Outpacing Threat Actors: Mainframe Security in the Age of AI and Quantum

AI-driven code scanning is exposing vulnerabilities in legacy technology at an industrial scale, shrinking the time mainframe teams have to respond from months to days. Organizations that typically roll out a z/OS upgrade over 18 months, or let a patch sit in test for a quarter, now face a breach risk that outweighs the risk of a failed patch. Post-quantum cryptography adds another deadline: sensitive data stolen and stored today could be decrypted in the future, making post-quantum cryptographic readiness an immediate priority rather than a distant concern.

On this episode of The Main Scoop, Greg Lotko and Daniel Newman welcome back Mark Wilson, Director at Vertali, who has spent 46 years working on mainframes. Wilson explains why the industry has to go back to the drawing board on maintenance, how he moved from AI skeptic to daily user of AI coding and fact-checking tools, and why post-quantum readiness is already overdue for most large organizations.

For security and infrastructure leaders, the practical shift lands on operating rhythm. Teams need daily vulnerability awareness with context on where each tool actually runs, AI agents that monitor security portals around the clock under human supervision, and cryptographic inventories built now. Basic security hygiene has to come first, because strong encryption offers little protection if an attacker can walk through an open front door and reach the keys.

Key Takeaways:

🔹 Why patch cycles have to be rebuilt from scratch. A bank CIO running 120 LPARs who receives several security fixes on a Monday needs them applied within the week. Wilson argues teams have to outpace threat actors, which a two- to three-month maintenance cycle cannot do.

🔹 How AI can monitor vulnerabilities around the clock. Teams can point AI tools at security portals to check for new fixes every few hours, while humans add context such as whether the affected tool runs in production or only in development and test.

🔹 Why AI today behaves like an adolescent. Wilson uses Claude Code and AI fact-checking daily but finds the tools can resist instructions and drift, so he acts as a supervisor and uses one model to check another. Greg Lotko calls this “artificial adolescence,” not yet artificial intelligence.

🔹 Why post-quantum work should already be underway. Large organizations should already have a cryptographic inventory, but many still don't. Attackers may be harvesting encrypted data now to decrypt later, and Wilson sees 2029 to 2031 as a near-term horizon.

🔹 How basic security hygiene comes before encryption. Wilson recalls a CIO focused on post-quantum plans whose mainframe security still left the front door open. An attacker who gets in can reach the keys, use the mainframe to decrypt the data, and walk away with it.

Mainframe teams that pair AI-assisted vigilance with disciplined fundamentals and an early start on post-quantum readiness will stay ahead of threat actors, while those waiting on traditional cycles fall behind.

Watch the full video at sixfivemedia.com, and subscribe to our YouTube channel so you never miss an episode.

Learn more about Vertali at vertali.com.

IMPORTANT — Note to Uploader: VIDEO EMBED – added by uploader.

Disclaimer: Six Five Media is for information and entertainment purposes only. Over the course of this video, we may discuss companies that are publicly traded, and we may reference their equity share prices. Nothing discussed during this webcast should be considered investment advice or a recommendation to buy or sell any security. We are not investment advisors, and you should not rely on this content as financial advice. Six Five Media collaborates with technology companies and industry leaders to produce research-driven interviews and multimedia programming for enterprise technology audiences.

Mark Wilson:

We can't be like that anymore. I did a session this morning all about the dark web, frontier models, what it means to the mainframe. And I just put, we have to outpace them. We can't keep up with them. We've got to outpace them. We've got to be in front of the threat actors.

Greg Lotko: 

Hey folks, welcome to our next episode of The Main Scoop. I'm joined here by my co-host, Daniel Newman.

Daniel Newman: 

Yeah, I'm going to be prim and proper on this show. We get really focused. I'm excited about this episode.

Greg Lotko: 

I think that fits for this one because we're going to be talking about security and you do always make me feel secure.

Daniel Newman: 

Thank you. You know, I was recently with a good friend, and I was confused for being his bodyguard. Really? Yeah. It's kind of like one of those things that you, you know, as a security guy, you take it semi as a compliment. You're like, oh, I'm not really fitting in shape. And then you take it somewhat insulted as like, do I look like I'm in an episode of Men in Black? Or what did I do wrong? How did I dress incorrectly today? Is it the sunglasses?

