Jen Easterly led the US Cybersecurity and Infrastructure Security Agency (CISA) from 2021 to 2025 and now directs the RSA Conference. In May 2026 she joined Jake Sullivan and Jon Finer on The Long Game, a podcast from the Vox Media Podcast Network, and a transcript of the episode was published on the show’s Substack. Her central argument was that most breaches trace back to poor software. From there she moved on to liability, the power of large buyers, frontier AI models, resilience and the threat from nation states.
Software quality as the root cause
Easterly started by describing who attacks critical infrastructure. Nation-state actors seek to steal data or to plant capabilities that could disrupt operations, while criminal gangs, sheltered or sponsored by Russia and China, mostly deploy ransomware. She criticised the glamorous names given to these groups.
“We fundamentally have a software quality problem.”
Her case was that vendors have long been allowed to put speed, features, low cost and convenience ahead of security, so security ended up bolted on afterwards. That gap, she said, is what created the multibillion-dollar security industry.
At CISA she pursued Secure by Design. Hundreds of vendors signed a voluntary pledge to take concrete steps to reduce software risk, and the agency worked with universities on teaching secure coding and with lawmakers and regulators on software liability.
Liability and the power of buyers
Software, she explained, is a credence good: buyers cannot judge how secure it is, so vendors gain nothing by investing in security, and government has never corrected that market failure. Contracts often place the full risk on the buyer, which she called the largest transfer of risk since the internet began. She rejected the idea that vulnerabilities are inevitable, comparing it to treating them as acts of God. Her answer is a liability regime built on a standard of care, with safe harbours for vendors that follow secure practices, similar to the rules that govern cars and medical devices. Society, she said, tends to blame the victims of breaches instead of the vendors who shipped the flaws.
Large buyers have a part to play as well. Under what she called secure by demand, they should use their purchasing power to require security from suppliers. She cited an open letter from a J.P. Morgan CISO that criticised the modern way of delivering software and called for secure design over rushed features. Frontier AI labs, in her view, should accept responsibility for security instead of passing risk to customers, as software vendors have done for about 40 years. CISA had worked with the labs on secure design for AI through its Joint Cyber Defense Collaborative.
Frontier models: help and threat
Easterly sees real promise in AI. Frontier models can find flaws in code and help write more secure code, which could cut software risk. She described Anthropic’s Mythos Preview and OpenAI’s GPT-5.5 as a step change in finding vulnerabilities, and praised the labs for releasing them in constrained forms, which she considered unusually responsible for an industry used to rushing to market. She noted that the US Commerce Department’s CAISI and the UK AI Security Institute had tested the models.
Her timeline was short. She expects models of this kind to be widely available within nine months to a year, including open-weight versions, and adversaries to have comparable capability within about a year, with distillation as one route. For the next two to three years she foresees significant disruption, followed by a sharp fall in ransomware. Defenders have a head start for now, she said, though finding flaws is far easier than fixing them. She also urged governments and labs to fund the hardening of open-source libraries, which she described as the software commons, so that they are not left exposed to these tools.
Resilience and the nation-state threat
On Volt Typhoon, she said China’s People’s Liberation Army had pre-positioned itself in water, power, transport and communications systems so that it could disrupt them during a crisis over Taiwan. The attackers used basic flaws in routers, switches and firewalls, without needing exotic weapons. The intrusions found so far, in her view, are the tip of the iceberg, which is why resilience matters so much.
Ukraine offered a model. Shields Up and declassified intelligence helped infrastructure operators prepare, and she praised the inventiveness of Ukrainian defenders, a view shaped by a visit in February 2024 with Ambassador Nate Fick. Resilience, she explained, means designing systems that can switch to backup data centres or to manual control, and rehearsing those switches. She also warned that Iranian retaliation can arrive years later, recalling the attacks on US banks in 2012 and 2013, which led to her role at Morgan Stanley.
On ransomware, she expressed sympathy for hospitals and small businesses deciding whether to pay, while noting that every payment feeds the criminal economy. She hopes that within two to three years ransomware will have become a shocking anomaly.
What it means for leaders
- Procurement is a security tool. ConfX’s reading is that the first practical step is to review software contracts for clauses that push all the risk onto the buyer, and to ask for secure-by-design commitments at renewal.
- For security leaders, her one-year estimate sets a planning horizon: assume attackers will have frontier-grade vulnerability discovery by then.
- A switch to manual operation only counts if it has been rehearsed, and her examples suggest rehearsal is where most plans fall short.
- Boards hearing about rising numbers of discovered flaws would do better to track how quickly flaws get fixed, since finding them has become the easy part.
- Open-source components deserve funding and attention in proportion to how heavily the business depends on them.
