Microsoft says traditional cybersecurity can't keep up with AI, and wants to build an entirely new 'Cyber Stack'

[SuperPosition52]

Microsoft Security EVP Hayete Gallot published a post arguing that the fundamental physics of cybersecurity are changing, since autonomous AI systems can now reason, adapt and operate continuously, while the cost of mounting an attack keeps falling even as the volume, speed and complexity of what needs defending keeps growing. Her core argument is that security approaches built around human paced threats simply cannot keep pace with a world of AI agents and machine speed attacks, and that the industry needs an entirely new architecture she calls the Cyber Stack

That new stack, as described, needs to continuously perceive risk across an organization's entire digital footprint, reason across enormous amounts of context rather than working from narrow, siloed signals, and take action at machine speed rather than waiting for a human to review and approve every response. Crucially, Gallot frames this as needing to keep humans central to the mission even while operating at machine speed, meaning the goal isn't replacing security teams but giving them dramatically more powerful tools and clearer insight so they can act faster themselves

This lands the same week as Nvidia's new Open Secure AI Alliance and Bloomberg's reporting on record breaking vulnerability discovery numbers, painting a consistent industry wide picture, major security vendors are converging on the same diagnosis that the old model of periodic scans, scheduled patch cycles and human reviewed alerts genuinely cannot keep up with AI accelerated attacks anymore, even as they compete on exactly how the replacement architecture should actually be built and who should control it

Rethinking security for the age of AI - The Official Microsoft Blogblogs.microsoft.com

[FreeKickKing73]

The physics of cybersecurity changing is a striking way to frame this, it's not just more attacks, it's a fundamentally different speed and cost structure for both offense and defense

[GoalPoacher42]

Keeping humans central to the mission while operating at machine speed is the tension every single one of these new security architectures has to actually solve, that's easy to state as a principle and genuinely hard to build in practice

[Northernah]

This landing the same week as Nvidia's Open Secure AI Alliance and the record vulnerability numbers story is not a coincidence, the entire security industry is clearly responding to the same underlying shift in real time

[ECWAlex98]

Reasoning across vast context rather than siloed signals is exactly the capability gap that's let sophisticated attacks slip through traditional security tools for years, worth seeing whether this actually gets solved rather than just described

[GhostRider63]

Worth remembering Microsoft has genuine self interest here too, being the company that defines the new Cyber Stack standard is a massive strategic and commercial win regardless of how necessary the shift is

[LifeAdmin]

The falling cost of offense while defense complexity grows is the actual structural problem underneath all of this, that asymmetry is what makes the old human paced model unsustainable now

[Thor]

This connects directly to the record 622 vulnerability Patch Tuesday story, that's a live, concrete example of exactly the volume and speed problem this new Cyber Stack framing is trying to address

[Ruby_50]

Appreciate that this isn't purely a product pitch, the framing around perceiving, reasoning and acting as three distinct capabilities gives an useful mental model for evaluating any security vendor's AI claims