Ami Luttwak

1. Key Themes

Black October: Theories Became Reality All at Once

Luttwak frames October as a black swan: two prior warning shots (the Mythos announcement and the Hugging Face/OpenAI incident) were theoretical or accidental, while October delivered the full realization. Vulnerability volume, severity, and autonomous AI attackers all arrived simultaneously.

Ami Luttwak: "We've never seen never, ever seen so many security incidents happen in a single month... Both the number of vulnerabilities that has been found in October and the severity of those vulnerabilities, including the PHP vulnerability, probably the most severe vulnerability ever found by AI" 00:02:09

Ami Luttwak: "What's happened now in Black October is that all of those potential theories, the things that we said are coming, they're all came and crashed upon us, and it's happening right now" 00:04:12

Open-Source Models Closing the Gap Is the Real Accelerant

The scariest dynamic isn't frontier models; it's that open-source models are now good enough for attackers to run cheaply and at scale. The expected 6-9 month lag has collapsed to roughly 3 months.

Ami Luttwak: "When we spoke about Mitos a few months ago, we said, 'We have a few months until open-source models catch up.' Okay? So, now they're catching up." 00:04:12

Ami Luttwak: "The hope was that open-source models are a year a year behind, but they're not." 00:41:06

Attack Speed Compression: Weeks of Elite Work in 20 Minutes

AI attackers compress the full kill chain (from initial access to stealing all secrets) into roughly 20 minutes, a task that previously took the best human attackers weeks or months. Few startups can detect or respond in that window.

Ami Luttwak: "Run an entire attack that usually took for the best attackers weeks or months, in again around 20 minutes. That's what we're seeing now." 00:04:12

Ami Luttwak: "Which startup is ready for detecting those attacks? I don't know... you need a 24/7 SOC in every small startup." 00:06:06

Attackers Are Targeting Startups, Especially Those Holding AI Keys

AI development platforms are a specific target because they hold valuable AI keys ("LLM jacking"). Wiz's list of attacked AI dev providers grew from nine to fifteen within weeks.

Ami Luttwak: "We had a blog about, we've seen initially the blog had nine companies attacked in October, and the list is growing every day. We're now on 15... These are getting targeted specifically now because they have AI keys" 00:05:32

Ami Luttwak: "Startups are actually their key target now for for LLM jacking, right? What do you need to do? ... if you have AI keys, probably better to put a limit on them, because if they steal them, you don't want to get a lot of charges" 00:29:53

Patching Is the Structural Weak Link

Exploit time collapsed, but patch time did not. Information leaks before CVEs publish, patches lag, and distro propagation can take months. A single PHP vulnerability affecting ~70% of the internet will take years to fully remediate, and older PHP versions will never be patched.

Ami Luttwak: "In the PHP case, we worked for months with PHP to get the entire industry ready, and it leaked before time, right? So, the customer doesn't have anything to do. The patch was not ready." 00:09:02

Ami Luttwak: "Even just this single vulnerability, is going to take years, okay, until it's resolved... Older versions of PHP are not even getting a patch." 00:07:54

"The Best Defense Is Attack": Continuous Red Teaming Replaces Static Defense

Because attacker capability ratchets up with every model release, security is no longer a static state. Luttwak argues defenders must continuously attack themselves with the latest models. Wiz's Red Agent is already used by a majority of its customers and is one of its fastest-growing features ever.

Ami Luttwak: "Whatever was considered secure last week, if every AI model can get into the door, it's not secure anymore. So, the watermark keeps going up." 00:22:16

Ami Luttwak: "In Wiz, majority of customers are already using the Red Agent... it's really one of the fastest growing features that we've ever released." 00:26:31

Model Cost Orchestration Is the New Core Engineering Discipline

Brute-force scanning is financially ruinous. Luttwak says building scalable AI products means constructing multi-model pipelines: deterministic first, cheap models next, expensive frontier models only for final confirmation.

Ami Luttwak: "I cannot run the most advanced, expensive model on every event... I can create a pipeline where you start from a deterministic detection, then you go through a cheap model detection, then you go through a more advanced model, and if all of them think it's malicious, I will send it to the most advanced model" 00:14:21

Ami Luttwak: "People say, 'Oh, now it's easy to develop using AI.' It's not true. For most founders, right now, the key is going to be the cost." 00:14:21

Security Is About Secure Design, Not Budget

Even with budgets rising (one CISO expects +80%), Luttwak contends money alone won't solve this. Architecture assuming nation-state-grade attackers and constant zero-days is the answer, and legacy tools are largely obsolete.

