former @googlechrome security. host @scwpod. cofounded @censysio. cryptography, startups. “ruthlessly practical". Go blue!
Washington, DC
Joined February 2009
- Tweets14.4K
- Following482
- Followers2.7K
- Likes30.3K
Pinned Tweet
I wrote a post about how security undervalues preventing problems, and how this can be exasperated by AI and the vulnpocalypse, even though AI should actually make robustness much easier for defenders
In which past David committed future David to donating money to charity to resolve a cryptographic conspiracy theory abetterinternet.org/post/goo…
David Adrian retweeted
High priority:
AI Firewall
AI Endpoint Protection
AI SIEM
AI Identity
Low priority:
Firewall
Endpoint Protection
SIEM
Identity
In a single year, AI has rewritten the security priority list for CISOs.
Attackers are moving faster. Bain estimates AI compresses a typical cyberattack from about four weeks to about 18 hours, and models keep getting better at finding and exploiting weaknesses.
There's also more to protect, with employees shipping apps they couldn't have built a year ago and agents getting access to source code, documents, and production systems.
In a survey of 100 CISOs at companies with 1,000+ employees, all seven of the most-selected 2027 priorities involve AI.
The biggest jumps since 2026:
- Internal AI agent security (+28 pts)
- AI SOC (+26 pts)
- AI offensive security (+24 pts)
- AI code security (+23 pts)
- AI vulnerability remediation (+22 pts)
Last year's staples:
- Exposure & vulnerability management (-21 pts)
- SIEM / security data (-18 pts)
- Privileged access management (-18 pts)
From a16z's @OwenColby and @steph_zhang on The New Security Agenda: a16z.news/p/the-new-security…
David Adrian retweeted
if you have ever wanted to write a browser from scratch, now is the time. for the next 2 years, browsers only need to render a single kind of DOM element: the <textarea>
David Adrian retweeted
Jon Stewart having Ed Zitron on as an "AI expert" really makes me question everything I learned about the world from the Daily Show when I was 13 years old
So 3SAT is subexponential but still hard?
*flips around chair*
Brother, let me tell you about some other subexponential problems that are still hard
New episode of @SCWpod ! youtu.be/qIzbr-KHJPg
David Adrian retweeted
If you want to argue that public-key crypto is ending, it is not too much to ask that you have SOME EMPIRICAL BASIS for that claim. "Computers are good at math" is not a fact that is prima facie even RELATED to the q of whether p-k crypto is computationally difficult to break.
NEW EPISODE!
The gang talks about what AI getting Good At Math™ might mean for cryptography, & why public-key cryptography probably isn’t ending. David is on a mission to civilize and claims a crisis of empiricism.
securitycryptographywhatever…
youtube.com/watch?v=qIzbr-KH…
David Adrian retweeted
Maybe THIS will be the push we need to really, actually, seriously consider the possibility that P/NP is basically ill-posed, that our formalization of "efficient" and "efficiently verifiable" algorithms do not correspond to reality's.
A TCS that had really, fully internalized this possibility would not look or be taught like it is now.
In the middle of all this security nonsense, HTTPS became the default, and Chrome now warns before insecure HTTP connections!
blog.google/security/chrome-…
David Adrian retweeted
🚨 Censys is closely tracking PHP2Shell exposure and remediation worldwide.
Our live dashboard tracks affected PHP versions and patching progress by country, network, and PHP version.
View the live dashboard: php2shell.censys.com
smdh, liberal cancel culture strikes again emudhra.com/en/press-release…
This is actually because they fear Roko's Basilisk. The next Mass Effect was based on the Red Ending of ME3, where artificial intelligence is destroyed.
