sharon sanders
Editor-in-Chief & President
Given the state of turmoil of online technology functions in the last couple of months our volunteer information technology expert & director Michael Kidd agreed to an interview.
Thank you Michael.
• Sure thing!
Q: Can you give us a brief summary of your IT experience?
• I’ve been in IT since 1994 and worn many hats – Systems Administrator / Engineer, Communications Engineer, Consultant, Support Engineer, Software Engineer to name a few. I’ve ran most operating systems from Windows 3.1 and RedHat Desktop Linux 5.0 through everything current today, and operated networks from simple home networks to multi-nation government experimentation networks.
• Currently, I’m a principal software engineer for IBM working on a distributed, open source storage solution used by thousands of companies around the globe.
Q: In layman’s terms, what is going on? And do you agree with Matthew Prince (CEO of Cloudflare)?
• Re: What’s going on - AI agents and models are getting much better at finding bugs in software, chaining those bugs together into a working exploit, and even deploying that exploit in the wild. The big advantage they have over skilled hackers ( and IT professionals ) is that they are tireless – nothing alters their resolve to achieve the task they’re set out to do, they never slow down, and they can explore massive systems – at incredible speeds, absorbing every detail for instant recall and put that information to use as they burrow deeper and deeper into IT infrastructure.
• Re: Matthew Prince’s quotes - For sure, I agree with him 100%. Microsoft, for example, has had three consecutive monthly patch Tuesday’s with record numbers of patches ( and increasing numbers each month!). The release for this month (Oct 2026) patched over 1400 issues, with a large portion being code execution and privilege escalation vulnerabilities. Before the days of AI security scanning, it was a massive month for them if they patched over 100 issues.
• AI is driving massive software improvements, and those improvements start by finding the bugs
.• It’s also important to understand that responsible disclosure means not sharing the bug details until fixes are available. So it’s definitely the case that industry insiders know about many bugs that exist which aren’t yet public, and not yet fixed. Keeping these details out of public knowledge protects the current users since any details released will do nothing but help bad actors weaponize those issues before fixes can be deployed.
Q: How long do you think this unstable situation will last? And do you agree with Jason Clinton (dCISO at Anthropic) in these posts below that he made on X?
• How long? It’s very hard to know. The rate of improvement of AI is unprecedented. But, not every product, project, or service will apply the advantages at the same rate (or at all). So I think at one end of the spectrum, there will be many products that take the leap and make big improvements very quickly, and at the other end, many projects will end up being shut down because of massive hacks / data breaches from not moving quickly enough.
• AI is honestly both the biggest help, and biggest threat to IT security of all kinds. IT professionals and "white-hat" hackers are using it to scan systems for vulnerabilities, suggest or even write the code fixes to patch them.
• One thing is for certain though – bad actors will absolutely use the new AI tools. So we will definitely see a massive uptick in reports of AI assisted hacks of companies, large and small.
• On the other side, bad actors, state sponsored hacking groups, etc.. are using AI agents to attack companies. As an example of the "improvement" in hacking that they gain.. a recent hack on a company that would have taken a team of skilled hackers 2 weeks to accomplish took a team with AI agents operating on the task.. 10 hours. The attackers even went so far as identifying the company's internal AI agents, enlisting their own agents against them. So the company ended up paying for AI tokens that were used to compromise their own internal systems.
• Re: Jason Clinton’s quote – He’s certainly on the right track. 18 months is probably as good a guess as any, but no one can predict the future. We’re certainly in for a wild ride moving forward.
Q: What actions can a regular person take to lessen their chance of getting caught in this apparent technology chaos?
• Pay attention to update notices, and update immediately! This includes your computer, tablet, phone, heck even your car!
• All the usual recommendations for security online and at home still apply, too:
◦ Use a password manager. I use and recommend Bitwarden, but most are good enough and (almost) any is better than nothing. Stay away from the built in password storage of your browser – it’s easily hijacked, and don’t use Lastpass.
◦ Use long, random passwords, unique to every site and service – preferably ones generated by the password manager.
◦ Use 2 factor authentication, preferably Time based One Time Password tokens. These are the ones where during setup, you scan a QR code with an app on your phone, and from then on, get a 6 digit key that changes every 30 seconds.
◦ Do not use Text (SMS) based 2 factor authentication if you have ANY alternative – the SMS system is not secure at all, let alone the risk of SIM hijacking
.◦ Don’t click links in email! Even if it’s from someone you know and trust. Compromised accounts and contact lists are commonly used for blasting malicious links to all friends and family – since most people trust links from someone they know, it’s so easy to get caught out and have a compromised computer.
◦ Don’t ever copy and paste a long string of junk from a web site into your computer’s Run dialog or command prompt. This is now one of the most popular forms of compromise. It commonly comes up as a way to prove you are human, or prove your identity – this is an instant compromise of your computer if you do it.
------------------------------
While talking to Michael this morning he also wanted to add a caution for the security questions that accounts ask to be answered as a backup verification. He said that many people have played games or taken quizzes online and that those records are not necessarily secure. i.e. the answers to your security questions may be findable somewhere.
Thank you Michael.
• Sure thing!
Q: Can you give us a brief summary of your IT experience?
• I’ve been in IT since 1994 and worn many hats – Systems Administrator / Engineer, Communications Engineer, Consultant, Support Engineer, Software Engineer to name a few. I’ve ran most operating systems from Windows 3.1 and RedHat Desktop Linux 5.0 through everything current today, and operated networks from simple home networks to multi-nation government experimentation networks.
