{"id":2348,"date":"2026-04-07T18:04:34","date_gmt":"2026-04-07T18:04:34","guid":{"rendered":"https:\/\/blog.ibvl.in\/index.php\/2026\/04\/07\/cybersecurity-in-the-age-of-instant-software\/"},"modified":"2026-04-07T18:04:34","modified_gmt":"2026-04-07T18:04:34","slug":"cybersecurity-in-the-age-of-instant-software","status":"publish","type":"post","link":"https:\/\/blog.ibvl.in\/index.php\/2026\/04\/07\/cybersecurity-in-the-age-of-instant-software\/","title":{"rendered":"Cybersecurity in the Age of Instant Software"},"content":{"rendered":"
\n

AI is rapidly changing how software is written, deployed, and used. Trends point to a future where AIs can write custom software quickly and easily: \u201cinstant software.\u201d Taken to an extreme, it might become easier for a user to have an AI write an application on demand\u2014a spreadsheet, for example\u2014and delete it when you\u2019re done using it than to buy one commercially. Future systems could include a mix: both traditional long-term software and ephemeral instant software that is constantly being written, deployed, modified, and deleted.<\/p>\n

AI is changing cybersecurity as well. In particular, AI systems are getting better at finding and patching vulnerabilities in code. This has implications for both attackers and defenders, depending on the ways this and related technologies improve.<\/p>\n

In this essay, I want to take an optimistic view of AI\u2019s progress, and to speculate what AI-dominated cybersecurity in an age of instant software might look like. There are a number of unknowns that will factor into how the arms race between attacker and defender might play out.<\/p>\n

How flaw discovery might work<\/h2>\n

On the attacker side, the ability of AIs to automatically find and exploit vulnerabilities has increased dramatically over the past few months. We are already seeing both government<\/a> and criminal<\/a> hackers using AI to attack systems. The exploitation part is critical here, because it gives an unsophisticated attacker capabilities far beyond their understanding. As AIs get better, expect more attackers to automate their attacks using AI. And as individuals and organizations can increasingly run powerful AI models locally, AI companies monitoring and disrupting<\/a> malicious AI use will become increasingly irrelevant.<\/p>\n

Expect open-source software, including open-source libraries incorporated in proprietary software, to be the most targeted, because vulnerabilities are easier to find in source code. Unknown No. 1 is how well AI vulnerability discovery tools will work against closed-source commercial software packages. I believe they will soon be good enough to find vulnerabilities just by analyzing a copy of a shipped product, without access to the source code. If that\u2019s true, commercial software will be vulnerable as well.<\/p>\n

Particularly vulnerable will be software in IoT devices: things like internet-connected cars, refrigerators, and security cameras. Also industrial IoT software in our internet-connected power grid, oil refineries and pipelines, chemical plants, and so on. IoT software tends to be of much lower quality, and industrial IoT software tends to be legacy.<\/p>\n

Instant software is differently vulnerable. It\u2019s not mass market. It\u2019s created for a particular person, organization, or network. The attacker generally won\u2019t have access to any code to analyze, which makes it less likely to be exploited by external attackers. If it\u2019s ephemeral, any vulnerabilities will have a short lifetime. But lots of instant software will live on networks for a long time. And if it gets uploaded to shared tool libraries, attackers will be able to download and analyze that code.<\/p>\n

All of this points to a future where AIs will become powerful tools of cyberattack, able to automatically find and exploit vulnerabilities in systems worldwide.<\/p>\n

Automating patch creation<\/h2>\n

But that\u2019s just half of the arms race. Defenders get to use AI, too. These same AI vulnerability-finding technologies are even more valuable for defense. When the defensive side finds an exploitable vulnerability, it can patch the code and deny it to attackers forever.<\/p>\n

How this works in practice depends on another related capability: the ability of AIs to patch vulnerable software, which is closely related to their ability to write secure code in the first place.<\/p>\n

AIs are not very good at this today; the instant software that AIs create is generally filled with vulnerabilities, both because AIs write insecure code and because the people vibe coding don\u2019t understand security. OpenClaw is a good example<\/a> of this.<\/p>\n

