Full transcript

[00:04.9]
Good afternoon. My name is Christy Majoris. I am the regional analyst for North America here on Everbridge’s Global Insights team. Today I’m here to talk about a coordinated cyber campaign that targeted more than 30 community water systems across Minnesota earlier this week. These attacks quickly drew national attention and prompted a coordinated response from federal, state, local authorities.

[00:29.3]
But these weren’t the kind of cyber attacks that we typically think about where hackers are trying to steal sensitive information or deploy ransomware. Instead, these attackers went after the OT systems responsible for running the physical equipment inside the water treatment plants.

[00:47.8]
So in other words, the purpose of these attacks was to disrupt the physical operations of the facilities themselves and by extension, disrupt the delivery of essential services. Clean water in this case. In response to these attacks, several of the sites transitioned to manual operations or in some cases, briefly took facilities offline before restoring service.

[01:11.9]
And the good news is that affected water systems are operational. And officials have stated that drinking water remains safe for public use at this time. Investigations remain ongoing, but initial assessments have now indicated that the campaign was likely conducted by Iranian state linked cyber actors.

[01:34.5]
So why would Iran target water utilities in Minnesota? Well, the question isn’t necessarily why Minnesota, it’s why water facilities. And it’s possible that water systems, simply present an easy target because many community water systems are operating with older technology or smaller cybersecurity teams.

[01:57.5]
But ultimately the objective was less likely about water specifically and more about demonstrating the ability to disrupt essential services inside the United States. And this is especially important if that initial attribution to Iranian linked actors, proves to be correct.

[02:18.8]
These attacks are occurring against the backdrop of an ongoing military conflict between the United States and Iran. And in fact, just days before these water system attacks, cisa, the FBI, the NSA and the EPA issued a joint advisory warning, stating that Iranian affiliated cyber actors were actively targeting industrial control Systems, supporting U.S.

[02:46.3]
infrastructure. And this is something that our Global Insights team picked up on and issued a threat assessment for as well. And these Minnesota attacks do appear to be consistent with those warnings at this time. The biggest takeaway from this incident isn’t that water service was disrupted because it wasn’t substantially.

[03:08.9]
The real significance is that a suspected state linked cyber actor demonstrated the ability to reach systems responsible for controlling physical infrastructure. And although the impacts were limited in this case, this is a good example of how international conflicts don’t always stay overseas.

[03:29.9]
They are increasingly being fought in cyberspace. And this enables attackers to cause physical disruptions remotely. And water utilities are only one example, similar industrial control systems are used in energy, manufacturing, transportation, chemical, oil and gas sectors.

[03:54.0]
So for businesses and organizations, that’s an important shift. Cyber incidents are no longer just about protecting information. They are increasingly about protecting operations and ensuring that essential services can continue during an attack.

[04:13.5]
And there are some practical steps that businesses and organizations can take to reduce this risk, such as reviewing the security of OT environments, limiting unnecessary Internet access to critical systems, separating business IT networks from OT wherever possible, or regularly testing manual operating procedures.

[04:38.1]
Be better prepared in the event of an incident such as this. Our Global Insights team will continue to monitor the situation and the investigation, for indications of expanded targeting or evolving risks to critical infrastructure.

[04:54.1]
And we will continue to provide updates, as warranted. Thank you so much for watching.

Full transcript

[00:05.0]
Hello, my name is Zsolt Csepregi. I’m the senior regional analyst for the Middle East and North Africa at Everbridges Global Insights team. Today I will deliver an Update on the US Iran conflict. As of Thursday, July 30, the conflict appears to be again on an escalatory trajectory.

[00:23.1]
And while this round of escalation is still limited compared to the most dangerous previous rounds that we had in the last couple of months, there are still two developments that seem to be reshaping the conflict’s trajectory in the near term and also the Middle Eastern regional environment in the long term.

[00:43.2]
The first is that Saudi Arabia has carried out airstrikes together with the United States against Iran allied militias, inside Iraq that have been carrying out drone strikes against Saudi energy infrastructure in the last week.

[01:03.9]
Now we had unconfirmed reportings in the previous months that smaller Gulf states have been carrying out retaliation strikes against Iran after Iran was striking their territory. But this is the first time when we had a confirmed news that Saudi Arabia, the largest Gulf Arab state, has carried out major military operations against Iranian proxies and possibly Iranian operatives in another country.

[01:36.6]
This means that Saudi Arabia may be entering the conflict in a more robust way in the coming days and weeks. And this also raises the risk of retaliation by Iran or proxies and attacks against Saudi or other Gulf states, infrastructure in the near term.

[01:59.8]
The other development that is worthwhile to highlight is that after carrying out a number of attacks against Saudi shipping and energy infrastructure, the Yemeni Houthis, who are controlling the northwestern part of the country and are a group which is supported by Iran, they’re floating the idea that as Iran is threatening to collect fees from the Strait of Hormuz in any post war arrangement, the Yemeni Houthis are intending to collect fees in the Red Sea and thereby tax global shipping.

[02:43.6]
Now this is creating a significant pressure for global shipping because if the future of the Middle east transportation corridors is that both of these vital locations would be in effect taxed by a local, by a local state, in the form of Iran and local terrorist militia in form of the Yemeni usis, this would mean that not only the financial burden of these fees but the associated disruptions, military, any pressure, and threats that are connected to any kind of contested arrangement.

[03:28.7]
So we see that the US Iran conflict by while some may claim that it’s in some kind of a stalemate. It’s true that on the macro level we have some kind of a stalemate type of competition between the US and Iran where both are trying to calibrate the level of escalation.

[03:48.2]
But these two trajectories are showing that in the near term the conflict may involve the Gulf states more deeply so not only as a territory for Iranian strikes on US assets and other infrastructure but also as participant of offensive operations.

