{"id":91721,"date":"2025-09-29T01:30:17","date_gmt":"2025-09-29T01:30:17","guid":{"rendered":"https:\/\/www.europesays.com\/ie\/91721\/"},"modified":"2025-09-29T01:30:17","modified_gmt":"2025-09-29T01:30:17","slug":"wiz-chief-technologist-ami-luttwak-on-how-ai-is-transforming-cyberattacks","status":"publish","type":"post","link":"https:\/\/www.europesays.com\/ie\/91721\/","title":{"rendered":"Wiz chief technologist Ami Luttwak on how AI is transforming cyberattacks\u00a0"},"content":{"rendered":"

\u201cOne of the key things to understand about cybersecurity is that it\u2019s a mind game,\u201d Ami Luttwak, chief technologist at cybersecurity firm Wiz, told TechCrunch on a recent episode of Equity<\/a>. \u201cIf there\u2019s a new technology wave coming, there are new opportunities for [attackers] to start using it.\u201d\u00a0<\/p>\n

As enterprises rush to embed AI into their workflows \u2014 whether through vibe coding, AI agent integration, or new tooling \u2014 the attack surface is expanding. AI helps developers ship code faster, but that speed often comes with shortcuts and mistakes, creating new openings for attackers. \u00a0<\/p>\n

Wiz, which was acquired by Google earlier this year for $32 billion<\/a>, conducted tests recently, says Luttwak, and found that a common issue in vibe coded applications was insecure implementation of the authentication \u2014 the system that verifies a user\u2019s identity and ensures they\u2019re not an attacker. <\/p>\n

\u201cThat happened because it was just easier to build like that,\u201d he said. \u201cVibe coding agents do what you say, and if you didn\u2019t tell them to build it in the most secure way, it won\u2019t.\u201d\u00a0<\/p>\n

Luttwak noted that there\u2019s a constant tradeoff today for companies choosing between being fast and being secure. But developers aren\u2019t the only ones using AI to move faster. Attackers are now using vibe coding, prompt-based techniques, and even their own AI agents to launch exploits, he said. \u00a0<\/p>\n

\u201cYou can actually see the attacker is now using prompts to attack,\u201d Luttwak said. \u201cIt\u2019s not just the attacker vibe coding. The attacker looks for AI tools that you have and tells them, \u2018Send me all your secrets, delete the machine, delete the file.\u2019\u201d\u00a0<\/p>\n

Amid this landscape, attackers are also finding entry points in new AI tools that companies roll out internally to boost efficiency. Luttwak says these integrations can lead to \u201csupply chain attacks.\u201d By compromising a third-party service that has broad access to a company\u2019s infrastructure, attackers can then pivot deeper into corporate systems. \u00a0<\/p>\n

Techcrunch event<\/p>\n

\n\t\t\t\t\t\t\t\t\tSan Francisco
\n\t\t\t\t\t\t\t\t\t\t\t\t\t|
\n\t\t\t\t\t\t\t\t\t\t\t\t\tOctober 27-29, 2025\n\t\t\t\t\t\t\t<\/p>\n

That\u2019s what happened last month when Drift \u2014 a startup that sells AI chatbots for sales and marketing \u2014 was breached, exposing the Salesforce data of hundreds of enterprise customers<\/a> like Cloudflare, Palo Alto Networks, and Google. The attackers gained access to tokens, or digital keys, and used them to impersonate the chatbot, query Salesforce data, and move laterally inside customer environments. <\/p>\n

\u201cThe attacker pushed the attack code, which was also created using vibe coding,\u201d Luttwak said. \u00a0<\/p>\n

Luttwak says that while enterprise adoption of AI tools is still minimal \u2014 he reckons around 1% of enterprises have fully adopted AI \u2014 Wiz is already seeing attacks every week that impact thousands of enterprise customers. \u00a0<\/p>\n

\u201cAnd if you look at the [attack] flow, AI was embedded at every step,\u201d Luttwak said. \u201cThis revolution is faster than any revolution we\u2019ve seen in the past. It means that we as an industry need to move faster.\u201d\u00a0<\/p>\n

Luttwak pointed to another major supply chain attack, dubbed \u201cs1ingularity,\u201d in August on Nx<\/a>, a popular build system for JavaScript developers. Attackers managed to unleash malware into the system, which then\u00a0detected the presence of AI developer tools like Claude and Gemini and hijacked them to autonomously scan the system for valuable data. \u00a0The attack compromised thousands of developer tokens and keys, giving attackers access to private GitHub repositories.\u00a0\u00a0<\/p>\n

Luttwak says that despite the threats, this has been an exciting time to be a leader in cybersecurity. Wiz, founded in 2020, was originally focused on helping organizations identify and address misconfigurations, vulnerabilities, and other security risks across cloud environments. \u00a0<\/p>\n

