Greg Brockman Says Security Spend Should Vastly Outstrip Software Spend. Here Is OpenAI’s 25% Security Sprint.
1. Key Themes
Theme 1: AI is changing the physics of cybersecurity, and defenders have a closing window
The "defenders window" is open now but will close
Frontier models help defenders more than attackers today because peak capability hasn't spread widely, but each release ratchets up what attackers can do.
"I do think the physics of cyber security are changing, and we're in what we call the defenders window."
"Peak frontier AI can already help defenders secure themselves, Brockman explains, and that level of capability has yet to spread widely. The capability that has spread ratchets up with each release from providers around the world."
"Brockman is blunt about the timeline: the window will close."
Security now rests on two things
An organization's security depends on fundamentals done right plus the cyber capability it uses to defend itself. Brockman expects hidden tech debt to surface.
"He says an organization's security now rests on 2 things. The first is the fundamentals it got right once. The second is the level of cyber capability it uses to defend itself."
"He traces the flaws back to 'really human issues' in the way we chose to build the internet, and he expects a lot of tech debt to surface."
OpenAI is funding defenders directly
OpenAI's Daybreak program gives defenders access to very capable models, with a $1B commitment behind it.
"OpenAI's response is its Daybreak program. It gives defenders access to very capable models so they can find and fix vulnerabilities, and OpenAI backs it with a $1 billion commitment to frontline defenders."
Theme 2: Security should become the dominant spend category as software gets cheap
Security spend should "vastly outstrip" software spend
Brockman's thesis is that software is losing its scarcity as a barrier to entry, so value shifts to resilience and trust.
"I have a feeling that cyber spend, security spend should actually vastly outstrip software spend."
"His reasoning: software used to be the barrier to entry, and it is getting very cheap. The value moves to how resilient that software is."
"You don't just want software. You want software that is reliable, that is secure, that you can believe in."
Supply chains are the weak point at scale
Few companies audit their dependencies, and one malicious package can hit many companies at once. Human developers can't fix this at scale.
"Supply chains show the gap. Few companies audit theirs, and 1 malicious package upload can hit many of them at once. Human developers could never fix that at scale, he says, because so few people hold the expertise."
The investor read-through: trust is where the margin sits
The newsletter points to funded demand for trust infrastructure.
"If software gets cheap, the software you can trust is where the margin sits. Investors already price this in. Harbor raised $10M to insure AI agents in its first year."
Theme 3: Data availability determines which scientific fields AI conquers next
AI-generated new knowledge is no longer in doubt
OpenAI says almost 400 important open math problems are resolved, including century-old ones.
"There's always been this question of whether AI is actually able to come up with new knowledge. At this point, it's just impossible to deny. It is definitively yes."
"OpenAI published almost 400 important open problems it now counts as resolved, and Brockman describes the work as cracking 100-year-old math problems."
Data is the binding constraint, and biology is the hard case
Math and theoretical physics have abundant data; biology doesn't.
"The thing that I think is the core insight is really about data. You can get lots of data in mathematics. You get lots of data in theoretical physics. Can you get lots of data in biology?"
"Biology is 'very data bottleneck, very difficult,' and he says OpenAI has yet to solve how to get that data."
Near-term biotech wins are in paperwork, not discovery
"Writing the case for a clinical trial takes 'like a year,' he says, and an AI drafts those filings far more easily."
Theme 4: The AI interface is moving toward always-on agents and no UI
Proactive, always-on agents change the form factor
"So dots is a proactive agent. It's always on, always working. You stop working, it keeps working."
"Each morning he wakes up to a to-do list. It also flags things he never asked about, like a calendar conflict that means leaving 1 meeting early, because it reads his inbox and his Slack."
The best UI is no UI, with generative UI on demand
"What we're heading to, there isn't even a text box. That is the AI we were promised."
"'How do I assemble a bicycle' gets a bespoke app that would have taken a person a month to write. Nobody would hire a developer for a 1-off bike app, and the AI is happy to build it."
Work and consumer assistants converge, with cost as the difference
"A workplace buyer pays for peak intelligence when the returns justify more compute, while a mass-market product has to run free or very cheap."
2. Contrarian Perspectives
1. Security, not software, should be the biggest line item Most software companies budget security as a small overhead. Brockman argues the ratio should invert, and he flags his own uncertainty.
"He admits he could be wrong. He makes the call anyway."
"His reasoning: software used to be the barrier to entry, and it is getting very cheap. The value moves to how resilient that software is."
2. Proving AI's value must precede regulatory change, even with huge upside Against the "move fast, rewrite the rules" narrative, Brockman says regulators shouldn't change rules on a promise, and he expects some hard limits to remain.
"If you can really prove that the physics of drug discovery have changed, then of course it should trickle through to every part of the system."
"He thinks it is hard to skip at least 1 long-term data point, and he expects 80% of what is possible to arrive very quickly."
3. Biology may be easier for AI than humans assume The consensus treats biology as AI's hardest frontier. Brockman's first-principles view is that the difficulty is human, not machine.
"Language suits humans and biology is foreign to us, so a neural net has no reason to find biology harder than language. He expects to learn that humans are 'incredibly bad at biology.'"
