Am I the only one not understanding the issue around increased Cybersecurity capabilities?

If we consider the amount of RCE/CVE in a software to be limited, I expect these models to result in massively more secured softwares, not less.

▲

jrflo 2 hours ago | parent | next [-]

Not a security guy but my understanding is: you only need to find one flaw to exploit a system, to make a system totally secure you need to find them all. It's inherently easier to use these tools offensively rather than defensively.

▲

ofjcihen 2 hours ago | parent [-]

I’m a cybersecurity guy.

>” you only need to find one flaw to exploit a system”

I see this everywhere, especially in these threads and it’s not even remotely true for modern architecture.

Between principles like zero-trust, defense in depth, etc. we’ve been away from the one flaw situation for a long time.

Now does crap software exist that doesn’t follow these principles? Absolutely. But those were a problem before AI.

AI isn’t going to change any of the principles of secure design. It’s just going to punish those who aren’t following them.

	▲	NitpickLawyer 37 minutes ago \| parent \| next [-]
		They do address some of these things in the final slides / "lessons learned" section of the defcon talk. Good security practices will continue to be good, but... and there are a lot of buts here. I disagree with your take that "it's not even remotely true" and "we've been away from...". We really really haven't. This is as true as it has always been. Any system is as secure as the weakest link. That link can be anything from a human, to a leaked token, to a badly configured server, to bad code running somewhere. The amount of leaks / ransomware attacks / etc in the past 5-10 years serve as ample evidence. And now, right now, there are "red team" capabilities that can literally bang tokens against the wall until they find that weakest link, and then can move laterally with inhuman speed. That's the reality, now. The "blue team" capabilities are lacking, because the bottleneck is with humans. From alert fatigue, to not enough trained people, to having to vet every new RCE, to having to test, deploy and validate any mitigations, the scales are currently favouring the automated side.
	▲	jrflo an hour ago \| parent \| prev [-]
		I'm using the term "one" loosely, it's a chain of exploits rather than a single weakness, but the argument is the same: it's much harder to find every chain than a single chain.

▲

rustyminnow 2 hours ago | parent | prev [-]

If we also consider LLM developed software to have exponential growth, then the CVEs will also grow at an exponential (if proportionally limited) rate. Squash some, create some, repeat. An ever revolving door of vulnerabilities. Will they resolve (and patch and deploy) them faster than they can create them? One can hope.