[04:08.0]
And also that the long term future of the Middle east and also global shipping will be decided in this conflict because if fee collection will be the norm in the Middle east that will reshape global logistics for many years to come.

[04:26.1]
We at Everbridge’s Global Insights team are going to monitor this rapidly developing situation in the coming days and weeks as the conflict progresses.

Full transcript

[00:07.3]
Hello, my name is Wyatt Kinney and I am the Asia Pacific Regional analyst for the Everbridge Global Insights team. A magnitude 7.1 earthquake struck southern Japan today, centered in Kumamoto Prefecture on the island of Kyushu. A Tsunami advisory was issued briefly before being lifted after no significant wave activity was detected.

[00:28.0]
Authorities also reported no abnormalities at nearby nuclear facilities. The earthquake caused structural damage. At least 50 reported injuries, although that number can change due to reporting and widespread disruption across the region. Local reporting indicates an explosion at a nearby mall in Kumamoto Prefecture where a partial collapse was reported and emergency responders remain on scene.

[00:52.5]
Additional impacts include damages to roads and buildings, localized fires and a derailed train and Yatsushiro rail services and airport operations were suspended while safety inspections continue. Also, power outages are affecting tens of thousands.

[01:09.6]
Response efforts remain ongoing. Approximately 300,000 people have been instructed to move to evacuation centers. Fire services, Coast Guard and Self defense force personnel have been deployed to support rescue operations as multiple people remain missing.

[01:26.4]
Authorities continue to assess damage while responding to persistent aftershocks across Kyushu. From a business continuity perspective, the primary concern is disruption to transportation, logistics and manufacturing. Kyushu is a major hub for advanced manufacturing, automotive production and semiconductor supply chains.

[01:45.8]
Interruptions to rail road, air transport and utilities may delay production from freight movement, employee mobility and time sensitive deliveries throughout the region. The near term outlook remains focused on aftershock activity and the pace of infrastructure restoration.

[02:03.5]
Additional seismic activity may slow rescue operations, prolong transport disruptions and extend inspections of buildings, utilities and critical infrastructure. The next several days will likely be defined by damage assessments and gradual restoration efforts for organizations with personnel, facilities or suppliers in Kyushu.

[02:23.2]
The immediate priorities are maintaining employee accountability, monitoring transportation and infrastructure updates and verifying supplier status and understanding how long it could possibly take for safe movement until normal operations resume.

[02:39.2]
While the full extent of the damage is still being assessed. The coming days will provide a clearer picture of the operational and and supply chain impacts across Kyushu. We will continue to monitor the situation and provide updates as more information becomes available. Thank you for watching.

Full transcript

[00:05.3]
Hi there. I’m Caitlin Gillespie, the chief of meteorology here at Everbridge, and this is your rapid resilience weather update. If the skies across the Northeast look unusually gray filtered, that’s not cloud cover or the traditional summertime haze. It’s wildfire smoke that has traveled hundreds and even some cases thousands of miles from fires burning across Canada.

[00:27.0]
Smoke is currently affecting a broad area of the Great Lakes through New York, southern New England, Pennsylvania, New Jersey and the Mid Atlantic. Conditions vary considerably by location, but air quality has reached unhealthy to very unhealthy levels in portions of the region.

[00:43.1]
Early this morning, visibility across the New York City metro had fallen roughly 3 to 5 miles, while purple or very unhealthy air quality alerts were issued across Washington, D.C. much of Maryland and Northern Virginia. So how does smoke from Canada reach the Northeast?

[01:00.1]
Wildfires release tremendous amounts of heat, gases and particles into the atmosphere. Strong fires can loft that smoke thousands of feet above the ground. And once it reaches that level, the smoke becomes embedded within the larger atmospheric circulation, and this can then travel multiple states or even across continents.

[01:19.9]
So, in our event, ongoing winds have transported smoke southeastward from the fires in Ontario and other parts of Canada, across the Great Lakes and into the eastern United States. A weak front moving through the Northeast has, helped carry this concentrated plume of smoke southward, while high pressure and relatively limited ventilation have allowed for some of those particles to remain over the region.

[01:43.0]
There’s also an important difference between smoke aloft and smoke near the ground. Smoke several thousands of feet above us can create that milky sky, reduced sunshine, and an orange and red appearance around the sun without necessarily causing severe air quality problems at the surface.

[02:00.3]
But once smoke is already traveling at, those lower levels, or when the daytime heating mixes elevated smoke downwards, the concentration of particles near the ground can rise quickly. This is when visibility deteriorates and the air Quality index, or aqi, can move into unhealthy categories.

[02:19.7]
The primary health concern are particles small enough to penetrate deep into the lungs and may aggravate asthma stimulus, copd, heart disease, and other respiratory or cardiovascular conditions. So, children, older adults, pregnant people, outdoor workers, and anyone with an existing heart or lung condition.

[02:38.5]
Those are particularly vulnerable folks that even though. No, okay, let’s rephrase from there. The primary health concern are particles small enough to penetrate deep into the lungs and may aggravate asthma, copd, heart disease, and other respiratory or cardiovascular conditions.

[02:59.6]
Children, older adults, pregnant people, outdoor workers, anyone with an existing heart or lung condition are especially vulnerable. But at, very unhealthy AQI levels, everyone should be reducing their exposure. So here’s what we can do. Check the current AQI through Air now or your state and local environmental agency before exercising, working or holding events outdoors.

[03:23.1]
Do not rely entirely on how the sky looks or smells, because smoke concentrations can change very quickly over short distances. When air quality is unhealthy, shorten or reschedule outdoor activity. Keep your windows and doors closed and even set your H Vac system to recirculate indoor air when possible.

