After three Washington national-security and technology conferences, one message has become increasingly clear: we may not be able to stop every cyber intrusion. The new measure of security is how quickly we can detect, contain and recover from one.
WASHINGTON, D.C. — Over the past month, as a member of the press, I have attended three conferences focused on intelligence, cybersecurity and artificial intelligence: the AFCEA/INSA Intelligence & National Security Summit, the Billington CyberSecurity Summit and the Government & AI Summit.
Different speakers. Different agencies. Different technologies.
But I kept hearing variations of the same uncomfortable idea.
We cannot build a wall high enough to guarantee that hackers will never get in.
The threat environment is moving too quickly. Networks are too interconnected. Government depends on too many outside vendors, legacy systems, cloud environments and individual users. Vulnerabilities can be discovered and exploited before organizations even know they exist.
So the strategic mindset is changing.
We are moving from deterrence toward resilience.
That does not mean abandoning prevention or deterrence. It means acknowledging that prevention alone cannot be the measure of cybersecurity success. Increasingly, the question is what happens after someone gets through the door.
How quickly do we see it?
How quickly do we understand it?
How quickly do we decide what matters?
And how quickly can we act?
This week, that theoretical discussion suddenly became very real.
ShinyHunters Says It Breached the FBI
The cybercriminal group known as ShinyHunters claims it compromised systems associated with the FBI and stole between two and three terabytes of information involving FBI personnel and applicants.
The FBI has confirmed that it is investigating a compromise involving FBIJobs.gov and the possible exposure of employee personally identifiable information. Importantly, the Bureau says it has not yet determined whether the point of entry was within the FBI's own enterprise or through a third-party provider supporting the jobs portal.
ShinyHunters has claimed considerably more.
The group says it exploited an Oracle PeopleSoft vulnerability, moved into other systems and obtained enormous quantities of information. Those claims have not all been independently verified.
But the story changed significantly on Wednesday.
Reuters examined a roughly 5,000-line sample of the purported stolen data and found information identifying FBI personnel and, in some cases, their assignments. The records included highly sensitive personal information and references to personnel working on matters involving Chinese espionage, Russian intelligence, organized crime and drug cartels. Reuters was able to corroborate portions of the information, although that does not authenticate the entirety of ShinyHunters' claimed trove.
We still do not know exactly how much was stolen, precisely where the intrusion originated, or whether every ShinyHunters claim is true.
But this is no longer merely a hacker boasting on the internet.
There is now credible evidence that sensitive information was compromised.
The Lesson I Kept Hearing in Washington
At the AFCEA/INSA Intelligence & National Security Summit in August, the emphasis was repeatedly on speed: intelligence has to become actionable quickly enough to matter.
DIA special adviser Greg Ryckman spoke about adversaries operating across multiple domains at increasing speed and about using AI and automation to help analysts identify information and anomalies faster—while preserving human judgment and accountability. Other sessions explicitly addressed operational readiness and resilience.
Then came the Billington CyberSecurity Summit.
The theme itself was telling: “Reducing Risk in an Age of AI-Enabled Threats.” The conference brought together government cyber officials, intelligence leaders and industry at a moment when both attackers and defenders are gaining increasingly powerful automated tools. Coverage from the summit included the FBI's new cyber strategy, AI-enabled threats, critical infrastructure vulnerabilities and repeated emphasis on getting cybersecurity fundamentals right.
And then, at the Government & AI Summit, the conversation broadened from cybersecurity to the problem of putting AI into actual government operations.
The emphasis there was not simply experimentation. It was deployment: moving AI into mission-critical environments, building the infrastructure around it and addressing the cybersecurity, governance and trust problems that accompany it.
Taken together, I came away with a different mental model for cybersecurity.
For years, cybersecurity was often discussed like a fortress.
Build stronger walls. Add another layer of authentication. Patch the vulnerability. Stop the adversary.
All of that remains necessary.
But the fortress metaphor is increasingly inadequate.
Modern digital infrastructure is more like a living organism. It is enormous, interconnected and constantly changing. There may always be another vulnerability, compromised credential, third-party provider or zero-day exploit.
The objective therefore cannot simply be:
Never get hacked.
It also has to be:
Know when you have been hacked—and respond faster than the intrusion can become a catastrophe.
DATA → TRUST → DECISION → AUTONOMY → ACTION
At Billington, I started writing the problem down as a chain:
DATA → TRUST → DECISION → AUTONOMY → ACTION
That framework becomes particularly useful when looking at the FBI breach.
