3 ms·

As part of my work in technical diligence, I create medium-long form content marketing material on topics germane to PE investment in tech. In the last six mont

As part of my work in technical diligence, I create medium-long form content marketing material on topics germane to PE investment in tech. In the last six months I did a series (not yet published) on the state of security in the age of gen-AI. Basically, we are entering the ransomware apocalypse. It is insane what a godsend gen-AI has been to the cybercrime sector. When all you need to do is make something good enough to fool some of the people some of the time, genAI is perfect. Things that used to work reliably - like trusting google ads or sponsored links not to be malvertizing sites - are meaningless now that gangs can trivially spin up networks of thousands of fake interacting sites and linked profiles to sneak by fraud detection. Phishing attacks are ridiculously sophisticated, combining voice, text, and video impersonation. Supply chain attacks are going to mean package managers are handgrenades. Ransomware gangs are running full on SaSS services allowing script kiddies access to big gun material. Attacks that were previously only in reach of nation-state-sponsored actors are now available for peanuts. And all of this is going to worse because of everyone and their dog using gen-AI to pump out huge amounts of vulnerable code. And then there is the world of prompt engineering for data exfiltration... If you are young and wanting a promising trade in tech, security would absolutely be a good choice. Shit is going to get CRAZY.

alephnerd 6mo ago
> If you are young and wanting a promising trade in tech, security would absolutely be a good choice. Shit is going to get CRAZY. Yes, but you can't be a CISSP or SOC monkey - that has no future. You need to be an actual Software Engineer who understands development fundamentals, OS internals, web dev fundamentals, algorithms, etc as well as offensive and defensive concepts. To many "cybersecurity" graduates in North America aren't even qualified to do L1 IT Helpdesk, which is a shame because the IT to Security talent pipeline is critical (along with the SRE, SWE, and ML to security pipeline).
- iainctduncan 6mo ago
  Definitely agree. I guess I should have specified I meant "real programmer who wants a career". ;-)
- sdevonoes 6mo ago
  As an “actual” software engineer, what do you recommend me to read to work in cybersecurity? Assume I have a solid background in OS internals, algos, networking, software engineering. I have never worked in cybersecurity though (I have never reversed engineered anything)
  - alephnerd 6mo ago
    What do you specialize in as a SWE? Can you identify architectural or implementation bugs and think about how an attacker can exploit that to laterally move across your environment? Cybersecurity is basically a wholistic architectural review of software that takes business, engineering, and operational context into account to make a qualified judgment about risk.
    - greenie_beans 6mo ago
      i'm one of these developers who found myself doing a lot of security-oriented devops work. how do i get away from compliance? i hate checking boxes, feels like it creates some pointless work sometimes. compliance alone makes me never want to do cybersecurity but i enjoy the architecture stuff and thinking about threats
      - alephnerd 6mo ago
        > i hate checking boxes > hate checking boxes, feels like it creates some pointless work sometimes Everyone does. It doesn't actually help reduce tangible risk, but it helps you understand the operational and liability aspect of cybersecurity which is critical as well. > compliance alone makes me never want to do cybersecurity Compliance =/= Cybersecurity. If you work in an organization where security actually means compliance, then leave. --- Honestly, it's region and industry dependent. If you are east coast, transition into a JPMC or GS tier bank (yes, banks are bleeding edge security personas). If you are west coast, it shouldn't be difficult for a SRE/DevOps/Cloud type to become a SWE or Solutions Engineer at a cybersecurity company. If you are in Europe, get an H1B and leave. I literally helped sponsor 2 O-1s today from European cybersecurity founders who wanted to leave becuase of subpar terms and bureaucracy.
RajT88 6mo ago
Oh, we're back to not being able to trust Google Ads again? I recall there being Malvertising campaign problems ~12-15 years ago or so, and then they seemed to get on top of it.
- iainctduncan 6mo ago
  typosquatting is shaping up to be a serious problem again.
operatingthetan 6mo ago
This just seems like the result is people are going to be driven off the internet. It will simply not be safe for the layperson.
- idiotsecant 6mo ago
  No man lands between walled gardens
- yoyohello13 6mo ago
  Literally the Blackwall from Cyberpunk 2077.
- PradeetPatel 6mo ago
  It might not be a bad thing if we have an Internet for humans, and a segmented Internet for AI.
  - kgwxd 6mo ago
    Who's enforcing that rule?
- pesus 6mo ago
  Sounds like an ultimately good thing to me. It was an interesting experiment, but the negatives largely outweigh the positives at this point. (I do realize the irony of writing this on HN, but I digress)
