Bruce Schneier: “We have long taken it for granted that we have time to patch systems after vulnerabilities become known … This is no longer the case. … these developments threaten to tip the scales completely. We’re potentially looking at a singularity event for cyber attackers”
translated by AI, reviewed by the editors
· Cybersecurity · cryptographer, in an essay written with Heather Adkins (Google) and Gadi Evron; they see the defence's answer in AI-driven “continuous discovery/continuous repair” of vulnerabilities
original
“In this future, attack capabilities could accelerate beyond our individual and collective capability to handle. We have long taken it for granted that we have time to patch systems after vulnerabilities become known, or that withholding vulnerability details prevents attackers from exploiting them. This is no longer the case.
The cyberattack/cyberdefense balance has long skewed towards the attackers; these developments threaten to tip the scales completely. We’re potentially looking at a singularity event for cyber attackers. Key parts of the attack chain are becoming automated and integrated: persistence, obfuscation, command-and-control, and endpoint evasion. Vulnerability research could potentially be carried out during operations instead of months in advance.”— Bruce Schneier, Schneier on Security, 10.10.2025 ↗
backs
Computer viruses+Operating systems → Moving target defense (2011)
verification
✓ checked against the source
The original is given verbatim and only as an excerpt — as much as the meaning needs; “[…]” marks a cut. The translation is ours.
¶ cydmuidxd