Jevons for Cybersecurity

If you have been on X the past few weeks, you have probably heard of the vulnpocalypse or Black October. PHP2Shell, Broccoli2Shell, Storm-0940, LiteLLM V2. Predictably, the discourse about cyber as it relates to AI has split into accelerationist and doomer camps with little nuance in between. One exception was @sebkrier's recent post:

Séb Krier’s post on X

Specifically:

5. Many critics of AI safety also fail to really engage honestly with the fact that there will, in fact, be all sorts of important risks as we decrease the barriers to entry to many activities that otherwise require some degree of expertise. This doesn’t mean we need to live in a constant Schmittian ‘state of emergency’ requiring extraordinary measures every time a new model drops, but it does mean we will need important state-led efforts on e.g. cybersecurity and biosecurity. I wish the progress-oriented or acceleration-adjascent crowd would provide more concrete proposals here.

I would not classify myself as a “critic of AI safety,” but I do consider myself “progress oriented” as someone who has founded a company attempting to apply AI to defensive cybersecurity. I also agree with Seb that much of the discourse currently is hypotheticals, so I would like to discuss a concrete proposal on how we can defend against blackhat (or greyhat, autonomous, misaligned) cyber offense with a new approach to cyber defense.

A Shift Right

Most of the teams I work with day to day are Detection and Response (D&R) teams. For folks less familiar with the security landscape, these teams sit on the right side of the timeline. Once code is shipped and preventative controls are in place, D&R is responsible for detecting when something has slipped past controls and carrying out the appropriate response actions. Their remit varies between companies, but typically spans cloud, identity, SaaS, as well as end users interacting with these systems.

The core philosophy of a good D&R team is that prevention will eventually fail, or existing assumptions will become invalid. A package your engineers are using will get compromised, a cert which you assume is good will have a dumbass private key, or a language you use will have an RCE in it. Shit happens; the question for these teams becomes how quickly you notice and how quickly you act once it does. As you might imagine, time is always of the essence in these situations; teams rely on metrics such as Mean Time To Detect (MTTD) and Mean Time To Remediate (MTTR).

Code security has gotten most of the attention this past year, but I think some of the events of the past week have shifted people’s thinking towards response. When an RCE vuln drops in the language which your product is built on, how quickly can you patch that? How do you know if it has been exploited on your service?

So the defender's job comes down to two questions: do you have the telemetry to detect intrusion, and can you get to it in time? This boils down to a capacity problem on both sides: do you have the infra to ingest all of the telemetry, and do you have the intelligence throughput to look at all the signals. Historically, cost (both human and silicon) has limited both.

A Shift in Cost

Now, to get to Seb’s point about solutions for operational defense and why I’m optimistic, I think there are two economic dynamics which are happening in parallel which are very beneficial to defenders:

1. The Cost of Log Storage is Decreasing:
   Warehouse technologies like ClickHouse and Databricks have collapsed the cost of ingesting and storing telemetry: managed log ingest now runs around $0.10/GB. That’s a ~50x drop in the unit price of visibility compared to legacy solutions.
2. The Cost of Alerts is Decreasing:
   Previously, for every security alert which fired, you would have to staff a human to triage and respond to each of these alerts. That roughly works out to $10 of human time per alert before anyone has found anything conclusive. Now, agents are able to take the first pass at all alerts coming out of your security telemetry and handle them for you for a fraction of the cost of a human in the seat.

Said succinctly, we believe that the price of storage and intelligence is dropping precipitously, and that directly benefits defenders. The core mission of Cotool is to continue to drive down the cost of these factors in their application to defensive cybersecurity in order to induce a Jevon’s Paradox for security, where we get net more secure because of the gains.

Jevons for Security

The initial offering of Cotool was an agent platform to automate the investigation of security signals from existing tooling (Crowdstrike, Socket, etc). Turns out agents with the right harness and access to tools are very adept at triaging true or false positives out of this stack. This was a massive unlock for the teams we worked with; they no longer had to staff analysts with initial triaging of alerts.

Rather than seeing some sort of headcount reduction from these teams from a lot of their work being relieved, we have just seen them get more ambitious. They are able to now process orders of magnitude more telemetry and alerts from their existing tools, sifting through way more data and uncovering much more than they were ever able to process before.

This is the first part of the Jevon’s paradox for security; there has been a latent demand for more detection coverage, so as the price to triage an alert goes down, we see an induced demand for more detections.

A Market for Dumb Detections

Demand for detection coverage has always outpaced supply. Almost every team wanted more detections than they had, but the cost of supplying them was too high: each one needed an analyst to respond to its hits. Agents have lowered the cost of response, so supply is starting to catch up, and as attacks shift, demand keeps going up.

But even with the increased bandwidth of D&R teams, offensive models are creative, explorative, and cunning in ways which are fundamentally different from humans. This results in models approaching attacks differently from the human threat actors; said differently, models attack in an out-of-distribution manner from what our detections are used to trying to catch.

So how do you catch an attacker which constantly acts in an out-of-distribution manner and is infinitely patient and creative? I believe this comes down to a recall problem which the above market dynamics are helping us solve.

When triage and response of security alerts are no longer bottlenecked by human hands on keyboard, and instead are just bottlenecked by a company's ability to apply and scale tokens, an interesting dynamic emerges. If precision matters less and less (because the cost of an FP has dropped), then detectors which favor recall end up being coarser, and by most definitions, dumber. In the limit, detections approach signals, and the “triage agent” essentially becomes the detector itself.

Take an example; let's say I’m trying to track account compromise at the point of authentication. Today, traditional detectors approximate this via “suspicious logins”. An example of this might be detecting when a user signs in from an anomalous IP address. While this serves as a decent proxy, there are clear examples of how this detector lacks recall; the simplest one could be that the threat actor is on the same network as the employee.

If you really wanted to be confident on your recall, you would take the maximal and coarsest form of this detection: investigate every login. Tokens and defensive security agents have made this possible, albeit expensive.

There now emerges a Pareto frontier of cost and recall, given a capable model and infinite budget, you can take your recall to 100% (and therefore your precision down with it). You can think of the lower left-hand side of the Pareto as “smarter” detections, where you amortize some of the previous investigations you’ve done back into the detection itself via methods like statistical tuning or allowlists.

A New Day

The exciting part is that this frontier doesn’t stay put. Every quarter the price of a token drops, which drags the expensive right-hand side (“investigate everything”) within reach of more and more teams. At the same time, every investigation an agent runs becomes something we can fold back into the detection itself, which pushes the smarter left-hand side further down. Both ends of the curve move in the defender’s favor, and they compound.

This is the second half of the Jevons paradox for security: every team can now afford to run broad, high-recall detections without worrying about increased noise. Fifteen years ago logging everything was a luxury and today it’s table stakes. I think investigating everything is on the same curve.

This is my answer to Seb. I agree that lowering the barrier to entry for offense creates real risks, and I don’t think defenders get to be complacent about that. But technological improvements swing both ways, and defenders have the advantage of accumulated knowledge over time. Every investigation can make the next detection smarter, and every drop in token price makes broader coverage more affordable. Our entire team at @cotoolai is optimistic and excited to play a part in driving the defensive frontier forward and the cost of great security down. Back to work.