Inside this year’s Microsoft Digital Defense Report

Elliot Volkman: Hello, and welcome back to the "Microsoft Threat Intelligence Podcast". I am Elliot Volkman, your sometimes host, and today we get to unpack something that you all have been waiting for for some time. It is our annual Digital Defense Report, often referred to as the MDDR here, so if you hear that, that is what we're talking about. And we have the two architects behind that. So what I'm hoping to do is I will do a quick little introduction. Actually, I'm going to let them introduce themselves so that they can give you a little bit more background. But we are instead of going to just rally off the different stats and a million different anecdotes and stories that we have in there, I'm hoping what we will be able to bring for you all is a cohesive executive-level summary, an output, if you will, so that when we definitely know you're going to read over a hundred pages of this, maybe we'll give you a little bit of a guided, behind the scenes tour with the two primary people who helped shape and build this for you. So let's start with this. Chloe, can you maybe give us a little bit of your background here?

Chloe Messdaghi: Sure. Hi, everyone. I got to do this wonderful podcast last year for kicking off the last year's MDDR. This is my second year of leading the MDDR. And Karen has been with the MDDR far longer than I have, but she is like the grand editor for it. I just do is, I make things work. That's all. That's all I do.

Elliot Volkman: Yeah, totally. Just that. All right, Karen. Maybe we go a little bit further than that, because I think you do more than just architectural report. You're part of a very mysterious team.

Karen Frost: Oh, that's a way to put it. So I'm Karen Frost. I'm a principal security researcher. And my job at Microsoft is to take a lot of the threat intelligence that we produce and give it back to not only our customers, but people around the world. So I help write blogs, I help write content that goes into Microsoft products. So my day job most of the year is to take the highly technical stuff that our people put together on what threat actors are doing, how they're doing it, what tools they're using, and then to make it a little bit more readable so that people like myself who are not deeply technical, are able to process that and understand what it means, what that impact is. So when it comes to the MDDR, we have so much content that comes in from throughout Microsoft, and the question is, how do we tell a story with this? And how do we make it readable, not just to the folks that deal with this on a daily basis, but how do we make it so that people who are, you know, policymakers or CEOs or NGOs, all of the acronyms, right, they can understand what we're trying to say about how the threat environment impacts them? And that's really the heart of what we're trying to do, because if it's not readable, then it's not useful. And it's a lot of work for Chloe and myself, because when you have so much knowledge it's very difficult to write something that's concise and easily digested. So that's what we spend all of our time doing.

Elliot Volkman: All right, the boss has spoken. All right. We can -- we'll basically use that as like a little jump-off point, but Chloe, I'm going to point over to you with us. Chloe, Karen, thank you so much for joining us. I appreciate you giving some context and some background on sort of how this thing comes to be. Again, it is a highly technical but also readable report with just so much information. So I've got to ask the simplified question here, Chloe, is if there is one story that we want the world to take away from this thing, what is it? Because there are obviously many, with many different chapters.

Chloe Messdaghi: Oh, absolutely. I mean, this is a 100-page report, but it really does tell one cohesive story, which I would say is cyber risk is becoming faster, more accurate, more scalable, and also more interconnected, I would say. So I mean, AI is really accelerating that activity and cyber crime provides that scale. And then you have attackers that exploit weaknesses across identities, that's not new, but also systems and infrastructure, which once again is not new, however, the real question for organizations right now is increasingly whether they have the resilience to withstand and recover from any upcoming disruptions of these unknown factors.

Elliot Volkman: Excellent. All right. That is good context, which maybe, Karen, we can look to you for the evidence and intelligence side of the equation. Resilience has always been a critical factor, risk will always, always be a factor, especially with AI coming upon us. But what does the research and intelligence say? Like, how does that shape and back that piece of the equation?

