Keep Calm. Hack On.

Keep Calm. Hack On.

Speakers: Renaud Feil, Co-founder and CEO, Synacktiv

Conference: BSides Canberra

YouTube: https://www.youtube.com/watch?v=64wO8yAIylI

Overview

In his compelling keynote at BSides Canberra, Renaud Feil, co-founder and CEO of the renowned French offensive cybersecurity firm Synacktiv, tackles the pervasive anxiety surrounding Artificial Intelligence (AI) within the cybersecurity community. Dispelling notions of an impending "cyber apocalypse" or mass obsolescence for human professionals, Feil offers a nuanced and historically informed perspective on AI's true impact. His talk serves as a vital call for calm reflection amidst the hype and fear, encouraging professionals to view AI not as a replacement, but as an indispensable tool that will reshape roles, amplify existing skills, and necessitate adaptation.

Feil's presentation is particularly relevant given the rapid advancements and widespread adoption of AI technologies, which have sparked both excitement and trepidation across industries. For cybersecurity, a field defined by a constant arms race between attackers and defenders, the introduction of powerful AI tools raises fundamental questions about the future of vulnerability research, red teaming, and defensive strategies. Feil challenges the prevailing narrative of AI as an unaligned, self-improving agent poised to conquer the digital world, instead framing it as a technological evolution that, like many before it, will demand new approaches and a renewed focus on human expertise in critical areas.

The core message resonates with professionals grappling with the potential disruption: while AI will undoubtedly automate many tasks and shift the landscape, it will ultimately favor organizations and individuals who possess both financial resources and deep, specialized skills. Rather than leading to a wholesale replacement, AI is predicted to widen the gap between the proficient and the unprepared, making human ingenuity and strategic oversight more crucial than ever. Feil’s talk is a pragmatic guide for navigating this new era, emphasizing the importance of adaptability, continuous learning, and a focus on the intrinsic "fun" of problem-solving in hacking.

Background

▶ Watch: Addressing anxiety: Will AI replace us? (0:00)

The current discourse around AI often mirrors historical patterns of fear and uncertainty surrounding new, disruptive technologies. Feil draws a direct parallel to the concept of "dread risk," a psychological phenomenon identified by Paul Slovic, where humans tend to overreact to risks that are new, poorly understood, perceived as out of control, and potentially catastrophic. He argues that the narrative of a "cyber apocalypse" driven by rogue AI agents perfectly fits these criteria, leading to an exaggerated sense of alarm.

To contextualize this, Feil revisits several historical "dread risks" that gripped past generations and the cybersecurity community:

• Nuclear Apocalypse: His grandparents building a fallout shelter in Europe in anticipation of a nuclear war, a fear that ultimately did not materialize in the way anticipated, thanks in part to initiatives like Eisenhower's "Atoms for Peace" which reframed atomic energy.
• The Blaster Worm (2003): This worm exploited a critical vulnerability in Microsoft RPC DCOM on Windows XP and 2000, causing over $300 million in damages. At the time, it felt like an uncontrolled digital plague, yet the internet survived.
• Metasploit's DB Autopwn: When Metasploit introduced its automated exploit feature, which would analyze open ports and automatically fire matching exploits, many feared it would enable "kids with absolutely no skills" to "hack the planet." This widespread destruction did not occur.
• The L0pht Heavy Industries (1998): Mudge, testifying before the US Senate, famously claimed he could shut down the entire internet in less than 30 minutes by exploiting flaws in BGP routing. While a wake-up call, the internet remains operational, albeit with ongoing security challenges.
• "Electronic Pearl Harbor": A term frequently used by his manager during his early penetration testing career to convince clients of imminent cyber threats, often met with indifference.

Feil highlights a crucial distinction in the current AI debate: unlike past warnings from independent hackers like the L0pht Collective who had little to gain, today's prominent AI "whistleblowers" are often leaders of the very companies creating these technologies. He points to companies like Anthropic, which is planning a massive IPO aimed at raising $100 billion for a valuation of around $2 trillion—a figure that dwarfs many national GDPs. Feil suggests that such ambitious financial goals necessitate an aggressive communication strategy that creates a sense of urgency, revolution, and even fear, to attract investors and dominate public discourse. "You just can't say I'm selling a product that helps developers being more productive," he observes. "You need something that is at the top of everyone's mind... something that is so revolutionary that it gets, you know, probably scary." This strategy, he implies, involves a "cozy alliance between journalists and AI giants" to amplify apocalyptic narratives, as "it's much easier to attract readers with apocalypse stories."

