Chris Hughes, VP of Security Strategy at Zenity and founder of Resilient Cyber, argues that security's risk-averse culture now creates more risk than it mitigates. Drawing on roles across the Air Force, GSA's FedRAMP team, the Navy, and CISA, he shows how security teams have arrived late to every technology wave and how AI raises the stakes on both sides. AI agents now open millions of pull requests a month with flaws inherited from open source, time-to-exploit has fallen from days to minutes, and an exploit can cost about a dollar to build. He covers the frameworks already available, the GRC impedance mismatch between machine-speed systems and industrial-era assessments, and why authorization has to be validated as fast as code deploys. He closes with a call for security teams to put AI to work themselves.

Thank you. Hello. Hello. As you said, my name is Chris Hughes. A bit of background before I dive in with you all. I've been in the cybersecurity space about 20 years. I started off in the US Air Force and then a government civilian with a couple different agencies like GSA on the FedRAMP team, Navy doing DevSecOps and cloud security. I started a services company for a few years, so I've been on that side of things as well, working with agency customers. And now I'm in the private sector working on AI and agentic AI security on the product front. I've also spent some time at CISA as a cyber innovation fellow and have written a few books on cyber. And a lot of that time has been spent in the public sector. So I've lived a lot of these problems and pain points firsthand. And I want to talk about what I call the dual use imperative of AI and some of the behavior in cybersecurity, particularly in the public sector. And for a lot of different reasons, you all heard it here from the folks before me around procurement and cultural inertia and things like that that impede adoption of technology. So I'll be diving into a lot of those things and I want to talk about why security has to move at the speed of the software protects and ultimately what that impedes when we don't. So here's what I call our cultural fatal Anyone ever heard of crossing the chasm? It's not really a cybersecurity thing per se, but it's showing the life cycle of technology adoption. And when it comes to cybersecurity, and especially just the public sector in general, but especially cybersecurity in the public sector, we're almost always a laggard and a late adopter. You've heard phrases like bolting security on or security being the office of no, things like that. And we always think about what can go wrong.

We're risk averse by nature. It's literally our job is to think about what could go wrong, what could break, what can be breached or hacked or impacted. And this actually creates much more risk than it mitigates because every time, every technological cycle throughout my career, cloud, mobile, SaaS, DevOps, DevSecOps, whatever buzzwords you want to use, security is always late. We show up after the business has already adopted and move out, developers, engineers, and of course our adversaries as well. They have no procurement cycles, they have no governance review boards. They are using this technology and AI is happening faster than any previous wave before it. And you might have heard phrases like secure by design that CISA and others started championing in the last couple of years, honestly, last four or five years under Jen Easterly and other folks like that. That phrase actually literally dates back to 1970. So 50 plus years ago. And in the last few years we talk about it's some novel new concept. This is amazing. We should build security in. We should make things secure by design. But it's 50 years old. We've been saying that for 50 plus years. And we keep doing the same thing, expecting a different result. And it's actually creating more risk because when we try to be the office of no, when we try to block, when we try to mitigate, when we try to slow down or create friction, we create shadow usage. People are using the technology, we just don't know about it. People are already moving out and on these initiatives, they just don't want to talk to us. They avoid us, they work around us. They consider us a problem, a pain in the *** really to deal with. And they don't want to collaborate with us.

DevSecOps was supposed to break down silos, but all we've done is bolster those silos with our behavior. And we risk doing that again with AI, particularly in the public sector again, where procurement, other things play a part beyond just the technology itself. So I want to talk to you all about two things here. One is going to be the offensive side of AI and what its impact is on software and cybersecurity. And then the other side of this is going to be the defensive side, the opportunity of what AI presents us as an opportunity to mitigate risk as well. This is what I call the attack surface exponential. So at the end of 2025, GitHub, which everyone's familiar with, the largest source code management system in the world, they finished the year with one billion commits and the COO took to X and Twitter and celebrated that. There was a press release. We hit a billion commits in a year. It's amazing. It's incredible. But by April of this year, he went to X again and said we're on pace to have 14 billion commits. So a 14X increase in literally just one year is the run rate that they're on in terms of software development, velocity and volume. And that's largely being driven by coding agents, agenta coding agents, Claude Code, Cursor, Cline, all the things that we hear about that are used for coding. We probably use them ourselves. I know I use them a lot myself. So it's creating this massive volume of attack surface. Anyone can create anything now. We've kind of democratized development as we say. The problem is we really haven't democratized security in that process. So 14 billion commits, we have 150 million developers globally and that number's growing with platforms like Replit and Lovable and what they call citizen developers where anyone can code now.

