The Least Secure Day of the Rest of Your Life

For years I’ve joked that “today is the most secure your digital life will ever be.” Tomorrow brings another dependency, another CVE, another bug nobody has found yet. Security as entropy. It only ever gets worse.

I’m no longer sure the joke holds.

Just in the past few weeks: Capital One shipped an AI that audits code like an attacker and tries to disprove its own findings before reporting them. An AI auditor found a critical bug in OpenVM that became a CVE. A research team used AI to compress months of elite exploit development into a blog series.

Attackers get these tools too, so the next few years could be rough. But every vulnerability eventually leaves the “unknown” pool through one of two doors. Found and patched quietly, or exploited, detected, and patched loudly. Either way, the pool drains. A used zero-day is no longer a zero-day. The race between attackers and defenders only decides how much the draining hurts.

Meanwhile, AI is making software cheaper to build, which means we’re about to build a lot more of it, bugs included. So if you do nothing, your app still gets less secure every day. The default hasn’t changed.

The choice has. You can point these same tools at your own code: keep it upgraded, audit it continuously, patch what turns up. That’s what we mean by stewardship, and until now it could only slow the decay. Today it can reverse it. Fewer unknown bugs in your app than yesterday, and fewer tomorrow than today, with each one leaving through the quiet door on your schedule instead of the loud one on an attacker’s.

Getting more secure over time wasn’t really on the menu before. Software decayed, and the only question was how fast.

One day soon, “today” won’t be the most secure day of your digital life.

It may be the least secure day of the rest of it.

Want the full argument, objections and all? Here’s the long version. Or just reach out and we can talk it through.