- babycheetahbite 6mo ago
  Just in general, the outcome of where technology is going may spur many to reduce their usage in favor of "the real world"; I agree it might be a good thing.
- tokioyoyo 6mo ago
  Most people's internet is Instagram + Games from AppStore + TikTok + Netflix + Banking Apps. Everything is within specific walls and guardrails.
sifar 6mo ago
I get amused that people don't realize that genAI is an existential threat to the internet and everything that has been built on it. 1) One can no longer trust things out on the web. 2) One no longer needs things out on the web. For 1), I hope the defense mechanism kicks in time to bake security into our computing culture and pervades throughout the stack.
- tim333 6mo ago
  I can't see an existential threat as in the internet as in it no longer existing. It's busier than ever although maybe with more junk.
- zolland 6mo ago
  I can't tell if this is satire or not
- ellg 6mo ago
  You were trusting things on the internet before LLM's?
  - nine_k 6mo ago
    The Internet is quite fine at delivering packages over encrypted channels which I can trust. (Except where interdicted by governments, like in China, India, Russia, Turkyie,..) The Web is a rather different beast, but the question is not "can you trust the Internet", but "can you trust a random website", and now even "can you trust a previously trustworthy website". You of course should not trust any pictures or videos as critical evidence, they should be corroborated by other means. But this has been true for several years now.
  - sifar 6mo ago
    To clarify, I meant it from a lay person's perspective. I do realize that one can argue if the average person will have developed this awareness now. The difference this time, I feel, is that the genAI tools are widely available for normal people to experiment with which will hopefully help develop this visceral feeling.
  - 6mo ago
strombofulous 6mo ago
> If you are young and wanting a promising trade in tech, security would absolutely be a good choice. If AI is capable of performing these attacks, what would stop AI from replacing the security engineers?
- chucky_z 6mo ago
  The more I use AI and my workplace buys into it, the more I’m doing person to person work in a security context.
  - iainctduncan 6mo ago
    exactly
- lelanthran 6mo ago
  > If AI is capable of performing these attacks, what would stop AI from replacing the security engineers? Because the threat model is one-sided - if an AI attack fails, the controller simply moves to the next target. If an AI defense fails, the victim is fucked. Therefore, there is still value in being the human in Cyber Security (however you are supposed to capitalise that!) There are still protections and mitigations that targets can do, but those things require humans. The things that attackers can do require no humans in the loop.
  - AlecSchueler 6mo ago
    > Therefore, there is still value in being the human in Cyber Security Why? Your logic applies equally well to humans. If the AI attacker fails they move onto the next target, if the human defence fails the victim is fucked. > There are still protections and mitigations that targets can do, but those things require humans. Which things would you point to here?
    - lelanthran 6mo ago
      > Why? Your logic applies equally well to humans. If the AI attacker fails they move onto the next target, if the human defence fails the victim is fucked. I didn't claim that the human defence is the only layer. Your analogy is only valid if my claim is that it's AI attackers vs Human defenders. It's not. It's AI attackers vs AI + Human defenders. > Which things would you point to here? If you cannot imagine any value that a human can add to an AI defence, then this conversation is effectively over; I am not in the mood to enumerate the value that a human can add to AI defence.
idiotsecant 6mo ago
How can open source software possibly survive this?
- Tepix 6mo ago
  Open source has advantages over closed source: You can demonstrate your sSDLC whereas with closed source you have to believe the vendor.
- baq 6mo ago
  There’s no closed source software anymore, clankers are mighty good at decompiling.
cyanydeez 6mo ago
in the upside, the current Adminstration is making most of that legit grift, so investing in homegrown fruad should be on every PE's 2026 wishlist
mmarian 6mo ago
> If you are young and wanting a promising trade in tech, security would absolutely be a good choice. Shit is going to get CRAZY. I personally would still recommend software engineering. Security in far majority of places is still checkbox and cost driven. Outrage happens around incidents, but rarely are people willing to invest meaningful in their people. Security SaaS on the other hand, is doing great, so anything driving revenue there is good.
zakki 6mo ago
Do you have some pointers to start advancing in security world?
meander_water 6mo ago
The crazy part is that none of this is unexpected. This was exactly the reason why GPT-2 was restricted for general release in 2019. Check out section 4 - https://cdn.openai.com/GPT_2_August_Report.pdf https://cdn.openai.com/GPT_2_August_Report.pdf

