Over the last five years, the State Department has faced more cyberattacks that include custom software code than ever before.
And now with the addition of artificial intelligence in their toolboxes, bad actors can develop bespoke code easier than ever, said State’s Gharun Lacy, deputy assistant secretary and assistant director of the Diplomatic Security Service for Cyber and Technology Security.
Lacy was joined by Egon Rinderer, senior vice president of global enterprise and public sector at NinjaOne, and Paul Blahusch, former Labor Department chief information security officer, for a panel on frontline cyber defense during Federal News Network’s Cyber Leaders Exchange 2026.
“Over the last four or five years since I’ve been here, I’ve never seen an adversarial engagement that did not have a custom piece of code, a custom piece of malware or a custom set of tactics, techniques and procedures — TTPs — that was designed specifically for the State Department’s network. In all of our adversarial campaigns, there has always been a custom piece of tooling, software and infrastructure that was stood up, built specifically for us. We know those adversaries. We know their trade craft. They know us. So that white hat, black hat game, that cat and mouse game goes back and forth,” Lacy said.
“We’re working closely to embed our threat hunters into our chief information officer’s shop with a couple of the deputy CIOs that are looking at this very problem set right now,” he continued. “What is the future architecture for us going to look like? That’s the key. Yes, they’re best practices. Yes, you have frameworks that are out there. Of course, the National Institute of Standards and Technology is always a key to that. But you know the common joke from a defender is: Adversaries don’t attack frameworks, they attack you.”
Just recently, cyber researchers discovered attackers using the ChatGPT tool to create custom GPTs for the specific purpose of bringing the user to what seems like authentic links that, once clicked upon, download malicious code capable of evading detection by a user’s cyber tools.
Lacy said AI is helping criminal gangs and nation states be more disruptive than ever before.
“Activists can act more like nation-state actors because the AI has raised the bar in terms of their capability. So, where a critical infrastructure piece of a power plant in Des Moines would previously see a script kiddie that is low sophistication, now we’re seeing higher levels of sophistication targeting that because AI has allowed not just the criminals but nation states to spread out their attack surface,” he said. “We have to follow the actor and work backwards. It helps you determine what the best protective posture is for your specific system or organization.”
The need to prioritize patching
The use of custom code is why Lacy and other cyber experts say understanding your underlying architecture combined with the prioritization of systems and data matters more than ever.
But a challenge for many agencies and private sector organizations is they mitigate critical vulnerabilities of key systems much later than they should.
The reason, Rinderer said, is the concern that because these systems are so mission critical that breaking them would cause as many problems as a cyberattack would. He said organizations are making a false tradeoff between dwell time of the vulnerability and self-infliction of the patch.
“We’re going to let the vulnerability dwell longer on those mission-critical systems because that’s somehow less scary than a self-inflicted wound we might impose. That’s one of the hallmarks of a failure of the tooling itself,” Rinderer explained.
“You’ve got to start putting this stuff into contracts. Putting teeth in those things so if somebody’s hitting the renew button on a piece of legacy tooling because it’s easy, and that legacy tooling doesn’t comply with zero trust, it presents an outside threat to you that you have no control over, and it doesn’t have the modern capabilities that you should expect. Vendors should not only work with customers to stack rank the vulnerabilities but also I should be patching those vulnerabilities. Don’t push the mission-critical systems until last. A lot of that responsibility is in the lap of the vendors.”
Basics of zero trust still matter
Blahusch agreed. The former Labor CISO said that with the speed and volume of cyberattacks increasing, agencies have to know which patches are most important to install.
“When I was the CISO at Department of Labor, there were often times we could not meet a mandate to patch a system. But I always would tell my team, ‘We have to do the best we can. If we can’t meet the mandate, we still need to try our best and not just throw our hands up, right, and say, well, it’s impossible to do that.’ It’s really then became the hard work of prioritizing where we put our efforts into making sure that we’re supporting our mission by securing the data and systems that we need, and then we’ll worry about those other mandated patches at a time that we can accommodate those things,” said Blahusch, who is now president and CEO of B&A Cybersecurity Consulting. “It really goes to knowing your environment, knowing what’s important, where’s the important data, where’s the important services, where am I most exposed to this type of vulnerability and really be working from there.”
Rinderer added that recent cyber data shows vulnerability exploitation remains the number one means of breach and the time from breach to moving laterally across networks dropped from more than 90 minutes to less than 2 minutes in the last two years.
“When people hear those numbers, they clutch their pearls. But this is exactly what zero trust was designed to stop. If you have a fully microsegmented environment and somebody lands on an endpoint, guess what they’re not doing? Moving laterally,” he said.
“We’re seeing a remarkable increase in what is very obviously agentic involvement in the attack. We can assume that it’s happening pre-attack where they’re gathering telemetry data, understanding the target and feeding that into AI. But once they land in the network, it’s very obvious. There are telltale signs that there’s agentic involvement, and things just move much, much more quickly than they have historically. We are squarely in the IT operations space, but IT operations is where the mitigation remediation of the problem lives.”
Rinderer, Blahusch and Lacy said all of these changes in the threat environment reinforce the need to implement zero trust tools.
Lacy said in many ways an organization’s architecture really determines when the breach clock starts.
“For agencies that have actually done the good work of zero trust microsegmentation, the breach clock moves much slower. The problem is finding any agencies that have fully achieved microsegmentation,” he acknowledged.
“When we talk about inventory, we are talking about basics and fundamentals of an asset inventory because your architecture really is the best fundamental defense and countermeasure against this type of threat environment. We get focused on patching. We’re never going to patch fast enough. Architecture will always beat patching, even at this level right now with the advanced capabilities of the agents. We do see that the agents still struggle against well-architected environments. Unfortunately, in the federal government, most of our environments are so big, so sprawling and so federated, so bespoke and piecemealed together, that we’re not going to have a well-architected environment, and that’s the challenge — to get to that point.”
Take a Reagan era approach
Blahusch added the basics of zero trust, like identity and access management and phishing resistant multifactor authentication, remain foundational against AI-fueled attacks.
“You read about a lot of the compromises that happen, especially in the private sector and a lot of it still comes down to that they’re not consistently and comprehensively using phishing resistant multifactor authentication and getting hacked through that. So that works. Microsegmentation works. Zero trust principles work,” he said. “User education, awareness and training may not be as exciting as AI, but it still works.”
Implementing some of the basics of a zero trust architecture is part of how organizations can make the attackers work harder. Rinderer said bad actors use large language models that rely on data centers. So how can agencies and other organization use AI and other tools to make the cost of an attack outweigh the benefits?
“AI doesn’t all have to be giant, large language models running in data centers. In fact, if you look at the way that we’ve employed it, it has the impact of giving time back to the administrators, measured in hours per week per administrator — and you extrapolate that across a large organization. You’re talking about tens of thousands of hours. Those AI capabilities that we have built to date cost us pennies, literally pennies a month. They are extremely narrow AI capabilities,” Rinderer said.
“To some degree, we want to take this Reagan era approach of like let’s exhaust their resources to the extent that we can. I think there’s a lot of lessons to be learned there. We’re still in the very early days of this. But it’s been very fascinating to me just how much, if you do these sort of mental exercises, you can move the needle for how little.”
Discover more articles and videos now on our Cyber Leaders Exchange 2026 event page.
Copyright © 2026 Federal News Network. All rights reserved. This website is not intended for users located within the European Economic Area.