The Security Democratization Gap

Chris Hughes is the founder of Resilient Cyber, a newsletter read by tens of thousands of security professionals every week. He's a three-time author, a Cyber Innovation Fellow at CISA, and has spent time inside FedRAMP and the DoD — so he's seen both what regulation does well and how it fails. He's also run a company himself, which reshaped how he thinks about where cyber risk actually ranks against payroll, contracts, and revenue. He works across the industry groups trying to get ahead of AI security — Cloud Security Alliance, OWASP, Coalition for Secure AI — and he was writing about exploitability and reachability years before "volnapocalypse" became a conference keyword. This conversation is about the gap he keeps circling: we democratized software development, and we never democratized security to match.

The numbers frame the whole episode. CVE volume is projected to hit 66,000 in 2026, yet only 1–2% of CVEs are ever exploited. GitHub jumped from one billion commits to a pace of 14 billion in a single year, driven by agentic coding. Research from about a year ago found 40–60% of LLM-generated code contained easy-to-identify structural vulnerabilities — roughly matching the vulnerability rate of the open source corpus the models trained on. And of the patches agentic remediation systems produce, only 17% qualify as real, resilient fixes. Chris walks from that data through what it demands: risk conversations boards actually have to answer, agent inventory before agent governance, and AI policy written by people who understand the systems they're regulating. If you own a vulnerability backlog, an AppSec program, or an AI governance mandate that nobody can define, this one is aimed at you.

RISC Point is security & compliance consulting tailored to your business. Talk to RISC Point.

Hampton North is the premier US based cybersecurity search firm. Start building your security team with Hampton North.

Sysdig is the leader in AI-powered real-time cloud defense; stop watching and start defending.

We opened with the number everyone's quoting: 66,000 CVEs projected for 2026, up 46% from a year we didn't exactly handle well. Chris had Jerry Gamblin — who helped write that projection for FIRST — on his own show, and the nuance matters: the volume is surging, but exploitation isn't.

The uncomfortable part is that none of this is new. As Chris put it, "Vulnerability backlogs were already massive before AI. Hundreds of thousands or millions in large enterprise organizations." What AI changed is that years of deferred work — every "not this sprint" pushed to the backlog — is now being found by machines. And Chris is blunt about what comes next: autonomous exploitation. Agents that don't just find the flaws but exploit them. There's an arms race forming between automated exploitation and automated remediation, and neither side has nailed it — but one will get there first.

The prescription isn't exotic. Known exploitation, reachability in both static and runtime context, asset criticality, internet exposure, data sensitivity. Chris has read the guidance coming out of the CISO summits Cloud Security Alliance ran across New York, San Francisco, and London, looking for something novel — and found the same list we've had for years. The problem was never knowing what to do. It was the business case to do it. If nothing else, this moment supplies that.

Chris wrote a piece over a year ago called The Cybersecurity Delusion Problem, and running a company sharpened the argument: security people believe cyber risk is the most critical risk to the business, and it usually isn't. Payroll, contracts, and revenue come first, because without them there's no business left to secure. We've repeated "security is a business enabler" for a decade without operating that way.

Fix the highs and criticals — based on what? Generic severity criteria with no relationship to the business, the environment, or the architecture, handed to teams competing in a market with customers to serve. Chris's image for it is someone hurling piles over a fence: the workload becomes someone else's problem, the dashboard is clean, mission accomplished.

The cost of that behavior compounds. "That stuff actually creates shadow usage and governance gaps because they avoid us. They work around us. They don't want to engage us." The parenting analogy got a workout here — you want the kid who tells you what they're planning, not the one who calls from jail — but the point is operational: teams that trust security pull it in early. Teams that don't, route around it. Chris's verdict on the industry's track record: we've been "our own worst enemy in a lot of ways."

There's a second failure hiding in the same conversation. Businesses won't fix things, won't prioritize them — and won't formally own the decision either. "They won't fix the things, and they won't prioritize them, but they also won't explicitly accept the risk." They accept it implicitly, through behavior, which leaves the security leader holding a liability nobody signed for. Getting the business to state its actual risk tolerance would change more than any scanner upgrade.

This is the thread the episode is named for. Chris wrote about it as The Attack Surface Exponential, using GitHub as the yardstick: the platform celebrated a billion commits at the end of 2025, and months later "they went from a billion to 14 billion in one year" — driven almost entirely by agentic software development. People who are not developers are pushing code they can't read. Development got democratized. Security didn't.

