AI doesn't need to invent a new cyberattack to make existing threats more dangerous.

In this episode of TechEDGE, Abby White sits down with Theresa Houck to unpack three of the month's top stories and what they reveal about the rapidly changing cybersecurity landscape.

They start with JADEPUFFER, what experts warn may be the first documented case of agentic ransomware, where AI carried out multiple stages of an attack and adjusted its approach when attempts failed.
Then, they examine a warning from the Five Eyes alliance that rapidly advancing AI capabilities could challenge today's cybersecurity defenses within months—not years.

Finally, Abby and Theresa turn to what IT leaders can control: preparing the organization to make fast, informed decisions when an incident occurs.

In this episode:
- What makes agentic ransomware different
- How AI makes familiar security weaknesses more dangerous
- Why AI could accelerate vulnerability discovery and attacks
- What the Five Eyes warning means for enterprise security
- Why strong security fundamentals still matter in an AI-driven threat environment
- How to establish authority, recovery priorities and response procedures before a crisis
- Why organizations should plan for business resilience instead of trying to predict every possible attack
The takeaway: Machine-speed attacks leave less room for unfinished security work—and less time to make decisions that should already be settled.

Featured TechEDGE Stories

Experts Warn of First Case of ‘Agentic’ Ransomware — and Paying Doesn’t Fix It 
Theresa Houck 

Why You Should Care: Alliance Warns AI Could Reshape Cybersecurity in Just Months 
Theresa Houck 

How to Develop an IT Emergency Response Policy Before a Crisis Hits: 8 Essential Steps 
Theresa Houck 

Prefer to read? Here's an excerpt of the podcast transcript:

Abby White: We're changing the format this month, Theresa. Instead of moving quickly through the five most popular stories from the TechEDGE website, we're going to spend more time on the top three.

What's really cool about the stories this month is that they fit together nicely topically. We've got what may be the first agentic ransomware attack. Along with that, there's a big warning that AI could be challenging current defenses within months. And the last story looks at whether your organization is prepared to respond when a crisis begins.

With all that said, why don't we start with JADEPUFFER? Theresa, this was a news item you covered, and the title is, “Experts Warn of First Case of Agentic Ransomware — and Paying Doesn’t Fix It.” I'm not going to lie, that is a scary title. Should we be scared?

Theresa Houck: I would be if I were going to get attacked with ransomware that doesn't care if they get my money.

JADEPUFFER was an attack where the AI agent independently executed the technical stages of the campaign after the target and infrastructure had been established. It exploited a vulnerable internet-facing Langflow instance, harvested credentials, moved through the environment, and encrypted and destroyed data.

It relied primarily on known vulnerabilities, default credentials and misconfigurations, kind of like shooting fish in a barrel.

For CIOs, CISOs and other tech leaders, the story is less about a single malware family than a broader shift in the economics of cybercrime. No backup, key or report was created. Even if the victim paid the ransom, the data would remain unrecovered. To me, that's just extra mean beyond the attack.

Abby White: Attacks are always mean, but I'm with you. This is next level. What's really scary is that this demonstrates AI doesn't even need to invent new attack techniques to completely change the cybersecurity field. It automates existing ones at machine speed.

Theresa Houck: This JADEPUFFER attack showed that attack speed is now exceeding human review cycles. Security programs that do reviews quarterly or monthly leave vulnerabilities increasingly mismatched against attacks that can adapt to failures or vulnerabilities in near real time.

Abby White: It sounds like AI is really replacing human attackers when it comes to cybersecurity.

Theresa Houck: AI orchestration platforms act as autonomous operators with the power to use tools and alter production environments, and many security teams treat them like high-privileged infrastructure rather than standard applications. Orchestration layers like LangChain and AutoGen are provided API access, database credentials and execution environments to take actions across the cloud and internal networks, but that also provides access.

Abby White: If you work in IT, you've surely heard this story, and it might be old news by now, but it's still relevant. Theresa has a section in her article, “What IT Leaders Should Do Now,” with the steps you should take. Experts recommend focusing on foundational cybersecurity practices before investing in new defensive technology.

The speed of attack is outpacing the review period. This attack didn't depend on a highly sophisticated new exploit. AI took familiar weaknesses and made them more dangerous at a much faster speed.

That brings us to a story you wrote before this news item happened: “Alliance Warns AI Could Reshape Cybersecurity in Just Months.” We saw that play out in real time. Theresa, you wrote this article about the Five Eyes Alliance, and they're warning that rapid AI advances could make current cybersecurity assumptions outdated within months, not years, or maybe even weeks, right?

Theresa Houck: The Five Eyes is an alliance from countries around the world that monitors these kinds of things. They indicated that AI could make your current cybersecurity expectations obsolete quickly. Cyberattack models are improving vulnerability discovery and exploitation because advanced AI tools lower the expertise needed by bad actors. This echoes the message from the article we just discussed.

