Charlie Lewis cited a Linux vulnerability dating from 2003 as an example of a long-lived flaw that old code can still hold.
“there was a Linux vulnerability from 2003. I mean, that's a long, that's twenty three years ago”
Person
Charlie Lewis
2 episodes · 18 quoted claims
Charlie Lewis said organizations are using AI-agent threat modeling and automating workflows through static and dynamic application security testing tools.
“we've seen organizations start using agentic threat modeling and then broader integration and automate automation of the workflows through their various SAST and DAST tools”
Charlie Lewis said known vulnerabilities can now be weaponized in hours or even minutes rather than weeks.
“Known vulnerabilities can move towards weaponization in a matter of hours or even minutes, potentially, rather than weeks.”
Charlie Lewis said the industry broadly agrees that AI-generated fixes should not be deployed without human review on critical applications and services.
“We still have full sort of alignment within the industry on not deploying own fixes without human reviews, especially on critical applications and critical business services.”
Charlie Lewis cited a Black Hat discussion involving Hugging Face in which so many simultaneous attacks occurred that the signal became noise.
“it goes back to what we heard coming out of Black Hat with Hugging Face, right? That it was where there were so many attacks and such a swarm and movement going on all at once that the signal became the noise.”
Charlie Lewis said a crisis war game was run at an international dairy association digital conference, followed by a visit to a Blue Bunny factory.
“we did a war game, a crisis war game example, uh, at the an International Dairy Farmer Uh Association digital conference”
Charlie Lewis explained that an ice cream sandwich is two wafers around ice cream, and that few wafer makers exist, so losing one threatens supply.
“an ice cream sandwich is really a wrapper, two wafers and ice cream in the center, and the ice cream gets hard because the wafer absorbs the moisture”
Charlie Lewis said apparently independent vendors may depend on the same cloud provider, identity service or data platform, creating hidden single points of failure.
“what we have found is that several apparently independent vendors can may depend on the same cloud provider, identity service, data platform, or some other foundational infrastructure.”
Charlie Lewis said no one can give a precise Q-day, noting a physics estimate from February that pointed to 2035.
“no one can actually give a precise sort of Q day, right? The physics in February said twenty thirty five”
Charlie Lewis said some companies have claimed quantum readiness by 2029, while he expects it within five to ten years.
“there have been some companies that have highlighted readiness by 2029”
Charlie Lewis said the United States government and the EU are developing more standards, with broader regulatory movement toward post-quantum cryptography.
“We are seeing increased standards development within the United States government, within, uh, the EU and broader regulatory movement here.”
Charlie Lewis described harvest now, decrypt later as the risk that encrypted data stolen today stays valuable long enough to be decrypted by future quantum computers.
“That encrypted information stolen today could remain valuable long enough to be decrypted later, right?”
Charlie Lewis said large cryptographic migrations can take years, so organizations should begin planning post-quantum cryptography now.
“large cryptographic migrations can take years, right? So you need to start thinking about what do I”
Charlie Lewis compared quantum risk to a hurricane that is visible in advance, unlike the sudden arrival of frontier AI.
“My view is this is more like a hurricane. We know it's coming, we have a general idea that it's gonna hit during a certain window”
Charlie Lewis said a well-built harness and strong prompting on a less capable model can outperform average setups on the best model.
“sometimes a really good harness and really strong prompting on a lower capable model will give you a better output than average harnesses and average prompting on the best”
Charlie Lewis predicted that attackers will stay well ahead of defenders for a year or maybe two, and that open weight models will catch up to today's frontier labs.
“All we know is that offense is gonna be way ahead for a period of time, a year, maybe two years.”
Charlie Lewis said chief information security officers are ranking AI agent risks among their top risks, with about a third placing them in their top three.
“the CISO from the security standpoint is ranking AI agent risks really in its top risk, about a third of them in the top three risks”
Charlie Lewis said security spending is shifting away from protect, detect and respond functions toward identity and access management and governance, risk and compliance.
“we are seeing spend move from, say, the protect or or from the detect and the respond type spaces to a lowering spend within there”