**Podcast Summary (Published 2026-11-13)**
* **Hosts and Guest:** Hosted by Zane, with guest Amy.
* **The Concept of "Black October":** October is referred to as "Black October" (viewed like a Black Swan event) because the security industry has never seen so many security incidents happen in a single month. This includes a massive number of vulnerabilities found, severe vulnerabilities, and the rise of AI attackers using unprecedented speed and expertise against companies, startups, and refrigerators. Elon Musk tweeted recently that "every day is zero day."
* **The AI Threat & Timeline:**
* Previous milestones included the "Mythos moment" (when Mythos proved it could find vulnerabilities) and the hacking phase incident with OpenAI (which were accidental attacks).
* What changed in Black October is that these theories became reality: models are now good enough to find and exploit complex vulnerabilities, and open-source models are catching up rapidly.
* AI development platforms (915 companies targeted in October) are specifically targeted because they hold AI keys.
* AI attackers can find and utilize zero days in code and run an entire attack (which previously took the best attackers weeks or months) in around 20 minutes.
* On the offensive side, open-source models are only about three months behind. AI is currently one of the few areas in humankind where AI is better than humans.
* **Case Study: PHP to Shell Vulnerability:**
* PHP is a heavily used external-facing technology (running ~70% of the internet). Almost 100% of customers had PHP running.
* It was independently discovered by two groups, Wiz and Calif.
* Despite 50% patching within the first two to three days, a single vulnerability like this will take years to resolve because older versions of PHP do not receive patches.
* The time to get an exploit dramatically decreased, and information often leaks before a CVE or patch is ready (such as in the PHP and Linux kernel cases).
* **Engineering and Patching Challenges:**
* The world is not ready for automated patching across legacy systems.
* Startups can potentially design for auto-patching by building an agentic pipeline (automated dev to create a patch, automated testing, automated CI/CD, and automated DevOps).
* AI systems require scalable, multi-model pipelines. Running the most advanced, expensive model on every event is cost-prohibitive. A successful pipeline moves from deterministic detection -> cheap model detection -> advanced model -> most advanced model confirmation.
* **Cloud Security and Continuous Testing:**
* Traditional static code scans can waste millions of dollars as new models (like Mythos 1.2) emerge.
* Security scanning must be continuous and intelligent, balancing internal code scans, external exposure checks, active/passive attacks, and runtime monitoring to use budgets wisely.
* Wiz handles a majority of customers using the "Red Agent," which continuously attacks applications from the outside using inside context.
* **Budgets, Secure Design, and Eliminating Waste:**
* Security budgets are increasing (e.g., a CISO expecting an 80% budget increase next year), but budgets alone won't solve the problem.
* Secure design, sandboxing, isolation, network lockdown, process lockdown, image lockdown, and assuming nation-state/AI attackers are crucial.
* Amy asserts that most of what security teams currently do (such as compliance reporting and classic CSPM configuration check lists) is not actual security and should be stopped. Teams should focus on finding critical risk, mitigation, detection, and response readiness.
* **Public Infrastructure and "Scan for Good":**
* Real-world infrastructure (such as refrigeration units in Europe and public services) connected to the internet is at serious risk from AI attacks.
* Wiz launched "Scan for Good" to help public services and nonprofits scan their systems and push them toward proactive red scanning.
* **Future Outlook (Next 2-3 Years):**
* The security game has changed. The industry is returning to an era resembling the 1990s and 2000s, with full remote unauthenticated zero-days and potential internet worms popping up constantly.
* Companies must automate both blue and red sides, build agentic workflows, and design systems capable of taking exposed components off the internet quickly.