For organizations responsible for critical financial infrastructure, cybersecurity is about more than identifying vulnerabilities. It requires understanding which weaknesses attackers can realistically exploit and what the consequences could be. As artificial intelligence accelerates both offensive and defensive capabilities, that challenge is becoming increasingly complex.
For Ryan Hebert, Head of Information Security Assurance at Intercontinental Exchange (ICE), the parent company of the New York Stock Exchange, the answer lies in combining continuous penetration testing, AI-driven automation, and human expertise. Speaking with Shahar Peled, co-founder and CEO of Terra Security, on the AI Native Cybersecurity podcast, Hebert discussed how ICE is adapting its security strategy to an evolving threat landscape.
AI Is a Force Multiplier for Security Teams
After 17 years at ICE, Hebert oversees governance, risk and compliance, application security, and red teaming across the company's business units. He sees generative AI as a significant force multiplier, particularly in offensive security, where agentic tools can identify vulnerabilities and connect weaknesses into realistic attack paths.
However, automation also creates additional work for security teams.
"From a cybersecurity perspective, it is definitely a force multiplier. It has given us a lot more things to focus on and think about. But with that also brings and leads to a lot more work," Hebert explained.
For ICE, human oversight remains essential. Application security and red teams must evaluate AI deployments, review model integrations, and test employee-facing interfaces for vulnerabilities such as prompt manipulation and unauthorized data access.
Why ICE Prioritizes Continuous Offensive Security
ICE's cybersecurity strategy follows a red-team-first philosophy. Rather than simply compiling lists of vulnerabilities, the organization focuses on understanding what attackers are trying to accomplish, from sabotage and extortion to accessing sensitive market information.
Those objectives determine testing priorities and help leadership understand which risks require attention.
ICE conducts more than 100 red-team campaigns annually with a dedicated team of just eight people. Agentic penetration testing supplements that work by continuously examining applications and using source-code context to identify potential attack paths.
"We're doing a hundred plus red team campaigns a year. So why not supplement that with something that can learn on our source code, be continuous in nature, and help supplement what they're doing on a day-to-day basis?" Hebert said.
The strategy allows experienced security professionals to focus on complex threats while AI expands their testing capabilities.
Why Human Judgment Still Matters
Despite advances in AI-powered vulnerability discovery, Hebert cautioned against treating every finding as an immediate business risk. Technical severity does not necessarily translate into practical exploitability. Understanding application architecture, dependencies, and existing security controls is essential before escalating issues to developers.
"If you're constantly lobbying raw CVE scores as critical over the fence to development, you lose the room," he said.
The same principle applies to automated remediation. While AI can identify vulnerabilities and suggest fixes, Hebert believes human validation remains necessary before changes reach production.
For an organization responsible for the New York Stock Exchange, the consequences of an improperly validated change could be significant.
"It's pretty important to me as the cybersecurity representative that the reason the stock market is down is not us," Hebert explained.
Addressing Traditional and Emerging Threats
The conversation also highlighted threats beyond sophisticated AI-powered attacks. Hebert pointed to increasing compromises involving open-source software ecosystems, including Maven, PyPI, and NPM.
ICE has responded by leveraging AI-assisted threat intelligence to evaluate suspicious packages before allowing them into internal repositories. The company also continues testing its defenses against social engineering, particularly attacks targeting help desks through impersonation.
For Hebert, these developments reinforce the importance of combining modern AI capabilities with established security controls.
Discussing advanced offensive models and Project Glasswing, he noted that ICE identified findings worth addressing but nothing that required an emergency response during its initial testing of critical applications.
He emphasized that fundamentals such as multifactor authentication, single sign-on, web application firewalls, and endpoint monitoring remain essential.
The Road to Zero Vulnerability Tracking
Looking ahead, Hebert wants to connect continuous penetration testing with increasingly automated remediation workflows. The objective is to use source-code context to identify vulnerabilities, develop appropriate fixes, and have security professionals validate changes before deployment.
"My goal is to get to zero vulnerability tracking in the next two years, and I think we can get there," he said.
His approach reflects a broader shift in cybersecurity: moving beyond periodic compliance exercises toward continuous, risk-based defense. As AI strengthens both attackers and defenders, organizations will increasingly need systems that understand their environments, identify exploitable weaknesses, and help resolve them without compromising operational stability.
Written by the editorial team at TVC Partners.