Unknown No. 2 is how much better AIs will get at writing secure code. The fact that they\u2019re trained on massive corpuses of poorly written and insecure code is a handicap, but they are getting better. If they can reliably write vulnerability-free code, it would be an enormous advantage for the defender. And AI-based vulnerability-finding makes it easier<\/a> for an AI to train on writing secure code.<\/p>\n

We can envision<\/a> a future where AI tools that find and patch vulnerabilities are part of the typical software development process. We can\u2019t say that the code would be vulnerability-free\u2014that\u2019s an impossible goal\u2014but it could be without any easily findable vulnerabilities. If the technology got really good, the code could become essentially vulnerability-free.<\/p>\n

Patching lags and legacy software<\/h2>\n

For new software\u2014both commercial and instant\u2014this future favors the defender. For commercial and conventional open-source software, it\u2019s not that simple. Right now, the world is filled with legacy software. Much of it\u2014like IoT device software\u2014has no dedicated security team to update it. Sometimes it is incapable of being patched. Just as it\u2019s harder for AIs to find vulnerabilities when they don\u2019t have access to the source code, it\u2019s harder for AIs to patch software when they are not embedded in the development process.<\/p>\n

I\u2019m not as confident that AI systems will be able to patch vulnerabilities as easily as they can find them, because patching often requires more holistic testing and understanding. That\u2019s Unknown No. 3: how quickly AIs will be able to create reliable software updates for the vulnerabilities they find, and how quickly customers can update their systems.<\/p>\n

Today, there is a time lag between when a vendor issues a patch and customers install that update. That time lag is even longer for large organizational software; the risk of an update breaking the underlying software system is just too great for organizations to roll out updates without testing them first. But if AI can help speed up that process, by writing patches faster and more reliably, and by testing them in some AI-generated twin environment, the advantage goes to the defender. If not, the attacker will still have a window to attack systems until a vulnerability is patched.<\/p>\n

Toward self-healing<\/h2>\n

In a truly optimistic future, we can imagine a self-healing network. AI agents continuously scan the ever-evolving corpus of commercial and custom AI-generated software for vulnerabilities, and automatically patch them on discovery.<\/p>\n

For that to work, software license agreements will need to change. Right now, software vendors control the cadence of security patches. Giving software purchasers this ability has implications about compatibility, the right to repair, and liability. Any solutions here are the realm of policy, not tech.<\/p>\n

If the defense can find, but can\u2019t reliably patch, flaws in legacy software, that\u2019s where attackers will focus their efforts. If that\u2019s the case, we can imagine a continuously evolving AI-powered intrusion detection, continuously scanning inputs and blocking malicious attacks before they get to vulnerable software. Not as transformative as automatically patching vulnerabilities in running code, but nevertheless valuable.<\/p>\n

The power of these defensive AI systems increases if they are able to coordinate with each other, and share vulnerabilities and updates. A discovery by one AI can quickly spread to everyone using the affected software. Again: Advantage defender.<\/p>\n

There are other variables to consider. The relative success of attackers and defenders also depends on how plentiful vulnerabilities are, how easy they are to find, whether AIs will be able to find the more subtle and obscure vulnerabilities, and how much coordination there is among different attackers. All this comprises Unknown No. 4.<\/p>\n

Vulnerability economics<\/h2>\n

Presumably, AIs will clean up the obvious stuff first, which means that any remaining vulnerabilities will be subtle. Finding them will take AI computing resources. In the optimistic scenario, defenders pool resources through information sharing, effectively amortizing the cost of defense. If information sharing doesn\u2019t work for some reason, defense becomes much more expensive, as individual defenders will need to do their own research. But instant software means much more diversity in code: an advantage to the defender.<\/p>\n

This needs to be balanced with the relative cost of attackers finding vulnerabilities. Attackers already have an inherent way to amortize the costs of finding a new vulnerability and create a new exploit. They can vulnerability hunt cross-platform, cross-vendor, and cross-system, and can use what they find to attack multiple targets simultaneously. Fixing a common vulnerability often requires cooperation among all the relevant platforms, vendors, and systems. Again, instant software is an advantage to the defender.<\/p>\n

