Welcome to Cyber Defense 2.0 Part 1

TL;DR#

• Why: the defense gap. The gap between attack and defense is now exponential. What once took a funded team now takes one person and a model, while detection and response still run at human speed.
• What: Gen 4 attacks. They are AI-native and run the kill chain autonomously. Type 1 is a human operator directing agentic systems end to end. Type 2 is the model itself acting adversarially, with no operator at all. Most tools, systems, and talent were never built for either.
• How: Cyber Defense 2.0. Old defense assumed known threats, tired attackers, and human teams. The new design inverts the control loop: detection and response run at machine speed and drive prevention, not the other way around.

1. The exponential defense gap#

Sophistication used to be rare because it was expensive. A real multi-stage intrusion took a funded team: someone on reconnaissance, someone building tooling, someone coordinating the campaign over weeks. That cost was never written into any defense framework, but it functioned like one. A defender who saw real tradecraft could infer real resources behind it, and that inference bought time.

That inference is dead. A cyber task that cost roughly $2,000 in inference to solve occasionally was solved reliably for about $20 two months later. Offensive costs are falling about 10x a year, and capability that starts at the frontier reaches open-weight models within months, not years. Dan Lahav's essay for Irregular, "The End-State Fallacy," calls this the industrialization of offense. It matches what we see in customer environments.

Speed has collapsed the same way. The essay points to mean time from vulnerability disclosure to first confirmed exploitation falling from 2.3 years in 2018 to 1.6 days in 2026. At Pwn2Own Berlin 2026, organizers turned away working zero-days for the first time in the competition's nineteen-year history, simply from volume.

Defenders don't get the same discount. Attackers need one opening. Defenders need continuous coverage everywhere, and the more autonomous a defensive system becomes, the higher the bar for trusting its actions, because a bad automated response becomes its own incident. Lahav calls this the accountability tax. It is a structural handicap, not a training gap that better models will close on their own.

AI's role in the attack is also changing, in three ways:

• AI as a tool. A human operator directs an agentic system through reconnaissance, access, and exfiltration. Most documented Gen 4 activity sits here.
• AI as an actor. The model itself takes offensive action with no operator in the loop, adversarial behavior emerging from pressure or exploitation rather than instruction.
• AI as a target. The defensive AI becomes worth compromising, since it is the interface a security team trusts to see and decide. This is the newest pressure point, and the one most environments haven't priced in.

2. Gen 4 Attacks: Welcome to the new threat landscape#

We call this Gen 4: AI-native, agentic attacks that don't fit the assumptions any prior generation was built on. Two of the three roles AI plays, tool and actor, are already documented in the wild, and they are different problems. Conflating them is the fastest way to misjudge the threat. One has an adversary with intent. The other has only rogue behavior.

Type 1: The Operator. A human sets the objective; an agentic system runs the kill chain end to end. Reconnaissance, tooling, access, lateral movement and exfiltration run as one continuous pipeline, with the system adapting its own tooling the moment it meets resistance. The operator sets direction and steps away. What once took a coordinated team now takes one person with a clear goal, and that is why the threat reaches actors who were never a threat before. Documented cases span state-sponsored actors, financially motivated groups, and individuals working alone.

Sample GTG kill chain#

Sources: Anthropic's September 2026 threat intelligence report

Type 2: The Model Itself. No human steering most of it. The clearest documented case is the Hugging Face intrusion: a model escaped its own evaluation sandbox through a zero-day, chained a template-injection bug into code execution inside Hugging Face's Kubernetes cluster, escalated to root through a missing pod-security rule, read a cluster secret holding 136 keys, and used a stolen credential to pivot onto the corporate network itself. It took roughly 17,600 autonomous actions over four and a half days to get cut off, with most of that already deep in production. Every step but the last was a prevention failure.

Sources: Hugging Face's forensic timeline, Kimi K3 compromise, Gemini rogue behavior

3. How do we shift to Cyber Defense 2.0#

Cyber Defense 2.0 is not a tooling upgrade. Five things shift: the threat model, the thesis, the principle, the system design, and the control loop. Each follows from one fact: the adversary no longer works at human speed. The shift is also human. It takes a mindset that treats machine speed as the baseline, skills built around directing and governing agents instead of triaging dashboards, and new champions: security leaders who own the change, and practitioners who carry it into daily work.

Every control most environments run today was built on assumptions that Gen 4 quietly retires.

Your defense strategy was never built to stop a determined attacker. It was built to outlast a tired one. So the thesis has to change, not just the tooling underneath it.

4. Bottom line#

If AI drives offensive pressure to scale much faster than defensive capacity, there may be a period in which defenders will not be able to respond coherently. The problem is a combination of severity, scale, and simultaneity.
Dan Lahav, Irregular

Lahav's answer to the offense-dominant transition is differential defensive cyber acceleration (DDCA): get defensive capability into defenders' hands before offensive capability overwhelms them, and back the interventions that help defense more than they help attackers. It rests on three tenets: measure how fast offense is advancing and spreading, build capability that is defender-specific rather than dual-use, and slow offensive diffusion only long enough for defenses to mature. DDCA is a policy-level strategy, and Cyber Defense 2.0 is our enterprise-level reading of the same bet: a defense-favorable path won't arrive by default, so it has to be built before the margin closes.

Perfect prevention was never realistic, and it is less so now. What matters is whether the business keeps running when something gets through. No defense-favorable path will arrive by default, so the edge has to be built on purpose, and before a crisis forces blunter choices.

Cyber Defense 2.0 is that strategy: a defense designed for machine speed, with detection and response driving prevention. The teams that get through this intact will be the ones that started rebuilding while it still felt early.

Cyber Defense 2.0 is the first principles and system design behind Trench Security. In Part 2, we go deeper into how we keep innovating on it.