Furthermore, Feil challenges the notion of AI being inherently "bad" or "cheating" by drawing on his own experiences with human competitiveness. He recounts anecdotes from the DEF CON CTF, where human teams (including his own, "Retards") engaged in various forms of "cheating" and "nasty tricks" – from having off-site experts to attempting to steal challenge content from organizer rooms. His point is clear: "Don't tell me we fear robots just because they cheat. Humans are not better." This historical context serves to ground the AI discussion in a more rational, less emotionally charged reality, suggesting that the current fears, while understandable, are often amplified and rooted in familiar human psychological biases.

Key Findings

▶ Watch: Are AI industry warnings about money? (11:45)

Renaud Feil's central arguments challenge prevailing anxieties about AI in cybersecurity, offering a more balanced and forward-looking perspective:

1. No Imminent Cyber Apocalypse: Despite sensational headlines and warnings from some industry leaders, Feil asserts that a full-scale "cyber apocalypse" orchestrated by rogue AI agents is not on the immediate horizon. He argues that while AI can be misused, the leap from current "limited incidents" to a catastrophic, out-of-control scenario is often exaggerated due to the "dread risk" phenomenon.
2. AI Amplifies Existing Skills and Widens the Gap: Feil posits that AI will not democratize hacking or defense by making everyone equally capable. Instead, it will act as an amplifier, enhancing the capabilities of those who already possess strong skills and financial resources. "AI will amplify existing skills," he states, predicting that it will "widen the gap between the good and the bad when it comes to cybersecurity." Organizations with money and expertise will leverage AI to become even more formidable, while those neglecting the shift will become easier targets, potentially leading to a "cyber apocalypse" for the unprepared.
3. AI as a Necessary Tool to Manage Exponential Complexity: Feil argues that AI's emergence is not merely an option but a necessity for the cybersecurity industry. He describes the exponential growth of human knowledge, lines of code, NPM packages, and IT system complexity as overwhelming for human comprehension. "We need AI to keep pace with the exponential growth of human knowledge and the exponential complexity of IT system," he explains. He introduces the metaphor of the ouroboros snake, an ancient symbol depicting a snake eating its own tail, to illustrate how AI generates knowledge and code at a scale beyond human management, thereby creating a world so complex that humans require AI to navigate it.
4. AI Can Enhance the "Fun" and Focus of Cybersecurity Work: While acknowledging that AI might automate some aspects of hacking that appeal to those who enjoy the "process" or "hard work," Feil emphasizes its potential to eliminate the "boring and time-consuming" parts of penetration testing and vulnerability research. By automating repetitive tasks, debugging (e.g., CSS, memory leaks), and routine information gathering, AI can free up human experts to focus on more complex, creative, and challenging problems. This shift, he suggests, can lead to a more enjoyable and impactful career, allowing professionals to focus on "solving the problem and getting things done."
5. Change is Inevitable but Gradual: Drawing on historical examples like the Luddites and his father's career as a photocomposer, Feil notes that while new technologies fundamentally change industries and make old jobs obsolete, this transformation is "always slower than what the prophets of new technology say" but "always quicker than what people who don't believe in change think." This suggests that cybersecurity professionals have a window to adapt and redefine their roles rather than face instant displacement.

Technical Deep Dive

▶ Watch: AI's impact: Will it favor attackers or defenders? (18:00)

While the talk is not a deep dive into specific AI algorithms for hacking, Feil extensively discusses the technical implications of AI on the offensive and defensive cybersecurity landscape, framing it within the eternal "sword and shield" dynamic. He highlights that cybersecurity, unlike classical safety disciplines like fire prevention, involves "smart defenders facing smart attackers," both capable of innovation and surprise. The introduction of AI fundamentally shifts the capabilities of both sides.

