AI is ending the era of scarce vulnerabilities, making powerful offensive capabilities abundant and pushing cybersecurity teams to move beyond reactive patching toward fundamentally safer software construction.

That reality was the core of a Black Hat USA keynote from David Weston (pictured), corporate vice president of AI security at Microsoft Corp., titled “The End of Rare: Defending When Offense Is Cheap.” Traditional defenses have long rested on the economics of scarcity — expensive zero-days, strong security boundaries and the assumption that those walls would hold, he explained.

“We’ve baked this in,” he said. “We said we’re safe because this is rare and it costs a lot. Unfortunately, AI’s changed this. It’s no longer rare.”

Weston spoke with theCUBE Research’s Krista Case at Black Hat USA, during an exclusive broadcast on theCUBE, SiliconANGLE Media’s livestreaming studio. They discussed why security teams must invest AI-driven productivity gains into safer software construction, memory-safe languages and formal verification rather than trying to outpace attackers with faster patches. (* Disclosure below.)

Changing the physics of safer software construction

Simply accelerating patches remains a reactive strategy that gives attackers an opening, especially when adversaries aren’t constrained by the compliance and development processes that slow defenders, Weston noted. Organizations can instead invest AI-driven productivity gains in building new software or converting existing code with memory-safe languages such as Rust.

“What AI is doing is making everyone more productive, particularly engineers,” he said. “Let’s invest that productivity in changing the physics.”

Google LLC’s experience illustrates the potential, according to Weston. In 2019, memory-safety issues accounted for roughly 75% of its vulnerabilities. By 2025, that share had fallen below 20%, with no new memory-safety vulnerabilities reported across 5 million lines of newly written safer code. Because memory-safe languages can’t eliminate every class of flaw, Weston also urged security teams to identify their most critical code boundaries and use formal verification to mathematically test whether program logic can fail.

“In Microsoft’s case … we were able to get a massive production increase by using agents to do this,” Weston said. “We found one that would have been pretty catastrophic had we shipped it, and it passed all the tests … all the analysis of human experts. Apple [Inc.] had a similar case.”

Here’s the complete video interview, part of SiliconANGLE’s and theCUBE’s coverage of Black Hat USA 2026:

(* Disclosure: TheCUBE is a paid media partner for Black Hat USA. Sponsors of theCUBE’s event coverage do not have editorial control over content on theCUBE or SiliconANGLE.)

Photo: SiliconANGLE