Posts tagged autonomous defence.

Google's Beyond Zero moves the trust boundary from the application to the individual action and puts a reasoning layer in the access path. The objection that landed on Hacker News, that a non-deterministic evaluator does not belong there, is aimed one layer too low. The gap is not determinism. It is legitimacy: nothing establishes that a given system has the standing to act in your environment, against your traffic, under your conditions. Vendor-asserted accuracy is not evidence.

Autonomous mitigations already act at machine speed - but we still have no legitimate framework for granting them authority over novel threats.

Machines attack at machine speed. Humans defend at human speed. We propose a governance framework for closing that gap, not through blind trust but through demonstrated competence.