Greg Lotko: 

I'd take it as you looked buff, so I'd just roll with it. What do y'all think? That's cool.

Daniel Newman: 

I think that's great.

Greg Lotko: 

So I understand this next guest that we have for our topic around security. I've known him for years, but it is somebody we've had on The Main Scoop before.

Daniel Newman: 

I didn't have… I've had him on The Main Scoop in Joe Doria. We had him in Atlanta. It was actually on a big stage. It was the biggest stage that this show has ever been on. I heard you did it live at a conference. We did it live at a conference. It was a lot of fun, and he was great.

Greg Lotko: 

And I had had a personal injury while I was recovering.

Daniel Newman: 

We've had a few back, but it is pretty rare that we bring people back.

Greg Lotko: 

It must mean he was really good at no pressure.

Daniel Newman: 

We should bring him on, because then, really, you should lay the pressure on thick. Okay. All right.

Greg Lotko: 

So with us today is Mark Wilson. I feel like I should do the Dennis the Menace, which might not relate here. Hello, Mr. Wilson.

Mark Wilson: 

Hello, Greg.

Greg Lotko: 

There you go. So you're a director at Vertali. Yeah. I know you've been around this industry in this space, the mainframe space, as well as security for Quite a few years now.

Mark Wilson: 

46 now, Greg. 

Greg Lotko:

Wow.

Mark Wilson: 

46.

Mark Wilson: 

Done nothing but mainframes in the tender age of 16 when I left school.

Greg Lotko: 

So I was going to joke and say you must have started when you were five or six, but you did literally start at 16.

Mark Wilson: 

16.

Greg Lotko: 

And did you go in through like an apprenticeship program? Did they have them back then as well?

Mark Wilson: 

Yes, they had them back then, but it was a slightly different way of getting into mainframe. I was going in the Navy and from leaving school to going in the Navy was a six month gap and I needed something to do. So I went on a six month training course and walked into a data center for the first time. And there was this mainframe. And here I am, 46 years later, still doing the same thing. It's really cool.

Greg Lotko: 

So we've been talking across this industry about a lot of things that are going on. We do tend to touch on AI frequently. And the reality is that AI and the frontier models are Exposing or uncovering new threats, new things that vendors across the industry, even customers with their applications need to lock down their code, fix. But that's really meaning that the windows we have to apply maintenance are shrinking like crazy. I mean, it used to be that you'd go, ah, you know, that patch comes out, I'll maybe wait until five or six other big customers install it and I'll put in my test system for a few months or a few quarters and let it simmer and then I'll put it in but I kind of feel like gone are the days where the risk of an outage from a failed patch were higher than the risk of a breach. Now it's the risk of breach is much higher, but that's really shrinking windows.

Mark Wilson: 

Yeah. And I think if you look at the way we've traditionally done maintenance patching, we've got to go back to the drawing board and start again. Cause if you're, if you're the CIO of a large bank and you've got 120 LPAS and you get five second APAS coming on a Monday, you need them in by Friday and we're not.

Greg Lotko: 

I think you need them in by the end of the day, Monday. Yeah.

Mark Wilson: 

Let's be realistic. We try and get them in by Friday.

Greg Lotko: 

You set your goals high.

Mark Wilson:

Yeah. It's a challenge. I mean, you look now and people say exactly what you've said there. This is a two or three month cycle. You know, I've worked with clients who do ZOS upgrades and it takes them 18 months to roll the ZOS upgrade out. We can't be like that anymore. I did a session this morning all about the dark web, frontier models, what it means to the mainframe. And I just put, we have to outpace them. We can't keep up with them. We've got to outpace them. We've got to be in front of the threat actors.

Greg Lotko: 

So what does all that mean? I mean, I agree, we got to keep ahead, we got to be in front of them. What are the things you do to stay ahead?

Mark Wilson: 

Yeah, what do you do to stay ahead? A lot more focus on research, working with the vendors, making sure that when those patches come out, you know about them, you know the severity, you understand how can you get them through your test harnesses as quickly as you can. And some may be so critical that It's going in.

