Security in the Age of AI Agents

AI is equally powerful for both. While AI can enable new attack vectors, it simultaneously accelerates code review, pen-testing, and patching. Every vendor uses AI to improve security services. The exploit window narrows because AI-driven resolution velocity increases — since bugs are finite, faster resolution makes software more resilient.

The exploit window is the time between vulnerability introduction and patch deployment. It is narrowing because AI accelerates every phase of the resolution cycle — review, pen-testing, and patching happen faster than in human-only pipelines. Increasing resolution velocity makes software more resilient even if AI initially produces more vulnerable code.

Automation is the only way to handle AI-era threat scale. At Lemonade, every security person is an engineer. The role shifts from managing people to architecting automated policies — security becomes a platform-building discipline.

A single endpoint could host 200 to 10,000 agents. Without identity, you cannot enforce policy — you cannot control what each agent accesses. Traditional IAM for human principals cannot scale to this level.

A custom AI platform with specialized agents: one reads threat intelligence and triages, another verifies whether vulnerable methods are actually invoked in production. This two-agent architecture separates signal detection from signal verification, dramatically reducing false positives.

Codifying security policies as version-controlled, testable, automatically deployable artifacts — treating policy like infrastructure rather than documentation. Essential in an agentic world where policy must scale to thousands of non-human actors.

An AI agent checks whether a reported vulnerability is actually exploitable in production by analyzing if the vulnerable code path is reachable and invoked. This reduces false positives and lets teams focus on vulnerabilities that matter.

A Security Operations Center where AI agents perform detection, triage, verification, and response. Human analysts shift from operators to platform architects who design and govern automated workflows.

Traditional IAM handles hundreds of human principals. AI agents add 200–10,000 non-human principals per endpoint. IAM must scale 100-1,000x, support automated identity lifecycle management, and enforce fine-grained policy at sub-second latency.

AI's benefits to defenders are at least equal to its benefits to attackers. Every vendor uses AI to harden products. Defenders can "harden everywhere simultaneously" — a capability attackers cannot match since they must find and exploit individual weaknesses.

Jaffe's argument is probabilistic: with tens of thousands of potential targets, the probability any single organization is targeted is low. As AI-driven defenses harden targets faster, the attacker's search problem becomes harder, not easier.

Four steps: hire engineers for security, invest in AI-driven code review and automated patching, architect agent identity governance now, and treat security policy as code. The CISO's role shifts from risk manager to platform architect.