A technology executive, Computer scientist, Professor. A decade at Microsoft Research, executive roles at Brave, ZKSync, Eclipse.
Worldwide
Joined April 2015
- Tweets1.7K
- Following3.8K
- Followers8.8K
- Likes1.5K
Pinned Tweet
If you would like to pursue a PhD at Imperial College London and work with me on blockchain and systems security-related topics, please contact me via my web site.
1/ Sutton's Bitter Lesson: general methods that scale beat the knowledge we hand-code. Security spent thirty years hand-coding. That stack is coming apart, and the question is what happens to the analyst at the end of it. Part 1 of 2.
🧵
8/ Leaders and practitioners describe different organizations. 59% of cyber leaders say management pays close attention to SOC retention. 32% of practitioners agree.
9/ Part 1 tests autonomy against benchmarks, exploitation data and three survey series. Part 2: 892 practitioner posts, 25 interviews, 3,090 analyst queries, 123 vendors' claims, and the apprenticeship the machine is taking over.
🔗 ben-livshits.org/blog/bitter…
Very important stuff; working on a piece on changing CISO priorities at the moment as well.
In a single year, AI has rewritten the security priority list for CISOs.
Attackers are moving faster. Bain estimates AI compresses a typical cyberattack from about four weeks to about 18 hours, and models keep getting better at finding and exploiting weaknesses.
There's also more to protect, with employees shipping apps they couldn't have built a year ago and agents getting access to source code, documents, and production systems.
In a survey of 100 CISOs at companies with 1,000+ employees, all seven of the most-selected 2027 priorities involve AI.
The biggest jumps since 2026:
- Internal AI agent security (+28 pts)
- AI SOC (+26 pts)
- AI offensive security (+24 pts)
- AI code security (+23 pts)
- AI vulnerability remediation (+22 pts)
Last year's staples:
- Exposure & vulnerability management (-21 pts)
- SIEM / security data (-18 pts)
- Privileged access management (-18 pts)
From a16z's @OwenColby and @steph_zhang on The New Security Agenda: a16z.news/p/the-new-security…
1/ For ~30 years, coordinated disclosure rested on an unwritten assumption: finding exploitable bugs is hard. Scarce researcher time bought defenders a 90-day embargo. In October that assumption met PHP2Shell.
🧵
11/ Same pressure on the breach side: Everest claims 590 GB of PwC HR and training data. Unverified, access path unknown, but given the scale of the breach and its potential impact,
12/ What holds up at the new tempo: live inventory, containment in front of the parser, faster patching with AI drafts held to human review, memory safety plus isolation, and forensics that assume the attacker got in first.
🔗 ben-livshits.org/blog/vulner…
