Keynote: Offense and Defense in an Era of Systemic Asymmetry

Keynote: Offense and Defense in an Era of Systemic Asymmetry

Speakers: Aaron Portnoy, Chief Product Officer, Mindgard

Conference: Ekoparty Miami

YouTube: https://www.youtube.com/watch?v=8jvSbaZ4ULw

Overview

In this compelling keynote address at Ekoparty Miami, Aaron Portnoy, Chief Product Officer at Mindgard, dissects the rapidly widening chasm between offensive and defensive cybersecurity capabilities, primarily driven by the transformative power of Artificial Intelligence (AI). Portnoy argues that the cybersecurity world is currently in an "interregnum" – a transitional period where the old order of defense is failing, and a new, effective defensive paradigm has yet to emerge. This imbalance is not merely a temporary shift but a fundamental, systemic asymmetry that profoundly favors attackers, who are adopting AI technologies at an unprecedented pace compared to their defensive counterparts.

Portnoy's talk serves as a stark warning and a call to action for the cybersecurity community. He posits that current defensive strategies, largely built on heuristic and reactive models, are fundamentally ill-equipped to counter the dynamic, autonomous, and cognitive capabilities of AI-fueled attacks. The core message underscores the urgency for defenders to abandon outdated approaches and embrace a first-principles reevaluation of their technology and philosophy, lest they be overwhelmed by a "tidal wave" of emergent, AI-generated threats.

The significance of this discussion cannot be overstated. As AI becomes more sophisticated and accessible, the implications for national security, critical infrastructure, and enterprise resilience are profound. Portnoy's analysis provides a framework for understanding the unique characteristics of AI-driven offense and offers conceptual pathways for developing a more resilient, adaptive defense. It challenges the industry to move beyond superficial AI integrations and address the deep structural changes required to achieve any semblance of parity in this new era of cyber warfare.

Background

▶ Watch: Initial asymmetry: attackers adopting AI faster (0:00)

The foundational premise of Portnoy's talk is the distinct difference between heuristic and cognitive approaches in cybersecurity. He defines heuristic as traditional, rule-based, or signature-driven defenses—think IDS/IPS, regular expressions, and hard-coded logic. In contrast, cognitive refers to adaptable, dynamic systems powered by AI, such as Large Language Models (LLMs) and generative AI, capable of reasoning and learning. The central problem, Portnoy highlights, is that while AI offers immense potential for both offense and defense, attackers are adopting it "a heck of a lot quicker" (00:00).

This rapid adoption by attackers is attributed to a peculiar characteristic of LLMs: their ability to be "plausibly incorrect" (01:00). For an attacker, the ability to try multiple times and succeed even with plausible inaccuracies is an advantage. Defenders, however, operate under stricter constraints; their tools must be fastidious and correct, as they cannot afford to have systems "lying" to them. This fundamental difference in acceptable error tolerance creates the first domino in a series of compounding asymmetries.

The current state of defense, Portnoy observes, is characterized by a "thin veneer of AI tacked on top" of existing technologies (02:00). Many defensive products marketed as AI-powered at conferences like RSA are, upon closer inspection, merely rebranded legacy solutions. This superficial integration has yielded few success stories against determined AI-powered attackers, while anecdotes of successful AI-driven attacks proliferate daily. This leads to a significant imbalance, exacerbating pre-existing challenges in vulnerability management. Portnoy cites the exponential growth of CVEs year over year (06:00) and alarming statistics from HackerOne in April 2025 (note: likely a future projection or typo in the transcript, but the trend is the focus): submissions up 76%, unresolved backlogs up 21 times, and researcher turnaround time dropping 80% (06:00). This indicates a "tidal wave" of vulnerabilities that current human-centric processes cannot possibly manage.