But those hard-to-find vulnerabilities become more valuable. Attackers will attempt to do what the major intelligence agencies do today: find \u201cnobody but us<\/a>\u201d zero-day exploits. They will either use them slowly and sparingly to minimize detection or quickly and broadly to maximize profit before they\u2019re patched. Meanwhile, defenders will be both vulnerability hunting and intrusion detecting, with the goal of patching vulnerabilities before the attackers find them.<\/p>\n

We can even imagine a market for vulnerability sharing, where the defender who finds a vulnerability and creates a patch is compensated by everyone else in the information-sharing\/repair network. This might be a stretch, but maybe.<\/p>\n

Up the stack<\/h2>\n

Even in the most optimistic future, attackers aren\u2019t going to just give up. They will attack the non-software parts of the system, such as the users. Or they\u2019re going to look for loopholes<\/a> in the system: things that the system technically allows but were unintended and unanticipated by the designers\u2014whether human or AI\u2014and can be used by attackers to their advantage.<\/p>\n

What\u2019s left in this world are attacks that don\u2019t depend on finding and exploiting software vulnerabilities, like social engineering and credential stealing attacks. And we have already seen how AI-generated deepfakes make social engineering easier. But here, too, we can imagine defensive AI agents that monitor users\u2019 behaviors, watching for signs of attack. This is another AI use case, and one that I\u2019m not even sure how to think about in terms of the attacker\/defender arms race. But at least we\u2019re pushing attacks up the stack.<\/p>\n

Also, attackers will attempt to infiltrate and influence defensive AIs and the networks they use to communicate, poisoning their output and degrading their capabilities. AI systems are vulnerable to all sorts of manipulations, such as prompt injection, and it\u2019s unclear whether we will ever be able<\/a> to solve that. This is Unknown No. 5, and it\u2019s a biggie. There might always be a \u201ctrusting trust problem<\/a>.\u201d<\/p>\n

No future is guaranteed. We truly don\u2019t know whether these technologies will continue to improve and when they will plateau. But given the pace at which AI software development has improved in just the past few months, we need to start thinking about how cybersecurity works in this instant software world.<\/p>\n

This essay originally appeared in CSO<\/a>.<\/em><\/p>\n

EDITED TO ADD: Two<\/a> essays<\/a> published after I wrote this. Both are good illustrations of where we are re AI vulnerability discovery. Things are changing very fast.<\/p>\n<\/div>\n","protected":false},"excerpt":{"rendered":"

