“tech debt liquidity crisis” seems like perfect framing of the LLM driven vuln discovery everyone is stressing over.
This isn’t the first time tech debt has rapidly come due. Y2K bug, SQLi, Heartbleed, Log4Shell, etc. But all of those had comparatively narrow paths to remediation, which plays well with the reactive whack-a-mole culture prevalent in much of InfoSec. But proactive systemic change is a struggle for InfoSec in most companies.
The last tech debt liquidity crisis that didn’t have a simple path to remediation, that I can think of, is from about ~35 years ago. When the internet suddenly became open for commercial use. And you had a whole security industry born from this. Firewalls, IDS, etc. Maybe more recent examples like Spam or Software Supply Chain could apply.
“tech debt liquidity crisis” conveniently speaks the language of VP & C-suite. Every defender should be leveraging this to get funding for defense initiatives they have been documenting for years. You have been documenting them for years… right!?! :)
Anyway, I’ve been out of corp InfoSec for 1.5yrs, and seems I couldn’t have picked a better time. But helping drive systemic change was one of my favorite things. So I ALMOST feel like I’m missing out. Almost…
LLMs becoming good at vuln-discovery and vuln-dev is really a lot of technical debt maturing suddenly, and defenders experiencing a liquidity crunch. It's not a *solvency* crunch though, so once we get through this a lot of tech debt will be paid down (altho new might be issued)