newsfilter
← Interviews
a16z46 min

Cyberattacks Used to Take Months. AI Can Do It in Minutes.

Ami Luttwak, Zane Lackey, Sarah Wang

Interview
  • Security environments are projected to regress to 1990s and 2000s conditions with frequent unauthenticated, full zero-day breaches occurring "all the time again," distinct from the landscape of the last 15 years.
  • AI-driven attackers will operate at unprecedented scale and speed, targeting companies, startups, and physical devices like refrigerators, with exploit creation times dropping dramatically enough that information may leak before CVEs or patches are released.
  • A critical vulnerability is expected to be reported by multiple teams with a major impact on the internet, potentially triggering worms similar to the Windows XP era where systems compromise faster than they can be patched.
  • The industry is currently "not ready" for AI-speed exploits due to a mismatch between minute-scale attack velocities and weeks-or-months-long patching and distribution timelines.
  • Automated patching is deemed possible for new companies with fully automated engineering pipelines, while legacy organizations face years-long challenges due to the prevalence of affected technologies like PHP running on 70% of the internet.
  • Startups and new system builders are advised to prioritize auto-patching as a primary engineering task, whereas entities unable to adapt should consider taking systems off the internet to avoid severe consequences.
  • Public infrastructure, including refrigeration units and traffic systems, faces risks from AI attacks that could cause dire consequences for the food supply chain and humanity at large.
  • Security toolsets including classic CSPM are expected to become obsolete as focus shifts from configuration checks to finding critical risks, mitigating them, and establishing detection and response readiness rather than compliance reporting.
  • Security budgets are forecast to rise significantly, with one CISO predicting an 80% increase next year, though it is cautioned that increased funding alone will not solve the emerging threats.
  • The previously predicted Y2K-style moment for 12 to 18 months away has effectively occurred sooner than anticipated due to the rapid maturation of open-source AI models.
  • Over the next two to three years, AI attacks will be prevalent and superior to human capabilities, particularly in executing complex zero-day exploits that human attackers cannot currently perform.
  • Transitioning to efficient security operations is not certain for most teams immediately due to legacy software and the time required to resolve context regarding ownership and resources.
  • Only organizations actively designing systems exposed to the internet with integrated security automation and reviews in the present are expected to survive the coming years.
  • The Scan for Good initiative anticipates that discovering these problems will drive public services to initiate large-scale internal red scanning projects.