Your security program is built to absorb the first move. The economics of the first move just collapsed. Here is the case for taking it yourself, and for fixing the 1986 law that says you cannot.
Joseph Paquin, MBA, CISSP, CGRC, CISA, PMP
In mid-September 2025, a Chinese state-sponsored group pointed a commercial AI coding agent at roughly thirty organizations: technology companies, financial institutions, chemical manufacturers, government agencies. The agent performed the reconnaissance, found the vulnerabilities, wrote the exploits, moved laterally, and exfiltrated the data. The human operators supplied strategic checkpoints. Anthropic, which detected and disrupted the campaign, estimates the model executed 80 to 90 percent of the tactical work on its own.
To be fair about the sourcing: that account rests on the detecting vendor’s own disclosure, and no independent forensics have been published. But MITRE catalogued it as Campaign C0062, the architecture it describes is entirely buildable from tools already public, and “it has only happened once that we know of” is a fact about the past. It is not a control.
I spent the last several months working through the deterrence literature, the national cyber strategy record, and the AI offensive security evidence for a white paper aimed at enterprise security leadership. The conclusion I could not escape is uncomfortable for someone who has spent a career on the defensive side: the purely reactive posture that most of us run, and that I have run, is being priced out of the contest. The organizations that stay secure over the next decade will be the ones that attack themselves first, at machine speed, and the ones that push to modernize a legal framework that currently binds defenders while leaving attackers untouched.
Defense is a posture you can be priced out of
The traditional asymmetry favored attackers for a familiar reason: the attacker needs one success, the defender needs perfection. But the asymmetry was bounded by economics. Offense required skilled humans working sequentially, and skilled humans are expensive and slow. Scan, wait, interpret, decide, repeat.
Agentic AI removed the dependency between steps. Reconnaissance now runs across every subdomain, port, and service simultaneously. Fewer than five open-source AI offensive security agents existed before GPT-4 shipped in 2023; a research census counted roughly seventy by March 2026, including orchestration layers that let a general-purpose model drive more than one hundred fifty conventional security tools through a standard interface. On the Cybench benchmark, agent performance rose from about 17.5 percent to 93 percent in roughly eighteen months. Fang and colleagues showed in 2024 that LLM agents could autonomously exploit the majority of tested one-day vulnerabilities when handed the advisory describing them.
A defender running annual penetration tests against an adversary running continuous, parallel, near-zero-marginal-cost offense is not disadvantaged. The defender is absent from the contest.
Deterrence by denial does not need the attacker’s name
The strategic studies literature sorts deterrence into two families. Deterrence by punishment threatens consequences after the act. Deterrence by denial convinces the adversary the act will fail. Punishment is largely useless to an enterprise: attribution is slow, retaliation by private actors is illegal, and Libicki observed back in 2009 that an attacker who expects to stay anonymous has little reason to stop.
Denial is a different animal, and Borghard and Lonergan’s reconstruction of it in the Journal of Strategic Studies is, I think, the most important piece of theory an enterprise security leader can read right now. Their argument: frameworks inherited from nuclear deterrence are mismatched to cyberspace, and credible denial is active rather than passive. It means contesting the adversary’s reconnaissance, burning their tooling, and closing vulnerabilities faster than they can be found and weaponized, not just thickening armor.
Denial has two properties punishment never will. It works whether or not you ever learn who attacked you, because the attack simply fails. And its credibility is automatic: the defense that killed the adversary’s reconnaissance is the same defense that will kill the attack. Nye’s framing completes the picture. Cyber aggression resembles crime more than apocalypse, and criminal effort flows toward soft targets. You do not have to make attacks impossible. You have to stop being worth the trouble.
The state already ran this experiment
In 2018, U.S. Cyber Command abandoned the reactive model in favor of defend forward and persistent engagement, on the explicit reasoning that adversaries operating continuously below the threshold of armed conflict must be continuously contested. The mechanism most worth studying is the hunt forward operation: at a partner nation’s invitation, U.S. teams hunt adversary activity on allied networks and publicly release the recovered malware. General Nakasone described the cumulative effect as the mass inoculation of millions of systems. The adversary’s sunk development cost is destroyed, and future campaigns start from scratch.
The academic critiques are real and I take them seriously in the paper. Healey warns that the strategy’s core prediction, declining adversary effectiveness, has never been rigorously validated in public data. Smeets documents the alliance costs. But read carefully, the critiques are not a refutation; they are a governance specification. Partner consent, tight scoping, disciplined attribution, honest measurement. Hold those conditions and the underlying logic survives: contesting adversary operations at the source beats absorbing them at the destination.
