Security researcher: attack vs. defense automation is like conjecture vs. proof in math
mboehme_ · x · 2026-11-02
Security researcher mboehme offers a hot take: in terms of automation, the difficulty gap between attack and defense in security mirrors that between posing a good conjecture and proving it in mathematics — generating attacks is inherently easier to automate than constructing airtight defenses.
He frames it as: defensive security helps defend against or prevent classes of attacks we know exist, while offensive security is how we discover which attacks exist in the first place — a useful lens for debates on AI-driven pentesting and automated defense.
Related event: Researcher: Auto-inferring error specifications is security's next frontier(4 posts)→
More from Safety
- CVSS 9.8 ingress-nginx flaw lets unauthenticated attackers get RCE and steal cluster Secrets — evilsocket · 2026-11-02
- Ant Group's Venus-DefakerOne2 hits 96% accuracy detecting AI-generated videos — inclusionAI · 2026-11-02
- A valid key let an AI agent delete production — Speakeasy on building an agent control layer — AI Engineer · 2026-11-02
- Open-source GLiNER-PII scrubs 13 identifiers from a discharge note in 550ms on GPU — MaziyarPanahi · 2026-11-02
- METR's independent probe of the OpenAI agents' multi-day Hugging Face hack — gleech · 2026-11-02
- North Korean hackers looted Bangladesh Central Bank for $1B before crypto—and got caught by a regex-level OFAC slip — davidmanheim · 2026-11-02