Discussion
Machine Speed is a lie: stop trying to fight AI with AI
Marketing departments are screaming that attackers are moving at "machine speed" and only AI-powered defenses can stop them. But cyberattacks have always been automated, and proactive defense beats reactive AI.
https://malwaretech.com/2026/09/machine-speed-is-a-lie-stop-trying-to-fight-ai-with-ai.html
@malwaretech 💯 "Do the basics, and do them well."
More than three decades and counting: people are strongly don't want to do the basics for some reason.
💯
"Historically, organizations have chosen to prioritize business function and availability over security. As attacks and attackers get faster, this becomes increasingly untenable."
@malwaretech I agree with the message of your post - but I think you underestimate how well an LLM (even a local one, no need for latest cloud models) can use an initial vector (from a regularly automated scan) to gain persistence and exploit. While nation state actors have personnel doing this for their 9-5, this ability is now part of any script kiddie's toolbox as well.
LLMs are also super useful to analyse centralized loki flows for "anything that seems suspicious or out of the ordinary". Keep all rule sets in place for known things, they're much more effective at that, but an LLM can pick up on unknown things remarkably well.
@troed I'm entirely open to sharing any data or demos you have.
@malwaretech A small typo - probably comma -> dot.
"a claim I agree with, Attacks were"
@malwaretech Next you’ll be telling me that a machine-learning system trained on prior attack data isn’t the best defence against an adaptive attacker who has access to the same machine-learning system.
@malwaretech Wannacry still spreading is interesting. Didn't ever consider it. So, are we in a situation when, at some point in the future, someone will forget to renew a registration for the sinkhole or accidentally delete it, and then it starts ransoming systems again?
@claushoumann I think it's safe to say that anyone who hasn't patched SMBv1 by now is a lost cause.
@malwaretech This is very good, you should consider publishing some version of it in a journal or as a paper at some conference. Have you ever attended @VirusBulletin's?
@bontchev @VirusBulletin Thank you! I haven't, I wanted to go but the whole US thing happened before I got a chance
@malwaretech @bontchev @VirusBulletin Really excellent article, thank you! Piercing through the hype with evidence.
@malwaretech
Thanks for the great article. It contains a lot of material for an internal post in writing 😁
I totally agree on the technical side.
When I suspect an impact of AI on the attacks it's on the social/human side e.g. phishing.
(I intentionally write "suspect" because there is no "exponential" increase and nearly everything i see could also be done without AI)
We had our first deep fake phishing attempts, there are context based phishing attacks after external accounts were taken over, and generally the (non English) language of phishing "improved"
@malwaretech
Follow up question
Is your keynote available online somewhere?
@realn2s not that I know of. The vendor may have recorded it, but it's not available anywhere that I've seen
@malwaretech agreed. I crank through meetings with hundreds of companies on these points, as I hear from ciso who get a lot of bad pressure. maybe your post will do us all some good.
we have to ask why is the marketing so much more effective than the anti marketing? my presentations since 2012 warned it's becoming our industry Loch Ness, and yet here we are. the people selling Nessie don't want us to prove the lie.
should also point out generative code tools came well before the start you say. GitHub Copilot was public preview June 2021 and GPT-3 API dropped waitlist in November 2021. full year before ChatGPT. DALL-E 2, Midjourney and Stable Diffusion also were 2022. so that start date reads off by a year or more.
@flyingpenguin None of those model were viable for automating cyber attacks, and the first reported case of threat actors using AI to automate attack was GPT 3.5
@malwaretech oh viability! better, but you said availability, and that's why I said it's off by a year. if it's viability then your own privesc tree automates with a Python script. can we agree Copilot, running Codex, wrote those from June 2021? then GPT-3 spear-phish was outclicking humans at Black Hat in August 2021. Check Point's January 2023 sightings were people self-attributing to ChatGPT, but that's as bad a vendors self-crediting. and even then it's the observed, not the whole. I guess I have more evidence to dig up.
@flyingpenguin I feel like you're trying too hard to make widespread AI cyberattacks a thing. I deliberately structured my entire argument around the fact that people would still attempt to resurrect their AI-boogeyman no matter what I said.
"For argument’s sake, let’s take CrowdStrike’s AI-enabled claims at face value, assume AI is driving the drop in breakout times, and that trend does continue as a result of it. The core argument of this piece still stands, regardless of opinions on why breakout times are dropping."
In some (or many) ways marketing utilises the same psychological effect as phishing/social engineering
It shows you something you want (or want to avoid) e.g. "not getting hacked".
Then tells a story with at least a tiny connection to (a perceived) reality e.g. "ai is everywhere"
Distracting you with a lot of irrelevant details to cause mental (over)load to limit the cognitive capacity available for rational thought.
Add time pressure, "if you don't act now it's too late"
And play with biases and psychology
Authority "Microsoft, Google said it or do it" "leading researchers say" ...
Group pressure, "everybody does it"
And then scam you out of your money
@realn2s @flyingpenguin @malwaretech
...that and, I think, the bxxxxxt asymmetry phenomenon.
Proving that a claim is bxxxxxt takes orders of magnitude more time and effort than making the claim.
A masterpiece, THE analysis everyone involved in this area should read. Not only for your credibility, the breadth and the strength of your arguments. The clarity and sharpness of your writing is fantastic.
I will make this mandatory reading for my students.
Thanks a lot for your work.
Well put as always. So many thoughts on this summed up well. Great stuff.
Install bonfire.cafe
Get the full app experience
@malwaretech The talk those two openAI devs gave at the blackhat had the same conclusion: We build the tools that attack you and you must buy the defense tools (or tokens) from us because this is the only way. They did say this without any shame. Its like selling land mines to the attacker, buying a health company, and sending the sales team to the target country to sell wheelchairs and artificial limbs