Last week, Snyk CTO Manoj Nair sat down with Alon Krifcher, Head of Applied AI from Anthropic, for a live discussion on the coming wave of autonomous attacks. Manoj kept landing on one thing: the AI Hurricane has already arrived, and what's left is deciding whether your defense runs at the same speed as the threat.
What happened
Manoj kept landing on one thing: the AI Hurricane has already arrived, and what's left is deciding whether your defense runs at the same speed as the threat.
Where the sources line up
Attacks have gone agentic, and so has the code writing them. Across thousands of real enterprise environments, Snyk is seeing new security issues introduced grow more than 2X quarter over quarter, and for every six new issues, teams are closing one. CrowdStrike's most recent threat report clocked the fastest recorded breakout time at 27 seconds. The average is now measured in minutes, not months. Zero days used to take a long time to develop and longer to exploit, giving defenders time. Time is exactly what autonomous attackers have taken away.
Practical impact for readers
However, Manoj doesn't think the sky is falling. He thinks the response is simpler than people expect, and it's already working in the largest enterprises he talks to. If autonomous attacks demand machine-speed defense, he argues, you need four things running in parallel, not in sequence: Discover → Remediate → Validate → Prevent. You can start anywhere in that loop. Most companies start with the backlog they already have, because everyone has one.
Who should pay attention now
That's where the risk math changes. The old model: likelihood times impact. Impact hasn't moved much, but likelihood has. An attacker can now cheaply and agentically chain three vulnerabilities, each classified as low or medium, into something that isn't low or medium at all. Retriaging everything isn't the answer, Manoj explains. Starting with your highest-impact applications and testing them the way an autonomous attacker actually would — that's the answer, and it's why Snyk built Evo Continuous Offensive Security . One early customer ran it against an app that had come back clean from a pen test that same week. Snyk found everything the pen tester found, plus two or three things they had to fix that day. It's not a concept, Manoj says. It's live.
What is still unclear
On the backlog itself, some of Snyk's customers, including Labelbox and Relay Networks , have talked publicly about getting to backlog zero using a combination of Skills and remediation agents built on Claude. Another Fortune 10 customer said the same thing. If that's true at that scale, he says, "we'll deal with the backlog eventually," stopped being a credible plan.
Latest comments
0No comments yet. You can start the conversation.