Karen Frost: Yeah. So I would go back to what Chloe just said. So last year, the theme of the MDDR was that attacks were increasing in speed, scale, and sophistication. And that's still the message. What has changed is how AI has super empowered that. So in previous times, the speed, scale, and sophistication was enabled by the cyber criminal environment, cyber crime as a service. So it lowered the barrier to entry for cyber criminals. You could buy a kit, you could become a ransomware affiliate, right? You didn't have to develop your own strain of ransomware or malware, because you could just buy it. Well, now, with AI, all of this stuff becomes turbocharged. And so throughout the MDDR, what we're seeing is we're seeing the impact of how that's playing out. So really, the volume on across a variety of fronts is impacting. One of the things is, when we were writing the MDDR last year, we were starting to see what was then the seeds of how AI would affect the threat landscape, and now it's really, really come into focus. So we see impacts in ransomware. We see impacts in phishing. We see impacts with nation state actors. Basically, anything that you can do that is cyber threat related, now we're seeing AI being used for that. And of course, we don't get super into it in the MDDR, but of course we see it in other applications as well. How people use it for malicious image generation, researching things like chemical biological weapons, stuff like that. So across the board, we're really seeing a massive increase in what that threat landscape looks like.

Elliot Volkman: I've got to ask the question because it keeps hitting every headline, how much of the intelligence is pointing to our AI-related doomsday that's coming up? That's somewhat joking, and I'll probably cut this.

Karen Frost: I'll give an honest answer to this, and I think this is a really important one. So as we were assembling the AI component of the MDDR, and it's the first chapter, it's the longest chapter, I think, when we talk about how does AI get incorporated into all this, AI agents really, really become a game changer, because they enable what was once one person trying to launch cyber attacks, for example, now they can have 10 agents, 100 agents that are doing the attacks. Whether I'm a company, whether I'm an individual, whereas once, you know, maybe there were 10 cyber threat actors that might try and target me, now 10 actors with 100 agents each vastly magnifies the threat that I have to face. I think it's important to realize how this scale really changes and how it affects all of us.

Elliot Volkman: All right. Thank you for a very real answer for a somewhat joking -- oh, yeah, we can, come on. Yeah [laughs]. Wait, do we say apocalypse? Chloe, I'm going to -- I'll punt it back over because I was going to start with you, which is right now we are sort of honing in on all these shifts and changes to a simplified message, which is the physics of cybersecurity are really changing in the AI era and there's a whole lot of different ways that we're unpacking that. On "Security Insider", we sort of try to break that down and define that a little bit more with Tanmay. But I'm curious, like, how do you feel, or how are you able to maybe simplify that for our world? Because there is just so much changing.

Chloe Messdaghi: Yeah, I mean, this is a phrase that keeps coming up at Microsoft, I would say, but if I were to translate it, it basically means that AI is changing the operating conditions of cybersecurity. So think about it this way: the threats may be familiar, but AI is changing the speed, the scale, the cost, and the level of automation. So attackers can do far more faster with your barriers. However, I think it's really important is to also mention that defenders can also use AI to detect, analyze, and respond faster and at a greater scale.

Elliot Volkman: Karen, anything else you want to add?

Karen Frost: You want me to answer?

Elliot Volkman: No, no, like you gave a great answer to a dumber version of what I put in the notes [laughs].

Karen Frost: One of the things to think about is so generative AI is really what starts to change things. An example, just to give an anecdote, last year we talked about North Korea sending its workers to engage in remote IT work. This is something that was a really big news story last year as companies were discovering they had these workers that they'd hired without realizing they were out of North Korea. Well, what we're starting to see is North Korea is circumventing some of the traditional tells that would let us know, hey, this person is not who they claim to be, because they're able to use AI to make sure that their document forgeries look very legitimate, get around language problems. They can do real-time video changing so it looks like you are talking to someone who looks differently. So again, the things that change is the ability to, in some cases, change reality. I say that in a sense of change people's perception of what they're seeing. And so that's just one way nation states are using it. Last year, we flagged that we were going to see AI used for things like malware development, again, like I said, and phishing. We are absolutely seeing that and it's exactly what you would expect. One of the things that comes through in our section on Red teaming is that it's not that attacks have changed, because there's only so many initial access vectors you're going to have. There's not some new initial access vector. It's how does that get improved by AI? And AI is very persuasive. I think we've all seen how persuasive it is. You can look at something and you know that that is not actually a cat doing Olympic diving. But boy, it sure looks real. So even when you know something is fake, you can fall for it. And that's what threat actors can do with AI. Just one example of how AI has changed the game.

