Cyberattacks Used to Take Months. AI Can Do It in Minutes.

Summary

The speakers argue that AI is sharply accelerating cyberattacks: models can now identify and exploit complex vulnerabilities, sometimes compressing work that once took weeks or months into roughly 20 minutes. They describe October as a turning point, or “Black October,” marked by a surge in vulnerabilities and attacks. In their view, open-source models are catching up to frontier models faster than expected, making offensive capabilities available to more attackers.

Key Analysis

• Patching is falling behind exploitation. The PHP vulnerability discussed affected technology that the guest said was present across nearly all Wiz customers and represented roughly 70% of the internet. About half of affected customer fixes were applied within the first two or three days, but the long tail could take years. Patches can also arrive late or leak before they are ready.
• Startups are attractive targets. AI companies may hold valuable model credentials and customer secrets. The guest advises restricting credentials and treating internet-exposed systems as potential targets, regardless of company size.
• Continuous security matters more than one-off scans. New models can change what attackers are capable of, so systems considered safe yesterday may not be safe today. The guest recommends regularly testing systems from an attacker’s perspective, prioritizing exposed, unauthenticated attack surfaces, and addressing critical risks.
• Security architecture—not just budget—is central. More spending may help, but the speakers say no tool or budget alone can guarantee safety. They recommend designing for compromise with measures such as isolation, sandboxing, and network and process restrictions.
• Automate where feasible, especially in new companies. Startups can build security into development, testing, and deployment workflows from the outset. Established organizations may find automation harder because of legacy systems, unclear ownership, and undocumented organizational knowledge.
• Use AI efficiently through layered workflows. Different models have different strengths, speeds, and costs. Rather than using the most expensive model for every task, the guest describes a pipeline that starts with deterministic checks and cheaper models, escalating to more capable models when needed.
• Security teams should focus on practical risk reduction. The guest argues that teams should spend less time on low-value reporting and checklist work, and more on finding critical risks, mitigating them, preparing detections, and responding to incidents.

Wiz Tools and Initiatives Discussed

• Atlas: Wiz’s vulnerability-detection engine, which uses multiple models to find vulnerabilities.
• Blue agent: Investigates potential attacks through a staged process, escalating from deterministic detection to more sophisticated models. The guest says the goal is to support deeper investigation and forensics, with response automation as a further step.
• Red Agent: Continuously attempts AI-driven attacks against a customer’s applications, using internal context to identify problems before attackers do. The guest says prioritizing externally exposed, unauthenticated systems can be more urgent than scanning all code.
• Scan for Good: A Wiz initiative that scans government services and other organizations needing assistance, with the aim of identifying problems and encouraging ongoing security testing.

Outlook

The guest predicts more frequent breaches and warns that AI may perform some sophisticated attacks better than human attackers. The speakers compare the coming period to earlier eras of internet security, including the possibility of fast-spreading worms. Their overall recommendation is to prepare exposed systems for highly capable attacks and operate security processes at machine speed.

Reviews, guides, or tutorials: No product review or step-by-step tutorial is presented; the discussion offers strategic security recommendations.

Main Speakers

• Ami Luttwak — Wiz co-founder and CTO; principal guest and source of the cybersecurity analysis.
• Zane Lackey — a16z general partner and moderator.
• Sarah Wang — a16z general partner and moderator.