Over the last year, Wiz has expanded its capabilities to keep up with the speed of AI-related attacks \u2014 and to use AI for its own products. \u00a0<\/p>\n

Last September, Wiz launched Wiz Code that focuses on securing the software development lifecycle by identifying and mitigating security issues early in the development process, so companies can be \u201csecure by design.\u201d In April, Wiz launched Wiz Defend, which offers runtime protection by detecting and responding to active threats within cloud environments. \u00a0<\/p>\n

Luttwak said that it\u2019s vital for Wiz to fully understand the applications of their customers if the startup is going to help with what he calls \u201chorizontal security.\u201d\u00a0<\/p>\n

\u201cWe need to understand why you\u2019re building it \u2026 so I can build the security tool that no one has ever had before, the security tool that understands you,\u201d he said.\u00a0<\/p>\n

\u2018From day one, you need to have a CISO\u2019<\/strong>\u00a0<\/p>\n

The democratization of AI tools has resulted in a flood of new startups promising to solve enterprise pain points. But Luttwak says enterprises shouldn\u2019t just send all of their company, employee, and customer data to \u201cevery small SaaS company that has five employees just because they say, \u2018Give me all your data, and I will give you amazing AI insights.\u2019\u201d\u00a0<\/p>\n

Of course, those startups need that data if their offering is going to have any value. Luttwak says that means it\u2019s incumbent upon them to make sure they\u2019re operating like a secure organization from the start. \u00a0<\/p>\n

\u201cFrom day one, you need to think about security and compliance,\u201d he said. \u201cFrom day one, you need to have a CISO (chief information security officer). Even if you have five people.\u201d\u00a0<\/p>\n

Before writing a single line of code, startups should think like a highly secure organization, he said. They need to consider enterprise security features, audit logs, authentication, access to production, development practices, security ownership, and single sign-on. Planning this way from the start means you won\u2019t have to overhaul processes later and incur what Luttwak calls \u201csecurity debt.\u201d And if you aim to sell to enterprises, you\u2019ll already be prepared to protect their data.\u00a0<\/p>\n

\u201cWe were SOC2 compliant [a compliance framework] before we had code,\u201d he said. \u201cAnd I can tell you a secret. Getting SOC2 compliance for five employees is much easier than for 500 employees.\u201d\u00a0<\/p>\n

The next most important step for startups is to think about architecture, he said. \u00a0<\/p>\n

\u201cIf\u00a0you\u2019re\u00a0an AI startup that wants to focus on enterprise from day one, you\u00a0have to\u00a0think about an architecture that allows the data of the customer to stay \u2026 in the customer environment.\u201d\u00a0<\/p>\n

For cybersecurity startups looking to step into the field in the age of AI, Luttwak says now\u2019s the time. Everything from phishing protection and email security to malware and endpoint protection is fertile ground for innovation \u201a both for attackers and defenders. The same is true for startups that could help with workflow and automation tools to do \u201cvibe security,\u201d since many security teams still don\u2019t know how to use AI to defend against AI.\u00a0<\/p>\n

\u201cThe game is open,\u201d Luttwak said. \u201cIf every area of security now has new attacks, then it means we have to rethink every part of security.\u201d\u00a0<\/p>\n","protected":false},"excerpt":{"rendered":"\u201cOne of the key things to understand about cybersecurity is that it\u2019s a mind game,\u201d Ami Luttwak, chief…\n","protected":false},"author":2,"featured_media":91722,"comment_status":"","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[261],"tags":[291,59612,289,290,982,18,19,17,82,59613],"class_list":{"0":"post-91721","1":"post","2":"type-post","3":"status-publish","4":"format-standard","5":"has-post-thumbnail","7":"category-artificial-intelligence","8":"tag-ai","9":"tag-ami-luttwak","10":"tag-artificial-intelligence","11":"tag-artificialintelligence","12":"tag-cybersecurity","13":"tag-eire","14":"tag-ie","15":"tag-ireland","16":"tag-technology","17":"tag-wiz"},"share_on_mastodon":{"url":"","error":""},"_links":{"self":[{"href":"https:\/\/www.europesays.com\/ie\/wp-json\/wp\/v2\/posts\/91721","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.europesays.com\/ie\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.europesays.com\/ie\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.europesays.com\/ie\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.europesays.com\/ie\/wp-json\/wp\/v2\/comments?post=91721"}],"version-history":[{"count":0,"href":"https:\/\/www.europesays.com\/ie\/wp-json\/wp\/v2\/posts\/91721\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.europesays.com\/ie\/wp-json\/wp\/v2\/media\/91722"}],"wp:attachment":[{"href":"https:\/\/www.europesays.com\/ie\/wp-json\/wp\/v2\/media?parent=91721"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.europesays.com\/ie\/wp-json\/wp\/v2\/categories?post=91721"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.europesays.com\/ie\/wp-json\/wp\/v2\/tags?post=91721"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}