In Menlo Security's first-ever Reddit Ask Me Anything (AMA), CEO Bill Robbins answered a slew of questions from users in the cybersecurity space. Drawing on Robbins' long history leading cybersecurity firms, users asked everything from practical security questions to AI fears to his love of quarter horses.
Among the answers, Robbins explained why organizations need to reduce exposed systems, validate findings through multiple independent signals, and use AI for repetitive work without surrendering human oversight. He also discussed why resilience matters, not just prevention. You can see the AMA here!
Artificial intelligence is changing cybersecurity on both sides of the equation. Defenders are using AI to analyze more data, automate repetitive work, and respond faster. At the same time, threat actors can use the same technology to create more variations of malicious code and personalize social engineering, all while searching continuously for vulnerabilities.
During a recent Reddit Ask Me Anything, Menlo Security CEO Bill Robbins addressed what these changes mean for security teams and for the next generation entering the field.
Across the discussion, one theme remained consistent: organizations cannot respond to machine-speed threats by simply accelerating the security practices they already use. Their defenses must reduce exposure and withstand missed signals, while keeping human judgment central wherever accountability matters. Here's what he had to say:
One participant began with a direct question about what worries Robbins most as cybersecurity enters a new AI-driven phase.
Question: What scares you about the future of cybersecurity?
Robbins: The pace at which threat actors can now create zero hour threats leveraging AI is scary. Traditional signature based detection, while always important, starts to become less effective. AI can change hundreds, thousands or tens of thousands of times to avoid signature based detection. Additionally, AI makes them better at phishing and spoofing and creating very personally relevant attacks. Last, AI never sleeps. In the past a threat actor was only willing to spend so much time on an attack before moving on. Now, they can unleash an agent that continuously looks for vulnerabilities to exploit.
Robbins' concern extends beyond the sophistication of individual attacks. AI also changes their economics and persistence.
Threat actors can produce more variations, test more approaches, and continue searching for weaknesses without the limits that once came with human time and attention. Signature-based detection remains valuable, but it becomes less effective when malicious code can be altered repeatedly and at scale.
The same acceleration affects the amount of time defenders have to react. Another participant asked whether traditional patching cycles can keep pace with AI-assisted vulnerability discovery and exploitation.
Question: With AI now letting anyone find and exploit zero-days instantly, do you think traditional patch-and-redeploy cycles can keep up? I've been wondering whether visual programming languages, where code is broken into granular, independently inspectable blocks, could enable real-time patching and monitoring without full redeployment. Curious if you see architecture-level shifts like that as part of the industry's future, or if it's more about layering better tooling on top of what we have.
Robbins: Hopefully, we are not yet now in a situation where anyone can use tools like Mythos and GLM-5.2 to find and exploit vulnerabilities instantly. But, when they can, attackers would need to stand up the software their target is using in order to find vulnerabilities to exploit. This might not be trivial, even for the bad guys. This said, the first targets would need to be internet-facing.
Therefore, a good preparatory move for any organization would be to inventory what's outside and find ways (which will require using VPN servers in more advanced ways) to bring them “inside”. Your hopes that modular code bases and other software architectural advances can help has merit as well. No question that it's all-hands-on-deck preparing to defend against a very formidable and rapidly evolving threat landscape.
There's a second piece: even though attackers still have real work to do, patch-and-redeploy is reactive by definition, and AI is compressing that window from weeks to hours. Racing to patch faster is racing a clock that keeps getting shorter, in my opinion.
Attackers still face practical barriers, including the need to understand and reproduce target environments. Even so, patching remains reactive, and AI is shortening the period between vulnerability discovery and exploitation.
Robbins' recommendation begins with a foundational security practice. Organizations need an accurate inventory of internet-facing systems and should reduce unnecessary exposure wherever possible.
Isolating potentially harmful activity before it reaches users or endpoints reduces an organization's dependence on winning every race to detect, patch, and remediate.
AI is increasing both the variability of attacks and the volume of security findings teams must evaluate.
One participant described bug bounty and reporting systems flooded with theoretical or highly improbable AI-generated findings. The question was whether AI-powered security tools are helping defenders or creating blind spots where subtle attacks can thrive.
Question: I'm curious to hear your thoughts on “Slop vs. Real Attacks”. As AI is fantastic at pattern matching, we're now at a place where every reporting system and bug bounty program we have is being bombarded with theoretical and highly improbable vulnerability reports. Because many of these reports lack real world context, we're forced to spend critical time tuning rules of AI powered tools to cut through the noise. Do you feel these tools are helping the industry? Or have we just created blind spots where low and slow (password spraying, low rate DoS, and Slowloris for example) attacks can thrive?
