Who's Job Is "Bug-Fixing"?

A recent report from Alex Banks at The Signal caught our attention:

"AI has made finding security holes cheap, but fixing them still needs people. Every fix has to be checked and released by the people who look after the software, so of those 948 bugs which GPT-6 Cyber found, only 61 had been fixed by the end of the 10-day test. It’s great that we’re speeding up in this domain, and to contextualise this, cybersecurity researcher Dave Aitel reckons a skilled human hacker might find 30 bugs like these in a whole career."

Wow.

Finding bugs is now cheap. "Fixing them still takes people": first the maintainers who review and release, then your team, who has to test and deploy. Both steps run on human coordination.

That's the point of the four pillars of a successful cybersecurity team: hire for talent, build structure, create engagement, develop your people. These pillars let you create a security culture, and in turn the security culture provides the rationale for the four pillars. If you have the four pillars in place, then that process to find and fix bugs -- which is ticking on your system, remember -- is going to be managed well: everyone knows the role they play and has the talent to execute.

The uncomfortable fact is that AI is likely to stress cybersecurity more than it helps cybersecurity, at least in the short term. Breaking things is always easier than making things. Most IT tools can be used against us faster and easier than they can be used for us. This is a perfect example: finding vulnerabilities is great, but the job isn't done until the vulnerability has been fixed, however that happens.

Teamwork creates and supports success. Supportive environments outperform unsupportive environments under stress. Cybersecurity teams are going to be increasingly stressed, at least in the short term.

Teams exist to raise the potential performance of the unit beyond what one person alone can do. If you are not good at building teams -- you probably think you are good at building teams, just like you probably think you're an above-average driver and that your sense of humor is better than most -- you get finger-pointing and blame. 

Here's a leadership challenge for you. Think about the last time the team had to mobilize in response to a suspected or actual incident. How did it go? Were people supportive? Did you have to get involved more than you thought you should? (Hint: micro-managers feel anxious about letting teams do things and jump in to make sure tasks are "done right.") How did people treat each other afterward? Was there an after-action review that led to change?

And here's the payoff question: If that scenario didn't pan out well, what did you do about it?

Because that's when the finger points to you.

Ask us how you can create a security culture. (p.s. thanks to Brendan for a few inputs!)

(image credit: Bject, CC BY 4.0, via Wikimedia Commons)