2020
Rajadurai says the average time to exploit a known vulnerability was about 1.3 years in 2020.
“the time to exploit, like going back back to 2020 was about 1.3 years”
Topic
Niro Rajadurai
14 facts from 1 episode, in date order. These are what speakers said on the shows, each linked to the moment it was said. They aren't independently verified.
2027
Rajadurai says time to exploit has fallen to about one day and is predicted to fall to one minute by the end of 2027.
“It's now down to like one day, and they're predicting that by the end of 2027, it'll be down to one minute.”
Undated
Rajadurai says he ran the advanced security business at GitHub, where an early use of AI models was fixing vulnerabilities already identified in existing code.
“because I ran the advanced security business at GitHub, was can we actually use these models to help us remediate vulnerabilities that have been identified in existing code?”
Undated
Rajadurai says that in the largest enterprises the volume of code is still bigger than what an AI model's context window can handle.
“the volume of code that the models need to deal with are still bigger than what the models context window can cope with.”
Undated
Rajadurai defines a vulnerability as exploitable if one can build something that uses it to steal information or run commands on a target machine.
“Because exploitable means I can build something that can use that vulnerability to go and exfiltrate some information or go and run some special command on that target machine”
Undated
Rajadurai says some open-source AI models now perform as well as the frontier models that providers are trying to restrict.
“some of the open source models are actually as performant as these models that we're trying to gate to the broader community.”
Undated
Rajadurai argues that an attacker needs to find only one hole in an application, while a defender must find all of them faster.
“if I have an application and the application has four holes, the attacker only needs to find one of those holes.”
Undated
Rajadurai says some of the largest enterprises have roughly 16,000 to 20,000 public-facing applications.
“a lot of them have a big public facing estate for their application, maybe sixteen, 20,000, you know, in the some of the largest enterprises, public facing application.”
Undated
Rajadurai says companies typically run penetration tests only once or at best twice a year on an application, usually the riskiest ones, because they are slow and costly.
“But they're only doing this like once a year, or at best twice a year on an application.”
Undated
Rajadurai says penetration testing is the gold standard for validating an application, which is why regulators ask whether it has been done.
“penetration testing activity is kind of the gold standard of like validating an application, which is why regulators ask you, have you pen tested your application?”
Undated
Rajadurai says an AI model that finds a SQL injection may try to drop database tables, unlike an experienced human hacker who would avoid wiping a production system.
“It turns out if you use a model to do the same exercise, the model say, Oh wow, I found a SQL injection, I'm gonna do a drop table.”
Undated
Rajadurai says AI models are very good at suggesting fixes when given a clear description of the problem, how to exploit it and what the exploit produces.
“It turns out that if you give a really good description of the problem, how to go and exploit the problem and what the outcome is if you run that exploit.”
Undated
Rajadurai says AI models tend to try to please users, which gives LLM-based vulnerability scanners a high false positive rate and a lot of noise.
“they tend to want to keep you happy. And so they tend to have a high false positive rate.”
Undated
Rajadurai estimates that 95% of autonomous offensive security vendors tell the market that a human must be in the loop.
“I think 95% of the players out there are telling the market, you have to have a human in the loop to use these tools.”
Episodes