The Most Dangerous Tool in Your Toolkit Is Bored

That's

close to possible

intro. Yeah.

Thank you. All righty. So, it was mentioned earlier AI. So, this talk about who am I? I've spent 20 years CTO building systems around humans for humans. I think that's pretty important. A lot of system implementations go and a lot of humans get in the way of systems. I've built software and infrastruct

AI has gone main.

So a quick question who uses AI at work or

how about researching

cool communication. Who's getting up to write your emails or your text? Cool. Who's using agents? Okay, keep your hands up if you're running your own MC MCP server. There's a few here. That's cool. That's cool. So, what happened in 2025 that was really big on the internet? Something significant has happened just recently. Who wants to yell a guess? No nobody. >> Internet search died. >> No longer does Google behave like a search engine that we all grew up with and abused while we were learning how to do it. It's very different now. This is a massive change with how people are accessing information, searching. It's faster. Why wouldn't you use it? So those people who didn't put their

hand up because they don't use AI, >> when was the last time you did a Google search? >> It would be AI giving you that answer. Now, uh, it's very different. Um, >> the other thing they've also done is they've removed the number of pages down the bottom, if anyone's noticed. So they no longer use their banner cry about how many pages of index they've got anymore. That's gone. >> The other thing that happened this year and makes me sad and I reckon there'll be at least one person in this crowd that would know why. Jamie from the JRE podcast has been replaced by AI. No longer does he get to troll through Google while they're making the show.

It's all now perplexity. So, even the best well-known Googler in the world has been replaced. >> Well, maybe it just looks different. Maybe it's still search. But what's happening to websites and the traffic on the internet's changed as well. There's been a decrease of 25% in clickthrough to sites. So, traffic isn't getting there anymore. There's 96% fewer site links, 8, sorry, 84% fewer videos, and now 58% of Google searches result in no clicks at all. People aren't searching on Google anymore. So, is that good or bad? It's faster. People are getting their answers quicker, but we're just taking what it says. I'd be really interested to know what that's also done for their AdWords model

because they're not getting any throughput now. >> So AI is here. Organizations are using it. Everybody wants to put it in. Enterprises are using it. They're actively advancing generative AI in their systems. The stats say that 92% of Fortune 500 companies are using it. There's millions of users, billions of requests. It's not going to go away. So, what has that changed for? I mean, that's a very broad bush approach, but what has it changed for IT security? The stats are scary. AI ends up supercharging all our old tricks and you end up with fishing attacks increasing by 1,265%. That number is crazy. The number of reported AI embedded cyber attacks has risen. Red team public competition of AI agents

is crazy. They they the pentest GPT gets like 28 out of like capture the flags out of hundreds. like it does really well. Breach volume is at records and it's also high high records because of social engineering. One of the weakest points that AI especially large language models is being used to to leverage is humans. The spam that it makes, it's beautiful. It gets past all the old filters. So if you think about what you're doing is your toolkit full of boring tools, but what does it mean to be bored? I call it you you've got it here. The tools are there? Are you actually using them enough to keep up with the adversaries, the guy

sitting next to you, the guy going for your job, or the girl that's DMing people and using chat GP? It's out there. I've seen it. So, in the past year, I can think of a bunch of times that I've lent on it to develop power simulation systems for battery systems, fixing DB queries for slowness, debugging e-commerce websites. Like, it's great. plus emails, chats, all that kind of stuff, planning trips, it's all for. So, what are the bad guys doing? Well, they're all matting everything. Your recon and exploits. There's a tool called Hex Strike AI, and it's scary. It's got a laundry list of tools that it has. It doesn't automated open source intelligence. It scrapes LinkedIn. You

can tell it to look for GitHub Showdan. It's amazing. So, if you wanted to uh sit there and kind of surf the web looking for targets, that's a slow way of doing it. Now, fishing is getting automated heavily. The ability for it to draft emails, mimic your CEO's tone, especially if it's got access to its mailbox. Like if it's had some of the communications from your CEO, it'll be able to pick it apart. Translations, that's not a problem anymore. It's pretty hard to pick out the Nigerian prince. And they're even using voice cloning and video cloning now in some attacks. Not only that, the campaigns can be generated very quickly, low amount of effort. They also can be tested in the actual