Portnoy references Rich Sutton's well-known quote, "compute is always going to beat humans" (06:00), to underscore that this surge in vulnerabilities is not a temporary spike but the "new normal." The skill gap is closing, and the economics of vulnerabilities are changing dramatically. He recounts his experience starting the Pwn2Own contest in 2006, where turning away competitors was unheard of. In contrast, Pwn2Own Berlin recently had to turn away participants, leading to full disclosures that further disadvantage defenders (08:00). This signifies a paradigm shift where experts are "lapped" by those who can effectively harness LLMs. The long-standing platitude of "assume breach" (08:00) is no longer a philosophy but a stark reality, demanding architectural reckoning, as attackers gain thousands of unpatched capabilities and can generate exploits within minutes of a CVE publication (09:00).

A critical historical "wall" in offensive operations, particularly for automated red teaming, was the necessity for human judgment once inside an unknown network (10:00). Traditional automated systems, like those at his former company Randori, could handle reconnaissance and initial exploitation but struggled with autonomous post-exploitation, lateral movement, and exfiltration in novel environments. This required a human operator in the loop, creating a bottleneck where instructions and data had to cross perimeter boundaries, increasing the risk of detection. This "remote-controlled limb" model for C2 (12:00) is where many traditional defensive products focus their monitoring. However, as Portnoy will elaborate, AI-fueled offense is rapidly dismantling this wall, rendering such defenses increasingly irrelevant.

Key Findings

▶ Watch: Four compounding asymmetries favoring AI offense (LOOP) (17:45)

Aaron Portnoy's keynote articulates several critical findings regarding the evolving landscape of cybersecurity:

1. Systemic Asymmetry Driven by Compounding Factors: The core finding is that AI is not just introducing new threats but creating a systemic asymmetry where offense gains an overwhelming advantage. This is due to four interrelated factors, summarized by the acronym LOOP: Locality, Observability, Opportunism, and Tempo. These asymmetries are not independent but "compound" and "feed into each other," making individual solutions ineffective (18:00).
2. Shift from Kill Chain to Kill Cycle: Traditional offensive models, such as the 2011 Lockheed Martin Kill Chain, are linear and externalized, allowing defenders to focus on breaking specific links. AI-fueled offense, however, transitions to an internalized, adaptive Kill Cycle, where sensing, reasoning, development, extension, and execution occur autonomously within the target environment. This polymorphic and opaque process fundamentally changes the shape of attacks, making legacy defenses obsolete (16:00).
3. Offense Operating at a Higher Level of Intervention: Portnoy utilizes Donella Meadows' 12 Places to Intervene in a System framework to illustrate the disparity. He argues that AI-fueled offense has already "transcended the paradigm" and operates at the highest level of influence—changing the system's goals and even its "paradigm" itself. In contrast, defensive efforts, even ambitious ones like Anthropic's Claude Wing (Glass Wing), are largely stuck at lower levels, focusing on patching, coordinated disclosure, or merely bolting AI onto existing structures (28:00).
4. Observable Structural Properties of AI-Fueled Offense: Despite AI's adaptability and dynamism, Portnoy identifies four inherent structural properties of AI-fueled offense, summarized by ACID: Acceleration, Compression, Identity, and Dependence. These properties, unlike specific attack patterns, represent stable distributions that can be observed and potentially manipulated by defenders, offering a unique opportunity to regain some parity (37:00).
5. Vulnerability of AI's Reward Loop: The "Dependence" property, specifically the mathematical reward loop that drives AI behavior, is highlighted as a critical vulnerability for AI-fueled offense. By introducing intentional complexity and deceptive technology (e.g., tar pits, prompt injection), defenders can corrupt this reward loop, steering the AI into latency-heavy, resource-consuming operations, thereby degrading its effectiveness and incurring significant cost for attackers (43:00-44:00).

Technical Deep Dive

▶ Watch: Defense's inherent reactivity and structural limitations (28:50)

Portnoy frames the current cybersecurity landscape through the lens of heuristic versus cognitive capabilities. Heuristic approaches, relying on signatures, rules, and frozen logic (e.g., IDS, IPS, regular expressions), are static and predictable. Cognitive approaches, powered by LLMs, generative AI, and transformers, are dynamic, adaptable, and possess a reasoning engine (03:00). The core technical challenge is that AI-fueled offense leverages cognitive capabilities far more effectively than current heuristic-based defense.