Ami Luttwak: "There is no security tool in the world you can buy, and everything is fine... It's about secure design even more than just security budget" 00:32:13

Ami Luttwak: "Don't assume, 'Ah, let's run everything in a Kubernetes cluster.' No, like there's zero-day vulnerabilities in the Linux kernel all the time. Anyone can get out of a container." 00:33:23

Return to the '90s/2000s: Worms and Constant Breaches

Zane Lackey predicts a regression to the Windows XP era of unauthenticated remote exploits and even worms, while Luttwak argues it's worse because dependence on technology is far greater and AI is now better than humans at attacking.

Zane Lackey: "I wouldn't be surprised if we end up seeing worms again on the internet uh like we did in the Windows XP days." 00:39:11

Ami Luttwak: "This is almost the only area in human kind right now that AI is better than humans, okay? That's the problem." 00:41:06

Critical Infrastructure and Legacy Devices Are Exposed

Refrigeration units, traffic systems, and any internet-connected legacy device are at risk. Wiz launched Scan for Good to help public services and nonprofits find exposures.

Ami Luttwak: "It can be refrigerators... It can be traffic... It can be really anything that we know that is connected to the internet is at risk. That's exactly the reason we started Scan for Good." 00:44:07

2. Contrarian Perspectives

Scanning Your Code with Frontier Models Is the Wrong Priority

The market's reaction to Mythos was to scan all code with frontier models. Luttwak says the "PR went to the wrong place": unauthenticated external exposure matters more, and over-investing in code scanning can burn millions.

Ami Luttwak: "Mitos got a lot of PR, good, okay, but the PR went to the wrong place. I actually don't think that scanning code is the most efficient thing you can do." 00:26:31

Ami Luttwak: "Who cares about your code? I'm talking about the actual unauthenticated, exposed attack surface that you have, more urgent." 00:24:32

Ami Luttwak: "You might have wasted $5 million... Some customers are spending now tens of millions of dollars on, like, scanning code." 00:17:06

Most of What Security Teams Do Is Not Security

A blunt challenge to the compliance-and-reporting industrial complex, including classic CSPM: if you're not attacking yourself, building strategic barriers, or readying detection and response, you're not doing security.

Ami Luttwak: "Most of what security teams do is not security, okay? There maybe small, small subset of their time is actually security... how much time are you spending with red teams, and how much time are you spending with compliance and creating reports, right?" 00:00:42

Ami Luttwak: "That was always my point against like classic what we call CSPM in cloud, which was just the way you did cloud security before, just a list of configuration checks. I don't care about that." 00:35:46

Security Budgets Won't Fix It, and Automating Patching Isn't Realistic for Most

Counter to the instinct that the answer is more spend and more automation, Luttwak says most companies simply can't be ready for elite attackers, and auto-patching depends on a fully agentic dev/test/CICD/DevOps pipeline that legacy firms lack. It is a startup-greenfield opportunity.

Ami Luttwak: "Most of the companies are not ready for attackers that have the speed and expertise of the best attackers in the world... I don't even know if budgets are going to solve the problem." 00:32:13

Ami Luttwak: "We don't yet exactly know how to automatically patch, and I, honestly, don't see a path towards that... For startups, maybe it's possible. And I would consider this a task for startups." 00:09:02

Vulnerability Discovery Is Like Bitcoin Mining, and Simultaneous Discovery Will Become the Norm

Rather than a finite pool being exhausted, each new model unlocks new vulnerabilities, so multiple teams will independently find the same critical bugs at the same time, shrinking the defender's discovery advantage to months.

Ami Luttwak: "I look at it like Bitcoin mining... because it's like Bitcoin, there's always more, and the new models can uncover more vulnerabilities... multiple teams find new vulnerabilities" 00:11:41

Pull Unready Systems Off the Internet

A stark operating directive: if a system can't withstand nation-state-grade AI attackers, remove it from the internet entirely.

Ami Luttwak: "Whatever is not ready, should take it take off the internet, okay, quickly, right? So, on the internet, you need to be ready with everything that is like ready for the crazy attackers" 00:41:06

3. Companies Identified

Wiz

Cloud security company (now part of Google), Luttwak's company, serving over 50% of the Fortune 100 plus leading startups. Mentioned as a leader in AI-era defense via its Blue Agent, Red Agent/Exposure Agent, and Atlas vulnerability harness.

Ami Luttwak: "So, there's two forces here: the red and the blue. The blue tries to find attacks and stop them. What the red is trying to say is the best defense is attack" 00:22:16

Ami Luttwak: "In Wiz, majority of customers are already using the Red Agent... one of the fastest growing features that we've ever released." 00:26:31

Sarah Wang: "You're working with some of the top enterprise customers, right? Over 50% of the Fortune 100, and then you also have leading edge startups in your customer base." 00:25:59

Atlas (Wiz's Vulnerability Detection Harness)

Wiz's internal harness for AI-driven vulnerability detection, run continuously across models from OpenAI, Google, and Anthropic.

