Biography
Nishawn Smagh is the principal intelligence liaison and a senior executive at GreyNoise Intelligence, where he leads collaboration with global government and enterprise partners to enhance their ability to detect, understand, and respond to advanced cyber threats. Drawing on decades of operational experience, he helps organizations strengthen both their offensive and defensive capabilities—advising on how government and commercial enterprises can counter sophisticated adversaries, defend critical networks, and outpace rapidly evolving APT tradecraft.
In his role at GreyNoise, Nishawn connects real-world threat activity to actionable intelligence, helping partners detect and disrupt adversary operations at speed and scale. His mission is to empower operators and decision-makers with the insights needed to anticipate change and build resilience in an increasingly contested digital domain.
A retired U.S. Air Force intelligence officer with 25 years of service, Nishawn most recently served as Director of Intelligence for the Cyber National Mission Force at U.S. Cyber Command, leading intelligence operations for a 2,000-member joint command charged with deterring, disrupting, and defeating malicious cyber actors. Throughout his Air Force career, Nishawn commanded at the squadron, group, and wing levels, leading intelligence operations across multiple global theaters. His decorations include the Defense Superior Service Medal, two Legions of Merit, the Bronze Star Medal, and the Defense Meritorious Service Medal.
Nishawn is a graduate of the U.S. Air Force Academy and holds master’s degrees in International Relations and Management. He completed professional military education at the U.S. Army Command and General Staff College and undertook senior development education at the Congressional Research Service, Library of Congress, where he supported congressional oversight and policy analysis on national security issues.
At GreyNoise Intelligence, Nishawn brings deep operational and intelligence leadership to the private sector—helping partners bridge the gap between strategy and execution to anticipate threats, enhance detection and response.
Abstract
Title: Machine-Speed Conflict: What Internet-Scale Data Reveals About Threat Actor Evolution
Abstract: GreyNoise telemetry indicates that cyber adversaries are gaining access to vulnerabilities prior to public disclosure. The research indicates that threat actors employ AI-assisted reconnaissance and machine-speed exploitation, compressing vulnerability weaponization timelines from weeks to hours. Most significantly, it reveals that attacker behavior itself offers predictive signals: An analysis of 216 malicious activity spikes from the GreyNoise Global Observation Grid revealed that 80% preceded CVE disclosures by up to six weeks.
This presentation summarizes 12 months of internet-scale threat telemetry from GreyNoise’s Global Observation Grid, revealing fundamental shifts in adversary structures, motivations, and operational tactics. Through analysis of billions of malicious observations, we document the industrialization of cyber operations—where threat actors operate as distributed automation ecosystems rather than individual operators.
The key take-away is that attacker behavior offers predictive signals, providing defenders with an actionable early warning window. Defense must evolve comparably—leveraging automation, behavioral analytics, and predictive intelligence derived from internet-scale observation.
