Comment by justinhj
4 days ago
If the AI tools can easily find exploits, cannot those same tools be used to harden security? In fact the companies have an advantage over script kiddies: access to more expensive models and compute time as well as professional security engineers
Companies are full of idiot managers who still prioritise new features over security. Security doesn't get your promoted, new features do. New features can be shoved in customers' faces and sold. Security is invisible. The idiocy in companies runs all the way from the top to middle managers. This feels a lot like Titanic.
Plumbing companies prioritize getting pipes installed over not leaking. Each individual plumber is responsible for his pipes not leaking.
Of course, but there is a big asymmetry: For some systems there are a lot more people interested in hacking them, compared to those interested in protecting them.
But i guess it's also a matter of money, because a company could potentially balance that by throwing x times more agents etc. at it.
Having the AI tools find exploits seems like a potential first step towards having the exploits be fixed.
It appears not.