a16z Podcast

Ami Luttwak on why the best defense is now to attack yourself

Ami Luttwak· Co-founder and CTO of Wiz at Wiz
·~46 min·English·a16z
AgentsAI SafetyBusiness Strategy
TL;DR

Wiz co-founder Ami Luttwak says 'Black October' proved AI can now find a flaw and run a full attack in about 20 minutes, open-source models are closing the gap with the frontier, and the only survivable defense is to attack your own systems continuously with the latest models.

01The Black Swan

Black October broke the record

<strong>October 2026 brought more severe security incidents than any month on record</strong> - including what Luttwak calls the most severe vulnerability ever found by AI.

the PHP vulnerability probably the most severe vulnerability ever found by AI

— Ami Luttwak, a16z Podcast
Key Insight
Naming a month 'Black October' is a deliberate signal: Luttwak is marking a regime change, not a bad week. The record vulnerability severity alongside a rise in live AI attacks is his evidence that the long-predicted 'AI can hack' era has shifted from theoretical to observed.
02Speed

Every day is now zero day

<strong>A full attack that took the best human attackers weeks or months now runs in about 20 minutes</strong> - from break-in to stealing every AI key.

run an entire attack that usually took for the best attackers weeks or months

— Ami Luttwak, a16z Podcast
Key Insight
The danger is not a smarter attack, it is a faster one. At 20 minutes the defender's response window closes before a human analyst has read the first alert - which is why Luttwak keeps returning to automation and machine-speed defense.
03Democratization

The scary part is open source catching up

<strong>The hope was that open-source models trailed the frontier by about a year; they do not</strong> - and once they close the gap, any attacker gets frontier-grade offense for free.

the hope was that open source models are a year behind but they're not

— Ami Luttwak, a16z Podcast
Key Insight
A frontier-only threat is a rich-attacker threat: expensive, rate-limited, traceable. The moment open weights match it, the capability becomes ambient and unpriced - which is why Luttwak treats open-source parity, not raw model strength, as the tipping point.
04The Asymmetry

The world cannot patch fast enough

<strong>The time to weaponize a flaw has collapsed, but the time to patch one has not improved in decades</strong> - and the fix often leaks before the CVE is even public.

So the answer is that the world is not ready. The world is not ready for this.

— Ami Luttwak, a16z Podcast
Key Insight
Auto-patching, Luttwak says, is still an open problem he sees no clear path to - realistic only for brand-new companies that already run a fully agentic build-test-deploy pipeline. For everyone carrying legacy code the exploit-patch gap is structural: you cannot close it by trying harder, only by redesigning what you expose.
05The New Doctrine

The best defense is to attack yourself

<strong>Static defenses are dead: every new model can clear a wall that held last week, so the only way to know you are exposed is to attack your own systems continuously.</strong>

maybe your application was considered secure yesterday, but it's not secure today.

— Ami Luttwak, a16z Podcast
Key Insight
This inverts the audit model of security. If the attack surface is re-scored every time a model ships, a once-a-year pentest is measuring a world that no longer exists - so Luttwak's 'red agent' runs the offense on a loop, not on a calendar.
06Engineering

Pipelines of models, not one model

<strong>There is no single best model, so the real engineering problem is routing each task to the right model and meshing cheap and expensive ones into a cost-managed pipeline.</strong> The costliest model runs only at the end, to confirm what the cheaper stages already flagged.

The only thing you can do as an independent company is to try all the models all the time and to find the best combination.

— Ami Luttwak, a16z Podcast
Key Insight
Luttwak reframes AI security from a modeling problem to a unit-economics problem. You cannot run the top model on every event without losing money, so the moat is the routing logic that decides which model sees what - the same lesson every company serving AI at scale is learning.
07Priorities

Scan your exposure, not your code

<strong>The urgent scan is not your code - it is your unauthenticated, internet-exposed attack surface</strong>, the hardcoded key or open endpoint attackers actually walk through.

That's where attackers get their attacks, unauthenticated surfaces. That's what you have to run scans for and you have to do it continuously.

— Ami Luttwak, a16z Podcast
Key Insight
Luttwak argues the industry spent its attention on code scanning because that is where the publicity went, not where the risk is. An exposure scan costs minutes per endpoint and catches the front door; deep code analysis is the next step, not the first.
08Hard Truth

Most of what security teams do is not security

<strong>Compliance, reports and configuration checklists eat most of a security team's time without reducing risk</strong> - and no budget can buy its way past bad security design.

Most of what security teams do is not security.

— Ami Luttwak, a16z Podcast
Key Insight
This is the interview's most actionable and most uncomfortable claim: the work that feels like security - audits, dashboards, config lists - is often theater. Luttwak's test is simple: how much of your team's time is spent actually attacking yourself versus producing reports?