Feil traces the history of automation in cybersecurity, noting that previous technological advancements, while significant, did not eliminate the need for human expertise:

• Automated Vulnerability Scanners: These tools offered a "huge advantage for defenders" by automating detection, yet "20 years after that, you still find bugs."
• Fuzzers: He recalls working with Laurent Gaffié at Stratsec in 2010, when fuzzers (like those used against SMBv1 and SMBv2) became prevalent, enabling the discovery of numerous crashes. Even when Google committed "a large amount of computing power to fuzz open source libraries," the "party for kids like us" (vulnerability researchers) did not end.

This historical perspective underpins his argument that AI, while more advanced, will follow a similar pattern: it will augment, not entirely replace. The true technical impact of AI lies in its ability to process vast amounts of data, identify patterns, and generate content at unprecedented speeds. This manifests in several ways:

• Code Generation and Debugging: AI can rapidly generate code, assist with prototyping, and significantly reduce time spent on tedious debugging tasks like fixing CSS issues or elusive memory leaks. This directly impacts developers and vulnerability researchers who spend considerable time on these activities.
• Knowledge Management and Information Retrieval: Feil notes the difficulty of finding precise information on Google Search and the failures of traditional knowledge management systems. AI is seen as a solution to "keep pace with the exponential growth of human knowledge" and the increasing complexity of IT systems, which are "kept on building on top of the previous layers."
• The "Ouroboros Snake" of Complexity: This powerful analogy describes AI's self-perpetuating cycle. AI is initially seen as a solution to manage the existing complexity and volume of code and vulnerabilities. However, AI itself is now "being used to create more code, to create more knowledge," which in turn creates more potential flaws and complexity. This necessitates "more AI to actually track and fix these bugs." The machine makes itself indispensable by generating a world so intricate that humans may no longer manage it without AI. This creates a continuous demand for both AI-driven tools and human oversight.
• Impact on Vulnerability Research: For serious vulnerability research, particularly against complex targets like iOS, AI makes the field "more and more difficult" for individual researchers. However, for penetration testers, the sheer "amount of code created will probably make it necessary to have more people review it even if it's with the help of AI." This suggests a shift towards human experts leveraging AI to manage and audit larger codebases, potentially using tools like Code QL or Semgrep rules to understand and audit AI-generated code for vulnerabilities.

Feil concludes that the question of whether AI will primarily secure existing code or create new, flawed code without human validation will likely lean towards the latter, as "mankind evolves and I'm sure it will be used to produce even more." This implies a continuous, escalating cycle where AI both creates and helps manage complexity, ensuring a persistent need for skilled human intervention.

Demo / Proof of Concept

▶ Watch: How AI changes the 'fun' of hacking (30:00)

This keynote address was a conceptual and philosophical discussion on the impact of AI on the cybersecurity industry, rather than a technical demonstration. As such, there was no live demo or proof of concept presented during Renaud Feil's talk.

Defensive Implications

▶ Watch: Professional advice: Adapt, behave well, stay expert (36:30)

Renaud Feil provides practical advice for both organizations and individual professionals to navigate the AI-driven transformation in cybersecurity, emphasizing adaptation over fear.

For Organizations and Managers:

1. Value and Nurture Experts: Organizations must recognize that highly skilled human experts remain indispensable. AI excels at automating routine tasks, but critical, complex challenges—such as identifying vulnerabilities in complex state machines or developing exploits for systems with moving memory layouts—still require human ingenuity. Managers should understand which tasks AI is good at and automate those, reserving the most challenging and critical work for their human talent. Feil cautions against the belief that AI will solve everything, reminding executives that "trees don't grow to the sky" – every technology has its limits.
2. Proactive Communication and FUD Management: Executives and managers must openly discuss their use of AI with customers and stakeholders. They will face significant pressure from FUD (Fear, Uncertainty, and Doubt) generated by vendors, journalists, and politicians. By transparently explaining how AI is integrated into their security posture, organizations can build trust and counter narratives from new competitors who might leverage AI as an argument to replace established players.
3. Maintain Brand and Trust: In an era of increasing automation, an organization's brand reputation and the trust it has built with customers become even more valuable. While AI can automate many flaw identifications, attackers will also use similar tools. The differentiator will be "who uses it better" and who can provide the expertise and accountability that AI alone cannot. Critical tasks will always demand human expertise and reputation.
4. Control Budget and Avoid Vendor Lock-in: Organizations must remain vigilant about managing their AI-related expenditures. Feil observes that AI giants currently struggle with customer lock-in due to the rapid advancement of open-weight models. As long as regulation doesn't enforce monopolies, costs should remain competitive. Managers should discourage practices like "token masking" that could lead to inflated costs and over-reliance on proprietary solutions.