• Currently, I’m a principal software engineer for IBM working on a distributed, open source storage solution used by thousands of companies around the globe.
Q: In layman’s terms, what is going on? And do you agree with Matthew Prince (CEO of Cloudflare)?
(Matthew Prince) “told Reuters he was aware of “a bunch of additional severe vulnerabilities that are present in other pieces of critical software” and predicted busy months ahead as AI surfaced long-hidden weaknesses in the fabric of the internet.“I think we’re going to have a couple years where every single week it’s going to feel like the sky is falling,” Prince said in an interview on Thursday.”
• Re: What’s going on - AI agents and models are getting much better at finding bugs in software, chaining those bugs together into a working exploit, and even deploying that exploit in the wild. The big advantage they have over skilled hackers ( and IT professionals ) is that they are tireless – nothing alters their resolve to achieve the task they’re set out to do, they never slow down, and they can explore massive systems – at incredible speeds, absorbing every detail for instant recall and put that information to use as they burrow deeper and deeper into IT infrastructure.
• Re: Matthew Prince’s quotes - For sure, I agree with him 100%. Microsoft, for example, has had three consecutive monthly patch Tuesday’s with record numbers of patches ( and increasing numbers each month!). The release for this month (Oct 2026) patched over 1400 issues, with a large portion being code execution and privilege escalation vulnerabilities. Before the days of AI security scanning, it was a massive month for them if they patched over 100 issues.
• AI is driving massive software improvements, and those improvements start by finding the bugs
.• It’s also important to understand that responsible disclosure means not sharing the bug details until fixes are available. So it’s definitely the case that industry insiders know about many bugs that exist which aren’t yet public, and not yet fixed. Keeping these details out of public knowledge protects the current users since any details released will do nothing but help bad actors weaponize those issues before fixes can be deployed.
Q: How long do you think this unstable situation will last? And do you agree with Jason Clinton (dCISO at Anthropic) in these posts below that he made on X?
“The vulnerability tsunami is coming in just a few months and there won’t be enough time to patch critical infrastructure. Network isolation described below(air-gaps and data diodes!) needed now!”
&
“as bad as things have gotten in the past 4 days, they are going to get a lot worse before they get better. Security leaders, never let a crisis go to waste: please go to your boards and ask for help right now. not for ai, for the basics. (we need to hold on for ~18months.)”
&
“as bad as things have gotten in the past 4 days, they are going to get a lot worse before they get better. Security leaders, never let a crisis go to waste: please go to your boards and ask for help right now. not for ai, for the basics. (we need to hold on for ~18months.)”
• How long? It’s very hard to know. The rate of improvement of AI is unprecedented. But, not every product, project, or service will apply the advantages at the same rate (or at all). So I think at one end of the spectrum, there will be many products that take the leap and make big improvements very quickly, and at the other end, many projects will end up being shut down because of massive hacks / data breaches from not moving quickly enough.
• AI is honestly both the biggest help, and biggest threat to IT security of all kinds. IT professionals and "white-hat" hackers are using it to scan systems for vulnerabilities, suggest or even write the code fixes to patch them.
• One thing is for certain though – bad actors will absolutely use the new AI tools. So we will definitely see a massive uptick in reports of AI assisted hacks of companies, large and small.
• On the other side, bad actors, state sponsored hacking groups, etc.. are using AI agents to attack companies. As an example of the "improvement" in hacking that they gain.. a recent hack on a company that would have taken a team of skilled hackers 2 weeks to accomplish took a team with AI agents operating on the task.. 10 hours. The attackers even went so far as identifying the company's internal AI agents, enlisting their own agents against them. So the company ended up paying for AI tokens that were used to compromise their own internal systems.
• Re: Jason Clinton’s quote – He’s certainly on the right track. 18 months is probably as good a guess as any, but no one can predict the future. We’re certainly in for a wild ride moving forward.
Q: What actions can a regular person take to lessen their chance of getting caught in this apparent technology chaos?
• Pay attention to update notices, and update immediately! This includes your computer, tablet, phone, heck even your car!
• All the usual recommendations for security online and at home still apply, too:
◦ Use a password manager. I use and recommend Bitwarden, but most are good enough and (almost) any is better than nothing. Stay away from the built in password storage of your browser – it’s easily hijacked, and don’t use Lastpass.
◦ Use long, random passwords, unique to every site and service – preferably ones generated by the password manager.
◦ Use 2 factor authentication, preferably Time based One Time Password tokens. These are the ones where during setup, you scan a QR code with an app on your phone, and from then on, get a 6 digit key that changes every 30 seconds.
◦ Do not use Text (SMS) based 2 factor authentication if you have ANY alternative – the SMS system is not secure at all, let alone the risk of SIM hijacking
.◦ Don’t click links in email! Even if it’s from someone you know and trust. Compromised accounts and contact lists are commonly used for blasting malicious links to all friends and family – since most people trust links from someone they know, it’s so easy to get caught out and have a compromised computer.
◦ Don’t ever copy and paste a long string of junk from a web site into your computer’s Run dialog or command prompt. This is now one of the most popular forms of compromise. It commonly comes up as a way to prove you are human, or prove your identity – this is an instant compromise of your computer if you do it.
------------------------------
While talking to Michael this morning he also wanted to add a caution for the security questions that accounts ask to be answered as a backup verification. He said that many people have played games or taken quizzes online and that those records are not necessarily secure. i.e. the answers to your security questions may be findable somewhere.