Swapnil Bhartiya: What surprised you the most in this year’s finding, either which you may have assumed that these kind of threats will go away, or you are not expecting them to appear at all, certainly.

Steve Winterfeld: So, you know, Akamai defends a number of banks, you know, the, the top US Banks, the top European banks. And so across these global banks, we see a lot of different types of attack. And we wanted to take a moment and you know, unlike the last report was global across attacks against APIs and denial of service attacks, and attacks against generative AI and ransomware and all these kind of things that, you know, these are where we defend. And as we defend against them, we collect data. And we wanted to share this data. And so the last one was kind of a global report. This one is more of an industry report. And so as we dive in, you know, some of the things that are what’s old is new again. And so we always end up talking about denial of service attacks. And so again, we saw a 738% increase in the duration of attacks. And so as you see these new peaks, and we’ve seen a lot of this lately, you talk about the Turbo Mirai, Kim Wolf and these other kind of attacks, they’ve really increased the volume, the scale of which we attack. And so when we talk about DDoS again, a quick refresher for those who don’t think about it every day you can attack the bandwidth and bits per second. You can overwhelm the CPU with packets per second. You can take out Web Infrastructure Layer 7 applications with requests per second. You can take out the domain name service, DNS, which is a phone book, or GPS of the Internet through queries per second. So there are different types of DDoS attacks. And so this first one we’re talking against banks is at layer 3, 4 bandwidth against infrastructure. And so if you’re trying to go in and use some capability, it’s simply your availability is not there. And what used to be these short, minute long attacks is now becoming our attacks or longer, depending on the capabilities are willing to use. And so these new capabilities are increasing the duration of an impact. And so it’s really something as a CISO that I need to go and say, does this change my risk profile? Do I need to go look at, you know, increasing my capability? And there’s a couple things driving this. One is the GEO conflicts. Some of this is coming out of the war in the Ukraine against Europe against, you know, the, the Middle east war in that region and beyond for, for companies or countries that support one side or another. And we see a lot of this is done by Hackivist or you know, people that are cyber criminals during the day, state sponsored, you know, Hackivist at night. So it’s kind of a complex issue, but at the end of the day we really see that volume changing and the speed and you knew I was going to talk about AI eventually. And this is where I talk about it, is it’s being driven through AI capabilities. So just as we’re using them as a CISO to do natural language queries, inside my security operations center, they’re using AI to do the speed and complexity of these attacks. The second half I want to talk about of these key findings is really around APIs. So APIs are those abilities for machines, to talk to machines. So if you’re on an app, on your phone and you’re connecting to your bank, that’s going through an API. If you’re going shopping and you’re inside an AI and you tell that AI to go buy something for you, that is also going through an API, that’s a zero click. So now the, the, you know, the people that you’re buying from never see you, they just see that AI, they’re losing touch. That’s all happening in the banks. We’re losing touch with our customers a little bit through those zero clicks. But this AI is having a big impact in here and, and it’s going through those APIs. And so 60% of that tax within the financial industry, that’s banking, wealth management, insurance, all these different types, most of it is going against actual banks. And so it is going after people’s accounts, trying to get into, to steal money straight from them. We also put out within this a separate study that Akamai sponsored, the API Security Impact Study, and that showed that 96% of the companies out there have had an API incident. Now what’s an incident? It could be something small, it’s not a data breach, but it is showing active attacks. And again, as a ciso, this is where I want visibility and discoverability. I want to make sure I know where all my APIs are and who’s attacking them, what’s going on. So those are kind of the two big things that jumped out at me on this one. For as far as data points.

Swapnil Bhartiya: Thank you. I was at Cisco Live and I was talking to Emmy Chang there and she also said that because of AI, we are looking at new kinds of threads. Because what happens is that most time, most folks, they scan an image, they upload an image for OCR they upload a PDF and they’re like, now what is happening is that, I mean, of course, bad actors, they’re embedding some codes in the image itself that humans cannot see. But when you upload them, so a lot of things are happening. Very many websites you will not see human readable text, but there’s a text that the AI can read and now that can pass on instructions that that AI can do on your behalf. And since agents are now acting autonomously, so that is also becoming a new threat. So I want to talk about AI now when we talk about AI here in this context, I will talk about API also, because AI and API are related. Not everybody is running local LLMs. Most of us use it through API. So it’s going to be connected when it comes to AI, how is AI changing different aspects of security? First of all, of course it can speed up the process. Also it can make attacks more sophisticated. And I, as I give examples that there are certain things that are not even visible to humans when it comes to financial sector, which people are more, more sensitive. But sometime you scan checks and rude. I think from financial sector’s perspective, from both defenders and attackers perspective, how AI is changing security there certainly.

Steve Winterfeld: And that’s a huge question to unpack. So I’m going to start a little bit up front with defining when we say AI. So the first thing you mentioned was the traditional, you know, large language models and even older than that is machine learning. But, but for more of the generative AI, it’s large language models and a lot of those are a little bit closer to, you know, what machine learning words. The CVE is a traditional malware. And then as we get beyond the gen AI and there’s more, there’s some malware, there’s a lot of logic attacks. So you’re going against how it’s processing data, not actual malware. And then you get from gen aa you get into agentic AI and the danger here is it’s not answering questions, it’s making decisions. So if the bank is using an agent to make a decision on a loan, then you can see where there’s a lot more danger here. And so across all of this, what we’re seeing is, you know, a surge in advanced BoT activities. So 147% surge in BoT activities. So again, I’m going to step back for a second because not everybody lives in the bot world. So I want to take a second and describe these. So the first are these training bots or fetcher bots? It’s the AI going out to learn something, going out to buy those shoes. I have to say shoes because I was CSO for Nordstrom Bank. So we always talk about buying shoes up front. You know. Next was scraper bots just going and harvesting data. It could be your competitors harvesting data. It could be cyber criminals harvesting, you know, proprietary information or customer information. You have account takeover bots that are, are using a number of, of attacks, from credential stuffing to brute forcing to a number of different, more advanced attacks to come in and take over your account. It could be your bank account. Or again, going back to before I worked with Akamai back in, in the Nordstrom days in commerce, going after all your reward points because those are easy to monetize. And so taking over different kinds of attacks or different kinds of attacks. We just mentioned it can be running DDoS attacks. It can be doing the speed and scope and duration and, and innovation. Whereas, you know, if I’m attacking and you block a country, then I shift my bots to the country you’re in and, and you can’t geo block. And then finally hoarding or scraper bots, where again, the new tennis shoe comes out, a sporting team just released, tickets, a music concert, all of these, you know, you have bots going in to buy all those tickets. So across all those, we see this. And in fact, in one case, 90% of all the site traffic was a scraper bot, and that’s a use case. But I just want to point out that, you know, that traffic costs money and if now 98% of the traffic I’m getting is just trying to steal from me, you know, or, or gather intelligence against me, that has a huge business impact.