The first problem is data: What information was accessed? Where did it come from? What else might have been exposed?
Then comes trust: Can the FBI determine which systems and records remain trustworthy? Can employees trust that their personal information is secure? Can partner agencies trust the affected infrastructure?
Only then can leadership make good decisions about containment, notification and remediation.
Those decisions determine how much autonomy the organization retains—whether it continues operating effectively or is forced into a defensive crouch.
And ultimately there must be action.
The speed at which an organization moves through that chain may increasingly determine the severity of a cyberattack.
The Zero-Day Problem
This becomes even more important if ShinyHunters' account of the intrusion proves accurate.
The group claims it exploited a previously unknown Oracle PeopleSoft vulnerability. That specific claim remains unverified. But the larger zero-day problem is very real: the interval between discovering a vulnerability and exploiting it is shrinking.
That means the traditional model—discover vulnerability, develop patch, distribute patch, install patch—can be too slow.
An attacker may already be inside, and they may have been in there for years.
The Government Executive discussion around zero-days describes exactly this challenge: the window between vulnerability discovery and exploitation is narrowing, requiring continuous monitoring, validation and response rather than reliance on periodic patching and compliance alone.
That is resilience.
Not an impenetrable system.
A system capable of taking a hit without losing the mission.
The FBI Now Has to Practice What It Preaches
There is an uncomfortable irony here.
On September 9, the FBI unveiled a new cyber strategy built around four priorities: disrupting adversaries, supporting victims, strengthening partnerships and building capabilities.
Two weeks later, the Bureau itself is dealing with an incident that may test all four.
And perhaps that is the most useful way to understand what is happening.
The important question is not simply whether one of America's premier law-enforcement and counterintelligence organizations could be hacked.
Apparently, it could.
The more consequential questions are what the FBI does next.
How quickly did it detect the intrusion?
How far did the attackers move?
How quickly can the Bureau determine which data was compromised?
Can it identify personnel whose exposure creates an elevated counterintelligence or personal-security risk?
Can it determine whether a third-party system became the gateway into a more sensitive environment?
And can it contain the incident before stolen information produces additional consequences?
Those are questions of resilience.
From Prevention to Triage
There is a medical analogy that increasingly seems appropriate.
Cybersecurity is becoming partly an exercise in triage.
You still try to prevent the accident.
But once the patient arrives, the objective changes immediately.
Stop the bleeding.
Determine what has been damaged.
Protect the vital organs.
Prioritize the greatest risks.
Stabilize the patient.
Then figure out exactly what happened.
That is not surrender to cybercriminals. Nor does resilience replace deterrence, law enforcement, offensive cyber operations or basic cyber hygiene.
It recognizes the environment we actually inhabit.
The United States is operating enormous interconnected digital systems against adversaries that include criminal groups, sophisticated state actors and combinations of the two. Artificial intelligence is increasing the speed at which both attackers and defenders can operate.
Perfect prevention is an increasingly unrealistic standard.
Speed of recognition, quality of information, preservation of trust and continuity of mission may be better measures of whether an institution is actually secure.
For the past month, I have listened to national-security officials talk about speed, resilience, trust and decision-making.
Now the FBI has become a case study.
AI-Assisted Reporting and Analysis: This article was written and edited by Ashley Greer with research and drafting assistance from OpenAI’s ChatGPT. The author personally attended the AFCEA/INSA Intelligence & National Security Summit, the Billington CyberSecurity Summit and the Government & AI Summit referenced in this article. Observations about themes discussed at those events—including speed, resilience, trust, triage and maintaining operational capability after a cyber intrusion—are based on the author’s firsthand attendance, notes and subsequent analysis.
ChatGPT was used to assist with researching publicly available reporting and official statements concerning the alleged ShinyHunters breach involving the FBI; organizing and synthesizing information; checking terminology and chronology; and developing and editing portions of the article. Public-source claims concerning the breach were distinguished from information independently confirmed by news organizations or acknowledged by the FBI.
The article’s central framework—including the argument that cybersecurity thinking is shifting from an emphasis on deterrence and prevention alone toward resilience, rapid detection, triage and recovery—is the author’s analysis informed by the conferences she attended. The framework DATA → TRUST → DECISION → AUTONOMY → ACTION was also developed by the author from her conference reporting and notes.
Final editorial judgment, interpretation, sourcing decisions and responsibility for the published article remain with the author.