Robbins: The noise problem you're describing isn't really a bug bounty problem, but a single-signal problem. Any time you've got one model or one rule set making the call on “Is this real?”, unfortunately, you inherit all of its blind spots. So, naturally, you tune it to be less sensitive and slow attacks slip through. And if you tune it to be more sensitive you drown in slop. The way I see it, the way out isn't a better single filter, it's not relying on a single filter at all. For example, when it comes to file security, we run detection through several independent engines and only act on consensus. We've found that a false positive from any one engine never becomes the source of truth, and individual blind spots don't go unchecked, because the other engines are looking at the same thing, just from a different angle. Ensuring that consensus is the baseline for more efficient security is a shift I believe the industry needs to embrace more broadly, and that's true whether it's a single AI model or the human workforce driving it.
Robbins traces the noise problem to dependence on a single model, signal, or rule set.
Every detection system has tradeoffs. Increase sensitivity and analysts may be overwhelmed by false positives. Reduce sensitivity and low-volume or slow-moving attacks may go undetected.
Robbins recommends using multiple independent perspectives and making decisions based on consensus instead of relying on one supposedly perfect filter.
This approach treats AI as useful evidence rather than an infallible source of truth. Findings must be validated against independent evidence before they drive consequential decisions.
The principle also extends beyond technology. Human analysts, like AI models, benefit from review, corroboration, and different perspectives.
AI will change how threats are created and detected, as well as how security organizations are structured.
When asked which widely accepted security assumption may be proven wrong within five years, Robbins focused on the way teams are structured.
Question: You've seen multiple cybersecurity eras come and go. What's one security assumption that most companies still believe today that you think will be completely wrong five years from now?
Robbins: For decades, security organizations have been structured around functions such as AppSec, SOC, GRC, and Identity because humans were the ones executing the work. That logic is breaking down. Security org structures will need to change, as AI agents increasingly do the high-volume, repetitive tasks like alert triage, compliance checking and anomaly detection. The rationale for organizing around those functions disappears. What remains valuable isn't the task; it's the outcome it was meant to produce. The security org of the future may be built around Risk Strategy, AI & Automation, Platform Operations, Engineering Enablement, and Trust & Business Resilience, each defined by what it delivers, not how the work gets done. In that model, human judgment moves up the stack because people become governors, not executors. Humans are setting priorities, validating AI outputs, making the calls that still require accountability, and determining where humans still need to be in the loop. Organizations that see this shift early will build for it deliberately and will be operating at the next level, where both humans and AI deliver significant business value. But man…. I sure wish I had a crystal ball!
Robbins expects AI to change both the work security teams perform and the way those teams are organized. Repetitive activities such as alert triage, compliance checking, and anomaly detection will become increasingly automated. As that happens, organizing teams entirely around the tasks people once performed may make less sense.
Instead, he envisions teams built around outcomes: risk strategy, automation, platform operations, engineering enablement, trust, and business resilience.
In that model, people remain essential, but their responsibilities become more consequential. Security professionals set priorities, validate AI-generated findings, make accountable decisions, and determine when human involvement remains necessary. The ability to govern AI may become as important as the ability to operate a traditional security tool.
A related AMA question focused on another long-standing organizational challenge: different security tools producing similar information in incompatible formats.
Question: How do you deal with the different solutions doing the same thing but collect logs in different formats and using different attributes?
Robbins: Thanks for bringing up one of modern IT's longest unsolved problems! A path you can take is to define your organization's common language, then the tools become much easier to work with. I don't think the answer is expecting every vendor to speak the same language. The best approach is to decide what language matters to your organization: do you need to know who did it? What happened? What system or data was involved? Was it allowed, blocked, or risky? And what should we do next? Over time, these answers become the common language for the security team, which, for any organization, is the right start.
Robbins recommends that organizations define the questions their security data must answer, regardless of how individual vendors structure or label their information: who acted, what happened, which system or data was involved, was the activity allowed, blocked, or risky, and what should happen next.
That common language gives teams a stable foundation even when the technologies, data formats, and vendors around them continue to change.
The shift toward AI-enabled security will also change what the industry expects from new professionals.
One participant asked Robbins to compare the environment facing today's graduates with the industry he entered at the beginning of his career.
Question: With the pacing of innovations happening in this space and other adjacent spaces, specifically when it comes to leveraging AI, how do you compare the state of the industry for new grads to what you experienced at the beginning of your career?
Robbins: Great question! The industry new grads are stepping into today is both richer with opportunity and harsher in its demands than what I faced at the beginning of my career, especially because AI has compressed the “easy” parts of cybersecurity and elevated the expectation that even new grads are expected to start at a much more advanced level given all the AI tools and automation that are available.
When I started, the innovation curve was meaningful but manageable: networking, operating systems, early firewalls, and basic intrusion detection evolved over years, not quarters. You could specialize deeply in one stack or technology and ride that wave for a long time before the ground shifted. Today, AI and automation have accelerated that cycle; models, tools, and attack patterns evolve fast enough that what you learned in a senior-year course may already be partially obsolete by the time you're onboarding. Best advice? Never stop learning and network your relationships non-stop!
