Cybersecurity is a balance of risks. Risks require trade-offs. An easy trade-off is: do we move as quickly as possible with an 80% solution with the known risk of having gone down the wrong path, or do we wait until we get to 99% certainty and then execute? Bots move quickly and break things, you say. This requires speedy response. Yes, though the psychology of decision-making under time pressure is gloomy. We're veering into the Daniel Kahneman " Thinking, fast and slow " territory where speedy decision-making relies on what Kahneman referred to as " System 1 " thinking where decisions made under time pressure engage heuristics. These are snap judgments based on pattern recognition, the goal being to conserve time and effort in making decisions in new instances that are -- maybe -- similar to previous instances. For example if you go to a new coffee shop and you like cortados, you might order a cortado w/o reading the menu. There is no need to think about it. T...

  Early 2026 givens: 1. Your organization needs an AI strategy. 2. Your organization needs a cyberdefense strategy. Late 2026 givens: 3. Your organization needs an AI cyberdefense strategy to secure your operations using AI. 4. Your organization needs a cyberdefense AI strategy to use AI securely. Your organization will have all of these by early 2027, right? Right? Quick, call your peers and ask them what they do! I've sat in those meetings. You've sat in those meetings. Big Consulting Company is in the building. Your natural tendency is to buy whatever the vendor is selling you because it's new and shiny and your bosses like bright shiny objects.  Look, we get it, Big Consulting Company has The Latest Ahead-Of-The-Curve AI product. It even was featured in Ivy League University Business Magazine. Your company just bought a product.  Sure, they said it was "consulting" or "advising" but being entirely candid it's a product. The difference is that a p...

Just as the leading edge of AI adoption by business is starting to show signs of wariness the cries of "what is your AI strategy?" are starting to be deafening. While it is often rude to answer a question with a question, in this case I have no choice. When I am asked "what should our AI strategy be?" I am forced to reply "in what domain?" Talking about AI without specific reference to the processes to which it is to be applied is to put cart before the horse. General statements about AI are simply not useful as ways of defining how you will apply AI to your daily operations. AI is a general-purpose tool. Perhaps the most general-purpose tool humanity has ever devised. It is not meaningful to talk about AI as if it had narrow fields of application. Consider a more narrowly focused utility, such as cloud computing: it is reasonable to ask what strategic decisions your IT folks have made about cloud computing. Do you need server capacity in such great quanti...

Our  previous post was about the Abundance Paradox in its many forms namely having lots of something turns out to have downsides in addition to upsides. My cup runneth over (and now the table is wet). That post was about cybersecurity (C/S) in general being vulnerable to this problem. This post is about how apply AI to C/S in particular has risks associated with it. Using AI to do your C/S survey work is very handy and allows you to keep up with lots of rote tasks but there are two downsides: the AI makes mistakes (fewer all the time, but still the occasional whopper) and relying on the AI means that your abilities atrophy or never develop in the first place. Is that a problem? After all, horse-handling is no longer a very common requirement of modern life. However, for years after the introduction of the automobile horse-handling remained quite a useful skill. The fact is that the set of skills you need over your life changes, faster than it ever has in human history, and our val...

The Abundance Paradox has many forms but in all of them having lots of something turns out to have downsides in addition to upsides. My cup runneth over (and now the table is wet). For developing nations we have the Resource Curse in which having abundant natural resources seems to lead to corruption and foreign exploitation and slow economic growth. For consumers we have the Paradox of Choice in which having too many options doesn't mean that most of get exactly what we want (although some of us do just that) but rather that most of us are paralyzed by the options and end up stressed out and less satisfied than we would have been with fewer choices. For complex systems we have a bit of a debate : does it make a complex system less reliable to add complexity, even if that complexity is aimed at raising reliability? It is all to often true that adding complexity to a system in order to raise reliability hits a wall, a point after which the additional subsystems raise the number of...

I am revisiting the excellent book Lies My Teacher Told Me in which the author makes the point that a good historian is a skeptic, not a cynic. This idea goes double for cybersecurity professionals dealing with AI. Let me list the positions I see cybersecurity professional taking vis-a-vis AI in what I believe is the proper ranking from best to worst. AI Skeptic The AI skeptic is open to this new technology but wary of the hype. "Show me" is the motto here. This person is eager to learn more, to define and execute some proof-of-concept projects using AI directly and evening willing to have a limited, monitored roll-out of AI-enhanced versions of software tools already in use. But wholesale adoption of AI is not planned anything in the next 12-18 months. AI Optimist The AI optimist is already sold on the idea of AI. "Bring it on!" is the motto here. This person is eager to open the floodgates right now, to use AI directly to look for flaws in their critical infrastru...