[03:43.5]
Avoid adding more particles indoors through smoking, burning candles or other activities that create smoke. If you must spend extended time outdoors, a properly fitted N95 will help reduce your exposure to these fine smoke particles.

[04:00.1]
Follow your asthma or respiratory action plan and contact a healthcare provider if coughing, wheezing, chest discomfort or difficulty breathing worsens or does not improve. Now Looking ahead, Portions of New York and southern New England should see a gradual improvement as the main near surface smoke plume shifts further south, poor air quality may persist longer across parts of Pennsylvania and the mid Atlantic.

[04:25.4]
A more southerly wind approaching showers. This should eventually improve the mixing and help disper some of the smoke this weekend. But this is not necessarily a permanent all clear. Hundreds of wildfires remain active across Canada and this means additional smoke plumes may return when the wind pattern becomes favorable once again.

[04:46.7]
The bottom line the fires may be far away, but the health impacts are local. Continue checking the aqi. Adjust your outdoor plans when necessary and take extra steps to protect those vulnerable family members, employees and community members. Stay aware, stay safe and stay resilient.

[05:05.0]
Thank you for watching.

Full transcript

[00:07.5]
Hello, my name is George Chapli. I’m the Senior Regional Analyst for the Middle east and North Africa at Everbridge’s Global Insights team on Wednesday July 8th. US President Donald Trump has stated at the NATO summit in Ankara that the ceasefire with Iran is over leading to severe doubts about the security environment in the Gulf and the future trajectory and near term of the global energy market.

[00:33.4]
Now these statements came after a day of severe escalation in the Gulf. Iran has allegedly struck three commercial vessels transiting the Strait of Hormuz, after Iran has warned them not to use the Omani side of the shipping corridor.

[00:52.1]
In response the US Carried out strikes against Iranian military targets in the southern side of the country and Iran has counter retaliated against targets in Kuwait and Bahrain. Now the issue is that all this military action and the diplomatic messaging is now creating an interlinked escalation cycle where each one is feeding into the other.

[01:21.0]
The two sides are pursuing contradicting aims. Iran is trying to show that it can impose any kind of costs on vessels that are transiting the Strait of Hormuz outside of the zone that it considers its zone of control.

[01:40.8]
And on the other hand the US is trying to show that it can decisively answer to these strikes attributed to Iran and restore deterrents. Now both sides are threatening further strikes in the coming hours and therefore near term escalation is likely.

[01:59.4]
Now that doesn’t mean that the diplomatic path is closed. President Trump has explicitly stated that while the renewed strikes on Iranian targets are likely, the US Is still interested in sitting down with Iran and and negotiating further on reaching some kind of a lasting agreement on the cessation of hostilities, the permanent lifting of sanctions on Iran and access to the Strait of Hormuz and on the Iranian nuclear program.

[02:38.8]
Now the timing of this escalation matters as the U S Iran talks were already suspended due to the ceremonial funeral events that were held in Iran between July 3rd lasting until the 9th of July, for the late Supreme Leader Ali KHAMENEI, the US UN talks were supposed to continue after the 10th of July.

[03:10.6]
So this cycle of escalation should be Barclay C. As a breakdown of the ceasefire framework but also that the sides are trying to reposition and regain some kind of a leverage or increase their leverage ahead of any continued talks.

[03:30.8]
That said, while the diplomatic path remains, viable. It’s severely challenged. In the near term, the likely pathway is more escalation and in the Gulf, and potentially now that the June 17th memorand of understanding between US and Iran is over, there’s also a chance that Israel would renew, hostilities, with Iran.

[03:57.6]
For businesses exposed in the Gulf or having assets, the primary risk is of the kinetic nature both to any vessels transiting the Strait of Hormuz. The primary risk of strikes is continued to be in Bahrain and Kuwait where there are, US Linked, military facilities.

[04:19.4]
But if, the cycle of escalation continues, then the target set may expand to Qatar, Oman, Saudi Arabia, United Arab Emirates, and also as I mentioned, even to Israel. And also, the oil and gas market, exposure, is already creating ripple effects in the global energy markets that are, likely going to continue in the next couple, of days.

[04:55.5]
We at Everbridges Global Insights team are going to monitor the developments closely in the coming hours and days and going to provide updated analysis, in the following days.

Full transcript

[00:04.9]
Hello everyone and thank you for joining. My name is James Burr and I’m a Senior Regional Analyst for Europe, the Caucuses and Central Asia. Today I’ll briefly cover the current risk picture surrounding the ongoing Russo Ukrainian conflict focused on Russia’s most recent large scale missile and drone attack on Kyiv.

[00:20.9]
All information in this presentation comes from publicly available reporting. The key takeaway is that these attacks are creating more than just military challenges. They continue to pose risks to personal safety, business continuity, transportation and cybersecurity. Public reporting indicates that Russia recently carried out what has been described as its largest combined missile and drone attack on Kyiv since the full scale invasion began.

[00:47.1]
Using more than 70 missiles, nearly 500 drones, the attack struck civilian areas across the capital and at the time of recording have reportedly killed at least 20 people. It also reflects Moscow’s ongoing strategy of targeting urban areas and critical infrastructure.

[01:03.6]
Although Ukraine continues to intercept many incoming threats, shortages of air defence interceptors are reportedly placing increasing pressure on its defensive capabilities. Now, looking ahead, the main concern is that these large scale attacks from both sides could become more frequent and more disruptive.

[01:22.7]
For organizations with personnel or operations in Kyiv and across Ukraine and Russia, that could mean recurrent air alerts, temporary transport disruptions, utility outages, communications issues and interruptions to normal business activity.

[01:38.0]
But there are also wider regional considerations. Previous large attacks have prompted neighboring countries to increase air patrols and introduce temporary airspace Restrictions which can affect executive travel, logistics and cross border movement.