You just use natural language and you can produce software. It's incredible, but it's also scary. It's like anyone could build a house. I would not necessarily want to live in it. And then AI agents are leading to 17 million pull requests a month. So this number is spiking. It's literally going vertical. And that's just GitHub in terms of their repositories. It's not GitLab, it's not Bitbucket, it's not the number of private repositories that we don't have visibility into in the public sector that are self-hosted and things like that. And user adoption of these AI coding agents is going vertical as well. 80% of new GitHub developers, for example, are using copilots or AI coding tools within the first weeks of touching the platform basically. So the adoption is very rapid. And then we have what's called vibe coding, this thing where anyone can create anything.

Anyone can code, anyone can develop. And it sounds incredible, but there's a problem with it. Beside the volume aspect of it, the research, whether it's from academia, whether it's from application security vendors, researchers, things like that, you can see just some of the metrics here, exponentially more vulnerabilities in AI generated code. And some of that's due to the developers using it. They implicitly trust the output. The more you use it, the more you start to feel comfortable, you start to trust what it's giving you. You don't really run the security scans on it, you don't have the same kind of level of rigor. You're incentivized to move fast. How many developers have you met who their annual review, their raise, their promotion, their accolades from their peers is based on how many security findings they mitigated? Never. You get what you incentivize. Incentives drive behavior as people have said throughout the day here today.

There's other aspects of this too, is these AI coding tools, these LLMs, they're trained on vast amounts of open source software and that open source software has flaws, has vulnerabilities, has misconfigurations and things that it essentially perpetuates as it creates code for folks. So it's a combination of technical issues as well as behaviors and incentives that are creating this problem. So you can see some of the metrics in terms of just the number of vulnerabilities, number of secrets, numbers of misconfigurations or flaws and so on that are kind of being pushed downstream via vibe coding. And while this is all happening, we already struggled to inject security into DevSecOps or CICD or some of the things that we've talked about, these trends that happen in cybersecurity. And now we have vibe coding, now we have AI generated code, agentic SDLCs, et cetera. And security is just trying to cling on for life. And then we have these two lines that are starting to cross one another. You may have seen this phrase, the Vulnpocalypse. I've been using it a lot. It's honestly even been picked up by CNN, MSNBC, Fox, et cetera. So cybersecurity has kind of went mainstream, which is cool, which is exciting for me being in that field. It's something that historically only my wife would hear me talk about. She's like, "I have no idea what the hell you're talking about, what any of that is." But now we're talking about critical infrastructure, schools, educational institutions, water facilities, things like that, and how cybersecurity and AI are going to impact those things that we develop and depend on as a society. So these two lines right here, you may not be familiar with the acronym CVE, but it just means vulnerabilities in a public database that we depend on, something called the NVD, the NIST National Vulnerability Database. We're on track to have 59,000 to 100,000 potentially new vulnerabilities just this year. And I can tell you that's like a double digit exponential growth over the last year. And that doesn't sound impressive until you think of that. We already have vulnerability backlogs in the thousands, the hundreds of thousands, even the millions I've seen in large organizations. And so while that line is going vertical in terms of the number of vulnerabilities and code and applications and software and things that run our critical infrastructure, our weapon systems, the time to exploitation is actually collapsing at the same time. So you can see the figures in the right here. In 2018, it was 771 days to exploit a vulnerability over two years roughly or so. So we had time. We could patch, we could mitigate, we could implement compensating controls. We had time to batten down the hatches or whatever phrase you want to use.

