Key Takeaways: Defending Tribal Enterprises Against AI-Driven Cyber Threats
Written by Olivia Fellows, TribalHub Industry Engagement & Narrative Producer in General Articles
Date: October 16, 2026
As artificial intelligence accelerates both the speed and complexity of cyber threats, tribal nations and gaming enterprises are revamping their digital defenses to move beyond simple compliance and toward automated, real-time protection.
Industry leaders and cybersecurity experts with Okta, CrowdStrike and Zscaler gathered virtually for the TribalHub webinar "Unifying Cyber Defense Safeguarding Tribal Nations & Gaming Enterprises in the AI Era," centered on how tribal enterprises can counter AI-driven threats. Panelists emphasized that static security audits, outdated multi-factor authentication, and unmonitored administrative access leave critical infrastructure vulnerable to increasingly sophisticated adversaries.
The AI Threat Spike and Vulnerability Realities
Panelists emphasized that artificial intelligence has fundamentally changed the speed of cyberattacks. Recent industry data shows an 89% increase in AI-driven or AI-enabled cyberattacks over the past year, alongside a 180% surge in vulnerability exploitation as an initial breach vector.
Keynote panelist Renita De Stefano, owner and chief executive officer of Second Derivative, LLC and former CIO/VP of Information Technology at Seneca Gaming Corporation, noted that bad actors are leveraging AI to discover and exploit system weaknesses faster than organizations can patch them.
"There’s an 89% increase in attacks that are driven by or enabled by AI adversaries over the past year," De Stefano said. "On top of that, our ability to patch our way to resilience has been greatly impeded by bad guys leveraging AI to accelerate their ability to exploit a vulnerability."
De Stefano stressed that stolen credentials and unpatched vulnerabilities remain the top two access paths for attackers. In many tribal governance and gaming environments, legacy administrative accounts, obsolete test profiles, and unmonitored service accounts linger without proper security controls, creating massive liabilities if compromised.
Moving Beyond Point-in-Time Compliance
A central takeaway from the panel was the distinction between passing a scheduled security audit and maintaining active, real-time security.
Jake Kwan, executive strategist at CrowdStrike, explained that relying strictly on periodic audits creates a dangerous illusion of safety.
"The audit is going to say that the controls were right on audit day, but it doesn't say that by month four, multi-factor authentication got switched off to fix an integration," Kwan said. "Compliance does become a byproduct of security rather than a competing project."
Sean Frazier, Okta's federal chief security officer, reinforced that audits verify existing protections rather than serve as the architectural blueprint.
"Compliance is definitely not real security," Frazier said. "Audits are a point in time, and I think you see a lot of frameworks moving to more continuous monitoring. You run the audit to make sure you're doing the right things and catching the holes you might not have gotten right."
Phishing-Resistant Authentication and Joint Defense
As adversaries adopt advanced adversary-in-the-middle attack kits, traditional multi-factor authentication methods like SMS text codes or basic push notifications are frequently bypassed. Panelists urged tribal organizations to shift to phishing-resistant, device-bound authentication and, where possible, eliminate traditional passwords.
"MFA is ineffectual at this point if everyone thinks that every MFA is created equal," Frazier said. "If you deploy an SMS-based MFA or even a push-based MFA, attackers can bypass that every single day, twice on Sunday. We need to start thinking about what phishing-resistant means and deploy that."
To protect lean tribal IT teams against rapid lateral movement, where adversaries can compromise a system in under an hour, the panelists demonstrated how integrated defenses work together automatically:
- Endpoint Containment: Security platforms like CrowdStrike Falcon detect anomalous behavior on unmanaged devices and isolate compromised hosts within seconds.
- Identity Revocation: Identity management systems like Okta ingest endpoint risk signals to immediately revoke active user sessions and access tokens.
- Network Access Termination: Zero-trust architecture platforms like Zscaler automatically cut off inline application access for flagged devices, halting lateral movement across the enterprise or casino floor.
Jared Swimmer, Zscaler's account executive for the tribal sector and a member of the United Keetoowah Band, highlighted the power of coordinated ecosystem controls.
"Instead of placing users on the network where they can scan the whole environment, Zscaler connects verified users directly to specified authorized applications only," Swimmer said. "By using us together, we serve as that team... If you're not there in the house, we serve as that team that's there watching for you."
Prioritizing Real Risk and Building Internal Talent
Addressing audience questions about legacy vendor contracts, De Stefano advised tribes to include strong data sovereignty, data governance, and performance-based termination clauses in all procurement processes.
Kwan added that leaders must weigh potential contract cancellation fees against the true financial risk of a cyber incident, noting that recent major gaming industry ransomware attacks have cost enterprises over $100 million in operational downtime and recovery.
The session concluded by emphasizing workforce development. Panelists agreed that cybersecurity awareness must be treated with the same operational necessity as food safety or Title 31 financial compliance certifications in gaming operations.
Several organizations highlighted ongoing initiatives to expand cybersecurity training within tribal communities, including Second Derivative's partnership with ISC2 to offer free foundational training, as well as Zscaler’s collaboration with the Tribal Leadership Council and the University of Nevada, Las Vegas, to establish certified academic training pathways.
"Training is training is training all day, whether it's as it relates to your food and beverage outlets serving safe food, or making sure you can spot a fraudster," De Stefano said. "It needs to be looked at in the exact same vein."
To watch the full 60-minute webinar, visit TribalHub's official YouTube channel.
To watch the full 60-minute webinar, visit TribalHub's official YouTube channel.