ESET's Ryan Grant on resilience in the AI era

* Matt Alderman spoke with Ryan Grant, Country Manager for the US and Canada at ESET.
* Findings from ESET’s 2026 S&P Cyber Readiness Index were discussed.
* Organizations face continued challenges with basic cyber hygiene.
* Phishing attacks are growing more sophisticated.
* AI is impacting traditional cyber threats.
* Grant advised focusing on foundational security practices before layering AI defenses.
* Foundational practices include multi-factor authentication, access controls, endpoint detection and response, vulnerability and patch management, and incident response planning.
* Shadow AI and AI agents require clear policies, governance, access controls, employee training, and continuous monitoring.
* SMBs face challenges due to limited cybersecurity resources.
* Managed service providers and security-as-a-service can help SMBs.
* ESET’s Protect offering combines security technology, 24/7 monitoring, vulnerability management, MFA, premium support, and a cyber warranty.

The narrative frames the integration of AI into cybersecurity not as an endpoint challenge but as an acceleration of existing, foundational risks. The core tension lies between the perceived need for complex, novel defenses against sophisticated AI threats (shadow AI, agents) and the necessary prerequisite work on established security controls (hygiene, patching, access management). This suggests a systemic pattern where emergent technologies prompt reactive defense strategies instead of proactive architectural hardening. The emphasis on foundational practices—MFA, access control, EDR—suggests that layering advanced AI tools on weak infrastructure is an unsustainable strategy; resilience must be built from the ground up. The shift towards managed services and bundled offerings like Protect indicates a recognition that resource scarcity among SMBs necessitates outsourcing complexity to achieve baseline protection. The implication for agency is whether organizations can afford to decouple security investment from immediate threat reaction and establish long-term governance before addressing technological novelty.
* BRIDGE QUESTIONS: If foundational hygiene is the prerequisite, what specific metrics should organizations use to measure the successful integration of AI governance policies versus traditional risk reduction? How does the bundled service model inherently risk creating dependency rather than true sovereignty for smaller entities? What alternative governance structures exist that do not rely on vendor-provided monitoring for continuous validation?
* COUNTERSTRIKE SCAN: A potential influence pattern involves framing innovation (AI) as a threat demanding immediate, expensive solutions. This narrative aligns with the Authority Game, as vendors position their comprehensive packages as the only logical answer to complex emerging threats. The focus on ESET's specific solution suggests a playbook where uncertainty is leveraged to push for an integrated product sale rather than allowing strategic risk assessment to dictate purchasing decisions.