Every Reachable System Is Now Worth Attacking

In 1883 a Dutch linguist and cryptographer named Auguste Kerckhoffs laid down what became the closest thing computer security has to scripture: a system should remain secure even if everything about it, save the key, is public knowledge.¹

Almost a century later, in 1975, computer scientists Jerome Saltzer and Michael Schroeder restated the idea as the principle of “open design.” Do not, they warned, rest your protection on the enemy’s ignorance of how your machinery works.²

Cybersecurity practitioners have repeated that sermon ever since. We have also, quietly and almost universally, ignored it.

Undocumented interfaces, proprietary protocols, closed firmware, custom file formats, a service listening on an unusual port, a login page nobody had thought to catalog: none of these was ever advertised as security in the theoretical sense. Yet these obscurities were load-bearing. They bought us time. They kept the merely curious out and made the determined pay an obscurity tax in effort. The industry lived a double life, preaching that obscurity is not security while depending on it every single day.

That double life worked because of an economic fact: Finding a flaw and exploiting a flaw are different problems, and for most of the digital era it was the finding that was expensive. RAND’s landmark study of some 200 real-world zero-day vulnerabilities put hard numbers on it: the average flaw survived undiscovered for nearly seven years, and only around 6% of a given stockpile was independently found and disclosed in any year. Once a usable bug was in hand, weaponizing it took a median of about three weeks.³ The scarce resource, in other words, was never cleverness alone. It was attention: the small population of people with the time, skill, access and incentive to go looking.

Even public knowledge did not collapse that moat. The researchers who built the CVE-Bench benchmark found that manually turning a single disclosed web vulnerability into a working exploit took between five and twenty-four hours of specialist labor.⁴ A flaw could sit in the open, cataloged and warned about, and still go largely unexploited simply because converting an advisory into an attack was tedious, bespoke work. Being unfashionable, fragmented, proprietary or plain boring was, for many products, a genuine defense. Not a sound one. But a real one.

The moat has been draining for longer than most people realize. In 2013 a tool called ZMap showed that a single ordinary computer could scan the entire public internet on a given port in under an hour.⁵ Search engines such as Shodan and Censys then made the results queryable. At that moment, obscurity of location died: an unusual address or an obscure service was no longer meaningfully different from one painted on a billboard. Cloud computing made mass testing cheap; open vulnerability databases made information abundant. Each wave stripped away one layer of friction.

Artificial intelligence is coming for the last and most stubborn layer, the cognitive one. The costs that survived automation were the human costs: reading unfamiliar code, reverse-engineering an undocumented protocol, working out which subtle change a patch was meant to fix, debugging an exploit through dozens of failed attempts. These were exactly the tasks that required a scarce specialist. They are exactly the tasks large models are now learning to do on demand. Undocumented behavior becomes searchable. Binary code becomes easily explained. A security patch becomes a set of clues pointing clearly at the bug it silently repairs. Each capability is imperfect on its own; the danger is in composing them into a loop that enumerates, fingerprints, understands, hypothesizes, tests and iterates without a human in every seat.

This is no longer speculative. In 2024 Google’s Big Sleep agent found a previously unknown, exploitable memory-safety flaw in SQLite, one of the most widely deployed pieces of software on earth, a bug that years of conventional testing had missed. By 2025 it had found more.⁶ And the trend is now visible in the concrete breach data. Verizon’s Data Breach Investigations Report, the industry’s most-cited census, has tracked exploitation of vulnerabilities climbing from roughly 7 percent of initial-access breaches in 2022 to 14, then 20, and in the 2026 edition to 31 percent. That is the first time in the report’s nineteen-year history that exploiting a flaw has overtaken stealing a password as the commonest way in. Over the same window, patching has gone backwards: the median time to fix a vulnerability lengthened, and barely a quarter of the most critical, known-exploited bugs were fully remediated. Verizon also found, working with Anthropic’s safeguards team, that flagged threat actors were already leaning on language models across a median of fifteen distinct attack techniques.⁷

It would be lazy to pin all of this on AI; the acceleration began before agentic AI was a thing, driven by mass scanning, cryptocurrencies providing a difficult-to-trace path to extortion, and criminal specialization. But the direction is unmistakable, and its deepest implications are not about breaking in at all. They are about what “in” now means.