[01:53.5]
Across central and Eastern Europe, cybersecurity also remains an important consideration. While there is no evidence that this specific attack was accompanied by a coordinated cyber campaign, previous periods of military escalation have coincided with increased activity by Russian state linked and Pro Russian cyber actors.

[02:13.7]
Organizations and sectors such as government, defence, energy, transportation, logistics and telecommunications may face comparatively higher exposure. Now, looking ahead, Moscow is likely to continue using large missile and drone attacks to maintain pressure on Kyiv and other Ukrainian cities even if they do not significantly change the battlefield.

[02:37.6]
This suggests a sustained period of disruption rather than a short lived escalation. So for clients, the practical takeaway is to continue assessing travel to Kyiv carefully and where operations continue. Consider maintaining shelter procedures, reliable personnel accountability measures, redundant communications and contingency plans for short notice disruptions.

[03:03.9]
Organizations elsewhere in Europe may also benefit from monitoring transportation and airspace developments, reviewing sanctions exposure and regularly exercising cyber incident response plans. Overall, this remains a prolonged strategic risk environment rather than any single attack.

[03:22.0]
The greater concern is that repeated large scale strikes by Kyiv and Moscow could make disruption in major cities more routine, increase regional security measures and create wider, indirect impacts for businesses operating across Europe. Thank you for listening.

Full transcript

[00:07.6]
Hello, my name is George Chepregi and I’m the Regional Analyst for Middle east and North Africa at Everbridge’s Global Insights team. Today I will outline the current state of the U.S. Iran negotiations focusing less on technical details and more on the wider regional picture and its implications for business operations in the Gulf.

[00:25.0]
As of Wednesday June 24th the U.S. Iran negotiations are active and reportedly progressing. The but they remain highly contested and fragile. The June 17th memorandum of understanding between Washington and Tehran created a 60 day window to try to turn the ceasefire and reopening of the Strait of Hormuz into a broader settlement.

[00:44.6]
Yet key terms remain disputed in public almost every day. That is why this process feels so tense. Not only because the final result remains uncertain, but because even the most basic assumptions of each side’s minimum and maximum demands are still in flux. This constant noise around the talks is not incidental.

[01:02.8]
It is a core part of these high stakes negotiations on the nuclear inspections. U.S. officials have said that Iran has agreed to full monitoring while Iran has publicly denied plans for inspections of their damaged nuclear sites which are exactly those core assets which require international oversight on warmouths.

[01:21.2]
Washington has been clear that freedom of navigation is non negotiable and that Iran cannot introduce a tall regime in the strait even as Tehran is constantly asserting that a return to pre war status quo is not acceptable. On sanctions relief and access to frozen Iranian funds.

[01:37.8]
Reporting points to a phased economic concession plan but the scope, conditions and control mechanisms remain disputed. One especially notable point is the reported proposal for a 300 billion dollars reconstruction fund for Iran just weeks after it has struck its Gulf neighbors.

[01:54.9]
Creating an alarming precedent for many regional actors. These details matter and we are watching them closely. But the main takeaway is evident even before the exact terms of a comprehensive agreement are finalized or even whether one emerges in the next 60 days. The real story is that the negotiations already reshaping regional behavior, security conditions and the operating environment for years to come.

[02:18.9]
The talks have brought Iran back into the diplomatic equation in the region of after a period of deep isolation. It’s not normalized, it’s not trusted and it’s not fully rehabilitated. But it was brought back into the diplomatic and strategic center of gravity in the Middle East.

[02:34.8]
That fact alone is forcing a profound regional adjustment. It is important to highlight that this adjustment is not happening in neat blocks of states, even if that is often the simplest way to describe it. Gulf states are trying to secure US guarantees while they are also trying to keep channels open to Tehran.

[02:53.2]
States directly affected by Iranian attacks are seeking strength in selective security coordination, while they are also acting unilaterally when they see an advantage. Israel is watching for any, arrangement that constrains its room to act, especially in Lebanon, while also managing its relationship with Washington carefully.

[03:12.4]
As the U.S. focuses on its talks with Iran, cooperation, competition and diversification strategies are all playing out at once as countries try to keep their options open and prepare for whatever regional order emerges. For businesses, that means a highly complex operating environment.

[03:30.0]
Even if de escalation broadly holds. Let’s be clear, the upside is real. There is lower immediate war risk, a large scale restoration of shipping flows in the region, and the possibility of more predictable energy exports and trade conditions.

[03:45.2]
That matters not only for operators in the Gulf, but also for global supply chains that depend on reliable maritime transit statistics, stable energy pricing and reduced insurance and freight volatility. But the downside is just as important. Repeated disruptions, sanctions, ambiguity, shipping frictions, proxy flare ups and a corrosive and even toxic information space full of contradictory claims and threats that can undermine markets and corporate decision making before facts are settled.

[04:13.3]
The most likely outcome of the U.S. Iran talks is neither a clean diplomatic breakthrough nor a total collapse. It is a state of managed volatility that could reverberate across the Middle east for years. The region is entering a period of partial de escalation, contested implementation, setbacks and constant repositioning by both regional and global actors.

[04:33.9]
Whatever the final result of the talks between Washington and Tehran, Iran is back in the regional equation and the operational environment across the Middle east will now have to adjust to that reality as, this emerging regional order continues to develop. Everbridge’s Global Insights team will keep providing in depth analysis to to help clients understand the operational risks, disruptions and strategic shifts that are ahead.

Full Transcript

[00:04.9]
Hello everyone and welcome to this rapid resilience weather Update for Wednesday, June 18th. My name is Caitlin Gillespie and I’m the Chief of Meteorology here at Everbridge. Although Tropical storm Arthur has dissipated, the flooding threat across the Gulf coast and Southeast United States continues to intensify.

