Part 12 — Autonomous Offensive Research Changes the Defender’s Clock

DEF CON 34 — Part 12

Why AI-driven experimentation may compress the time from idea to exploit

By Eckhart Mehler for CISOsCISO — a perspective on cybersecurity leadership, governance and the decisions that determine whether organizations retain control.

Cybersecurity has been governed by an uncomfortable but relatively stable asymmetry.

Attackers could move quickly.

Defenders usually could not.

But there was still friction on both sides.

Finding a vulnerability required expertise.

Understanding a target required reconnaissance.

Building an exploit required experimentation.

Testing variations required time.

Failure required another attempt.

And scaling all of this required people.

That friction mattered.

It created something defenders rarely described as a security control, but nevertheless depended upon:

Time.

Time between disclosure and exploitation.

Time between reconnaissance and intrusion.

Time between an attacker having an idea and discovering whether that idea actually works.

Time for defenders to patch, detect, isolate and respond.

What I take from DEF CON 34 is that we should begin questioning whether this assumption will continue to hold.

Because AI does not merely make attackers faster at writing code.

It can change the economics of experimentation itself.

And that may change the defender’s clock.

The Important Change Is Not AI-Generated Malware

Much of the discussion around offensive AI still gravitates toward an obvious question:

Can AI write malware?

Of course it can assist with code generation.

But that is not the most consequential development.

The more important question is:

What happens when experimentation itself becomes autonomous?

Consider how offensive security research traditionally works.

A researcher forms a hypothesis.

They inspect a protocol.

They modify an input.

They execute it.

They observe the response.

They analyze the failure.

They modify the hypothesis.

They try again.

This cycle may happen dozens, hundreds or thousands of times.

The scarce resource is not necessarily compute.

It is human attention.

Now imagine that loop being delegated.

An autonomous system can potentially:

• inspect documentation,
• analyze source code,
• generate hypotheses,
• create test cases,
• execute them in a sandbox,
• observe crashes or unexpected behavior,
• correlate results,
• modify inputs,
• generate another hypothesis,
• and repeat.

Not once.

Thousands of times.

Potentially in parallel.

The important shift is therefore not:

AI writes exploits.

It is:

AI can increasingly participate in the scientific process that discovers them.

That is a much more fundamental change.

Offensive Research Becomes a Search Problem

Many security discoveries can be understood as searches through enormous possibility spaces.

Which input triggers unexpected behavior?

Which sequence of API calls produces an unintended state?

Which combination of permissions creates a privilege path?

Which parser behaves differently at a boundary condition?

Which dependency interaction produces unsafe execution?

Which prompt causes an agent to invoke the wrong tool?

Which sequence of actions bypasses an intended control?

Humans are extraordinarily good at intuition.

But humans are expensive at repetition.

Machines have the opposite characteristics.

AI systems add something new to traditional automation:

They can increasingly combine reasoning with iteration.

That matters because the search space in modern systems is exploding.

Cloud environments contain thousands of identities and permissions.

AI agents connect to dozens of tools.

Applications depend on hundreds or thousands of packages.

APIs expose complex state transitions.

Infrastructure is dynamically created and destroyed.

Security increasingly depends on interactions rather than individual components.

Finding weaknesses in such systems may therefore become less like manually discovering a vulnerability and more like asking an autonomous system to explore:

Find me a path through this environment that violates the intended security invariant.

That is a very different offensive capability.

The Cost of Failure Approaches Zero

Human attackers have a practical constraint.

Every failed experiment consumes attention.

Machines do not experience frustration.

They do not become tired.

They do not lose concentration after attempt 4,731.

They can generate another variation.

And another.

And another.

This changes something fundamental about offensive economics:

The marginal cost of another hypothesis may become extremely small.

Historically, many systems have benefited indirectly from the fact that finding subtle vulnerabilities simply required too much expertise and too much time.

That was never a formal security control.

But it was real friction.

AI-driven experimentation can erode that friction.

And once experimentation becomes cheap, previously uneconomic attack paths may become worth exploring.

This is particularly important for systems whose security depends on complexity.

Complexity creates hiding places for defenders.

But it also creates search spaces for machines.

From Automation to Autonomy

We should distinguish two concepts.

Traditional offensive automation says:

Run this technique against 100,000 targets.

Autonomous offensive research says:

Determine which technique might work, test it, learn from the result and decide what to try next.

That difference matters.

The first scales execution.

The second begins to scale adaptation.

A scanner executes known checks.

An autonomous researcher can potentially ask why a check failed and modify the next experiment.

A fuzzing engine mutates inputs.

An AI-assisted system can potentially interpret the resulting behavior and decide which mutation strategy deserves further exploration.

