AI Changing the Security Game

Transcript

Thank you very much. Well, hello everyone. Uh, welcome and thank you very much also for to the DSS team for making this happen. Um, I know that being a volunteer sometimes is hard. So, thank you very much. And also, thank you very much for all of you for coming on a Friday at 10:00 a.m. If you're here, it means that you have not been at RAV or that you are incorporating Yerba Mate in your morning routine. So, either of both, that's fine. Today I'm going to be talking about how AI is changing the security game. And although I'm not going to be going into any kind of like technical or deep workflow on this presentation, but we can debate anything like similar to that afterwards. More than happy to take any questions or

speak about the technical aspects. But as a quick intro to myself, so I'm part of the Spirit and Canina team. uh do solutions engineering mostly which is just like try finding out how to try and solve a problem. Um let's just write hop right into it. So okay first right before I before I start if I were to point at you how many of you I'm not going to put you on the spot but how many of you would be able to define what a large language model is with confidence like raise your hand.

Okay, if you're at home, you can also raise your hand, although I won't see it. And what about an AI agent? Okay, so that's like 50% pretty much of the room here. That's great because that means that we won't have to be spending a big time on the recap. Although I think that doing a quick recap also like for those that are at home may be important and of relevance. But just to keep going. So as we know a large language model so it's a type of uh artificial intelligence system that uses deep learning in order to process large chunks of data in order to generate um generate words etc and um perform complex natural language tasks right and

this is important to know because I want you to keep always in mind what are LLMs and what are AI agents throughout the whole presentation as these are the foundation on which the whole game is actually changing. And this said, AI agents are fully autonomous systems that operate independently over an extended period of time using various tools to accomplish complex tasks. So I also would like to mention that the efficiency of the agent is highly correlated to the quality of the foundational model that it's using. So for example, if you're if you have I don't know cloud code or codeex with GPT2 that is very far away from being

able to accomplish a complex tasks, right? So the better that these LLMs get, the better these agents get and the more stuff they can get done. And I've put this diagram I've been using for some time ago, but I think it does represent very well like all these different modules that would create what an agent actually is. So memory engine tooling reasoning uh their reinforcement learning training pipeline and so forth. So this is a small little chart that I just wanted to put here in order to show you guys the interest of regular users, the regular people searching on the internet for topics and words such as LLM or cursoric AI. And this is just to convey the point that there is a major

trend obviously speaking and then after cloud code was released this year the interest for large language model and AI systems has increased. So there is even more people coming in. What does this mean? Well let's quickly do a quick you know you know understanding of where we at right now. So how this has been progressing since 21 right? So since 21 before if you were using GPT2 or if you were using Dainci or something like this you would just like type stuff and then the model would keep continue generating most times some nonsense. And this is a fun one because in 22 we were trying uh Davinci to uh we are trying it and see

if it could find re-entry vulnerabilities. Um I mean mostly 90% of the cases it didn't but that 10% was pretty impressive. So we already knew that there was something very big coming and how this was going to be changing the uh AI and the security game. So then the LLMs were able to follow instructions. So you would interact with chat GPT and you would tell it write in this particular style or give me the output in a JSON format and it would do it. Great progress. Then in 23 all these agentic open-source systems became more mainstream such as lankchain and essentially here people would take an LLM and would wrap it in a loop and then

would pass the output of that LLM to another one and then you would start to develop what they are called workflows. So after that multimodel so text um uh images, video everything was being processed and in 23 24 it went to actually first AR workflows that many companies starting to incorporate in their own operations and right now we are in the 2024 25 era of autonomous collaborators. So putting things into perspective, VIP coding, we all know about it. All the new developers that are coming in, they're using AI in one way or the other. And GitHub reported that the last year, like 2025, this year, they had an

exponential increase in the user base only because most of these people are on boarding using AI. Corporations, startups, hackathons, everyone is using AI right now in order to develop something. If you're a founder, then you don't have to be technical anymore. you're just using this AI systems in order to build stuff. Um, Etheum, the Ethereum Foundation also is has an AI department and they're trying to figure out how these AI agents are going to be interacting on chain. So, the whole economy is being positioned towards usage of AI. So, this is not a small trend like everything is just changing and especially corporations, they're laying off at lots and lots of people because they found out that they can automate lots of these processes with with AI. Now because we have VIP hacking

