{"id":9118,"date":"2026-08-13T08:25:00","date_gmt":"2026-08-13T08:25:00","guid":{"rendered":"https:\/\/cybersecurityinfocus.com\/?p=9118"},"modified":"2026-08-13T08:25:00","modified_gmt":"2026-08-13T08:25:00","slug":"microsoft-wants-you-to-rethink-your-approach-to-cyber-defense","status":"publish","type":"post","link":"https:\/\/cybersecurityinfocus.com\/?p=9118","title":{"rendered":"Microsoft wants you to rethink your approach to cyber defense"},"content":{"rendered":"
\n
\n
\n
\n
<\/div>\n

Cyber defenders need to shake off traditional best practices and switch from reactive patching to building inherently resilient systems in the face of AI-accelerated vulnerability discovery, according to a senior security manager at Microsoft.<\/p>\n

David Weston, group manager in the Windows team at Microsoft, told delegates at Black Hat USA that traditional approaches to vulnerability remediation<\/a> fail to work in an era when AI tools are making vulnerability discovery and exploit development cheaper, faster, and more scalable.<\/p>\n

Weston\u2019s keynote \u2014 entitled \u201cThe End of Rare: Defending When Offense Is Cheap<\/a>\u201d \u2014 challenged industry vulnerability best practices that Weston said where from a time when developing exploits and mounting attacks was time consuming and expensive. That\u2019s no longer the case, he said.<\/p>\n

As evidence, Weston explained how the Microsoft Security Response Center (MSRC) is doubling the number of vulnerabilities it processes and patches every six weeks. \u201cThat is an incredible number,\u201d he said. \u201cWe\u2019re nine times the vulnerability volume that we were in March.\u201d<\/p>\n

The accelerating pace of vulnerability discovery is \u201chighly correlated\u201d to rising use of increasingly capable AI tools, and presents a cross-industry problem, he said.<\/p>\n

\u201cThese are serious vulnerabilities, the kind that I used to take a year to bespoke craft,\u201d Weston pointed out. \u201cThey\u2019re being spit out at industrial speed, and it\u2019s not [just] Windows. You look at Linux, you look at any other operating system out there, I think you\u2019ll see a pretty strong correlation.\u201d<\/p>\n

Microsoft\u2019s MDASH<\/a>, short for Multi-model Agentic Scanning Harness, found roughly 200 Linux kernel vulnerabilities in the company\u2019s internal Azure Linux distribution that Microsoft is working with the community to fix.<\/p>\n

Microsoft also added a new module to MDASH to help its engineers triage vulnerabilities. The technology is capable of turning a static analysis result into proof-of-concept exploit code.<\/p>\n

\u201cThat\u2019s worked much better than we ever thought,\u201d said Weston, who leads Microsoft\u2019s AI vulnerability-discovery and frontier-model research. \u201cOf the 200 vulnerabilities, we can automatically generate 182 crash-level POCs. Many of them are fully working exploits. I\u2019m talking root exploits automatically spit out from vulnerability.\u201d<\/p>\n

The average computing cost of detecting those vulnerabilities and generating their exploits was just $3.61, with a time to generation of 21 minutes.<\/p>\n

Microsoft\u2019s work provides further evidence that developing an exploit from a security vulnerability is not likely a factor holding back any attackers with access to advanced AI-based security tools.<\/p>\n

\u201cBy the end of the year, we\u2019ll be looking at automatic exploit generation being pretty commonplace and pretty commodity,\u201d Weston warned.<\/p>\n

Traditional mitigations failing<\/h2>\n

Nondeterministic mitigations that introduce randomness or unpredictability, such as ASLR (Address Space Layout Randomization), may continue to be an obstacle for attackers but are not likely to stem the rising tide of AI-mediated vulnerability discovery for long.<\/p>\n

Enterprises have historically relied heavily on threat detection for defense, but that layer of protection assumes attackers face cost and time challenges in changing the tools and techniques they use. Those comforting assumptions are also being undermined by AI, Weston said.<\/p>\n

The idea used to be that it\u2019s \u201csuper expensive to code a framework or an implant, so people just keep using packers and obfuscation tools on the same stuff, and they keep using the same TTP, so we\u2019ll work against that. And that\u2019s gonna give us durability in detection,\u201d Weston said.<\/p>\n

\u201cInstead of having to retrain the operator, which would have been expensive for cyber operations, we can just use autonomous operations,\u201d he noted of attackers\u2019 evolving mentality. \u201cInstead of obfuscating, we can create a bespoke set of tools or frameworks per target.\u201d<\/p>\n

