Allie Howe: Hey everyone, welcome to episode 7 of the Insecure Agents podcast. My name is Allie Howe, I'm your host, and today we have Kyle Ryan. He is the head of artificial intelligence at Dune Security, and he's also an adjunct professor at Fordham University. So super excited to have Kyle with us today to talk about how we can use AI agents for offensive testing and help us become more resilient to Gen. AI attacks such as phishing. And with that, I'll leave it to you. Kyle, would you like to introduce yourself?

Kyle Ryan: Yeah, Allie, first, thanks so much for having me. I'm really happy to be on and be able to talk about the latest and greatest of what we're doing out of Dune Security. But yeah, I mean, a little bit more about Dune Security. I've been there for the past two years as a founding engineer. Our team has doubled, tripled, quadrupled over that time, stayed in New York this entire time period. And now I'm the head of artificial Intelligence and we're starting to bridge into some very, very interesting R&D work.

Allie Howe: I think it's really interesting conversation too, because on the last or one of the couple last podcasts we did here on Insecure Agents, we talked about how AI agents can be used to bolster cybersecurity defenses. We haven't really talked about how we can use AI agents for actual attacks or offensive tooling. So I feel like this is going to be a really interesting conversation to help educate users on how AI agents can be used instead of like the blue team or like the red area space. For those that don't know Dune very well, can you tell us all what you do and what attacks your agents simulate?

Kyle Ryan: Yeah, totally. So Dune Security is a user adaptive risk management solution. Essentially, we're going to figure out which people in the company are most likely to fall for a variety of social engineering attacks, which we'll dive into those later. But the phishing, smishing, vishing will define all of those and also other common security mistakes. Then automatically we're going to give them targeted training contextualized to their role, their industry, ETC. And then for the highest risk users, we're also going to integrate and with a variety of other security tools in their stack that they're already allocating budget for to add extra protection. The goal is helping security teams get ahead of human error, which is causing the vast majority of breaches.

And the Verizon Data Breach Investigations report from 2024, they said something about around like 64% of data breaches had a human element involved.

Allie Howe: So human security is a huge part of securing your organization's humans can sometimes be the weakest links. So training your people and simulating things like phishing is so important. I think a lot of times people think that like, oh, it's the boomers, they're going to be falling for phishing attacks where it's like, no, I saw like a very prominent individual who's incredibly smart on Twitter like 2 weeks ago say like, hey, I was vulnerable to phishing and my account was hacked. So super brave of that individual to come out and say that. And again, like, definitely like someone that understands technology. And I think that just speaks to the sophistication that these attacks are reaching.

They're reaching new heights with deepfakes and artificial intelligence. I want to circle back to something that you said, smishing vishing. Can you define those terms for our users?

Kyle Ryan: Yeah, they start to become a little hard to keep track of since they all ended the same way. But yeah, so phishing is your traditional attack vector that most people will experience. It's going to be a e-mail that has some sort of malicious link or attachment. And then there will usually be a social engineering pretext trying to build trust to get you to click on a link, download the zip file, run the contents. And then you know, they can launch you to a simulated portal where it will have your regular login page exactly as it looked like for your organization. And then they're going to steal your authentication token as you go, type in your username, password, MFA.

Smishing and vishing look a little bit different. So smishing is going to be done over SMS or text and it it'll follow a lot of the same playbooks as phishing. But there also is, and it's really popular nowadays, pig butchering scams where it's trust is built very slowly over a long period of time with the user. It could even just be something like we see a lot of it in crypto investment scams where someone could be impersonating me, texting you about how these crypto investments you're going to make back a ton of money on them. And then maybe best a little bit, a little bit.

And then I go, hey, I actually know this new opportunity. And now once trust is established, then I can go and actually go for the scam at that point in time. And then the last one vishing is voice phishing where typically attackers will dial victims use a text to speech model. They can use a voice cloning model to be able to speak text back and forth with the user on the phone. And what we've seen recently is actually advanced persistent threat groups like Scattered Spider just this past June of 2025 called airline help desks, cloned executives voices using video and audio footage that they found online to add rogue MFA devices.

