Security Confidential S17 E2 Alex Sharpe

Manoj Tandon:
Hello everyone, this is your host, Manoj Tandon. Thank you for joining us for another episode of Dark Rhiino Security’s Security Confidential.

We have another great guest today—but before we begin, please hit the Like and Subscribe button. It really helps us with the algorithms so we can keep bringing you great content and amazing guests.

Now, without further ado, I’d like to introduce Mr. Alex Sharpe.

Alex is a board member, practitioner, speaker, and author. He’s well-versed in driving value and managing risk. His career began in the intelligence community, and he has led numerous organizations through strategic transformations across global enterprises. He’s built two startups—taking one public—and participated in over 20 M&A transactions. He’s also recognized as a top thought leader in cybersecurity.

Alex, welcome to the show, and thank you for being here.

Alex Sharpe:
Thank you, Manoj. This is fun—I enjoy doing this kind of thing.

Manoj Tandon:
That’s exactly why we do it too. This podcast is a passion project. Sure, it helps get our name out there, but more importantly, we hope it helps people by having guests like you share your insights.

Let’s start with you. Tell us a bit about your background—how did you get into this fascinating world of cybersecurity?

Alex Sharpe:
You actually covered the broad strokes, but my career has really been a series of unanticipated phone calls—sometimes literal, sometimes not.

I put myself through school. I realized early on that education would be my way out of a tough situation. I wasn’t the sports guy, but I was curious and willing to work hard. I didn’t mind falling and learning—just not making the same mistake twice.

I went to community college, worked my way through, and then transferred to a four-year program. My degree is in electrical engineering with a concentration in computer engineering, and minors in math and computer science. Pretty geeky, I know.

Manoj Tandon:
Hey, I studied aeronautical engineering—that’s pretty geeky too!

Alex Sharpe:
True! Any of the STEM fields are. I chose engineering because I loved building things. I also liked business, but I decided to do the engineering first. That was the right decision—had I gone the other way, I’d probably never have come back to engineering.

When I graduated, I got an offer from the National Security Agency. It was actually the lowest-paying offer I had, but it sounded fascinating, so I took it. I ended up on the offensive side of the agency, working on a very interesting project.

About a year later, someone mentioned another part of the agency focused on something called “InfoSec”—the protective side. I’d never heard of it before. They were starting a program to recruit the next generation of InfoSec professionals, and I decided to join.

Manoj Tandon:
This was still during the era of mainframes, right?

Alex Sharpe:
Oh yes—mainframes everywhere. And yes, they were getting hacked, in a big way—especially in banking.

That transition to the defensive side was an eye-opener. I realized that being the defender is a much harder job than being the attacker. That challenge appealed to me.

Later, when I moved into management consulting, it happened the same way—another unanticipated call. My contractor said, “We’re going off to start something new. We want you to come with us.” And I did.

So, in many ways, my career has been shaped by those unexpected opportunities.

Manoj Tandon:
That’s amazing. For many of our younger listeners—those who grew up in the 2000s—it’s hard to imagine that era. Inter-computer communication was through modems and dial-up. I can’t help but think of WarGames—“Would you like to play a game?”

Alex Sharpe:
Exactly! And that movie is actually a great example. They hacked into that system because of a default password—a backdoor that was never closed. Same issue we still see today! Working for the government at that time gave me access to what would become the internet—back then, it was only accessible to academics and government agencies.

Manoj Tandon:
DARPA Net, right?

Alex Sharpe:
Originally, yes. But by the early ’80s, DARPA Net had evolved into what became the modern Internet Protocol. So, I spent close to a decade working on the internet before most of the public even knew it existed, and about five years on the World Wide Web before it went mainstream. That’s one of the perks of working in the right part of government—you get an early look at technologies that won’t go public for years.

Manoj Tandon:
You mentioned AI earlier. Were you already working on early AI use cases back then?

