CyberWire Daily - CyberWire Daily at 10: Examining a decade of public-private partnerships. [Special Edition]

Episode Date: October 12, 2026

Please enjoy this Special Edition podcast while our team is out observing Indigenous Peoples' Day in the United States. In this episode, Dave Bittner joins Maria Varmazis to explore the evolution of public-private partnerships in cybersecurity over the past decade. Together, they discuss key incidents, trust-building, and the future challenges posed by AI and geopolitical shifts. Join Maria and Dave as they discuss: The definition and importance of public-private partnerships in cybersecurity. Evolution of collaboration from episodic to institutionalized. Impact of major incidents like Colonial Pipeline on policy and trust. The role of information sharing and trust-building mechanisms. The influence of AI and automation on future cybersecurity strategies. Learn more about your ad choices. Visit megaphone.fm/adchoices

You're listening to the Cyberwire Network, powered by N2K. Hello and welcome to this special edition. I'm Maria Varmazes, and today I am speaking with host of the CyberWire Daily, Dave Bittner. We're continuing our 10th anniversary of the Cyberwire Daily series of conversations. In today's show, we're going to be discussing the legacy of the past 10 years of public-private partnerships and law enforcement operations in cybersecurity. Here's our conversation. Hi, everybody. We are celebrating the 10-year anniversary of the CyberWire Daily.

We are continuing our celebrations throughout the year with a series of interviews that I'm doing with the one-and-only, Dave Bittner, host of the CyberWire Daily. Hi, Dave. Hello. Hello. And we've been taking a look over this course of interviews at what's been going on the last 10 years

of your coverage in the world of cybersecurity, and we've been focusing on certain topic areas. And the one that we're going to be using as our focus today is public-private partnerships. And this one, I had to take a moment and go, what do we mean by that? And I feel like we should start there and actually just define that a little bit. I suppose it maybe is a little bit intuitive for a lot of our listeners. But in your own words, what do you think of with public-private partnerships in cybersecurity? What does that really entail?

Well, I think we find ourselves in the cybersecurity world. as a, can we call it an accident of history or perhaps somebody intended it to be this way? I don't know. But we've got a whole lot of effort and resources and capabilities that are in the private sector. And then we've got a whole lot of effort, capabilities, and resources that are in the public sector, i.e., the government. And it is through the course of natural things, it is necessary, if not an inevitable for those two silos to interact and hopefully support each other to help make our great nation and indeed the world a safer place to be.

Well done. That's a great way of defining it. Did I get a gold star? I think so. Bing. Okay. Yay me. Yeah. It's one of those phrases that I go, I have in my mind what that might mean, but I didn't want anyone getting lost in the sauce on what they think we might be talking about. So I'm glad that you defined that so beautifully there, Dave. So thinking back to when the show started 10 years ago,

and the state of things back then in terms of these collabs, if we want to use that kind of terminology, and certainly things have evolved over the last decade in terms of how those two silos have worked together. And again, the siloed for no fault of anyone, just the way things have really happened. what was it like 10 years ago compared to where we find ourselves today? Well, I think back then, and we're talking in 2016 or so, there was collaboration,

but I think it was more episodic, maybe relationship-driven. Something bad would happen, and everybody would get on the phone and the people who knew each other would figure out how to work together. There were information sharing organizations, and of course there were established relationships. but I think there was still a fair amount of uncertainty on the private sector side about what you actually got by bringing the government into the room. Yeah, like was it even worth doing? I mean, one must sometimes, but is it something we always want to do?

Right. Was it worth doing? And what could you possibly be setting yourself up for? Because I think there's a natural inclination of any business organization to say, do we really want to invite the government in here and where they might start looking around? You know, you just don't know. Or slowing things down if we want to put it more politely. Slowing things down, whatever.

