Alex Stamos: AI is flattening the skill ladder the security industry assumed

Security expert Alex Stamos argued on The Verge's Decoder that AI is flattening the skill ladder on which the multibillion-dollar security industry was built. Script kiddies, amateurs who run other people's hacking tools, now have a bunch of the skills once held by a few elite experts, he said. In his view, the industry's old assumptions no longer hold.

What was said

Stamos said the last era began with Microsoft's trustworthy computing memo in the early 2000s. Companies hired former hackers, and an industry grew around bug bounties and consulting firms. It rested on a hierarchy, he said. Script kiddies sat at the bottom, then tool writers, then vulnerability researchers, then a top tier of elites he put in the hundreds.

Attack teams copied that shape, he said: a small group of elite researchers and a larger, less skilled group running operations. AI breaks it. With a Mac on his desk, Stamos said, he can take apart a Microsoft patch and write working attack code. It is not yet automatic and still takes skill, he added, but it is close.

He gave a small-company example. A medical and dental supplier he once worked for was hit by Russian ransomware, and dental offices across the country cancelled appointments. A dozen IT staff were badly outmatched by a twenty-person criminal team. Now, he said, two or three people with many machines can run agents all day. His summary of the economics: "The cost per token for attackers is going towards zero." A token is the unit AI services charge by. He said defenders' costs are not falling the same way.

Why it matters

Our reading: if the ladder no longer sorts attackers by skill, hiring and training built around it need a second look. Stamos said companies were never actually secure, in his words: "We were never secure." Attackers can now work at larger scale against weaknesses that were always there. We infer that the scarce skill may shift toward judgement, meaning deciding which findings are real and which risks matter most. Stamos did not say that. For managers, it suggests asking who on the team can rank problems and decide what to fix first.

The other side

Stamos did not say the shift is complete. He said full automation is not there yet and that skill is still needed. He also rejected the idea of leaving defence entirely to unsupervised bots. He called the coming period a dark age, though the show notes say he is not a doomer in the long run.

The excerpts leave open how defenders will get cheaper options. Stamos said making attacks costly will be extremely hard, so defence costs must fall. We have no detail on how. The skills claim also rests on one expert's view, not on measured data.