Resilient Cyber · 2026-06-18 · 41 min
Niels Provos on why you don't need a frontier model to find zero days, why the Vulnpocalypse is overstated, and how security invariants change the game. Description Niels Provos has spent twenty-five years in security, from writing bcrypt to running security at Google and Stripe, and he came on to push back on the panic around AI and vulnerabilities. He explains why finding zero days is an orchestration problem rather than a frontier-model problem, using his Iron Curtain runtime and an open-weight model to surface net-new bugs for the cost of a cheap scan. We get into security invariants and egress control, why remediation is the real bottleneck, why AI coding tools ignore the security abstractions you build, and why someone this technical keeps coming back to incentives over technology. Key takeaways You don't need a frontier model to find zero days. Niels used his Iron Curtain runtime and an open-weight model to surface net-new vulnerabilities, which is why he calls this an orchestration problem rather than a frontier-model problem. The Vulnpocalypse framing is overstated.
Rain Versus Flood, Making Sense of the 2026 CVE Surge76 / 100AI Industrialized the Vuln Lifecycle and Broke the System of RecordAI Is Winning the Cyber Arms RaceSecuring the Agentic SDLCThe Agentic GRC Revolution