Alex Sharpe:
Yes, actually. My first AI project was around analyzing log files to detect suspicious activity—a use case that’s still highly relevant today. We even explored quantum computing, which, as I like to say, has been “20 years away” for the last 30 years! But that’s what made the work exciting.

Manoj Tandon:
My early AI experience was with LISP in the late ’80s—painfully limited! How did you even approach machine learning back then with the limited compute power available?

Alex Sharpe:
Great question. Most people don’t realize this, but the foundation for modern AI was laid long ago. Alan Turing’s work in the 1950s set the stage. Then, in the mid-1950s, the term “Artificial Intelligence” was coined at a Dartmouth conference. After that, AI went through what’s called the AI Winter—about 20 years where progress stalled. By the time I joined NSA, we were coming out of that ice age. Interestingly, the algorithms and math we use today existed even then—the difference was data, compute power, and storage. Back then, data was scarce, storage was expensive, and transferring it between machines was painfully slow. Today, we have the same math, but with GPUs like Nvidia’s, which compute differently—not just faster. That’s what unlocked modern AI.

Manoj Tandon:
That makes sense. The pace of change today is staggering. But I still think we’re just lighting the candle—there’s a long way to go.

Alex Sharpe:
I agree. In fact, I believe AI will have a bigger impact on humanity than electricity or semiconductors.

Manoj Tandon:
That’s a bold statement, but I can see it. There’s an old saying: “The man who knows how will always have a job; the man who knows why will always be his boss. With AI, I think that equation breaks. The man who knows why will still be the boss—but the man who knows how might not have a job anymore.

Alex Sharpe:
That’s a fascinating thought. Workforce development is one of my passions, and this idea is worth exploring. Too many people equate AI with a single tool—like ChatGPT—instead of understanding it as a discipline. That’s a dangerous oversimplification.

Manoj Tandon:
Agreed. And our education system isn’t helping—it’s still designed for rote learning and repetition, not for understanding why. If you’re a paralegal, radiologist, or pathologist, AI could soon outperform you in repetitive, data-driven tasks. Once machines reach 3% error rates—human accuracy levels—why would we need thousands of people doing the same thing?

Alex Sharpe:
Exactly. But work doesn’t disappear—it just transfers to machines. AI is different because it’s the first major technological disruption that affects knowledge workers—white-collar jobs requiring data and analysis. The Oxford study on AI disruption showed that roles like roofers and welders might be affected too, because modern machines now combine visual acuity and manual precision. It’s remarkable. And the rate of adoption today is unlike anything before. It took the camera 70 years to achieve mass adoption; ChatGPT did it in 48 hours.

Manoj Tandon:
That’s incredible. But I don’t think AI can replace creativity—the emotion behind art, music, and the human experience.

Alex Sharpe:
Exactly. Machines don’t have emotion or passion. And there’s an emerging issue called model collapse, where AI models become increasingly generic as they feed on their own outputs. Essentially, they lose the sense of humanity in their responses. You can often tell when something was written by a model because it lacks that spark of being human.

Manoj Tandon:
Let’s bring this back to cybersecurity. With all this compute power, do we still need massive SOC teams? Why not train a large language model on all attack methods from the MITRE ATT&CK Framework and let it auto-detect, correlate, and even respond to incidents faster than humans ever could? Are we heading toward a robot vs. robot cybersecurity battle?

Alex Sharpe:
In a sense, yes—but humans will never be fully replaced. This is often called the Defender’s Dilemma, beautifully explained by Phil Venables and Royal Hansen from Google Cloud. AI dramatically increases a defender’s capability, and we’re already seeing that. Spam filters, for instance, block 98–99% of malicious traffic before it ever reaches users—that’s AI at work. ISPs and security tools are using similar techniques to catch threats earlier. However, social engineering has skyrocketed. ChatGPT has made phishing attacks far more convincing. One striking example: Japan used to have almost no ransomware because few hackers spoke Japanese. After ChatGPT, attacks against Japan surged. Within just four months of ChatGPT’s release, dark web chatter about AI in ransomware increased by 170%, and attack efficiency exceeded 50%. So yes, we’re entering a world where AI enhances both defense and offense.

