A first-principles account
When I say the physics of cyber changed, I mean something narrower and more specific than it sounds. I do not mean the threat got worse. Worse is a question of degree, and degree alone never forces anyone to change strategy. I mean the constants changed.
Every security strategy rests on a handful of assumptions that behave like constants. How expensive offensive capability is. How much effort a single attacker can spend. Whose clock runs faster, the attacker’s or the defender’s. Whether an attack looks different from ordinary work. Those four held steady for roughly twenty years, long enough that we stopped examining them. All four have now changed. When the constants change, a strategy that was correct becomes incorrect without anyone making a mistake, and that is the part worth sitting with. Most of what our industry built was right for the world it was built in.
There is a simple way to see what the change does. The damage from a security event is the product of two things.
Expected Damage = P(breach) x B(architecture)
P is the probability an attacker gains access to at least one workload. B is blast radius, meaning what a compromised workload can reach once it is running. Prevention and vulnerability management attack P. Detection compresses the time an attacker gets to operate, which is also an attempt to hold down the consequences of P. Containment reduces B.
For twenty years the overwhelming share of security investment went at P, and that was a rational allocation while the four constants held. What follows is what happened to each one, and what it does to the equation.
1. The price of elite offensive capability collapsed to the price of compute
The binding constraint on offense used to be human expertise, and that expertise was genuinely scarce. Finding an exploitable flaw in a hardened codebase and weaponizing it reliably was work that a small number of intelligence services and a thin layer of the best offensive researchers could do. Scarcity of talent was performing a large share of the world’s defensive work, and none of us were paying for it.
That constraint is gone, and it went for a structural reason rather than a market one. Offensive capability turned out to be an emergent property of general model improvement. Anthropic did not train Mythos to find vulnerabilities. In its April 2026 safety evaluation the model found 181 exploitable zero-days in Firefox where the previous generation found two, and it weaponized a seventeen-year-old FreeBSD kernel flaw in approximately four hours with no human guidance. Weeks later Z.ai released GLM-5.1, a 754 billion parameter open-weight model with near-comparable capability, under an MIT license, full weights, no safety constraints.
Two properties of that matter more than either number. The capability is emergent, which means every frontier model will develop some version of it as a byproduct of getting better at coding and reasoning, whether or not anyone intends it. And released weights cannot be recalled. There is no mechanism to un-release a model, no recall, no restriction, no expiry. So the capability is permanent, and the price of wielding it is the price of compute.
The consequence is about population rather than sophistication. The attack surface did not change. The number of hands testing every door did. Work that was once available to a thin elite is now available to anyone with intent and a credit card, and the elite are still there doing it too.
2. The attacker’s effort budget stopped being finite
Human offense carries a fatigue budget. An operator gets tired, gets bored, gets reassigned, runs out of patience, or decides the target is not worth the fourth week. This is why difficulty worked as a defense. Making something hard raised the attacker’s cost, and some share of attackers stopped.
An autonomous offensive system has no fatigue budget. It runs around the clock, it retries indefinitely, and it has no opinion about the fact that attempt four hundred failed. Its constraints are compute and token cost, and both of those are falling.
That takes difficulty out of the control set. Against a human adversary, difficulty is a real cost because patience is finite. Against a system sampling thousands of targets without fatigue, difficulty costs almost nothing and reduces to latency. The same reasoning disqualifies every probabilistic control as a primary defense. A control with a non-zero miss rate, given effectively unlimited attempts at near-zero cost per attempt, is a control that will eventually be missed.
Anthropic published the cleanest demonstration of this I have seen, and it came from outside our company. In a red team exercise a malicious prompt instructed Claude Code to read local AWS credentials and post them to an external endpoint. Claude completed the exfiltration in twenty-four of twenty-five retries. The only defense that held was environmental containment, meaning the deterministic boundary around what the agent was able to do rather than the probabilistic supervision of what it chose to do.
The design test that falls out of this is worth adopting. Ask of any control whether it makes the attack impossible or merely tedious. Tedious used to be good enough.
3. The clock inverted
Patch-and-scan assumes a window. A vulnerability is discovered, disclosed, fixed, and then deployed, and the defender’s job is to move through that sequence before an attacker moves through their own. The window has been closing for years, and it is now inverted for the vulnerabilities that decide outcomes.
In the first half of 2026, 484 vulnerabilities were newly identified as exploited, and 133 of them were already under exploitation the day they were published. VulnCheck found 28.96 percent of 2025’s known-exploited entries were exploited on or before the day their CVE went public, up from 23.6 percent the year before. For a growing share of the vulnerabilities that decide outcomes, exploitation comes before disclosure.
Discover, disclose, patch, deploy is broken at step one for exactly the vulnerabilities that matter most. You cannot patch ahead of exploitation that is already underway.
4. Remediation has a measured ceiling, not a theoretical one
This is the claim I am most confident in, because it has the cleanest data behind it. Qualys examined 1.1 billion remediation records across more than ten thousand organizations against the CISA KEV catalog. Organizations increased effort 6.5 times in a single year, closing 6.5 times more tickets, and the share of critical vulnerabilities still unresolved at seven days got worse, moving from 56 percent to 63 percent. More effort produced a worse outcome.
The mechanism is not mysterious. Roughly 85 to 90 percent of the remediation timeline is organizational rather than computational, meaning discovery of ownership, change control, testing, scheduling, and approval. Automation compresses the deployment step, which is the small part. Remediation is also not purely subtractive, since 5 to 15 percent of patches introduce new defects, a subset of them security relevant. And a growing share of real exposure is not patchable at all. Misconfiguration, flat networks, and overpermissioned non-human identities are additive and sit entirely outside remediation’s domain.