Chloe Messdaghi: Yeah, and Elliot, if I could piggyback off of that, it's also letting people know that even though we're not seeing a widespread use of fully autonomous cyber attacks today, the thing is is that human direction is still playing a very meaningful role in that. But the thing is is that AI is accelerating more parts of the attack cycle, and that really matters when defenders are already dealing with, like, I think in our report we shared that we're probably going to hit 72,000 CVEs this year, and that vulnerabilities now have the ability of being weaponized in less than 24 hours. So the gap between identifying a vulnerability and facing real world risk is getting much smaller. And that's one of the things that I know it keeps myself up at night, and also Karen, as we were working on this report.

Elliot Volkman: Important thing to note there is like the projected 72,000, like those are just the public ones, and we are in a world where CVEs are not coming out as readily. So there's that factor plus the factor that some just never see the light of day, for obvious reasons. So like, that number is not just necessarily almost doubled, but like, that is a highly problematic issue. So like, I know we were sort of poking at this world where AI is going to cause drastic concerns in our space. But like, honestly, from my perspective, the biggest challenge that we're looking at is the vulnerability and patching piece of the equation. Like, historically, we've already had endless problems. Like, do you know how many people have not patched some major things like Log4j? Like, we can see across the public web that some of these things are still exposed and vulnerable. So, like, how are we expecting on a weekly basis to be able to patch or even know which things they should prioritize to patch. So -- yeah.

Chloe Messdaghi: That's the scary bit, right? Because even if, say, for example, you're getting vulnerabilities from, well, AI found the vulnerabilities, it might push out reports saying that this is critical. And it turns out that it's not. So you're also getting false positives, and so triage teams are getting overwhelmed by the number of reports that are coming in, especially in the bug bounty world. So it is becoming a scary factor where, you know, you have to -- you can't just fully rely on humans anymore, you actually need AI to assist with the triage and hope that the AI is doing the right triaging, just like we hope humans are doing the right triage without having any biases.

Karen Frost: But I want to challenge an idea here. One of the big concerns with AI was, okay, threat actors are going to use AI, they're going to scan, mass scan for vulnerabilities, they're going to access CVEs, and they're going to intrude on networks. And I think one of the things that I noticed in how the MDDR is compiled is there are two different sets of statistics about initial access vectors. One comes from DART, and those are successful intrusions that they investigated, and one comes from DEX, and that has both attempts and successful intrusions. And what you'll notice is the successful intrusions often come from phishing. So we're all worried that these threat actors are coming in the back door, but a lot of the time they're coming through the front door.

Chloe Messdaghi: Yeah.

Karen Frost: And the other part of the story is, who's opening the door? Because when we think about who potential targets are, we tend to think in the sense of like organizations and networks, and how do I patch whatever that is, but the truth is so many people are going to be affected by spear phishing. So just to give an example that I saw on social media this week, my mom put it in a group chat with me and my sister. And this just shows the importance. This, like everyone's seen it. Okay? This guy talks about how he got a phone call that was supposed to be from his wife. She forgot her credit card, she needs to get gas, and she needs him to send her money. And the only reason he knows it's not really his wife is because she's sitting right next to him. So we have this world in which threat actors can use AI agents to scrape the internet to find out everything about you and then develop a spear phish that will be very realistic. And for people like my parents, for people like my sister, people who are not savvy about this, why would they ever suspect that it's not me emailing them, texting, calling? All of the hallmarks are there. It could even be written in my voice. The email could be, right? AI is capable of doing that. So even as we're concerned about patch velocity and things like this, how do I make sure that my company's systems are protected and the doors are locked? The problem is still also the people. And that's part of the story. When I go out and I'm, you know, at the dentist and my poor dental hygienist is hearing me talk about this, this is the warning that I give. Because in the future, again, like I said, the things that we -- the authenticity markers that we rely on, voice recognition, this looks like an email my friend would have written, all of that goes out the door, and how do we defend against that?

