“Attacks are becoming agentic. The cost per token for attackers is going towards zero. And the cost for defenders is staying quite high. And so it is very important for us to find ways for defenders to have cheaper options.”
Decoder with Nilay Patel · Tech Strategy & Big Tech · November 2026
Context
Nilay Patel said a flood of capable attackers changes the economics of security, since you can't easily make attacks expensive. Stamos answers that defense has to get cheaper instead, and says few people are working on that.
Transcript
wasted the headline. You wish you held it back.
…a bunch of teenagers are going to be even more malicious. It's a bunch of bad actors with real incentives to do harm are now vastly more capable than they were before. And that doesn't seem like you can re-jigger the economics of that unless you somehow make it really expensive to do the attacks.
I think it's going to be extremely hard to make it expensive to do the attacks. We're going to have to lower the cost of defense. And you're completely right to look at this economic problem because what's happening is attacks are becoming agentic. The cost per token for attackers is going towards zero. And the cost for defenders is staying quite high. And so it is very important for us to find ways for defenders to have cheaper options. And I think that is critical. So that's something I am personally extremely focused on. And I think, to be frank, very few people are. There's a couple of problems here. One, there's a ton of focus on the defensive side of AI on finding and fixing bugs. That's great. It's important. But software security as a CISO, like I work for an AI software company, Cognition. Even as a CISO of a software…
me an example of the other things, the 75%.
Okay, so like the operational security side is watching your logs, looking at, ah, somebody is running our techs against us. I am now going to trigger an investigation. I am going to look to see what is going on and I'm going to make an intelligent decision of what I'm going to do to respond to…
You've been asked to run the company's social channels, but company content plays by its own set of rules. It needs a logo in the first three seconds, but it can't feel like an ad. It needs subtitles, except when it doesn't. It needs to run at two times speed and deliver a complex message. Simply…
More from Decoder with Nilay Patel
