Ex-Goldman CISO: AI floods us with vulns, but defenders can use AI to deep-clean codebases
philvenables · x · 2026-11-03
Security veteran Phil Venables publishes a long essay, "The Vulnpocalypse":
- Bad news: AI tooling is massively increasing vulnerability discovery, and many orgs sit on years of software, config, and structural/policy vulnerabilities; attacker industrialization with agent swarms could turn opportunistic targets into victims.
- Good news: many orgs already respond with speed, prioritization, and defense in depth; apart from scams, crypto, and parts of the ransomware kill chain, industrialization isn't yet improving attacker monetization.
- Key take: defenders can use the same AI for "deep cleaning" codebases, potentially driving vulnerability levels to record lows — but clean code doesn't mean patched software reaches every edge device quickly.
- In a "negative time-to-exploit" world, auto-adjusting active controls, runtime mitigations, and high-level policy intent buy vital time while deployments catch up.
Related event: Ex-Goldman CISO Warns of AI-Driven 'Vulnpocalypse'(2 posts)→
More from AGI Musings
- After AI automates intellectual work, judgment and initiative become core human strengths — sqcai · 2026-11-03
- Good prompts are about articulating taste, not writing specs, argues designer — dreamwieber · 2026-11-03
- Researcher: interpretability "revolutions" are rarer than social media suggests — tallinzen · 2026-11-03
- $4.2M ARR AI startup pitched a "foundational model" — due diligence found GPT-4o and a system prompt — alex_verem · 2026-11-03
- Investor rebuts AI bubble-burst claims: unlike 2000, model usage keeps growing — robleclerc · 2026-11-03
- The 1955 Proposal That Named AI—and Predicted Today, 70 Years Early — r0ck3t23 · 2026-11-03