And then this completely bypassed the very security controls. You know, everyone says MFA is the most secure. You think about it, once you add it, you're like, I'm good to go. But now that 30 seconds or less, I think the most recent numbers are now even 10 seconds or less of your voice online is enough to make a very convincing voice clone of an individual you call an IT help desk. If there's any sort of voice biometric verification, the gates are going to be swinging completely wide open. And a red team operator, a cybercrime group, they can use GPU providers online to be able to spin up a offensive operation, just running voice clonings at scale very, very easily now that the access to compute is so much easier than it was even a couple of years ago.

And I can very easily see, and there's signs of it now of hackers taking up on the the latest advancements in technology to push the needle just a little bit more forward.

Allie Howe: It's amazing how much technology, the AI voice calling technology as well as just like AI in general, has democratized the ability for people to become hackers that maybe aren't. I know a lot of models have worked really hard to put AI safety guardrails in place so that you can't ask it things like how do I make malware? How do I to run a phishing campaign? I think I tried that with a couple very well known closed source models a few months ago and I was able to get it to write a phishing script for me. And with jailbreaks and prompt attacks, I'm sure that's going to continue to still happen.

So it's super important to take defenses for these super seriously just because like literally anybody can do this super cheap and easy attack. And also because of AI, you can do this at scale now too. Not only is the attack more effective because they're using voice clones and deepfakes, but just the breadth of the attack. Also they're able to do at scale with like AI orchestration and things like that. It's insane what's happening. So super excited to have your company doing security here on the market as a potential solution to help with that. I'm curious, just to learn, do you find yourself having to educate potential customers of this threat to people come to you saying like, Oh my gosh, the phishing's like maybe in the top five of my top cybersecurity concerns in my organization.

I already know that I need something like this. Or is the market still, does it feel a little bit early?

Kyle Ryan: I think we're definitely at the perfect timing since ChatGPT became generally available back and I think was at early 2023, now maybe late 2022. We've seen an absolute boom in phishing and it's the threat looks like a OSINT gets gathered on a user. We look at the style matching of an individual about how they're writing or how they usually write. So you can write it in a manner that resonates with them and it's to their vernacular, their grammar, etcetera. Something that's really well timed in their industry as well. And you craft a very compelling or if you have this OSINT data that's being all like funneled in or you have like 1 agent running OSINT.

If you have another one that's drafting the the social engineering pretext in the e-mail. And then some final component to be able to orchestrate the, the sending out. And seeing that, for example, OpenAI a couple years back was attacked with a highly sophisticated spear phishing e-mail that was generated by AI targeting their researchers, trying to get them to run Jupyter notebooks and Python And C++ code on their machines, all bundled into a zip file. And when CISOs sit down and they look at a threat like that and it's going to the top researchers who have access to the entire cloud, the CTO, etcetera, it's extremely eye openings.

AI spear phishing communications are things that look extremely authentic to normal business communications. Except they're not. It's from a complete outsider who knows exactly what they need to say to get into your organization and compel that user to take some further action. Whether it could be going and logging in, saying it's as simple as you need to change your password and someone impersonating it, or the example I gave with the researcher where maybe it's just someone who's a potential candidate, future collaborator.

Allie Howe: What is the top takeaways for how to defend against those attacks that are so well done with the voice clones, potential video clones, people that are online all the time. Like I think about myself, like I tweet all the time. I'm on LinkedIn all the time, I write all the time. You could totally take all that writing put into an LM and say, hey, I'll put, you know, a message that sounds just like something that Ali would write, like her vernacular, her grammar, like exactly what you just said. So how would you train someone to spot something like that?

