Mandiant Consulting’s Charles Carmakal Discusses the Evolving Landscape of Cybersecurity
In a recent interview, Charles Carmakal, the chief technology officer at Mandiant Consulting, a subsidiary of Google Cloud, elaborated on the current state of cybersecurity, particularly the impact of artificial intelligence and social engineering on defense mechanisms. His insights were shared during the Black Hat USA 2026 event, a significant gathering for cybersecurity professionals and enthusiasts.
Carmakal pointed out a noteworthy shift in the approach to software security since the release of Anthropic’s Mythos models. This innovative technology has prompted both vendors and adversaries to engage in a competitive race to uncover vulnerabilities before the other party does. The landscape of cyber threats is evolving rapidly, and defenders are now being compelled to rethink their strategies to protect software that has been in circulation over the last decade.
The conversation highlighted an intriguing advantage currently held by defenders in this competition. Carmakal expressed optimism, stating, "Right now, we’re seeing a number of advances from an adversary perspective in terms of using AI to find vulnerabilities. But the defenders right now have the upper hand." This assertion underscores the belief that cybersecurity professionals are leveraging advanced technologies to stay one step ahead of potential threats.
However, Carmakal also acknowledged a significant challenge that transcends technical barriers— the human element. He observed that social engineering tactics, particularly those involving telephone interactions, have become markedly more sophisticated. Historically, scammers often relied on identifiable foreign accents, which made their schemes relatively easy to detect. Yet, today’s adversaries have adapted their strategies; many now employ American, Canadian, and British accents, which lend a level of credibility and can manipulate employees and help desk personnel into divulging sensitive information.
The interview further unpacked Carmakal’s insights into the shifting focus towards data theft and extortion, asserting that these tactics are now eclipsing traditional ransomware attacks as endpoint detection and response (EDR) technologies improve. The efficacy of EDR systems in mitigating ransomware threats has pushed cybercriminals to seek alternative, less detectable methods for data exploitation.
Moreover, Carmakal emphasized the growing threat posed by nation-state actors. These sophisticated adversaries often target critical infrastructure components such as firewalls and other edge devices—areas that may not possess robust EDR coverage. This vulnerability highlights a crucial area for organizations to prioritize in their cybersecurity strategies.
Carmakal also called for Chief Information Security Officers (CISOs) to adopt a proactive approach towards managing software supply chain risks. He raised concerns regarding the potential exposure of developer credentials and cloud environments, stressing the necessity for more rigorous protective measures in these areas. The supply chain is often a weak link in cybersecurity and needs closer scrutiny to ensure that organizations are safeguarded against potential threats that reside outside their direct control.
As the head of a skilled team of incident responders, analysts, and consultants, Carmakal plays a pivotal role in guiding organizations through complex cyber incidents linked to nation-state actors and organized criminal enterprises. His extensive experience oversight includes major breaches, such as the SolarWinds supply chain attack and the Colonial Pipeline disruption, events that have reshaped the cybersecurity landscape.
His work encompasses not only incident response and threat investigations but also a critical advisory role for organizations as they navigate the multifaceted challenges of cybersecurity risk. Carmakal’s observations and expertise serve as a reminder of the increasingly intricate and evolving nature of cybersecurity threats and the requirement for vigilant and innovative defense strategies.
In sum, as the cybersecurity environment continuously transforms, industry leaders like Charles Carmakal are carving out invaluable insights that can assist organizations in adapting to these challenges effectively. The conversation around social engineering, evolving adversarial tactics, and the importance of a robust defense underscores the necessity for organizations to remain vigilant and proactive in their cybersecurity measures.