Check Point CEO Gil Schweid sat down with Nasdaq TradeTalk to map the threat landscape. The conversation covered AI-written malware, the explosion of the attack surface during the pandemic, the rise of cloud as a target, and the increasingly professional ransomware economy.
The through-line: defenders fight on more fronts with tools that do not talk to each other, while attackers keep getting faster at monetising intrusions. Schweid's argument is that the answer is unified architecture, not another point product.
The threat landscape, as Schweid sees it
On AI, Schweid is blunt. Generative models lower the bar to writing functional malware and convincing phishing lures. Bad actors no longer need expertise. The asymmetry is real: defenders must be right every time; attackers only need to be right once.
On the pandemic, the attack surface is no longer the corporate network. It is every home desktop, every employee laptop, every unmanaged device that touches corporate data. Once one is compromised, the attacker has a launch point inside the trust boundary.
On cloud, Schweid frames it as a paradox. More capable, but also more porous than on-premises environments. Once a foothold is established, it can quickly reach the heart of the data, because cloud removes layers that used to slow attackers down.
Healthcare and government—including schools and local authorities—are most frequently targeted. Not because they are inherently more valuable, but because they tend to be under-resourced for security relative to the data they hold.
Our analysis
The sharpest part of the conversation is ransomware economics. Five or six years ago, a typical attack yielded a few hundred dollars. Today, six- and seven-figure payouts are common, and some cases have crossed $10 million. Ransomware is no longer opportunistic; it is a structured business with reliable returns.
Who wins? Attackers have built a monetisation engine with low entry costs and high predictability. Who loses? Organisations treating ransomware as a probabilistic risk rather than a near-certainty, and the insurance market underwriting them.
The trade-off Schweid identifies is stark: each new security product a defender adds creates a new seam attackers can exploit. Tool sprawl is not strength; it is complexity that benefits the offence.
What to watch: as AI tools mature, the quality of phishing lures will接近 human-crafted originals. Training programmes built on last year's red flags will lose relevance faster.
Who should care
| Role | Primary concern | Immediate action |
|---|---|---|
| CISOs at under-resourced orgs | Underfunded security + valuable data = high attractiveness | Audit cloud IAM; prioritise identity hardening |
| Security managers | Tool sprawl creating blind spots | Map which products share telemetry; consolidate seams |
| Risk and compliance leads | Ransomware as business continuity risk | Rehearse response playbooks; establish board-level payment policy |
| IT generalists | Home devices as network entry points | Enforce endpoint hygiene; reduce trust boundaries |
What it means for you
The first move: reduce the number of tools in your stack, not add more. Audit endpoint, network, cloud, and identity tools, and ask which ones share telemetry. If the answer is "not many," you have a consolidation project.
On AI, treat generative models as both a force multiplier for your team and a tool in the attacker's hands. Use them for phishing simulations and threat-intel summarisation. But assume your phishing training material from last year is obsolete—the attacker can generate better lures with a free model.
On ransomware, the recommendation has not changed, and that is the point: assume you will be hit, and rehearse the response. Backups, segmentation, identity hardening, and a pre-approved board-level decision on payment.
Bottom line
The threat landscape is more crowded, more capable, and more profitable for attackers than it was five years ago. Defenders need to consolidate tools, treat AI as both a weapon and a shield, and rehearse the ransomware response. The playbook is known. Most organisations have not run it.
Key takeaways
- AI tools already lower the bar to writing malware and phishing lures.
- Remote work permanently expanded the attack surface to every endpoint.
- Cloud exposure is a primary target, not secondary.
- Ransomware is a structured, high-yield criminal economy—payouts now reach seven figures.
- Tool sprawl creates seams; consolidation is a defensive move.
- Healthcare, education, and local government are frequent targets due to underfunding.
Frequently asked questions
Why is ransomware getting worse despite more security products?
Attackers have built a reliable monetisation engine, while many defenders still run disconnected point products that do not share signals.
How is AI changing the threat landscape?
Generative models lower the bar to writing malware and phishing lures, giving less skilled attackers credible output.
Why is the cloud a target?
Weak IAM and exposed services give attackers a short path from foothold to sensitive data, with fewer layers than a traditional network.
Which sectors are most at risk?
Healthcare, government, and education are most frequently targeted, partly because they tend to be under-resourced relative to the data they hold.
What is the right defensive posture?
Schweid argues for unified architecture, tool consolidation, and rehearsed incident response—not adding more point products.
Inspired by reporting from: cybertalk.org