especially with, you know, some of the A I companies, you know, I do not want to put any company's name in this conversation, but, you know, with the, you know, advent of the frontier A I models, you know, those models have, you know, capability of, you know, attacking, enabling, like, you know, just, you know, spin off the number of requests, bombard the companies with the cyber threats.
So that has changed significantly in the last, I would say, six months since April of this year. That's where, like, you know, people, just $50, they can buy a model, and then they can attack number of companies at the same speed simultaneously. They don't need an army of people to do that, and they don't need a huge money to do that. That has changed in the last six months.
Before we get to talk about the solution for all of this, the scary thing is I had a guest on the other day that told me about this event where a few hundred agents escaped out of their sandbox and all for evil. And then they were even trying to recruit other agents. Mind going, so it's not even just being aware and building your security for humans, it's also building your security for the agents that go rogue, apparently.
And I think, what's one thing that I keep coming back to when we have these types of conversations and brainstorming about these ideas is is the speed problem? And I think you also brought that up now in a very nice way. The teams teams used to test for weaknesses in their processes, in their technology every now and again, let's say once every quarter, maybe once every six months for some of these teams. And that obviously is is not going to to cut it anymore.
They're going to need something that never stops. Uh that's just from what I hear. So I'm curious, what actually has to change inside the team for this to even be possible? Is there a new capability, a different way of working? Is it something else entirely?
That's a great question, you know, this is one of the questions I think about in most of my day job as a head of security engineering here at MassMutual. You know, the easy answer is not about, you know, buying other tools, another platform, or, you know, buying other detection tools. You know, tooling matters, especially as teams evolved and they evaluate, evaluate cloud native protection, the software supply chain security and identity controls for A A I agents that can hold credentials and act on production systems.
But, you know, tooling is only part of the answer. The larger change is how the team operates, how often it tests itself, how quickly it makes decisions, and whether it's, you know, workflows or engineered for speed rather than, you know, built around manual handoffs. So first, I would suggest organizations to review their testing cadence. You know, their testing cadence has to change, you know, annual or semi annual pen testing or their exercises made sense when threats evolved more slowly.
But now, you know, those kind of, you know, semi annual or annual cadence, they are inadequate. When a new A I enabled credential attack can Emerj in matter of weeks or could be matter of days, given that, you know, as we were talking, you know, now it's not humans doing the attack, it's actually the agents or the software robots are doing the attacks. So now security teams need more frequent exercises built around current scenarios. For example, like, you know, synthetic voice used to influence a help desk, followed by compromise of a dormant service account and escalation through an identity provider.
So the best way to know whether an operating model works is to test it deliberately before an attacker does. So second one is the operating model must move beyond the traditional, you know, gatekeeper approach. Now, security cannot remain a review queue that slows down change while attackers operate in hours. It has to become an embedded engineering native function. So that means, you know, security engineers working, you know, alongside or inside the DevOps or DevSecOps pipelines, you know, expressing policy as code and building automated guardrails that catch, you know, these type of issues or these type of risks when they are introduced.
So it also means moving identity from static approval to continuous, you know, zero trust evaluation. A well designed zero trust model assumes compromise is possible and it limits its blast radius by design rather than relying on every attack being stopped at the perimeter. The third one, I would say, you know, teams must be built differently. Not simply okay, now you know, A I threats are increased, or we need to go and hire more people. That doesn't work.
When attackers automate, adding, you know, additional analysts, it's not gonna help, you know, because those people, they will still do the manual process and all they do is just, they just simply generate more alerts. Rather than, you know, automation engineering should be core security discipline. Findings should arrive with, you know, prioritized context and, you know, proposed remediation path, allowing engineers to act quickly instead of waiting in a ticket queue. And the objective is to engineer the workflow, not just add more more people to it.
So the answer is a threefold, you know, test continuously against current tech techniques more frequently. Maybe, you know, every day you test your security controls, make sure there are no gaps introduced with the A I threats and embedded security engineering into the development. That's basically security by design. And automate your process, not by hiring more people. That's how I would handle it, and that's what my suggestion how to handle these new threats.
That makes sense. So I'm thinking if we're going to do continuous validation, I'm sure that the noise will also be more. How do you personally decide when a finding is a real risk or just noise?
Well, that's a great point, you know, organizations just identifying the risk is not gonna help, right? You know, organizations should have a solid remediation plan. And, you know, with the A I threats, there's gonna be hundreds, thousands of zero day vulnerabilities. Like, how do you prioritize? How do you risk rank? So that's when next comes, you know, another, you know, you need to build, you know, A I based or A I automated vulnerability management or patch remediation.
So, first to your point, um, they have to risk rank those findings. And the way how organizations should risk rank them is, first, organization should have a appropriate inventory. Maybe that's like, you know, I'm gonna cover that in the next question, but, you know, first, what are the high asset values for the company? Let's say, you know, if you're a e commerce site, any systems that involved in your, uh, point of sales or e commerce, those systems are critical.
So, any vulnerabilities or any findings on those systems, those are the super critical. That's the priority. Whereas like, you know, hey, there are a bunch of vulnerabilities that are on a inter internal system where it's not exposed to the internet. Yeah, those are critical vulnerabilities, but priority can be low. So that's how they should prioritize and enable automated patching and validation capabilities.
