(KEYNOTE) The Converging Threat Landscape by Patrice Perche

### Overview In this keynote address, Patrice Perche discusses the escalating challenges across the cybersecurity threat landscape and Fortinet’s perspectives on counteracting global cybercrime. Organizations are grappling with rapid infrastructure changes—such as hybrid work models, application decentralization across edges and clouds, IT/OT convergence, and tool sprawl. Concurrently, cybercriminals are scaling operations through advanced tooling and convergence with nation-state methods. The presentation outlines telemetry observed through FortiGuard Labs, regional threat trends in Switzerland, predictive indicators around destructive malware and Crime-as-a-Service, and the critical need for cross-sector collaboration between public and private entities.

### Key Topics - **Infrastructure Evolution & Complexity:** The shift toward hybrid work and cloud adoption increases management friction. Securing operational technology (OT) and critical infrastructure is increasingly vital as legacy systems converge with standard IT networks. Fortinet advocates for vendor and tool consolidation, secure networking (e.g., Secure SD-WAN/Secure Branch), and mesh architectures. - **Threat Intelligence & Telemetry:** Insights into FortiGuard Labs' data ingestion, which uses roughly 10 million deployed network appliances as sensors, monitors 200 billion daily threat events, and leverages machine learning to scale threat evaluation and augment security operations. - **Regional Insights (Switzerland):** Data from 2022 ranks Switzerland fourth in overall attacks within the EMEA region (accounting for ~9% of worldwide attacks recorded by Fortinet). Notable attack waves included Log4j in Q1 2022 and IoT/OT Mirai botnet activity targeting manufacturing in Q4 2022. - **Evolution of Cybercrime & APT Convergence:** Traditional cybercrime syndicates and advanced persistent threat (APT) groups are increasingly merging tactics, infrastructure, and target sets into what Perche terms "Advanced Persistent Cybercrime." - **Public-Private Collaboration:** Actionable disruption requires shared intelligence and unified action through initiatives such as the World Economic Forum's Cybercrime Atlas, the Cyber Threat Alliance, MITRE R&D, and law enforcement operations with Interpol.

### Technical Details - **Zero-Day Vulnerability Research:** Fortinet operates a responsible disclosure program, working directly with vendors (including over 80 partners like Microsoft, Siemens, Schneider Electric, ABB, and GE) to patch flaws and implement virtual patches via IPS engines before wide exploitation. - **Ransomware-as-a-Service (RaaS) Shifts:** Criminal operations have shifted from high-volume, broad affiliate networks (~1,000 partners) to more selective models (~100 partners), concentrating heavily on Very Large Enterprises (VLE) and OT/manufacturing. This targeted approach has seen ransom demands transition from seven-figure to eight-figure sums. - **Surge in Wiper Malware:** Destructive wiper malware grew substantially throughout 2022. FortiGuard Labs tracked 16 new wiper variants in 2022 compared to historical norms of roughly one per year. While early 2022 activity was concentrated on Ukraine, wipers expanded globally into cross-platform targets (Windows, Linux, Unix, Solaris), averaging 13,000 monthly attacks in Q4 2022 (a 53% quarter-over-quarter increase). - **Expansion of Crime-as-a-Service (CaaS):** Commodity services on the dark web now span DDoS-as-a-Service, phishing, stolen credentials, and reconnaissance, with threat actors weaponizing generative AI tools (such as ChatGPT/GPT-4) for reconnaissance and deepfake creation. - **Law Enforcement Cooperation:** Practical outcomes highlighted include working with Interpol to dismantle a $16 million business email compromise (BEC) operation in Nigeria and ongoing operations targeting ransomware syndicates.

### Takeaways Defending against contemporary cyber threats requires moving past isolated perimeter defenses toward an integrated security fabric and zero trust architectures that verify identity and behavior continuously. Because cybercriminals operate across jurisdictions with disparate legal frameworks, private organizations cannot succeed in isolation. Effective defense hinges on proactive cross-industry intelligence sharing, vendor consolidation to eliminate security gaps, and institutional partnerships linking technology vendors, enterprises, and international law enforcement.