In AI-driven cybersecurity, being the first to defend your systems or embed exploits gives a massive but temporary edge. This advantage diminishes quickly as others catch up, creating a "fierce urgency of now" for national security agencies to act before the window closes.

The same AI technology amplifying cyber threats can also generate highly secure, formally verified code. This presents a historic opportunity for a society-wide effort to replace vulnerable legacy software in critical infrastructure, leading to a durable reduction in cyber risk. The main challenge is creating the motivation for this massive undertaking.

The idea that major software vulnerabilities found by AI can be fixed in a short, coordinated effort is mere "theater." The sheer volume of bugs embedded in decades of code would necessitate a multi-year shutdown of the internet to truly address them, making short-term projects largely performative.

Contrary to fears that AI would replace security firms, the consensus has shifted. Analysts now believe AI massively increases the surface area for vulnerabilities, compounding the need for security. This creates a multi-billion dollar opportunity for firms protecting new AI-driven attack vectors, making cyber a resilient software sector.

Cybersecurity expert Gili Raanan highlights a critical risk: threat actors can adopt new AI tools much faster than large, slow-moving enterprises. This creates an asymmetric battlefield where defenders are outpaced, putting AI's power in the hands of bad actors first.

The sophistication of attacks like the Axios NPM compromise necessitates a shift to AI-driven defense. Tools like Cognition's Devin Review are reportedly catching malware before public disclosure, indicating that organizations must adopt AI security tools to counter the rising threat of automated, AI-powered attacks.

AI tools drastically accelerate an attacker's ability to find weaknesses, breach systems, and steal data. The attack window has shrunk from days to as little as 23 minutes, making traditional, human-led response times obsolete and demanding automated, near-instantaneous defense.

The emergence of AI that can easily expose software vulnerabilities may end the era of rapid, security-last development ('vibe coding'). Companies will be forced to shift resources, potentially spending over 50% of their token budgets on hardening systems before shipping products.

The long-term trajectory for AI in cybersecurity might heavily favor defenders. If AI-powered vulnerability scanners become powerful enough to be integrated into coding environments, they could prevent insecure code from ever being deployed, creating a "defense-dominant" world.