Dichotomies

If you follow me on the socials, you might have noticed me saying that "I miss nuance" a number of times lately. I thought I'd try to shake out few takes on some of the less-productive Cybersecurity X AI "camps" I've seen forming over the past few weeks.

Yes, I believe that AI could rewrite a lot of today's deployed software within the next 18 months, on it's currently trajectory of improvement. No, I don't believe that this could be practically implemented into the wild within the next 18 months.

Yes, the attack surface is accelerating and getting more diverse, with AI showing up as a tool, a target, and a threat now. No, I don't see this prompting a change in focus or fundamentals, only an increase in the tempo and the urgency of them.

No, not every vulnerability that's actually exploited by an attacker to cause harm is a CVE. Yes, real AI-assisted exploitation is happening - If you're an attacker and not using AI in your toolchain, that's as daft as being an engineer and not using it to improve your productivity, or to help you fill gaps in your knowledge.

No, the PHP bugs aren't easy to develop a broad-spectrum exploit for, in spite of PHP being very widely deployed. Yes, I still think you should patch or update, because a lot of eyes (both human and human+clanker) are now on these codebases.

Yes, this is a thing that happens sometimes - vulnerability discovery and vulnerability exploitation are very different crafts. Yes, other times you end up with a log4shell and a reliable multi-platform exploits showing up in a tweet. No, this is neither a recommendation for apathy, nor is it one for panic - It's a comment on the need for vigilance.

Yes, I think dealing with memory corruption bugs is important, and will only get more important. No, this isn't the only thing that attackers exploit. Trust relationships, configuration issues, secrets and data where they shouldn't be, etc, are all a) easier to attack, b) more pervasive, c) harder to fix at scale.

Yes, when I say "AI" I'm referring to LLMs and commoditized access to them as a step-function technology shift. No, I don't just mean OpenAI and Anthropic when I say AI.

No, I don't think the frontier US labs are the authority on cybersecurity (and certainly not on cyber risk) - For the better part I think a lot of what we're seeing at the moment is a product of leadership actually seeing into the abyss for the first time. Yes, I think that the US labs are currently the primary drivers of awareness around the risks that cybersecurity operators have been warning about for 30+ years. Yes, I think that awareness is a good thing.

Yes, I believe that AI will play a key role in securing the Internet going forward. No, I don't believe it will be complete (and no, saying that I think AI is important doesn't make me a shill - It still takes a crowd, and 9 out of 10 bad guys agree).

Yes, I like to try to see around corners. It's called stochastic analysis and as a discipline it most deeply involves an understanding of the present and the past. Yes, a lot of futurists are talking out of their asses at the moment. No, I don't think futurism is "cooked". It takes what's available at present and uses it to attempt to shape a better future.

No, I'm not AGI-pilled - I'm people-pilled. Yes, I think of AI in a similar way to how I thought about the Internet in the 90s or mobile in the 00s - We don't know what the exact parameters will be, but I think it's safe to assume that it's a technology class that will touch almost everything in some shape or form.

Yes, I think the vulnpocalypse is here, if by that you mean "there are a crap tonne of vulnerabilities and exploit pathways that are out there and unfixed". Yes, this was a pre-existing condition… ask me how I know this. No, I don't think the vulnpocalypse is here, because in my mind it involves commoditized AND industrialized exploitation which is not something we've seen yet. No, exploitation attempts don't count. Yes, I think that breachpocalypse is a far more suitable term.

Yes, I think it's a still slopdemic, because to me "slop" means "something that is AI-generated and of little or no actual value to the end-user" - Attackers and defenders alike haven't turned the corner from taking all the information, analyzing it, and turning it into actionable intelligence yet. No, this isn't meant as a "KEEP CALM AND CARRY ON" statement - I actually do believe the risk is real and accelerating.

Yes, I do believe that a true vulnpocalypse is somewhat inevitable. Yes, I think AI plays a key role in mitigating that, as will all of the other automations and technologies we've developed over the past 50 years. No, I don't believe that's a reason to a) entrust AI (or those controlling it) to suddenly and magically fix everything, or b) give up on trying. No, I don't think this is a doomer take, it's an observation that there is a lot of work still to be done.

Yes, panic is unproductive. Yes, apathy is also unproductive. No, the argument about which one is "correct" isn't productive either.

Yes, I think we need to make risk sexy again. This entire conversation has become far too one-dimensional.

tl;dr: AI is probablistic towards deterministic decisions. Risk distills these choices back into a probability, and this has always been true. The vulnerabilities were always there. AI is here to stay. Defender and attacker capability and increasing alongside eachother. Attackers still have the agility advantage.