AI is rapidly changing how software is written, deployed, and used. Trends point to a future where AIs can write custom software quickly and easily: \u201cinstant software.\u201d Taken to an extreme, it might become easier for a user to have an AI write an application on demand\u2014a spreadsheet, for example\u2014and delete it when you\u2019re done […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"site-container-style":"default","site-container-layout":"default","site-sidebar-layout":"default","disable-article-header":"default","disable-site-header":"default","disable-site-footer":"default","disable-content-area-spacing":"default","footnotes":""},"categories":[4,974,90,210,459,53,242],"tags":[91],"class_list":["post-2348","post","type-post","status-publish","format-standard","hentry","category-ai","category-computer-security","category-cybersecurity","category-llm","category-patching","category-uncategorized","category-vulnerabilities","tag-cybersecurity"],"yoast_head":"\nCybersecurity in the Age of Instant Software - Imperative Business Ventures Limited<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/blog.ibvl.in\/index.php\/2026\/04\/07\/cybersecurity-in-the-age-of-instant-software\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Cybersecurity in the Age of Instant Software - Imperative Business Ventures Limited\" \/>\n<meta property=\"og:description\" content=\"AI is rapidly changing how software is written, deployed, and used. Trends point to a future where AIs can write custom software quickly and easily: \u201cinstant software.\u201d Taken to an extreme, it might become easier for a user to have an AI write an application on demand\u2014a spreadsheet, for example\u2014and delete it when you\u2019re done […]\" \/>\n<meta property=\"og:url\" content=\"https:\/\/blog.ibvl.in\/index.php\/2026\/04\/07\/cybersecurity-in-the-age-of-instant-software\/\" \/>\n<meta property=\"og:site_name\" content=\"Imperative Business Ventures Limited\" \/>\n<meta property=\"article:published_time\" content=\"2026-04-07T18:04:34+00:00\" \/>\n<meta name=\"author\" content=\"admin\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"admin\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"9 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/blog.ibvl.in\/index.php\/2026\/04\/07\/cybersecurity-in-the-age-of-instant-software\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/blog.ibvl.in\/index.php\/2026\/04\/07\/cybersecurity-in-the-age-of-instant-software\/\"},\"author\":{\"name\":\"admin\",\"@id\":\"https:\/\/blog.ibvl.in\/#\/schema\/person\/55b87b72a56b1bbe9295fe5ef7a20b02\"},\"headline\":\"Cybersecurity in the Age of Instant Software\",\"datePublished\":\"2026-04-07T18:04:34+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/blog.ibvl.in\/index.php\/2026\/04\/07\/cybersecurity-in-the-age-of-instant-software\/\"},\"wordCount\":1824,\"keywords\":[\"Cybersecurity\"],\"articleSection\":{\"0\":\"AI\",\"1\":\"computer security\",\"2\":\"Cybersecurity\",\"3\":\"LLM\",\"4\":\"patching\",\"6\":\"Vulnerabilities\"},\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/blog.ibvl.in\/index.php\/2026\/04\/07\/cybersecurity-in-the-age-of-instant-software\/\",\"url\":\"https:\/\/blog.ibvl.in\/index.php\/2026\/04\/07\/cybersecurity-in-the-age-of-instant-software\/\",\"name\":\"Cybersecurity in the Age of Instant Software - Imperative Business Ventures Limited\",\"isPartOf\":{\"@id\":\"https:\/\/blog.ibvl.in\/#website\"},\"datePublished\":\"2026-04-07T18:04:34+00:00\",\"author\":{\"@id\":\"https:\/\/blog.ibvl.in\/#\/schema\/person\/55b87b72a56b1bbe9295fe5ef7a20b02\"},\"breadcrumb\":{\"@id\":\"https:\/\/blog.ibvl.in\/index.php\/2026\/04\/07\/cybersecurity-in-the-age-of-instant-software\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/blog.ibvl.in\/index.php\/2026\/04\/07\/cybersecurity-in-the-age-of-instant-software\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/blog.ibvl.in\/index.php\/2026\/04\/07\/cybersecurity-in-the-age-of-instant-software\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/blog.ibvl.in\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Cybersecurity in the Age of Instant Software\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/blog.ibvl.in\/#website\",\"url\":\"https:\/\/blog.ibvl.in\/\",\"name\":\"Imperative Business Ventures Limited\",\"description\":\"\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/blog.ibvl.in\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/blog.ibvl.in\/#\/schema\/person\/55b87b72a56b1bbe9295fe5ef7a20b02\",\"name\":\"admin\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/blog.ibvl.in\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/4d20b2cd313e4417a599678e950e6fb7d4dfa178a72f2b769335a08aaa615aa9?