3 ms·
As a founder of an auditing firm, I definitely feel the heat of the competition when big LLM companies push products that not only compete with us an auditors b
by baby 8mo ago
As a founder of an auditing firm, I definitely feel the heat of the competition when big LLM companies push products that not only compete with us an auditors but also with our own AI-based offerings (https://zkao.io/ https://zkao.io/).
If I were to venture a guess, there's different world in which we might exist in the next 5-10 years.
In one of these futures, we, as auditors, seize to exist. If this is the future, then developers seize to exist too, and most people touching software seize to exist. My guess here is as good as any developer's guess on if their job will remain stable.
In another one of these futures, us auditors become more specialized, more niche, and bring the "human touch" needed or required. Serious companies will want to continue working with some humans, and delegating security to "someone". That someone could be embedded in the company, or they could be a SaaS+human-support system like zkao.
On the other hand, vibe coders will definitely use claude code security, maybe we should call it "vibe security"? I don't mean it as a diss, I vibe code myself, but it will most likely be as good as vibe coding in the sense that you might have to spend time understanding it, it might make a lot of mistakes, and it will be "good enough" for a lot of usecases.
I think that world is a bit more realistic today, than the AGI "all of our jobs are gone in the next years" doom claim. And as
@zksecurityXYZ
, I don't think we're too scared of that world.
These tools have been, and are making us stronger auditors. We're a small, highly specialized team, that's resilient and hard to replace. On the other hand large consultancies and especially consultancies that focus on low hanging fruits like web security and smart contracts are ngmi.
- deadbabe 8mo agoDevelopers will not cease to exist. The developers of tomorrow will simply being doing things that developers today can’t possibly even imagine. Auditors though, they are cooked.
- viccis 8mo ago>Auditors though, they are cooked. I think you're massively underestimating the complexity and depth of a good security audit service.
- tptacek 8mo agoI don't.
- viccis 8mo agoGod bless you, the beautiful thing about computer security is that this attitude has kept us happily in business for many years.
- tptacek 8mo agoSay more? It's really hard to navigate the antecedents of this argument.
- viccis 8mo agoPeople who don't do intense security work for a living underestimate the complexity of it. This might find some vulnerabilities, but it's not really capable of producing new methods and attacks. What it replaces isn't a high quality human researcher; it replaces current static code review systems. If AI models never had stack smashing writeups in their corpus, they'd never be able to invent stack smashing.
- tptacek 8mo agoSo, by any reasonable measure, I've spent a career doing "intense security work", with a particular focus in vulnerability research, and I do not agree with this at all.
- viccis 8mo agoWhat evidence do you have? It sounds like you probably haven't been providing much value if an LLM can replace you.
- kypro 8mo agoDevelopers of tomorrow will be everyone with a computer in the same way everyone today is a calculator.
- baby 8mo agoDev and auditors are two sides of the same coin, if one exists the other does as well. Perhaps they will be the same person, but systems don’t exist without tradeoffs and security considerations.
- ping00 8mo agoRespectfully (not trying to be pedantic but helpful): it's "cease" not "seize" in this context :)
- deleted 8mo ago[deleted]