[00:22.7]
The tropical cyclone itself is no longer the primary concern, but instead a deep plume of moisture left behind. Arthur’s interaction with a frontal boundary and favorable upper level weather patterns that creates an environment very capable of producing repeated rounds of heavy rainfall and dangerous flash flooding.

[00:41.4]
The Weather Prediction center has issued and upgraded to a high risk or level 4 out of 4 for flash flooding across portions of the central Gulf coast today, including parts of Louisiana, Mississippi, Alabama and the western Florida Panhandle. This is the agency’s highest flash flood risk category and is only issued rarely.

[01:01.8]
Historically high risk events account for a disproportionate share of flood related fatalities and damages across the United States. The highest flood risk extends along and north of the I10 corridor. Major population centers including New Orleans, Baton Rouge, Mobile, Pensacola, Panama City, Montgomery and surrounding communities face the greatest potential for dangerous flash flooding today.

[01:27.3]
Additional flood concerns do extend northward into central Alabama and portions of Georgia, including the Birmingham and Atlanta metropolitan areas. Flood watches remain in effect across much of the central Gulf coast and portions of the Southeast with numerous flash flood warnings already occurring and have been issued along the affected corridors.

[01:48.1]
River flooding is quickly developing following several days of heavy rainfall over our quick response river basins. The flood threat is ongoing, which originally started last weekend over the western Gulf coast and will continue through the end of the week.

[02:03.5]
But today presents the greatest risk for widespread, potentially life threatening flash flooding. Multiple rounds of thunderstorms are expected to move across of the same areas throughout the day and evening. Importantly, the threat does not end tonight. The Weather Prediction center maintains a moderate risk or level three out of four for flash flooding Friday across portions of Alabama, the Florida Panhandle and Georgia as the deepest moisture now gradually shifts eastward.

[02:30.9]
Areas impacted by flooding today may be vulnerable to additional flooding tomorrow, especially where our, rivers, streams and drainage systems are already elevated and overwhelmed. Several ingredients are coming together to support this high impact flood event. Strong low level winds are transporting this exceptionally deep tropical moisture inland from the Gulf and we’re seeing moisture levels that are near record for mid June.

[02:54.7]
We couple that with plenty of atmospheric energy that’s supporting heavy rainfall rates. Rainfall rates may exceed 3 inches per hour within the strongest and more organized thunderstorms. Our forecast computer model guidance this morning indicates widespread rainfall totals of 5 to 10 inches across portions of the region with localized totals exceeding 12 to 15 inches in the hardest hit areas, storm total rainfall totals could approach 20 inches in spots.

[03:23.6]
Many locations have already received several inches of rainfall during the past few days. Soils are saturated, rivers are elevated, and much of the additional rainfall is expected to become runoff, increasing the likelihood of, flash flooding, river flooding, and rapidly deteriorating travel conditions.

[03:40.3]
So what does this mean for us operationally? Road closures, flooded low water crossings, transportation delays, facility access issues, and disruptions to workforce mobility are increasingly likely. Where heaviest rainfall occurs, urban areas, low lying roadways, construction sites and locations near smaller creeks and streams remain especially vulnerable even after the heaviest rainfall ends.

[04:04.6]
Lingering river flooding, standing water, road closures and access constraints may continue to affect operations into the weekend. So while isolated tornadoes, localized severe weather, coastal flooding and hazardous marine conditions all remain possible, the primary business continuity concern for us is the rapid onset flash flooding and repeated impacts across already saturated areas.

[04:28.9]
Organizations across the Gulf coast and Southeast should closely monitor flood watches, flash flood warnings and river forecasts. And please ensure that personnel have multiple methods or ways of receiving weather alerts. This is especially an extremely important overnight when flooded roadways can be difficult to identify and conditions may deteriorate rapidly.

[04:49.3]
Thank you for watching and stay safe.

Full Transcript

[0:05.2]
Good afternoon, everybody. My name is Adam DeLuca. I’m the director of Risk Intelligence here at Everbridge. And welcome to another rapid resilience video. Today I’m joined by Ignacio Brada. He is one of our leading cybersecurity expert here, and he’s the lead security and AI architect and a proud graduate of Michigan State University.

[0:23.5]
It’s good to see you, Ignacio. Good to see you, Ann. Go green. Yeah. Go white. You know, as we all know, the World cup is coming up in a couple weeks, and I think there’s a lot of threats on everybody’s mind, right? There’s travel challenges, language barriers. There’s going to be strains on infrastructure throughout this unique event that’s spawning three different countries and 16 sites.

[0:45.8]
Now, there’s also possibly domestic violent extremism under the, kind of backdrop of the political climate that we’re in here in the United States. But I don’t think a lot of people hear World cup and think cyber security risk and challenge. But we’re here to tell you today that there are real cybersecurity threats out there surrounding an event like this, and we want to talk about it.

[1:05.6]
So, Ignacio, a lot going on in the world right now. Can you just kind of give us a general overview of the cybersecurity threat landscape heading into the tournament? Absolutely, Adam. And it’s an incredible time. I think, in the cybersecurity world. Things, are changing fast.

[1:22.0]
AI is having amazing developments, and at the end of the day, AI is just a tool. So just how it’s helping us on the different side, the bad thing is that it’s helping the bad guys as well. So I’m sure a lot of people here, have heard about how, bad actors are using, the different LLM models to find zero labeling abilities, string exploitability, windows, since a vulnerability is discovered till someone is able to abuse it.

[1:56.7]
And also, it’s creating, you know, a lot of noise out there in the Internet. Scanners are getting smarter, by guys are using this in large amounts, and it’s relatively cheap. Surprisingly right to use these. Anyone can get access to these.

