Organizations have realized greater profits by doing business online for decades. Doing business online comes with the cost of operating in a landscape where threat actors exist. Those threat actors also keep improving their ability to profit, thrive, and achieve their objectives at your expense. The cost of a data breach has risen in the US to 10.22 million, and it’s been reported that Cybercrime (Yes, cyber- we lost this battle; general audiences identify it as cyber) has surged past a trillion dollars. Yet some companies still claim that they don’t have the resources or money to do security beyond compliance.

compliance is just compliance

There is nothing wrong with compliance. People bash it for not being “security,” but it was never meant to be security. It’s a set of policies and criteria required to meet a minimum bar to do business with certain customers. Its function directly correlates with the business’s ability to make more money. I can fully understand why companies emphasize this work over other types of security work. However, it is not a risk-reduction function.

Risk reduction is what you’re missing

What most companies miss is evaluating their organization through the lens of risk reduction and taking appropriate action to avoid breach-related loss. Losses vary and should be identified and addressed based on your circumstances (e.g., most companies don’t necessarily need a Red Team). Compliance alone does not reduce risk because compliance requirements are not meant to serve this purpose. However, most organizations do the bare minimum because it ties directly to making or not making more money.

“Always remember, compliance is important, but true security requires going beyond what’s mandated to effectively mitigate risk and stay ahead of the threat landscape – pg 10

Ross Young (2025)

Cybersecurity’s Dirty Secret: Why Most Budgets Go to Waste

You’re choosing to be a sitting duck

I want to be very clear: if you’re only doing compliance, you’re choosing to do almost nothing. This choice leaves you at the mercy of online threats, shows you don’t care about your customers’ data, and, to put it plainly, is negligent. This shift didn’t happen yesterday; in fact, choosing to do this for so long has led to a recent 2:1 advantage for adversaries yet again. Not to mention, many decades of breaches have shown us through experience that it’s a losing strategy. Your excuse about resources, money, or it being an *cough* APT is no longer acceptable. You’re responsible for making investments that reduce risk appropriately for your business…or you’re intentionally choosing to be a sitting duck 🦆.

Shortly after Artificial Intelligence took over our news feeds, questions arose about how it would affect the speed and skill of attacks. The second question was if defenders could use it to get ahead. Unfortunately, as the story played out, it gave Red Teams (and therefore adversaries) an advantage they didn’t need. Still, it would no doubt be exploited to the fullest. As it currently stands, Red Teams have a 2:1 advantage in this overall situation. Thankfully, the story hasn’t fully played out, and there is still time to change the outcome.

Red team advantage 1

I’ve worked in technology for nearly 20 years, and I’ve seen many technologies deployed rapidly to keep organizations competitive. However, I’ve never seen a technology deployed so ballistically and carelessly as AI. It’s like everything we learned about security was immediately forgotten when a shiny new toy appeared. To double down, everyone proceeded to give poorly configured AI access to tools (code execution), remote control, and critical data. Red Teams no longer need to crack the perimeter when one misconfigured AI server gives up everything needed.

Red Team advantage 2

Red Teams also benefit from AI’s speed and scale when actively operating, developing capabilities, and scaling initial foothold discovery. Frontier models have many safeguards in place to slow their use for this purpose (though approved access loosens these restrictions). Still, honestly, they don’t do much. At best, it creates a minor inconvenience; at worst, we have to write or modify code by hand, which wasn’t an issue before AI. Even though AI can’t Red Team as it stands, it’s been a huge help as an assistant for Red Team operations or during capability development.

Blue Team advantage 1

For defenders digging into large data sets to discover threats, AI is infinitely useful. It provides scale, speed, and analysis never previously possible. But Red Teams and Adversaries are also generating events at that scale when using AI. Defenders have a huge opportunity at this stage in the AI timeline. If used properly, these advantages could level the playing field in future rounds of this match. However, defenders can only gain these advantages if they aren’t fighting the security regression caused by poorly secured AI technologies.

Closing thoughts

The situation is evolving rapidly, and Red Teams (and therefore Adversaries) have the advantage. If defenders lean into this once-in-a-lifetime opportunity, they could create significant friction and frustration for Red Teams. Sadly, Red Team Advantage 1, where people are punching holes in the attack surface with poorly configured AI technologies, isn’t helping. I’m seeing strong innovation in this space for defenders, and I’m confident they will not leave any advantage on the table. I’m even more confident that Red Teamers won’t either.