Equity Podcast

Tomer Schwartz on why the one-bug-a-year era is ending

Tomer Schwartz· CTO of Exposure Management and AppSec at Wiz at Wiz
·~31 min·English·TechCrunch
AgentsAI SafetyOpen SourceAI Infrastructure
TL;DR

AI harnesses now let small teams try thousands of attack ideas at once, which is why a 12-year-old PHP flaw suddenly turned exploitable — and why the industry's one-critical-bug-a-year cadence is giving way to a steady stream that manual patching cannot keep up with.

01Core Mental Model

The Weekend Researcher That Never Sleeps

<strong>AI did not make vulnerability researchers smarter — it made them parallel</strong>, and Wiz's Atlas harness turns a months-long hunt into a weekend sweep across dozens of attack ideas at once.

Why wouldn't you try 20 different ideas on various different targets and just run them on top of Atlas and find a ton of different potential vulnerabilities and maybe do it over the weekend.

— Tomer Schwartz, Equity
Key Insight
The unlock is not a cleverer model, it is breadth. Atlas turns a sequential, months-long hunt into a breadth-first sweep, so the scarce human skill shifts from finding bugs to triaging which of the machine's many leads is worth pulling.
02Parallel Discovery

Everyone Found the Same Bug at Once

<strong>Point similar AI tools at the same code and independent teams surface the same flaw in parallel</strong> — which is how Wiz and a separate OpenAI-linked team both reported the PHP bugs to the maintainers.

It's kind of cool to see how different companies and different groups of researchers actually find similar things in parallel.

— Tomer Schwartz, Equity
Key Insight
If rival teams converge on the same flaw in parallel, the window a secret bug stays secret is collapsing toward zero. Responsible disclosure is now racing an invisible clock set by whoever else is scanning the same code.
03What Changed

A 12-Year-Old Bug, Suddenly Exploitable

<strong>The flaw sat dormant for 12 years because no one could weaponize it — until AI could</strong>, so what changed was never the code but the cost of building a reliable exploit.

With the capability of AI models today, it might be a full exploit already available.

— Tomer Schwartz, Equity
Key Insight
Calling a flaw known-sensitive but not exploitable was always a claim about human effort, not about the code. AI reprices every dormant QA worry as a live threat, because the cost that kept it dormant just fell away.
04Disclosure Dilemma

Coordinated Disclosure Is Fundamentally Flawed

<strong>Coordinated disclosure is fundamentally flawed — the more defenders you warn, the more certain it leaks</strong>, and when it leaked the team accelerated the timeline before every downstream release was ready.

Coordinated disclosure is something that is, you know, fundamentally flawed, right?

— Tomer Schwartz, Equity
Key Insight
He frames the leak as structural, not anyone's mistake. Every disclosure faces the same curve, and AI steepens it: a leaked hint is now instantly actionable for attackers, so speed of response is the only lever a defender has left.
05The New Cadence

The Headliner-a-Year Era Is Over

<strong>The one-critical-bug-a-year cadence is breaking down</strong>, and Schwartz warns the next crisis-level vulnerability could arrive within weeks or months, not once a year.

This is not the only critical vulnerability that is about to be published in the next couple weeks or months, right?

— Tomer Schwartz, Equity
Key Insight
A yearly headliner let teams treat patching as an event to schedule. A weekly stream makes it a background process, and any org that still plans security work by the calendar will be permanently behind.
06Architecture

Architect So You Can Patch in Your Sleep

<strong>Manual patching will never scale against a constant stream, so define everything in code and let continuous deployment push the fix</strong> — and the small, new company with no legacy holds the advantage.

I do encourage everyone to think about how the architecture can be as resilient as possible to changes.

— Tomer Schwartz, Equity
Key Insight
His advice quietly inverts the usual seniority. The startup with no legacy and no security team is better placed than the thousand-person incumbent, because resilience is cheap to build in and expensive to retrofit.
07Founding Advice

Build Security In, or It Caps Your Speed

<strong>Bolt security on late and it becomes the thing that caps your speed</strong>, so if trust is core to the business, it belongs with a founder or one of your very first hires.

This will always be something that will stop you from being able to accelerate and move faster and faster as a company.

— Tomer Schwartz, Equity
Key Insight
He reframes security as a speed feature, not a compliance cost. Treated as a brake you add later, it throttles every release; owned from the first hire, it is the thing that lets a trust-dependent business move fast at all.