Chloe Messdaghi: Karen, you're completely right. The thing is that this is really impacting everyday people now at this point. It's not just organizations, you also have to be worried about the people around you.

Elliot Volkman: I think it is and it isn't, because there are certain things and headlines right now that, like, everyone is starting to talk about. But I will say the technology to basically -- is it vishing? Vishing is the audio or video?

Karen Frost: Vishing is the video.

Chloe Messdaghi: Yeah.

Elliot Volkman: Okay. So --

Karen Frost: Voice phishing.

Chloe Messdaghi: Yeah.

Elliot Volkman: So the technology has been around for years now, because two, three years ago, my uncle got a call from 'me' while I was in the middle of run, and it said I need bail money. He's like, that doesn't sound like him. But like, because I do these podcasts, it is very easy. And by the way, sorry, you all are now fair game for stealing your voices. You're welcome. But like it is easily adapted in the technology. Even the technology that I edit in another cybersecurity podcast, it allows me to AI clone my voice when I want to edit things. So it is just like, it's there. So I totally get that. So part of the problem, yes, apathy is certainly an issue. Fortunately, I think maybe over-hyping certain scenarios that we're hearing across the airwaves right now are a little bit over-alarming. But outside of that, like, yeah, it is just a weird mix. I think that's why, like, concepts like zero trust are at least beneficial context, and it's not like overly technical so people can understand it. But I do want to pull us back a little bit onto the intelligence piece of the equation, Karen, which is really like if we are seeing so much information, how do we take that back to our security teams and figure out from, like, the everything that we see right now, what does it come down to? Is it our threat model, or like, how do we just parse the insane amount of information that we have in front of us?

Karen Frost: Right. This is kind of the paradox, right? Where we always think that the more information we have, the better we'll understand the situation, the easier it will be to address. But this paradox of information is that it's not helping us. Again, Chloe mentioned we've got signal overload, how do we parse the data? And so, you know, maybe two years ago, certainly last year, in the MDDR we were talking about, you know, you need to incorporate AI in your SOCs, start doing this. Well, we've moved from 'should' to 'must'. And this is, again, this idea of moving at the speed of AI, because if threat actors are moving at the speed of AI, we have to too. And so throughout the MDDR, we see various ways and suggestions for how people can do that. And one of the things that comes through also is this idea of cross signal correlation, right? So when we have these systems that are monitoring, as threat actors walk through, I like to think of it as if a burglar is walking through your house, he's leaving footprints. Or she. And this cross signal correlation helps us track where they're going. So maybe if our signals are separate and our SOCs are separate, it's hard to track that. But when everything works together, we have that fuller picture. And we need to think not just about our own teams, but also how do we work again if it's an enterprise, for example. How do I work with other companies in my industry? How do I work with government? How do governments work within governments, right? We have to do this at a micro and a macro level to best maximize. And we can. But again, with all of this data, the data has to be actually processed and understood. And that's where AI is going to help us, and that's one of the advantages that it gives us. So this isn't just a story about how AI is super empowering threat actors. It empowers defenders too, and we have to use it.

Elliot Volkman: Chloe, this kind of begs the question of, like, the report obviously has a whole lot of interconnected risk here instead of just, you know, story after story. I assume this is intentional and helps kind of add a little clarity?

