A Security's CEO Says Hackers Could Soon Attack Everything Left Exposed
Attack software costs almost nothing to run, so being left exposed may soon be enough to get broken into.
Lightspeed Venture Partners · The End of Human-Based Cyber Defense | Yossi Torati, A SecurityYossi Torati, the founder and chief executive of the cybersecurity startup A Security, was explaining why defending against machines is different from defending against people. Asked what changes when the attacker is software that can act on its own, rather than a human at a keyboard, he pointed first to speed.
All of our defenses, Torati argued, assume a human pace of attack. They assume there is time to notice, to react, and to block, and that the most advanced offensive tools were nation state capabilities aimed at very specific areas.
That assumption, in his view, is breaking. Those top level offensive skills, he said, are becoming available to ordinary criminals. And with that shift, attackers will move from what he called an opportunistic approach to a comprehensive one.
In his words: “Once you will be there vulnerable, you will be hacked.” He added, “Because the cost of attacking is approaching zero.”
What he meant was that attackers will no longer have to choose. Today, a human hacker picks a target because time is limited. Torati believes the “internet will crawl with this type of capabilities,” with automated attacks happening at much larger volume and in real time, so anything left exposed gets broken into.
He said he came to that conclusion after talking with corporate security chiefs. Many told him they already struggle to answer a basic question: what in our network is actually breakable right now. His fear is that self directed attack software will find that answer faster than any human defender can.
Questions people ask
Does this mean every company and person will inevitably get hacked?
Torati's claim is about exposed systems. His line is that once a system is vulnerable, it will be hacked, not that every company or person will inevitably be hacked. How well defended systems hold up is outside what he addressed in this part of the interview.
Why does lower cost mean more hacking?
This explanation is ours, not Torati's, who did not define cost in the interview. The idea is that human hackers are limited by time and effort, so they must pick targets. If software can do much of that work automatically, it takes far less effort to try more targets, which is the logic behind his line that the cost of attacking is approaching zero.
What can a small business or individual do about automated attacks?
Torati does not offer personal safety steps in this part of the interview. Common advice from outside security experts, not from him, is to install updates promptly, use unique passwords with a second login check, and back up important files. For companies, Torati argues the harder task is mapping which flaws actually create a path to something valuable.