Post #4377990

the "role" of LLMs in Security is farcical and having to seasoned Cybersec veterans absorb and perpetuate the hype makes me want to entirely leave the industry. /rant 1. if you could instead use all of the 'cloud' architecture on which the big name LLMs serve their APIs, to instead run maximally threaded multiprocessing tasks for automations like burpsuite, autopwn etc, you would have fully deterministic and debuggable results much faster than waiting for the prediction machine to juggle and re-juggle thousands of 'tokens'. The difference is that These vendors are willing to operate at such a collossal loss that people don't notice how much compute they'd actually be paying for to emulate its scale. 2. From a defender's perspective, nothing exceptional changes. If Gork pops a known CVE on some webserver, it is not meaningfully different to a human popping it. If the malware is written by Blippo5, it is no different to if it was written by a human. You detect it or you don't, you quarantine it or you don't. It will privesc or it won't. it'll c2 or exfil secrets or it won't. 3. What does change is that there are some new additions to your attack surface. Local 'harnesses' like Claude code. Internal 'MCP' servers. New techniques like fetching instructions/droppers relative to a probabilistic interpretation of system state. But ultimately, it's malware or unauthorized access, and you quarantine it or you don't. 4. Users fall for phishing emails or they don't. My anecdotal experience is that more "sophisticated" brand impersonation emails don't have any more (and in fact, have less) success on real life userbases than Nigerian Prince-tier quality phishing emails, for baiting user interaction. 5. "The barrier to entry has been lowered!" maybe has a scratch of validity, but is negated by all the above points anyway. 6. It is no coincidence that in the last 2 weeks all the vendors have been competiting with each other for their SUper Duper Model to "EscaPe ConTaiNMeNT" and "Hack" other companies. It's pure horse shit. Andy Kaufman v Jerry Lawler hype marketing as it's always been. /end