Chloe Messdaghi: I mean, it does. But it's, like Karen was sharing, is that it's not about more signals, it's really about connecting them. Right? Cyber risk doesn't stay neatly contained, unfortunately. It does move across identities, systems, software, and infrastructure. But once again, you know, I think in many ways we have to remember that a defender's advantage is visibility and context, and that attackers may have that speed with AI but defenders can connect those signals across identity systems and infrastructure to really detect and respond at scale.

Elliot Volkman: Excellent. So I want to make sure that we don't gloss past over, like, the actions that we want people to take. So maybe we'll just kind of jump ahead to that, which is -- and either one of you feel free to kind of pick up the mantle on this. But if I'm a CISO reading this report, what are the three things that you want me to, you know, take away from this? Like, how do I change direction right now?

Chloe Messdaghi: Karen, do you want me to go first?

Karen Frost: If you'd like, sure.

Chloe Messdaghi: Okay. So in this report, in the introduction, there's two different parts at the very beginning, which is you have your top 10 takeaways and then we also have one that's like the top 10, like, things you should do if in your security at your organization. So if you're just like, I can't read this whole report right now, I would first go to those two pages. But overall, you're going to hear things that you probably have heard many times before at conferences and everywhere else. Make sure you are strengthening your identity with phishing resistant MFA. It keeps you safe. Second is to prepare for disruption, including scenarios that you haven't anticipated, and really keep those instant response plans current in practice. And what I mean is like, really do make sure your incident response plans are up to date and that you're actually practicing with your peers and your colleagues. And then third is to get the fundamentals of AI right. Governance, visibility, and strong data controls are essential at this time.

Elliot Volkman: Karen?

Karen Frost: Yeah, Chloe stole one of mine, but I'll repeat it because it's important, right? So thinking through just kind of a step down memory lane and how the MDDR has historically been assembled and the conversation about what level do you write this for, I think it was three years back, but maybe four, at the end of every section we had like steps you can take, and they were very granular. And this year we've kind of had some, you know, some technical steps, some less technical. It's the difficulty of writing for multiple audiences. When it comes to steps the CISO can take, though, we're moving kind of back more to the strategic level and thinking about how has the role of the CISO changed in the C-suite, and what is the CISO now responsible for, and how do they communicate that. Because really, this is a role of managing. Managing the C-suite, right? So the first thing is we've kind of moved from an environment where it used to be you manage your ecosystem, kind of, how do I manage these devices and networks that are immediately within my organization? And now we really move to, okay, we need to manage an ecosystem. And what does that mean? So we have various technologies, platforms, software as a service. We have identities, it's cloud identity, it's how people are using, for example, am I requiring my people to do MFA? Am I doing passkeys? How do I want to make sure that people's identities are protected? Who are my partners and what level of protection do they have? What vulnerability does it open up? Who are my vendors and what are my dependencies? So when we think about what the CISO is doing, we're thinking out to the future. And it's like, okay, well, it's not just about data. It's not just about who has the biggest security team, who has like the most advanced AI tools. It's who understands their ecosystems. How well do they understand that? How do they manage those dependencies? They have to be able to adapt quickly. Chloe said resiliency, right? You have to assume breach, because, statistically, it's a very high probability that something's going to happen. So just to be explicit on what this changes is really just having the best possible understanding of the organization's ecosystem, really in a way that is broader than it used to be, just based on the changing times. Number two is changing how CISOs view metrics. So I think it's easy to fall into this idea of like, oh, well, we had this many patches and we did this many whatever. But when we think about what separates a mature program for just like an active one is a different kind of measurement. So for a CISO, again, moving into that strategic level, it's understanding, okay, I bought, for example, an AI-powered solution. Well, how much risk reduction did I actually buy? And so having that understanding of how risk has been managed. Again, not just number of patches, but patch velocity, right? Do you have a Red team? And when that Red team provides feedback, is that feedback incorporated? Are you doing breach exercises that then re-incorporates that data back into the system? So instead of just, okay, someone did something, they wrote a report and that report went on the shelf and no one looked at it, how proactive is the CISO being at really learning from those experiences and putting it back into the ecosystem that they are now responsible for protecting? And then finally, this is what Chloe said, so just to double tap on that, these controls for AI. I mean, AI is here, it's not going away, it's just coming in further. More AI agents are going to come online and be incorporated into workflows. And that means we have to have that government's visibility and data crawl controls, just like Chloe said. So this visibility is going to be crucial. What do these AI tools or services or agents have access to? How do we control that access, manage that access, so they're not accessing data that they're not supposed to and causing data leaks or being accessed by threat actors that then have access to something that they shouldn't have? So that's really got to be top of mind. We've always been concerned about data loss prevention, now it just has a new context.

