I’m with you until that last sentence, which I’ve been thinking about as “… until AI code testing, vulnerability scanning, and developer support tools help to limit the number of 0-days and vulnerabilities making it into production”.
So prevention will be more important than ai-assisted rapid containment or patching, though both of those capabilities will be necessary as part of defense in depth.
And some sort of AI-enabled security analysis across the organization’s architecture that is done as part of testing ahead of new software entering production to ID potential vulnerabilities caused by configuration changes or upgrades that modify how systems interact with each other.
I’ve been trying to guess the timeframe for seeing improved secure development, but I’m hoping it’s a bit closer to 6 months - 1 year given the speed of AI adoption and AI progression. May be closer to 3 years as you stated.
In the meantime, is there more to be done than this (not in order)?
- Patch COTS software
- re-evaluate the scoring for previous vulnerabilities
- set up up containment measures capabilities for systems that can’t be patched / high risk vendors
- use frontier model vuln scanning and patching for home grown systems that may have more 0-days than COTS depending on the organization’s capability
- limit the number of vendors / simplifying the tech stack.
I’d be happy to hear how others are thinking about this.
You can't do any kipping / front to back movement. Worth it IMO to get a beefier bar (see Rogue's above door offering) so that you don't break your tailbone falling off the door frame & can use resistance bands for added assistance.
Do you enjoy that work and thinking about it? Sure, you may not make groundbreaking discoveries, but there is a lot of space between groundbreaking and implementation. If you can understand the groundbreaking work and see the applicability to other problems, you are in a good place.
It's not a waste of life if you enjoy the work and are adding some value (e.g. someone's paying you for your output, or some other measure of value).
>"how do I know I'm not an idiot here too?"
Who judges what is an idiot? There's raw talent, the ability to synthesize information, the ability to retain a breadth of knowledge and draw connections between ideas, the ability to communicate ideas, and many other dimensions of "smart".
You can have a truly unmotivated genius that will achieve and contribute much less than someone who is just "smart" but has the work ethic. Einstein had both. That's why he is so rare.
> "Are there any other ways to assess yourself to ensure you’re not (amongst other things) out of your depth without being aware of it?"
Again, IMHO, if you are still learning things and feeling out of your depth, then you are in a good spot. If you don't understand the topic, then you've either missed a step between the fundamentals and what you're working on or maybe you've hit the limit of your ability. But truly hitting that limit is rare - most times people could return to learning the basics and a few more intermediate items, return to the problem, have a "breakthrough", and keep going. Progress is not linear.
But it makes sense - as you work on more and more difficult problems, it takes longer and longer to make visible progress. If it were easy, it would have been figured out already. While making progress, it never feels like you're making a big accomplishment day after day.
I think working on goals that are "more suited" could stick you in a place where you've under-achieved to feel "smart" and have not achieved what you could have. Personally, I'd rather be failing (in a way that isn't life altering or career ruining) consistently to make sure that I'm not under-performing or selling myself short. It's an uncomfortable place to be, but that's where you find personal growth and progress.
Last thing - to be successfully measured, it means someone needs to have covered the territory, solved all the problems, figured out and ranked how difficult the problems are, and then put them out there to judge others. If you want to compete in a space that is that mature, have fun, but it seems like you may be operating in a place where the measuring stick isn't built yet.
So prevention will be more important than ai-assisted rapid containment or patching, though both of those capabilities will be necessary as part of defense in depth.
And some sort of AI-enabled security analysis across the organization’s architecture that is done as part of testing ahead of new software entering production to ID potential vulnerabilities caused by configuration changes or upgrades that modify how systems interact with each other.
I’ve been trying to guess the timeframe for seeing improved secure development, but I’m hoping it’s a bit closer to 6 months - 1 year given the speed of AI adoption and AI progression. May be closer to 3 years as you stated.
In the meantime, is there more to be done than this (not in order)?
- Patch COTS software
- re-evaluate the scoring for previous vulnerabilities
- set up up containment measures capabilities for systems that can’t be patched / high risk vendors
- use frontier model vuln scanning and patching for home grown systems that may have more 0-days than COTS depending on the organization’s capability
- limit the number of vendors / simplifying the tech stack.
I’d be happy to hear how others are thinking about this.