Daniel Miessler: prediction

Transcript context

…want to force put you in a emotionally stressful position for too long. But just one area there, because it is like your professional background and expertise. How do you see cybersecurity playing into this risk or this sort of family of concerns? We've got AI could go totally rogue and do something like extreme. We've got gradual disempowerment Empowerment where it's like everybody willingly and rationally at each step like. like gives AI systems more and more decision-making discretion, power, autonomy, whatever. And the next thing there's not really any humans in the loop anymore. And that might be like, okay, but now the AIs are really running the show and we're just along for the ride. And then somewhere in between is this like cybersecurity world where, of course, AI seems to amplify all the threats. It also seems to provide, at least have some promise for a sort of DAC infrastructure hardening or whatever. Another episode, hopefully I'll be doing before too long with a company called Asymmetric. It's literally just, as far as I understand right now, and I'm more to learn, but they seem to be really trying to do the like log reading that you were describing earlier. They said basically what happens when there's a security issue today in a company is people go do forensics on it and they try to get down to a root cause, but they only do that once harm has been done and now they're called to attention and they have to go investigate. And so their idea is basically, what if we just scaled cybersecurity forensics as much as is needed to read all the logs all the time and try to identify these things before they actually become critical issues or whatever, before harm is actually done. Anyway, that'll be an episode kind of coming soon. But where do you think we are right now in terms of, I don't even know how you want to frame it, but offense, defense, balance. Is cybersecurity about to become our worst nightmare or might we use AI to get it under control? Yeah, I think it's definitely a combination. My favorite frame for this is basically that the game, as of probably last year, definitely this year and going forward, is it's the attacker's AI stack against the defender's AI stack. That is the competition. So the goal of the defending security team is going to be how good of an AI stack can they build to actually do this stuff. So I've been doing this whole attack surface management thing for decades or so many people have also been doing this. It's about do you understand your attack surface, right? And with all these AI tools, the attack surface is everything. It's total knowledge of the company. It's total knowledge of every employee. Yeah, I built a thing that like it just finds all employees and creates a psychological profile on them, which allows me to write the perfect spearfishing email, right? And it's, oh, yeah, you adopt dogs. Therefore, here's what this thing looks like. And I could also figure out, oh, you're also one of the people making this core product. Oh, it's also releasing a new version. Oh, it's also running on this platform that's vulnerable. This is all work that a red team could have done, but it comes down to this concept of many eyes, which was supposed to secure us all this time with open source. But turns out the fact that humans could look at something doesn't mean they will. And that's what, that's the case with this, this asymmetric thing you're talking about, right? With all these logs. The logs are there. There aren't enough eyes. There's not enough time. There's not enough attention. Humans need to rest. They miss things. So it's a matter of maintaining state. You have to understand the state of your company, right? And this is, I think, the big picture here. If you understand the state of your company, what is your profit and loss? What are your goals? What are your competitors doing? What does your infrastructure look like? What is currently facing the internet? What applications are you running? What stack are they running? What vulnerabilities do those stacks have? What just changed in the last 13 seconds while I was saying that sentence? Right? Faster and faster granularity. Oh, this person left the company. Oh, so-and-so joined the company. Oh, that person is extremely vulnerable to this type of social engineering. So now we're going to spin up this entire thing, this campaign to go after them to get access to the company. Now, prior to this, all this could be done by a high-quality attacking team, high-quality pen testing team. I'm thinking more like attackers. So like a really skilled, advanced, persistent threat team. But they are very small teams. They are specialized in specific industries and verticals. And they could only go after so many companies just because of the time. Now we're in a situation, clawed code is the model here. mall teams. They are specialized in specific industries and verticals. And they could only go after so many companies just because of the time. Now we're in a situation, clawed code is the model here. Pi is the model here, where the attacker basically says, look, I'm an expert at going after these types of vulnerabilities. Spin up a capability to do continuous recon to find all employees inside of a company, produce psychological profiles. We've got another module over here that writes the social engineering attacks. We've got another module over here that does the network attacks and the scanning. And this beast, they basically just put in a target and it starts hitting them and it spins up all these different. different modules and agents and it's constantly hitting you. Now, on the receiving side, there's only one way to survive this and to defend. And that is you have to be doing the exact same thing. There is no game. You can't, we need to hire smarter people in our company. No, that's not going to work. It's not going to be enough. The only thing that's going to work for is helping them improve the AI, them helping the AI improve and get better. Because the scalability and the pace of change is actually what matters. So all that to say, it's attackers spinning up better and better versions of cloud code, basically, cloud code co-work or whatever. And I'm not saying they're only using that. But Anthropic did say that they've already seen automated attacks using cloud code being extremely successful. So these sorts of stacks attacking the planet, attacking all these companies, and then all these companies have to have a similar stack that's defending…

Stored transcript either side of the excerpt. The highlighted words are the published quote; the surrounding text is unedited source, never generated.