Agentic To Autonomous - Where Cybersecurity Stands In The Face Of AI

Agentic To Autonomous - Where Cybersecurity Stands In The Face Of AI

Speakers: Alex Levinson, Chief Information Security Officer, Scale AI

Conference: Black Hat MEA

YouTube: https://www.youtube.com/watch?v=JjdkHBVYZiU

Overview

In his Black Hat MEA talk, "Agentic To Autonomous - Where Cybersecurity Stands In The Face Of AI," Alex Levinson, CISO of Scale AI, charted the cybersecurity industry's evolving journey from today's human-assisted agentic systems towards the ambitious "North Star" of Level 5 autonomy: self-defending networks that operate effectively without direct human intervention. Levinson aimed to cut through the pervasive AI hype, focusing instead on tangible indicators of this transition, including the rise of sophisticated deep research capabilities, a critical shift in measurement from mere detection speed to the validity of outcomes, and the emergence of new forms of "digital exhaust" characteristic of machine-led operations.

The presentation underscored a fundamental challenge facing the industry: the rapid democratization of offensive AI. This burgeoning threat landscape, where advanced AI tools become increasingly accessible to adversaries, demands a radical reshaping of defensive strategies. Levinson highlighted the inherent risks of navigating this "uncanny valley of autonomy," where the allure of self-operating systems can breed complacency and lead to a perilous loss of control. His insights provided a crucial update to a conversation he initiated at the previous year's conference, reflecting on the significant strides made in AI capabilities during 2025 and their profound implications for cybersecurity.

Background

▶ Watch: Introduction: Agentic to Autonomous Cybersecurity (0:00)

Alex Levinson, bringing a unique dual perspective, prefaced his talk by acknowledging his professional roots. While serving as the Chief Information Security Officer for Scale AI, defending some of the largest companies and governments globally, his professional inclination leans "offensive-minded." This background stems from years participating in Capture The Flag (CTF) competitions and, even earlier, hacking video games. His early experiences building bots to automate tasks in games ignited his passion for autonomy, a principle he later recognized as central to success in competitive cyber operations, both offensive and defensive. The ability to "press one button and execute your entire plan and vision simultaneously is just unparalleled," he noted, underscoring the power of automation.

Levinson's previous year's talk at Black Hat MEA established his belief in the eventual reality of autonomous cyber, envisioning a future where agent-taken autonomous agents conduct cyber operations effectively. However, he then classified this vision as "mostly sci-fi." The rapid advancements in 2025, he argued, have significantly shifted this perception, making it "a little bit less" sci-fi today. To frame this evolution, Levinson drew a parallel to the well-defined levels of autonomy in self-driving cars, an area where Scale AI has extensive experience. He lamented the lack of such clear definitions in cybersecurity and sought to establish a framework for cyber autonomy levels. Last year, the industry largely operated at Level 2 autonomy, characterized by co-pilots and reliance on single-shot inference for classification tasks. Tools like ChatGPT demonstrated the potential, but limitations were evident: restricted model architectures, small context windows (preventing the ingestion of vast log data), and a near absence of complex decision-making or goal-oriented behavior. The promise of cyber autonomy remained largely hypothetical.

Key Findings

▶ Watch: Two major AI breakthroughs enabling cyber autonomy (6:00)

The year 2025 marked a pivotal shift, driven by two major breakthroughs in the broader field of AI that are now enabling advanced cyber autonomy. The first was the maturation of reasoning models, characterized by chain of thought processing. This allows models to perform long-running, "behind-the-scenes" internal monologues, enabling them to deduce non-explicit information and arrive at more robust answers through a series of logical steps. This architectural evolution, now dominant in everyday chatbots, provides a crucial "scratchpad" capability previously unavailable for cyber applications.

The second breakthrough was the advent of deep research capabilities. This allows AI agents to actively seek, gather, and process information beyond their initial training data. As Levinson described, a chatbot can now use its chain of thought to scan for relevant information, reach out to external sources, process the data, formulate new questions, conduct further lookups, and enrich its understanding to confidently answer complex prompts. He considers this the "most prolific deployment of agentic utilization" to date, fundamentally transforming AI from a static inference engine into a dynamic, information-seeking entity.