box itself. So you can run your proper tests and see how it goes. And deployment in hours. Coding and malware. This is crazy. I'm not a coder. I'm a hack from simple scripts. It'll do it. Uh and to actually like do things like hide the code. I know was talking to my sister over the year about one attack that she's seen. It wasn't encrypted or obicated in any way, but the tools are there to do it. Why aren't they doing it? So, with all those tools, these hackers, they're getting some superhuman skills. Social engineering 2.0 hackers are using it to generate profiles resumes to pose as developers, legit actors. There's even, and I won't go into it too

much because I know it's in a later talk, but there's a cool story that involves North Koreans getting hired >> and staying hired. And I know there's another really interesting one with Open AI where they busted the Chinese using it to draft malicious attacks to US citizens. Um, that's a really interesting one where they're using their own tools which are meant to be, you know, slided for them. They're actually going, "Oh, I'll use that to generate the content." So that kind of threat vector has changed. You've now got AI as like a social engineer, not in human form. It's going to be faster. It's going to be quicker. And it erodess and it creates an issue where your biggest

problem or it grows to be a biggest problem is trust. Who's generating it? Who's doing it? The amount of information that there's now being generated is crazy. How do you keep up with that? So, we've now enabled the hacker toolkit skin for the toolbox. What do you do from the other side of the fence? Well, you automate all the things for defense. Uh AI can triage alerts, do you summaries, you know, free up people to do that higher order work. Um you can, you know, all those uh repetitive tasks, prompt engineering. When you build this, you probably should keep a human in the loop. Otherwise, you know, you you'll lose your job. Don't automate augment.

But automate everything you can because you'll need to be defending its machine speed because that's what they're attacking at or, you know, collecting information at. So the future of work it's going to be augmentation rather than automation auto automation. Uh the jobs and skills Australia put out a report that they think that 13% of tasks will augment sorry automate 13% of tasks and augment 55%. Reallocating labor rather than destroying it. Don't know why they'd use those words about destroying labor. Maybe it was a liberal written. Now, clerical reception and accounting roles are one of the ones that are going to see the biggest decline. Those work of just moving information from one system to another, answering

the phone, reading emails, that's going to see a big pull. Cleaners nurses construction hospitality workers, they reckon that's going to come up. So, I guess we're not getting robots anytime soon to do the cleaning. The biggest thing they point out is that AI literacy and adaptability are going to be the biggest things that matter and jobs are likely to evolve rather than vanish. um had a really interesting chat with a radiologist friend of mine and he used chat Gvt to automate and write an interface for his home automation system. Now he's a radiologist. He's not a coder but he went to chat Gvt, he told him what he needed and I gave it to him

and it worked. He gets on the phone to me and he's like, "It's coming." I'm like, "No, it's already here." And like the the conversation went to what is the kids going to do? Because he'd been pushing his son down a path of do computer science, get there, do this, do engineering. Kids not really be engaged. But what are they going to do? So I tried to turn it into a light-hearted conversation. Asked him, well, what would you still go to a human for over a computer? And he came back with the answer of food. So, I think we should all become chefs. But, you know, probably use the tools available, use it to make recipes,

things like that. Do your ordering cuz who likes paperwork? >> So, agents and MCP servers or, you know, context protocol servers are the next frontier. collaborative AI is emerging which is an interesting concept where the different models you use and change together almost act like general contractors and when you build a house you get a plumber get electrician you know when you start looking at trying to build things you go okay well I'll use an illustrative bot or I'll use a text bot or don't try and use the PowerPoint bots they draw boxes everywhere. It's crap. So, in doing this talk in between submission and now, one of the most interesting things that I found

that happened was the amount of effort I had to do early on to like do submissions and things like that. It's changed so much since March. >> What I had to take time to craft, put together The agent mode creams. It does it so fast. Goes away. Does it itself. It's not cheap, but it does it. But if you think about using AI in the workplace, getting it to build, you know, task list for people, make it be a project manager if you want to. I wonder what we're going to see our work look like, what the pace is going to be. Cuz you know, project manager, a good one, he keeps you moving, throws