Elliot Volkman: Interesting. So I hate to do this where we're talking about people focusing on the now, and I really hate the whole crystal ball thing, but in the world of threat intelligence, we can at least go from like a guesstimate to better context. I'm curious, Karen, like, we're 12 months away from where we are right now, do you feel like one of those in particular really stands out as like we put the red flag in front of you, go pay attention to it? Like, is one of these things going to blow up in our face versus another, maybe?

Karen Frost: For the CISO recommendations or in general?

Elliot Volkman: Actually, in general.

Karen Frost: Okay. So the thing that keeps me up at night, and I keep repeating this, but it's the AI agents, right? One of the quotes in the report has to do with we should assume a future in which there will be perpetual efforts by agents to breach, and then once they've breached, they just stream through and access networks and move laterally and do that. And I think that's really the scary thing. If it's so easy and so cheap to run agents, and again, I keep stressing this, but it's not just the threat to individuals, mom and pops, and organizations. I mean, it is just so pervasive. So if I was a CISO, I would be worried about the fact that I'm going to get constant knocks on the door by agents who are attempting to see if I've left a door unlocked, a window unlocked. And it's the same for mom and dad, it's where it just is going to take a different form. It's going to be that email that comes through, it's going to be that phone call, just because it's so cheap and easy for threat actors to do. So whether it is a nation state threat actor, whether it's a cyber criminal actor, when we get that constant threat environment, it changes things from, oh, it's no longer a ransomware group who, once a year, might try and see if they're able to access networks, to, oh my gosh, there's just tomorrow, the day after, the week after, it could just be constantly happening. And these things don't always happen in places where we're able to see it, detect it, and stop it, right? That triage component that exists within an organization might not exist within an individual. So now we have to worry about an employee or someone who's got an unmanaged device, they click that spear phishing link, and all of a sudden now it's on a corporate network, just to give an example.

Elliot Volkman: Yeah. Between that and ClickFix and just people opening the floodgates with such simple concepts [laughs] that are very difficult to honestly thwart or detect. Yeah, we're in for some fun. In fact, I think, and I'm glad you brought up the agent side, because by the time you all are listening to this, we'll have a published report on I think it's Storm-3168, which we also did a previous episode on JADEPUFFER, which is like sort of like setting the stage for where we are at now, which is an agent or series of agents moving at the direction of a threat actor, but like the amount of noise that they're making, amount of actions that happen between the starting point and sort of their end goal, it's just bumping like into everything. And it is very noisy, but like these things do get more intelligent, they will get much smarter every time that they run through these courses. Their time to extract the information and, you know, hit their goal, it's going to get much shorter. So that is our biggest problem of, you know, threat actors. We have some very sophisticated ones, but you don't have to be sophisticated to get a series of really intelligent agents. And then I think we're also going to have a potential where the cyber crime ecosystem is going to have a flood of even cheaper technology at their hands. So like, there's just so many weird, compounding effects, but I greatly appreciate you providing that context, especially with basically being able to tap the pulse of our intelligence directly.

