Nikesh Arora

Arora warns that most organizations, especially smaller ones, cannot patch vulnerabilities as fast as AI can discover them.

Most organizations do not have capacity to patch at the speed needed, especially the smaller ones,

Arora advocates virtual patching, a proven technology available from security vendors, as the most obvious interim solution to AI-accelerated vulnerability discovery.

The most obvious solution is virtual patching. This is a time tested technology that is currently available with cyber vendors for endpoints, WAF, cloud, network use cases.

Nikesh Arora says that as model performance improves, vulnerabilities will keep being discovered and cannot all be fixed at once, since mass patching risks unknown infrastructure side effects; he proposes hybrid patching.

If you apply many patches at once, you also don't know what side effects might occur in infrastructure

Arora says that as AI models uncover more vulnerabilities, no single fix can address them all at once.

As AI models find more and more vulnerabilities, there is no single solution that can fix them all at once.

Arora proposes hybrid patching, pairing software fixes with network-layer virtual patches, because mass patching risks unpredictable infrastructure side effects.

If you apply many patches at once, you cannot know what side effects might occur in the infrastructure

Arora argues that defensive agent swarms are impractical due to token costs and current security structures, and that the contest with attackers is about speed, not volume.

Attackers stitch together multiple vulnerabilities, slip in while staying hidden, and extract data quickly. This is not a volume fight, but a speed fight.

Arora says fixing the SOC structure with modern SOAR and platform consolidation is the precondition for deploying AI agents in detection and recovery.

Logs, threat intelligence and security products must be tied together under a modern security orchestration, automation and response (SOAR) system so you can move quickly. Only then can you deploy agents to handle detection and recovery.

Arora says enterprises lack urgency and CIOs and CISOs are overloaded, so the cycle of emergency patching will keep repeating.

Because companies do not feel a sense of urgency overall, they cannot make decisions quickly

Arora told frontier AI labs that security cannot be left to them alone, warning that AI is a new attack surface and that careless adoption, including insecure coding harnesses, could put companies at risk.

The world cannot leave the solution only to you

Nikesh Arora says that as AI accelerates, security response times must speed up accordingly.

Our security response time has to get faster as AI gets faster

Arora called the White House meeting on SI an epic moment.

The meeting at the WH on SI was an epic moment.