Greg Lotko: 

So part of that is vigilance, right? You say you've got to be aware and you've got to know. I mean, we know in the mainframe space, in the ecosystem, we publish seconds. And they are published every Tuesday. They can be published more often if they're higher severity. But if in your shop you're thinking, oh, once a month or once a quarter, I'm going to go look and see what's out there. That's not being vigilant.

Mark Wilson: 

No.

Greg Lotko: 

This should be a daily thing that you're looking and seeing what's going on. And like you said, looking at the severity, but also understanding context. Yeah. Like, hey, yes, I may use that tool, but does it tell me enough? Do I use it in that way? Or do I use that feature function? Might I be exposed?

Mark Wilson: 

And where do you use that tool? Because some of it may be a dev or test tool, might not be something that runs on production. So do I worry about getting that to prod? Probably not. Do I get it to dev? But you look at the tools we've got now, the technology and the tooling for interfacing to all the different security portals. It doesn't need somebody sat there doing this all day. You can use the AI tools to do it for you. Go wake up every couple of hours, go and pull the whole day to go and do this.

Greg Lotko: 

So use AI to help you defend against AI.

Daniel Newman:

 Agents are working, right? And you have them looped and they continue to optimize what they're doing. And you're intervening at times and you're adding, you know, and qualifying their work and hoping that they don't go rogue.

Mark Wilson: 

Again, back to this talk I gave this morning, I just put a little chart together about the hogging mask and the hogging mask and the open AI thing. And just watched the blackout video where the open AI guys walk through what happened. And all I could see was Skynet, Skynet, Skynet. And I didn't want to say that in the presentation, because I think that's a bit of perhaps fear mongering. But I'm looking at it thinking, this needs some severe controls and guardrails. And I've been a bit of a… a naysayer towards AI in our world. Six months ago, yeah, I think it'll be a bit of a problem. Be a bit of a problem. Yeah, yeah. And then I started using some of it. So I've moved from the green screen. I'm now, yeah, all the code I wrote and all the work I did, VS Code, got my Claude account, Claude Code, written some skills, doing all bits and pieces. So now I'm interacting with this stuff all of the time and you see the power of it and using it to go and fetch me this data. Can you have a look at this code? Can you analyze it? Then taking the results and putting it in a different tool and say, can you check the work of the other one? And I've got windows open on my desk that I'd never imagined I would ever have.

Greg Lotko: 

And you're using your human intelligence to oversee it.

Mark Wilson: 

Yeah, and it's almost being that supervisor. What's going on? Yeah, okay, that's done that, using it to check and balance. I edit Cheryl Watson's tuning letter, I'm the editor-in-chief of that. So I get an article submitted to me, I feed it in and say, go and fact-check it. And it goes away and it checks and comes back, that statement's wrong, here's the link to the Broadcom website that tells you how this works, or the IBM website. So use it as a tool, but also being very mindful of, you know, in the wrong hands, or even the right hands. can cause a lot of damage.

Greg Lotko: So I'm curious, watching what's going on out there, and I know you're self-playing directly with the tools, my theory is we have not reached artificial intelligence. The behavior of these agents, what we're witnessing is artificial adolescence. Is that what you're saying?

Mark Wilson: 

I could not agree more. I think, yeah. When you interact with them a lot, it's almost like a petulant child. It will say no. What do you mean no? And then you have to go back and challenge it and course correct it. And one of the youngsters back in the office, Nathan, super bright kid, and he's there tapping away, and he's using please and thank you. Can you do this for me please? Thanks for that.

Greg Lotko: 

Well, he's seen The Terminator and Skynet. So he's like, look, just in case, I'm going to be polite.

Mark Wilson: 

And that is exactly what he said. Smart guy. He said to me, he says, I'm being polite just in case I ever need to do something with it again. And I was like, wow. Just the mindset. I think we're in unprecedented times with it. I think the rate at which the language models and the AIs are growing… Maturing even. Yeah, maturing.

Greg Lotko: 

To keep with the chromatology.

Mark Wilson: 

Yeah, absolutely maturing. But then you look at what they're doing at industrial scale. scanning the legacy technology, not just mainframe, all the other stuff, but finding vulnerabilities that have been there for decades and decades, but not finding one or two, finding thousands of them. I did some research for this talk this morning and found a little website that said, you know, in a week, they found 15,000 vulnerabilities across 72 different projects.