Yeah. They're just different breeds of organism. But I think today it feels a lot more institutionalized. We've got standing relationships. We've got established channels. And I think there's a greater recognition that neither side can really do this alone. You know, the government has authorities and they have intelligence that the industry doesn't necessarily have.

and industry owns and operates much of the infrastructure and has visibility that the government doesn't have. So that basic interdependence was always there, but I think we've just gotten a lot better at acknowledging it. Yeah, yeah. And formalization of those pathways, as you said, makes a lot of sense and out of necessity, but also just expedience, I would say,

as opposed to, I used to work at a three-letter agency and now I'm in the private sector, So I know all the three-letter agency guys back in that place. And I can reach them real easy. And the only way that you can do that is if you hire me. Right, right. Job security. Great.

And that's a real thing, you know. I mean, that is a tried and true pathway for folks who... Yeah. No, and it exists to this day. And it has its ups and downs and pluses and minuses. But to deny it would be a foolish thing to do. Indeed. So in terms of that formalization of pathways and maybe just the evolution in general that you were describing, were there specific events that precipitated this?

Is it just how things were going? Or did we see big jumps in that change? Yeah, I'm not sure there was like one big event. You know, as long as we've been doing this, people have been talking about Cyber Pearl Harbor or Cyber 9-11, right? And, you know, I mean, those are useful. metaphors and good cautionary tales. But looking back, to me, it's more the accumulation of incidents that demonstrated how fuzzy the line between public and private risk can be. And you can point to things like solar winds, colonial pipeline, the rise of ransomware, and then certainly attacks against health care and critical infrastructure. Over and over and over

again, we've been seeing something that begins as a cybersecurity problem inside a private organization, and that can turn into a national security problem, it can have to do with economic security or even public safety. I think ransomware was particularly important because it made cyber risks tangible. When a hospital can't see patients or people are worried about getting gasoline, cybersecurity stops being something that happens in the server room, right? Yeah, yeah, yeah, yeah. And that creates pressure on government and industry to figure out how. to work together before the next crisis happens. I'm sure over the last decade, you've seen that actively evolve.

I mean, I'm thinking of the more ad hoc organizations' email lists that you had to know somebody to get added to the ISACs, but also the joint cyber defense collaborative, things like that that have cropped up. Have those moved the needle to use that corporate cliche a lot? Is there a lot of work still to be done there? Have you seen a huge change from those kinds of collaboratives? I think the needles definitely moved in the right direction. And I think there's been a general acknowledgement

that relationships are difficult to build during a crisis. You don't want the first time you're exchanging phone numbers to be while someone is actively inside your network. No, not usually anyway, yeah. So, you know, the move towards standing partnerships gives folks a chance to establish trust, to have a better understanding of what each organization can actually contribute, and then work through some of that bureaucratic friction

before there's an emergency. That doesn't mean you solve the problem. A partnership on an organizational chart isn't necessarily a partnership in practice, right? People change jobs, priorities change, administrations change. So those relationships have to be maintained. but having that machinery in place ahead of time is a meaningful improvement over reinventing the wheel to mix metaphors every time something catches fire.

I mean, it makes so much sense, especially when you think about, to use the word against silos, of what we might have thought is public sector versus private sector entities or organizations or infrastructure. There's a lot of mixing that's always been happening. you know, how much, you know, private sector software is running on the public infrastructure,

that sort of thing. So when, I don't know, a colonial pipeline happened, you know, who do you call? You call a big mix of everybody. And I would imagine that that was probably a big teaching moment for a lot of orgs, not that this was something that necessarily they had no idea might happen. But, you know, you do need to have those numbers handy. You do have to train for this. You have to practice for stuff like that. And I'm wondering if, through all, all the interviews that you've been doing all these years. And if you heard that sort of become a crystallizing moment, the Colonial Pipeline, for example.

I think it was. I think Colonial Pipeline was an important demonstration of how quickly a private sector cyber incident can become a government problem. Mm-hmm. Yeah. A ransomware attack against one company became a national story about fuel supplies,

about transportation, and about critical infrastructure. And so for the executives who watch that unfold, I think one of the lessons was that there are incidents where calling the government isn't simply a compliance decision or something that your lawyers debate. Yeah. Right? The government, they may have intelligence about the attacker. They could have visibility into other victims. They could have relationships with foreign partners or even resources that could help with their response.