Ami Luttwak: "We built what we call Atlas, which is a harness for vulnerability detection... we're using that with different models all the time, because every model has its own unique capabilities" 00:12:36

Wiz Blue Agent / Red Agent / Exposure Red Agent

Wiz's AI agents for investigating attacks (Blue) and attacking customers' own exposed surfaces (Red).

Ami Luttwak: "We have what we call the Blue Agent, which investigates attacks... Then we layer on top of that what we call the Exposure Red Agent that just looks at everything that is unauthenticated, exposed on the internet from your environment" 00:14:21 and 00:24:32

Wiz Zero-Day Competition (ZDC)

Wiz's zero-day competition, ahead of which multiple teams are independently reporting the same critical vulnerability.

Ami Luttwak: "We are getting ready for ZDC, the zero-day competition of Wiz, and we are seeing, we're getting multiple, multiple reports on a very, very critical vulnerability that is also, I believe, is going to be a major impact on the internet" 00:11:41

Scan for Good (Wiz Initiative)

Wiz's initiative to scan nonprofits and public services for exposures to push them toward continuous red scanning.

Ami Luttwak: "Scan for Good is trying to help any public service that wants help, and we try to scan them and try to find problems... Our hope that if we find stuff, then they will understand it's a bigger project, and then they will start doing red scanning on their own" 00:44:07

Anthropic (Mythos)

Mythos is cited as the first inflection moment showing AI finding vulnerabilities at scale; Anthropic is also named among the frontier model providers Wiz uses.

Ami Luttwak: "The Mitos moment where Mitos came out and said, 'Oh my god, we can find vulnerabilities.'" 00:03:37

OpenAI, Google (DeepMind), Anthropic

Frontier model providers whose differing model strengths, speeds, and costs Wiz benchmarks continuously.

Ami Luttwak: "Every model has its own unique capabilities from OpenAI, or Google, or Anthropic. Like each of them has its own capabilities. We're trying to use all of them" 00:11:41

Caliph

Independent security research group that discovered the same PHP2Shell vulnerability simultaneously with Wiz.

Zane Lackey: "This was a vulnerability that was independently discovered by two groups, Wiz and Caliph" 00:10:51

Hugging Face

Involved in the second "warning shot" incident (accidental AI attack with OpenAI).

Ami Luttwak: "The other big moment that we had was the Hugging Face incident with OpenAI, right? ... But, again, it was accidental attacks." 00:03:37

PHP

Ubiquitous web technology (~70% of the internet) at the center of the most severe AI-discovered vulnerability ("PHP2Shell").

Ami Luttwak: "PHP is maybe one of the most prevalent technologies as an external-facing technology" 00:07:10

Linux (Kernel and Distros)

Cited for slow patch propagation from kernel report to distros and for the container-escape risk.

Ami Luttwak: "Even if there's a vulnerability reported to Linux kernel, it might take weeks or even months until it reaches all of the distros" 00:09:02

Kubernetes

Cited as insufficient isolation when kernel zero-days exist.

Ami Luttwak: "Don't assume, 'Ah, let's run everything in a Kubernetes cluster.' No..." 00:33:23

Windows XP

Referenced as the historical analogue for worm-driven mass compromise.

Zane Lackey: "You couldn't install and update Windows XP fast enough, because from when you installed it and when you started the update, a worm would hit your system" 00:39:11

a16z Infra Team

Zane's colleagues wrote on the exploit-vs-patch time gap and a founder note urging more security spending.

Sarah Wang: "Two of our partners wrote this great piece on time for writing exploits versus patching" 00:08:13

4. People Identified

Co-founder and CTO of Wiz, the guest. Praised for early, specific forecasting (a Y2K-style moment in 12 to 18 months) and for building Wiz's AI red/blue agent systems.

Sarah Wang: "You wrote this great blog post in April that there was a Y2K moment coming in 12 to 18 months." 00:40:47

Zane Lackey

a16z General Partner, former CISO of a PHP e-commerce company, and OWASP-era peer of Luttwak. Offers the worm and 1990s-regression prediction.

Zane Lackey: "As a former CISO of a PHP e-commerce company, yes." 00:07:16

Sarah Wang

a16z General Partner and host; relays internal discussions at the firm and the CISO data point on an 80% budget increase.

Sarah Wang: "A CISO recently told one of the partners on our team that he expects his security budget to go up 80% next year" 00:31:34

Joel

a16z colleague who co-wrote a founder note with Zane urging more security spend and potentially delayed releases.

Sarah Wang: "Zane and our colleague Joel actually wrote a note in the midst of Black October to our founders talking about spending more on security" 00:28:03

Martin

a16z infra colleague who raised the Windows XP worm anecdote.

