In the last few months we have seen millions of Vulnerabilities being reported and 100s of thousands valid, exploitable. AI is not just finding vulnerabilities, it is making it very difficult for engineers to know which one is exploitable or false-positive. And if such decision makers are ceased, it will create a paralysis
There's a lot of systems out there that operate on quarterly schedules, or worse. I once did some work for a company that hadn't updated anything in more than 4 years. Systems with 1500+ day uptimes, zero patches.
In the last few months we have seen millions of Vulnerabilities being reported and 100s of thousands valid, exploitable. AI is not just finding vulnerabilities, it is making it very difficult for engineers to know which one is exploitable or false-positive. And if such decision makers are ceased, it will create a paralysis
Systems should be taken offline until they can be proven secure. Nearly all of these bugs are exploitable, or can be chained into a larger exploit.
There's a lot of systems out there that operate on quarterly schedules, or worse. I once did some work for a company that hadn't updated anything in more than 4 years. Systems with 1500+ day uptimes, zero patches.
Have you ever written a system that's provably secure? Can you point to anyone else that has?
Even sel4 has easily invalidated assumptions built into its proof model.
https://archive.is/e4aRQ
If the internet stops working, AI becomes much less useful. In which case, AI will stop breaking the internet.
Or Office365 could stop working like today.
This felt AI-written to me, ironically. Especially the last few paragraphs.