Why Do Breaches Happen With No Vulnerabilities?

George Kurtz says software with zero vulnerabilities will still be breached, because a lot of the activity is people logging in rather than breaking in, and identity is the weak point.

The only way to fight AI today is with better AI. Defenders know their own systems, the architectural diagrams, and the code, which can raise the odds of outsmarting offensive AI. If most code is agent-written, stronger security architecture can be enforced. Engineers are limited in number and capacity, and teams move fast. Agents have infinite patience and can scale with compute or with spending. In his view, software might end up more secure, and today's code is probably good enough to help, though models were also trained on code that may have had issues. He builds his own apps and runs a security agent that reviews the code. The model writes the code, then the model's security app flags the same code as insecure.

Fewer vulnerabilities would still help, but the long tail remains. Microsoft keeps backward compatibility, so some old flaws never get fixed or modernized. The rest of the software out there will not be repaired overnight.