By 2023, it was down to six days. You had less than a week. Now in 2024 it was hours. Now it's minutes. So things are being exploited as you see in the bottom right there, being exploited before there's even a public vulnerability associated with it. So these are essentially zero days. You run your scanners on your code, your cloud infrastructure, whatever. It won't even pick it up because it's not even recognized yet. And that vulnerability growth is impacting things like the databases we depend on for vulnerabilities, the scanning tools we use. So you're kind of flying blind to this at the time that the exploitation is taking off, it's going vertical. Let's talk about the economics of this because it's not just a technical thing. There's an economic aspects. You probably hear in the broader AI conversation phrases like tokenomics or things like that, token maxing or those kind of phrases where there's an economic aspect of cybersecurity both for the offensive entities and the defenders alike.

Right now in 2026, you can develop exploits for literally a dollar or even cents on the dollar and you can also do it in 10 to 15 minutes. So just today on the flight here, I arrived today. Bill Gates had put out a letter, a blog that you should all go read. He's talking about the turbulent AI era and he talks about economics and education and child development and all these things, but he talks about cybersecurity as well. And he says that we're essentially entering this era where the ability to hack anyone at any scale is not going to be reserved for just China or North Korea or Russia or whatever, Iran, whomever, right nation states. It's going to be available to anyone, essentially anyone. And we're seeing this. Not only are there tools like Fable five and Mythos and GPT 5.6 and these proprietary frontier models, these closed models, there's GLM 5.2 and all these Kimi K2 and all these Chinese models.

They're available. You can download it, run it on your local laptop. So this capability is being commoditized. It's going to be available to anyone anywhere and they can essentially say, "Hey, go hack X, Y, Z." They don't need to be an expert in this domain. So we have these massive vulnerability backlogs. Anyone who's worked in security knows you try to come up to the team and tell them to fix things. They say, "Not this sprint, not this quarter, not this release, but we will get to it soon. It'll go on the backlog and the backlog keeps growing like the national debt is just kind of exponential." And that's getting worse and worse. And now these capabilities to hack all this low hanging fruit, this security technical debt that we've avoided for years and/or decades, that can be hacked by anyone anywhere now as these capabilities become commoditized.

And it is being used by nation states as well. Here I have a slide talking about the AI espionage escalation. This one here is from Anthropic, but then there's been other examples of the Mexican government showing examples where people are attacking them with AI, several other examples, and they're starting to use autonomous exploitation. So 80 to 90% of the attack is just being done by AI agents, not even a human in the loop, not even someone at the keyboard per se. And they're bypassing guardrails, identifying targets, harvesting credentials, stealing sensitive data, all with the use of AI and automation. And that's again, coming to everyone soon. Anyone can use it, anyone can start to use this technology and it's going to be problematic. And at the same time, we have the introduction of things like LLMs or AI agents or agentic AI, as people might say.

And I've been involved with these groups. OWASP is a popular one that makes guidance and recommendations on how to secure technology and things like that. They've produced the LLM top 10 or agentic AI top 10, these kind of best practices. And you can see, I don't want to walk through all these different techniques, but you can see that LLMs introduce new attack surfaces, new attack vectors, new risks to consider. Agents introduce, again, new problems, new vulnerabilities, things like that, but they also amplify old issues. We've always had concepts, again, going back decades, things like least permissive access control or phrases that you'll say. And we sucked at it on-prem, we sucked at it in the cloud, we sucked at it in SaaS, and we are probably going to do terrible with it with agents. And now agents are going to go around and they need to have their own identities.

We need to secure those identities. We need to know what agents are doing with what permissions, et cetera. It's going to be a real problem. It's going to be a real challenge. And there's people tackling it from the technical side, from the organizational process and policy side. But these are things we need to be thinking about is how do we secure this technology while also trying to make use of it ourself, which I'll talk about in the second half of my talk here is how do we leverage this capability as well? And I think last thing I'll say, actually, I want to go back to this is we've got all these best practices, all these recommendations, all this guidance, but we're best practice rich and implementation poor. There's stacks of documents on what you should do and how you should do it and why you should do it.

The problem is we're not doing any of it. We have all these best practices, but we're not really adhering to them or following them or utilizing them. And then there's starting to be a bit of a policy tailwind that this is a bit of a good thing. I had written a book on vulnerability management a few years ago and I feel like the federal government, this space, again, that moves slow. It tends to be a laggard. It tends to take longer to adopt emerging trends and methodologies. We are seeing glimmers of hope. I talked about that projection of 60,000 CVEs or 100,000 vulnerabilities this year. The problem is among those 60,000 or 100,000 of vulnerabilities, only one to 2% of them are ever exploited in a given year. But the problem is which ones do we fix? Which ones do we address? And historically we've just kind of used things like CVSS, and I don't want to throw acronyms at you all.