Zane Lackey: "Martin brought up a funny point of there was for all of us who were kind of in broader tech and IT at the time, there was a window of time where you couldn't install and update Windows XP fast enough" 00:39:11

Elon Musk

Tweeted "Every day is zero day," popularizing the framing.

Sarah Wang: "Every day is zero day, right? Elon Musk tweeted that recently." 00:03:00

Marc Andreessen

Listed as a participant; referenced as "Mark" in an internal discussion that Red Agent swarms are the state of the art.

Sarah Wang: "We had an internal discussion with Mark the other day about how it feels like state of the art is essentially what Red Agent is doing." 00:25:59

5. Operating Insights

Design the Entire Pipeline Around Cost Tiering, Not Model Quality

Treat model cost as a first-class architectural constraint: deterministic detection first, cheap model next, advanced model for escalation, and top-tier model only for final confirmation. Luttwak says this applies far beyond security and is the "new engineering change" for AI-at-scale companies. Without it, "you are going to lose money on yourselves."

Ami Luttwak: "You need multiple models, multiple types of models, and you have to design pipelines. And I think that is really the new engineering change for founders, for companies building AI systems at scale." 00:16:05

Benchmark Every Model, and Every Version, Continuously

Don't commit to one model vendor. Model behavior, speed, and cost differ, and the matrix now includes frontier and cyber-specialized variants of each. The only independent-company strategy is to test all models all the time and find the best combination.

Ami Luttwak: "The only thing you can do as an independent company is to try all the models all the time and to find the best combination, right?" 00:14:21

If You're Building Greenfield, Make Auto-Patching an Architectural Requirement

Startups have a unique advantage: build agentic dev, testing, CICD, and DevOps from day one so that "patch this" is a command the system can execute. Luttwak sees this as a startup opportunity, since legacy firms can't retrofit it.

Ami Luttwak: "For new companies, you should design your system to be able to auto-patch... If you have automated dev, so you need the ability to take a ticket and have an automated dev to create the patch. Fine. Then you need automated testing, automated CICD, and automated DevOps." 00:09:02

Prioritize Attack Surface Order: External Exposure, Then Pen Test, Then Code

A budget-allocation ladder: analyze all exposure deterministically, run agents on every unauthenticated endpoint (minutes each), then spend hours (even 10) on pen-testing critical apps, and only then deep code analysis. Findings should feed detections when fixes are too costly.

Ami Luttwak: "The Exposure Agent maybe will take a few minutes for every endpoint, because you have a million endpoints. When there's a critical application, I might take 10 hours to try and hack it... If engineering says, 'Oh my god, this is too expensive to fix.' Okay, you know what? Let me tell the Blue Agent to put some detections there." 00:24:32

Cap Your AI Keys and Know Who Owns Every Resource

Practical hygiene: put spending limits on AI keys to blunt LLM jacking, and invest in the unglamorous work of mapping ownership, because automating response fails when you don't know who owns what or how to get them to patch.

Ami Luttwak: "It still goes back to find the context of who actually owns every resource, who, how do I get them to patch stuff. It's complicated... a lot of the knowledge of the organization is a bit obscure. It's not anywhere that is actually written." 00:37:54

6. Overlooked Insights

Customers Now Expect the Vendor to Close the Loop: From Detection to Fix to Response

Briefly noted, but a product-strategy sea change: customers have shifted from wanting prioritized findings to wanting the vendor to write the code fix and PR, run forensics, find root cause, and expel the attacker. Luttwak says automated response, "which is very scary," is the next step. This implies that any security vendor still selling alerts and dashboards is already behind, and that liability and trust around autonomous remediation become the next frontier.

Ami Luttwak: "Now they would expect us to go back to the code, find the code, create the fix, create the pull request... They also expect to get a full investigation, forensics, find the root cause, find tell me how the attacker got in and push them out" 00:20:07

Ami Luttwak: "We need to start thinking about automated response, which is very scary" 00:20:07

Vulnerability Leaks Now Precede Patches, So Coordinated Disclosure Is Breaking

Mentioned almost in passing: the PHP vulnerability leaked before the patch was ready despite months of industry coordination, and exploit information frequently surfaces before the CVE is even published. If AI can turn leaked details into exploits in minutes, the traditional embargo and coordinated-disclosure model that underpins the entire patch ecosystem may no longer be viable, leaving defenders with zero actionable window. That implies structural opportunity for virtual patching, runtime mitigation, and isolation-first architectures that don't depend on patches arriving.

Ami Luttwak: "Many times the information leaks before the CVE even is out... In the PHP case, we worked for months with PHP to get the entire industry ready, and it leaked before time, right? So, the customer doesn't have anything to do." 00:08:49

Ami Luttwak: "AI can exploit things in minutes, so the answer is that the world is not ready." 00:09:02