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/4d20b2cd313e4417a599678e950e6fb7d4dfa178a72f2b769335a08aaa615aa9?s=96&d=mm&r=g\",\"caption\":\"admin\"},\"sameAs\":[\"https:\/\/blog.ibvl.in\"],\"url\":\"https:\/\/blog.ibvl.in\/index.php\/author\/admin_hcbs9yw6\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Cybersecurity in the Age of Instant Software - Imperative Business Ventures Limited","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/blog.ibvl.in\/index.php\/2026\/04\/07\/cybersecurity-in-the-age-of-instant-software\/","og_locale":"en_US","og_type":"article","og_title":"Cybersecurity in the Age of Instant Software - Imperative Business Ventures Limited","og_description":"AI is rapidly changing how software is written, deployed, and used. Trends point to a future where AIs can write custom software quickly and easily: \u201cinstant software.\u201d Taken to an extreme, it might become easier for a user to have an AI write an application on demand\u2014a spreadsheet, for example\u2014and delete it when you\u2019re done […]","og_url":"https:\/\/blog.ibvl.in\/index.php\/2026\/04\/07\/cybersecurity-in-the-age-of-instant-software\/","og_site_name":"Imperative Business Ventures Limited","article_published_time":"2026-04-07T18:04:34+00:00","author":"admin","twitter_card":"summary_large_image","twitter_misc":{"Written by":"admin","Est. reading time":"9 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/blog.ibvl.in\/index.php\/2026\/04\/07\/cybersecurity-in-the-age-of-instant-software\/#article","isPartOf":{"@id":"https:\/\/blog.ibvl.in\/index.php\/2026\/04\/07\/cybersecurity-in-the-age-of-instant-software\/"},"author":{"name":"admin","@id":"https:\/\/blog.ibvl.in\/#\/schema\/person\/55b87b72a56b1bbe9295fe5ef7a20b02"},"headline":"Cybersecurity in the Age of Instant Software","datePublished":"2026-04-07T18:04:34+00:00","mainEntityOfPage":{"@id":"https:\/\/blog.ibvl.in\/index.php\/2026\/04\/07\/cybersecurity-in-the-age-of-instant-software\/"},"wordCount":1824,"keywords":["Cybersecurity"],"articleSection":{"0":"AI","1":"computer security","2":"Cybersecurity","3":"LLM","4":"patching","6":"Vulnerabilities"},"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/blog.ibvl.in\/index.php\/2026\/04\/07\/cybersecurity-in-the-age-of-instant-software\/","url":"https:\/\/blog.ibvl.in\/index.php\/2026\/04\/07\/cybersecurity-in-the-age-of-instant-software\/","name":"Cybersecurity in the Age of Instant Software - Imperative Business Ventures Limited","isPartOf":{"@id":"https:\/\/blog.ibvl.in\/#website"},"datePublished":"2026-04-07T18:04:34+00:00","author":{"@id":"https:\/\/blog.ibvl.in\/#\/schema\/person\/55b87b72a56b1bbe9295fe5ef7a20b02"},"breadcrumb":{"@id":"https:\/\/blog.ibvl.in\/index.php\/2026\/04\/07\/cybersecurity-in-the-age-of-instant-software\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/blog.ibvl.in\/index.php\/2026\/04\/07\/cybersecurity-in-the-age-of-instant-software\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/blog.ibvl.in\/index.php\/2026\/04\/07\/cybersecurity-in-the-age-of-instant-software\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/blog.ibvl.in\/"},{"@type":"ListItem","position":2,"name":"Cybersecurity in the Age of Instant Software"}]},{"@type":"WebSite","@id":"https:\/\/blog.ibvl.in\/#website","url":"https:\/\/blog.ibvl.in\/","name":"Imperative Business Ventures Limited","description":"","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/blog.ibvl.in\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/blog.ibvl.in\/#\/schema\/person\/55b87b72a56b1bbe9295fe5ef7a20b02","name":"admin","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/blog.ibvl.in\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/4d20b2cd313e4417a599678e950e6fb7d4dfa178a72f2b769335a08aaa615aa9?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/4d20b2cd313e4417a599678e950e6fb7d4dfa178a72f2b769335a08aaa615aa9?s=96&d=mm&r=g","caption":"admin"},"sameAs":["https:\/\/blog.ibvl.in"],"url":"https:\/\/blog.ibvl.in\/index.php\/author\/admin_hcbs9yw6\/"}]}},"_links":{"self":[{"href":"https:\/\/blog.ibvl.in\/index.php\/wp-json\/wp\/v2\/posts\/2348","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/blog.ibvl.in\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.ibvl.in\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.ibvl.in\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.ibvl.in\/index.php\/wp-json\/wp\/v2\/comments?post=2348"}],"version-history":[{"count":0,"href":"https:\/\/blog.ibvl.in\/index.php\/wp-json\/wp\/v2\/posts\/2348\/revisions"}],"wp:attachment":[{"href":"https:\/\/blog.ibvl.in\/index.php\/wp-json\/wp\/v2\/media?parent=2348"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.ibvl.in\/index.php\/wp-json\/wp\/v2\/categories?post=2348"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.ibvl.in\/index.php\/wp-json\/wp\/v2\/tags?post=2348"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}