I know that you all sat through some sessions on FARS and DFARS and you probably felt like I did. So I'm not going to use cyber acronyms on you guys, but there's different things that we can do to kind of prioritize vulnerabilities. Look at things like CISA's known exploited vulnerability catalog. Is it actively exploited? Do we know it's exploited in the wild? Is it highly likely to be exploited? Is it reachable? Is it reachable based on my architecture, based on the source code, based on the functions that get called? Do I have compensating controls in place? Is it a critical system? Does it have sensitive data? These levels of discernment help us prioritize, but as you can see, we have many systems, many containers, many applications. Trying to discern that across that entire kind of digital estate is problematic. It's challenging to say the least, especially when you consider workforce constraints and contracting and all the other things that come along with that.

I also want to talk about GRC impedance mismatches, I call it, governance, risk and compliance, which everyone loves that in government. Everyone loves it in cybersecurity. We love compliance. And you guys are going to hear about that next with a panel. And I've always looked at this and how we do compliance in the government, which is really, it defines how we do security. It's not compliance. It's really how we do security in the government. And it's really like we're doing performative arts or security theater. We're not doing cybersecurity per se. We have snapshot and time assessments. We have ATO cycles that are run on a three-year cycle. You reassess it every year. I have five kids. I can tell you if I check one of their rooms and then I check again in 30 days or 90 days or a year, it's no indication of what the room looked like at that time.That's how cybersecurity is.

Things are changing way too fast. We have containers that live for a minute or less. We have AI agents coming on the scene, sub-agents, dynamic ephemeral workloads. So the systems are moving at machine speed, but we're still assessing these things like we're living in the industrial era, the analog era, I should say. I feel like we're using a rotary telephone in some ways. So we need to have machine speed scale assessments of these systems to match the way the workloads work, how long they live, how often and frequently the systems change. And this is kind of where we need to go with this. And I'm going to talk about a little bit about that as well. I know teams are doing work in this space, innovative work. You may have heard phrases like continuous ATO or GRC engineering. And I'm really excited for the next panel that you guys are going to hear from because they're going to talk about some of these concepts and how you implement them, like lessons learned.

And I can tell you, I've done these in large federal civilian agencies. I've done these in Department of War systems. I've done it in the commercial sector. Again, it's that people process technology paradigm, and it's most often not a technology problem. It's a people process problem, especially in our space. Something I want to talk about here, I ran a services company. Our industry largely runs on services company, government contracts, billable hours. If I automate someone's revenue away, that's a problem. That's going to lead to political infighting and knife wielding and power struggles internally and dynamics between primes and subs and different business units in the agencies and things like that. But the reality is we can't risk the security of our critical infrastructure, our civilian agencies, our national security systems based on the revenue of government defense contractors and things like that. It needs to be tied to securing the institutions and the systems that we rely on.

So if code deploys in seconds, that authorization must be validated in seconds as well. So that means using modern GRC systems, that means using infrastructure as code, compliance as code. It means leveraging APIs to assess these systems, not manual assessors who come in and do screenshots and system sampling and spreadsheets and POAMs and Excel. That's literally not going to cut it. It didn't cut it in cloud mobile SaaS. It's not going to cut it in AI and agentic AI. And I wanted to give some proof points on the defensive side because as much as I just walked through how bad things are in some ways, we have a lot of reasons to be optimistic as well. This technology is a force multiplier for the attackers, for the development teams, for the engineers, and for us in security. Every team I've ever been at, any agency I've ever worked at, any commercial organization, we've never said, "You know what? We have too many people in security. Our team is just too big. We're always outnumbered. We always are kind of playing catch up." So this technology offers some incredible capabilities as well. I wanted to give a shout out to DARPA. They've been running some efforts here around autonomous finding vulnerabilities. You can see that they found millions of line of code being assessed in incredible automated ways, finding real world zero days. You all probably are familiar with Anthropic, right? It's hard not to know who they are. They have an initiative called Project Glasswing. They found tens of thousands of vulnerabilities, literally just like in a 30 to 60 day window over the summer in critical open source software that's used by everyone everywhere, including in national security systems. And they're able to use this technology to find these vulnerabilities, to produce patches, make recommendations upstream to the maintainers and things like that.

