Attackers Can Be Wrong 999 Times. Defenders Only Need to Be Wrong Once.

Attackers Can Be Wrong 999 Times. Defenders Only Need to Be Wrong Once.

There is a fundamental imbalance in cybersecurity that we have lived with for years. An attacker can try something 999 times, get it wrong every single time, and nobody cares. If attempt number 1,000 works, they have succeeded. A defender can stop 999 attacks and miss one, and suddenly everybody wants to know what went wrong.

AI is making that imbalance much more serious.

We spend a lot of time talking about how AI is making attackers more sophisticated, but I don't think sophistication is necessarily the most important part of this. There is obviously still technical expertise involved in a serious intrusion. You need to understand how to get into an environment, how to move through it and how to achieve whatever objective you have once you're there. What has changed is that generative AI can now help people who previously wouldn't have had the capability to do many of those things themselves.

That doesn't suddenly turn every low-level criminal into an elite hacker. What it does is give far more people a reasonable shot at techniques that were previously beyond them. When you multiply that across thousands of potential attackers, the volume changes dramatically. Most of them can fail and it doesn't matter. They have time, they can experiment and they can keep trying. Eventually, somebody gets it right.

Defenders don't have that luxury. We are operating under completely different rules.

A criminal can use AI aggressively. They can allow it to experiment, make mistakes, adapt and try again. There is no regulator looking over their shoulder and no board asking what happens if the system makes the wrong decision. There is no production environment they are responsible for keeping online. On the defensive side, all of those considerations exist, and rightly so.

If you're a security vendor developing AI that could potentially interrupt an organisation's production environment, shut down systems or take autonomous action, you have to think about liability. You have to think about regulation. You have to think about what happens when the AI gets something wrong. That inevitably makes defensive AI more cautious. The attacker doesn't have to be cautious.

That is where I think we are creating a dangerous gap. We can build incredibly capable defensive technology, but if we constrain it to the point where it cannot react quickly enough, while the attacker is free to operate at machine speed, we are starting the fight at a disadvantage. This isn't an argument for letting autonomous security systems run around organisations doing whatever they want. Of course there need to be controls. But we have to acknowledge that those controls have consequences, particularly when it comes to time.

And time is increasingly what this fight is about. Look at the way most security operations are architected today. Something happens somewhere in the environment, perhaps on an endpoint, inside cloud infrastructure, on the network or in the data centre. The event is collected, normalised, aggregated and moved through the security stack until eventually it reaches the point where it can be analysed and somebody, or increasingly some AI system, can decide what to do about it.

We have spent years making that process faster. The SOC evolved from relatively basic SIEM environments into systems with greater automation, SOAR, playbooks and now AI assistants capable of doing significant parts of the triage process. All of that is useful, but there is a problem: we keep putting smarter technology at the end of essentially the same architectural sequence.

By the time the AI sees the attack, the attack has already been happening.That matters when the other side is increasingly automated. It doesn't matter how intelligent your AI assistant is if it is sitting at the end of a chain that has already introduced the delay. You can make the analysis incredibly fast, but you haven't removed the time it took for the information to get there in the first place.

This is why I believe the next major shift in defensive security has to be about moving intelligence much closer to the controls themselves. If something is happening on the network, process it there. If it is happening in cloud infrastructure, process it there. The same applies to endpoints and data centres. We need AI operating where the event is taking place, as close to real time as possible, rather than collecting everything centrally and asking an intelligent system to work out what happened afterwards.

Some vendors are beginning to move in this direction, but the industry as a whole isn't there yet. And the uncomfortable part is that we will probably only accelerate once something goes badly wrong. That's how security has traditionally worked. We close the well after the calf has drowned, as we say in the Netherlands.

The difference now is that the fire is moving much faster.I sometimes compare it to being told that the summer is going to be exceptionally hot and there is a serious wildfire risk. Somebody tells you that you should probably install a sprinkler system around your house, and you agree that it sounds sensible, but decide you'll deal with it when the fire gets closer. Then the fire reaches your road and suddenly you decide it might be time to install the sprinklers.

It's too late.

Yet organisations make security decisions like this all the time. The people working in the SOC often know exactly where the delays are. They know that an attacker can complete part of an intrusion before the detection has even appeared on their dashboard. They see these problems every day. But fixing them means changing architecture, changing technology and spending money.

That introduces another timescale entirely. A security team identifies the problem, builds the business case, gets it into the annual operating plan, waits for budget approval, evaluates the technology and eventually starts the transformation. For a large organisation, you're potentially talking about millions in investment and a significant operational change, so naturally there is caution.

Unfortunately, the attacker isn't waiting for your annual operating plan.This is the part I think boards and security leaders need to understand. AI isn't simply another technology that we can bolt onto the existing security stack and assume we have dealt with the problem. It changes the speed and economics of the attacker. If we respond by adding AI to the end of an architecture that was designed for a slower threat environment, we haven't really changed the equation.

Organisations should be asking a very simple question: where are we losing time? Talk to the people actually defending the environment. Find out how long it takes from the first indication of an intrusion to detection, analysis and meaningful action. Look at every step in between and ask whether it still needs to exist in the way it does today. Because shaving a few seconds off AI analysis isn't particularly useful if minutes have already been lost getting the data to it.

We will never give defenders the same freedom attackers have, and we shouldn't. Legitimate organisations have responsibilities that criminals obviously don't. But that means our advantage has to come from somewhere else. It has to come from better architecture, faster detection and the ability to make decisions much closer to the point of attack.