AI just changed which side of the arms race is affordable
What kept enterprises from acting on this logic was cost. Continuous expert-level offensive pressure against your own environment was too expensive to sustain, so we bought it once a year and called the resulting PDF a security posture.
That constraint is gone. In the DARPA AI Cyber Challenge final at DEF CON 33, autonomous cyber reasoning systems discovered 86 percent of the synthetic vulnerabilities planted in real open-source codebases, patched 68 percent of what they found, discovered eighteen real, previously unknown vulnerabilities along the way, and delivered the work at an average cost of about 152 dollars per task. Google’s Big Sleep agent, after finding the first publicly documented AI-discovered memory-safety flaw in widely used software in 2024, went on to intercept a critical SQLite vulnerability, CVE-2025-6965, that Google says was known only to threat actors and at imminent risk of exploitation. It was patched before it could be used. Notably, fuzzing had failed to find Big Sleep’s original discovery, which means AI vulnerability research is additive to the existing toolchain, not a rebranding of it.
The honest caveats: challenge environments are controlled, production is not, and several of the loudest commercial capability claims are self-reported. I weight the DARPA results and first-party patched-CVE disclosures precisely because they are the best-instrumented public evidence available. Even heavily discounted, they support the operational point. When competent vulnerability discovery and repair cost about as much as lunch, continuous self-attack becomes an operating expense. Every flaw your agents find and close before adversary reconnaissance reaches it is an attack that fails silently. That is deterrence by denial with a budget line.
Now the part that will cost me some readers
The binding constraint on all of this is no longer technical. It is the Computer Fraud and Abuse Act.
The CFAA was enacted in 1986, drafted around the mental image of an individual human trespasser, and it waited thirty-five years for the Supreme Court’s first authoritative reading of its core language in Van Buren. The Department of Justice now says, by charging policy, that it will not prosecute good-faith security research. I am glad the policy exists. It is also not something you can build a program on: it binds no court, it can be rescinded by any administration without a vote, it offers zero protection against civil suits, and it does not touch the patchwork of state computer crime statutes. Ask your general counsel whether “the government currently promises not to prosecute this” is a foundation for a continuous AI-driven security validation program, and watch their face.
AI makes the statute’s defects acute in ways its drafters could not have imagined. The law criminalizes what a person intentionally does, but an autonomous testing agent makes tactical access decisions its operators never individually directed; when your authorized agent follows a federated credential into a system the engagement letter never named, the statute has no confident answer, and ambiguity gets resolved by counsel saying no. The demonstrated value of AI vulnerability research lies in breadth, sweeping whole dependency graphs and internet-facing surfaces, which is exactly where per-system consent is hardest to obtain. And every month defenders operate under criminal and civil uncertainty while adversaries operate under none, the offense-defense gap widens as a matter of law rather than technology. A statute that chills the compliant and ignores the criminal is not neutral. It is a subsidy to the attacker.
The United Kingdom is ahead of us in confronting this and instructive in both directions. Its Computer Misuse Act reform, announced in 2026 after the Vallance review recommended a statutory public interest defence, proves the legislative will can exist. The reported draft, conditioned on credentials so narrow it would shield fewer than 300 of roughly 69,600 UK practitioners, proves how reform fails: a defence that excludes standard industry practice reproduces the chilling effect under a new name.
So here is what I am actually advocating, and where I stop. Codify the good-faith research defence in statute, with civil protection and preemption of inconsistent state law. Define authorization for autonomous agents, so written rules of engagement mean something and promptly reported overreach has a safe harbor. Scope the defence to conduct standards, intent, harm avoidance, coordinated disclosure, and data minimization, not to membership cards. Channel anything beyond research, meaning actual disruption of criminal infrastructure, through a licensed, government-supervised tier like the federal program that emerged this September, rather than a unilateral hack-back right. And build measurement and sunset review into the whole thing, because a reform that works will survive its audit.
What I am not advocating is vigilantism. Unilateral hack back is illegal under current law and unwise under any law, and the most credible reform coalition in the world agrees: CyberUp, which has fought for UK reform since 2020, states flatly that disruption should remain the prerogative of the state. Research and denial for the private sector. Disruption under state supervision. That line is where durable legislative consensus lives, and I hold it in the paper and here.
What actually works
If you run an enterprise security program, the program the evidence supports looks like this, roughly in order.
- Governance before capability. Charter the offensive program in policy: scope confined to owned and contractually authorized assets, rules of engagement, CFAA-literate legal review, executive risk acceptance. This document is what separates an offensive security program from an incident waiting to be litigated.
