Human Intelligence Versus Artificial Intelligence: Ransomware

Bryce Webster-Jacobsen, director of intelligence operations at GroupSense and a ransomware negotiator, frames the debate over artificial versus human intelligence in ransomware response as a false choice. He argues that automated detection is strong at spotting signals such as command-and-control traffic, lateral movement and privilege escalation, while people are needed to tune those tools and to judge what they produce. He also notes that human behavior, such as falling for phishing or reusing credentials, sits at the start of many attacks.

The talk walks through the ransomware incident lifecycle, from initial access through data theft, backup destruction and encryption. For initial access, he describes monitoring dark web sales of access and vetting claims, which requires language skills, credible forum reputations and skepticism toward scammers. The negotiation stage is where he sees people outperform automation: timelines stretch over days, insurance and leadership shape options, groups rebrand, and strategy has to change as new information arrives.

He closes with a case of a small family business without cyber insurance, where negotiators presented as the victim and appealed to the operator's sense of a real business being harmed, alongside a more businesslike approach. The takeaway for practitioners is to combine automated monitoring with experienced human judgment, bringing in outside expertise early and treating negotiation as an ongoing reassessment.