For Cybersecurity Awareness Month, we sat down with JSL Chief Information Security Officer Avery Moore to revisit some of the issues we discussed with him a year ago. No surprise, artificial intelligence dominated the conversation. But Avery’s perspective went beyond what AI can do. He talked about what happens when attackers and defenders both get faster, why organizations still struggle with basic security practices, the skills we risk losing through automation, and one major technology risk that AI may be pushing out of the spotlight. 

When we spoke in 2025, you said the speed of change in cybersecurity concerned you most. Looking back over the past year, what changed faster than you expected? 

The rapid, breakneck speed of AI development has, of course, been staggering. And I really shouldn’t be surprised by it, but I am. 

What makes AI different from previous technological advances is that we’re using the technology itself to help create the next generation of the technology. Think about aviation. The Wright brothers built an airplane, flew it, and then people figured out how to build a better wing, a better engine, better controls. But the airplane didn’t help them design the next airplane. 

With AI, we can essentially ask the technology to help us build a better version of itself. We’re using existing models in training, post-training, coding, testing, and research to improve what comes next. We haven’t really seen anything quite like that before. 

From a cybersecurity perspective, that acceleration affects nearly everything we do. 

What is noticeably different about the threat environment today versus a year ago? 

Speed, on both sides. The good guys and the bad guys have these tools and can move faster. 

AI gives defenders new ways to review code, analyze large amounts of information, identify vulnerabilities, and respond to threats. At the same time, these capabilities are available to threat actors. 

Attackers can identify weaknesses in applications, websites, and other technologies so much faster. They can use AI to make social engineering a lot more convincing. For years, we told people to look for misspellings, awkward grammar, and weird phrasing to spot phishing. That advice is not useless now, but it certainly isn’t enough anymore. AI can generate polished, convincing messages in multiple languages. 

There’s another piece that doesn’t get talked about as much. Attackers who steal large amounts of data still have to figure out exactly what they’ve got. AI can help them process, characterize, and evaluate that stolen information much faster. So AI can potentially accelerate several stages of an attack, from finding the vulnerability to extracting value from the data afterward. 

If both attackers and defenders have access to these capabilities, where should organizations focus first? 

You’re going to hear me say this a lot: fundamentals. 

We still see organizations struggle with security controls that aren’t new or exotic. Sometimes the fundamentals are hard. Sometimes they’re expensive. Calling something “fundamental” doesn’t mean it’s easy to implement. 

But organizations still need to know what systems and data they have, understand their critical processes, manage access the right way, address vulnerabilities, and make deliberate decisions about risk. 

It’s easy to get distracted by the newest technology because everybody wants the cool stuff. But before you start piling these sophisticated new capabilities on top of your environment, make sure the foundation underneath is sound. 

Technology comes and goes. Risk management doesn’t. 

You raised another concern during our conversation: that automation could cause organizations to lose important human skills. Why does that matter in cybersecurity? 

This is something I think we need to start paying much more attention to. 

Companies naturally want to automate. Automation makes new efficiencies, and AI gives us a chance to automate work that used to take a lot of time. We should take advantage of that. 

But there’s value in doing some things manually, because that’s how people learn and develop fundamental skills. 

For example, looking at a junior cybersecurity analyst who is going through the results of a vulnerability scan. There’s value in that analyst poring over the results and figuring out what they mean. There’s value in working through security evidence and understanding how a control is implemented, and how an assessor will interpret it. You develop knowledge by doing the work. 

I think about it this way: I spend a lot of time canoeing and camping, and I’m going on a trip to Boundary Waters in Minnesota. This is not like a weekend camping in a national park, it involves rough terrain, open water, and portage of all your gear.  

So as I’m preparing for that, I think about three fundamentals that I need: leverage, strength, and balance. You learn those things by carrying the load, making adjustments, and actually doing it. Building cybersecurity skills works the same way. 

