A company let an automatically-intruding program attack its own website.
Inside Google’s product security team, there’s a system called PageBreak. The public claim is that it has already found more than 500 real vulnerabilities in its own applications. Unlike common scanning tools, it only reports results after a specific, working attack method can reproduce the vulnerability in a real environment—so its false-positive rate is close to zero. The next step is to pair it with a program that automatically fixes vulnerabilities.
Competition among security tools has always been stuck on an old problem.
Reporting more isn’t as good as reporting accurately. Scanners dump hundreds of ambiguous alerts onto engineers, and the result is that people stop trusting them—while the truly dangerous few get drowned out. Only alerts that include reproducible attack evidence are allowed to take up someone else’s time. This threshold sounds simple-minded, but it’s the only way to let machines take over the decision.
The one that’s best at defending a system is often the one that’s best at breaking it.
Do this in reverse: let offensive capability serve defense. What’s left is simply whether you dare to let it actually take action.
Inside Google’s product security team, there’s a system called PageBreak. The public claim is that it has already found more than 500 real vulnerabilities in its own applications. Unlike common scanning tools, it only reports results after a specific, working attack method can reproduce the vulnerability in a real environment—so its false-positive rate is close to zero. The next step is to pair it with a program that automatically fixes vulnerabilities.
Competition among security tools has always been stuck on an old problem.
Reporting more isn’t as good as reporting accurately. Scanners dump hundreds of ambiguous alerts onto engineers, and the result is that people stop trusting them—while the truly dangerous few get drowned out. Only alerts that include reproducible attack evidence are allowed to take up someone else’s time. This threshold sounds simple-minded, but it’s the only way to let machines take over the decision.
The one that’s best at defending a system is often the one that’s best at breaking it.
Do this in reverse: let offensive capability serve defense. What’s left is simply whether you dare to let it actually take action.