Activate Industry!: Moving Beyond Defense to Disruption and Active Defense

Sandra Joyce, VP of Google Threat Intelligence, presents a keynote at RSA Conference 2026 advocating for a shift from passive intelligence sharing to proactive disruption of cyber adversaries. She highlights the evolution of cybercrime, citing a drop in median time from initial access to handoff from 8 hours to 22 seconds, indicating pre-planned partnerships. She discusses the impact of AI on attack speed, scale, and sophistication, and argues that defenders must go upstream to disrupt at the source. Google’s disruption strategy is built on four pillars: civil legal action, public disclosure, technical takedowns, and product hardening. She provides case studies: the takedown of IPIDEA residential proxy infrastructure, which reduced traffic from exit nodes by 90% for Okta and 75% for Comcast; the disruption of a certificate reseller that led to mass revocation of malicious certificates; and the takedown of GRIDTIDE, a PRC-nexus espionage campaign. She also outlines Google’s approach to securing AI, including disabling malicious infrastructure, hardening models, automating vulnerability hunting, and developing advanced defenses. She concludes by calling for industry-wide collaboration and a whole-of-community approach to make disruption the new status quo.