How to turn the table on attackers<\/h2>\n

In response to the changing economics of security, the industry must adopt memory-safe computer programming languages such as Rust alongside the use of AI-based tools to improve the resilience of existing code bases.<\/p>\n

\u201cWe don\u2019t wanna go vulnerability for patch,\u201d Weston argued. \u201cWe don\u2019t want to go exploit for detection, evasion for detection. Hand-to-hand combat with attackers will cause us to lose in defense.\u201d<\/p>\n

About 70% of vulnerabilities that are patched today, at least by the major vendors, are memory safety issues. Safer computer programming languages, such as Rust and Golang, \u201celiminate those,\u201d according to Weston. For example, Google reduced memory safety flaws<\/a> from 76% of Android vulnerabilities in 2019 to below 20% in 2025 after it switched to Rust.<\/p>\n

More recently, Microsoft rewrote the Azure hypervisor, the software that isolates virtual machines from one another, using Rust, and scaled it across 1.5 million virtual machines without any adverse incident.<\/p>\n

A project from the Defense Advanced Research Projects Agency<\/a>, called Tractor, automates the conversion of legacy C code into Rust. Microsoft Research\u2019s AI-based project RustAssistant,<\/a> introduced last year, uses AI-based technology to detect and suggest remedies for Rust compilation errors.<\/p>\n

Weston added: \u201cWe can shift left and make more secure software. That\u2019ll limit vulnerability.\u201d<\/p>\n

Detection of attacks is still important but no longer sufficient. Both enterprises and vendors should be investing in durability.<\/p>\n

\u201cWe can move to more prevention mechanisms,\u201d Weston said. \u201cAnd we can use secure by construction and even formal methods to get the deterministic safety. If we can do that along a realistic timeline, then we can turn the tables and drive this problem towards attackers.\u201d<\/p>\n

Vulnerability research in the age of AI<\/h2>\n

Yan Shoshitaishvili, an associate professor at Arizona State University and well-known vulnerability researcher, presented a Black Hat USA keynote on how agentic AI is drastically reducing<\/a> the cost and time required to discover and exploit vulnerabilities.<\/p>\n

The talk \u2014 \u201cVulnerability Research in the Agentic Age<\/a>\u201d \u2014 offered a companion piece to Weston\u2019s presentation. AI tools have shifted the human skills in bug hunting toward developing better search strategies, validation pipelines, and exploitability checks.<\/p>\n

\u201cGoing from asking GPT to find bugs, to having an agentic pipeline that\u2019s vulnerability-aware requires human innovation, human understanding of the threat models, of the vulnerability space,\u201d Shoshitaishvili said.<\/p>\n

He and his research student Hong Kai Chen applied these techniques to a study on OpenHarmony, the open-source foundation behind parts of Huawei\u2019s commercial HarmonyOS ecosystem for mobile devices.<\/p>\n

\u201cWe found dozens of flaws, ranging from Bluetooth, device takeovers, to privacy leaks, location, all of this, very fun stuff, in Open Harmony, because we started from the vulnerability properties that we extracted from Android bugs,\u201d Shoshitaishvili said. \u201cNow we\u2019re doing this agentically, and the results are incredible.\u201d<\/p>\n

With agentic pipelines, Shoshitaishvili\u2019s team is finding vulnerabilities far faster than they can responsibly disclose with accompanying documentation and proposed fixes.<\/p>\n

Shoshitaishvili tested the \u201cjust rewrite everything in Rust\u201d idea using agentic code generation on a Rust rewrite of coreutils shipped with Ubuntu. His team found that memory-safety bugs (buffer overflows, use-after-free) were largely gone but logic vulnerabilities, such as time-of-check\u2013time-of-use (TOCTOU) races and cryptographic, reappeared.<\/p>\n

Rewriting in a safer language removes some classes of bugs but not the underlying design-level weaknesses unless active steps to rewrite problematic code are undertaken, Shoshitaishvili concluded.<\/p>\n<\/div>\n<\/div>\n<\/div>\n<\/div>","protected":false},"excerpt":{"rendered":"

Cyber defenders need to shake off traditional best practices and switch from reactive patching to building inherently resilient systems in the face of AI-accelerated vulnerability discovery, according to a senior security manager at Microsoft. David Weston, group manager in the Windows team at Microsoft, told delegates at Black Hat USA that traditional approaches to vulnerability […]<\/p>\n","protected":false},"author":0,"featured_media":9119,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[],"class_list":["post-9118","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-education"],"_links":{"self":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts\/9118"}],"collection":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"replies":[{"embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=9118"}],"version-history":[{"count":0,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts\/9118\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/media\/9119"}],"wp:attachment":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=9118"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=9118"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=9118"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}