Hyper Defense: Why Patching Faster Won't Stop AI-Speed Attacks

AI has made attacks cheap, fast and parallel. Most security programs still answer with one lever: patch faster.

At apisec|con 2026, Bashar Abouseido, President of Tenex.ai and former SVP and CISO at Charles Schwab, argued that this lever is broken. Finding volume is rising faster than any team can fix, and attackers now move at machine speed.

His alternative is what he calls hyper defense. Use AI at the same scale as attackers, and spend engineering time on what is actually exploitable. Here is what he told Christine Bevilacqua of apisec University, and what it means for your program.

1. Patching faster is the wrong scoreboard

"I don't think the outcomes are changing. I would say, like I said, you don't need to patch faster necessarily. I really don't think so. But what I think we need to do is defend smarter, and that includes how we focus on what I consider to be the highest risk, the validated risk, which is exploitability." (30:10)

AI is raising finding volume on both sides of the SDLC. Code written by AI and scanners run by AI both produce more findings than any team can fix.

Treating every finding as urgent burns engineering time and adds change risk of its own. Bashar's test is simpler: is it exploitable, and has that been validated? Those go first. Earlier in the session he put it plainly: "We need a differentiated approach that focuses on exploitability and validation." (10:06)

2. Hyper offense will require hyper defense

"Hyper offense will require hyper defense. Hyper defense meaning I need to use AI at scale agentically to detect. I need to focus on exploitability and validation. I need to be able to link all of the stuff that we do to our controls so we can defend at machine speed, and we need that continuous context and validation to make decisions that are suited for our business." (29:06)

Bashar uses "hyper offense" for what AI changed: thousands of agents deployed in parallel, at machine speed, often on open-weight models. Human-paced defense can't match it.

This was his one message for the board. AI investment can't stop at the business side. Defense needs the same scale, plus business context for every finding: Is this application revenue-generating? Do we have enough controls? How much time do we have?

3. 26,000 agents for 48 hours cost about $15,000

"26,000 agents for 48 hours, the total cost was about $15,000." (06:59)

That is the price Bashar gave for a 48-hour, 26,000-agent test. He expects it to fall further: "we think it's going to be cheaper and cheaper and cheaper as hardware become more available, GPUs are more available, people are able to download open source models and leverage AI." (07:07)

The threat model changes when sustained, automated attacks are this cheap. Persistence is no longer reserved for well-funded adversaries. From apisec's perspective, models are not deterministic, but at this price attackers can afford enough attempts to find something. Defenders need to find those issues first, and do it deterministically.

4. Fix validated exploits now, and schedule the rest

"One is, I don't have time. The compression of time that is happening on the offensive side is leading me to say, 'Hey, listen, I need to prioritize with the development team what I consider to be exploitability and validated exploitability.'" (13:46)

Bashar described two tracks. Validated, exploitable findings go to development immediately. The same knowledge goes to detection and perimeter teams so they can add compensating controls, such as a WAF rule, to buy time while the fix ships.

Everything else follows the normal process: "Maybe it is okay to stay with the cadence of 30 days or 35 days, whatever the cadence is within an organization." (14:58) Rushing low-risk fixes into production adds resiliency risk without reducing much exposure.

5. Why application security has lagged

"I also see what happens in the CISO community is the majority of them come really from an infrastructure background." (17:37)

Bashar started as a developer, so he sees the gap clearly. Leaders who grew up in infrastructure invest where they are comfortable: network segmentation, firewalls and host protection. Application security gets handed to development, often through a security champions program.

He calls that the reason AppSec investment has lagged, even though the heavy lifting happens in the software itself. His conclusion: "If you wanna reduce risk the most, you need to start with applications first." (18:44)

6. Attack agents coordinate like ant colonies

"Agents don't communicate to each other. They use the framework to leave evidence of progress, and other agents come in and just pick up that progress and keep finding ways and path and creating a graph to exploitation." (07:29)

Open pen-testing frameworks are on GitHub. Agent swarms built on them don't need a plan. Each agent leaves traces, and the next one continues from there until an exploitation path exists.

One failed attempt means little against that model. Bashar's answer is that defense has to be continuous too: "It is a continuous process, and we need to be part of it at the AI machine speed." (24:13)

What this means for your program

1. Re-rank your backlog by validated exploitability. Count and severity score alone don't tell you what an attacker can use.
2. Create a fast lane. Validated exploitable findings go to development with an agreed turnaround. Detection gets the same data to add compensating controls, such as WAF rules, while the fix ships.
3. Keep everything else on your normal cadence, on purpose. Tell engineering why, so the fast lane stays fast.
4. Decide where AI testing runs. Bashar recommends a CIO and CTO level decision on which applications and source code can go to frontier models and which stay in-house on open-weight models (25:46).
5. Take one message to the board. Hyper offense will require hyper defense, and defense needs AI at the same scale as the business.

The bottom line

Bashar's point is not that patching matters less. It is that speed without prioritization adds risk.

From apisec's perspective, that starts with knowing what you have. Applications are now APIs, and AI agents can probe them at scale. Finding the exploitable issues in your own applications first, deterministically, is how defenders get ahead.

Watch the full session: Hyper Defense: Application Security in a Mythos World | Bashar Abouseido. To see how apisec discovers your attack surface and tests for exploitable issues, explore apisec Surface and Exploit Testing.

FAQ

What is hyper defense in application security?

Hyper defense is Bashar Abouseido's term for answering AI-driven attacks at the same scale. Attackers now run thousands of agents in parallel at machine speed. Defenders need AI at scale to detect, a focus on exploitability and validation, links to existing controls, and continuous business context to decide what to fix first.

Should security teams patch every vulnerability faster?

Not according to Bashar Abouseido, former CISO at Charles Schwab. He argues teams should fix validated, exploitable findings immediately, add compensating controls such as WAF rules while those fixes ship, and let lower-risk findings follow the normal 30-day patch cadence to avoid adding resiliency risk.

How much does an AI-driven attack cost to run?

In a 48-hour test Bashar Abouseido described at apisec|con 2026, 26,000 AI agents ran for a total cost of about $15,000. He expects that cost to keep falling as GPUs and open-source models become more available, which lowers the barrier for sustained, automated attacks.

Why has application security lagged other areas of security?

Bashar Abouseido says most CISOs come from infrastructure backgrounds, so they invest in network segmentation, firewalls and host protection, and hand application security to development teams. He argues the opposite approach: the biggest risk reduction comes from applications, so security programs should start there.