This topic is more complicated than it looks. As an industry, we've definitely made a lot of progress in cyber over the years. But this is different, very different from what we've dealt with before. Look at the spike in fixed vulnerabilities across all the big vendors. And this isn’t a one-off event, it's a continuous trend. What it shows is that our understanding of cybersecurity in general is right, but the way we've solved these problems in the past is not. AI is exposing all the obscurity and complexity across the tech stack, including hardware, in exactly the places where problems were traditionally hard for human researchers to find. At the same time, threat actors are getting a force multiplier from AI without investing in new resources or building new expertise. And on top of that, every new model outpaces the previous one, so yesterday's statements and assumptions quickly become wrong. This isn't a static risk. It's highly dynamic, and things are changing and escalating far faster than the industry, or the tech stack, can react.

Another point, the HW and FW security boundaries are our last frontier for building real hardwired boundaries for virtualization, memory isolation, and hardened agent sandboxing. In the end, the whole confidential computing movement is more about cloud cost optimization than anything else. It's just broken by design, you can't build a secure stack if what's underneath has been broken for many years.

Unfortunately, the complexity of the hardware and firmware supply chain has the same negative effect on how cryptographic artifacts are managed, or mismanaged, across the ecosystem. This is a reminder of the scale of the problem, based on just one documented data breach.

This tweet has aged a few months, and frontier progress has only strengthened my feelings in this direction. Twelve months ago my thought was that AI is just another tool, automating parts of the RE/VR process. Now I'm more of the impression that it operates like the creative mind of an experienced researcher, who thinks beyond established patterns and finds new attack paths. The most effective vulnerability researcher is no longer human.