Source item

1/ useful to catch up with friends and judge the Launchpad competition @ RSAC2025. There was a clear shift from CISO skepticism on AI to embracing it as mission-critical weapon. Some takeaways (and questions) in thread 👇 https://t.co/4sPryZgRct 2/ AI is now both lock-pick and shield. Attackers can cheaply craft polymorphic phishing & deepfakes; defenders must counter with real-time AI detection or be overwhelmed by volume. The arms race is underway. Cyber is one of the first and most real abuses of LLMs 3/ SOCs are going autonomous. AI triages alert floods, stitches evidence, investigates more deeply (a combo of log parsing and security reasoning) — leaving humans to decode the weird edge cases and populate these systems with institutional knowledge. see the @culminatesec demo! 4/ related, some talent math: we have seen AI offloads ≈40 % of tier-1 tickets and reduces the need for every security team to try to hire data science (hard) and stem the endless churn in the SOC 5/ Security “copilots” are progressing into task-specific agents (that can write detection rules, summarize logs, and flag insider drift, etc). but their use remains fragmented and incomplete. Practitioners want unification so they can stop cut-and-pasting context 6/ Identity remains a soft target. Deepfake help-desk scams and synthetic accounts push continuous behavioral auth (and deepfake liveness checks) from nice-to-have to a more urgent must-have, especially for financials 7/ compliance has a chance to be relevant, transitioning from annual fire-drills into quiet, continuous background processing (SOC2 data capture like @TrustVanta, dashboards that intelligently map controls-to-shifting regs and flag drift, pen-testing agents like @runsybil) 8/ Shadow AI > Shadow IT. CISOs are “holding the bag” on data security for AI. They must figure out how to police/redact tokens and watermark outputs. Early “DLP-for-AI” proxies sit between users and external LLMs, but it’s still unclear how to protect without killing velocity 9/ Explainability or bust. Regulators and governance teams want mission critical AI verdicts to ship with a “why” stack trace. No receipts? No auto-action — but this remains an open area of fundamental research 10/ Several startups are selling “agent security” — but market timing matters, and it’s still early in terms of volume of agents in the enterprise. Security platforms follow the workloads. But market changing faster than ever, we’re actively monitoring 11/ AppSec is the next five-alarm fire. LLMs churn out scaffolding at warp speed, but vuln density hasn’t budged. Triage isn’t better. More code = more attack surface. We need secure-by-design and tests thay work (with higher confidence) on 10X the commits (see @CorridorSecure) 11/11 Final hot take: model weights aren’t the ticking time-bomb some fear. They’re static math blobs; the real “supply-chain risk” sits in the code, pipelines, and infra that fetch, fine-tune, or serve them. Audit your platforms, not your checkpoints See you at next RSAC!