The term “security through obscurity” describes an old idea that networks and systems will remain secure so long as their architecture, along with any vulnerabilities or other weaknesses, remains secret or hidden. It was never a sound strategy for protecting sensitive assets and systems, but many organizations leaned on it due to lack of resources or complacency.<\/p>\n
Now it\u2019s obsolete. Don\u2019t believe us? Here\u2019s proof.\u00a0<\/p>\n
Software vendors and independent researchers alike are now using AI agents to find bugs<\/a>\u00a0\u2013 some very obscure<\/a> and decades old<\/a>\u00a0\u2013 across products and open source code, leading to record-breaking numbers<\/a> of security disclosures and patches, and a massive backlog for project maintainers<\/a>.<\/p>\n \u201cYou see open source platforms that have been visible to the tech community for a decade, these libraries that are run in 80 percent of web servers out there, people have stress-tested those for 10 years, and the community believed that they were really secure,\u201d Brett Leatherman, assistant director of the FBI’s Cyber Division, told The Register. \u201cThe latest models were able to break those<\/a> and say, \u2018yeah, there\u2019s significant vulnerabilities in here.\u2019\u201d<\/p>\n Whether or not security through obscurity is dead \u201cisn’t even an opinion question,\u201d Trend Micro\u2019s Zero Day Initiative chief bug hunter Dustin Childs told The Register, the day after Microsoft\u2019s record-breaking Patch Tuesday<\/a> addressed 974 CVEs.\u00a0<\/p>\n \u201cWhen you look at all of the components patched by Adobe and Microsoft yesterday, you see components no one has talked about in years,\u201d Childs said. \u201cTelnet client<\/a>\u00a0\u2013 is this even still used in any secure environment? Windows RNDIS<\/a>\u00a0\u2013 the USB-networking protocol Microsoft has been trying to deprecate for years. NFS <\/a>Portmapper<\/a>\u00a0\u2013 1980s Unix tech. And Link Layer Topology Discovery<\/a>\u00a0 \u2013 the Vista-era network-map protocol nobody’s thought about since Vista \u2013 just to name a few.\u201d<\/p>\n Meanwhile, attackers are also using AI to reverse-engineer fixes and find exploits within hours<\/a>. In one recent case, at least four espionage crews, most suspected of links to China, slammed shut the \u201cpatch-gap\u201d window<\/a> for open source Chromium, using an exploit kit developed shortly after the maintainers released an upstream patch \u2013 but before the downstream stable release was pushed to users.<\/p>\n What this means for OT security<\/p>\n During interviews at Black Hat in August, both former US National Cyber Director Chris Inglis<\/a> and John Hultquist<\/a>, chief analyst at Google Threat Intelligence Group, told us that they worry about what this means for critical operational technologies and industrial control systems (ICS).\u00a0<\/p>\n These are the systems that ensure the lights turn on when people flip a switch, gas flows out of pumps, and safe drinking water pours from faucets\u00a0\u2013 all critical services that people use daily, and assume will continue working reliably.\u00a0<\/p>\n The OT systems themselves often use obscure protocols and proprietary hardware and software, which historically made them black boxes, even to IT specialists and hackers.\u00a0<\/p>\n AI upended this assumption. It means that criminals don’t need to be OT experts to carry out destructive cyberattacks on critical networks and facilities. They just have to ask an agent to learn everything about these systems and do the dirty work for them.<\/p>\n A couple of weeks after Black Hat, five US agencies said that attackers used AI-generated exploitation scripts<\/a> to break into internet-exposed Siemens S7 Series programmable logic controllers (PLCs) at water, manufacturing, energy, and other critical facilities. \u201cThis is not a theoretical risk \u2013 it is an active threat,\u201d the feds warned.<\/p>\n AI \u201cis excellent at technical troubleshooting, at knowing obscure systems and helping you make your way through it, and this makes me very concerned about industrial control systems,\u201d Hultquist told The Register in an interview last week.\u00a0<\/p>\n \u201cThey’ve been largely secured because the expertise was in a handful of people’s heads, and that’s not going to last forever,\u201d he said.<\/p>\n AI can be a useful guide for attackers studying not just the application layer, but also the operating system, and even down into the firmware, Hultquist added. \u201cThat’s going to have implications for a lot of different areas of security, but definitely for industrial control systems.\u201d<\/p>\n However, while this undoubtedly means more work for sysadmins and defenders, burying this outdated idea of security through obscurity isn\u2019t necessarily a bad thing.<\/p>\n ‘Never a winning strategy’<\/p>\n \u201cI’ve always been of the mind that security through obscurity was never a winning strategy,\u201d Katie Moussouris<\/a>, founder and CEO of bug bounty consultancy Luta Security and the fairy godmother of bug bounties<\/a>, told The Register. \u201cBut that’s because I’ve been a hacker for so long. The argument always fails in the face of someone who decides to turn their gaze towards your organization. If there is something to find, they will find it.\u201d<\/p>\n Plus, she added, AI makes hacking a whole lot easier.\u00a0<\/p>\n \u201cPeople might not have familiarity with the particular tech stack that you’re running, but that is no longer a barrier because AI has ingested everything, and an AI is going to help them enumerate weak spots, even if they themselves are not familiar with the particular tech stack that they are pointing an AI towards,\u201d Moussouris said.<\/p>\n However, finding bugs and other weaknesses has never been the big security problem, she added. \u201cIt\u2019s triaging and prioritization and actually getting things fixed.\u201d This, Moussouris said, has also been her biggest issue<\/a> with the way that organizations implement bug bounty programs.<\/p>\n \u201cAI is shining that bright light on the wrong end of the security picture, and unfortunately, AI hasn’t caught up on the defensive side,\u201d Moussouris said. \u201cWe’re not there with AI automated patching, remediation\u00a0\u2013 anything of the sort.\u201d<\/p>\n A couple of recent studies back this up, both finding that AI-generated patches fail more than half of the time. <\/p>\n 1Password\u2019s research team took six CVEs disclosed since March, and produced 6,080 patches using two frontier models: OpenAI’s ChatGPT-5.5 and Anthropic’s Opus 4.8.\u00a0<\/p>\n \u201cThe average success rate for generating a patch that fully resolved the vulnerability (without materially changing application behavior) was just 26.0 percent,\u201d wrote<\/a> Director of Security Research Keith Hoodlet, adding that even patches that did fix the flaw also mucked up the application\u2019s behavior 20 percent of the time. This included things like changing \u201callow list\u201d logic to \u201cdeny list\u201d logic.<\/p>\n \u201cConversely, LLM-generated patches did not resolve the vulnerability, added a new vulnerability, or both, an average 53.9% of the time,\u201d Hoodlet said.<\/p>\n