back to reflections

Always-On Red Teams

Serious red teaming was expensive, scarce, and booked months ahead. Autonomous agents that hammer your systems around the clock change that, and the capability that belonged to a few is now cheap enough for everyone, attackers included.
Petko D. Petkovon a break from CISO duties, building cbk.ai

Security has always been a game of time and attention. A red team only finds what it has the hours to look for, and serious red teaming costs enough that only the largest companies could afford it. Even they had to book it months ahead, because the good people are few and cannot be in two places at once.

Picture an agent whose only job is to get into your systems. It runs around the clock, never gets bored, never gets tired, working every angle it can reach to find the gap. Now picture a hundred of them. One sitting outside with nothing but public information. One already inside with a foothold. One fixed on a single target system and ignoring everything else. All running at the same time, all patient in a way no human team can be.

This capability was rare. None of that holds anymore.

It is now perfectly feasible to keep an AI hacking agent running against your own surface all the time. It will not match the very best humans in the world, and it does not have to. It is cheap to run and cheap to deploy, and it covers the ground that nobody had the hours to cover before.

We built one. Rook is a standalone autonomous security agent for bug hunting, vulnerability research and source-code auditing. A single binary that you hand a target and a scope, and it works the problem the way a researcher would, through recon, analysis, verification, and a written report. We built it for ourselves first, the same way we build everything.

This cuts both ways. If you can run a hundred agents against your own systems, so can someone who was never invited. The defenders who come out ahead will be the ones who get there first and keep their own agents running, because the other side certainly will.