Claims

Particular serious concerns in US-China relations include Chinese intellectual property theft, prepositioning of cyber tools in telecommunications networks (particularly Volt Typhoon operations in Guam), and these issues must be addressed even while pursuing rapprochement.

A significant unresolved debate exists in the technological, policy, and strategy communities (particularly in Washington DC) about what constitutes 'cyber warfare' and how to define it, with different countries using cyber tools for fundamentally different purposes.

Cyber attacks on major organizations and critical infrastructure are occurring today with high frequency, and smaller-scale attacks are happening constantly; many organizations are unaware they have been compromised.

Cyber threats are permanent and will persist for the rest of America's existence; as each defensive mechanism is found, attackers find a workaround, creating an endless arms race.

When a user clicks a link in a phishing email, the browser is exploited first, gaining code execution in the browser process; modern browsers have sandboxing, but the attacker must achieve sandbox escape and then privilege escalation to reach kernel-level execution, at which point defenses on the host essentially fail

Matthew Holland has been the person that three-letter agencies in the western world call when they have problems they cannot solve

Holland and business partner released a tool called DenwiPatisev (vista poned in reverse) under a legitimately registered but fake company name to demonstrate that Microsoft's mandatory driver signing in Windows Vista would not stop malware, contrary to the industry's claims that it would be a 'silver bullet'

Offensive cybersecurity only exists because humans are generally horrible at writing software; if software security practices were strong, offensive capabilities would be drastically limited

Attackers typically begin by profiling targets through online services, email addresses, and social media presence, then launch social engineering campaigns via email or phone with links/attachments designed to get users to click and trigger exploitation

For high-value targets like Boeing or General Electric seeking to steal IP, attackers use zero-day exploits and custom development to gain access to systems, versus commodity attacks used against small businesses

Once an attacker achieves kernel-level code execution on a Windows system, there are essentially no defenses available—they can open back channels to command and control servers or exfiltrate data without detection by standard monitoring solutions

The company Vupin (zero-day marketplace) recently announced they were 'full up' on iOS privilege escalation exploits, meaning they have more iOS privilege escalation zero-days than they can use, which demonstrates that Apple's security model is less secure than commonly believed

Zero-click tools like NSO's WhatsApp exploit were previously only in the hands of governments, but the accessibility and creativity of attack vectors are changing, allowing non-governmental actors to create significant impacts with exploits

NSO Group claims to have an internal ethics review group to decide which governments they sell to and don't sell to, but Holland doubts the effectiveness because the very existence of such a group indicates ethics weren't part of the founding

Ransomware is the easiest malware to detect and stop, and Holland finds it remarkable that a ransomware industry exists at all given how simple it is to defend against, suggesting the cybersecurity industry has fundamentally failed at its job

Companies often pay ransoms instead of investing in preventive cybersecurity because the immediate financial impact of paying feels more tractable than the upfront cost of hardening systems and hiring security expertise

Cryptocurrency (especially Bitcoin) facilitates ransomware payments because it provides anonymous, traceable-resistant payment channels, making ransom collection feasible and enabling the ransomware economy

Gartner Magic Quadrant is an imperfect guidance tool because it looks backward at what existed and succeeded, not forward at emerging categories, so vendors are often ahead of Gartner's categorization

Most businesses don't know what cybersecurity solutions they actually need, which is why Field Effect focuses on small-to-medium businesses where they can educate customers about their actual problems rather than selling them pre-packaged solutions

When there are problems with cybersecurity, the system should provide guided, specific actions rather than links to external resources or requiring users to google and understand security concepts independently

China and Russia are remarkably aggressive in their cyber operations despite intellectual property concerns, and the 'spray and pray' approach allows them to use the same exploits across many targets without concern about losing capabilities

When an intelligence agency discovers a zero-day vulnerability, they face a strategic choice: either use it operationally (and risk it eventually being discovered and lost) or disclose it (and lose the capability immediately but prevent adversaries from using it)

Huawei gained competitive advantage and became a major global telecom vendor remarkably quickly, suspiciously coinciding with Cisco source code leaks in 2003-2004, suggesting they obtained IP through theft rather than independent development

