Reflections on 31 Years of Cybersecurity Community

### Overview Recorded live from the expo floor at InfoSec World 2025, host Mandy Logan speaks with industry veteran G. Mark Hardy for a show wrap-up interview. InfoSec World is in its 31st year—a tenure surpassed only by DEF CON. Reflecting on his participation since around 1997 and his keynote in 2000, Hardy contrasts the community-focused, accessible nature of InfoSec World with massive conferences like RSA and Black Hat. The discussion covers the evolution of cybersecurity conferences, the reality behind artificial intelligence (AI) hype, defense in 'AI time,' startup advice, and future considerations around digital identity.

### Key Topics - **Evolution of InfoSec World and Community Size**: Hardy reflects on giving his highly rated talk 'PK I Don't Think So' in February 2000 during the PKI hype cycle, where around 120 attendees packed a room. In contrast to massive events like RSA or Black Hat where networking largely shifts to after-parties, InfoSec World maintains a manageable size that fosters 'lobby con' hallway networking, direct face-to-face reconnections, and targeted tracks like AI and CISO leadership. - **AI Hype Cycle vs. Dot-Com Era**: Hardy compares the current AI frenzy to the 2000 dot-com and PKI eras. While many vendors simply use generative AI for marketing copy, Hardy anticipates an inevitable market shakeout similar to the dot-com crash, where companies with real customer value (analogous to Amazon and Google) will endure while overhyped startups will disappear. - **Offensive Democratization vs. Automated Defense**: Generative AI lowers the technical barrier for attackers, allowing inexperienced individuals to prompt for exploit generation while staying outside law enforcement jurisdictions. Hardy emphasizes that defenders can no longer rely on human or internet-speed responses; they must automate defensive agents to operate in 'AI time' (milliseconds) simply to fight to a draw. - **Guidance for Cybersecurity Startups**: Acknowledging that nine out of ten startups fail within 3 to 4 years, Hardy advises founders against immediately targeting Fortune 100 enterprises, which often take over a year to navigate through procurement, legal, and budgeting. Instead, startups should target accessible markets and avoid pricing out small and medium-sized businesses (SMBs). - **The Future of Identity and Access Management**: Logan and Hardy touch on the future expansion of identity. Logan notes data from an ISW cybersecurity trends report indicating only 44% of digital identities are currently managed, while Hardy and Logan contemplate identity extending beyond users and devices to data and automated agents.

### Technical Details - **PKI Hype vs. Reality**: In 2000, Hardy warned against inflated stock valuations of PKI firms (noting stocks like Baltimore dropping drastically from 210 to 40), drawing direct parallels to today's AI bubble. - **Defensive Execution at Millisecond Latency**: Hardy explains that AI-driven attacks necessitate codifying defensive rules into automated AI agents. When offensive toolsets operate at machine speed, automated defensive responses must neutralize attacks within milliseconds to provide human operators time to absorb threat intelligence and rearchitect perimeter security. - **Identity Management Expansion**: Discussions touched on theoretical intersections of quantum consciousness (citing Roger Penrose) and digital infrastructure, questioning whether identity and access management (IAM) must evolve to authenticate temporal contexts and data artifacts.

### Takeaways - Manageable mid-sized cybersecurity conferences provide high-value networking and mentorship opportunities without the sensory and logistical overload of mega-conferences. - The cybersecurity sector is approaching the peak of the AI hype cycle; sustainable organizations must deliver genuine product value beyond marketing veneer. - Machine-speed attacks demand automated, millisecond-level defensive architectures operating in AI time. - Early-stage security startups should avoid the fatal cash-flow trap of long enterprise procurement cycles by focusing initial sales efforts on agile, smaller customers.