The economics of offence have changed faster than the economics of defence

Attack resources, once limited to skilled researchers, organized crime, and nation states are now widely accessible, while building and maintaining secure systems remains difficult and expensive.

Security is no longer free.

For years, security was something many teams postponed until after shipping. Many systems survived not because they were secure, but because no one was actively looking for weaknesses. Hidden endpoints, obscure workflows, and edge-case bugs often went undiscovered. That assumption no longer holds.

The economics have changed.

Hackers haven’t just become smarter, access to security education, research, and tools are now widely available, lowering the barrier to entry. Security education, research, and tools are now widely available, lowering the barrier to entry. Large language models and other technologies have made technical knowledge easier to access and apply. The gap between curiosity and capability continues to shrink.

Security through obscurity doesn’t work.

Investigation, enumeration, code analysis, and experimentation are increasingly automated. A motivated individual no longer needs years of expertise to become dangerously effective. The capabilities available to casual attackers today are far greater than many organizations realize.

Defence is still hard.

Attackers need only one successful path; defenders must secure them all. While security tooling continues to improve, organizations cannot automate away the problem entirely. Effective security still requires thoughtful design, threat modelling, architecture reviews, and incident preparedness.

So, What do we do?

Developers need basic security education. Engineering leaders must treat security as a core engineering responsibility, not a compliance exercise. Organizations need plans not only to prevent incidents, but also to respond when prevention fails.

In closing

The biggest change isn't that attackers are more clever, but that advanced offensive knowledge is now widely accessible. The cost of attack is falling, the cost of defence remains high, and the consequences of failure continue to grow. That changes everything.