alephnerd 6mo ago

> If you are young and wanting a promising trade in tech, security would absolutely be a good choice. Shit is going to get CRAZY. Yes, but you can't be a CISSP or SOC monkey - that has no future. You need to be an actual Software Engineer who understands development fundamentals, OS internals, web dev fundamentals, algorithms, etc as well as offensive and defensive concepts. To many "cybersecurity" graduates in North America aren't even qualified to do L1 IT Helpdesk, which is a shame because the IT to Security talent pipeline is critical (along with the SRE, SWE, and ML to security pipeline).

iainctduncan 6mo ago
Definitely agree. I guess I should have specified I meant "real programmer who wants a career". ;-)
sdevonoes 6mo ago
As an “actual” software engineer, what do you recommend me to read to work in cybersecurity? Assume I have a solid background in OS internals, algos, networking, software engineering. I have never worked in cybersecurity though (I have never reversed engineered anything)
- alephnerd 6mo ago
  What do you specialize in as a SWE? Can you identify architectural or implementation bugs and think about how an attacker can exploit that to laterally move across your environment? Cybersecurity is basically a wholistic architectural review of software that takes business, engineering, and operational context into account to make a qualified judgment about risk.
  - greenie_beans 6mo ago
    i'm one of these developers who found myself doing a lot of security-oriented devops work. how do i get away from compliance? i hate checking boxes, feels like it creates some pointless work sometimes. compliance alone makes me never want to do cybersecurity but i enjoy the architecture stuff and thinking about threats
    - alephnerd 6mo ago
      > i hate checking boxes > hate checking boxes, feels like it creates some pointless work sometimes Everyone does. It doesn't actually help reduce tangible risk, but it helps you understand the operational and liability aspect of cybersecurity which is critical as well. > compliance alone makes me never want to do cybersecurity Compliance =/= Cybersecurity. If you work in an organization where security actually means compliance, then leave. --- Honestly, it's region and industry dependent. If you are east coast, transition into a JPMC or GS tier bank (yes, banks are bleeding edge security personas). If you are west coast, it shouldn't be difficult for a SRE/DevOps/Cloud type to become a SWE or Solutions Engineer at a cybersecurity company. If you are in Europe, get an H1B and leave. I literally helped sponsor 2 O-1s today from European cybersecurity founders who wanted to leave becuase of subpar terms and bureaucracy.

RajT88 6mo ago

Oh, we're back to not being able to trust Google Ads again? I recall there being Malvertising campaign problems ~12-15 years ago or so, and then they seemed to get on top of it.

iainctduncan 6mo ago
typosquatting is shaping up to be a serious problem again.

operatingthetan 6mo ago

This just seems like the result is people are going to be driven off the internet. It will simply not be safe for the layperson.

idiotsecant 6mo ago
No man lands between walled gardens
yoyohello13 6mo ago
Literally the Blackwall from Cyberpunk 2077.
PradeetPatel 6mo ago
It might not be a bad thing if we have an Internet for humans, and a segmented Internet for AI.
- kgwxd 6mo ago
  Who's enforcing that rule?
pesus 6mo ago
Sounds like an ultimately good thing to me. It was an interesting experiment, but the negatives largely outweigh the positives at this point. (I do realize the irony of writing this on HN, but I digress)
babycheetahbite 6mo ago
Just in general, the outcome of where technology is going may spur many to reduce their usage in favor of "the real world"; I agree it might be a good thing.
tokioyoyo 6mo ago
Most people's internet is Instagram + Games from AppStore + TikTok + Netflix + Banking Apps. Everything is within specific walls and guardrails.