[2:13.4]
While some of the most dangerous, models are used mainly in research, the current models are pretty strong. And I do think that we’re, we’re, you know, heading into these FIFA, World cup with a lot of that in the news. But it’s also important not to forget the classic cybersecurity threats, right?

[2:33.0]
Phishing, QR codes, just sometimes you know, all the. With all the lights in the news, that captures all our attention. But it’s also very, very important to remember, that the traditional way of attacks, are still happening, and we need to be ready for those.

[2:51.3]
Yeah, well, those, types of attacks, those trade craft, are there for a reason, right? Because the social engineering is very successful. And with AI kind of accelerating the landscape, it’s also, broadening, the amount of threat actors out there.

[3:06.5]
Because AI makes these traditional apt groups associated with large nation states. Now individuals and smaller groups can kind of leverage the same technology and get some of the same results. Obviously, we have a developing situation going on in the Middle east with the Iran, Israel, United, States conflict.

[3:25.1]
Is there any heightened threat coming to the World cup based off of that conflict, or is it just business as usual? No, absolutely, Adam, I’m glad you brought that up. And let me start by saying this. Our organizations do not have to be politically active to become a cyber target here. Right?

[3:46.2]
With, a big event like the World cup, being visible, being visually connected, or being part of that, operational indispensable vendor, of the chain here makes you a target. So, it’s really important to think about that.

[4:02.3]
And then on the other side, I think that, you know, with everything going on in the world, and we’ve seen this in the past, right, the different political actors are trying to take advantage of this.

[4:17.6]
It could be creating disruption to create, political unrest. It could be maybe taking advantage of this for cyber espionage. So definitely, there’s a lot of angles there, that people need to be thinking about in order to stay on top of this.

[4:37.3]
I think one of the key things, right, is we need to understand what the core asset. So, for example, if you’re a broadcasting or streaming platform, the trust is really what separates you from the rest. If you’re a ticketing or payment system, you become part of the operation and the transactions there.

[4:55.5]
So, people can have used that or launch a, denial of service attack, to. To affect that. Not even, you know, if we talk about transportation, hospitality, local services, you know, people are working really, really hard with an increased demand.

[5:11.6]
So the door for, for attackers to, you know, sneak in is a little bit bigger than normal. So. So that’s. That’s definitely an area of focus, I think. And especially with all the geopolitical developments that we’re having, you know, nation state, are going to take advantage of that.

[5:29.2]
Yeah, I mean, it’s a good point. That you make. Because a lot of different sectors are involved, not only in the planning and the preparation for this, but, you know, on the operational side. So, you know, supply chain, you have transportation sector, financial sector, healthcare sector, you know, in these cities. And, you know, these threat groups can go after those sectors in a variety of different ways.

[5:48.0]
Like you’re discussing, you know, so you mentioned QR codes, you mentioned some other social engineering, kind of basic level, cybersecurity, hygiene, type issues. What are some of the other tradecraft and tactics that some of these cyber groups might be looking to leverage, during the event?

[6:07.0]
Yeah, I think, you know, definitely causing disruption. So definitely your denial of service attacks, are what, you know, if you look, if you look at some of those expert agencies, you know, Canada on their side, cisa, they have put a lot of, documentation out there talking about some, some of these things.

[6:27.1]
But, you know, ransomware, that’s always, that’s always there. They can, you know, they will definitely try to take, advantage of, the high volume of transactions and people and things happening, to try to try to find the door and be able to, get some financial benefits from it.

[6:44.7]
I would say, you know, for teams, it’s definitely important, you know, keep the user, and Employees, you know, aware of these. On paying, extra attention, I think, understanding, you know, what are the new traffic patterns that, you know, there’s online services might be expecting, increasing monitoring at the WAF layer, making sure that your dos, protections are in place, being able to scale up to handle the demand.

[7:14.5]
I think those are good things to look at. And Adam, let me just call out one more thing as well. Although it’s not a technical control, I think tabletop exercises are super important in these scenarios. Right. You can look at it, you know, at the top, at the top layer.

[7:30.0]
You have, places like Miami and cisa, right. The city of Miami and CISA did an exercise already specifically, for some of the World Cup. And, you know, if they can do it, I think small organizations can do it too. And this really helps you. One, make sure that you know how to react and respond.

[7:48.4]
And then to the coordination part, make sure you’re ready to coordinate. And potentially you could even find gaps, you know, depending what scenario you have, to be able to, to get in front of those before the bad guys do. Yeah, it’s kind of identifying those unacceptable consequences and kind of ranking a rich risk register. Right.

[8:07.9]
Like, of what you can afford and what, what amount of risk that you’re actually comfortable with. And when it comes to some of these cybersecurity threat actors and the impact that they can, you know, whether it’s ransomware, denial of service, or some of those traditional social engineering attacks, you know, they can cause a lot of disruption.

[8:24.7]
You talked about exercising, right, you mentioned a couple other things that businesses can do to mitigate this threat. But are there any other things that businesses and individuals associated with this event that they can do to actually improve their risk posture? Yeah, I think, you know, I think you call out great things, you know, knowing what your crown jewels are.

[8:44.7]
Right. In order to do a good risk metrics there, you need to know where your crown jewels are. What are those assets that cannot fail? What are those processes that need to be running in order for you to keep operating? And then, based on that, you can start making some risk based decisions.

[9:04.6]
Definitely user training, make sure people are aware and then all the technical controls that we talked about before with AI, I think you can also experiment on some new things. So I’ll give you some things that we’ve been looking at.

[9:21.2]
So for example, making sure that, you’re using AI to scan your public facing infrastructure, and going back to the scenarios. LLMs can be very, useful creating some scenarios for you and help you think about things that you haven’t thought about.

