It is neither common nor unusual for a FAM to confirm their identity either explicitly or implicitly. I've had one go the implicit route once in response to, "how many runs this week?"

The bottom line is, the baddies know at least as much as we, if not more. Neither your agency nor the FAM's is effective. Your bosses may lay claim to a lack of publicized attacks since -- you know when -- but both the good news and the bad is that aviation is no longer the significant target. The really bad news is nobody knows what the target is.