The Offense Has Better Tools. Your Defense Shouldn't Change.

Last Thursday I was on a panel at the Global Cybersecurity Initiative conference in Chicago. AI-powered offense came up during and kept coming up in every networking break. This is the post I wrote on the back of it to condense and capture the essence of those conversations.

AI-powered vulnerability discovery is getting frighteningly good.

Tools like Mythos and the research coming out from folks like Niels Provos are demonstrating something the security industry has known was coming but hoped would stay theoretical: you can now automate the discovery of zero-days at scale, across multiple model families, with accuracy that rivals skilled human researchers. The attack surface didn't simply widen. The velocity of exploitation changed entirely.

The instinct, particularly for those of us who live in this space, is to fight fire with fire. Build smarter detection. Layer in AI-assisted defense. Counter the AI-powered attack with an AI-powered response.

That instinct is wrong.

Not because AI defense is useless. Because it's the wrong first move. You can't AI your way out of a misconfigured system. You can't automate your way past decades of accumulated technical debt. What Mythos and tools like it are proving is not that defenders need fancier tools. They're proving that attackers don't need them either. Not when the fundamentals are already broken.

Consider what these tools are actually doing. They're finding memory corruption bugs, logic flaws, and trust boundary violations. They're identifying paths where input flows from external sources to sensitive operations without proper validation. They're exploiting identities with too much privilege and services with too much exposure. None of those conditions require sophisticated AI to create. They're the product of skipping the basics. And the basics, it turns out, are where you win or lose.

Hygiene Is Not Glamorous. It Is Foundational.

The majority of exploitable conditions in production systems don't exist because defenders missed something subtle. They exist because environments drift. Packages go unpatched. Configuration changes outpace documentation. Services that were supposed to be temporary become permanent. Old credentials stay active long after the people who owned them are gone.

System hygiene is the practice of treating your environment like it's trying to kill you, because eventually it will be. That means continuous asset inventory, not annual audits. It means patch cycles measured in days for critical exposure, not sprints. It means knowing what's running, what version it is, what it's talking to, and why. Boring work. Consequential work. Difficult work.

The AI-powered scanners are going to find what you left unattended. Stop leaving things unattended.

Hardened Configuration Is a Decision, Not a Checkbox.

Default configurations exist for usability, not security. Every major operating system, database, cloud service, and framework ships with settings optimized for getting things working; not for limiting blast radius when something goes wrong.

Hardening means making deliberate choices: disabling unused services, restricting listening ports, enforcing TLS everywhere, removing default credentials, tightening file permissions. It means treating every default as a potential liability until proven otherwise.

This is not a one-time exercise. It's a configuration management practice. It requires tooling, documentation, and enforcement, not because individual administrators can't be trusted, but because systems don't stay configured the way you left them. Drift happens. Automation catches drift.

The AI model that finds a zero-day still needs a path to something worth having. Don't give it one. As someone I respect recently coined: if it can't be reached, it can't be breached.

Least Privilege Is the Most Underrated Control in Security.

Identity architecture is where most organizations have quietly accumulated enormous risk without realizing it. Service accounts with admin rights. Humans with standing access to production. API keys scoped to entire environments instead of individual functions. Cloud roles that provision other roles.

Least privilege means every identity (human or machine, internal or external) gets exactly the access required for its stated function and nothing more. Not "probably fine" access. Minimum viable access, enforced, audited, and reviewed.

The same applies to data flow. Controlled data flow means you know what moves where, you've made an explicit decision about it, and you have visibility when something deviates from that decision. Not everything needs to talk to everything else. Most things probably shouldn't.

When an attacker (or an AI running on their behalf) compromises a component, blast radius is determined entirely by what that component can reach. Constrain the reach. Constrain the damage.

The Answer Is Already Written.

The tools getting better on the offensive side don't change the playbook on defense. They make executing it more important.

Patch aggressively. Harden everything by default. Give identities the minimum they need. Know your data flows. Treat your environment like an active threat, not a controlled space.

This is not a new framework. It's not a product category. It's not something a vendor can install for you. It's operational discipline: proven, mature, and consistently under invested in every organization that eventually discovers why it matters.

The AI arms race is real. Your best counter to it is the work you've been deferring.

Let's get back to basics.