Cybersecurity has developed an interesting new problem. We are getting better at finding holes in software, but that does not necessarily mean we are getting better at closing them.
Artificial intelligence is changing vulnerability research because machines can now examine enormous amounts of code and identify potential weaknesses at a speed that would be impossible for a human team. That is good news for defenders. It is also a reminder that vulnerability discovery is only the first step. After somebody finds the hole, somebody still has to decide whether it matters, notify the developer, build a patch, test it and get that patch onto the systems that actually need it.
That is the problem the Trump administration's Gold Eagle initiative is trying to attack. The federal program is designed to coordinate vulnerability discovery and remediation across government, researchers, software developers and critical-infrastructure operators. Its use of VINCE gives the effort an existing technical foundation rather than requiring the government to build the entire system from scratch.
That is a sensible approach because the cybersecurity industry already has plenty of smart people and plenty of security products. What it does not always have is coordination. AI could make that problem larger by generating vulnerability reports faster than organizations can process them. The danger is not just missing a serious vulnerability. It is burying that vulnerability beneath thousands of less important findings.
There are already private-sector projects trying to deal with this. Akrites, backed by the Linux Foundation and technology companies, focuses on open-source vulnerability discovery and coordination. Athena represents another effort involving major technology companies and security organizations. Gold Eagle will be most useful if it connects to this ecosystem rather than attempting to replace it.
That matters because the cyber threat does not stop at the edge of government networks. It reaches the phone in your pocket, the laptop on a kitchen table and the software running inside a multinational corporation.
Look at WhatsApp. Microsoft researchers recently documented a campaign using malicious Visual Basic Script files delivered through WhatsApp messages. Once executed, the scripts began a multi-stage infection process that could establish persistence and remote access. Kaspersky separately reported a campaign using malicious VBS files to install ManageEngine RMM Central. In other words, attackers were not necessarily trying to sneak some exotic piece of malware onto a machine. They were abusing legitimate tools designed to help administrators manage computers.
That is becoming a recurring cybersecurity problem. The software itself may be legitimate. The cloud service may be legitimate. The messaging platform may be legitimate. The malicious part is what the attacker is doing with them. Security teams therefore have to become better at understanding behavior rather than simply hunting for suspicious files with suspicious names.
Meanwhile, criminals continue to prove that you do not need an AI supercomputer to fool somebody. Sign-in scams are a perfect example. A fake security warning tells the user that something terrible has happened, displays fabricated information about supposed infections or account problems and then offers a convenient solution, usually involving the purchase of security software. It is essentially a digital burglar standing outside your house yelling that burglars are coming, then offering to sell you a lock. The technique works because fear is still remarkably efficient at pushing malware.
Nation-state operators have figured this out too. North Korean hackers have used fake cryptocurrency companies and job recruiters to target technology workers. The attacks can involve fake interviews, fake companies and technical assessments that eventually lead victims toward malware. Researchers reported that one campaign targeted at least 230 people.
The important point is that none of these attacks exist in isolation. The vulnerability in a piece of software, the malicious WhatsApp attachment, the fake security warning and the fake recruiter all exploit different parts of the same digital ecosystem. Modern cybersecurity is therefore as much about identity, trust and behavior as it is about firewalls and patches.
That brings us to AI policy. There is a temptation to look at the obvious risks of AI and conclude that the safest approach is to regulate the technology as heavily as possible. That is not necessarily the safest approach for the United States. If America slows its own development while adversaries continue investing in AI, the country could end up with less technological leverage and fewer defensive capabilities.
The better strategy is to keep moving while taking the security problem seriously. AI should be used aggressively to help defenders analyze code, detect anomalies, prioritize vulnerabilities and process threat intelligence. At the same time, security teams need to recognize that attackers are using the same technology to scale phishing, impersonation, reconnaissance and malware development.
That is where Gold Eagle becomes interesting. It is an attempt to solve a problem that is easy to underestimate: information has value only if it reaches the right person in time. A vulnerability discovered six months before exploitation can be enormously valuable. A vulnerability discovered six minutes before exploitation can be just as useful if somebody can actually get it fixed.
The administration deserves credit for recognizing that speed matters. The private sector deserves credit for building many of the systems that already exist. Researchers deserve credit for finding the holes. The next challenge is making all of them work together.
Because the attackers are already doing exactly that. They are combining legitimate software, social engineering, cloud infrastructure, stolen identities and increasingly capable automation. The defensive side needs to be just as coordinated.
AI is going to make cybersecurity faster. Gold Eagle is an attempt to make the response faster too. That is a race worth winning.
Julio Rivera is a business and political strategist, cybersecurity researcher, founder of ItFunk.org and ReactionaryTimes.com, and a political commentator and columnist. His writing, focused on cybersecurity and politics, has appeared in major publications around the world.