Trends shaping the future at RSAC.

RSAC 2025 is well under way, and Kevin the Intern files his first report. Authorities say Spain and Portugal’s massive power outage was not a cyberattack. Concerns are raised over DOGE access to classified nuclear networks. The FS-ISAC launches the Cyberfraud Prevention Framework. Real-time deepfake fraud is here to stay. On today’s Threat Vector, host David Moulton speaks with Daniel B. Rosenzweig, a leading data privacy and AI attorney, about the growing complexity of privacy compliance in the era of big data and artificial intelligence. Protecting your company…with a fat joke.

Today is Tuesday April 29th 2025. I’m Dave Bittner. And this is your CyberWire Intel Briefing.

RSAC 2025 is well under way. 

At RSAC 2025, Day 1 announcements point to several clear trends shaping cybersecurity. Artificial intelligence is taking center stage, not just for automation, but also for real-time analysis, training, and security operations. There’s a major focus on identity security, as companies push solutions that manage vulnerabilities tied to human and non-human identities. Unified platforms are another big theme, as vendors work to reduce security tool fragmentation by consolidating visibility, management, and response into single frameworks. Finally, protecting post-launch applications and external digital threats is gaining attention, signaling a shift toward proactive, continuous security across the entire software lifecycle. Overall, cybersecurity is leaning hard into smarter automation, consolidation, and preemptive threat detection.

RSAC 2025 kicked off yesterday with the Innovation Sandbox competition, and ProjectDiscovery earned top honors for its open-source platform that helps security teams rapidly detect and remediate vulnerabilities. The company’s flagship tool, Nuclei, automates attack surface monitoring and is already widely used by defenders worldwide. 

Later this week, we’ll share my interview with ProjectDiscovery’s CEO to discuss their journey from open-source upstart to industry standout, how they plan to scale their impact, and what this win means for the future of automated security tooling.

Stay tuned—you won’t want to miss it.

In a panel discussion Monday, former CISA chief Chris Krebs criticized efforts to shrink the federal cyber workforce, warning it could weaken national defenses at a critical time. At RSA Conference 2025, the notable absence of current NSA and CISA leaders highlights deeper instability. Budget cuts, leadership vacancies, and a hesitance to engage publicly are hampering U.S. cyber agencies’ visibility and influence. Together, these stories paint a concerning picture: while policy and research are pushing for stronger security practices, political pressures and resource cuts are undermining the federal capacity needed to lead and protect in an increasingly hostile digital environment.

Kevin Magee is Global Director of Cybersecurity Startups at Microsoft, but for this year’s RSAC we had different plans for Kevin. He files this report. 

Stay tuned for Kevin Magee’s updates from the RSAC conference throughout the week.

Authorities say Spain and Portugal’s massive power outage was not a cyberattack. 

We reported yesterday on the massive power outage that left millions in Spain and Portugal without electricity. It disrupted transportation systems, halted metro services, and grounded flights. Emergency services operated on backup generators, and traffic lights were out across both countries. By the morning of April 29, power had been restored to over 99% of affected areas. Authorities have ruled out cyberattacks as the cause of the outage. Investigations are ongoing to determine the exact origin, with initial reports suggesting a massive disconnection within Spain’s power grid. The event has raised concerns about the stability and resilience of Europe’s interconnected electricity infrastructure.

Concerns are raised over DOGE access to classified nuclear networks. 

NPR reports two members of Elon Musk’s Department of Government Efficiency were given accounts on classified nuclear networks, though officials insist the accounts were never activated. Neither had prior clearance or nuclear experience. The Department of Energy initially denied any access but later admitted the accounts existed, stressing no classified material was accessed. Experts say simply having accounts could allow limited requests for classified information, though strict controls remain. The incident adds to growing concerns about DOGE’s handling of sensitive data across the government. The situation reflects rising tension over the politicization and management of national security systems during ongoing federal restructuring efforts.

