Good News: The Robots Are Faster Than You Now

Pillar 01 · Security

Bias declaration. I founded SkyeConnex. We sell data custody. I have a financial interest in your files being unreadable. You have one too, you just haven’t been told yet.

Assume Autonomy

Well, we have a new doctrine.

Rik Ferguson at Forescout wrote “Assume Autonomy” this week and it’s a good piece. Go read it.

The short version is that attackers are now machines, they’re faster than us, and the answer is to build our own machines and govern them very carefully. He says it calmly. I’d be less calm.

Quick recap. For years we assumed nobody could get in. That went badly. Then we moved to Assume Breach, where you plan for them getting in. That went a bit better. Now it’s Assume Autonomy, where they get in, look around and leave before anyone notices they showed up.

We keep renaming the problem and the file hasn’t moved an inch.

What actually happened

Last fall a Chinese state-sponsored group gave an AI coding agent about thirty targets and let it do 80 to 90 percent of the work. The humans mostly clicked approve. Middle management, basically.

In May, Google caught criminals using an AI model to find and weaponize a 2FA bypass zero-day for a mass exploitation run. The exploit code had nice docstrings and a made-up severity score. Our adversaries now write better comments than our developers do.

CrowdStrike puts average breakout time at 29 minutes. The fastest they saw was 27 seconds. Your SOC can’t find the escalation runbook in 27 seconds, and your change advisory board meets Thursdays.

The prescription

The article’s answer is complete asset visibility, dependency mapping, and giving your defensive AI enough context and guardrails that it doesn’t do something dumb. Then you govern the robots that fight the robots.

Complete asset visibility. We’ve been promising that since Windows NT. Ferguson admits the gaps hang around for years no matter what gets spent. But this time we’ll close them at machine speed with a new platform, which will of course need its own visibility. Somebody will sell you a tool to see that tool.

Every one of those recommendations is about protecting the file. It’s the same readable file that’s been around since 1973, and we keep hiring better guards for it. Now the guards are robots with a governance framework. I’d just like someone to ask why the vault is full of cash that works for whoever picks it up.

Ottawa agrees, sort of

Treasury Board’s new SPIN kicked in October 1. It tells departments to assume breach, contain fast, limit blast radius and recover quickly. That’s the right policy. Now try following it.

When they’re in, what do they get? In most shops the honest answer is everything the stolen identity can read. And the stolen identity always seems to belong to an admin.

You can’t detect your way to a smaller blast radius. It comes from how you store things. Buy all the detection you want and the bomb is still the same size.

A fairly boring idea

A file is one bag of bytes in one place, readable by whoever’s holding it. If you have it, you can read it. An autonomous attacker is just a faster way of having it.

So we split it in two.

The substance gets encrypted on the client, erasure coded into shards and spread across independent hosts by geopolicy. No host has a readable file. No operator has the keys, us included, which our lawyers are quite happy about. Reconstruction happens inside the client’s boundary or it doesn’t happen. We use ML-KEM-1024 and ML-DSA-87, so the harvest-now-decrypt-later people can keep filling their warehouses. Everyone needs a hobby.

The shadow is what stays out in the open. It’s a signed record of the file with no content in it. What the file is, where its pieces live, who touched it and when. That’s what does the audit, classification and conformance work. Steal it and you’ve got a very detailed receipt for something you don’t own.

Now give the attacker their best day ever. The agent does recon at impossible speed, grabs credentials, moves laterally in 27 seconds, finds the storage and pulls every byte it can reach without a single mistake.

It goes home with a pile of shards it can’t put back together and a catalogue of files it doesn’t have. Confetti, nicely indexed.

His four conditions

Ferguson says autonomous defence needs context, constraints, reversibility and transparency before you can trust it. Fair enough. Here’s how that looks when the data layer carries the load.

Context. The shadow is the inventory. Every object reports in, signed, whether or not anyone ran the scanner this quarter.

Constraints. Authority sits in the keys and the geopolicy. An agent, ours or theirs, can’t touch what it can’t reconstruct. Nobody has to convene a steering committee for that.

Reversibility. Custody keeps point-in-time versions. Ransomware encrypts at machine speed and you roll back at human speed, and it still works. A version sealed last Tuesday doesn’t care how fast anyone is today.

Transparency. The ledger is hash-chained and signed, so gaps show up. You don’t have to take the defensive AI’s word for what happened, which is good, because it’ll sound very sure of itself either way.

Where I land

Assume they get in. Assume they’re faster than you and always will be. Then set things up so that getting in doesn’t get them much.

Keep the detection. Buy the robots and govern them properly, Ferguson’s right about all of that. Just stop leaving the cash on the floor while the robots argue about who gets to guard it.

We built this before anyone called it Assume Autonomy, and it’s running now.

Sovereignty by architecture, not by promise.

Source: “Assume Autonomy: When AI attacks outrun human defenses,” Rik Ferguson, SecurityInfoWatch, October 2026. securityinfowatch.com