3. Companies Identified
OpenAI
- Description: Frontier AI lab; Brockman is co-founder and president.
- Why mentioned: Case study for the security sprint, the Daybreak program, and the always-on agent "dots."
- Quotes: "We took about 25% of our production engineers and said all of your projects are on hold. You are just securing now." / "[Daybreak] gives defenders access to very capable models so they can find and fix vulnerabilities, and OpenAI backs it with a $1 billion commitment to frontline defenders."
- Description: Frontier AI lab.
- Why mentioned: Cited as seeing the same cyber risk and restricting its most capable hacking model.
- Quotes: "Anthropic decided to keep its most capable hacking model locked away."
- Description: Tool that scans a company's open source supply chain.
- Why mentioned: Raised by the host as a supply chain security solution.
- Quotes: "A host points to Socket, which scans your open source supply chain."
CrowdStrike
- Description: Cybersecurity company.
- Why mentioned: OpenAI partner on the response side.
- Quotes: "Brockman says OpenAI partners with CrowdStrike on the response side."
- Description: Startup insuring AI agents.
- Why mentioned: Evidence that investors are pricing in trust and risk for AI.
- Quotes: "Harbor raised $10M to insure AI agents in its first year, and the deck and memo show how a market with zero loss data got funded."
- Description: Big tech and frontier AI developer.
- Why mentioned: Pursuing the same scientific frontier; its agent broke a long-standing math record.
- Quotes: "Google is chasing the same frontier. Its agent broke a 56-year math record."
Apple (via the iMac story)
- Description: Consumer hardware company.
- Why mentioned: The iMac handle is Brockman's metaphor for human control of AI.
- Quotes: "I'm reminded of the story of why Steve Jobs put the handle on the iMac, right? So that people could feel that they could control the machine."
- Description: Consumer AI assistants.
- Why mentioned: Hosts ask whether work assistants will diverge from consumer ones.
- Quotes: "The hosts ask whether work assistants will split from consumer ones like Instinct and Muse."
4. People Identified
- Description: OpenAI co-founder and president.
- Why mentioned: Primary subject; he walks through the security sprint and OpenAI's strategic views.
- Quotes: "I think that people have not yet really internalized how much the physics around cyber security are going to change."
- Description: OpenAI CEO.
- Why mentioned: Advised small companies to defend themselves during the defenders window.
- Quotes: "Sam Altman told every company under 1,000 employees to defend itself while the window is open."
Steve Jobs
- Description: Apple co-founder.
- Why mentioned: His iMac handle is Brockman's analogy for keeping humans in control.
- Quotes: "The same spirit needs to apply to AI."
- Description: Host of the No Priors podcast.
- Why mentioned: Hosted the interview and posted the episode summary.
- Quotes: "What are the Post-AGI Rules of the Game in Cyber and Science? New @NoPriorsPod with @gdb."
Ruben Dominguez
- Description: Author of the newsletter post.
- Why mentioned: Summarized the interview.
- Quotes: "I watched the full interview so you don't have to."
Andrej Karpathy
- Description: AI researcher.
- Why mentioned: His autoresearch run is cited as a loop-design model.
- Quotes: "The loop design in Karpathy's 2-day autoresearch run and the overnight optimization playbook carries over almost line for line."
Demis Hassabis
- Description: Google DeepMind leader.
- Why mentioned: His deck predicted AlphaFold and informs the biology thesis.
- Quotes: "The 55-slide Demis Hassabis deck that predicted AlphaFold."
Dario Amodei
- Description: Anthropic CEO.
- Why mentioned: Linked for his long-game approach to safe AI.
- Quotes: "Dario Amodei's long game of safe AI."
5. Operating Insights
1. Run a "security sprint" loop on every new model release Freeze the roadmap, point your best model at all your code and infrastructure, build reusable tooling, fix, and rerun until the model finds nothing new.
"Every time a new model drops, you apply it to your own systems, find your vulnerabilities and saturate."
"A startup can run this with a calendar block and 1 rule: nothing ships until the loop is done."
"Turn every probe into a reusable tool. OpenAI built tooling so the sprint is easy to repeat, and that tooling is what makes the second run cheap."
2. Put an independent AI critic between agent output and customers When you can't verify AI work yourself, use a second AI whose only job is to attack the first, and you judge the argument.
"It's pretty hard unless you have another AI who is trying to prove that the summary is a bad summary."
"In the managed agents playbook, a second agent grades every brief before a user sees it."
3. Ask the data question before the model question Score every AI use case on whether data is abundant before investing.
"Capability follows data, so score every use case on its data first."
6. Overlooked Insights
1. Training models to write secure code, and proving security properties, targets future code Beyond fixing existing vulnerabilities, OpenAI is working on the code not yet written, which could shift how secure software gets built.
"So much code is now AI-assisted that OpenAI is training models to write secure code from the start. He also asks why models that are great at proving things shouldn't prove the security properties of software."
2. Clinical trial regulation is already fragmenting by jurisdiction Companies are relocating trials based on regulatory friendliness, an arbitrage opportunity that could be accelerated by AI evidence.
"Clinical trial rules already differ between Australia and the US, and he notes that companies are moving trials to wherever the regulation makes more sense."