DEF CON is Dead, Security is Cooked?

About this episode

Jason Haddix came home from DEF CON frustrated by all the talk that security is finished. He answered with an article asking whether DEF CON is dead and security is cooked, and he says the title was sarcastic. He tells Mehul that AI agents now let his team at Arcanum test every JavaScript file and every parameter. They keep turning up old bugs buried deep in applications, including an unauthenticated SSRF that gave them control of a company's entire Kubernetes fleet. They also talk about the 10-year-old who beat all five levels of his team's prompt-injection CTF at DEF CON in about 15 minutes, and why Jason calls "machine-speed defense" BS. Jason expects offense to keep the edge for the next year or two. He explains why AI triage works only for companies with good SOPs, and why defenders should get rid of whole classes of bugs instead of playing whack-a-mole.