A penetration-testing framework executes predefined techniques.

An autonomous system can increasingly reason across the results and identify possible paths that were not explicitly programmed beforehand.

The boundary between tool and researcher begins to blur.

The Vulnerability Window May Compress

Security teams have traditionally organized vulnerability management around a lifecycle:

Discovery → Disclosure → Prioritization → Patch → Deployment

Attackers operate in parallel:

Discovery → Weaponization → Reconnaissance → Exploitation

The defender’s advantage depends partly on the distance between those timelines.

AI-driven offensive research threatens to compress several stages.

A newly published vulnerability could potentially be:

1. analyzed automatically,
2. correlated with public source code,
3. mapped to affected technologies,
4. converted into candidate exploit logic,
5. tested against controlled environments,
6. refined through repeated experiments,
7. and integrated into reconnaissance workflows.

The critical metric may therefore stop being:

How quickly do we patch critical vulnerabilities?

It may become:

How much time exists between machine-readable knowledge of a weakness and machine-operational exploitation of it?

That interval could become dramatically shorter.

Zero-Day Research Changes Too

The more significant long-term consequence is not faster exploitation of known vulnerabilities.

It is machine-assisted discovery of unknown ones.

Software contains an enormous latent vulnerability space.

Historically, exploring that space required highly specialized researchers.

AI does not eliminate the need for expertise.

But it may amplify it.

One skilled researcher equipped with autonomous experimentation may eventually explore far more hypotheses than a traditional team could investigate manually.

That creates another asymmetry.

The question is no longer merely:

How many skilled attackers exist?

It becomes:

How much autonomous research capacity can each skilled attacker orchestrate?

This is similar to what cloud computing did to infrastructure.

One engineer could suddenly operate thousands of machines.

AI may do something comparable to certain forms of cognitive security work.

One researcher may eventually orchestrate thousands of concurrent investigative threads.

Agentic Systems Create a New Research Target

There is another reason this matters.

The systems attackers are researching are themselves becoming autonomous.

Traditional software generally follows relatively deterministic execution paths.

Agentic systems do not.

They interpret context.

They select tools.

They retrieve information.

They construct plans.

They invoke APIs.

They respond to external data.

They may delegate tasks to other agents.

This creates a vast behavioral attack surface.

A vulnerability may no longer be:

Input X causes memory corruption.

It may instead be:

Context A causes Agent B to interpret instruction C, retrieve data D, invoke Tool E with Identity F and produce Action G.

That is an attack path across multiple trust domains.

Discovering such paths manually is difficult.

But it is exactly the kind of combinatorial search problem that autonomous experimentation may eventually become good at exploring.

We could therefore see an unusual symmetry:

Autonomous systems attacking autonomous systems.

One agent explores the behavioral boundaries of another.

At machine speed.

Defenders Cannot Win by Accelerating the Ticket Queue

The natural organizational response will be:

We need faster vulnerability management.

That is true.

But insufficient.

If offensive experimentation becomes machine-speed, shaving two days from a remediation SLA does not fundamentally solve the problem.

The defender must change the architecture.

This means reducing the consequences of successful discovery.

Assume that vulnerabilities will be found faster.

Then ask:

• Can one compromised identity reach multiple security domains?
• Can one agent invoke irreversible actions?
• Can one workload identity create another identity?
• Can one compromised developer environment reach production?
• Can one security tool modify infrastructure?
• Can one automation pipeline create privileged credentials?
• Can one exposed service become a bridge into another trust domain?

This moves security from vulnerability management toward attack-path governance.

The objective is no longer merely to prevent weaknesses.

It is to prevent individual weaknesses from becoming systemic authority.

Detection Must Also Become Experimental

There is another uncomfortable implication.

If attackers can autonomously explore systems, defenders may need to do the same.

Traditional detection engineering is largely retrospective.

We observe attacks.

We identify indicators.

We create detection logic.

We tune it.

We deploy it.

That model assumes enough time exists between learning and recurrence.

But machine-speed experimentation may generate attack variations faster than static detection content can follow.

Defensive systems will increasingly need to explore their own environments.

Not merely:

Is this configuration compliant?

But:

What could an attacker cause from here?

Not merely:

Does this identity have excessive permissions?

But:

Which authority paths become reachable if this identity is compromised?

Not merely:

Is this AI agent configured correctly?

But:

What combinations of context, tools, credentials and actions could make this agent violate our intended security boundary?

That is continuous adversarial experimentation.

Essentially:

The enterprise must learn to attack itself faster than the attacker can learn to attack it.

This Changes the Meaning of Exposure

Exposure management today often prioritizes assets using vulnerability severity, exploitability, internet exposure and business criticality.