Consider the authority we quietly accumulate. Microsoft’s own telemetry across millions of cloud identities found that only about 2 percent of granted permissions are ever used; roughly half are classed as high-risk; and the average corporate estate contains some 351 exploitable paths to a critical asset.⁸

We have, in effect, been carrying around fifty units of dormant power for every unit we actually exercise, tolerable only so long as discovering and stringing that power together was too laborious to bother with. Verizon’s latest report captures the consequence with brutal economy: in a sixth of organizations, an attacker who lands on a low-privilege account has an 80 percent or better chance of reaching a key administrative one. Nor is stringing those paths together still a human monopoly. When the UK’s AI Security Institute turned frontier models loose on a simulated 32-step corporate takeover, running from reconnaissance through credential theft, lateral movement and data exfiltration, the strongest system it tested, Anthropic’s Mythos, was the first to complete the entire sequence unaided. The composition of dozens of access steps into a single autonomous run is precisely the work that once required a skilled team. The comforting phrase “low privilege” assumes the escalation paths are absent or too costly to find. Machines that test hypotheses at pennies apiece are quietly retiring that assumption.

None of which means we are doomed or that attackers now win by default. Defenders, too, can automate, and in controlled tests AI defenders sometimes outpace AI attackers. The likely destination is not surrender but a faster, more expensive equilibrium, one in which sloppy architecture and sprawling authority carry a far steeper penalty than before. The scarce resource is already migrating from finding flaws to verifying, prioritizing and fixing them; the winners will be those who can prove exploitability and remediate the highest-value paths, not those who merely count alarms.

Look a few years ahead and the sharpest consequence is not that attacks multiply but that the long tail becomes worth attacking. Human adversaries have always concentrated on popular software, because expertise is costly and only pays if it can be reused across many targets. That logic is what has quietly protected the bespoke internal application, the abandoned open-source dependency, the niche regional vendor, the decade-old industrial controller humming away on a factory floor. Strip out the cost of understanding an unfamiliar system, and that protection evaporates. Expect vulnerability to spread outward from the major platforms toward everything obscure, forgotten or one-of-a-kind: the very systems that were never designed to withstand scrutiny, because they were never expected to receive any. The most exposed organization of the coming decade may be the one whose estate is the most sprawling, the most poorly documented and the most confident that no one would bother to look.

There is a single test that cuts through all of it. Would your system remain acceptably secure if an adversary held its source code, its documentation, its firmware, its configuration conventions and its entire patch history, and could set a tireless, infinitely patient machine to work on the lot? For a great many of the products quietly running the world, the alarming answer is no.

Kerckhoffs told us as much more than 140 years ago. We are about to be forced, at last, to listen. Artificial intelligence will not abolish access control. It will make access control honest about everything an identity can ultimately reach.

References

1. Kerckhoffs, A. (1883). La cryptographie militaire. Journal des sciences militaires.
2. Saltzer, J. H., & Schroeder, M. D. (1975). The Protection of Information in Computer Systems. Proceedings of the IEEE.
3. Ablon, L., & Bogart, A. (2017). Zero Days, Thousands of Nights: The Life and Times of Zero-Day Vulnerabilities and Their Exploits. RAND Corporation.
4. CVE-Bench research team (2025). Five to twenty-four person-hours of specialist work to manually reproduce and exploit a single real-world web vulnerability, across 40 critical-severity cases.
5. Durumeric, Z., Wustrow, E., & Halderman, J. A. (2013). ZMap: Fast Internet-wide Scanning and Its Security Applications. USENIX Security.
6. Google Project Zero and Google DeepMind (2024–2025). Big Sleep agent: first publicly reported discovery by an AI agent of an unknown, exploitable memory-safety vulnerability in widely used software (a stack-buffer underflow in SQLite), with further findings by mid-2025.
7. Verizon. Data Breach Investigations Report, 2022, 2024, 2025, and 2026 editions: exploitation of vulnerabilities as a share of initial-access vectors (7%, 14%, 20%, and 31%); 2026 as the first year it became the leading vector, overtaking credential abuse (13%); lengthening median remediation time; low remediation of known-exploited vulnerabilities; in roughly 16% of organizations a low-privilege foothold yields an 80% or better chance of reaching a key administrative account; and analysis, with Anthropic’s safeguards team, of threat actors using large language models across a median of 15 MITRE ATT&CK techniques.
8. Microsoft. 2023 State of Cloud Permissions Risks and 2024 State of Multicloud Security Report: of roughly 51,000 permissions granted to human and workload identities in 2023, only about 2% were used and about 50% were high-risk; workload identities made up about 83% of cloud identities; the average estate held about 351 exploitable attack paths, with 88% of organizations having at least one path to a critical asset.