AI made vulnerability discovery nearly free, breaking security's risk-acceptance model

1. Safe-rating logic collapses — ▶ 2:22

   The CISO role began at Citigroup after Russian hackers stole money, when systems were so insecure that a Telnet connection could yield root commands. Over time the job shifted toward accepting medium and low-severity risk, on the theory that exploiting flaws takes hundreds of hours of skilled labor, much as a safe is rated by hours-to-break-in. De la Garza says AI has pushed the cost of that knowledge work essentially to zero over 2-3 years. His forecast: 3-6 months of disclosures, with PHP, BIND, the Linux kernel and 4-5 embargoed issues already in view.

2. Why disclosures cluster now — ▶ 4:47

   De la Garza attributes the burst less to a specific model than to a shifting threat landscape. Leaks and active exploitation, reportedly of the PHP flaw for a few weeks, pull disclosure timelines forward, and embargoed vendors are a common leak source. Many other flaws were silently patched over the prior 3-4 months. Attackers may be using open-weights models, and he notes Chinese ones have been very good at this for roughly 6-8 months, though he frames that as an assumption. Breach information also lags by days to years, so the true damage is unknown.

3. Patching capacity for months — ▶ 7:21

   Since Heartbleed, which affected every website, appliance and even cars, the industry has built a patching cadence, and systems now run on images that can be updated in real time. De la Garza therefore thinks defenders are well prepared. The difficulty is duration. He has told portfolio founders to expect a couple of months of sustained effort: more security staff, allocated engineering time and zero tolerance for known vulnerabilities in shipped products. That ends the MVP habit of shipping with security bugs.

4. Hardware's unpatchable tail — ▶ 10:03

   Nation-state activity moved toward hardware and firmware over roughly the last 15 years, after the Obama-era executive order naming Chinese intelligence officers. De la Garza says much critical infrastructure now has tooling to patch, with remote water systems and similar places the exceptions. The harder problem is low-capability devices such as heart rate monitors and wearables, which cannot practically be patched. He treats the damage from them as real but well short of taking down a grid control system. Whether that holds is untested.

5. Doom framing undermines action — ▶ 13:28

   A host cites the 2003 Northeast blackout, which affected 55 million people and killed almost 100, and asks about harm to hospital patients. De la Garza, who lived through it, accepts the deaths as tragic but not apocalyptic, and argues that doom scenarios induce helplessness and weaken the case for change. He compares them to an asteroid strike: possible, but far out on the probability scale. The likelier outcomes are manageable with basic hygiene, funded security teams and not shipping products before they are ready. He offers no probability estimates.

6. People remain the weak point — ▶ 19:03

   De la Garza cites Verizon's breach data as showing that 80-90% of incidents each year for 10 years began with social engineering or spear phishing, so people stay weaker than infrastructure. Pressed on whether AI weakens that logic by making direct system attacks viable, he partly concedes. Capabilities once held by nation-states with billion-dollar budgets have trickled down to ordinary ransomware operators. Low-hanging fruit should still be off the table if defenders use attackers' own tools and patch aggressively, but treating this as a one-week problem would be a mistake.

7. Disruption through precaution — ▶ 21:29

   De la Garza calls real disruption in the next year almost certain, but mostly because governments and operators will shut systems off until they are patched, citing NSA advice and actions in the UK. His example is a DMV offline for a day or two. A SF grid outage over 12 hours he rates as low probability, while admitting he does not know grid security. For banks, he says those given early access to Glasswing 6-8 months ago have been patching for 6 months, and one bank is hiring an additional 1,000 people for it.

The economics of vulnerability discovery have inverted, and security practice has not caught up. According to Joel de la Garza, the profession spent years managing risk on the premise that exploiting a flaw demands hundreds of hours from highly technical people. Like a safe rated by hours-to-break-in, systems were judged safe enough because no attacker would invest the time. Over the last 2-3 years, he says, AI has pushed the cost of that knowledge work essentially to zero. If that is right, the risk-acceptance logic that let organizations tolerate medium and low-severity issues as a cost of doing business no longer holds, and the question shifts from which flaws attackers can find to which they will bother to use.

The visible symptom is a wave of disclosures. De la Garza points to the PHP, BIND and Linux kernel vulnerabilities and 4-5 more under embargo, and expects the flow to run for 3 to 6 months. Much of this code has been flawed for years, he says; agents are simply the first to look. He is cautious about causation. The cluster of disclosures this week, he suggests, came from leaks and reported active exploitation pulling timelines forward, not from one model release. He assumes attackers may be using open-weights models, including Chinese ones he considers very capable for 6-8 months, but offers that as an assumption rather than a finding.

His case against panic rests on the defenders' track record. After Heartbleed, which touched every website and appliance, the industry built a patching cadence and shifted to architectures where updated images can be pushed in real time. The trouble is endurance. De la Garza has told portfolio founders that this is not an all-hands week but a sustained effort over months, requiring more security headcount, engineering time and a zero-tolerance stance on vulnerabilities in shipped products. The implication, which is the editorial reading of his advice, is that the usual startup trade of speed against security gets more expensive: the MVP that ships with known bugs becomes a liability instead of a norm.

Exposure, in his account, is uneven. Google and Microsoft operate at nation-state level and are well resourced. He estimates typical security spending at about 10% of technology budgets and guesses Google is nearer 20%, though he stresses it is a guess. Large banks, he says, have been patching for months, and one is hiring an additional 1,000 people for the task. The risk lies in regional, low-margin systems that never made the investment, in remote water systems, and in low-capability hardware such as wearables that cannot practically be patched. He adds that infrastructure neglect predates AI. That distribution of risk, not the headline vulnerability count, is what readers should watch.

The discussion also surfaces a real tension about where attacks will land. De la Garza cites Verizon's breach data, which he says shows 80-90% of incidents starting with social engineering or spear phishing every year for a decade, as evidence that people remain the weakest layer. A host objects that cheap exploit discovery could let attackers skip the human and hit systems directly. De la Garza partly concedes, noting that nation-state capabilities have trickled down to ordinary ransomware operators. His reassurance is conditional: low-hanging fruit should be off the table only if defenders use the attackers' own tools and move aggressively. That is a prescription more than a forecast.

On catastrophe, he argues that doom framing is itself a professional failing. Asked about the 2003 blackout, which a host says affected 55 million people and killed almost 100, he says the event was survivable and that apocalyptic scenarios leave people feeling helpless and weaken the case for practical change. He places them alongside an asteroid strike. The argument is about communication strategy and not an estimate of likelihood, and he gives no probabilities. He also says plainly that he does not know grid security well enough to say how likely a prolonged outage in a major city would be.

His own forecast is therefore undramatic but not comforting. He calls real disruption in the next year almost certain, yet expects it to be self-imposed: governments and operators taking systems offline, as in the DMV example, until they can patch and restore them safely. The unresolved issue is what the visible record will not show. Breach information arrives days, weeks or years late, so the current calm may reflect delayed reporting. The 6-month patching surge at large banks is evidence of the good outcome, but it is also evidence of how much work the good outcome demands.