There are multiple philosophies regarding this question, and especially historically people were in disagreement. Many companies used to be angry when attacked or probed by white hats. They thought "yes I suppose I should lock my door, but if someone is out trying door handles they should be put in jail". I think there is some logic to that perspective. But clearly that philosophy ended up losing to the "victim blaming" one where everyone is responsible for securing their systems.

Since we are entering a new age, maybe it's time to revisit the question. But ultimately I think we will land in the same place, in fact even firmer than before.

So why don't we just lock up all the whitehats and people behaving suspiciuosly and probing things? Why can't we achieve cybersecurity in this way when it seems to be a common thing in physical security?

And the answer I think is quite simply that there are too many attackers and they are too far away. When the russians and chinese come knocking there isn't much we can do to shoo them away. Their governments will not cooperate in detaining the criminals. Entirely blocking such countries from the internet isn't viable either. And that's why we arrived where we did. Victim blaming because it was the only effective strategy.

And how does AI change this? I think it just creates even more hard to trace or block attackers. If ChatGPT or Claude doesn't find the vulnerability then Deepseek will. That's why using legal weapons will not succeed and why using AI to find and plug holes is necessary.