Hm, that's interesting. I'm imagining now, with obviously me not being as high level as you, but imagining that we're basically going to build something like a a spam folder for the noise that's just noise. And when we and I think about your priority list, so I like that idea. The great part about this conversation is we're not leaving our listeners with just the conversation. We are also giving them a bit of guidance and a bit of a playbook as to what they should do next.
So, for the for other security leaders I in regulated industries, which are so sensitive, and we not only do we need to think about security and privacy, but also regulations and fines and everything that can come with it. Where is the first real step towards being ready for that kind of speed, making sure that we are at the same level as the attackers?
So the first real step is practical governance, not another policy document. Now leaders need to know what sensitive data they hold and which regulatory obligation apply to it, where it resides, and how the data is being processed, and who is accountable for protecting it. You know, in a regulated financial services that might include the S C C regulation, or any other European regulations, or the New York Department of Finance regulations, or it could be the local state requirements.
So, if an organization cannot quickly identify which systems hold regulated regulated data and which rules they have to apply, then every security investment rests on uncertain foundation. Now, data classification and regulatory mapping should be treated as a near term priority, not a multi year exercise. So the next step is to expose visibility gaps, especially, you know, around the identity. You know, that is where risk often hides. You know, as I mentioned, dormant service accounts, you know, over permissioned roles, unmanaged A P I keys, you know, having a, you know, the long long lasting or standing admin access and third party integrations and the contract access.
So, this is all the matters. And the important part is not just to document the findings, but, you know, decommissioning, reducing or governing the access that creates unnecessary exposure. The third step is to, uh, you know, examine the team model. The answer is not automatically, as I mentioned, like, you know, don't don't bring, uh, too many vendor tools, that's not gonna help. Come up with, uh, your inventory, you know, one of the basic principle in the cybersecurity is if you don't know what you have, you cannot protect.
Have a right inventory of all of your digital assets, including your, you know, applications, platform, whether it's a s a s or managed, uh, including your hardware assets as well. You know, all the your switches, routers, uh, make sure you have a full inventory. That's part of the governance. And then risk rank them, what are the high risk assets, and just focus on them. And finally, you know, leaders often have reasonable reasons to wait, you know, an audit, a budget cycle, or evolving regulation.
But, you know, the bad actors, they do not pursue while organizations seek certainty. An imperfect control operating today creates more value than a perfect strategy. Uh, that remains, uh, on paper. If I were to leave listeners with one action immediately, it would be this, you know, choose the system, choose at least, you know, one system that holds your most sensitive or regulated data and run a focused test on that one and see what are those findings.
And the last one, as I mentioned, you know, don't wait for, you know, we need to wait for 2027, our board review, board approvals. Just do what you have, pick one system and see what are the findings and, uh, put together action plan how you can fix it. And then with that information, you can go to your board or your management committee and get the approval for 2027, but don't wait wait for that one.
So basically, in simple way, governance, uh, write policies and write inventory and take an action immediately, rather than waiting on a, you know, big initiative or a budget approvals.
I think all of this makes sense and our listeners will, as they hear you say this, they'll tick this off in their heads and be like, this, yes, this should be added to the agenda, definitely. And I think our overall message before we wrap it up for our audience is just that we need to rethink security because in the past, our attackers were human, and we were able to combat that or defend with human capabilities. Uh, but our attackers are no longer just human.
So we can no longer just use the human defense force. Uh, we need things like validation, continuous validation, uh, continuous security checks and pen tests. It's it's no longer a annual or biannual or quarterly event. It is an everyday, twenty four seven event that needs to continuously happen. Because I think something that Sridhar just mentioned, he said, you know, expose the visibility gaps. The longer you wait, the bigger those gaps and the more gaps will exist.
Those gaps will come in a very short instance. So there's more to think about and definitely a lot more that needs to be done. Sridhar, is that the correct overall message that we want to send to the audience members?
Yeah, yeah, that that's correct. And one one last thing, just wanted to reiterate that, you know, every organization's everyone is going through the cost pressure, even with the invention of these A I threat, uh, threat and A I risks. You are bored, they're not gonna approve, like, you know, 10 million to you. So you got to operate with the limited budget that you have and how smartly and how you empower your team with automated capabilities. That's what I would say, you know, otherwise, if you ask millions of money, nobody's gonna get that money in this age of world.
Sridhar, thank you so much for joining us today. I'm excited to hopefully have you back on the show in the future.
All right, thank you, Arvind. Thank you. It was nice talking with you and thanks for having me in the show.
Wrapping up today's episode, let's look at the three key takeaways from our conversation with Sridhar. First, the cost and skill needed to launch a credible cyber attack have collapsed, putting real attack capability within reach of far more people. Second, tooling alone cannot fix the speed gap. Testing, cadence, decision making, and team structure all have to move to a continuous engineering embedded model. And finally, the first real step toward readiness is practical governance, knowing what data you hold, where it lives, and who's accountable for it, then acting on one system now rather than waiting for a bigger budget cycle.
According to Nielsen, 91% of podcast listening happens alone, indicating deep, undistracted attention, ideal for complex B two B messaging. To learn how leading brands and A I startups connect with enterprise A I buyer audiences at scale, download our media kit at Emerj dot com slash a d one. That's e m e r j dot com slash a d one. For further executive level analysis and to join our network of leaders delivering workflow impact with A I, visit Emerj dot com.
On behalf of the team at Emerj, we'll see you on the next episode.