3 ms·

If I were in charge of an org's cybersecurity I would have AI agents continually trying to attack the systems 24/7 and inform me of successful exploits; it woul

by dheera 1y ago

If I were in charge of an org's cybersecurity I would have AI agents continually trying to attack the systems 24/7 and inform me of successful exploits; it would suck if the major model providers block this type of usage.

idontwantthis 1y ago
Horizon3 offers this.
cube00 1y ago
That sounds expensive, those LLM API calls and tokens aren't cheap.
- brulard 1y ago
  Actually thats quite cheap for such a powerful pentesting tool.
- throwawaysleep 1y ago
  It’s about $200 a month for 15 human hours a day.
jsheard 1y ago
Judging from the experience of people running bug bounty programs lately, you'd definitely get an endless supply of successful exploit reports. Whether any of them would be real exploits is another question though. https://daniel.haxx.se/blog/2025/07/14/death-by-a-thousand-slops/ https://daniel.haxx.se/blog/2025/07/14/death-by-a-thousand-s...
netvarun 1y ago
Shameless plug: We're building this. Our goal is to provide AI pentesting agents that run continuously, because the reality is that companies (eg: those doing SOC 2) typically get a point-in-time pentest once a year while furiously shipping code via Cursor/Claude Code and changing infrastructure daily. I like how Terence Tao framed this [0]: blue teams (builders aka 'vibe-coders') and red teams (attackers) are dual to each other. AI is often better suited for the red team role, critiquing, probing, and surfacing weaknesses, rather than just generating code (In this case, I feel hallucinations are more of a feature than a bug). We have an early version and are looking for companies to try it out. If you'd like to chat, I'm at varun@keygraph.io. [0] https://mathstodon.xyz/@tao/114915606467203078 https://mathstodon.xyz/@tao/114915606467203078
- mdaniel 1y ago
  > Our goal is to provide AI pentesting agents that run continuously, Pour one out for your observability team. Or, I guess here's hoping that the logs, metrics, and traces have a distinct enough attribute that one can throw them in the trash (continuously, natch)
  - trog 1y ago
    You can set this up in a non-production environment and realise a lot of the benefits. It would also help you figure out better ways to manage your logs such that you can improve signal-to-noise ratio in monitoring solutions and alarming. Not convinced "AI" is needed for this sort of around the clock pen testing - a well-defined set of rules that is being actively maintained as the threat landscape changes, and I am pretty sure there are a bunch of businesses that offer this already - but I think constant attacking is the only way to really improve security posture. To quote one of my favourite lines in Neal Stephenson's Anathem: "The only way to preserve the integrity of the defenses is to subject them to unceasing assault".

by dheera 1y ago

idontwantthis 1y ago

Horizon3 offers this.

cube00 1y ago

That sounds expensive, those LLM API calls and tokens aren't cheap.

brulard 1y ago
Actually thats quite cheap for such a powerful pentesting tool.
throwawaysleep 1y ago
It’s about $200 a month for 15 human hours a day.

jsheard 1y ago

Judging from the experience of people running bug bounty programs lately, you'd definitely get an endless supply of successful exploit reports. Whether any of them would be real exploits is another question though. https://daniel.haxx.se/blog/2025/07/14/death-by-a-thousand-slops/ https://daniel.haxx.se/blog/2025/07/14/death-by-a-thousand-s...

netvarun 1y ago

Shameless plug: We're building this. Our goal is to provide AI pentesting agents that run continuously, because the reality is that companies (eg: those doing SOC 2) typically get a point-in-time pentest once a year while furiously shipping code via Cursor/Claude Code and changing infrastructure daily. I like how Terence Tao framed this [0]: blue teams (builders aka 'vibe-coders') and red teams (attackers) are dual to each other. AI is often better suited for the red team role, critiquing, probing, and surfacing weaknesses, rather than just generating code (In this case, I feel hallucinations are more of a feature than a bug). We have an early version and are looking for companies to try it out. If you'd like to chat, I'm at varun@keygraph.io. [0] https://mathstodon.xyz/@tao/114915606467203078 https://mathstodon.xyz/@tao/114915606467203078

mdaniel 1y ago
> Our goal is to provide AI pentesting agents that run continuously, Pour one out for your observability team. Or, I guess here's hoping that the logs, metrics, and traces have a distinct enough attribute that one can throw them in the trash (continuously, natch)
- trog 1y ago
  You can set this up in a non-production environment and realise a lot of the benefits. It would also help you figure out better ways to manage your logs such that you can improve signal-to-noise ratio in monitoring solutions and alarming. Not convinced "AI" is needed for this sort of around the clock pen testing - a well-defined set of rules that is being actively maintained as the threat landscape changes, and I am pretty sure there are a bunch of businesses that offer this already - but I think constant attacking is the only way to really improve security posture. To quote one of my favourite lines in Neal Stephenson's Anathem: "The only way to preserve the integrity of the defenses is to subject them to unceasing assault".