you tickets, asks for updates, moves the work around if he needs to. But if that gets automated, you're not looking at like a garden hose anymore. you're looking at like a SpaceX delu system worth of, you know, job requests or what you need to do or give us an update because if it's automated, you know, if they're creating that pipeline, go bug the guy every 5 minutes, I guess we'll just have to automate back, send an update every time he asks for one. So, in conclusion, embrace the board. And it got silly and chose the wrong kind of board. Prepare for the agents. The agents are where it's going to be a big multiplier next. The individual models are running

out of improvements. They're trained off fast and they're running out of stuff to feed it. But the agents chaining agents together and getting it to do the work for you is going to be where you're going to see the most amount of mundane work fall away. Probably want to keep the humans in the loop so you keep a job like I said. But the judgment and ethics, you know, these models can go a little bit astray. So, you've all been hacked. Bides has been hacked. Well, kind of.

It's an unauthorized access and privilege escalation. The vulnerability was identified when we were able to put in a generative AI full submission. All the content, all the structure, all the images, all the jokes, not my fault. So, it was prompted to compose the submission later the entire talk, but it's a proof of concept and it's success because I'm standing here that an AI authored talk could be presented live. You start making questions about what do we do? Which content do we trust? What stuff are we reading, watching? You know, it's AI slop. So if if AI can be used to hack or engineer access like this, what else could it engineer an access? Especially if there's, you know,

a lot more resources, state badge actors. what could happen. So, some final thoughts. Who's really holding the keyboard? If AI writes your code, drafts your, you know, emails, and plans your day, at what point does that authorship accountability change hands? Do you blame the IIT that screws up? Or is it you that was crafting the prompts? Can we outsource wisdom? Now knowledge has kind of now become infinite and instant. You can find out anything really quick. But wisdom requires judgment, empathy, and restraint. You know, an AI could just basically not have feelings. So, you know, if we hand over that thought leadership to AI where we go yeah all right that sounds good let's do that

you know is all those interactions in business and you know peopleto people are they still meaningful and what happens when there's no more real original thoughts and it just becomes a regurgitation and a replication of that's what that thing said let's just try The next concept is, can you patched human trust? Ever had somebody do something wrong to you? Do it dirty. How easy that's to fix. Every exploit has been about trust. Someone believed the wrong input. Someone told you something, you believed it. >> The AI could tell us something, we'd believe it. And then the next question is if you can gain root access to your attention, you know, like when you're sitting there

on a phone just scrolling, what does the AI install in us? You know, we might have sat there and firewalled our networks, put AI on, uh, you know, AV on our machines, but we haven't really kind of prepared our minds for this. And I don't think the general public's ready for it either. you know, how do you believe what's being put in front of you? So, you know, are we letting AI reprogram us, our workflows, our values? How do we decide which parts that we should automate of ourselves? And it goes back to that comment I made earlier about a mate of mine. Look, we'll keep him innocent, so we'll call him Simon. Simon asked me the other day, "Hey, how

could I automate this DMing on these apps to try and date? You know, can I just like make it come up with really remarks and put it in?" And then I don't know, phones must have been listening to us, but came an advert for I think it was Perplexity's Comet, the new browser. And it was actually two people sitting there talking about how to use that browser based tool to do DMing and even book the dates. >> Is that really something we should be handing to AI? So thank you. No,

[Applause] >> no questions. Another question. A very good friend of mine was in the keyword for the exact reason that brought up ying SEO and she failed. Y >> the company that she represented at the time,000,000 a month was like shal.

>> Yeah. >> Know another guy in DevOps who was developing a track using >> Yeah. it's kind of gone. >> Yeah, you're not going to get there anymore. Um, you are right. Um, I've had a very very similar experience just recently with an e-commerce website that been contracted to fix and we fixed these performance issues. Like the owners are super happy, which we used AI to work out what to do. 100% transparency there. But the next topic he wanted to go and go ahead and fix was he wants to now sell an SEO package to people who use his SAS platform, like his SAS e-commerce platform. And yeah, I'm trying to have that conversation with him now that it's

dead. Don't worry, don't put the investment into it. You need to be making your websites ready so that you know you're providing information that AI agents are going to be able to pick up and serve to people if you want to direct that traffic or make those sales. Because if you look at those click-through rates, that's changed. Yeah. Cool. Thank you very much. Thank you. [Applause] Thank you very much. Uh we're heading into a morning break now. So I forget schedule says the time.