[9:37.6]
So if you’re planning on doing a tabletop exercise, make sure you spend some time playing with LLMs. See what scenarios they can come up with and see if they can look at angles that you haven’t really thought about before so that you can start thinking how you can react to some of those.

[9:54.4]
No, that’s a really good point again about, using AI defensively to monitor and even start recovery on some of these incidents that get into your organization. But Ignacio, it was really good to have you here. I just want to have one more question before you go.

[10:09.9]
Who are you rooting for? Yeah, well, I have my jersey right here, with the third star. So I’ll be rooting for Argentina, the last champion, and the United States as well. So hopefully one of those two, get the championship this year. Yeah.

[10:27.3]
Is somebody that comes, from Italian descent. Unfortunately, the, Italians weren’t able to qualify this year, but, we’ll be pulling for the United States States, over here in this household. But Ignacio, it was really great to have you here and get some of your expert, analysis on some of the threats.

[10:43.2]
Approaching the World cup this year from a cybersecurity perspective. You know, please stay tuned to Everbridge. We have the World cup covered from every angle, whether it’s cyber weather, violent extremism, cartel activity in Mexico. We’ll be producing and alerting and monitoring on all threats surrounding the event.

[11:00.2]
If you have any questions or concerns, please contact us. We’re happy to collaborate, Ignacio. Thanks again. Thanks, Adam.

Full transcript

[00:05.1]
Hey, everybody. Good afternoon. My name is Adam DeLuca. I’m the director of Risk Intelligence here at Everbridge. I’m joined by Caitlin Gillespie, our chief of meteorology. How you doing, Caitlyn? Hey, Adam. Thanks so much for having me. I’m doing really well. Excellent. So as everybody knows, the World cup starts here in about two weeks.

[00:23.6]
And it’s on everybody’s mind, not just because it’s a great event and it’s going to provide a lot of entertainment over the summer months where there’s not a lot of sports on, but it also is going to bring a lot of risks and highlight a lot of vulnerabilities for organizations, you know, nationwide.

[00:39.2]
And one of those is, obviously weather, is very topical on everybody’s mind right now. You know, with 16 host cities spread across the United States, Canada and Mexico, it’s kind of an unprecedented event in the way it’s set up logistically. But what are some of the major weather patterns that we typically see during June and July?

[00:57.9]
And kind of what host regions concern you most from a weather perspective? And what can you actually confidently say today, two weeks out? Sure. And I’ll tell you, Adam, I mean, really, June and July are some of the most operationally complex weather months across North America because we’re transitioning into peak summer, heat, thunderstorm activity, tropical moisture, wildfire season.

[01:22.0]
So the challenge for the World cup is the size of the footprint. The weather risk profile looks very different in Dallas than it does Vancouver, Toronto, Mexico City. So starting in the southern United States, especially that southern tier, the primary concern is extreme heat combined with high humidity.

[01:41.4]
Those considerations and conditions can create significant health and operational challenges for spectators, staff, transportation systems, medical and public safety agencies. Also today, June 1, is the kickoff of the Atlantic hurricane season.

[01:59.0]
So even when the Atlantic is on the quieter side, let’s knock on wood for a second, we still have to account for tropical moisture, heavy rainfall, travel disruption, supply chain impacts, and the possibility of short notice homegrown tropical systems near the Gulf or Southeast coast, especially over the next two months, that’s really when we see that style of system.

[02:19.7]
We’re also watching the Eastern Pacific. That basin’s already showing signs of early areas of interest. So moisture from that region can influence parts of Mexico and at times even the Southwestern United States. So even systems that never directly affect a stadium city can still create rainfall, flooding, travel or logistics concerns.

[02:40.8]
So frequent thunderstorms, another major concern. These storms produce lightning, heavy rainfall, local flooding, short notice disruptions. And lightning, of course, really remains one of the leading causes of event interruption because it forces that immediate shelter decision with little notice.

[02:57.4]
Oftentimes, in Mexico, Monterey, we can experience, of course, the summer heat, but Guadalajara and Mexico City, we’re at elevation. Urban heat, lightning, heavy rainfall, and large population concentrations also play that role. So, you know, in moving into Canada, while temperatures may not reach that same extreme levels, the southern United States heat can really be a concern because those, those large outdoor gatherings, and urban environments can increase that heat stress, especially in populations that are less acclimatized, to prolonged heat.

[03:29.8]
So what I can confidently say today is that heat is certainly our highest weather confidence concern and signal heading into the tournament. The exact timing of thunderstorms, tropical systems, or any of those wildfire smoke episodes, those become clear as we move closer towards individual match windows.

[03:47.9]
But for resilience perspective, the cities that concern me the most are not necessarily the hottest cities, but the cities where weather hazards intersect with large populations, transportation networks that are complex, critical infrastructure, and just overall event operations.

[04:04.9]
that’s a lot of interesting points there, Caitlin. And I think, you know, you touched on it a couple weeks out. You know, we can anticipate thunderstorms or things that, you know, we know heat is gonna, gonna be a factor, not just for the people playing it, but the people organizing it and some of these events surrounding it. So if you were advising FIFA today, let’s say, you know, would heat be your number one weather concern?

[04:25.2]
Because you know, we talked about the heat. Obviously, thunderstorms, lightning could cause shelter in place, tropical storms, even wildfires. Right. Like, we didn’t really touch on that. What would you mostly focused on if you’re an organization? No, I love this question. And of course, yes, heat, I think, remains that number one concern because it’s the most widespread, it’s the most persistent, and just the overall, just most complex risk across our tournament.

[04:52.3]
A thunderstorm or tropical system that can affect one city for a limited period of time, it kind of has that expiration time. Right. But he can affect multiple host cities simultaneously and persist for days or weeks. So the challenge for us is really not just a single hot day.

