AI has not just added new tools to cybersecurity — it has helped break the old economics of defense. In a conversation on Decoder, Alex Stamos, chief security officer at Cognition and a longtime security leader, argued that the industry is now dealing with “permanent continuous breach,” where attackers can detect weaknesses and write exploits in real time while defenders scramble to keep up.
Why Alex Stamos thinks cybersecurity has entered a new era
Stamos described the current moment as a kind of frontier phase, similar to the 1990s when the always-online world was still taking shape. The difference now, he said, is that the internet underpins far more of the world, and AI has made it far easier for both criminal groups and state-linked actors to scale attacks.
He said the result is a “dark age” in which the industry has to adapt to a very different threat model. That doesn’t mean he expects collapse, but it does mean he thinks companies, governments and security teams will need to rethink almost everything they assumed about how breaches happen and how quickly they can be contained.
AI is changing the attack chain in real time
One of Stamos’s biggest points was that AI is flipping the traditional cyber “kill chain.” Historically, attackers did research first, found vulnerabilities later and then deployed prepared exploits at scale. Now, he said, AI systems can look at targets, find bugs and write exploits at the same time.
That shift matters because it compresses the time defenders have to react. In his view, the attacker’s cost is dropping while the defender’s cost remains stubbornly high, which makes the imbalance worse with each new wave of attacks.
Examples Stamos pointed to
- AI-related companies and “neoclouds” have reportedly been breached in succession.
- The Binance hack was described as the largest heist of anything in human history, with Stamos saying it was mainly human social engineering and North Korean activity, though AI may have played some role.
- The Cursor incident allegedly began with a breach at Fireworks, where API keys were stolen and used to get into Cursor, after which a bad plugin reportedly reached about 5,000 companies.
- PHP, Node and other bugs have added to a month Stamos described as exhausting for security teams.
Stamos also said this is not just about one country or one group. He said the actors range from private criminals to state-linked groups such as Russia and North Korea, plus what he described as a Chinese “cottage access industry” that breaks into companies and sells the information onward.
The security industry’s old assumptions are fading
According to Stamos, much of the multi-billion-dollar cybersecurity industry grew up around a set of assumptions that no longer hold. One was that advanced offensive work required a rare elite tier of experts. Another was that teams had to be carefully organized, with small research groups and larger operational groups behind attacks.
AI, in his view, has spread more of that capability downward. A person with a Mac and an open-weight model can now do work that once required highly specialized teams. He said this does not make attacks automatic yet, but it gets “really, really close.”
He tied that to a broader economic shift. Bitcoin made laundering money easier for criminals, he said, while AI is making technical attack work cheaper. At the same time, defenders are still stuck with expensive monitoring, investigations and response work.
What defenders will have to automate
Stamos said the answer is not to unleash fully autonomous defensive swarms, a phrase he said he hears too often and largely dismisses. Instead, he argued, companies will need AI to take on the first layers of security operations while humans keep control over the highest-risk decisions.
That means systems watching logs, triaging alerts, examining cloud activity and deciding when an investigation is warranted. He said current tools can already help, but they need to get far cheaper and much more efficient.
He gave a concrete example: a colleague at a major security platform company told him an investigation using a frontier-model cyber product cost about $900. In a world where attackers can run cheap or nearly free operations using open models and commodity hardware, that is too expensive to scale.
Stamos’s practical priorities for defenders
- Use AI to find and fix bugs automatically.
- Push more of SOC work into cheaper, layered AI systems.
- Set deterministic limits so defensive agents cannot take down an entire company.
- Actively red-team systems before attackers do.
Why he says companies need to red-team themselves now
Stamos argued that every company in the next 90 days will need to “RTX itself,” a reference to running an AI-driven attack simulation either with a product or an outside firm. If not, he warned, they are likely to be breached.
His concern is that many organizations are too slow to approve that kind of testing. Legal teams, vendor reviews and risk frameworks often make it difficult or impossible to run aggressive security checks, even though those checks may be the only way to stay ahead of increasingly automated attackers.
He said this is already happening in the wild: while companies debate permissions, some attacker is likely probing forgotten sites, unused API endpoints and old infrastructure, then moving quickly once they find a weakness.
Software rebuilds may matter more than patching
Another major theme of the interview was that patching alone may no longer be enough. Stamos argued that if a codebase contains thousands of bugs, rewriting it may be cheaper than trying to patch every issue one by one.
He said LLMs can help generate tests, rewrite code and merge pull requests in a way that would take human teams years. That, he believes, is how old software estates can be made more secure at scale.
He went even further, suggesting that Google and Amazon could lead a rewrite of the Linux kernel for their own cloud environments, using memory-safe, type-safe languages and modern constraints. He acknowledged that such a project would be politically and technically difficult, but said it may ultimately be cheaper than endless patch cycles across the global internet.
How AI and social media add a second security problem
Stamos also touched on the flood of AI-generated content on social platforms, especially Instagram. He said synthetic media creates a rights-management headache, user trust issues and a likely wave of lawsuits, even if the technology for labeling it is imperfect.
He said some platforms treat technical challenges as blockers when they do not want to act, but move quickly when they do. In his view, AI content labeling is not perfectly solvable, but that should not be an excuse for doing nothing.
The broader message of the conversation was blunt: AI is not just making security harder, it is changing who can attack, how fast they can move and how much it costs to defend. Stamos does not think the world is doomed, but he does think it is entering a dangerous transition period — and one that the security industry has to confront faster than it has in the past.
Source: Original report
Was this helpful?
Explore more: Application Audit & Review More Cybersecurity Tech News
Last Modified: November 7, 2026 at 10:31 pm
0 views