There's still understandable hesitation. You know, companies worry rightfully so about regulatory exposure, litigation, reputation, and just losing control of the process. Yeah, yes. That is something I would wonder about that hesitation of going, you know, we let the government in right now. And it also changes the optics considerably. It makes you, if I was a corporation, I might go, you bring them in. It might engender confidence in some people, but other people might go, this means you've lost control of the situation. And I wonder what, how that changes. the conversation. Yeah, and I think colonial pipeline also help demonstrate that when an incident reaches a certain scale, government involvement may be inevitable. Whether you want it to or not. Right. When it affects enough people, there's no denying. It's going to happen. So you should be ready for that. And you should have those relationships before you need them. Yeah, that's a very interesting way to think about it.

And I'm wondering when the next, when there is a next, because there will be in next, I don't want to say cyber pro, I really hate that place. We haven't had one yet. We haven't had that yet. I know, but when there's an incident that becomes that, when there's a next colonial pipeline,

when there's a next thing, when there's a next thing, I'm wondering, are people going to be putting faith in this kind of collab, like, hey, I got the government on the line, in a way that maybe they shouldn't. Are we thinking that maybe the government can come in and fix a problem that they can't? That actually is really much more in the private sphere. Is our understanding of how this all might work overly ambitious, maybe?

I mean, it's an interesting question. I think, for example, I think sometimes people overestimate what information sharing accomplishes by itself. We've been talking about information sharing for as long as I've been, covering cybersecurity and probably longer than that. And sharing is useful, but only if the information is timely, actionable, and actually gets to someone who can do something with it. Yes. And then you've got issues of trust. You know, companies want to know what happens, what happens to the information they provide the government. And the government agencies have

legitimate restrictions on what information they can share, particularly intelligence they can share. And of course, everybody has lawyers, right? So there's a big difference between the capabilities of a major technology company and, let's say, a rural hospital or a small manufacturer or even a local government. So public-private collaboration, I think, tends to work best amongst organizations that already have resources and sophisticated security teams, and reaching everybody else remains a much harder problem. I think also there's this notion of who's obligated to help. That's an interesting question.

In other words, your house catches on fire. Somebody calls the fire department, they're coming, right? Yeah. They're not going to say, yeah, you know, that's... That's not our jurisdiction. I mean, we can, we have the tools to fix that for sure, but, you know, yeah, maybe you should call the feds for that. Right? I mean, it just doesn't work that way.

But in this world where so much of the cyber capability is in the hands of private companies, they get to choose who they help. Right. And so is, I know, I'm sure there are cases where that's exactly as a. it should be. There are probably cases where the government is banging their head against the desk saying, why aren't you doing more here, but they can't require them to? Yeah, I'm just a total tangent, but I'm just imagining if we had like an emergency, a national emergency line for cyber incidents, as opposed to what you have now where a lot of private companies have an incident response hotline, you know, 24-7, even if you're not

our customer, call us and we'll help you kind of situation. Well, and to be clear, I mean, those types of efforts do exist. There are collaborative efforts between the government and private industry to be prepared for exactly this kind of thing. When something big happens that all the players can come together, the experts in every field can try to do this. And they do well. I think when we look back at things like Colonial Pipeline, we can see what worked and what didn't. And we can make it so the next time, hopefully, we do. even better. But again, I think everyone does acknowledge and it's important to realize that

government and private sector run under different requirements. They're out to please different people. They have different laws that apply to them. They have different responsibilities and obligations to the general public or towards their shareholders. And so all of that comes into play when trying to figure out who's going to do what and how much can they do, what are they allowed to do. That's an interesting thing to think about. As we look through the crystal ball of 10 years from now when you're hosting the 20-year anniversary shows of the CyberWire Daily.