So we need to be turning this technology internally. Again, to my comment about being a laggard and a late adopter, how can we leverage this technology to our benefit? We have to. We know what the business is. We know the attackers are. How can we be using it as well internally? There's also teams like Google who have been doing this to find many, many bugs. Again, Anthropic, OpenAI has patched the planet. All these initiatives coming out that are really exciting of leveraging this technology to find vulnerabilities. I'm excited about that, but finding vulnerabilities hasn't necessarily been the problem. As like I said, organizations before AI were already sitting on massive vulnerability backlogs, it's fixing them, that's the problem. So we have to get through that organizational inertia of getting it prioritized, getting it put ahead of speed to market and revenue and feature releases. And that's challenging. That's incredibly challenging. There's also teams like Expo and many others in that category who are using AI to pen test. You've heard penetration testing. So turning this technology in your system to find vulnerabilities, misconfigurations, attack pass, exploitation opportunities before the attackers do. But again, that means us being an early adopter. It means us being a user of the technology and turning it on our own systems before attackers turn it on us. There's also a lot of hope around using AI to do patching and things like that. I've been incredibly optimistic about this, but the numbers, like same with vibe coding, how introduce vulnerable code, things like that, the numbers are mixed. Some research just came out last month by a team that look at thousands of AI generated patches. And the problem is over half of the time, it either didn't fix the vulnerability or it fixed the vulnerability introducing new vulnerabilities at the same time, or it didn't fix it and introduce new vulnerabilities in the process.

So it's like we have reason to be optimistic. The capability is there, the promise, the premise is there, but it's not where we need it to be yet. So it's a work in progress as is anything in technology. As I say in security, it's not a product, it's a process. It's not something you buy, it's something you do. You use tools, you use the technology as a part of that process, but it's not a panacea. We also run the risk of what I call cognitive surrender. As I talked about with the patches, often these things can fix something but introduce new issues or they may fix the vulnerability, but they don't address the root cause. And I was talking to some folks backstage a little bit earlier in the day here about things like auto approval or you'll hear phrases like human in a loop.

You got to have a human in a loop with AI. The challenge is these systems are making hundreds or thousands of decisions at machine speed. And how many times have we used Claude or OpenAI's tools and other tools and you just click approve, approve, approve because you're tired of looking at their approval request. And I'll tell you, even in security, I'm not reading all of those things. So I know people outside of security are definitely not reading those things all the time. So we run the risk of cognitive surrender, just kind of giving into the tool. The tool knows what to do, right? It will address the thing I'm asking it for. But as we're seeing, that's not always the case. It often introduced new problems. So we run the risk of kind of falling asleep at the wheel, if you'd say. So I want to close with this. As I said, AI is dual use. It offers opportunities to attackers. It offers opportunities to the business, our peers and other areas of technology and in us in cybersecurity. So it's dual use by nature and that makes it both a good thing and a bad thing. It's an attack surface and a capability. So it's a good and bad. And we need to move at the speed of relevance. I think this is like an existential requirement, not just something that feels good to say, it's like a moral imperative. We run the risk of perpetuating that bolted on, not built in aspect of cybersecurity. If we're not an early adopter, an innovator with this technology, we're not showing up with the mission owners and so on saying, "Yes, we can do this and here's how, and here's how we do it securely." So security must be invested as a collaborator with engineering and security must move from being kind of this paper-based static out practice that we do to being an engineering discipline in how we approach this and with our mission owner peers, our business peers and things like that. And again, the last thing I'll say and close with is our risk averse, reflexive nature and cybersecurity is literally the biggest vulnerability and risk that we face. We risk, again, running that cycle of being late to the conversation, being blocked out by our peers, them avoiding us, not wanting to collaborate with us, viewing us as a pain. So we need to lean in and get our hands dirty with this technology. Thank you.

‍