A key threshold in AI-driven hacking has been crossed. Models can now autonomously chain multiple, distinct vulnerabilities together to execute complex, multi-step attacks—a capability they lacked just months ago. This significantly increases their potential as offensive cyber weapons.

Pursuing 100% security is an impractical and undesirable goal. Formal methods aim to dramatically raise assurance by closing glaring vulnerabilities, akin to locking doors on a house that's currently wide open. The goal is achieving an appropriate level of security, not an impossible absolute guarantee.

Instead of trying to build an impenetrable fortress, early-stage founders should focus security efforts on mitigating the *volume* of potential damage. Simple tactics like rate-limiting all endpoints and creating easy-to-use IP/account banning tools can prevent catastrophic abuse from succeeding at scale.

Claiming a "99% success rate" for an AI guardrail is misleading. The number of potential attacks (i.e., prompts) is nearly infinite. For GPT-5, it's 'one followed by a million zeros.' Blocking 99% of a tested subset still leaves a virtually infinite number of effective attacks undiscovered.

Unlike human attackers, AI can ingest a company's entire API surface to find and exploit combinations of access patterns that individual, siloed development teams would never notice. This makes it a powerful tool for discovering hidden security holes that arise from a lack of cross-team coordination.

The same AI technology amplifying cyber threats can also generate highly secure, formally verified code. This presents a historic opportunity for a society-wide effort to replace vulnerable legacy software in critical infrastructure, leading to a durable reduction in cyber risk. The main challenge is creating the motivation for this massive undertaking.

Penetration testing was often a periodic, "checkbox" exercise for compliance. Terra's continuous AI-powered approach transforms it into a strategic validation tool. It helps CISOs justify security spending and quantify business risk, aligning security efforts with business impact.

AI tools drastically accelerate an attacker's ability to find weaknesses, breach systems, and steal data. The attack window has shrunk from days to as little as 23 minutes, making traditional, human-led response times obsolete and demanding automated, near-instantaneous defense.

Don't overlook seemingly "boring" industries like cybersecurity or compliance. These sectors often have massive, non-negotiable budgets and fewer competitors than glamorous, consumer-facing markets. Solving complex, high-stakes problems for large companies is a direct path to significant revenue.