- Institutionalize adversary emulation. ATT&CK-mapped red team campaigns against production, on a recurring schedule, findings entering the same remediation pipeline as real incidents. NIST SP 800-115 and control CA-8 have codified this for years; the change is cadence.
- Go continuous with AI. Autonomous validation against internal infrastructure, agentic testing against web-facing applications, humans redirected to triage and exploitation depth. Track two numbers as your deterrent output: median time from vulnerability introduction to internal discovery, and the ratio of flaws found by your own offense versus external report or incident.
- Field deception. Decoys, canaries, instrumented dead ends. An intruder who cannot trust what reconnaissance returns must slow down and risk exposure with every step, which converts the attacker’s parallelism into wasted parallel effort.
- Point the agents at your own code. The AIxCC result implies a duty as much as an opportunity: run AI discovery against your codebase and your critical dependency graph, and contribute the patches upstream. That is the hunt forward inoculation logic, executed at ecosystem scale for 152 dollars a task.
- Prepare for supervised active defense without practicing unsupervised offense. Track the federal program structures, position to qualify if participation ever fits your threat model, and codify that nobody touches non-owned infrastructure absent explicit government authorization.
- Advocate. Treat CFAA modernization as a governance responsibility. Document the specific statutory ambiguities that constrain your own program and put that evidence into comment periods and industry associations. The UK record shows practitioner coalitions move legislatures, and practitioner silence during drafting produces defences too narrow to use.
The point
The reactive consensus was a rational response to a world where offense was expensive, specialized, and episodic. That world ended somewhere between the release of GPT-4 and Campaign C0062. Offense is now cheap, general, and continuous, and the only open question is who wields it against your organization first: the adversary, or you.
The full white paper, Seizing the Initiative: Offensive Cybersecurity and Artificial Intelligence as Instruments of Deterrence, runs about 8,600 words with 52 sources and works through the theory, the evidence, and the reform architecture in detail. I would genuinely welcome disagreement, especially from counsel and from anyone who has operated a red team under the ambiguities described above.
Attacks that predictably fail are attacks that increasingly are not attempted. You will not eliminate your adversaries. You can stop being worth the trouble.
Sources
- Anthropic. (2025). Disrupting the first reported AI-orchestrated cyber espionage campaign. anthropic.com
- MITRE. (2026). Anthropic AI-orchestrated campaign, Campaign C0062. MITRE ATT&CK
- Borghard, E. D., & Lonergan, S. W. (2023). Deterrence by denial in cyberspace. Journal of Strategic Studies, 46(3). doi:10.1080/01402390.2021.1944856
- Libicki, M. C. (2009). Cyberdeterrence and cyberwar. RAND Corporation.
- Nye, J. S., Jr. (2017). Deterrence and dissuasion in cyberspace. International Security, 41(3). MIT Press
- Fischerkeller, M. P., & Harknett, R. J. (2017). Deterrence is not a credible strategy for cyberspace. Orbis, 61(3).
- Healey, J. (2019). The implications of persistent (and permanent) engagement in cyberspace. Journal of Cybersecurity, 5(1). doi:10.1093/cybsec/tyz008
- Smeets, M. (2020). U.S. cyber strategy of persistent engagement and defend forward. Intelligence and National Security, 35(3). doi:10.1080/02684527.2020.1729316
- Nakasone, P. M., & Sulmeyer, M. (2020). How to compete in cyberspace. Foreign Affairs. foreignaffairs.com
- U.S. Cyber Command. (2022). Cyber 101: Defend forward and persistent engagement. cybercom.mil
- DARPA. (2025). AI Cyber Challenge marks pivotal inflection point for cyber defense. darpa.mil
- Google. (2026). Google’s latest AI security announcements. blog.google
- Fang, R., Bindu, R., Gupta, A., & Kang, D. (2024). LLM agents can autonomously exploit one-day vulnerabilities. arXiv:2404.08144
- Zhang, A. K., et al. (2024). Cybench: A framework for evaluating cybersecurity capabilities and risks of language models. arXiv:2408.08926
- Oesch, S., Hutchins, J., Austria, P., & Chaulagain, A. (2025). Agentic AI and the cyber arms race. Computer, 58(5).
- Van Buren v. United States, 141 S. Ct. 1648 (2021).
- Electronic Frontier Foundation. (2022). DOJ’s new CFAA policy is a good start but does not go far enough. eff.org
- The Record. (2026). UK moves to shield security researchers in cybercrime law overhaul. therecord.media
- CyberUp Campaign. (2026). About the campaign. cyberupcampaign.com
- National Institute of Standards and Technology. (2024). The NIST Cybersecurity Framework (CSF) 2.0 (NIST CSWP 29).