Hello Cyber Builders đź––
This morning, I kicked off the CyGO AI & Cyber Collective Summit. Here is my talk, as written.
Twenty-five years ago, I worked in computer security. Back then, the job was simple: protect computers and networks. Now, cybersecurity touches every company. It is about your business, our values, and our democracies.
Digital technology runs the world. Things move so fast now that it can make your head spin.
So I looked back at just one week of news. Even a single week gives perspective nowadays.
You have heard about the refrigeration controllers that run supermarket fridges.
Claroty’s Team82 published the Danfoss controller vulnerabilities in August. As usual, months go by between when a vulnerability is found and when the manufacturer and supermarkets finally patch it.
AI makes that gap even more dangerous.
Team82 gave the controller firmware to an AI. In about 28 minutes, the AI did what a security researcher would do. It disassembled the firmware, discovered a hidden admin password derived from the date and time, and built a working exploit.
That is a recipe any criminal group can follow, even with limited skills. Shodan and Censys show thousands of these controllers exposed on the Internet.
And don’t get me wrong, I am not arguing for the privatization of vulnerability research. We need public security research shared openly; it remains extremely important. I will keep defending it.
But you have to adapt to the speed that AI brings, whether you are an entrepreneur, a supplier, or a CISO. AI speeds up criminal operations. It should also speed up your security.
Last week, OpenAI released results on more than 300 open problems in mathematics, published as 722 manuscripts from an internal model.
Hugo Duminil-Copin, a French Fields Medalist, has said in very strong terms what this kind of release does to researchers’ work. And he does not accept how it is happening.
His issues are not with progress. Leaps in mathematics are good news. His concern is the method. Mathematical research is a community. It shares results and passes on the intellectual path, mistakes included, so others can learn.
Read the declaration signed by 28 Fields Medalists, published online and covered by international newspapers. Their message is important.
AI companies’ goals and the mathematical community’s goals are severely misaligned.
A lab that keeps its process to itself and publishes results nobody can follow, with no methodology or reasoning path that researchers and PhD students can work from, breaks sharing and the collective.
Math research must be done as a community.
Mathematics may sound far from your daily work as a Cyber Builders. It is not.
Last week, Matthew Green, cryptography professor at Johns Hopkins, wrote: “I think we might lose public key cryptography.”
Asymmetric cryptography lets you connect securely to a website and sign documents. It is a building block of trust for every system you protect.
My most technical readers may find that leap speculative, but at the speed we’re seeing now, who really knows?
I don’t think Matthew Green wanted to sound alarmist. But with the progress of AI in mathematics, this is a strong reminder that asymmetric crypto is based on “hard to solve” problems such as large-prime factorization, lattice-based problems, or the discrete logarithm problem. These maths problems are “hard to solve” because there are no obvious solutions that work at scale.
For example, that’s why we can set up a private key on a web server and serve content over TLS, sign documents with our smartcard, or buy tokens with our wallets.
Don’t expect the labs to stop. This last week, The Information reported that OpenAI is in early talks to buy Trail of Bits, the New York security firm behind widely used crypto security tooling.
What does this mean for CISOs, suppliers and entrepreneurs?
The threat is changing. It used to focus on technical infrastructure: networks, computers, keeping systems available. Now it is moving in two directions.
The first target is the human mind. You have already seen it: social media manipulation, disinformation campaigns, deepfakes, fraud, brand attacks on marketplaces. To me, all of this is part of the perimeter of Cyber, with a capital C.
The second family of threats is well known, but not top of mind for many: integrity. The integrity of our fridges. The integrity of our AI agents.
A digital system that takes actions and makes decisions must behave as intended. You need to trust that behavior.
For years, you protected availability so nobody could stop your systems. You protected confidentiality. Now, integrity is essential: the assurance that nothing cracks and you can trust the system.
Why? Because AI is, in a way, an omnipotent and extremely fast attacker. Davi Ottenheimer and Bruce Schneier make the same case in The AI Agents of Tomorrow Need Data Integrity. Of the three classic properties, integrity will matter most.
The cybersecurity function is still evolving. That is true for entrepreneurs, service companies, and security leaders in large and mid-sized organizations. AI is hitting hard and speeding everything up.
So pick one system you own. Ask yourself: if the attacker were omnipotent, which invariant would still hold? If you cannot name one, that is your next project.
See you next week.
Laurent đź’š
