AI
Three Past Shifts Prove the Industry Adapts
Westelius walked through three historical crises. The early internet had no encryption. Traffic moved in plain text. Certificates were expensive and painful. Organizations like Let’s Encrypt made them free and automated. The worm outbreaks — Love Bug infected 10 million Windows devices — forced patching and vulnerability management into a discipline. Networks were redesigned with blast radius reduction. The cloud shift at Netflix started with a three-day database corruption that stopped DVD shipments. The company spent seven years rebuilding infrastructure natively in the cloud.
Six Reasons for Optimism
Westelius listed six reasons the industry is better positioned. Security leaders now sit in boardrooms. Casey noted that the idea of a hacker as a strategic asset was absurd 10 years ago. Human risk management treats employees as the best line of defense instead of the problem. The industry is correcting away from vendors that produce volume over substance. The barrier to entry to become a security expert has never been lower. AI tools can now read and transform legacy code bases at scale.
Legacy Code Finally Becomes Tractable
Fixing legacy systems has been the industry’s hardest problem. Jen shared that AI is beginning to take on decades-old software full of flaws and defects. Clint said burning down a decade of legacy risk now feels achievable, not mythical. Westelius emphasized that security is now positioned to be in the conversation from design through implementation. Providers are investing in security teams and shifting left.
The Community’s Role in the Next Phase
Westelius called on practitioners to share ideas broadly. She pointed to nonprofits like the FIDO Alliance and Let’s Encrypt as connective tissue. She asked attendees to engage with volunteer-driven groups. Information sharing during zero-day crises — one team’s painful lesson becomes everyone’s early warning — is the community’s superpower. She urged attendees to pick one thing in their sphere of influence and start this weekend.
Notable Quotes
what makes me optimistic about security’s future is how far we’ve come in shifting from purely technical discipline to one with genuine institutional and political influence. Casey · ▶ 22:25
for the first time, burning down a decade of legacy risk feels achievable, not mythical. Clint · ▶ 30:21
Success in this is not going to be pre-ordained and it won’t come easy. AI has the potential to be destabilizing in the short term. We’ll face new threats. Adversaries are adopting these tools too and will become more capable, more efficient and more dangerous. But so will we. Matt · ▶ 31:43
Key Takeaways
- The industry has overcome three major shifts before and can handle the current one.
- AI tools make legacy code tractable for the first time.
- Security practitioners must share ideas and engage with nonprofits.
About the Speaker(s)
Anna Westelius is a Scandinavian expat and former Security Researcher, Analyst & hacking enthusiast turned technology strategist, and security leader. Occasional public speaker. Passionate about solving big, complex, problems and building inclusive, motivated, and successful teams. Currently leading security, privacy, and assurance at Netflix.