The FS-ISAC launches the Cyberfraud Prevention Framework. 

The FS-ISAC has launched the Cyberfraud Prevention Framework to help financial institutions better detect and stop scams before money is lost. The framework unites cybersecurity and fraud teams around a shared structure and language, aiming to catch threats earlier in the attack lifecycle. This shift comes amid a surge in online fraud, with the FBI reporting $9.3 billion in crypto scam losses and Google warning billions of Gmail users about new phishing tactics. Crime syndicates, particularly from East and Southeast Asia, are expanding their global operations, forcing banks like those in New Zealand to adopt stricter protections. While large institutions may find it easier to implement, FS-ISAC stresses that smaller banks and fintechs also stand to benefit. Experts note that while frameworks are critical, overcoming cultural resistance within organizations remains a key hurdle to truly effective fraud and cybercrime prevention.

Real-time deepfake fraud is here to stay. 

Real-time deepfake fraud has evolved from a theoretical threat to a practical tool for scammers, as detailed in a recent 404 Media investigation. Using accessible software, fraudsters can now alter their appearance and voice during live video calls, enabling them to impersonate others convincingly. This technology has been exploited in romance scams, where victims are deceived into believing they are interacting with someone they trust. The sophistication of these deepfakes poses significant challenges for detection, as traditional verification methods may not suffice. The increasing accessibility of such tools underscores the urgency for enhanced security measures and public awareness to combat this emerging form of digital deception.

Protecting your company…with a fat joke. 

And finally, at a panel session yesterday here at RSAC, CrowdStrike’s Adam Meyers had a wild tip for spotting North Korean spies posing as tech workers: just ask, “How fat is Kim Jong Un?” Apparently, they hang up faster than you can say “laptop farm.” Thousands of these operatives have infiltrated Fortune 500 companies, using AI to craft LinkedIn profiles, borrowing Polish names they can’t pronounce, and even running U.S. laptop farms to fake local presence. Once hired, they’re top performers—mainly because they have an entire team helping one “employee” climb the ranks and steal IP in tiny, sneaky bits. FBI agents warn that if caught, these workers often leave behind malware and a whole lot of trouble. Deepfake interviews are also getting disturbingly real. The advice? Tighten hiring processes, require local check-ins, and maybe think twice before hiring that remote hot-shot who’s just too good to be true.

And that’s the CyberWire.

 

 

On today’s episode of CISO Perspectives, host Kim Jones sits down with Kathleen Smith, Chief Outreach Officer at ClearedJobs.Net and longtime cybersecurity career advocate, to tackle one of the biggest hurdles for aspiring cybersecurity professionals: How do you gain experience without already having a cyber job?

Just a reminder that today’s episode of CISOP is the final episode of the season available to everyone. The rest of this season will be available exclusively to our N2K Pro subscribers.  If you’d like to continue following Kim's conversations and access the full season, head over to thecyberwire.com/pro to learn more about becoming a Pro subscriber.

 

And that’s the CyberWire.

We’d love to know what you think of this podcast. Your feedback ensures we deliver the insights that keep you a step ahead in the rapidly changing world of cybersecurity. If you like the show, please share a rating and review in your podcast app. Please also fill out the survey in the show notes or send an email to cyberwire@n2k.com

We’re privileged that N2K CyberWire is part of the daily routine of the most influential leaders and operators in the public and private sector, from the Fortune 500 to many of the world’s preeminent intelligence and law enforcement agencies.

N2K makes it easy for companies to optimize your biggest investment, your people. We make you smarter about your teams, while making your teams smarter. Learn how at n2k.com.

 

N2K’s senior producer is Alice Carruth. Our CyberWire producer is Liz Stokes. We’re mixed by Tré Hester, with original music and sound design by Elliott Peltzman. Our executive producer is Jennifer Eiben. Peter Kilpe is our publisher, and I’m Dave Bittner. Thanks for listening.