We talk constantly about maintaining inventories of our assets and our data. Maybe we also need to think about an inventory of our critical human skills. Which skills are so fundamental to the organization that we can’t afford to offload them completely to AI? 

That question is going to matter well beyond cybersecurity. It applies to HR, finance, marketing, program support, and just about every other part of an organization. 

Does that mean organizations should limit their use of AI? 

No, but we should use it where it makes sense. We just need to understand what we’re giving up when we automate something. 

AI can be remarkably good at parsing large amounts of information and helping an analyst find things they might have missed. Think about reviewing a supplier’s security documentation. An analyst might have hundreds of pages of audit reports, certifications, and all sorts of other materials to review. There’s only so much time available, so the analyst learns what to look for and focuses on the most important areas. 

AI can examine far more of that material and surface something the analyst might never have found manually. That’s valuable. But then a human has to look at what the AI found, check it, understand the context, and decide what it means. 

That last part matters. The errors AI makes can be subtle and very confidently presented, so human judgment is still essential. 

Last year you described the heart of cybersecurity as “the grind,” the constant daily work required to maintain security. Has AI changed the grind? 

Absolutely. But there’s an interesting paradox.  

Let’s say that looking for threats is like turning over stones. You still have to turn over all those rocks, but with AI you can do it a lot faster, much faster than a human analyst could. 

That’s great. But guess what happens when you turn over more rocks? You find more problems under them. 

AI can reduce the amount of work required for certain tasks while simultaneously creating more work, because we’re discovering things we couldn’t see before. 

That isn’t necessarily good or bad. It just is. 

The real value comes when AI handles work that machines can do efficiently while people provide context, reasoning, and judgment. AI can help us gather and analyze information much faster, but ultimately a person still has to understand the organization and make a decision about risk. 

Given all of this speed and complexity, how can cybersecurity professionals help federal agencies navigate AI? 

I think one of the most useful things we can bring to the table is clarity. 

Agency CIOs and CISOs have a tremendous amount coming at them. They’re dealing with new technologies, people asking them questions, their regular systems, security requirements, mission priorities, and risk. Sometimes an outside perspective can help you zoom out and look at the whole problem. 

Frameworks like the NIST AI Risk Management Framework give organizations a structured way to think about what AI they have, how they’re using it, where they want to go and how they should govern the associated risks. 

The goal shouldn’t be to adopt AI just because everybody is talking about AI. The goal should be to understand the environment, establish the right governance, and develop a reasonable roadmap that manages risk while still allowing the mission to move forward. 

Sometimes what an organization needs most isn’t another technology, it’s a clearer way to think about the technology it already has and the decisions it needs to make next. 

With so much attention focused on AI, is there another cybersecurity risk you think organizations may be overlooking? 

Absolutely, and that’s post-quantum cryptography. 

Quantum computing hasn’t stopped advancing just because everybody started talking about AI. The concern is that sufficiently capable quantum computers could eventually threaten some of the public-key cryptography we rely on today. 

And there’s a timing problem. Sensitive information can have value for a long time. An adversary doesn’t necessarily need to decrypt everything today. They can collect the data now and then decrypt it later when the technology becomes available. That’s the “harvest now, decrypt later” problem. 

Organizations need to understand where they rely on cryptography that may eventually become vulnerable and plan their transition to quantum-resistant approaches. That transition isn’t something you want to start after the threat shows up. 

AI deserves the attention it’s getting, but cybersecurity leaders can’t spend all their time on that while another significant risk falls off the radar. 

After everything that has changed in the past year, what hasn’t changed? 

The fundamentals. 

Know what you have. Know what matters to the mission. Understand how technology supports it. Understand the risks. Put the right controls in place. Keep monitoring. Keep asking questions. 

AI can help us do all of those things faster. It can find things we couldn’t find before and help us make sense of enormous amounts of information. 

But somebody still has to understand what it all means. That part of cybersecurity hasn’t changed. in 2025