The AI security question leaders should be asking instead
Gremlin security officer Frederic Bull argues AI has eroded the attacker-defender skill asymmetry while least-privilege controls remain essential for securing AI agents.
In a Help Net Security interview, Gremlin Security Officer Frederic Bull says AI has narrowed the expertise gap between attackers and defenders, enabling faster exploit discovery even by less-skilled actors. His team processed roughly nine times more vulnerabilities in the past year with unchanged staffing using LLM-based tooling, cutting time-to-remediate by about 5%. He argues least privilege, session-based RBAC via OIDC/OBO, and human-in-the-loop oversight remain the bedrock defenses for AI agents, and that hiring should favor engineers able to catch confidently wrong AI output.
- AI narrows the attacker-defender skill asymmetry, letting less-skilled actors devise exploits faster.
- Gremlin processed 9x more vulnerabilities with the same staff, reducing TTR by about 5%.
- Least privilege, RBAC, and human-in-the-loop controls remain key defenses for AI agents.
- Hiring now prioritizes experience to detect confidently wrong AI outputs.
- Organizations
- Gremlin
From the original article
5 min read at helpnetsecurity.com
In this Help Net Security interview, Frederic Bull, Security Officer at Gremlin, talks about what AI means for security teams. The conversation covers why asking what data a model was trained on is only part of the picture, and why least privilege and access controls still matter for AI agents.
By Mirko Zorz · helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.