The Moat Was Scarcity: Part 1

TL;DR

‍
AI made finding and exploiting vulnerabilities cheap at the same time. That breaks patch-speed defense. The answer is not to patch faster.

For as long as there has been software to attack, the chain has looked the same.

• Know what's exposed.
• Find a vulnerability in it.
• Build a working exploit.
• Use the access you've won.

Four links, and for decades, two of them were harder than the others.

Knowing what's exposed was never the bottleneck; scanning has always been pretty cheap. Using the access, once you have it, is tradecraft, not a wall. The wall that was the hardest to scale was always finding a real vulnerability and turning it into something that fires reliably. This took scarce, expensive, deeply skilled people. 

The moat, in the classic business sense, is whatever protects you from being overrun by a threat. The moat in vulnerability defense has been the scarcity of skilled people who could find a vulnerability and turn it into an exploit. These two steps used to be slow and expensive because so few people could do them well, and that gap in time is what made "patch before it gets weaponized" a workable strategy at all.

However, AI drains this moat by making the two scarce, expensive skills cheap and fast for anyone. Once the moat (scarce expertise) is gone, the castle it protected (patch-speed defense) falls too, since there's no more time buffer between disclosure and exploitation. Finding and exploiting collapse toward zero cost and near-zero time. 

The question is simple and uncomfortable: what happens to a defense built on patch speed when the expensive links get cheap?

The short version: the disclosure-to-exploit window shrinks below any window in which you could realistically patch, and patch speed stops being a race you can win. CISA reached the same conclusion in June 2026 and wrote it into federal policy. We'll get there.

Two kinds of findings

Finding vulnerabilities isn't one skill. It's two, and they don't compress at the same rate.

The first is the creative leap: the researcher who invents a technique nobody had named, who finds the door in a wall everyone thought was solid. This is rare, and it stays at least partly rare, because invention is more than pattern-matching.

The second is variant-finding: taking a known bug pattern and working a codebase, patiently, for the next instance of it, and the next. It demands real knowledge of how the target operates, but at bottom it is pattern plus persistence rather than invention. It was expensive only because the people who could do it well were scarce, and the work was slow.

AI compresses both, but it eats variant-finding first, and most completely, because variant-finding is the part that looks like pattern application rather than novelty. Point a capable model at a codebase and a known pattern and it will surface instances faster, and cheaper, than any human team.

Most vulnerabilities that get exploited in the wild are variants, not novel classes. The exotic technique makes the conference talk. The workmanlike variant of a known class is what ends up in the breach report. So the part of discovery AI makes cheap first is the part that produces the bugs that hurt you, and it is producing them now.

There was never a scarcity of bugs, only of the people who could find them, and that's a claim you can test. Check the deepest well on earth and see if it's still producing.

The deepest well

If you want to know whether a well is running dry, you don't check the shallow ones. You check the deepest, best-maintained well on earth and see if it's still producing. Consider the two most scrutinized codebases in existence: the Chrome browser and the Linux kernel. Both have elite security teams auditing them continuously, full-time, with world-class tooling and every incentive to find their own bugs first. If the supply of vulnerabilities exhausts anywhere, it exhausts here.

It doesn't.

The Chrome data carries the point on its own. Even with elite internal teams auditing their own browser without pause, the supply of findable bugs never runs out. The well is, for practical purposes, bottomless. AI does not change its depth. It changes how fast you can draw from it: an inexhaustible supply, now pumped harder.

The Linux kernel sharpens this, because here we can watch a single high-value category over time: the deterministic, generic Local Privilege Escalation (LPE). A reliable generic LPE is not just another bug. It's a master key. It barely depends on the environment it lands in, it stays good for years, and it works across enormous fleets of identical kernels. One good one is worth a campaign.

Walk the timeline forward and the gap between these master keys keeps shrinking. The crown jewels show up more often. Then listen to the people who maintain that kernel.

Linus Torvalds, announcing a recent kernel release candidate, was blunt about what AI bug-finding has done to the kernel's own security process. His complaint was not that the tools fail, but that they work for everyone at once. If you found a bug with AI tools, he wrote, "the chances are somebody else found it too". And the sharper line, the one that should kill any comfort you take in a quiet patch window: AI-found bugs are, in his words, "pretty much by definition not secret".

That detail quietly destroys the assumption under everything. A private patch window only means something if, during the gap between discovery and fix, you are the only one who knows. When the same tools in anyone's hands surface the same bug on the same day, independently, all over the world, that privacy is gone.

Your unpatched window is not the private time you've been granted. It is a public fact you have not acted on yet.

And acting on it runs into physics you don't control. You cannot reboot and repatch fleets of VMs and bare-metal boxes every week. Change windows exist for a reason, and production uptime does not bend to a researcher's schedule. So the patch clock is set by your change-management reality. The exploit clock is set by nothing, and AI just loosened it further. The two are pulling apart, which is what the timeline above is meant to show.

You know your own environment better than any attacker ever will. That's not a consolation prize, it's the only edge left once patch speed stops being a race you can win. As mentioned above, finding vulnerabilities got cheap and fast at the same time. This means the old strategy, close every path before someone finds it, is not going to hold. So the shift isn't more effort in the same place. It's putting that effort where the terms are still yours to set.

So what do you do, once you accept the race is structured against you? Stay tuned for part II of The Moat Was Scarcity.