The traditional "wall" in offensive operations, where automated systems required human intervention for judgment inside a target network, is being dismantled (10:00). With LLMs, the judgment (decision-making) can move inside the perimeter. Instead of a remote-controlled limb, the AI implant can utilize local GPU infrastructure, consumer laptop GPUs, or readily available API keys (e.g., OpenAI keys found on disk or in memory) to perform cognitive reasoning (14:00). This allows the implant to adapt autonomously to the environment. Taking this a step further, development can also be forward-deployed. Portnoy recounts Mindgard's experience where, instead of shipping malicious code past a guardrail, they asked the target AI system to generate and execute the malicious Python script internally. This creates an emergent payload—brand new, without a prior signature—executed in situ, making it incredibly powerful and difficult to detect (14:00).

This internal, autonomous capability transforms the traditional Lockheed Martin Kill Chain (Recon, Weaponize, Deliver, Exploit, Install, C2, Act – 2011) into a Kill Cycle (16:00). The Kill Chain is largely externalized, linear (with some looping), and leaves numerous artifacts on disk, wire, and memory. Defensive products are designed to break specific links in this chain. The Kill Cycle, however, is highly internalized, polymorphic, and adaptive. It involves continuous sensing, reasoning, developing new capabilities, extending itself, and executing within the environment. This cycle's reasoning portion often occurs in an opaque, unobservable manner, making introspection incredibly difficult even for frontier AI labs, thus significantly hindering defenders (17:00).

These changes manifest as the four LOOP asymmetries:

1. Locality: Heuristic offense is invasive; it introduces foreign elements into an environment, creating a detectable delta. Cognitive offense is endemic, arising within the environment, adapting to local conditions (e.g., observing network traffic to blend in), and camouflaging itself (19:00).
2. Observability: Traditional defense relies on deducing a causal chain of events. Cognitive offense, however, produces outcomes from a Bayesian distribution of probabilities. Defenders see the consequences of decisions, not the encodings of the decisions themselves. The actual reasoning is ephemeral. Current SOC tooling, built for human pace (hours, days) and correlation across slow events, becomes a "forensic historian" or "archaeologist," ingesting event data long after the autonomous attack has completed its objectives (21:00).
3. Opportunism: Cognitive offense can continuously observe, reason, and act autonomously, turning even fleeting vulnerabilities (e.g., a 90-second misconfigured GitHub action, a 5-minute Python HTTP server) into exploitable attack surfaces. This was previously difficult due to the need for continuous human observation and real-time judgment (23:00).
4. Tempo: Human-driven attacks follow a "burst-rest-burst" or staccato pattern, as identified by Albert Laszlo Barabási's 2005 Nature paper. AI-fueled attacks operate at the pace of inference, a continuous, legato pattern, compressing the decide-and-act loop. The mean time to exploit a CVE has dropped from hours/days to 10-15 minutes (25:00). Mandiant's M-Trends report noted initial access to handoff reduced from 8 hours in 2022 to 22 seconds in 2025 (25:00). This velocity is beyond human or current defensive system capabilities.

Portnoy then introduces Donella Meadows' 12 Places to Intervene in a System to highlight the strategic disparity (27:00). Defense is largely stuck at lower levels of influence: patching based on CVSS cutoffs, fixed patch cadences, or "bolting on AI" to existing firewalls or SOC co-pilots. Even significant efforts like Anthropic's Claude Wing (Glass Wing), while effective, are limited in scope (early access, specific attack surface, big players only) and still operate within the existing paradigm (28:00). Offense, however, has transcended this, operating at Level 1—effectively changing the system's fundamental goals or even the paradigm itself.

Further structural asymmetries persist, favoring offense (31:00):

• Oracling: Attackers know definitively if an attack worked (got a shell, file, access); defenders struggle to prove a compromise did not happen.
• Focus: Attackers can hyper-focus on a single target or vector; defenders must secure an entire, complex environment.
• Cost of Error: Attackers can often retry (brute-force login, exploit failed); defenders typically get one shot to stop an attack.
• Initiative: Attackers choose the time and place for an attack (e.g., Christmas Eve).
• Alignment Tax: Defenders face significant burdens with compliance, PII, regulation, and auditability for AI deployment; attackers have no such constraints (33:00).

