Adversary Universe Podcast

The field of cybersecurity higher education is changing as quickly as the threat landscape itself. Neil Schloth has a front-row seat to these shifts as an adjunct professor at James Madison University.

In this episode, Neil joins Adam and Cristian at Fal.Con Las Vegas 2026 to discuss what today’s students are learning — and how different it looks compared to when the three of them were breaking into the field. “Constantly updating the curriculum is key,” he emphasizes. Over time, his curriculum has evolved to span topics including API security, cloud security, risk and asset management, and security engineering and architecture, depending on the class level.

Training the next generation of security practitioners requires educators to stay current not only on what students should learn but how they should learn it. Programs that embrace hands-on experiences are the ones thriving. Students want to be in the weeds, working with their peers and learning from their mentors in person.

Of course, they now must also navigate AI. “It’s keeping educators, especially in this space, on their toes,” as Neil puts it. AI can be productive, but not in a way that limits students’ ability to understand what they’re taught. It’s driving a change away from final papers to final presentations as students learn to understand and communicate information in a compelling way.

Tune in to hear Adam, Cristian, and Neil discuss how cybersecurity education has changed since they got their start and what the future could hold.

How is the threat landscape looking these days? “A lot is going on,” as Adam puts it. “The speed and the volume of the activity, everything is on fire.” To illustrate, he shares the Falcon Adversary OverWatch team is now clocking a new agentic adversary every two hours.

A new report from CrowdStrike Counter Adversary Operations puts a spotlight on some of them. The team details four profiles of agentic adversaries, including their targets, operations, and sophistication. Actor 1, believed to operate out of Argentina, is the most advanced and uses a range of AI models including Claude, Sonnet, Opus, and Fable to target healthcare entities. Actor 4, the least sophisticated of the group, is likely a criminal actor operating out of Russia.

In this episode, Adam and Cristian compare and contrast these adversaries. They discuss how they built the harnesses used in their operations, how they handle rejections or guardrails built into AI agents, and how they overcome challenges. Each actor has different methodologies for dealing with the obstacles they face. They also have gaps in their operational security that allow researchers to gain a better idea of how they operate.

Tune in for all the details and check out the full report: CrowdStrike Counter Adversary Operations Uncovers New 2026 Agentic AI Campaigns.

Bartley Richardson, Chief AI and Autonomous Systems Officer at CrowdStrike, recently took the stage at Fal.Con 2026 to announce CrowdStrike’s Cyber Superintelligence Lab. The lab brings together our AI researchers, offensive operators, and incident responders to build defensive model and harness capabilities for the agentic era.

How are they doing it? “To build the best defense, you have to understand the best offense,” Bartley says.

The first initiative to come from the lab is SafeMind, a system that combines offensive and defensive security models with runtime harnesses to execute autonomous security workflows. Red Tempest, on the offensive side, emulates real adversaries targeting live virtual machine (VM) environments. The CrowdStrike Falcon® sensor takes this telemetry and feeds it into Blue Solano, the defensive environment, to improve it. The fortified defensive model then faces Red Tempest again.

“We wanted to build the best defensive capability that would auto-patch, auto-remediate, auto-deliver content, to work inside of environments,” Bartley explains in this episode, which goes far beyond SafeMind.

Tune in to hear Bartley, Adam, and Cristian dig into the AI advantages for adversaries and defenders, scaling cyber defense in the enterprise, and their predictions for the future of AI.

Over the past several decades, China’s five-year plan has provided a roadmap to the country's innovation and economic growth. It details what China is interested in, where technology is evolving, and what it plans to target, including the highest-priority verticals.

“It’s their shopping list,” as Adam puts it. His team does a deep analysis on these plans, including information published adjacent to it and the discrepancies across various languages.

The latest five-year plan, published in March 2026, reveals a strong emphasis on a wide range of industries: academia, aerospace, biomedical, defense, and energy. It also reveals new areas of focus: AI-enabled robots, integrated chips, and innovation in advanced circuitry design. As China strives for global technological influence, integrating AI into every industry is essential.

Tune in to hear Adam and Cristian discuss the details of China’s latest five-year plan, the reasoning behind making this information public, how the plan enables cyber contractors competing for government projects, and how China’s strategic focus on key industries and AI development is poised to shape the geopolitical and cybersecurity landscapes.

Steve Schmidt, SVP and CSO at Amazon, sees firsthand how both defenders and adversaries are using AI to their advantage. In this episode, he joins Adam and Cristian to discuss modern AI models, evolving adversary behavior, and how Amazon is responding to shifts in the threat landscape.

“The big change we’ve seen recently is the ability of models to chain things together to produce something interesting,” Steve says. As AI models grow more adept at automatically chaining and acting, he adds, the time to respond has dramatically decreased.

Defenders must now measure and respond in seconds or minutes, when they used to have hours or days. In using AI to fight AI-driven attacks, they must also consider which AI models they’re using. Using the right model is essential. If the business is building defenses for Mythos or Fable, and the adversary is using a different technology, the threat model changes.

While adversarial use of AI is a primary concern, right alongside it is employees’ use of AI. As Steve puts it, to build a good AI governance program, defenders need strong identity governance and data governance programs. The identity component is key. Many organizations over-permission agents; others are so restrictive they defeat the purpose of having agents at all.

How did Amazon handle this? Steve shares how the company built its own authentication framework that treats agents as a third type of identity. The agent temporarily inherits permissions through session-based delegation from the human who deployed it; it can only access what that person can access. It can’t do what they can’t do, even if a malicious prompt tries to trick it.

Tune in to hear more details about AI-driven defense, and the evolution of AI-powered offense, in this episode of the Adversary Universe podcast.