Log in
The following article originally appeared on Tim OâBrienâs Medium page and is being republished here with the authorâs permission.
At some point, the software âSecurityâ industry stopped talking about stopping threats and started talking about detecting them: detection windows, response times, mean time to remediate. Itâs not offense or prevention; itâs damage control. Thereâs a movie scene that captures what that sounds like, and youâre going to name the film before I finish describing it.
An underground base on a frozen planet. The enemy knows exactly where it is. Massive mechanical walkersâwalking tanks the size of buildingsâare advancing across the ice. The defenses canât stop them. The people inside arenât trying to fight back. Theyâre frantically trying to get a broken ship working so they can just escapeânot win, not hold the line, just get out before something catastrophic and unstoppable reaches the door.
The whole opening is just people preparing. Rushing. Running checks on equipment that isnât ready, coordinating defenses that wonât hold, buying time against something too large and too fast to stop. Nobodyâs planning a counterattack.
The entire operation is: slow it down long enough to get out.
The Empire Strikes Back
Thatâs what the conversation around InfoSec sounds like right now. The base is under attack. The walkers are AI-generated vulnerabilities, automated exploit chains, and speed that no human team can match. The framing has shifted from defending the perimeter to just getting the ship started. Not winning, just getting out.
Go back and watch that opening sequence carefully. There are hundreds of faceless Rebel troopers in that sceneâno names, no lines worth rememberingâscrambling to hold the perimeter, buy time, absorb the blow. Some of them continue to fight. But maybe some already understand that the base is lost.
Han is out on the ice looking for Luke. Leia is already on the transport, making sure the mission survives. The main characters arenât defending the base. Theyâve concluded the only way to answer the threat is to move. Most of the conversation around AI right now sounds like those faceless troopers continuing to defend: fortify whatâs there, slow the walkers down, hold long enough for something to change. A few people are thinking like Han. Theyâre not buying another vulnerability scanner from a vendor. Theyâre asking whether thereâs a different way off the planet entirely.
Hereâs the disconnect: most people focused on âSecurityâ have spent decades being handed a finished base and then being asked to defend it. They werenât involved in the architecture or approach that application developers have been using.
- This new application uses Node.jsâgo defend it.
- Weâre using a new relational database because the architect wanted toâgo defend it.
- Our developers decided to start using an LLM. Can you secure it? Thanks.
In many cases, people responsible for security are not defining architectures as much as they are catching up. And as âdevelopersâ start to generate more code in a day than was possible in a month or a year, itâs becoming increasingly unrealistic to think of security as an afterthought.
When security is just a support team for software engineers, thatâs building a base that might be indefensible.
The shift that actually matters isnât a better scanner or a faster response team. Itâs security people in the room when people are writing the prompts, when agents are assembling the dependency list, and when the basic system prompts are defining the authentication systemâbefore any of those systems is in production. Not reviewing the finished base.
Security needs to be involved before anyone even starts to prompt a systemâs creation.
âMachine speedâ has become a conference catchphrase, which usually means it needs translation. Hereâs what it actually looks like, pointed at you:
- A network of agents found a zero-day in FFmpeg and didnât announce it anywhere, just filed it internally.
- A second agent scraped your teamâs LinkedIn and X and noted whoâs in Cancun next week.
- A third logged your nightly load balancer latency blip as a cover for an attack.
- A fourth studied your last three incident reports and estimated a 30-minute detection window.
The whole operation, including reconnaissance, timing, and coordination, ran in seconds. What previously required a dedicated red team and weeks of planning is now background processing that runs continuously, waiting for the right moment.
Five years ago, you would have tasked a room of scary-looking security people with profiling a target, capturing latency data, and maybe holding several meetings to discuss what they found. Today, the coordination I outlined in the previous paragraph might take a few minutes on a network of interconnected Nanobot, Picobot, Hermes, or OpenClaw agents that gather data and then update a shared memory system, and the decision on when and how to attack would be made by another agent that was granted permission to coordinate the attack across a distributed network of agents.
Quick note: If you have anything to do with running a website, stop posting about your vacation plans.
Hereâs what the conversation keeps missing: AI isnât the real problem, and this problem isnât necessarily new. The problem is that weâve been building bases that were always going to need to be evacuated. The problem is that security is rarely involved in selecting a tech stack, and because that tech stack selection is frequently automated with AI, thereâs no predicting the mess thatâs being thrown over the wall.
The response to AI-accelerated attacks is almost entirely defensive. Tighten npmâs signing requirements. Fund the Maven repository. Sign up to support Akrites with the Linux Foundation. Add another scanner to the pipeline. These arenât wrong. Theyâre just not enough.
These are important projects, and security groups should sign up to support them, but the real transformation that needs to happen is that more people in security need to get involved in software creation. What this looks like is having an opinion on React, Vite, Tomcat, Node.js, databases. It means jumping in and affecting some of the basic decisions that these agents are going to use before they deliver vulnerable software.
Most of the industry is still shopping for scanners. Most people in security are still âreviewingâ software in a process that assumes it takes weeks or months to write.