These advancements directly addressed the limitations Levinson identified in his previous talk, particularly concerning the "properties of autonomous cyber":

• Independence of Operation: Significant progress has been made beyond mere runtime. Models now demonstrate resilience in the face of friction, making decisions that sustain their operation. New industry benchmarks, such as intervention rates and remote labor index, have emerged to quantify this independence.
• Adaptive Context Understanding: The rapid adoption of Multi-Contextual Processing (MCP) has been transformative. Levinson noted a paradigm shift from the concept of a limited "context window" to a "context mesh," dramatically improving models' ability to self-orient and adapt to environmental changes.
• Complex Decision-Making: The combination of chain of thought and deep research has unlocked system-two thinking in AI—a logical, deliberate processing style, contrasting with the quick, intuitive system-one thinking. This enables AI to consider risks and anticipate outcomes. The industry has shifted its focus to measuring outcome validity (e.g., "Did we solve the crime?") rather than just accuracy, as seen in benchmarks like "computer use benchmarks" and "exciting benchmark."
• Goal-Oriented Behavior: Levinson candidly admitted being "wrong" about his previous assessment that this was an unstudied area. While not fully achieved, 2025 saw demonstrable progress, with underlying AI technology now capable of supporting research into long-term, goal-directed cyber operations.
• Transparent Reasoning: Modern models now expose their chain of thought and thought logs, providing the necessary transparency to audit decisions made by probabilistic systems, ensuring they are well-grounded in reality rather than mere flukes.

Collectively, these breakthroughs indicate a confident shift from Level 2 autonomy (co-pilots, assisted triage, single-shot inference) to Level 3 autonomy, where "agents are handling specific tasks" with a "human on the loop"—a profound distinction from full automation.

Technical Deep Dive

▶ Watch: Essential properties for autonomous cyber systems (8:00)

The technical heart of the advancements lies in the shift from static, single-shot inference to dynamic, reasoning-driven AI architectures. Reasoning models, powered by chain of thought, allow an AI to break down complex problems into sequential steps, much like a human thinking through a problem. Instead of simply generating a token output, the model engages in an internal monologue or utilizes a scratchpad to explore intermediate thoughts, evaluate options, and refine its understanding before producing a final answer. This iterative internal process is crucial for tasks requiring more than superficial pattern matching, enabling the AI to "think" in a more structured, logical manner.

Complementing this is the rise of deep research capabilities. This functionality transforms an AI from a passive information processor into an active investigator. When confronted with a prompt, the AI can now autonomously formulate sub-queries, interact with external data sources (e.g., websites, databases, internal knowledge bases), retrieve relevant information, and then integrate this new context into its internal reasoning process. This iterative cycle of research and reasoning allows the AI to enrich itself with up-to-date or specific domain knowledge that might not have been present in its initial training data, dramatically expanding its problem-solving scope and confidence.

The concept of Multi-Contextual Processing (MCP) represents a significant leap in how AI models handle and integrate diverse information streams. Previously, models were limited by a finite context window—a specific amount of input tokens they could process at any given time. MCP, as described by Levinson, ushers in a "context mesh" paradigm, where information from various sources and over extended periods can be dynamically linked and referenced. This allows an AI agent to maintain a much richer, more persistent understanding of its environment, crucial for long-running cyber operations where context changes frequently and historical data is vital. The rapid industry adoption of MCP into tooling is a testament to its effectiveness in enabling adaptive contextual understanding.

The shift in AI's cognitive ability is further highlighted by its progression towards system-two thinking. Drawing from psychological models of decision-making, system-one thinking is fast, intuitive, and often emotional, while system-two thinking is deliberate, logical, and analytical. Chain of thought and deep research capabilities directly facilitate system-two thinking in AI, allowing agents to process information, weigh alternatives, and anticipate consequences in a structured manner. This capability is paramount for complex cybersecurity tasks, such as penetration testing or incident response, where hasty, intuitive decisions can have catastrophic outcomes.

This evolution in cognitive ability has necessitated a change in how AI performance is measured. The focus has moved from simple accuracy (e.g., did the model correctly identify a malware signature?) to outcome validity (e.g., did the model successfully mitigate a threat or achieve an offensive objective?). Benchmarks like "computer use benchmarks" and the "exciting benchmark" now assess a model's capacity to perform tasks and deliver results, rather than just its knowledge recall.

However, Levinson also highlighted critical areas requiring further research. Scale AI's studies into propensity score reveal that models tend to perform poorly in high-stakes, high-pressure situations—a critical concern for cybersecurity's inherently stressful environment. Understanding why models falter under "emotional" pressure is vital. Furthermore, intervention rate serves as a key metric for gauging independence of operation, indicating how frequently human intervention is still required. The future also demands addressing agentic identity, establishing robust identity constructs for autonomous agents akin to those for humans, and developing resilience to adversarial noise—an ongoing research focus for his team at Scale AI—to ensure AI systems can withstand sophisticated attacks designed to confuse or mislead them.

