Attackers no longer need to break down the door when someone will open it for them. The Verizon 2026 Data Breach Investigations Report found that the human element was involved in 62% of breaches, the same story security teams have heard for years. If the message is not landing, perhaps it is time to change the tune, and that is where music and cybersecurity meet.
As modern attacks increasingly blend into the systems they target, cybersecurity needs new ways to help people recognize them. We spoke with Mathew Caplan, Director of Professional Services at Orange Cyberdefense, about the surprising parallels between music and cybersecurity and how AI is changing both.
A regular on international conference stages, Mathew returns to DefCamp with “Last night a DJ erased my drive”, a talk on the impact music has on cybersecurity.
25 years in cybersecurity and still learning
Few people in the industry can say they watched cybersecurity grow up. Mathew has worked in the field for more than 25 years, advising organizations of every size on security strategy, governance, and compliance across many countries and industries. Over that time, the threats changed almost beyond recognition, and so did the tools used to fight them. For Mathew, there was never a single moment of decision, only a career that grew alongside the technology.
I'm not sure there was one moment when I decided that cybersecurity was what I wanted to do. My career evolved alongside the technology and the threats surrounding it. What drew me in was the combination of technology, problem-solving, and human behavior: cybersecurity is never purely a technical challenge.
What continues to inspire me is that the work genuinely matters. I want to help people protect what is important to them and make better decisions in uncertain situations. The threats never stand still, so neither can we. After more than 25 years, I am still learning, still being challenged, and still finding new ways to make complex subjects understandable. That constant change is what keeps the field interesting.
Why people tune out cybersecurity advice
Free courses, awareness videos and security guides have never been easier to find. Yet many people still click the wrong link, reuse passwords, or ignore the warnings their IT teams send every month. It is tempting to blame users for not caring. Mathew believes the problem often lies with how the industry tells the story.
I don't think the problem is always that people don't want to understand cybersecurity. Often, we have made it difficult for them to care. As an industry, we can be very good at speaking our own language, using fear to attract attention and then presenting people with long lists of things they must or must not do.
People engage when cybersecurity feels relevant to their lives and when they understand why something matters, rather than simply being told to follow another rule. That is why identity and human behavior feature so strongly in my talks. Technology changes, but curiosity, trust, distraction and persuasion remain remarkably consistent.
Learning resources may be easier to access than ever, but access to information is not the same as understanding it. Our responsibility is to make cybersecurity relatable, practical and memorable. If people are not listening, sometimes we need to reconsider how we are telling the story.
What music and cybersecurity teach us about resilience
Mathew has a habit of borrowing from pop songs to explain security, and he has drawn on R.E.M. in the past to talk about risk and compliance. This time, his talk opens with a famous line from Joni Mitchell’s 1970 song “Big Yellow Taxi”, about only realizing what we had once it is gone. It is an unusual way to begin a security presentation. For Mathew, few lines capture resilience as neatly.
The lyric captures something very familiar in cybersecurity: we often don't value things until they disappear. We rarely begin the working day feeling grateful that our files are accessible, our identities still belong to us, and our systems are behaving normally. We simply expect them to be there.
Then something goes wrong, and their value becomes painfully obvious.
It is a simple way of expressing the importance of resilience. Good cybersecurity is not only about stopping bad things from happening; it is also about understanding what really matters, recognizing when it is at risk, and being able to recover when prevention fails. Joni managed to communicate all of that rather more elegantly than most security frameworks, and she also has a much nicer singing voice than me.
AI music, authenticity and trust
AI can now write a song, imitate a famous voice and publish the result on a streaming platform in a single afternoon. For listeners, it is getting harder to tell who actually made what they hear. For artists, it raises uncomfortable questions about ownership and consent. Mathew sees the same questions at the heart of his own work.
I wouldn't say that AI music forced me to change my approach, but it certainly reinforced it. Music created or altered by AI raises many of the same questions we face in cybersecurity: Who created this? Is it authentic? Can I trust its source? Has someone's identity or work been copied without their knowledge? Is someone suffering as a result, whether financially, creatively, or simply through having to endure even more terrible music?
AI makes it possible to produce convincing voices, music and other content at extraordinary speed. That is creatively exciting, but it also makes context, provenance and critical thinking increasingly important. We can no longer assume that something is genuine simply because it looks or sounds convincing.
The underlying approach remains the same: understand what you are trusting, look for independent signals, and avoid allowing one persuasive piece of information to make the decision for you.
How AI helps modern attacks blend in
Mathew often says that modern attacks don’t break systems; they blend into them. Many attackers now “live off the land”, which means they use legitimate tools and accounts already present in a network, so their activity looks like normal work. Security teams then have to spot a few suspicious actions among millions of ordinary ones. AI, in Mathew’s view, makes that camouflage even better.
AI will make blending in easier. It can help attackers create more convincing messages, imitate individual communication styles, and adapt their behavior much faster. Instead of sending the same clumsy phishing email to thousands of people, an attacker can create something personalized that appears to belong naturally within an existing conversation.
The same principle applies inside technology environments. AI can help malicious activity resemble legitimate user or system behavior, allowing it to hide among the enormous volume of normal operational noise. The danger is not necessarily a spectacular attack that immediately breaks everything. It may be a series of small, plausible actions that nobody notices until they form a much larger pattern.
Of course, defenders can use AI too: to identify unusual behavior, connect weak signals, and help analysts focus their attention. The advantage will belong to those who combine technology with context and human judgment. AI may help us hear more, but we still need to know what we are listening for.
Music and cybersecurity at DefCamp 2026: inside "Last night a DJ erased my drive"
Music has caused real security problems before. In the Windows XP era, playing the music video for Janet Jackson’s “Rhythm Nation” could crash certain laptops because the song matched a resonant frequency of their hard drives, a story Microsoft engineer Raymond Chen shared in 2022. The issue even received its own vulnerability ID, CVE-2022-38392. Stories like this hint at what Mathew is preparing for the DefCamp stage, although he is careful not to give too much away. So should the audience expect more music, more cybersecurity, or a bit of both?
Definitely a bit of both, and possibly more music than is normally considered sensible in a cybersecurity presentation.
The session is an audio-visual journey through some unexpected connections between music and cybersecurity. I will explore how music has been used to influence behavior, communicate secretly, create identity and community, and even damage technology. Along the way, I will connect those stories to modern attacks, operational noise, and the challenge of recognizing activity that is hiding in plain sight.
There are serious lessons about detection, response, and resilience, but this is not intended to feel like 45 minutes of security policy accompanied by a playlist. My aim is for people to enjoy the journey, learn something useful, and perhaps even listen to certain songs differently.
Oh, and cats. Expect plenty of cats.
Meet Mathew Caplan at DefCamp 2026
Want to hear how a playlist can explain modern attacks? Catch “Last night a DJ erased my drive”, Mathew Caplan’s audio-visual talk at DefCamp 2026.
You can learn from new research, meet attendees from more than 50 countries, and compare notes with the specialists who defend organizations every day.