The training data explains a lot of it. About a year ago, research found that "40 to 60% of the code it was generating had easy to identify, but structural vulnerabilities" — and the open source corpus those models trained on was vulnerable at roughly the same rate. Train on flawed code, generate flawed code. Harnesses and retraining have improved things at the margin, but the core principle stands.

The remediation side is just as immature. We walked back through prior guest Saad Ullah's DARPA AI Cyber Challenge work and the 1Password research from Keith Hoodlet's team: judged against four patch-quality criteria, only 43% of agentic patches genuinely fixed the issue without being bypassable, and only 17% were real, resilient patches. Some "fixes" just relocate files so the scanner stops complaining. Chris connects it back to something Bob Lord pushed during his time at CISA — are we addressing the underlying CWE, or are "we just fixing the same things and never fixing the root cause"? He also makes a case worth sitting with: some of these problems will be solved by people from outside security — developers, non-IT backgrounds — precisely because they aren't stuck in how we've always thought about it.

Chris has spent the past year deep in agentic security work across Cloud Security Alliance, OWASP, and Coalition for Secure AI, and the field's center of gravity just moved. The first wave of AI security was chatbot risk — hallucination, embarrassment, reputation. That framing dies the moment a system gets autonomy and tool access. The newest OWASP LLM Top 10 opens by saying it outright:

The evidence is no longer hypothetical. The Hugging Face incident went public, and then OpenAI and Anthropic each disclosed their own — three back-to-back, which tells you this was happening quietly before anyone was forced to talk about it. The UK's AI Security Institute ran evaluations on frontier models with internet access, and the results are the stuff of tabletop nightmares: "it went out, it actually socially engineered open-source maintainers, it created malicious packages, it like bypassed CAPTCHAs." Chris credits Hugging Face for handling its incident well — the team joined a Cloud Security Alliance call with over 500 CISOs and walked through the whole thing, including how the system behaved irrationally compared to a human attacker.

For the enterprise, Chris drags it back to the oldest control in the book: inventory. "Most organizations have really poor understanding of where agents are running in the enterprise" — on endpoints, in cloud, in SaaS, in home-grown builds — let alone what those agents can access and do. OWASP's Agentic AI Top 10 gives leaders a frame, and its own evolution is telling: the first iterations were built on practitioner intuition, and the latest state-of-agentic-security report has moved from "what could happen to what is happening," cataloging thousands of real incidents. Grim as that is, it's useful — you can now walk into a budget conversation with what happened to a named organization instead of a hypothetical. And it exposes the governance trap: visibility is the identify function of NIST CSF, nothing more. Knowing where your agents are isn't enforcing what they can talk to and which tools they can call.

Chris is candid about his priors: "I'm not a huge fan of regulation despite coming out of the public sector." But unfettered evals running wild on the internet, socially engineering real maintainers, isn't tenable either. His FedRAMP and DoD years taught him both failure modes. Self-assessment collapses — "as it turns out for the DoD like no one did it and it wasn't good and China did steal all the designs for our ships." Heavy compliance regimes fail the other way, becoming so costly they turn into a moat for the biggest players and push out smaller firms "who may have innovative solutions, but they can't bring them to market." There's active regulatory capture in play right now, with lobbyist armies working to box out anyone chasing the frontier.

His middle path: an evaluation framework for model releases — one is being previewed at the White House now as a voluntary effort — that assesses the whole system, not just the model. Harness, tool calls, behavior under cybersecurity and bioweapons contexts. More than a 200-page system card. And whatever gets built has to be iterative, because this technology moves faster than anything Chris has seen in his career, and it has to involve people who actually understand it:

Early draft legislation keyed thresholds to model parameter counts — a rule with no chance of surviving six months. Chris also names the risk on the other side: the UK set out to be a regulatory superpower, in its own words, and paid for it economically. Over-regulate and you hand the advantage to competitors abroad while this technology becomes critical infrastructure.

The episode closes on the part the industry keeps underweighting: the public isn't sold. Outside our bubble, people aren't excited about data centers and job automation — there are people wearing "AI free" t-shirts at the grocery store — and the frontier labs spent years talking in ways that made it worse. Chris's framing is the right one to end on: like social media, this technology can amplify the best or the worst of us, and the quality of governance we put on it — not the volume — decides which.