In a sponsored Industry Voices conversation on N2K CyberWire, host Dave Bittner sat down with Trinity Cyber founder and CEO Steve Ryan to talk about what it will take to survive first contact with a frontier AI-enabled cyber threat. His answer is not more tools, more logs or faster alerts. It is a different approach.
The ecosystem we have is already broken
Ryan starts from an uncomfortable premise: the way we defend ourselves today is flawed before AI ever enters the picture. It is a detect-and-respond ecosystem, which means it always acts after the fact. Something has to happen first, and then we respond to it.
We don't do that in any other domain. We don't wait for something to happen. It's like that commercial of the security guard in the bank. The bank's being robbed and the guard’s response is hey, I can't do anything about it. I can just pull the alarm.
Steve Ryan
The indicators that ecosystem runs on have the same problem. The lists of bad hashes, nasty URLs and IP addresses to block exist because someone has already been a victim. We know a file is bad because Mary downloaded it and the forensics came back. Multiply that across the industry and you get the SOC funnel every director describes on a tour: trillions of events a day, reduced to billions, then millions, then thousands, until there are a few hundred a team can actually get through.
That is today, before the threat accelerates.
Seven years to seven hours
Ryan points to two watershed vulnerabilities: Heartbleed in 2014 and Log4Shell in 2021. Seven years apart, and years after Heartbleed half the servers still weren't patched. Now compress that gap. Seven months. Seven days. Seven hours. An AI-enabled adversary means more threats, more variations of each threat, more indicators from every variation, more tickets, more logs, more storage, more SIEM.
More isn't better here. Surviving first contact to me is not more of all of this, but a different approach.
Steve Ryan
The different approach is to focus on the threat itself rather than its manifestations, and to take it out of the delivery mechanism, the network, before anything happens.
One condition, infinite variants
To show what "the threat itself" means, Ryan takes apart the Microsoft Equation Editor vulnerability. Anywhere an Office document uses an equation, somewhere in its data is the name of the font that equation used. Getting to it means interpreting multiple nested file systems inside the document and finding the one object that defines the equation. In that object the name has to fit a 40-byte buffer, terminated by a null character. The vulnerability is the absence of that null: fill all 40 bytes and everything on the other side becomes executable content.
That one condition can appear in an infinite number of documents, and the payload behind it can be an infinite number of things. The traditional path tries to chase every one of them with indicators: every hash, every variant, every delivery location, every sender. It doesn't scale, and once AI is altering the content every minute, every second, every millisecond, you will never keep up.
There's a single condition that can result in an infinite number of variations, but it's one condition. When you talk about machine-to-machine, you've got to get parity between the machines. The defending machine has to be able to find that condition. It sounds easy, but that is the only way that we scale to the AI threat.
Steve Ryan
Ryan credits David Bianco's Pyramid of Pain for the framing. At the bottom sit IP addresses, domains and hashes, the things that change in a nanosecond. At the tip sit tactics and techniques, the way a threat is actually manifest. The way to survive is to live at the top of the pyramid.
Find it in the network, and rip it out
Finding the condition is only part one. Feeding what you find into a detection-and-response pipeline is still too late, and in a post-AI world too late means done. Part two is doing something about it in the network, as it occurs: rip it out, change the condition.
Asked about the explosion of CVEs, with Patch Tuesday releases pushing toward a thousand, Ryan says the answer is the same. Models already exist that can reverse-engineer a patch to find the vulnerability and build an exploit. The same kind of model can build the detection and remediation syntax for a system that looks for the threat and removes it. While attackers generate exploits, defenders generate what he calls an active countermeasure, aimed at the threat rather than its variations. The result is a form of virtual patching, but it reaches beyond servers to the human side as well: the lure, the link, the fake CAPTCHA that drops a second-stage downloader. Phishing PDFs arrive different every time, so you cannot hash them. You have to look inside them for the code.
A security layer in the internet
Ryan's second argument is about where that technology should live. Good vendors and good tools exist, so why are there so many breaches, and why do some organizations get breached more than others?
Why would we expect the mom-and-pop electric co-op in rural Pennsylvania to have a team that could go toe-to-toe with a Nation-state adversary?
Steve Ryan
He recalls the 2014 Target breach: 46 million card numbers lost almost overnight, and the attackers didn't go after Target. They went after its HVAC vendor, a small shop, and rode the VPN in. Bittner offers the analogy of a nation's military or a town's police force, things we build for the common good. Ryan agrees that is the only way. The alternative is every organization for itself, whoever can afford the best kit and the people to run it.
Every threat, however fast it is derived, has to be delivered through a network, and the internet has natural choke points where traffic can be fully examined. Ryan compares it to airport security: the screening point doesn't try to secure every aircraft, it examines the people, finds what is dangerous, removes it, puts the bag back together and sends the traveler on their way. The difference online is that it has to happen live, deep enough to find the malicious piece and fast enough that nobody feels it.
It works today
Asked whether the technology exists, Ryan says Trinity Cyber does this now. The platform examines on the order of 480 billion network transactions a day. Every transaction is stopped, exploded into its parts, with thousands of fields of content extracted and checked, threats removed or neutralized, and the whole thing reassembled and sent on, at less than a millisecond of latency. Those content objects total about two trillion a day.
One bad guy can take that one vulnerability and spray out 10,000 variants of the same thing to 10,000 endpoints. To everybody else, that's 10,000 problems they have to track down. For us, that's one thing. It happens 10,000 times, but it's one thing.
Steve Ryan
For the user, the experience is invisible. The page loads, the document opens, the malicious JavaScript or the booby-trapped equation object simply isn't there anymore. The security team gets the event and the telemetry, with a note that it has already been taken care of. Accuracy improves with scale: in Trinity Cyber's early days the platform ran at about a 2% false positive rate, respectable against firewalls and IPS tools in the 30% range. When a very large customer brought tens of gigabits of traffic, the team braced for it to get worse. It got better, and today the rate is a decimal point followed by a string of zeros.
A different way of doing things
Ryan's message to listeners is a change of mindset. He is skeptical of vendors promising to fight AI with AI, if all that means is an NDR that tells you about the breach in ten minutes instead of an hour. That is still too late.
We need a different way of doing things. That's the bottom line. It has to be something that anything we care about goes through and gets cleaned of something that would be malicious. Bad guys trying to do X, we're going to make sure that doesn't happen. And users, operators, businesses don't even notice.
Steve Ryan