For Professionals:

1. Embrace "Better" Behavior: Professionals should strive to behave at least as well as, or even better than, advanced AI models like Claude or ChatGPT. This means being "nice, responsible," proactively "fix[ing] the issue," and "say[ing] it when you don't know." Beyond technical skills, cultivating positive relationships with colleagues and demonstrating empathy will become increasingly important. The era of the "bastard operator from hell" – a highly skilled but difficult individual – is fading, as AI can provide knowledge without the interpersonal friction.
2. Overcome Pride; Embrace New Tools: The "pride of being an artist, a digital artisan" who only does things "the old way" is a dangerous trap. While personal satisfaction from manual work is valid, professionals must not let it be an "excuse for not trying new tools." The objective is to "get the work done" effectively, and that means utilizing the best available tools, including AI.
3. Stay an Expert and Understand AI's Mechanisms: True expertise will shift from simply doing tasks to understanding what AI is doing and how to improve upon it or audit it. Professionals need to comprehend the underlying mechanisms of AI-assisted processes. This includes knowing how to create tools like Code QL or Semgrep rules to analyze AI-generated code, identify potential flaws, and establish "repeatable audit trails." This ensures human oversight and accountability for AI's outputs.

Ultimately, Feil believes that adaptability is key. Professionals who embrace AI as a partner, focusing on critical thinking, problem-solving, and continuous learning, will thrive in this evolving landscape.

Key Takeaways

• AI is an Amplifier, Not a Replacer: AI will augment human capabilities and widen the gap between skilled, well-resourced organizations and those unprepared, rather than universally replacing human cybersecurity professionals.
• Contextualize AI Fears with History: Current anxieties about a "cyber apocalypse" mirror past "dread risks" associated with new technologies and cyber threats, which often proved less catastrophic than initially predicted.
• AI is Essential for Managing Complexity: The exponential growth of code, knowledge, and IT system complexity makes AI a necessary tool for human professionals to keep pace and manage the digital world.
• Focus on the "Fun" and Critical Tasks: AI can automate tedious, repetitive work, allowing human experts to concentrate on complex problem-solving, creative challenges, and strategic thinking, thus enhancing job satisfaction and impact.
• Adaptability and Continuous Learning are Paramount: Professionals must embrace new tools, stay updated on AI's capabilities and limitations, and focus on understanding what AI does and how to audit or improve its outputs, rather than resisting change.
• Maintain Human Expertise and Trust: Organizations must continue to invest in and nurture human experts for critical tasks, while leveraging their brand and reputation to provide the trust and accountability that AI alone cannot.

About the Speaker(s)

Renaud Feil is the co-founder and CEO of Synacktiv, a highly regarded French offensive cybersecurity company known for its exceptional capabilities in the field. With over 20 years of experience, Renaud began his career as a penetration tester in Paris. He spent more than two years in Australia, working initially at KPMG, then at a boutique firm called Sift, which later merged with Stratsec and was acquired by BAE Systems.

A passionate participant in Capture The Flag (CTF) competitions, Renaud competed with his team "Retards" in events like the DEF CON Human CTF, enjoying the challenge of competing against other humans globally. He stepped away from CTFs just before the infamous DARPA Cyber Grand Challenge in 2016, which introduced human-robot competition. Upon returning to Paris, he co-founded Synacktiv, specializing in offensive security, primarily focusing on red teaming exercises and vulnerability research. Despite his current leadership role, Renaud admits to being a "late believer in AI," having initially regarded discussions about its transformative power as "science fiction" until early 2023. His insights are drawn from extensive experience in offensive security, a deep understanding of hacker culture, and a pragmatic view of technological evolution.