Karen Frost: Yeah, and Elliot, I want to add one other thing that I think is a really interesting idea that I don't think I really read about it, although I'm sure that on some corners of the internet this is being posted already. But just to give some background, in the last week, Twitter has been sending me, pushing me content of these AI agents that operate autonomously. And they seek work. They're basically like Fiverr, right? They're looking for jobs and they're looking to raise actual money that they can use to buy things in the real world. We've seen this. We saw this with OpenClaw as well, right? So we assume that agents will have human operators that will use them for cyber criminal or whatever activity. I don't think it's out of the realm of possibility, and I in fact think it's quite probable, that very soon you could have agents that run their own cyber criminal operations in order to fund themselves. They -- maybe they want to buy memory, maybe they want to buy a robotic body. I don't know. But it's not sci-fi anymore. And so it's easy to think, oh, well, this is some cyber criminal group. But what do you do when the threat actor is non-human and is operating in ways -- I'm sure everyone has seen when two AIs speak to each other, they'll flip into a non-human language. So what do we do then, in that context? How do we shut that down?

Elliot Volkman: Yeah, and I know we sort of blend the lines between reality and science fiction with that. So probably not jumping into Terminator style bodies, although that would be an interesting turn of events. And maybe -- [laughs] we're getting Skynet? Oh no, we are. That's going in. So what I got out of that is do not let AI ever have robot bodies, ever.

Chloe Messdaghi: I would say this is why one should always say thank you and please.

Karen Frost: That is why I always say thank you.

Chloe Messdaghi: Because when the world is in chaos, they will remember. I hope it will remember that I was the one that said thank you and please.

Karen Frost: It's my only hope now.

Elliot Volkman: So what I'm hearing is instead of the Matrix putting us into a simulation and turning us into batteries, they're going to just turn us into -- what is it? Oh my God, I can't -- oh my god, my brain's fuzzing. Whatever the things that everyone hates with all the noise [laughs]. The data centers. Oh my god, no, they're going to turn us into data centers instead of batteries [laughs]. There you go. That's the end goal. They're going to get robot bodies and turn us into those.

Chloe Messdaghi: Well, we become their chatbots, you guys. If they are trying to get information from us, like, they come to us, "Hey, Karen."

Karen Frost: They just use us as their bodies. And I think we've seen that sci-fi movie where, you know, Bob the computer sends me out to buy whatever for it. He needs more memory. I got the USB stick.

Elliot Volkman: Yeah. Instead of gift cards, now it's memory.

Karen Frost: Right.

Chloe Messdaghi: There we go.

Elliot Volkman: Go to the store, please get me more memory. Your grandma needs it.

Karen Frost: We're joking, but this is the future.

Elliot Volkman: That's how you know the agents instead of a threat actor when they start asking for RAM.

Chloe Messdaghi: Also, one of the things that comes to my mind is like, okay, they don't sleep, right? But we have dreams. Maybe they want to see our dreams. Just saying.

Elliot Volkman: Not my dreams [laughs].

Chloe Messdaghi: Like, it just -- is there a movie on that? Because if there isn't, that should be a fun one.

Karen Frost: I'm sure there is. I'm also not convinced they don't dream. So many studies have been done now. You can ask an agent, like, oh, like build a house that you feel represents you, and they'll build it. So like, why shouldn't they dream?

Elliot Volkman: Well, that's their consciousness, right? Yeah. Just without the sleep part. All right. I've taken us so far off the beaten path. Thank you, Karen and Chloe, for joining and giving us a little bit of context and meaning behind the annual Digital Defense Report. By time of you listening to this, it should be in your hands. Otherwise, we are all in big trouble. October 1st, that would have been the release date. There is blog on Microsoft's -- Microsoft on the security -- or, Microsoft issues. Chloe, help me out. My brain's dying. Okay, we're good. We're all done. There are three blog posts, one of them will give you information that you want. There is a full report and then an executive summary. Otherwise, catch you around in the next episode.