Demo / Proof of Concept

▶ Watch: Current state: Level 3 autonomy and future challenges (18:00)

The talk focused on theoretical and observed advancements in AI capabilities and their implications for cybersecurity, rather than showcasing a specific live demonstration or proof of concept. Levinson's discussion centered on the architectural shifts and measurable progress seen across the AI industry that are enabling the move towards greater autonomy in cyber operations.

Defensive Implications

▶ Watch: 2026 focus: Agentic testbeds and trust (20:00)

The rapid advancements in AI, particularly the democratization of offensive AI, present a stark warning and a call to action for defenders. As sophisticated AI tools become more accessible to malicious actors, the defensive landscape must fundamentally reshape itself to keep pace. Defenders can no longer rely solely on traditional, human-centric response mechanisms.

Firstly, the shift towards measuring outcome validity rather than just detection speed is critical. Security teams must move beyond simply counting alerts or identifying threats to evaluating whether AI-driven systems can effectively "solve the crime"—meaning, mitigate the threat, restore systems, or achieve a defined security objective. This requires new metrics and a re-evaluation of how security operations centers (SOCs) assess performance.

Defenders must actively leverage the new AI capabilities discussed, such as reasoning models and deep research capabilities, to enhance their own operations. This means integrating AI agents that can not only classify threats but also conduct autonomous investigations, gather intelligence from diverse sources, and reason through complex attack chains. The adoption of MCP and the context mesh paradigm in security tooling will be essential for building adaptive, context-aware defense systems that can understand and respond to evolving threats across vast and dynamic networks.

However, Levinson's insights also highlight significant challenges. The research on propensity scores indicates that current AI models struggle in high-stakes, high-pressure situations—precisely the environment of incident response. Defenders must factor this limitation into their strategies, ensuring that human oversight remains robust, especially in critical, time-sensitive scenarios. The current state of Level 3 autonomy, with a "human on the loop," emphasizes that full automation is not yet a reality for core defensive functions like a Tier 1 SOC operator. Strategic deployment of AI agents for specific, well-defined tasks is prudent, but humans must retain ultimate control and decision-making authority for the foreseeable future.

Furthermore, the concept of agentic identity poses a crucial defensive implication. As more autonomous agents operate within a network, establishing clear identity constructs, access controls, and auditing mechanisms for these agents becomes paramount to prevent insider threats or supply chain attacks involving compromised AI systems. Finally, proactive research and development into resilience to adversarial noise are necessary to ensure that defensive AI systems cannot be easily bypassed or manipulated by sophisticated attackers employing AI-driven deception techniques.

Key Takeaways

• Significant Leap in Autonomy: Cybersecurity's journey towards autonomy accelerated significantly in 2025, moving from "mostly sci-fi" Level 2 (co-pilots) to practical Level 3 (agents handling specific tasks with humans on the loop) due to breakthroughs in general AI.
• Enabling AI Breakthroughs: The maturation of reasoning models (chain of thought, internal monologues) and deep research capabilities (active information gathering and enrichment) are the core enablers, allowing AI to perform more complex, goal-oriented cyber operations.
• New Metrics for Success: The industry is shifting from measuring simple accuracy or detection speed to outcome validity (e.g., "Did the model solve the crime?"), reflecting AI's newfound ability for system-two thinking and complex decision-making. New benchmarks like intervention rates and remote labor index quantify operational independence.
• Adaptive Contextual Understanding: Technologies like Multi-Contextual Processing (MCP) have rapidly advanced, leading to a paradigm shift from limited "context windows" to a "context mesh," significantly improving AI's ability to understand and adapt to dynamic cyber environments.
• Challenges and Future Focus: While progress is substantial, full Level 5 autonomy (human-off-the-loop) for critical roles like SOC operators or pen testers remains aspirational. Key challenges include improving AI's performance under high-pressure situations (propensity score research), establishing agentic identity for autonomous systems, and ensuring resilience to adversarial noise.
• Defensive Imperative: The "democratization of offensive AI" demands a fundamental reshaping of defense. Cybersecurity professionals must rapidly adopt and integrate these advanced AI capabilities while carefully managing the risks of complacency and loss of control in the "uncanny valley of autonomy."

About the Speaker(s)

Alex Levinson serves as the Chief Information Security Officer (CISO) for Scale AI. Professionally, he identifies as more "offensive-minded" but operates as a defender in his day-to-day role, securing data for some of the world's largest companies and governments. His extensive background includes 15 years in competitive cyber spaces, participating in CTFs, and even hacking video games in his youth—experiences that ignited his passion for autonomy and the development of bots. Scale AI, his current employer, is deeply embedded in the AI ecosystem, working at the nexus of major AI companies and possessing significant experience in the autonomous vehicle space, which has informed Levinson's perspective on defining and achieving autonomy in cybersecurity.