What does modern cyberwarfare look like for security leaders? Matan Eli Matalon explains Iran-linked attacks, disruption campaigns, propaganda, credential abuse, and AI-enabled attacker speed.

CISOs will learn a three-step framework for defining business failure, mapping attack paths, and protecting critical systems.

This episode had to pause mid-recording after Matan, a former CISO who reverse-engineered Iran’s Handala malware, received a missile warning and had to take shelter. We picked the conversation back up the next day.

Matan explains:

• Why groups like Handala choose quantity over sophistication and how that makes them harder to defend against
• How AI removes friction for attackers without changing the attacks themselves and why defenders can't keep up
• Why protecting everything equally is the fastest way to protect nothing
• The 3-step CISO framework: define failure, map every attack path to it, validate it's closed

Timestamps:

• (00:00) Intro - Cyberwar is already here

• (03:00) Disruption over dollars

• (06:45) The Handala playbook exposed

• (08:07) Inside Handala’s malware

• (10:29) AI didn’t make hackers smarter, it made them faster

• (12:20) Anthropic’s leaked “Mythos” model

• (13:48) Stop protecting everything, protect what can kill you

• (18:00) AI is breaking your security perimeter from within

• (22:20) The house analogy that changes how CISOs think

• (34:25) The CISO isn’t the department of no

• (46:45) Agentic AI is a black box and CISOs hate it

• (51:05) Slop squatting: the attack no one’s talking about

• (54:00) The Iranian hack that almost took everything down

• (1:00:00) When the goal is deletion, not data theft

• (1:03:18) The backup that wasn’t

• (1:06:30) The 3-step framework every CISO needs

• (1:08:25) Why this 28-year-old chose defense over offense

• (1:10:50) Cybersecurity in 3 years: Matan’s prediction

Connect with Matan Eli Matalon on LinkedIn

Powered by Control D