Offense · Defense

Both sides
have agents now.

An attacking agent needs to be right once. A defending agent needs to not be wrong. That asymmetry has always shaped security work — these are notes on what happens to it when both sides run at machine speed.

Recent

  1. A bit is not a counter

    Measuring how fast memory changes, when the kernel will only tell you whether it changed. A page-frequency instrument, its validation against known workloads, and the negative result that separates it from symbol profiling.

  2. The asymmetry does not survive contact

    Attackers need one path to work. Defenders need every path closed. Automation was supposed to help the side with more work to do — so far it has helped the side with less. The exception is detection: the attacking agent has to run its loop on your ground.

All writing