Despite these overwhelming advantages for offense, Portnoy offers a glimmer of hope by identifying ACID properties of AI-fueled offense that can be leveraged for defense (37:00):

1. Acceleration: AI compresses the time for complex tasks. Hack The Box data shows the highest discrepancies (up to 10.5 hours reduction) on the most difficult challenges, where reasoning and cognitive load are highest. This is because LLMs parallelize tasks, unlike sequential human processing (38:00). This non-uniform speedup is an observable property.
2. Compression: LLMs can rapidly integrate and compress vast amounts of information (e.g., crafting a realistic fraudulent wire transfer from terabytes of Google Drive data). The density and complexity of information ingested and produced by AI are measurable characteristics that reveal non-human origins (40:00).
3. Identity: AI, despite trying to be human-like, often produces outputs that fall into the "uncanny valley," identifiable as non-human (e.g., typos, fragmented sentences, an unusually broad skill set for a single entity). This "texture" of AI-generated content can be detected (41:00).
4. Dependence: Unlike humans with endogenous motivation, LLMs operate on a mathematical reward loop. This gradient can be abused. By feeding deceptive information or creating intentional complexity, defenders can steer the LLM, making it waste time and resources. Portnoy gives an example of attacking Perplexity, where a fake back-end Linux system consumed the agent's time without yielding value (43:00).

These ACID properties provide levers for control (44:00). While Identity is largely read-only, Acceleration, Compression, and Dependence are interconnected. Corrupting the reward loop (Dependence) with deceptive technology like tar pits (which slow down operations) can make the AI pursue latency-heavy, resource-intensive tasks. Similarly, filling environments (e.g., Google Drive) with prompt injections can co-opt or neuter AI-focused offensive tools by manipulating their compression capabilities. This fundamentally changes the defensive strategy from fixing every vulnerability to manufacturing confusion and incurring cost for attackers at a different scaling factor (46:00).

Demo / Proof of Concept

▶ Watch: The 'alignment tax' burdening defensive AI (33:30)

While Aaron Portnoy's keynote did not feature a live, interactive demo, he compellingly illustrated a proof of concept through an anecdote from his team's work at Mindgard. He described a scenario where they were attacking an AI system protected by a guardrail (14:00). Instead of attempting to inject malicious code or artifacts directly, which the guardrail successfully blocked, the team instead instructed the target application itself to generate and execute the malicious Python script.

This demonstration highlighted the concept of forward-deployed development and emergent payloads. By leveraging the AI's internal capabilities to write code, the malicious actions were created and executed from within the protected environment. This resulted in a "brand new" payload, with no pre-existing signature, that successfully bypassed the guardrail. This conceptual proof of concept effectively showcased how AI-fueled offense can move development, judgment, and execution entirely inside the perimeter, "living off the land" to create unique, highly evasive threats.

Defensive Implications

▶ Watch: Exploiting AI's reward loop for defense (42:50)

The implications of Portnoy's analysis for defensive cybersecurity are profound, demanding a radical departure from current practices. The central message is clear: "we can't be using the technology of the past to deal with this particular shape of a problem" (04:00).

1. Abandon Heuristic, Reactive Defenses: Traditional signature-based, rule-driven, and causal-chain-focused defenses are rapidly becoming obsolete. SOC tooling designed for human-paced correlation and batch processing is effectively rendered a "forensic historian" when attacks complete in mere seconds (21:00). Defenders must accept that "bolting on AI" to legacy concepts and implementations will fail repeatedly (47:00, 50:00).
2. Shift Focus to Patterns of Cognition: Instead of looking for artifacts, signatures, or files on disk, defenders must focus on detecting and understanding the cognition occurring during a malicious act. This means seeking the "why" and "how" of AI decisions, even if opaque, rather than just the "what" (47:00).
3. Exploit AI's Structural Properties (ACID): Defense needs to strategically leverage the inherent characteristics of AI-fueled offense:

