It’s Time We Talked About AI and Software Security

If you run a public company and someone steals your customer database, the standard public relations playbook requires you to announce two things. First, you announce that your organisation was targeted by a sophisticated, highly coordinated nation-state adversary. Second, you announce that they used an unprecedented zero-day exploit.This framing is immensely comforting to everyone involved. It suggests your engineers fought valiantly against foreign intelligence operatives before being overwhelmed by classified cyber weapons. The board nods sympathetically, the financial press writes sober headlines about geopolitical friction, and the chief information security officer keeps their job.The post-mortem almost always reveals that a teenager in the West Midlands called your outsourced IT helpdesk, claimed to be an account manager who lost their phone, persuaded an operative to reset their credentials, and was handed administrative access to your entire corporate network before…