Attacker Economics

AI dramatically lowers the cost and skill threshold for executing known attack patterns — including the Lucky 13 defect classes (see UV-01). Automated scanning, custom phishing at scale, AI-generated exploit code: the defects being exploited are decades old, but the attacker's cost has collapsed.

Cheaper defect finding helps manufacturers and attackers alike (see E-08). But defenders must fix every instance; an attacker needs one. Speed cannot close that gap. Eliminating the defect classes raises attacker cost permanently; patching only keeps pace.

Discussion prompts

• How has your threat model changed with the availability of AI-powered attack tools?
• If AI halves what it costs an attacker to find defects in your product, where do they spend the savings: more targets, or deeper into yours?
• What would closing the attack/defense asymmetry actually require, and who is accountable for that decision?