Greg Lotko: 

Just look at what's going on with the published seconds, right? Yeah. The idea, we can see this, is people who have licenses to software across the ecosystem from other vendors, you can see that they're going up what they're publishing to 3X. So no matter what anybody's saying to you, we know they're using this technologies and finding other things to fix, which is the good thing. We're finding them; we're fixing them.

Mark Wilson: 

And we're seeing that in our day-to-day lives as systems programmers. You have to apply the patch. Yeah, and you know, it'd be once a month, once every two weeks. We're getting these things daily and sitting there and going through them. Okay, where's the risk? What's this? Put some context around it for our environment.

Greg Lotko: 

I think what we're going to have is AAA. Artificial Adolescence Assistance. That's going to be a new human job. Wow.

Mark Wilson: 

Yeah. I hadn't thought about it like that.

Daniel Newman: 

He's going to write a book about it. I think I'll patent it. Yeah. Patent? Patent? Yeah.

Greg Lotko: 

If I were going to write a book, I'd do it with a seven-time business book bestseller person.

Daniel Newman: 

He'd probably be nice to him. Yeah. No. OK. Please. Let's pivot. Quantum. Because AI is fun. It's here. It's staying. I think they're close cousins. I think there's definitely overlap, both megatrends. One's, I'd say, I've heard a lot of CEOs in the industry kind of say quantum is where AI was about five years ago, meaning that we're kind of at this precipice. I know the post-quantum photography. I like it further along than that. I'm just telling you what Sundar and others have said, you know. I don't know if he's right. I'm just giving attribution to some people that know a little bit about something. But the net is that whether it's, you know, five years, you know, ago, or whether it's the old joke about quantum being five years away from being five years away, there's one thing I think everybody agrees is the quantum networking and the security side, the risk is much more immediate. Meaning, you would argue, you know, a lot of people use 2030 as the line, but some will say it could happen before that. What's your sort of read on post-quantum cryptography? This seems to be the front door. And again, and talk about, you know, things that are controversial, supposedly, you know, decrypting Bitcoin and decrypting you know, most of these blockchain networks and all this, like, kind of, where are you at with that? And how do you, how are you advising organizations to prepare for that?

Mark Wilson: 

Today, especially in the mainframe space, you know, it's not about when should we do it. It's now.

Greg Lotko: 

And we're in this… Oh, I think it was yesterday.

Mark Wilson: 

Yeah. So it should be done already. Yeah, it should be done. If you go to large organizations now, they should have the inventory. They should know where all this stuff is. And they're not. They're not there. And you think, OK, well, OK, start now. Let's build the inventory, at least understand what we've got. And, you know, we're seeing some tools coming out from, you know, the big vendors out there coming out with the tools to help us make life a bit easier. But the peak you see is, you know, it's a thing now. And, you know, people who don't understand that are going to have a very big shock in a few years' time, 2029, 2031. It's not that far.

Greg Lotko: 

And the reason I said yesterday is because they may have already harvested it. Yeah. Right? Exactly.

Daniel Newman: 

By the way, for everyone out there, what does that mean?

Greg Lotko: 

I mean, they may have already harvested the data today. And even though they don't have the quantum cryptography, they don't have the computing power to do it. So they have the encrypted data.

Daniel Newman: 

They have the encrypted data.

Greg Lotko: 

And they're just waiting for the capability to decrypt it. And if you're not changing your passwords, if you're not changing your routes, if you're not updating your certs, it's just an issue lying in wait.

Mark Wilson: 

I would like to understand just how many of our potential businesses we interact with on a daily basis, our clients, actually encrypt the data anyway. Because there's so much of it still there lying unencrypted. And I had this conversation the other day with a CIO and he said, this is what we're going to do with post-quantum, we're getting ready, we're doing this. I said, but you've not shut the front door. I mean, the front door's wide open. Yeah, your mainframe security's all over the place. I said, so I don't need to worry about your encrypted data, because I can come through the door, get access to the keys, decrypt all the data, and take the data off. I'll use your mainframe to decrypt it, and then take the unencrypted data away.

Greg Lotko: 

Right, that's fundamental blocking and tackling security. And they're thinking just because the data is encrypted, I don't have to worry about security. And it's like, no.

