A podcast guest expects AI-found flaws to take most team time for 18 months

A speaker on the No Priors podcast said they expect most of a team's time to go to security for about 18 months, as AI finds flaws faster. The episode, recorded live at Cloudflare Connect, is billed as a talk with Cloudflare's chief technology officer.

What was said

The speaker said serious internet-wide flaws once set off an all-hands response at Cloudflare about once a year. Now, they said, such events happen weekly. Not all are made public, and some are as serious as log4j, a flaw in widely used code.

Their reason was that AI never tires. A red team, meaning people who attack their own systems to find weaknesses, used to be one engineer. As an example, they described a key meant to protect web connections that was reportedly built from the single number four, which makes it easy to reverse engineer.

On timing, the speaker said: "I expect that through the rest of this year and in the next year, by the next 18 months, majority of teams time is going to be spent on security." They recalled a keynote figure of over 50% of engineering time, but were not certain of it. They expect the shift to be brief. In their view, AI will eventually have scanned most code and found most bugs, so productivity should climb back.

The speaker conceded that other priorities, such as trimming costs, might give way. They ruled out a freeze: "if you're not shipping, you're dying."

Why it matters

Our reading: AI-found flaws land first in engineering time, not in a breach. A team that must patch what it already shipped has fewer hours for new work, even if nobody calls it a freeze. The speaker described the job as partly catching up on decades of old software. Managers planning roadmaps for the next 18 months may want to allow for that.

A question put to the speaker asked about people who cannot afford red teams or never had one. The answer was to put sites and infrastructure behind Cloudflare. The speaker said that when major flaws appear, such as the React one last year, protection goes to every customer, not only paying ones.

The other side

The speaker is tied to a company that sells that answer, so it is a vendor's view. Nothing in the excerpts shows that small teams carry a heavier load, or measures how they are coping.

Fewer features is an inference, not something the speaker said. They pushed back on it: teams must do both, and AI may help them do both faster. They also called the surge temporary, and the 50% figure was half-remembered.

One worry was left open. The speaker said that keeping cyber-capable AI models closed would leave out many people who need them. Who gets those tools first, and who pays while waiting, was not settled.