uh sorry VIP coding we also have vibe hacking and this is a problem because these AI systems they are very powerful. So if it gets in the wrong hands it can do real damage. For example uh China, North Korea other various APS the uh they are using this underlying systems in order to automate the whole uh what you would call the cyber kill chain uh process. So they just like so from this report it was very funny because the Chinese they managed to jailbreak cloud code and make it hack systems and it actually did infiltrate many of them. So everyone in the IT world IT leaders and also CISO security researchers do really see this as a threat that has to be uh

defended against. So that's what is happening also in traditional security. uh everyone is moving towards the usage of AI or this autonomous agents for pretty much automating more than they could do before. So if before you had an analyst that would had to go through everything manually then we had better computing. So we introduced automation which is just machines following instructions but these were still very very constrained and now we have the agents which machines pursue outcomes and goals and you can see how many of these big companies are uh switching all their operation defense towards agentic systems and well of course web 3 is also doing it. This is just like a couple of

companies a handful of them. So if there's many more then just please let me know about them. But we are still very nent as an industry in this uh in this regard because as you can see most companies seem to be trying to solve the smart contract audit and CI/CD integration issue for code reviews. But there aren't many that are focusing on introducing AI at the monitory and defensive level and on the investigations side of things and the forensic side of thing only a couple of very big ones have the whole monopoly.

So I do really see that many more web3 security companies are going to start introducing new products to that that going to solve this uh these problems. So just to reiterate this is a structural trend. It is not to fade. lots of investment is going into it. The whole market is changing. The whole way that security is being done is also changing. So if you haven't used AI recently, maybe you should do so. But we can also figure out what are people doing. A couple of days ago, I run a survey. I shared on multiple channels where security researchers like to hang out and it's just to get a sense an idea of what how are these security researchers using the AI systems. So the first question is are you currently

using AI tools uh in your web 3 or smart contract security work and as you can see 62% of them are using them daily. So this already demonstrates complete integration if uh not to do so like there's everyone is using them. So when did they start using them for work? And now this is interesting. 50% of respondents out of 90 responses used them in started using them in 2025. This year which is also this year where cloud code introduced like the best uh uh agentic system to automate to automate tasks. So it does make sense.

31% of people were using it even before maybe GPT4 Turbo and the OGs already know what was going on even before. So how much of the smart contract a web3 security workflow involves AI assistance? So 14% of people do almost everything with AI in the loop and 23% of people they have it as a core part of their workflow. And it is interesting to see that also like a 32% of them and at 28% of them 32% 28% of them they have it as a some sort of helper. So it's not really really integrated into a workflow but we do assume that it's coming. And what do

security researchers use this for? mainly for understanding unfamiliar code that's 88% of cases for writing reports summaries and communicate with the clients and three for writing tests scripts and tooling. So this everything that they are doing here security researchers is helping them speed up their their workflows and and and processes. So more than 50% of people increase that their work speed has has gone up and also by the number of quality findings uh that folks find then it's 60% of them which is also surprising especially if you follow along the competitions then you see that

lots of them are spam but when it's about private reviews then people do seem to actually get value out of it one way or the other. So how people are feeling about all this? Well, everyone is strongly bullish, but it is very fun to see that an 11% of the respondents are somewhat bearish. So, they said that it's useful, but it's overhyped. We'll see how this uh segment evolves in the next couple of years. And this is like a small summary. So, we know that 62% of them use it daily. 72 74% integrate AI into their audit workflows. And the biggest strength for security researchers is that they can understand code faster and they can uh create proof of concepts and also find

small little vulnerabilities that they would have missed um much much more efficiently. So adoption wise this is very interesting. uh smart contracts the security researchers are still like the main line of defense and we don't really have in web 3 a defined or a standard method or framework in order to use AI on every single step of the sec DevOps like life cycle for example but we do see that many of the companies web3 companies that I mentioned before are trying to solve particular issues and if you try to predict what is going to be happening in the next six months then I would see happening something

what I call the race of the AI uh secure software development life cycle uh framework. So it would look like something like this where AI and these AI agents are going to be incorporated on every single step of the software development life cycle starting from the very beginning from the design of the product. So let's imagine we are doing lending.fi very very uh mainstream name. So lending.fi we start doing our research and see like how are how is the tokconomics going to work how are the economics of the protocol going to work and as soon as we start working on this then the AI is going to help us by looking at several reports and