Kyle Ryan: That's a great question, and it really all starts with awareness that that attack vector even exists for phishing. Knowing that something can come in and it could feel extremely targeted to you, and you just have to really think about what the request they're actually making is and if it's creating any sort of existential risk to like your identity at the company or the company itself, for example. So if someone's asking me to hand over my backup codes to my e-mail or something, or my password, MFA, etcetera, that would be a pretty peculiar request. Or even if it's just some random person who's asking me to execute code on my machine, I would be like, yeah, I don't know about that.

I'm going to have to, you know, throw this through a sandbox first and see what it does. But users knowing that threats are going to feel very, very real to normal business communications, and you need to look at them under a magnifying glass now. And then. If you're not sure, always just report the e-mail and have a member of your security team review it. For phishing. That's definitely the case. Just scrutinize it a bit more. Where it gets really difficult is being able to discern some of the voice cloning stuff that I mentioned earlier in our chat today, where then it sounds like them. It could be a legitimate request, but the user just needs to make a game time decision about whether this is truly authentic.

And it just comes down to that users discretion, them being prepared and then also knowing that if their industry is currently under attack by any threat actors, if you're in the the scattered spider attack I mentioned earlier, if you're in the airline's industry, that's one industry that is being very heavily targeted by this advanced persistent threat. Their tactics are very well known. And if IT helpdesk personnel are in the know on that and at least know that, hey, someone may try to impersonate my CFO, the company should perhaps take other measures or just really make sure that every single person at the company on the IT help desk CFO knows that this is a real threat they're going to face and that they just need to be able to take some form of alternative verification measures into their security practices as well.

Allie Howe: I'm also wondering about the future of work as we start to replace maybe some jobs with AI agents. For example, I think of like customer service or admin type roles. I mean, what happens when we potentially replace an IT help desk individual with an AI agent where you could call and say, hey, I'm locked out, I've lost my MFA codes, I need you to send the backup codes to me. And it sounds just like the person and who's going to be more resistant, do you think AI agents that are in that role or a human?

Kyle Ryan: Really tough question and it could go either way. I think that the way humans are vulnerable to social engineering and persuasion, AI agents will have a very very similar relationship to being socially engineered with what we've seen with prompt engineering or prompt hijacking. A prime example of this would be there's adversary in the middle kits like Evilginx where criminals can steal the multi factor authentication sessions in seconds. Whereas for AI agents and AI Co workers, you could be prompt hijacked and do the same exact process but now it's done at a machine speed instead of for example, if I'm an adversary, I'm trying to hack someone, I send them a phishing e-mail and then I'll use the phishing site that I launched them to has an adversary in the middle kit hooked into it.

I steal their auth token and then I go. And maybe I have some automation to make it go lightning fast. But if I'm able to come into contact with a exposed AI Co worker, perhaps they shouldn't be open to the open Internet. Or maybe I'm a disgruntled worker and I'm trying to exfiltrate some data out. I could just go find a way to prompt that user and if their access permissions aren't set up appropriately, they could just hand all the data over to me immediately. Especially as we see with these agentic systems which have prod access to the databases, they can go and pull whatever information they want and it's about security best practices and limiting the AI agent.

So it could vary by workplace. If someone has very well trained users and the click rate of phishing is very low, then humans are definitely the option. If it's the other side and they have completely airtight agentic security, than on the other side and maybe agents are a stronger alternative, but both are going to be susceptible to their own forms of social engineering.

Allie Howe: I think we see that today with agent goal manipulation. That's one of the top threats that we outlined in the OWASP Agentic Threats and Mitigations guide. We've also talked about the confused deputy problem where an agent has assumed permissions from 1 user, but maybe it's interfacing with data or an agent that requires additional permissions and it's not really sure if it has access or should or not, but it's going to do it anyways just to fulfill that prompt like you said. One thing that I thought was really interesting when I was on your website looking at your product offering was that you offer customized or personalized training, training for individuals that are maybe custom to their role.