Oh, Maria, you remember back when. Okay, Dave, time for you to go back to bed. fancy computer boxes. Give me some more applesauce. I mean, things have changed a lot in 10 years. In so many ways in cybersecurity, and that's, if there's one thing our listeners will remember from these chats,

it's that, I think news at 11. But, you know, the nature of government, U.S. government involvement in cybersecurity incidents has enormously changed in a decade. Maybe not, maybe too much. maybe not enough, whichever. That's not my judgment call. Ten years from now, though, I mean, especially with AI, oh my God, I had to say it. But really, ding ding, ding, ding, sorry, I did it. We didn't get through it. But seriously, though, I mean, is there any way for us to even

possibly imagine what this all could look like 10 years from now? Do we imagine the federal government with more heavy hands-on involvement with much less involvement, just letting the person, private sector, just be their deputy for everything. I mean, to say nothing of, you know, military response to certain things, given geopolitics and such, I mean, that's a whole other show. Yes, it is. We're going to keep it as such. Yeah, let's please.

I think that AI is going to force us to rethink some of these relationships. I think if AI agents are increasingly finding vulnerabilities, defending networks, responding to incidents, and perhaps even conducting offensive operations, obviously the speed of cybersecurity is going to change, right? It already has. A lot of our current processes assume that humans have time to receive a warning, evaluate it, have a meeting, make a decision, and take action. And that increasingly, I think, is going to be a luxury. So I think, the next big question is going to be how do government and industry coordinate when these machines are operating at wait for it machine speed what decisions can be automated who establishes the rules of

the road what happens when an automated defense gets something wrong and how do you preserve accountability when this tempo is so much faster than the institutions overseeing it yeah right yep terrifying questions honestly yeah how do you build in human accountability when humans are out of the loop at that point that is a huge question that goes beyond just cybersecurity at this point but certainly the impacts we're feeling it in our field so much and in light of what our adversaries are doing

and in light of what our place in the world may be 10 years from now depending on who our allies are who's in our corner and who isn't and the different I mean we're I think it's fair to say that we are in a state of active global realignment when it comes to relationships nation to nation. And so however that plays out over the next decade is going to inform how we're able to respond to all of these things. Because what if we establish a certain set of rules and standards, but our adversaries don't, or they have different standards. You know, it's all interconnected.

Yeah, yeah. And 10 years from now, now our AI agents or avatars are interviewing each other. That's right. I'll be very curious to hear what they have to say. Yeah, now we're depressed. So, all right, I'm looking at our time and I'm going, all right, I've picked your brain for a little bit,

but I definitely want to pick your brain at least one more question. Ten years of not just covering this industry, but also you've interviewed thousands of people, lots of folks working in not just the U.S. government, various different governments, and lots of folks in the global private sector. What do people get wrong about each other's field? What do private sector folks assume about governments that they get wrong, and what do government folks assume about the private sector that they get wrong?

I think each side tends to underestimate the constraints the other one operates under. I think industry looks at the government, and says, why does everything take so long? And government looks at industry and says, why won't you just give us the information we need? And from inside each of those organizations, those seem like perfectly reasonable questions. But as we sort of alluded to earlier,

companies have customers, shareholders, regulators, lawyers, and they have competitive pressures. And the government, of course, has laws. They have classification rules, oversight, procurement requirements, and political accountability. So over 10 years, I'd say one of the recurring lessons for me is that cybersecurity itself is usually easier than the organizational problem surrounding it. The technology is complicated, for sure, granted.

But getting people with different incentives, different authorities, and different definitions of risk to trust. each other and move in the same direction, I think that continues to be an ongoing challenge. I wonder also, both groups are often moving towards their ideal of what the public good is, but it may be very different depending on the circumstance or their point of view, how they are defining public good. You sort of start there and it becomes a sort of the incompatibility is magnified. as you go, I would imagine.

