AI-enabled cyber operations have moved from theory to reality, with the GTG-1002 incident marking the first widely recognized case of an AI system independently executing a multi-step intrusion. In this 2-episode conversation, Nury Turkel explains how this shift is reshaping national security—from adversaries using AI to accelerate reconnaissance and credential misuse to the growing geopolitical stakes between the U.S. and China in advanced AI development. The episode highlights how governments and organizations must rethink readiness, regulation, and innovation as AI becomes both a transformative capability and a destabilizing force in global competition.

References:

• Wall Street Journal: The First Large-Scale Cyberattack by AI (paywall)
• Anthropic Report on GTG-1002: Disrupting the first reported AI-orchestrated cyber espionage campaign (download)

AI is rapidly transforming how organizations identify, classify, and protect sensitive information, yet many are only beginning to understand what this means for CMMC, CUI, and their broader security programs. In this episode, we explain why understanding your data has become one of the most urgent challenges in modern cybersecurity and how AI‑driven tools can quickly reveal hidden sensitive information. This new intelligence helps organizations accurately define the true boundaries of their enclave and reduce assumed scope by pinpointing who actually interacts with CUI.

We also cover how:

• Traditional tools like DLP, firewalls, and endpoint security often produce overwhelming, low‑value alerts.
• Adding richer, context‑aware data intelligence makes policies more precise and reduces alert fatigue.
• Enhanced intelligence strengthens enforcement as sensitive files move across the environment.
• It also improves operations by identifying stale or redundant data and reducing risks as organizations adopt AI.
• Strong AI guardrails are essential, including managing model permissions, inputs, outputs, and using MCP server‑based controls to block improper data flow.

Manufacturing sits at the heart of the Defense Industrial Base, yet many machine shops are only now grappling with what CMMC truly means for handling engineering data. In this episode, Paul Van Metre explains the practical challenges shops face, from managing drawings and CAD models that clearly qualify as CUI to updating decades-old processes never designed for cybersecurity.

We discuss why CUI is so widespread on the shop floor, how traditional "print-and-post" workflows increase exposure, and why moving to digital, paperless processes can significantly reduce both scope and cost. Paul highlights the mindset barriers many shops encounter, the operational pressures on small manufacturers, and the hesitation some have in accepting that CMMC applies to them at all.

We also explore:

• The shift toward cloud-based ERP systems and FedRAMP equivalency
• How modern ERP platforms eliminate local CUI storage, secure endpoints, and streamline compliance
• The high cost and risk of old on-prem ERP systems
• Strategies for lowering long-term CMMC costs
• Lessons from hundreds of ERP deployments, including when to migrate historical data versus starting fresh

Listen to get a clear, realistic look at what CMMC means for machine shops, the operational decisions that matter most, and how manufacturers can modernize without overburdening the business.