Sep 23, 2025 · 1h 0m · big-technology
Is Generative AI a Cybersecurity Disaster Waiting to Happen? — With Yinon Costica
0:00 / 0:00
▶ Watch on YouTube →
gold bands on the timeline = statements, start to end. Hover to read, click to jump. CC turns on captions
Wiz co-founder Yinon Costica joins Alex Kantrowitz to examine the intersection of generative AI and cybersecurity, explaining why foundational cloud hygiene, human accountability in coding, and proactive defense matter far more than sensationalized AI threat narratives.
How this conversation actually went
Every chapter scored 0–10 on four independent dynamics. Hover any point for the reasoning behind the score. Alex holds 26.2% of the talking time here. How this is scored →
Alex as informed peer 4.8 Guest teaching 5.0 Guest disagreement 1.7 Alex pushing back 3.3
speaking balance: gold is Alex, purple is the guest (3 minute bins)
Sharpest disagreement ▶ 47:15 Costica rejects hypothetical superintelligence doom framing
Costica brushes aside Kantrowitz's apocalyptic thought experiment about superintelligence deleting competitors, insisting on reframing the problem around defensive engineering and historical precedent.
Hardest push from Alex ▶ 39:50 Host challenges Wiz's DeepSeek vulnerability reportingKantrowitz directly challenges Costica on Wiz's blog post regarding DeepSeek, asserting that Wiz sensationalized a routine database exposure that happens across tech companies every day.
Biggest teaching moment ▶ 20:10 Costica details attacker-defender asymmetry and alert fatigueCostica educates Kantrowitz on the mathematical asymmetry of defense using the fire alarm story, demonstrating that false-positive noise is far more destructive to security operations than sophisticated attack tools.
Alex holds their own ▶ 53:35 Host demands analysis beyond founder optimismKantrowitz demonstrates sharp interviewing acumen by explicitly preempting Costica's default vendor optimism and forcing a concrete analysis of catastrophic physical IoT attack vectors.
the scores for every segment, with the reasoning behind each
| Chapter | Topic | Alex as informed peer | Guest teaching | Guest disagreement | Alex pushing back | Why |
|---|---|---|---|---|---|---|
| Securing AI Infrastructure and Cloud Data Storage | 4 | 7 | 1 | 2 | Costica educates Kantrowitz on why cloud infrastructure misconfigurations and exposed buckets remain the primary AI vulnerability rather than novel prompt exploits. Kantrowitz translates the technical concepts for the audience and asks clarifying questions. | |
| Vibe Coding and Software Ownership Challenges | 4 | 6 | 2 | 2 | Costica discusses the implications of vibe coding, highlighting that automated coding creates long-term ownership and maintenance liabilities. Kantrowitz follows along, asking if real-world breaches from vibe-coded apps are already appearing. | |
| Agentic Workflows and Accountability in Code Maintenance | 5 | 4 | 2 | 5 | Kantrowitz challenges the vision of using AI agents to review code generated by other AI agents, arguing it compounds vulnerability and removes human diagnostic competency. Costica clarifies that human accountability remains essential regardless of automation. | |
| Threat Actor AI Utilization and Defender Asymmetry | 4 | 7 | 1 | 1 | Costica breaks down the trifecta of AI attack surfaces and details the severe asymmetry between attackers and defenders, illustrating noise overwhelm with a fire alarm anecdote. Kantrowitz relates the dynamic to a DDoS attack on human security personnel. | |
| The Business of Cybercrime and Current Threat Realities | 5 | 5 | 2 | 4 | Kantrowitz presses Costica on whether generative AI has actually caused an exponential escalation in breaches since ChatGPT's debut. Costica explains that cybercrime is run like a business and current threat levels remain largely 'more of the same' due to improving foundational defenses. | |
| AI-Driven Vulnerability Research and Zero-Day Threats | 4 | 6 | 1 | 1 | Costica explains zero-day vulnerabilities and how automated AI vulnerability research could trigger a high-speed discovery race. Kantrowitz synthesizes how automated security tools mirror broader AI enterprise adoption trends. | |
| Wiz Cloud Architecture and the Google Acquisition | 5 | 4 | 1 | 1 | Kantrowitz inquires about the strategic drivers behind Google's $32B planned acquisition of Wiz, noting Google Cloud's recent growth. Costica contextualizes AI as the third major migration wave to the cloud following cloud natives and the COVID-19 remote shift. | |
| The DeepSeek Security Incident and Media Hype | 7 | 4 | 3 | 7 | Kantrowitz pushes back directly on Wiz's viral research report on DeepSeek, arguing the company sensationalized a routine database misconfiguration that happens across the industry. Costica defends the disclosure while acknowledging the media amplified the geopolitical framing. | |
| Superintelligence Concerns and Proactive AI Security | 5 | 4 | 3 | 6 | Kantrowitz presents a hypothetical superintelligence scenario and tells Costica he is underrating existential risks due to industry optimism. Costica counters by pointing out that modern AI security discussions are happening proactively at the architecture stage rather than as an afterthought. | |
