Wiz warns AI attackers compromise targets in 20 minutes

Wiz co-founder and CTO Ami Ludwak has labeled October "Black October," citing an unprecedented volume and severity of security incidents driven by artificial intelligence. Ludwak stated that AI attackers are now executing full compromises in approximately 20 minutes, a process that previously required elite security teams weeks or months. This acceleration is attributed to frontier models gaining the ability to find and exploit complex vulnerabilities, with open-source models catching up within a six-to-nine-month window. Wiz reported that 915 AI development platforms were targeted in October, with attackers specifically seeking API keys. While 50% of Wiz customers patched a severe PHP vulnerability within two to three days, Ludwak noted that 70% of the internet runs PHP, meaning full resolution will take years. He argued that the world is not ready for AI-speed attacks, as patching cycles for systems like the Linux kernel still take weeks or months, creating a critical gap where exploits are available before patches are distributed.

To address this, Wiz introduced the Red Agent, a tool that continuously attacks customer environments using AI to identify vulnerabilities before external attackers do. A majority of Wiz customers, including over 50% of the Fortune 100, are already using the tool. The Red Agent operates on a tiered pipeline, starting with deterministic analysis of unauthenticated external exposure, then using cheaper models for broad scanning, and reserving advanced models for deep penetration testing. Ludwak emphasized that continuous external scanning is more critical than internal code scanning, as attackers primarily exploit unauthenticated surfaces. He also highlighted the financial unsustainability of traditional one-time AI code scanning, noting that customers have wasted millions on single scans. Wiz is developing intelligent, continuous scanning pipelines that allocate budgets efficiently across different models. A CISO told A16Z partners that he expects his security budget to increase by 80% next year, but Ludwak argued that budget increases alone will not solve the problem, advocating instead for secure design and automated defensive operations.