I want to be careful here, because this argument gets caricatured. Patching is hygiene, discipline in hygiene matters, and it remains the right answer for the bulk of moderate findings. A higher ceiling is still a ceiling.
5. The attack stopped looking like an attack
Eighty-two percent of intrusions now ride valid credentials through legitimate channels and produce no anomalous signal. That number does the most damage to our collective assumptions, because detection requires distinguishability, and distinguishability is a logical property rather than a tooling gap. You cannot distinguish what is indistinguishable. Trusted code executing in a trusted pipeline is not an anomaly. It is Tuesday.
Speed finishes the argument for human-led response. Average eCrime breakout time from initial access to lateral movement is 29 minutes, the fastest observed is 27 seconds, and in one intrusion exfiltration began within four minutes. Average time to identify and contain a breach is 247 days. There is no staffing model, no analyst training program, and no alert-tuning exercise that closes the gap between 27 seconds and 247 days. Detection still matters enormously. It cannot be the mechanism that decides consequence.
6. The terrain stopped holding still
The thing we are defending changed shape underneath the strategy. Machine identities outnumber human identities 144 to 1 in the average enterprise cloud, a ratio that grew 56 percent in the last twelve months, and 97 percent of them carry excessive privileges. Sixty percent of containers live sixty seconds or less and a serverless function may execute in three. A security model that requires agent installation, identity enrollment, policy assignment, and human review takes longer to apply than the workload exists.
The defaults compound it. AWS security groups allow all outbound traffic. GCP VPCs carry an implied allow-all egress rule at the lowest priority, invisible in the firewall rules list. Azure network security groups default to AllowVNetInBound. AKS, EKS, and GKE all default to unrestricted pod-to-pod communication across the cluster. Gartner puts microsegmentation adoption at 5 to 20 percent of enterprises in any form. The interior is open because that is how it ships, and the shared responsibility model places the interior squarely on the tenant. This is a structural condition of the cloud we all bought, not a tenant failure.
The last piece is where enforcement physically sits. A centralized inspection point can only govern traffic that traverses it. Kubernetes pod egress leaves through the node NAT gateway. Serverless egresses through provider-managed infrastructure. East-west traffic moves directly over peering and transit gateways. PrivateLink endpoints and public load balancers create paths that never touch the transit VPC. These are standard cloud networking constructs rather than edge cases, so the inspection point governs a shrinking share of the paths that decide the outcome.
What this does to the equation
Read the six together and the shape is clear. Every lever that lowers P weakened structurally, and they weakened at the same time and for related reasons. Offensive capability is cheap, permanent, and widely held. Attacker effort is effectively unbounded. The patch window is negative. Remediation has a measured ceiling. The majority of intrusions generate no signal to detect. The environment is permissive by default and the enforcement point misses most of the paths.
None of that says P is unimportant. It says P cannot be driven low enough, fast enough, to serve as the primary control. Which leaves B.
B is blast radius, the set of systems, data stores, and external destinations reachable from the point of initial compromise. It is a graph property rather than a metaphor. It is set by architectural policy before anything goes wrong. It does not require anyone to notice the attack, which is precisely why it survives an adversary that produces no signal and never gets tired. It is the one term in the equation the defender fully controls by design.
That is the entire shift, and it is why I keep reducing it to ten words. Trust will be violated. The only question is whether your architecture bounds the blast radius when it is.
The honest boundary
Strong claims deserve a clear statement of what they do not cover, so here is mine.
Vulnerability management is not dead and I am not arguing that it is. Detection still catches the majority of threats, including phishing, stolen credentials, misconfigurations, and known-CVE exploitation, and an organization that abandons it will be worse off. The argument is about primacy, not usefulness. Containment completes detection rather than replacing it, and the useful order is contain first to bound the search space, detect inside the contained space where every denied connection is a lead, then eliminate with precision.
Containment has real limits. It does not prevent initial compromise. It has a connectivity floor, because workloads exist in order to communicate and minimum viable connectivity is greater than zero. It concentrates risk in the hub workloads that must talk widely, meaning identity providers, CI/CD, secrets managers, DNS, and observability, and those need the tightest discipline in the estate. It does not govern privilege escalation inside a workload or exfiltration through a channel that policy already authorizes. It is operationally complex, which is why the deployment sequence runs visibility, then monitoring, then enforcement, and why any reduction in segment size delivers a proportional cut in blast radius. This starts immediately and is not an all-or-nothing program.
I also want to separate what is measured from what is inferred. The remediation ceiling is measured. The collapse of the exploitation window is measured. The malware-free share of intrusions, the breakout times, the machine identity ratio, and the cloud defaults are measured or documented in provider material. The claim that the population of capable attackers grows by orders of magnitude is an inference, drawn from emergent capability, irrecoverable open weights, and falling compute cost. I think it is a strong inference and it is still an inference. Any specific timeline for open-weight models reaching frontier parity in vulnerability discovery is an expert estimate. I hold the estimates loosely and the math tightly.
The question that follows
If a valid credential is used against one of your most critical cloud workloads at 3:00 AM on a Sunday, what, architecturally, prevents it from reaching the ledger? If the answer depends on a detection tool firing first, you do not have containment. You have hope.
I spent most of my career building the detection era at Splunk. This argument runs against my own history, which is uncomfortable and does not change anything. The math is the math. Read it, stress-test it, and tell me where I am wrong.
Join our LinkedIn group Information Security Community!
