Gosh I love how nonsense like this gets buzzsawed by The Register's comment section.

I mean..

Ultimately, she said, "if we're able to build and deploy and govern these incredibly powerful technologies in a secure way, I believe it will lead to the end of cybersecurity."

This reads like an Onion article written by a cybersecurity expert.

Anyone still under the illusion the technocrats are a meritocracy?

couldn't ai, then also, break code faster than we could fix it ?

Ex-CISA head.

Thankfully.

Execs and managers showing Dunning-Kruger in full effect.

AI is opening so many security HOLES. Its not solving shit. AI browsers and MCP connectors are wild west security nightmares. And that's before you even trust any code these things write.

At this point, they're just rage baiting and saying random shit to squeeze that bubble before it bursts.

As usual, the biggest advocates for AI are the ones who understand its limitations the least.

I have worked as a pentester and eventually a Red Team lead before leaving foe gamedev, and oh god this is so horrifiying to read.

The state of the industry was alredy extremely depressing, which is why I left. Even without all of this AI craze, the fact that I was able to get from a junior to Red Team Lead, in a corporation with hundreds of employees, in a span of 4 years is already fucked up, solely because Red Teaming was starting to be a buzz word, and I had passion for the field and for Shadowrun while also being good at presentations that customers liked.

When I got into the team, the "inhouse custom malware" was a web server with a script that pools it for commands to run with cmd.exe. It had a pretty involved custom obfuscation, but it took me lile two engagements and the guy responsible for it to leave before I even (during my own research) found out that WinAPI is a thing, and that you actually should run stuff from memory and why. And I was just a junior at the time, and this "revelation" got me eventually a unofficial RT Lead position, with 2 MDs per month for learning and internal development, rest had to be on engagements.

And even then, we were able to do kind of OK in engagements, because the customers didn't know and also didn't care. I was always able to come up with "lessons learned", and we always found out some glaring sec policy issues, even with limited tools, but the thing is - they still did not care. We reported something, and two years ago they still had the same bruteforcable kerberos tickets. It already felt like the industry is just a scam done for appearances, and if it's now just AIs talking to the AIs then, well, I don't think much would change.

But it sucks. I love offensive security, it was really interresting few years of my carreer, but ot was so sad to do, if you wanted to do it well :(

I tried using AI in my rust project and gave up on letting it write code. It does quite alright in python, but rust is still too niche for it. Imagine trying to write zig or Haskell, it would make a terrible mess of it.

Security is an afterthought in 99.99% of code. AI barely has anything to learn from.

Schrödinger's AI: It's so smart it can build perfect security, but it's too dumb to figure out how to break it.

Ha ha ha ha ha!

Oh wait, you're serious. Let me laugh even harder.

HA HA HA HA HA!

Not with any of the current models, none of them are concerned with security or scaling.

ahahahaha

Oh, you're serious. Let me laugh even harder.

AHAHAHAHA

Ah yes, I'm sure AI just patched that software so that other AI could use that patched software and make things so much more secure. What a brilliant idea from an Ex-CISA head.

Because then Security would be non-existent.

One of the most idiotic takes I've read in a long time

Ron Howard narrator: Actually, they would need more.

Clearly she's never seen AI code.

Fix what code? The code it broke or wrote like shit in the first place?

HAH... FUNNY JOKE!

Is that why she's Ex-CISA? 🤣

If an AI can be used for automatic scalable defense, it can also be used offensively. It'll just be another digital arms race between blackhats and everyone else.

Who is paying her?

The look on her face in the thumbnail matches the title perfectly.

I just asked an AI what the minimum wage was in 2003 in the UK and it told me that it was £4.50 and that on a 40 hour work week, that came out to 18k a year... But sure, trust it to write and fix code...

AI might pull her head our of her ass... eventually.

Because its doing so so well now unattended...

Easterly said that if cybercrime was a country, it would be the third biggest in the world, just behind the US and China.

Based on my understanding of programming I think they're going to need an extra couple people on the security team because of the Ai's "fixes"

People who say these things clearly have no experience. I spent an hour today trying to get one of the better programming models to parse a response. I gave it the inputs and expected outputs and it COULD not derive functional code until I told it what the implementation needed to be. If it isn't cookie-cutter problems then it just can't predict it's way through it.

Except that most risks are from bad leadership decisions. Exhibit A: patches exist for so many vulnerabilities that remain unpatched because of bad business decisions.

I think in a theoretical sense, she is correct. However, in practice things are much different.

This is like a landlord painting everything white. It'll hide / seem to fix some issues, but probably isn't the fix you're looking for.

At first I thought it was the Beaverton. Had to check the URL.

AI can't even write decent unit tests. How the hell is it going to properly red-team this service?

The one thing I will agree with is that If you ignore the AI part and just focus on the idea of having good software that can find code vulnerabilities, that’s a good idea.

I walked into to work this morning to a dev IM needing permissions. Instead of telling me what the error message said, which would contain the allowance needed, he needed he sent me a screenshot of what chatGPT said he needed. GPT effectively said the solution was to let him assume any privileged access policy that exists.

I think security teams are fine for a while.