| Quantum Computing Risks and Post-Quantum Cryptography | 5 | 5 | 2 | 6 | Kantrowitz challenges Costica to provide a realistic assessment of physical robotics and vehicle hacking risks without relying on canned optimism. Costica responds by explaining how threat actors creatively weaponize ordinary IoT devices for massive indirect disruption. | |
| Democratized Cybersecurity, AI Deepfakes, and Conclusion | 5 | 3 | 1 | 1 | The conversation concludes with practical discussion around democratized security, AI voice cloning, and social engineering vigilance. Kantrowitz closes by balancing his initial alarmist assumptions with Costica's pragmatic optimism. |
Statements from this episode (15)
Costica: Four of six AI technologies at Pwn2Own had critical RCE vulnerabilities
“Six technologies were presented. Out of these six technologies, four were actually Researched and found to be vulnerable at what we call the highest impactful vulnerability, which is remote code execution, RCE, which means that you can do anything with the tec…”
Costica: AI security relies on standard cloud infrastructure fundamentals
“When we think about AI, it's not all new. It's new software. It's existing infrastructure. And when we think about securing it, the basics apply. And it's very important to remember it. The fundamentals apply. The fundamentals of patching vulnerabilities, secu…”
Costica: Most AI security incidents stem from insecure cloud infrastructure
“Actually, when we look at AI related incidents, the majority of them is within this layer of Using the infrastructure in an insecure manner that allows threat actors to just do what they are used to do in cloud in the past.”
Costica: Vibe coding does not absolve developers of understanding their code
“The way I'm looking at it is that vibing code is a great way to accelerate, but it doesn't remove you from the responsibility of actually knowing your code, being able to address issues within the code, and guide AI farther into the, you know, maintenance proc…”
Costica: AI automation disproportionately benefits cyber attackers over cybersecurity defenders
“And now with AI, the interesting thing that the threat actors can automate a lot more, but from a defense perspective, it doesn't give me the same order of magnitude of, let's say, improvement that the threat actor can gain. So, in essence, there is an aggrava…”
Costica: Security teams must prioritize foundational hygiene over alert detection
“It's actually reducing the noise by investing more in the fundamentals and less on the detection. Ok, so if we are always trying to detect It's going to be hard. We're going to be bombarded with alerts. If we're proactively reducing the risk and the chance of …”
Costica: Ransomware groups reliably return data to protect their business reputation
“If you think about ransomware, it's a business. It has rules to it, right? You know, when you pay the ransom, you get the data, right? It's a rule. You don't, you're not tricked into it because it's a business and they need to maintain their reputation.”
Costica: AI currently only accelerates automation of existing cyber risks
“AI is another layer that allows us to automate more right now. Okay, I'm not talking, because we're not seeing the crazy new threats yet, we are right now at the phase where we're seeing accelerated automation of the known threats, known risks, and this is a j…”
Costica: Vulnerability research is the primary bottleneck in cybersecurity
“The ability to research and find vulnerabilities, this is kind of the bottleneck of the security space, ok? Because vulnerabilities are what allow threat actors to move from, you know, lower trust to higher trust environments”
Costica: Almost 10% of organizations adopted DeepSeek within one week
“Within a week, almost 10% of organizations were using DeepSeq.”
Costica: DeepSeek's database leak was a typical cloud exposure, not an exotic exploit
“It was a very, ah, what I would say, typical exposure that exposed a lot of sensitive data, but yet, ah, if we look historically, there were similar incidents, for instance, with Microsoft releasing a token that had access to sensitive data in, you know, a buc…”
Costica: AI Security Is Being Addressed Much Earlier Than Prior Tech Waves
“And the concepts behind, I think, today, AI security are actually well thought today rather than much later. And it shows a bit on the maturity of not only the security teams, by the way, it shows a lot on the maturity of the industry that we are having the di…”
Costica: Hackers steal encrypted data now to decrypt with future quantum computing
“I think the one thing that has changed around quantum computing is a sort of, maybe it is closer than we think, and then the threat actors are, you know, stealing data now, so they will be able to decrypt it later once they, you know, figure it out.”
Costica: Cybersecurity cannot scale without democratizing responsibility to all employees
“Because if we think about just security teams doing security for the whole world, it's not going to scale. But if we think about our responsibility as employees, humans, developers, Security teams, IT teams, and how can we contribute to this resilience of our …”