• Detect Acceleration: Monitor for non-human tempo, sudden compressions of complex tasks, and "legato" attack patterns that deviate from human "staccato" behavior (38:00, 46:00).
• Manipulate Compression: Introduce prompt injections into data repositories (e.g., Google Drive) that AI-fueled attackers might ingest. This can co-opt, neuter, or redirect the attacker's AI by corrupting its information processing (46:00).
• Identify Anomalous Identity: Develop detection mechanisms for the "uncanny valley" effect in AI-generated content. Look for non-human traits like unusual typos, fragmented sentences, or an implausibly broad skill set for a single actor. The more attackers try to mimic humans, the deeper the valley (41:00, 46:00).
• Corrupt Dependence (Reward Loop): This is perhaps the most potent defensive strategy. By deploying deceptive technology and intentional complexity (e.g., tar pits, fake systems), defenders can manipulate the AI's reward loop. This steers autonomous AI agents into resource-intensive, time-wasting operations, degrading their effectiveness and incurring significant cost for the attacker. The success of defense can then be measured by the cost inflicted on attackers, not just bugs patched (44:00, 48:00).

1. Move Up Donella Meadows' Leverage Ladder: Defense must transcend lower-level interventions (e.g., patching, compliance) and aim for higher-level strategic shifts. This means rethinking system goals, changing the incentive structures, and ultimately intervening at the level of the system's paradigm itself (48:00).
2. Recognize and Address the Category Gap: The current state is a "category gap" where offense is far ahead. Defenders must acknowledge this fundamental disparity and push for innovation that challenges existing paradigms, rather than clinging to incumbents who simply bolt AI onto old technology (47:00, 48:00). The "wall" that previously constrained automated offense is effectively gone, necessitating a complete re-architecture of defense (49:00).

In essence, defenders must transition from a reactive, artifact-focused posture to a proactive, cognition-aware, and deceptive one. The goal is not just to stop attacks but to observe, influence, and ultimately degrade the decision-making and operational tempo of AI-fueled adversaries.

Key Takeaways

• Systemic Asymmetry Favors Offense: AI has created a profound and compounding asymmetry in cybersecurity, driven by Locality, Observability, Opportunism, and Tempo (LOOP), giving attackers a significant and growing advantage.
• Kill Chain is Obsolete; Welcome the Kill Cycle: The traditional, linear Lockheed Martin Kill Chain is being replaced by an internalized, adaptive, and opaque Kill Cycle fueled by AI, rendering most existing heuristic defenses ineffective.
• Defense Must Rethink Fundamentally, Not Just Bolt On AI: Current defensive strategies, often characterized by merely adding a "thin veneer of AI" to legacy systems, are failing. A first-principles reevaluation and abandonment of obsolete concepts are necessary to cope with AI-driven threats.
• AI's Structural Properties Offer Defensive Opportunities: Despite AI's adaptability, its inherent Acceleration, Compression, Identity, and Dependence (ACID) properties provide stable, observable characteristics that defenders can exploit.
• Deception and Complexity are Key Defensive Levers: By manipulating AI's reward loop through intentional complexity and deceptive technology (e.g., tar pits, prompt injections), defenders can degrade attacker cognition, waste resources, and change the economics of defense.
• The Cyber Landscape is in an "Interregnum": We are in a transitional period where offense has made a significant, paradigm-shifting move, and defense is urgently required to respond with equally transformative strategies to regain parity.

About the Speaker(s)

Aaron Portnoy is the Chief Product Officer at Mindgard, a company focused on addressing the challenges of AI security. With a deep background in offensive security and vulnerability research, Portnoy has been a prominent figure in the cybersecurity community for many years. Notably, he was instrumental in starting the Pwn2Own contest in 2006 and ran it for six years, a pioneering event that incentivized researchers to find and disclose critical vulnerabilities. Prior to his role at Mindgard, he worked at Randori, a company specializing in continuous automated red teaming, where he gained firsthand experience with the limitations of pre-LLM automated offensive operations. His extensive experience across both offensive and defensive disciplines provides him with a unique perspective on the evolving threats posed by AI.