Description
His conclusion:
> Context wins
>
> Basically whoever can see the most about the target, and can hold that picture in their mind the best, will be best at finding the vulnerabilities the fastest and taking advantage of them. Or, as the defender, applying patches or mitigations the fastest.
>
> And if you’re on the inside you know what the applications do. You know what’s important and what isn’t. And you can use all that internal knowledge to fix things--hopefully before the baddies take advantage.
>
> Summary and prediction
>
> 1. Attackers will have the advantage for 3-5 years. For less-advanced defender teams, this will take much longer.
> 2. After that point, AI/SPQA will have the additional internal context to give Defenders the advantage.
>
> LLM tech is nowhere near ready to handle the context of an entire company right now. That’s why this will take 3-5 years for true AI-enabled Blue to become a thing.
>
> And in the meantime, Red will be able to use publicly-available context from OSINT, Recon, etc. to power their attacks.
I agree.
By the way, this is the SPQA architecture.
> Context wins
>
> Basically whoever can see the most about the target, and can hold that picture in their mind the best, will be best at finding the vulnerabilities the fastest and taking advantage of them. Or, as the defender, applying patches or mitigations the fastest.
>
> And if you’re on the inside you know what the applications do. You know what’s important and what isn’t. And you can use all that internal knowledge to fix things--hopefully before the baddies take advantage.
>
> Summary and prediction
>
> 1. Attackers will have the advantage for 3-5 years. For less-advanced defender teams, this will take much longer.
> 2. After that point, AI/SPQA will have the additional internal context to give Defenders the advantage.
>
> LLM tech is nowhere near ready to handle the context of an entire company right now. That’s why this will take 3-5 years for true AI-enabled Blue to become a thing.
>
> And in the meantime, Red will be able to use publicly-available context from OSINT, Recon, etc. to power their attacks.
I agree.
By the way, this is the SPQA architecture.
Basic Information
ID
SCHNEIER:C1E75F66CE18F62857DD6FDE425254FF
Published
Oct 2, 2025 at 16:19