Cyberattacks Used to Take Months. AI Can Do It in Minutes.

AI is compressing the offensive side of cybersecurity from weeks or months into minutes, and the guest argues that October marked a turning point he calls “Black October.” He says models are now good enough to find and exploit complex vulnerabilities, while open-source models are catching up fast enough to put sophisticated attack capabilities in many more hands. In his view, this is no longer theoretical: attackers can target companies, startups, and even public infrastructure at a speed defenders cannot match on human timelines.

The discussion centers on PHP2Shell as an example of how widespread exposure remains, with the guest saying almost all customers had some PHP running and that even a single vulnerability could take years to fully unwind across the internet. He argues that patching alone is not enough, especially when patches leak before CVEs or distribution updates arrive, and says new companies should design for automated patching from the start. For legacy companies, he is less optimistic about full automation.

The defense playbook he recommends is continuous and layered: continuously attack your own systems, focus on unauthenticated external exposure first, then deeper code and runtime analysis, and use multiple models in pipelines rather than relying on one expensive AI system. He also says budgets matter less than architecture, secure design, isolation, and response readiness.