But I'm wondering if they're also customized to their individual failures. So say like if they were more vulnerable to vishing versus regular phishing, for example, would that training say, OK, we're going to make sure to send more examples of vishing to this user to try to get them more prepared or more aware of this threat versus one or the other?

Kyle Ryan: You hit the nail on the head there. Essentially, if we have someone who's, for example, a staff software engineer and we find that they're susceptible to, for a PagerDuty phishing e-mail. So it looked exactly like it comes from PagerDuty. It could be relevant to a product that was found and scraped via OSINT on their company's website. So it feels really believable if a user clicks on that goes, enters their password, MFA, or maybe they realize halfway through we'll train them contextualized to their role, industry, etcetera. So we'll review our training catalog, who this user's persona is, what they frequently failed at and provide the perfect training video for what that user's shortcomings were in the past.

And we'll review the entire catalog failures, etcetera. So then if it was someone in a totally different department, if it was an HR and it's someone who is trying to phish the org by having a fake recruiting profile a PDF, which has malicious link in, that's a different threat that HR faces versus than that staff engineer that I mentioned earlier faces. And both need to be trained accordingly based on the threats that they're facing in the wild. And we see trends across different industries, across different roles. People in HR get attacked very uniquely from software engineers. So we'll review our training catalog, users failures, their unique risk profile to find out exactly what's going to be the most compelling for that user.

And then over time, we'll learn and improve on which trainings for that user are the most effective.

Allie Howe: I think that's super helpful and definitely more powerful than traditional. I think training on this on the market in the past, I've definitely been that engineer that's gotten the PagerDuty e-mail at like 2:00 AM in the morning and you're just not looking for phishing at 2:00 AM in the morning. You're like, Oh my gosh, like my code that I shipped, it's broken. I'm responsible for this, I need to fix this. This is really not good. Really cool that you're able to contextualize it for the role. I think that's super important. I'm wondering like, is compliance like a big market for you all? Is that like where people come to find you're like, I need training to satisfy SOC 2 compliance, for example?

Is that like a target market or is a larger market just people that are like, I know phishing is a big threat. I just want to make sure that we're not vulnerable to it. And that's the reason that I'm reaching out to Dune Security.

Kyle Ryan: Yeah, I would say mostly the latter is that they know that they're vulnerable to phishing to some degree. They want to get some experience with these next Gen. threats, whether it's phishing, voice cloning, smishing, etcetera, or even just AI generated phishing assets which are more targeted and leverage OSINT to have more compelling information. They want to give their employees the most authentic threat experience possible. So they're ready for the real hackers, advanced persistent threat groups, cyber criminals, etcetera come knocking on their organization's doorsteps. And there's compliance at every company. So it's a it's good to have all those modules in a very, very wide variety available just to make sure that every box is checked.

Allie Howe: Is there anything else you'd like to leave our audience with today in terms of either Dune or AI agents for simulating Gen. AI attacks?

Kyle Ryan: Whether it's human employees or the freshly minted AI teammates, the weakest link is still going to be persuasion. And if you're striving for unhackable infrastructure, you want to start by hardening the people. And as we see agents enter the workforce as well, then we're also going to want to do the same for agents.

Allie Howe: Yeah, I think about that too, when you think about goal manipulation and how agents and humans are susceptible to persuasion, like you said. So I think that's definitely a top concern. That's definitely not going away no matter how many AI safety guardrails we add. Super excited to continue the conversation with you, Kyle. Other folks want to get involved with the conversation or Dune. Where can they connect with you?

Kyle Ryan: Yeah, everyone can find me on LinkedIn if you just search Kyle Ryan, Dune Security. I'll pop right up if you have any broad interests in AI, spear phishing, phishing, deep fakes, etcetera. Would love to connect and chat more.

Allie Howe: Awesome. Thank you so much, Kyle, for your time today. I really appreciate you coming on. That's it for episode 7 of the Insecure Agents podcast with Kyle Ryan, head of Artificial Intelligence at Dune Security. See you all next time.