Abby White: I remember when you wrote this, there was a lot of talk about Anthropic's new-at-the-time Mythos 5 and Fable 5 models, which showed exceptional abilities to identify software vulnerabilities. That raised concerns about how quickly these AI capabilities are evolving.

Theresa Houck: AI can expand the threat landscape by lowering the expertise needed. It automates vulnerability research, exploit development and attack planning, so it doesn't even need a human behind a screen or a phone. Smaller organizations with limited security resources or legacy systems are especially vulnerable. They're prime targets as these AI attacks become more accessible.

Abby White: That's a wake-up call for smaller businesses that might not have a robust IT department.

The useful question is what an AI system could exploit in your environment right now. What is the first step listeners should take to get ahead of this?

Theresa Houck: A lot of times, you don't know you have a vulnerability. A lot of times, they're created by another business unit within the organization, so you really need to practice good cyber hygiene.

You need to strengthen your detection, response, and resilience strategy. Review them on a regular basis. You don't set it once and let it go. Most people listening know that, but you've got to make sure you're doing it right.

Abby White: Are those vulnerabilities increased when you've got people across the organization using different AI tools and platforms? When you talk about hygiene, what does that encompass?

Theresa Houck: The most likely vulnerabilities come from employees using their own devices or uploading their own information, like spreadsheets, but also from edge devices, different software platforms, different vendors for your architecture system and a network of third-party suppliers.

You don't know what vulnerabilities they're bringing in. You can try to find them once you start working with them, but they might bring vulnerabilities in later that you don't see because you're checking monthly and it came in between checks.

It's a hard thing to keep up with. That's why you have good cybersecurity software, good practices to check, and a good plan on what to do if something happens.

Abby White: That leads into our third and final article, another one of yours: “How to Develop an IT Emergency Response Policy Before a Crisis Hits.”

We've been talking about all the scary things that can happen, but you offer a flexible response framework built around critical business operations rather than a separate plan for every possible threat, because that would be impossible to manage.

You wrote, “Every crisis eventually becomes an IT crisis.” It's true. Every major disruption is going to become IT's problem.

Theresa Houck: Who can think of every possible emergency and then keep a plan for every scenario? It's impossible.

Whether it's a blackout, cyberattack, weather problem or labor strike, emergencies end up being handled pretty much the same way. You can develop a policy that has a consistent framework for decision-making, communication, and recovery, no matter what the triggering event is.

The main thing is to focus on business resilience, keeping critical operations operating during the event. No matter what causes a disruption, many response requirements are the same. Tech leaders still need visibility into critical systems. They need communication channels, decision-making authority, and recovery priorities — what systems are they going to restart first, second, third — because all that needs to happen when minutes count.

Policies answer the question everybody's running around asking: What capabilities must be available for the business to operate?

Another important point is that authority about who's in charge of what during an emergency response should be established before anyone has to use it. One of the most common reasons response efforts fail is uncertainty about who's authorized to make decisions. Delays occur because people debate responsibilities and argue about who's in charge instead of responding to the incident. The objective isn't more bureaucracy; it's governance.

Abby White: You also have an emergency response policy self-assessment. If you work in IT and you're not sure where your organization stands, you can take this short quiz and assess how exposed you are to risk.

You also have to know who's in charge, and communication is so important. Make sure you have a strong communication plan that establishes procedures for executive leadership and decision-makers, what staff should be doing, and transparency for customers, partners, vendors and regulators. All of that needs to be built into your plan so everyone isn't running around confused.

Theresa Houck: The important point is to have the plans in place before something happens.

Abby White: A plan can look reassuring until the organization loses time debating who can shut down a system or what needs to come back online first. Having it on paper isn't enough. Would you recommend businesses do a drill? What would be a good way to prepare and make sure you're actually ready if something happens?

Theresa Houck: It depends on the organization and its size. If you can do a drill quickly without disturbing business, that would be great. If you're not able to, at least meet and talk about: If this just happened, who does what? At minimum, do that so you're not running around asking who was supposed to do something.

Especially for smaller companies, if you're able to do a quick drill, do it, just like when the fire company comes out and makes you do a fire drill.

Abby White: This really sounds like a tactic that transcends IT. It applies to a lot of areas.

Theresa Houck: Including the marketing department and the communication plan. Plus, for communication, you've got to plan to assume the electronics are down when the event happens.

Abby White: The goal isn't to predict every crisis or have absolutely everything ready for every possible scenario. It's to make sure your organization has a structured, repeatable way to respond and recover. That's what organizational resiliency is all about, right?

Theresa Houck: Absolutely.

Abby White: If we look at a common thread this month, AI raises the consequences of unknown vulnerabilities, unpatched systems, and weak credentials. Organizations need clear authority and tested recovery priorities before an attack happens, because machine-speed attacks like JADEPUFFER leave much less room for unfinished security work.

Theresa Houck: And much less time to make decisions that should already have been settled.

Abby White: Theresa, thank you so much for joining me today.

Theresa Houck: It's always good talking to you, Abby.

*Transcript lightly edited for clarity and brevity