Manoj Tandon:
Given all that, how should we be thinking about cyber risk in this new landscape?

Alex Sharpe:
That’s a complex question—and we don’t have enough time! Many in cybersecurity talk about “risk management” without really understanding what risk means. Traditional quantification models—like those used in insurance—don’t work in cyber because our adversaries are actively trying to harm us. Instead, we need to identify our most valuable assets, understand which are most exposed, and protect accordingly. Not all assets are created equal. Cyber risk isn’t just technical—it involves people, processes, and organizations. We can’t just throw technical controls at every problem anymore.

Manoj Tandon:
Exactly. Things like business email compromise are process failures, not purely technical ones.

Alex Sharpe:
Right. Every AI and cyber issue today is a technology-induced problem without a purely technological solution. The answer lies in people, processes, and organizational awareness. We still need access controls and logging—but that’s just the baseline. Or as you put it: “You still have to lock your car.”

Manoj Tandon:
And sometimes, even that doesn’t stop it from being stolen—just ask my daughter, twice!

Alex Sharpe:
(Laughs) Exactly. Locks just keep honest people honest. The tougher the lock, the more sophisticated the thief.

Manoj Tandon:
So maybe cybersecurity needs a business mindset—defending brand and revenue instead of just systems. That approach forces leadership to engage and look at the problem holistically, not just delegate it to IT.

Alex Sharpe:
Absolutely. Businesses have long used Business Impact Assessments to identify what’s most critical. Cybersecurity needs to be part of that conversation. When you align strategy, architecture, and operations, you can prioritize resources effectively. Historically, the lack of that alignment has been the biggest vulnerability.

Manoj Tandon:
And all this while ransomware attackers are moving faster than ever. And then there’s the shocking stat—60 to 70% of backups fail to restore.

Alex Sharpe:
It’s painful—and true. I’ve worked with many organizations that swore they tested their backups, but never actually tried restoring. Some even forgot to include critical systems in their backup network. Regulators are now starting to require proof of actual recovery tests. And some systemically important organizations run failover drills—but that takes real courage.

Manoj Tandon:
Especially for legacy OT systems in critical infrastructure. If one of those old servers goes down, the OEM might just tell you, “Sorry, we don’t support that anymore.”

Alex Sharpe:
Exactly. I’ve seen that firsthand. Those recovery costs can be staggering—and in many cases, the systems never come back. That’s why involving both business and technology teams in impact assessments is crucial. The discussions aren’t easy, but they’re necessary. And despite everything, I remain optimistic. The people in our industry are tenacious. When a crisis hits, they don’t go home—they stay, fight, and recover. That resilience gives me hope for the future of cybersecurity.

Manoj Tandon:
That’s a great note to end on. Alex, before we close, tell our audience where they can connect with you and what you have coming up.

Alex Sharpe:
Sure! Connect with me on LinkedIn—it’s Alex Sharpe, with an E at the end. I’m not the violinist, the economist, or the Irish tenor. Search for “Alex Sharpe Cyber Resilience AI” and you’ll find me. I’ll be at the ISACA North America Conference, where we’re unveiling an AI Maturity Model. Also, on May 29th, I’m co-hosting an event sponsored by Johns Hopkins University—“Towel Day,” in honor of The Hitchhiker’s Guide to the Galaxy. We’ll be discussing technology disruption and workforce development. If you can’t find it online, reach out through LinkedIn.

Manoj Tandon:
Fantastic. And the answer to life, the universe, and everything is…

Alex Sharpe:
(Laughs) Forty-two!

Manoj Tandon:
Exactly. Alex, this has been a great conversation—we’ve only scratched the surface. Thank you for joining us.

Alex Sharpe:
Thank you, Manoj. This was a pleasure.