Member-only story
The Cybersecurity risk you couldn’t see
Over the past several months, a familiar pattern has emerged across boardrooms and security teams alike. Large, capable, and increasingly autonomous frontier AI models are demonstrating a remarkable ability to identify vulnerabilities in software systems at a scale and speed that previously required entire red teams and months of coordinated effort. The reaction has been a mixture of concern and genuine uncertainty: Should organizations be running more testing? Do existing threat models need to be reconsidered entirely?
The answer to both is yes. But something more fundamental is at stake here, because this moment exposes a structural flaw in how the industry has understood cybersecurity risk for a long time, one that has been quietly tolerated rather than honestly examined.
The core issue, stated plainly: cybersecurity has long treated the visibility of vulnerabilities as a proxy for the existence of risk. When a system is tested and ten vulnerabilities are found, they get scored, prioritized, partially remediated, and the remainder accepted as residual risk. The audit closes. The paperwork is complete.
What frontier AI is doing, with uncomfortable clarity, is demonstrating an idea of how much was always present beneath the surface.
