Decoder with Nilay Patel
00:14:35 · S3, Nilay Patel
Other people have gone out of it because it's, like, really hard to compete against a foreign intelligence agency that recruits their smartest kids, and all they do is steal Bitcoin. They're extremely good at it. And for the Binance hack, we could talk about it. There's some... Probably some AI component, but mostly that was actually human intelligence and very, very smart social engineering. And the North Koreans are... I mean, you have to give it to them. They're very, very good at that. Yeah. But for the other stuff, it's it's... It looks like for the the people who are breaking into the AI companies is what's called the Chinese cottage access industry, which are small Chinese contractors who break into companies and then sell the information to much larger Chinese companies. [00:15:22] S2: That diffusion of skill changing the sort of economics of cyber is really fascinating to me. We ran a headline ages ago called Attack of the Killer script kiddies at, like, the very beginning of all this. And I feel bad because it is much more suited to now than it was to then. Because then it was just a lot of, like, automated mischief. [00:15:40] S3: Because you wasted the headline? You you wish you held it back?
00:15:40 · S3, Nilay Patel
[00:15:40] S3: Because you wasted the headline? You you wish you held it back? [00:15:43] S2: I I... You know, every now and then, you get a lightning bolt of headline. You gotta you gotta get it out there. It's a great piece of art. You know, we'll we'll put it in the show notes. But it feels like there... The diffusion you're talking about is not, oh, a bunch of teenagers are gonna be even more malicious. It's a bunch of bad actors with real incentives to do harm are now vastly more capable than they were before. And that doesn't seem like you can rejigger the economics of that unless you somehow make it really expensive to do the attacks.
00:16:16 · S3, Nilay Patel
[00:16:16] S3: I think it's gonna be extremely hard to make it expensive to do the attacks. We're gonna have to lower the cost of defense. And you're completely right to look at this economic problem because what's happening is attacks are becoming agentic. The cost per token for attackers is going towards zero, and the cost for defenders is staying quite high. And so it is very important for us to find ways for defenders to have cheaper options, and I think that is critical. So that's something I am personally extremely focused on, and I think, to be frank, very few people are. There's a couple of problems here. One, there's a ton of focus on the defensive side of AI on finding and fixing bugs. That's great. It's important. But software security as a CISO, like, I work for an AI software company, Cognition. Even as a CISO of a software product company, software security is 25% of my job. Right? I have all kinds of other responsibilities, and software security is the part of my job that has been the most both revolutionized and improved by AI. The other 75% has been helped a bit, and in some cases made much worse. So there's so much more we need to do than just hill climb on finding and fixing bugs. There's been so much less hill climbing on all these other things, and the next area needs to be the operational security side. [00:17:58] S2: Give me a... Wait. Give me an example of the other things, the 75.
00:18:01 · S3
[00:18:01] S3: Okay. So, like, the operational security side is watching your logs, looking at, ah, somebody is running our techs against us. I am now going to trigger an investigation. I am going to look to see what is going on, and I'm going to make an intelligent decision of what I am going to do to respond to this without shutting down the entire company. That is SOC work, that security operations center work. Companies that want to survive this era are going to have to replace human beings who do that work with the first tier and then eventually the second tier. You can do that with current LLMs. The the first tier actually has to be not an LLM. It has to be something much dumber because you're looking at terabytes or petabytes of logs, and it is just completely uneconomical to do that with actually an LM. We have other things, TFIDFs, MLBERTs, traditional classifiers that can operate at much faster. But then that's just off an alarm, and then you you send it to a small LM, and then the small LM calls its bigger brother, and that might call it an even bigger brother. Right? But for those models, we need to do a lot more work to optimize them, and we need to make them cheap. Right? And I have a colleague who works at, like, one of the large security platform companies who said that, like, doing an investigation on one of the big frontier model... Cyber models cost on their product $900 to do an investigation. That is not going to work when the the Russian ransomware guys are either using MACs or they're using, you know, thrown away cyber... You know, crypto mining rigs. Right? And their marginal cost is zero. So this is, like, one of the things we're working on at Cognition is, like, we train our own models, retrained open weights, and we're trying to drive this cost way down. It's something we've done, but we have a lot more work to do here, and a lot of other people have work to do here. And I I think this is where, like, as an industry, we have to focus on, like, the Pareto frontier between cost and efficiency on cyber because it's not just bug finding. Yeah. The other place here is just, like, people talk about Mythos. Mythos is great. AstraCyber is great. They're incredible models. But even the people who have access to it, which is a tiny number of companies, they only scan, like, their most important code.
00:20:15 · S3, S0, S1
And there are hundreds of billions of lines of code out there that are not the Linux kernel, that are the crap c sharp and j two e e code that was win... Written by Infosys fifteen years ago. All of that code is not is not going to go through a frontier cyber model that cost a gazillion dollars. And so that's the kind of stuff that we need to work on cost efficiency for. Ad[00:20:44] S0: Support for the show comes from engine. Running a small business means every dollar has to work hard. But if your team is still booking travel the old way, it's costing you more than you think. Engine is the fastest growing travel and spend platform in the country built specifically for businesses like yours. Ad[00:21:01] S1: Book a trip in as little as two and a Ad[00:21:03] S0: half minutes. Earn up to 10% back on hotels. And in 2025, engine customers save more than $300,000,000 on travel with zero booking fees, no contracts, and no BS. More than a thousand businesses join engine every month. Join them and get $500 when your business signs up and starts traveling at engine.com/vox.
00:21:03 · S0, Nilay Patel
Ad[00:21:03] S0: half minutes. Earn up to 10% back on hotels. And in 2025, engine customers save more than $300,000,000 on travel with zero booking fees, no contracts, and no BS. More than a thousand businesses join engine every month. Join them and get $500 when your business signs up and starts traveling at engine.com/vox. [00:21:34] S2: It It feels like you're describing this cliche that I hear all the time. And again, I'm just gonna keep asking really dumb questions about all this. But the cliche I hear all the time is everything's gonna get so much worse before it gets totally secure forever. And it doesn't seem like the model you're describing leads to that result. Result. Right? We're not gonna fix all the bugs forever in some valley of despair and then always have perfect code. At some point, there's some cost advantage to the attacker always. Right? Like you running a company, you can't write defense that has zero marginal cost. Like, someone has to do it even if the attackers are so infinite that their marginal cost is effectively zero. So are are we gonna go through a period where everything is so much worse and then it's perfect forever, or how does the cost manage itself at into balance?