Holland fundamentally disagrees with Edward Snowden's approach and actions, believing Snowden's disclosure of the entire intelligence archive (not just illegal programs) was an unnecessary betrayal of legitimate operations

Many things Snowden exposed were later determined to be illegal, but intelligence agency decisions go through extensive legal review by teams of lawyers who carefully evaluate legality before operations are approved

Disclosing operational techniques and exploitation methods in the Snowden documents caused real harm by revealing to adversaries how allied intelligence agencies conduct operations, potentially costing lives

Every company should have cybersecurity protection; no company is too small to be off attackers' radar, and Holland has seen two and five-person companies successfully attacked and compromised

Companies should not hesitate to seek cybersecurity help from vendors like Field Effect, just as they wouldn't hesitate to see a doctor about health problems, despite the natural human aversion to bad news

Modern smartphones (iOS and Android) are personal computers that are now primary targets for attack, and phone exploitation works the same as Windows/Mac exploitation—through browser exploits, sandbox escapes, and privilege escalation

Only holistic cybersecurity solutions that cover endpoint and network layers can defend against sophisticated attacks, because attackers can bypass any single-pillar solution, and if one layer fails, another should detect the compromise

A common alternative attack on email accounts is brute-forcing weak passwords (enabled by lack of multi-factor authentication), accessing the inbox to identify customers and financial patterns, and then sending fraudulent payment instruction emails to all customers claiming payment should go to attacker-controlled accounts

The cybersecurity industry is fundamentally unethical and resembles a 'used car salesman' strategy where vendors focus on transactional sales rather than actual customer protection and results

Apple's approach of increasingly restricting what operators can do on iOS provides an illusion of security, but once an attacker discovers even a single way around the mitigations, they can compromise any iOS device in the world because all devices run identical code

The UK's 'accredited lab' approach to Huawei—where they would review code to allow limited deployment—would fail in practice because once code is released, zero-days would be deployed immediately before the review process could complete

The cybersecurity industry has three distinct pillars: offensive operations (ransomware, state intelligence), defensive operations (antivirus, firewalls, monitoring), and a third category that isn't actually cybersecurity (election interference, social media influence campaigns) that gets mislabeled as security

Zero-day exploits will always exist because creative attackers are always discovering new ways to bypass mitigations, and no amount of operating system hardening can eliminate this problem entirely

NSO Group (Israeli company) sold WhatsApp zero-click exploits that allowed them to compromise phones without any user action—the attacker simply sends malicious content via WhatsApp and the phone is exploited, representing the most dangerous form of compromise

Ransomware attacks typically encrypt files on a workstation, potentially delete backups across network shares, copy sensitive data for extortion threats, and then demand payment to decrypt—the attack vector requires endpoint-level capabilities that network monitoring alone cannot detect

Trust in cybersecurity vendor relationships is built over time through demonstrating genuine commitment to fixing customer problems, not through rapid sales or flashy interfaces that customers don't understand

Attackers constantly balance risk of losing capabilities against the effort to develop new ones, and this cost-benefit calculation drives how aggressive and operational they are willing to be

Trust in critical infrastructure vendors like Huawei cannot be rebuilt once broken because an infrastructure vendor with government ties could compromise an entire nation's telecommunications network

The size of the intelligence agency bureaucracy for legal review is 'absolutely crazy'—no developers can just implement ideas; there is extensive bureaucratic oversight

Intelligence agency employees sacrifice greatly—long hours, broken families, broken relationships—and deserve recognition, not public vilification when programs they worked hard on are exposed

The Bangladeshi Bank SWIFT heist nearly succeeded in stealing $1 billion; it only failed due to two human errors: a typo in the recipient address and the recipient bank's name (Jupiter) being flagged for Iranian money laundering associations—without these accidents, a developing nation would have had $1 billion extracted overnight, a scale impossible with physical robbery.

Cybersecurity is one of the most important but ugliest/boring topics, and it lacks proper memes; the 2015-2016 Bangladeshi Bank SWIFT heist attempt showed that hackers nearly stole $1 billion from a developing country in one operation—far exceeding the largest physical bank robbery ($60 million)—and within 5-10 years there will be a 'COVID moment' for cyber where things become very dark very fast.