**The End of Rare: Defending in an Era of AI-Driven Exploits**
The cybersecurity landscape is undergoing a dramatic shift, moving away from traditional reactive defenses. According to David Weston, a senior security manager at Microsoft, the rise of artificial intelligence (AI) is fundamentally changing the economics of cyber attacks. Where developing and deploying exploits once required significant time, effort, and expense, AI tools are now making vulnerability discovery and exploit development cheaper, faster, and more scalable. This new reality demands a fundamental change in how organizations approach security.
### The AI Acceleration of Vulnerability Discovery
Weston highlighted this paradigm shift during his keynote, “The End of Rare: Defending When Offense Is Cheap,” at Black Hat USA. He argued that traditional vulnerability remediation methods are no longer effective against the industrial-speed generation of flaws enabled by AI. The evidence is staggering: Microsoft’s Security Response Center (MSRC) is now processing and patching twice as many vulnerabilities every six weeks. This represents a ninefold increase in vulnerability volume compared to just a few years ago.
This acceleration is directly correlated with the rise of AI tools. Weston noted that vulnerabilities once taking a year to craft manually are now being “spit out at industrial speed.” This isn’t limited to Windows; the trend is evident across operating systems, including Linux. To combat this, Microsoft has developed MDASH (Multi-model Agentic Scanning Harness), an AI-powered tool that has already identified around 200 Linux kernel vulnerabilities in Azure’s internal distribution. The system is so effective it can automatically generate proof-of-concept exploit code from static analysis results, producing working exploits—including root-level access—with an average computing cost of just $3.61 and a generation time of 21 minutes.
### Why Traditional Defenses Are Failing
This new threat landscape renders many traditional security measures ineffective. Nondeterministic mitigations like Address Space Layout Randomization (ASLR) may slow attackers slightly, but they cannot stop the flood of AI-discovered vulnerabilities. Similarly, the historical reliance on threat detection is flawed. This approach assumes attackers face significant cost and time barriers when changing tactics, but AI has removed those constraints. Attackers can now easily retool their methods and create bespoke frameworks for each target, making detection-based defenses a losing strategy.
### Shifting to a Prevention-Based Model
To turn the tables, Weston advocates for a fundamental shift from detection to prevention. This involves two key strategies:
1. **Embracing Memory-Safe Languages:** The single most effective step is moving away from memory-unsafe languages like C and C++. Microsoft found that about 70% of its patched vulnerabilities were memory safety issues. By adopting languages like Rust and Go, organizations can eliminate these classes of vulnerabilities entirely. Google’s transition to Rust reduced memory safety flaws in Android from 76% in 2019 to below 20% in 2025. Microsoft has also successfully rewritten its Azure hypervisor in Rust, scaling it to 1.5 million virtual machines without incident.
2. **”Shifting Left” in Development:** Security must be built into the software from the very beginning. Projects like DARPA’s Tractor are automating the conversion of legacy C code to Rust, while AI tools like Microsoft’s RustAssistant help developers resolve compilation errors. By making software more secure by design, organizations can significantly limit the number of vulnerabilities introduced in the first place.
### A New Era for Vulnerability Research
The changing landscape is also transforming the work of vulnerability researchers. Yan Shoshitaishvili, an associate professor at Arizona State University, presented research showing how agentic AI has drastically reduced the cost and time required for vulnerability research. His work on OpenHarmony, the open-source foundation for HarmonyOS, discovered dozens of flaws in Bluetooth, device control, and privacy using agentic pipelines.
However, this power comes with a caveat. While AI can find vulnerabilities quickly, human expertise is still crucial for understanding threat models, validating bugs, and ensuring responsible disclosure. Furthermore, simply rewriting code in a safer language like Rust is not a silver bullet. As Shoshitaishvili’s team discovered, while memory-safety bugs disappear, underlying logic vulnerabilities—such as race conditions and cryptographic flaws—can reappear and must be actively addressed through careful design and review.
***
### FAQ
**Q: What is AI-accelerated vulnerability discovery?**
A: AI-accelerated vulnerability discovery refers to the use of artificial intelligence tools to automatically scan code, identify weaknesses, and even generate functional proof-of-concept exploits at a speed and scale previously impossible. This dramatically lowers the barrier and cost for attackers to find and weaponize software flaws.
**Q: Why are traditional patching methods no longer effective?**
A: Traditional methods are reactive and slow. They involve discovering a vulnerability, creating a patch, and then deploying it. With AI generating vulnerabilities in industrial volumes, this cycle is too slow. The “vulnerability-to-patch” window is closing rapidly, making this “patch and pray” model unsustainable.
**Q: What is a memory-safe programming language, and why is it important?**
A: Memory-safe languages like Rust and Go are designed to prevent common programming errors that lead to memory safety vulnerabilities, such as buffer overflows and use-after-free bugs. These errors are responsible for a majority of critical vulnerabilities. Using these languages eliminates entire classes of security flaws from the start.
**Q: Can’t we just use AI to improve our threat detection?**
A: While AI can enhance detection, relying solely on it is a losing strategy. The new reality is that attackers can use AI to adapt, create bespoke tools, and evade static detection methods instantly. The focus must shift to making systems inherently secure and resilient, rather than trying to detect every possible attack after it’s launched.
**Q: What does “shifting left” mean in this context?**
A: “Shifting left” means integrating security into the earliest stages of software development. Instead of testing for security at the end of the development cycle, it involves using secure coding practices, memory-safe languages, and AI tools during the design and coding phases to prevent vulnerabilities from being created in the first place.
***
### Conclusion
The democratization of vulnerability discovery through AI has irrevocably altered the cybersecurity battlefield. The era of relying on slow, reactive patching and hoping attackers face enough difficulty to be deterred is over. The offensive has become exponentially cheaper and faster. To defend effectively, organizations must adopt a proactive, prevention-focused strategy. This means embracing memory-safe programming languages to eliminate fundamental classes of bugs and “shifting left” to build security into the software from the very beginning. The goal is not just to detect attacks as they happen, but to make the underlying systems fundamentally resilient, turning the tables on attackers and driving the problem back in their direction.