[05:08.0]
It’s the cumulative strain that develops over time. The conversation focuses mainly, of course, on the athletes and match conditions. But from a holistic resilience perspective and standpoint, the concern is much broader. Heat can impact spectators, security personnel, transportation workers, volunteers, the medical teams, and even the broadcasters waiting, in the queues and the venue staff.

[05:31.1]
So while simultaneously increasing the demand on energy systems, transportation networks, healthcare resources, and public safety operations. And especially if our overnight temperatures remain warm, there’s also the less opportunity for people, buildings and infrastructure to recover.

[05:48.8]
Heat really creates that, potential for both resource fatigue and warning fatigue. Medical personnel or public safety agencies and transportation ops, the venue staff and security, they all may be operating under that elevated stress for extended periods, but there’s also the risk of warning fatigue.

[06:07.4]
So where the repeated heat advisories, extreme heat warnings, that can lead people to become less responsive to the message, even as the operational risk certainly remains elevated. And so maintaining that effective communication, preserving that sense of urgency, becomes just as important as monitoring the weather itself.

[06:26.5]
So that said, like you mentioned, heat’s not the only concern. Lightning remains that hazard that’s the most likely to trigger that immediate operational disruption. It can force rapid sheltering. But heat rises to the top for me, and quite literally, scientifically, as the hazard is most likely to affect the broadcast, the broadest range of people, locations and operations at the same, same time.

[06:49.0]
Yeah, you know, I think you touched on the key point. For me, it’s the effect heat can have over a prolonged period of time on infrastructure. Okay, so like the healthcare system is going to be strained. Obviously, heat over a prolonged period of time has a real serious impact on energy and providing, you know, what that looks like to millions and millions of individuals, around the country.

[07:10.9]
So you know, how heat affects infrastructure and the strain it puts on it over a tournament of this length is going to be something that obviously organizations are going to really need to keep an eye on. But if you are an organization, you are supporting the World cup, whether that’s a sponsor, logistics provider, security teams, corporate travelers, what can they do to improve their operating posture and limit some of the safety issues that heat and thunderstorms can have, leading up to the matches?

[07:39.7]
Yes, absolutely. And get to put the emergency manager hat back on. Organizations that perform the best during these major events are not necessarily the ones with the best forecast. They are the ones with the best decision making process tied to the forecast.

[07:55.1]
So a couple of things, you know. Number one, establish weather thresholds and predefined actions well before the tournament begins. Don’t wait for the heat advisory, the lightning threat or that air quality alert to decide what you’re going to do. Identify the conditions that matter, the impacts that they create and the actions that you’re going to take when those thresholds are reached.

[08:16.6]
Second, focus on protecting people. Heat mitigation plans, hydration strategies, cooling areas, your workforce rotation schedule, and your medical surge planning should all be established before match day. So protecting personnel ultimately protects operations.

[08:34.1]
Identify those critical dependencies. I like this point. Because weather rarely creates the biggest disruption directly. The larger disruptions occurs when weather affects a dependency. So transportation, staffing, communications, power supply chains or public safety.

[08:51.4]
So organizations, we should be asking what happens if transportation is delayed? What happens if power reliability is affected? What happens if air quality deteriorates or if a venue or fan zone has to temporarily shelter in place? What happens if our deliveries or staffing or executive movement are disrupted?

[09:09.8]
So understanding these downstream impacts is essential to maintain that continuity aspect, increase our monitoring as our event approaches. Our seasonal outlooks that we discussed in our awesome webinar last month, those provide great strategic awareness. But operational decisions should now start to rely on the shorter range forecast and real time intelligence.

[09:31.1]
So as we move into like that five to seven day, but certainly within that 72 hour window, organizations start to shift from planning mode into that operational readiness, and maintaining that common operating picture. The most resilient organizations are those where security teams, logistics providers, venue operators, emergency managers and the public safety folks.

[09:53.4]
We are all operating from the same picture, with the same information. And so when our stakeholders are sharing information quickly and consistently, they can make those decisions before small disruptions become the large operational problems. At the end of the day, weather intelligence really only creates value when it informs action.

[10:13.4]
So the organization that, that performs the best are the ones that really connect weather information to decisions early enough to stay ahead of a curve. Right. I think you touched on a couple really important mitigation strategies that highlight and kind of separate what successful organizations do and then, what some organizations might get caught off guard.

[10:33.6]
One is scenario planning. You know, we talked about it on the webinar, a month ago, with, with the planners out in Los Angeles talking about how important it is to, to plan for scenarios and exercise with your people so you know how to make those decisions. When something does go wrong, you know, it just shows how important it is that flexibility and then also identifying your unacceptable consequences, you know, due to weather, you know, it is, it can be unpredictable.

[11:00.1]
But, you know, if you’re identifying your unacceptable consequences and your risk regime register, you understand how we can start to prioritize and approach risk and become more resilient. So, you know, I, I do want to say thanks for joining us today, Caitlin. It’s always a pleasure to get to talk to you. Who you got in the tournament? Who are you rooting for?

[11:17.2]
I mean, of course, Team usa. I’m rocking with them. Absolutely. How about you? How about you? Well, you know, I’m not too confident in their, in their chances this year, but I am an American through and through, will be rooting for the United States, win or lose. But just looking for an exciting tournament and some good entertainment and hopefully everybody can stay safe from the weather and all the other risks, that kind of come up due to an event of this size.

[11:41.8]
So Everbridge will continue to report on any and all risks and vulnerabilities associated with the World cup, both forward leaning and strategically as well as tactically during the tournament. So, Caitlin, thanks again for joining us. Talk to you soon. Thank you so much.