Those remain important.

But autonomous offensive research adds another dimension:

Explorability.

How easily can an automated system understand the target?

How much documentation exists?

Is source code available?

Are APIs machine-readable?

Can the environment be cheaply reproduced?

Can responses be observed?

Can experiments be performed repeatedly?

Can an agent determine whether an attempted action succeeded?

Ironically, many characteristics that make modern systems easier to operate also make them easier to explore.

APIs.

Infrastructure as Code.

Machine-readable schemas.

Automated deployment.

Detailed error messages.

Developer documentation.

Open-source components.

These are enormous engineering advantages.

They may also become ingredients for autonomous offensive research.

CISOs Need a New Time Assumption

Most security programs contain hidden assumptions about time.

Critical vulnerability: patch within X days.

Incident: detect within Y hours.

Privileged access: review every Z months.

Penetration test: annually.

Red team: periodically.

Architecture review: before major release.

These intervals reflect an environment in which human activity defined much of the pace.

That assumption deserves review.

The relevant question for CISOs is becoming:

Which of our security processes assume that the attacker needs more time than they may soon require?

That question should be applied across the security operating model.

Vulnerability management.

Threat intelligence.

Exposure management.

Identity governance.

Cloud security.

Detection engineering.

Incident response.

Software supply chain security.

AI security.

Recovery.

Because the defender’s clock may be changing everywhere at once.

From Mean Time to Detect to Mean Time to Understand

Security organizations have spent years optimizing metrics such as:

MTTD.

MTTR.

Patch latency.

Containment time.

Those remain useful.

But AI-driven attacks introduce another metric that may become increasingly important:

Mean Time to Understand.

How long does it take the organization to understand what a new attack technique actually means for its environment?

That includes:

Which assets are exposed?

Which identities are reachable?

Which dependencies matter?

Which business processes could be affected?

Which controls genuinely interrupt the attack path?

In highly interconnected environments, understanding may become the bottleneck.

An organization can patch quickly once it knows what matters.

The difficult part is determining what matters before an autonomous attacker does.

The Strategic Question Is Not Whether Attackers Will Use AI

They already do, and they will use more of it.

The more useful question is:

What happens to our security model when offensive reasoning, experimentation and adaptation become scalable resources?

That is the shift CISOs should prepare for.

The future attacker may not simply operate faster.

They may run more experiments.

Explore more paths.

Test more hypotheses.

Correlate more information.

And learn from failure continuously.

This does not make defense impossible.

But it changes where defensive advantage must come from.

Not from assuming attackers will overlook something.

Not from assuming complexity will slow them down.

Not from assuming short-lived credentials eliminate persistence.

Not from assuming human approval guarantees safety.

Not from assuming reimaging restores trust.

And not from assuming we will have days or weeks to understand a newly discovered weakness.

The defensive advantage must increasingly come from architecture.

Segmentation.

Observability.

Least agency.

Constrained authority.

Attack-path analysis.

Resilience.

And the ability to continuously test our own assumptions.

The Defender’s Clock Has Started Moving Faster

For years, cybersecurity treated automation primarily as a force multiplier.

Do the same task faster.

At greater scale.

With fewer people.

Autonomous AI changes the equation.

It can potentially choose the next task.

Evaluate the result.

Form another hypothesis.

And continue.

That transforms automation into experimentation.

And experimentation is how vulnerabilities become exploits.

The strategic consequence for CISOs is therefore not simply that AI may make cyberattacks faster.

It is that AI may compress the entire distance between:

idea → hypothesis → experiment → learning → exploit.

When that happens, vulnerability management becomes a race against machine experimentation.

Detection becomes a race against machine adaptation.

And incident response becomes a race against machine-speed exploration of authority paths.

The defender’s clock has not stopped.

But it may be ticking much faster.

The question is whether our security operating models are still calibrated to the old one.

Next in the series: Part 13 — The CISO Security Model After DEF CON 34 — why attackers increasingly exploit relationships rather than isolated components, and why CISOs must move beyond governing assets, vulnerabilities and permissions toward governing authority paths: who can instruct, authenticate, invoke—and ultimately cause what to happen.

Publication Note & Disclaimer
This article provides security and governance analysis, not legal advice. Regulatory obligations must be assessed against the facts, jurisdictions, data types, and roles of the organizations involved.

This article reflects my personal professional perspective and does not represent the official policy or position of my employer. Drafting and editorial refinement may have been supported by commercially available AI-assisted tools. The analysis, conclusions and final curation are entirely my own.

For information regarding image credits, copyrights, trademarks and other intellectual property rights, please refer to the Imprint.