Defensive AI Advantage
The thesis that the same AI capabilities which make cyberattacks more potent also give defenders a durable advantage — if they act first.
The argument
AI vulnerability discovery is a dual-use capability. In adversary hands, it enables faster, more frequent, more sophisticated attacks. In defender hands, it enables proactive scanning and patching of vulnerabilities before attackers find them. The asymmetry favors defenders because:
- Defenders can act first. Vulnerabilities can be found and patched before adversaries develop exploits.
- Defenders control the code. They can fix flaws directly, while attackers must work around patches.
- AI can produce more secure new software. Beyond fixing existing bugs, AI can reduce the rate at which new vulnerabilities are introduced.
Conditions
The advantage holds only under specific conditions:
- Speed. Defenders must deploy AI-assisted scanning before capabilities proliferate to adversaries.
- Coordination. No single organization can cover the full attack surface — coalition efforts like Project Glasswing are necessary.
- Open-source coverage. Most critical infrastructure runs on open-source software maintained by under-resourced teams. The defensive advantage collapses if these codebases are left unscanned.
Counterargument
The window between vulnerability discovery and exploitation has collapsed — CrowdStrike’s CTO notes it went from months to minutes with AI. If patches lag behind discovery, AI-assisted scanning may expose more attack surface than it secures. The advantage depends on patching speed matching discovery speed.
See also
- AI Vulnerability Discovery — the underlying capability
- AI Cyber Proliferation — the threat that erodes the advantage
- Project Glasswing — an attempt to realize the defensive advantage