Daniel Newman: 

Talking about buying a next great striker and they don't even have a goalie in the net right now.

Greg Lotko: 

Well, I was thinking you don't have to lock the liquor cabinet because it's inside the house yet you left the front door unlocked.

Mark Wilson: 

I mean, I've been doing, you know, I've been doing pen testing for years and years. And, you know, sometimes you have that moment, you're in there, you're knocking at the door for three or four days, four or five days. And somebody said, did you try this? And you go, no. And you try it.

Greg Lotko: 

Oh, right, and it's the obvious stuff. It's the obvious stuff. Literally, I had gates installed on my house, and I told the guy that I wanted it to have locks, iron gate, because I didn't want you to get into that little alcove. I came home, the guy said, hey, it's all done. We got the locks installed. Gates up, locks there, wrought iron. You could reach right through the wrought iron and unlock the gate from beyond. The lock worked perfectly, the gate was standing there, but you didn't look at the obvious next step. And we need to be thinking about the technology. What about the alligators in the moat that you have? No alligators, no moat.

Mark Wilson: 

So I think post-quantum's a thing and we need to be, the organisations need to be tackling that problem now. They need to be building those inventories, making sure they're running all the right ciphers everywhere. We've got now AES-256 everywhere, yeah, but it's all the infrastructure around it. Make sure you've gone and checked all of that because, you know,

Greg Lotko: 

So the reality is there's no lack of tasks that need to be done, effort that needs to be applied, or things that need to be accomplished. These companies should be hiring people, implementing AI. There's more than enough to do.

Mark Wilson: 

Back to the first thing, using the AI to help you discover this and catalog it and index it. So it's exactly what you said. They're tightly coupled, all of this stuff is tightly coupled.

Daniel Newman: 

There's no excuse not to know anymore. Absolutely. And, you know, there's tools now that can give you the insight immediacy and a good set of recommendations that can be, as Greg would say, human augmented to deliver the secure environment that businesses and organizations should be looking for. Just curious, because you are, you know, you're an inquisitive mind, quantum as a whole, Where do you think we're at with quantum computing? Because I know we kind of just hit on the networking side, but like, you know, when do you really think that side of the quantum story starts to take hold? I'm hoping after I've retired.

Mark Wilson: 

OK. Are we announcing when that is? Not yet. OK. No. I think, again, we've got to rethink the whole IT landscape when we get this technology deployed at scale. Not just in the businesses that are going to use it, but also all the threat actors, the nation states. How do we defend ourselves against that? Forget PQC, just the compute power itself. How do you defend it?

Daniel Newman: 

I think it's just so interesting to have computing, because the two work so, you know, they work almost opposite of one another, right? Quantum is incredibly good at solving problems with limited data inside of a space, like, hey, you know, I only have a small percentage of the data. It's very good in solving physical world problems with, you know, very little discriminant data or, you know. And on the other side, AI really only works when you have massive amounts.

Mark Wilson: 

See, I would say, we had this debate in the office the other day, and I'll go back to the young guy in our team who's very focused on this. Our belief is you don't give AI masses of data. You give it the right amount of quality data. Because if you give it too much, and we've done that with some of the stuff we've been trying. So we've got countless tools for pen testing and doing security assessments. And we found if we gave it a couple of the tools, it was quite close most of the time. Yeah. Yeah. But if you give it too much, it starts drifting and making stuff up and hallucinating.

Daniel Newman: 

Well, the problem is when you don't have enough deterministic data. Yeah. OK, what ends up happening is it will go out and it will find something. And it kind of, that's where the hallucinating starts to come. Or it'll just find a relevant source in Reddit, and then it will come back with the, what looks like really useful and realistic data. And that's why the whole idea of enterprise systems being replaced by AI, we're going to rip out SAP or Salesforce or Oracle, only if you were going to give all that deterministic data to the AI.

Mark Wilson: 

Yeah.

Daniel Newman: 

Because unless you give that database and all that structured data, What AI is gonna go do is it's gonna make up anything it can't figure out deterministically. And you're gonna get a lot of crap back. And as the CEO of Palantir likes to say, Alex Karp, I think he's a thoughtful guy, but he says the alpha of your business is basically in that proprietary data that you have in your systems of record. And the question is, is every company in the world going to give all that alpha to two companies so that they can basically know everything about how companies run? I think unless they're willing to do that, The idea that AI eats software, AI eats security, AI eats data platforms, AI eats services, AI is unrealistic because that thin layer of data, kind of like security, is something you can't just give up.