Robbins sees strong career opportunities in cybersecurity, although the traditional entry-level path is becoming more demanding.
AI can automate many of the tasks that once allowed early-career professionals to develop skills gradually. New graduates may therefore be expected to arrive with stronger technical foundations and become productive with automated tools much earlier in their careers.
His advice is straightforward: keep learning and keep building relationships. Both matter because cybersecurity knowledge now ages quickly. Tools, models, and attack patterns can change within months, while professional relationships help practitioners continue learning, discover opportunities, and understand how problems are being solved across the industry.
Robbins also offered a candid reflection on his own career when asked what he might have done differently.
Question: What advice would you give to cybersecurity beginners who are looking to build a career in the field? Looking back on your journey, what is one thing you would have done differently or one thing you wish you had done earlier in your career or life?
Robbins: My father was career military (which I am proud of!), and me being a Gen X guy, I sort of had the mentality that you joined a company and stayed. Maybe not forever, but for a substantial period of time. While I still believe in company loyalty (as long as it is culturally bi-directional), looking back there were opportunities (and perhaps some risks) I did not take that I probably should have. Hindsight is 20/20 and I can't complain about how my career has turned out, but I probably stayed in a few jobs a couple of years too long and missed what would have been some really cool experiences.
Robbins still values loyalty, but only when it is reciprocated by the organization. He also acknowledges that staying too long in a comfortable role can come at the cost of new experiences and professional growth.
Cybersecurity has always been shaped by an uncomfortable asymmetry. Defenders must protect large and complex environments, while an attacker may need to find only one opening.
One AMA participant asked Robbins how security leaders live with the knowledge that even strong defenses cannot eliminate every possible zero-day or determined attacker.
Question: How do you rationalize (or get a full night's sleep, without waking up in a cold sweat) that no matter how great you or your companies/products are at cybersecurity, at any time/day, some kid on a broken keyboard could have the perfect zero-day, and you or your companies have done “better” or different to stop it?
Robbins: Great question… but very simply the answer is I can sleep if we have done our best and we are always improving. An old adage in cybersecurity is that defenders have to be right 100% of the time and the adversaries only need to be right once. It is an asymmetrical and frustrating reality. But we, me, Menlo, our cybersecurity industry, do our best everyday. When I was at Mandiant (awesome company, awesome people!) we used to say “Breaches are inevitable but the direst consequences don't have to be”. Hacks will happen, but I am passionate about this industry because I believe we are collectively doing everything we can to prevent those breaches and the consequences of them if they do occur.
Robbins defines success through preparation, continuous improvement, and the ability to keep an incident from producing its worst possible consequences. His answer acknowledges that no organization or security product can eliminate risk entirely, which is the basis of a resilient security strategy.
Trust plays an equally important role in how security companies engage with customers. When asked whether direct, in-person messaging is the best way to reach CISOs, Robbins emphasized the credibility that must be built before an executive meeting takes place.
Question: Do you believe that direct messaging (in-person) to CISOs about your company/solution's value proposition is the best way to cut through the marketing noise? If so, provide some examples of things you've done and how do you learn about new groups who have CISO engagements.
Robbins: This is a very timely issue, especially with Black Hat just around the corner. To be honest, getting in-person time with CISOs has always been the holy grail, but the challenge is that CISOs are occupied with an endless amount of strategic projects and short-term fires. I can attest to that! However, while it is extremely effective to meet in-person, what is even more important is the work done prior to the meeting. Building partnerships within the CISO's organization can create advocates that agree with how the platform is unique and differentiated and who will believe this will make their life easier and solve real problems.
Trust is rarely created in a single executive conversation. It is earned when practitioners understand how a platform works, see how it differs from alternatives, and believe it can solve a meaningful operational problem. That perspective makes internal credibility and demonstrated operational value the basis for a productive executive conversation.
Robbins' AMA responses reflect both urgency and restraint. He was clear that AI gives attackers more ways to vary their threats and operate around the clock. He also recognizes that the structures and detection models security teams have relied on may not hold up to what's coming next.
Robbins also identifies practical ways organizations can prepare: reduce exposed systems, corroborate security signals, and assign AI the repetitive work while people retain responsibility for governance and consequential decisions.
The goal is to make attacks harder to pull off and easier to catch through independent perspectives. When prevention fails, the aim shifts to limiting the damage.
Robbins' view of leadership aligns with Menlo Security's own approach as the leader in Browser Security for human and agentic workforces: prevention paired with resilience. As threats accelerate, organizations need architectures that contain harmful activity and teams that validate automated findings. Leaders still need to remain accountable for the decisions AI cannot make on its own. Once again, you can view the AMA here!
Menlo Security
