MacArthur Foundation's Seth Arnoff on Top AI and Quantum Threats

Live from Black Hat 2025, host Casey Cammalleri sits down with Seth Arnoff, a cybersecurity engineer at the John D. and Catherine T. MacArthur Foundation, to talk about what it really looks like to run security at a mission-driven organization with a lean team. Seth walks through the day-to-day reality—patching, vuln management, and log triage—alongside bigger culture-forward initiatives like going passwordless with Windows Hello and driving adoption through demos, lunch-and-learns, and intentional communication. From there, the conversation shifts into proactive security: why MacArthur moved from point-in-time assessments to a continuous penetration testing model, how “always-on” testing reduces operational drag, and why verified remediation matters more than one-and-done reports. They also dig into the security side of the AI boom on the conference floor—how to build guardrails when people are going to use AI tools anyway, what third-party risk looks like in an LLM world, and how to monitor tool usage without becoming invasive. Seth shares practical advice for reporting security to leadership (hint: fewer scary vanity metrics, more measurable objectives), how they’re maturing vendor management with repeatable processes and SOC 2 reviews, and what he thinks the industry still isn’t talking about enough: quantum computing.