Kevin BeaumontOct 29
The management at my org is thankfully very good and gets it, but if you are struggling to explain to your management as to why they should stop sucking the GenAI marketing juice and chasing the AI laser pointer like a cat and instead do foundational security, explain it a way they'll understand: AI.
Show threadKevin BeaumontOct 29

Also, if your management has seen the widely reported "80% of Ransomware Attacks are AI-Driven" headline published by MIT, it was paid for by a vendor.

The paper is absolutely ridiculous. It describes almost every major ransomware group as using AI - without any evidence (it's also not true, I monitor many of them). It even talks about Emotet (which hasn't existed for many years) as being AI driven.

It cites things like CISA reports for GenAI usage.. but CISA never said AI anywhere.

Show threadKevin BeaumontOct 29

The PDF is here and is absolutely crackers, MIT should be ashamed of themselves for letting this out the door.

https://cams.mit.edu/wp-content/uploads/Safe-CAMS-MIT-Article-Final-4-7-2025-Working-Paper.pdf

No, REvil don't use AI to set ransom demands, CISA never said that, none of the sources cited said that, and they were running before the GenAI craze. It's just absolute nonsense, every page is.

Show threadKevin BeaumontOct 29
If you want to know why MIT are working with Safe Security and what Safe Security are doing... they sell an AI product which they say is developed with MIT to solve the report they made up, after receiving 8 figures in VC funding.
Show threadKevin BeaumontNov 1
Update: MIT have removed the study after this thread.
Show threadKevin BeaumontNov 3

I have asked MIT these questions:

1) Is this paper being retracted?

2) How much money was paid to MIT Sloan by Safe Security?

3) What part did Safe Security play in the paper creation and review?

Show threadKevin BeaumontNov 3
It isn't a new paper btw - e.g. senior MIT people have been using it in public at a cybersecurity conference earlier this year and linking to the now deleted PDF.
Show threadKevin BeaumontNov 3

The Financial Times today links to the now deleted MIT study https://www.ft.com/content/56cb100e-7146-488f-aae5-55304ae0eff6

If anybody knows anybody at the FT, could we please tell them it's fake?

Show threadKevin BeaumontNov 3

MIT have also silently, without noting on the pages, started rewriting their website to remove references to their own work. They've also changed the URLs of the pages to remove references.

Left, before: https://archive.ph/SckSr

Right, after: https://mitsloan.mit.edu/ideas-made-to-matter/80-ransomware-attacks-now-use-artificial-intelligence

Show threadKevin BeaumontNov 3

I'm coining another term - cyberslop.

Cyberslop is where trusted institutions use baseless claims about cyber threats from generative AI to profit, abusing their perceived expertise.

I'm also starting a series about it, called CyberSlop. Much more soon.

Show threadKevin BeaumontNov 3
knightkneeNov 3
Show threadKevin Beaumont
Several members of MIT sit on Safe Security's board -- who paid for the paper, including the person cited as the author of the paper.
Nov 3 at 1:10pmWeb
Show threadKevin BeaumontNov 3

New by me - CyberSlop, where I look at orgs misusing GenAI fears to take from their own customers.

First threat actor - MIT and Safe Security go full cyberslop.

https://doublepulsar.com/cyberslop-meet-the-new-threat-actor-mit-and-safe-security-d250d19d02a4

CyberSlop — meet the new threat actor, MIT and Safe Security

Cybersecurity vendors peddling nonsense isn’t new, but lately we have a new dimension — Generative AI.

Medium
Show threadKevin BeaumontNov 5
According to MIT, Shodan is AI. 🥴
Show threadKevin BeaumontNov 5

The whole report is like that btw. It even lists ransomware groups who disbanded before the GenAI stuff as using GenAI. It also cites no evidence for any of the groups using GenAI.

I suspect Safe Security authored the problematic bits but to be confirmed. Safe Security’s website is absolutely full of absolute nonsense, reads like it is AI generated, and has AI artwork of Chad AI robots on it.

Show threadKevin BeaumontDec 4
A vendor has made a paid Forbes magazine post trying to redefine cyberslop as "High-Volume AI Threats"
Show threadKevin BeaumontMar 4
MIT Sloan's urgent review of their 80% of ransomware attacks are via Gen AI paper, progress update report after 4 months:
Show threadKlaus FrankDec 4

@GossiTheDog Nah, just looks like the usual clickbait article bullshit to me though.

Turn brain off, write some garbage, maybe have an LLM generate parts or all of it for you and post it without looking at it...