Greg Lotko: 

So I'll hop a little bit on the opposite side of the equation and pose a theory that I would be open to and I do think there is a path. The reality is I think there's more likelihood that AI could eat some portion of application software. And the reason I believe that is if you go back to the 50s, 60s, 70s, the businesses that were creating the operational application software to run their businesses were embedding their unique secret sauce of their business and their model into it. Now what ended up happening as you got into the 80s and the 90s is the amount of things you could do commonly across a space, whether it be ledger, payroll, billing, asset tracking, depreciation. That was so huge and common across companies that they actually forewent. They decided, hey, I don't have to have the unique part of my business in my applications. Or I'll add it on as a custom. and they went to, you know, SAP, whatever, standard software. I do believe there's opportunity in the world where those unique parts of software that AI will eat that application space. But the thing is… I don't even want to argue that. But there'll be a trade-off. There'll be a trade-off because the balance is… hey, do I want to buy a packaged app that may not hit it perfectly, but I don't have to worry about maintaining it? Or is the secret sauce of my business so unique that I want to keep it in-house and I'm willing to maintain it? And that'll become the divide.

Daniel Newman: 

Well, I think Satya Nadella called business, and the reason he said SaaS was at risk is he said it's, you know, they become deprecated CRUD databases with logic on top. And I think, you know, I just had a, you know, sit down yesterday with Mark Benioff, and Mark even acknowledged, like, that it will be both. But what will happen is that data layer will be secured. It will be in some sort of air-gapped environment where you're not just saying, hey, here's all my customer data, and here's all of our experience data, and here's all our operational data, Claude. Enjoy this and do whatever you want with it. It's going to sit somewhere, and you're going to let Claude API into it. But it's not allowed to pull that into its training set. Because otherwise, like I said, they could just build every company. And I've heard Dario say that in his memo or his little long form where he said, there's a world where we're the only company and everything else is just government.

Mark Wilson: 

We're looking at it with the stuff we're doing. And we're using the terminology of vault. So we've got a vault for that type of work.

Daniel Newman: That's unique. You can get it in your queries.

Mark Wilson: Yeah.

Daniel Newman: 

But it's not being used in any sort of way where it's training the model. No. It's only limited. It's your API or your MCP. Absolutely. It's protected in your little air-gapped environment. And you're not training anything. And I think that the future looks like that.

Mark Wilson: 

Yeah. I mean, there was a session yesterday from the guys at Morgan Stanley talking about MCP servers. And he said, with everything they're doing, they need three times the engineers. to get everything built and up and running. He said, so he's got a problem now, he's got to recruit and train. And what we've started to see for us, because we want security engineers and systems programmers, we're using it as a tool to fast track them, that first six months, help them and show them the new way. VS Code, Zoe, Z-O-A-U, Yeah, as well as Zoe and all that. Get them using those tools, not the old way of doing it. So they, they accelerate to a point really quickly, but we still got to keep getting the knowledge into them and just use it as a tool to help.

Daniel Newman: 

It's yet another tool. You know, wrapping this up and bringing this all home. It's all Jevin's paradox. It's all, as you know, is every time we solve a problem, we just see more scale. I mean, exactly what you just said, like the problem was, most people in the beginning when we were saying about replacement and displacement, we were thinking very linearly. I can build an agent to do the exact same APAR function as we need today, and it can do it really effectively. But what happens when there's 8x more required transactions because of the impact of agents? it doesn't end up being replaced. It ends up being, we need to augment this. Your point about engineers is like you've looked at the processor, we don't need to do it the way we always did it. We do it that way because that was the best of what was available to me. Now there's more available to me. Mark, it's always great to chat. Very, very thought-provoking conversation. Great to see you. safe flight, safe flight home. Thank you very much. Thank you everybody for being part of this episode of The Main Scoop. Appreciate you tuning in, being part of our community. Hit subscribe, join us for all of our great content here on The Main Scoop. See you all later.

‍