sifar 6mo ago

I get amused that people don't realize that genAI is an existential threat to the internet and everything that has been built on it. 1) One can no longer trust things out on the web. 2) One no longer needs things out on the web. For 1), I hope the defense mechanism kicks in time to bake security into our computing culture and pervades throughout the stack.

tim333 6mo ago
I can't see an existential threat as in the internet as in it no longer existing. It's busier than ever although maybe with more junk.
zolland 6mo ago
I can't tell if this is satire or not
ellg 6mo ago
You were trusting things on the internet before LLM's?
- nine_k 6mo ago
  The Internet is quite fine at delivering packages over encrypted channels which I can trust. (Except where interdicted by governments, like in China, India, Russia, Turkyie,..) The Web is a rather different beast, but the question is not "can you trust the Internet", but "can you trust a random website", and now even "can you trust a previously trustworthy website". You of course should not trust any pictures or videos as critical evidence, they should be corroborated by other means. But this has been true for several years now.
- sifar 6mo ago
  To clarify, I meant it from a lay person's perspective. I do realize that one can argue if the average person will have developed this awareness now. The difference this time, I feel, is that the genAI tools are widely available for normal people to experiment with which will hopefully help develop this visceral feeling.
- 6mo ago

strombofulous 6mo ago

> If you are young and wanting a promising trade in tech, security would absolutely be a good choice. If AI is capable of performing these attacks, what would stop AI from replacing the security engineers?

chucky_z 6mo ago
The more I use AI and my workplace buys into it, the more I’m doing person to person work in a security context.
- iainctduncan 6mo ago
  exactly
lelanthran 6mo ago
> If AI is capable of performing these attacks, what would stop AI from replacing the security engineers? Because the threat model is one-sided - if an AI attack fails, the controller simply moves to the next target. If an AI defense fails, the victim is fucked. Therefore, there is still value in being the human in Cyber Security (however you are supposed to capitalise that!) There are still protections and mitigations that targets can do, but those things require humans. The things that attackers can do require no humans in the loop.
- AlecSchueler 6mo ago
  > Therefore, there is still value in being the human in Cyber Security Why? Your logic applies equally well to humans. If the AI attacker fails they move onto the next target, if the human defence fails the victim is fucked. > There are still protections and mitigations that targets can do, but those things require humans. Which things would you point to here?
  - lelanthran 6mo ago
    > Why? Your logic applies equally well to humans. If the AI attacker fails they move onto the next target, if the human defence fails the victim is fucked. I didn't claim that the human defence is the only layer. Your analogy is only valid if my claim is that it's AI attackers vs Human defenders. It's not. It's AI attackers vs AI + Human defenders. > Which things would you point to here? If you cannot imagine any value that a human can add to an AI defence, then this conversation is effectively over; I am not in the mood to enumerate the value that a human can add to AI defence.

idiotsecant 6mo ago

How can open source software possibly survive this?

Tepix 6mo ago
Open source has advantages over closed source: You can demonstrate your sSDLC whereas with closed source you have to believe the vendor.
baq 6mo ago
There’s no closed source software anymore, clankers are mighty good at decompiling.

cyanydeez 6mo ago

in the upside, the current Adminstration is making most of that legit grift, so investing in homegrown fruad should be on every PE's 2026 wishlist

mmarian 6mo ago

> If you are young and wanting a promising trade in tech, security would absolutely be a good choice. Shit is going to get CRAZY. I personally would still recommend software engineering. Security in far majority of places is still checkbox and cost driven. Outrage happens around incidents, but rarely are people willing to invest meaningful in their people. Security SaaS on the other hand, is doing great, so anything driving revenue there is good.

zakki 6mo ago

Do you have some pointers to start advancing in security world?

meander_water 6mo ago

The crazy part is that none of this is unexpected. This was exactly the reason why GPT-2 was restricted for general release in 2019. Check out section 4 - https://cdn.openai.com/GPT_2_August_Report.pdf https://cdn.openai.com/GPT_2_August_Report.pdf