Show threadEdDec 4
@GossiTheDog appears there might already be a AI generated song called Cyberslop
Show threadRaphaelDec 4
@GossiTheDog hilarious
Show threadStefan PrandlNov 5
@GossiTheDog Big if true. Though if it is true, it’s vitally important someone gives me a neural computer interface and a ticket to Saturn.
Show threadfuzzyfuzzyfungusNov 5
@GossiTheDog What they told us was true; from a certain point of view.
Show threadPhil Burg (he/him)Nov 5
@GossiTheDog
From discussions with non-IT people, anything that implements an algorithm is AI.
Show threadTheTomasNov 5
@Standard_Phil @GossiTheDog no no thats magic, cult or religion... ;-)
Show threadtheHastyOneNov 5

@GossiTheDog I mean that is the new marketing trend, right? Oh this application does OCR..the same OCR we have done for like 15 years... That's AI...you have an app that has a ML program to recognize hotdogs and not hotdogs....that's AI... The computer did spell check..you guessed it AI!

Neural networks not needed

Show threadBill, organizer of stuffNov 5
@GossiTheDog 💀
Show threadSteveNov 5
@GossiTheDog
Show threadFalk Heiland 🇺🇦 🇪🇺Nov 5
@GossiTheDog I had a MVP claim in a presentation enigma back in WW2 was ai. Dumbest timeline something something
Show threadplasticine_eraNov 5
@GossiTheDog I'm AI ... and so's my wife....
Show threadrootNov 5
@GossiTheDog sneakily using AI for automated instruments, eh?
Or "everything is AI, if you're brave enough"?
Show threadZeph!Nov 5
@GossiTheDog You could probably consider it AI under the academic definition that's been in use since the 50s, but now everyone thinks all AI = LLMs or MLMs.
Show threadDanny PalmerNov 5
@GossiTheDog I know pretty much all cyber firms say everything they do is AI now, but this firmly takes the cake.
Show threadMetacurityNov 3
@GossiTheDog Kevin, I have to reiterate, MIT did not talk to me. You need to correct your piece.
Show threadchapulinNov 3
@GossiTheDog the IoC section is gold. Bravo 👏
Show threadMats WernolfNov 3
@GossiTheDog
Articles like this actually lowers my blood pressure as realise there is a resistance to this AI bs that corporates try to drown us in. Thanks
Show threadSnoopNov 3
@GossiTheDog thanks, just blocked the IoCs
Show threadMordoc 🇨🇦 (VA6STM)Nov 3
@GossiTheDog Thankfully someone is listening you, the sage among the fools! https://www.theregister.com/2025/11/03/mit_sloan_updates_ai_ransomware_paper/
MIT Sloan quietly shelves AI ransomware study after researcher calls BS

: Even AI has doubts about the claim that '80% of ransomware attacks are AI-driven'

The Register
Show threadBrian ClarkNov 4
@GossiTheDog brutal takedown 😮
Show threadJzeroNov 4
@GossiTheDog
This is so good.
Show threadgaryNov 6
@GossiTheDog something to consider - how much secure private slop potential do you want and how much do you actually need. no small biz needs more than 3 5090 - there are going to be cheaper refurb parts - compute capabilities for smb sector are going to jump, they are going to get more done, faster, they will be able to attack another class of problems that were formerly enterprise biz probs will now be their biz probs
Show threadKimota94Nov 6
@GossiTheDog AI really is a “slop machine,” and is about as likely as a slot machine to actually pay off.
Show threadDibsNov 3
@GossiTheDog the heck
Show threadCat 🐈🥗 (D.Burch) ⁠Nov 3
@GossiTheDog One might think there's a slight conflict of interest there 
Show threadsauc3Nov 3

@catsalad @GossiTheDog

Fortunately, critical thinking is one of the first things that regular use of "AI" slop helps smooth away. Problem solved!

Show threadLulu PowerfulNov 3
@GossiTheDog Holy shit.
Show threadAdrian SanabriaNov 3

@GossiTheDog I wonder how Safe’s lawsuit with Security Scorecard is going.

https://www.bankinfosecurity.com/securityscorecard-accuses-safe-security-trade-secret-theft-a-25423

Show threadOlivierNov 3
@GossiTheDog follow the money.
Show threadTindraNov 3

@GossiTheDog just dropping this here, and wondering if there’s going to be any awkward moments there

https://safe.security/resources/events/safe-at-the-10th-annual-fair-institute-conference/

SAFE at the 10th Annual FAIR Institute Conference - Safe Security

Safe Security
Show threadJPNov 3
@GossiTheDog Aaaah, classic
Show threadGeeden_Of_ArdenNov 3
@GossiTheDog What are the odds that an LLM was used extensively in the production of the "research"?