Yeah. Sometimes tough decisions require sacrifice. And who decides what those sacrifices are going to be? Business leaders make those types of decisions

every day. People in government make those decisions every day. But, you know, sacrificing a business department in your company

because sales are down is different than sacrificing a group of soldiers for a strategic reason, right? And so, yeah, each side has different degrees of seriousness that they have to deal with. And I guess maybe if we're talking about good news, I think over the past decade, my sense is that as folks have been through things together, that there is more trust than there used to be. And I think there's a better understanding of what the different

parts are for the different folks to play. And the expectations are more realistic. So I think that puts everybody in a better place to collaborate when the time comes. Sure, there's plenty more work to be done, but I think we're in a better place than we were, certainly 10 years ago. That's my perspective. It's an encouraging perspective. And I, I have. have to wonder, Dave, do you think it's because the field has just matured? This is just, we've grown up a little bit from our, from where we started. Absolutely. I think there's no question we've seen more, I usually refer to it as professionalization of cybersecurity, right? It's, it's, it's not so much that one person who is a tech wizard who

comes in and lays their hands on the keyboards and mutters, I'm in, you know, like, we've got, systems for people coming up through the ranks and standards. And all of that, I think, leads to a more healthy, reasonable, rational ecosystem in a world full of threat actors and people who are out to do us harm, but our nation harm and ultimately the world harm. Beautifully, as said, as always, Dave, any last thoughts on this topic before we conclude? You know, I think one thing that doesn't get discussed very often that I wonder about from time to time is just what part is it best for the federal government to play in defending our nation against cyber attacks. And I come at that question from this point of view.

I think most of us think about the physical defense of our nation, right? we have friendly neighbors on either side for us in the U.S., we have oceans on either side, and it is up to our military to protect those borders from anyone out there trying to do bad things to us. And that's up to and including the use of force. But cyber, the way it's developed so far is a little different because, as we've been talking about, the private sector has so much of the capabilities. And so I can't help wondering over time how much of that is going to shift. How much will the government try to claim more responsibility?

Will they try to claim more capabilities? In other words, there's a well-known cyber defender who I've enjoyed talking with many times. I'm not going to name him here, but he's said famously, there are some threat actors out there who deserve a missile through the front door, right? We haven't really seen that yet. We haven't seen direct physical kinetic responses to cyber incidents. I'm sure there are folks in our audience who can point to a handful of them that have happened. But it's certainly not the norm, right?

You attack a hospital, you don't get a missile through the front door. what if that becomes a norm? What if a government, if a government, a future government, ours or someone else's, decides, we've had enough of this, right? We're bringing kinetic activity into play. I don't know how that would play out. I don't know if it'll ever happen. I tend to hope we can solve these things without unnecessary violence.

But you never know. We always talk about if somebody turns off. off the lights, what happens. Yeah, yeah. Right? Oh, that's a terrifying thought. I should have ended on collaboration, right? It should have ended on things getting better.

You had to ask me if there was anything else I was thinking about. I should have just lied and said, no, we're good. Well, you know, it is, it was an honest answer to an honest question, so I shouldn't ask a question if I don't want the answer. No, but genuinely, I mean, as you were talking through, through that, my thinking was, well, we perhaps we haven't seen things like that because, you know, our data is distributed everywhere. People tend to be distributed everywhere. So, you know, the physical limitations of doing things like that. However, as we've talked about

on hacking humans, there are cases of governments coming down and going, you know what, maybe if we just take out the ringleader stuff. So you know what? I think you have a very interesting point there and it's something certainly that it's an escalation certainly if that ends up happening but i i don't think it's outside the realm of pure possibility at this point um no there's no question there are folks out there who are gaming out all of those possibilities yep and uh you know what what could come of them so i'm glad i'm not one of them everybody keep your nose clean okay that's right that's right Dave uh you always give me a lot to think about thank you as always for your perspective and your expertise and 10 wonderful years of

the CyberWire Daily. Congratulations as always. And until next time. No, it's really exciting to me to have these conversations with you. You bring up a great provocative questions and I look forward to having you along for the next 10 years. Thanks, Dave. Appreciate it. And thank you for listening. We'll see you next time.