vulnerabilities that are on the wild and help us uh by guiding us on what are the correct design decisions that we have to do since the very beginning. So some sort of developing your product with thread modeling in mind. Then whenever you already have your product, let's say you already know what kind of product you're going to be working on and then you start coding. As soon as you start coding all these agents, they're going to be connected probably most likely to findings databases from where they will be able to take patterns and as soon as you are coding they will see that you have done some sort of mistake. You're not using checks effects uh interaction pattern. So we automatically in real time suggest you hey uh this is not a

secure pattern maybe you should change it. Do you want to accept or do you want to reject? Well maybe only accept no reject. And of course something interesting is that if the agent has already help you design the protocol itself and it has a thread model then it can also be using certain invariance that can be constantly run in the background as you are coding in order to make sense that your code aligns with the spec that you have developed and is enforced pragmatically. And let's say that you have already coded everything is doing fine. What do you do? you you you push to GitHub. So here in the testing phase then you would have also multiple different specialist agents. Every company would very likely

be offering a different tier or you would get different value from any of them. But the point here is that because all of them are different then they all of them are going to be testing your code differently trying to find vulnerabilities and if something is found they will automatically create a PR request and they will also automatically create a fix or a suggestion. So you can see how much of the of the manual work is already being delegated to these autonomous systems. Okay, everything is clean, everything is perfect. We are going to deploy. Never push to prod. I know that you must ship, but do staging first because when you deploy to staging, they're going to have other AIs such as you may have heard of Expo, right? So, you're going to deploy

your application to to staging uh your front end, your back end, and then you're going to have like all these, let's say, uh swarm of different types of AI is trying to break into your system the same way that the North Koreans are trying to break into yours right now. And after that, let's say that everything went perfect. you deploy everything into production but you do know you do never never miss the monitoring step because the monitoring step is what actually makes you know the whole work previously done worth it. So in this case right now we are using static systems um hexagate or monitoring via uh events but right now you could have the AIS themselves

process these events because I don't know if any of you have has worked on a uh security operations center before or has done any uh work on on on the defense side of things but you are bombed by alerts. It's insane. It's like alert alert alert and many of them are false positives, right? So you still have to go through all of them and it takes a lot of time. But now these agents, these systems can sort through them and understand what is an actual threat or what isn't. So that will make the analyst's life so much easier. And if indeed one of these alerts it's actually harmful, problematic, then the agent is going to be able to respond. So you can

either have a human in the loop in order to get the notification from the agent, hey this is actually an issue. How do you want to react? Or you can automate it because if you have done the thread modeling before then you must also have incident response playbooks and the AI agents will be able to execute those uh playbooks and for example pause the protocol if something happens. So this is what I would imagine developing in the next six months where these agents are going to be integrated into every single step of the uh software development life cycle and I call it like the AISSDL and maybe after this has been implemented on the product side for 2728

I would imagine something more like this which in web 2 is already a concept it's it's rather new but it's called an intelligent security operation center or autonomous security operation center where using the previous example where we had AIS doing automation for every single step of the software development life cycle process these agents were going are going to be in charge of whole departments or I'm going to call it units much better so take into account that our lending fi example so let's say that we develop our lending fi example the product security unit is going to be all that uh all this

framework before and all these agents are going to have like very specific tasks that they're going to have to accomplish after the product is already done then and deployed then the threat intelligence unit is going to be constantly scanning on Twitter forums looking at wrecked news just in case that something happened that could have a that could affect your protocol right and if that actually affects your protocol call then this agent is going to trigger an alert and set it in such a way that you as an analyst can react to it or even better let the agent do it it uh do it itself. So if that actually happens then the agent will activate the unit defense module and that is

responding or posing uh the protocol is if if the alert really is uh really problematic. Let's say that the protocol has been paused. Now the AI at the same time sends an email to all stakeholders and also let's say uh posts uh post something on the DAO governance forum telling everyone is like hey this ISO has posted the protocol because we have detected this and the unit economic risk module has run a few simulations and has has discovered that this can actually be an issue. So now it is up to the community to unpause the protocol or to pause the protocol. And if unfortunately it does it does get hacked then the unit

forensics module is going to be investigating all these addresses and try to contact with law enforcement and centralized exchanges in order to retrieve the funds. So pure pure automation and you can take a screenshot of or a picture of this but it's just a table demonstrating why AI AI agentdriven secops is much more efficient that human wise and how this is really going to be changing the whole AI security game especially in web 3. Well, thank you for your time.