When every week brings one or more Y2K-grade vulnerability, normal surveillance infrastructure like the CVE reporting system degenerate to uselessness. But this doesn’t mean we’re necessarily getting swamped or overwhelmed. There is no indicator that tracks the fact that AI-powered defensive reactions have also been one equally capable, possibly more so. This may not fix hardware level unpatchable vulnerabilities but for everything else, it’s not actually clear that the the threat environment has gotten worse. All we know is that our surveillance and response tracking systems are flying blind. For all we know things are getting overall more secure faster than vulnerabilities are getting discovered.

from Venkatesh Rao's Blyg ↗ · excerpt of v1

Yeah my (unmeasured) suspicion is defense is way ahead of offense. Enormous energy is being put into it and it is possible to write perfect code.

This is useful context too:

Here’s the first part of my theory: cybercriminals are not the organized geniuses we implicitly imagine. Anyone building a criminal gang has to find candidates willing to forgo more stable opportunities in the formal economy. My modeling estimated that something like 720,000 people are involved in the online criminal economy, 90% of them in scam and fraud call-center type operations, some of them human-trafficked. Of the 76k or so actual hackers, the vast majority work for governments. Of the remaining few thousand criminal hackers, most work in ransomware. Some demographic estimates of these workforces are below.

Criminal organizations need to base themselves in middle and lower income countries, where they can pay less and hire people who have few formal-economy options. For scams and fraud, picture an illegal call center building in a small city in Nigeria. For ransomware gangs, picture kids working in the informal economy in Belarus. I think folks in the AI safety and cyber world sometimes imagine adversaries as their Waluigi twins, implicit MIT graduates; in fact, in cybercrime we’re dealing with a lower-skill demographic. The chart below estimates attacker wages relative to default economy wages…

https://joshuasaxe181906.substack.com/p/if-the-vulnpocalypse-is-the-apocalypse