NightVision Interview with FBI Cyber Assistant Director Brett Leatherman | Recorded live at Black Hat 2026, Las Vegas
THE TAKEAWAY
FBI Cyber Assistant Director Brett Leatherman joined NightDragon Founder & CEO Dave DeWalt live from Black Hat 2026 to detail Operation Riptide, a 60-day campaign that disrupted ransomware infrastructure and led to over 200 arrests of cyber actors worldwide. Leatherman explained why ransomware attacks and payments have dropped sharply, why fast information sharing with the private sector is central to the FBI’s cyber strategy, and how AI is compressing attack timelines from days to minutes.
Speaking with Dave DeWalt at Black Hat 2026, FBI Cyber Assistant Director Brett Leatherman laid out how the Bureau is scaling its offensive posture against cyber criminals, and how artificial intelligence is reshaping both sides of the fight.
What is the FBI’s strategic priority in cyberspace right now?
Leatherman said the FBI, a 118-year-old law enforcement agency and a member of the U.S. intelligence community, organizes its work around four operational divisions: counterterrorism, criminal, counterintelligence, and cyber. Under the current administration’s strategy, the Bureau’s cyber priority is shifting the risk calculus away from victims in the U.S. and onto cyber actors themselves, domestically and internationally. They are imposing real cost at scale rather than treating cybercrime as low-risk for attackers.
“We like nothing more than to impose costs on bad guys.”
Brett Leatherman, FBI Cyber Assistant Director
What is Operation Riptide?
Operation Riptide was a 60-day campaign to scale the FBI’s work against cyber actors through 17 joint, sequenced operations, including targeting actors’ infrastructure, communications platforms, money, and tools to disrupt the broader cybercrime ecosystem. One example: FirstVPN, an anonymization service used by more than 25 ransomware groups to hide their identity, was dismantled through technical operations. The FBI also leveraged partnerships with Google, Lumen, and other companies to take down residential proxy networks that gave actors cover to target the United States.
Over 200 cyber actors were arrested globally in a two-month span, with an additional 50 charged and a number of extraditions to face charges in the U.S. Leatherman noted the scale is without recent precedent for the Bureau’s cyber work.
Why does public-private partnership matter so much to FBI cyber operations?
Leatherman said no discipline within the FBI depends on industry relationships as heavily as cyber does, for two reasons. First, companies doing threat intelligence work often see threats before the FBI does — but that only helps if it’s shared quickly, so the Bureau can move upstream against actors and infrastructure. Second, victims who report breaches early give the FBI’s 56 field offices — each with dedicated cyber teams — the ability to support incident response while also enabling upstream action against the attackers themselves.
How is AI changing the speed and shape of cyberattacks?
According to Leatherman, AI isn’t changing the fundamentals of how attacks happen — it’s compressing the timeframes dramatically. Citing industry reporting from Palo Alto, he noted data exfiltration that once took days now happens in minutes. His takeaway for defenders: AI has to be deployed quickly and smartly in the highest-risk areas of the environment, because adversaries are already adopting it at scale.
“It’s compressing the time frames dramatically.”
Brett Leatherman, on AI’s impact on attack speed
Watch the Full Interview
About NightVision
NightVision is NightDragon’s ongoing interview series, hosted by Founder & CEO Dave DeWalt, featuring conversations with the government, military, and industry leaders shaping cybersecurity, defense, and national security. This is the second in a special four-part series with the leaders our nation has entrusted with its cyber defense. New episodes are available on the NightDragon site, YouTube, Apple Podcasts, Spotify, and Amazon Music.