OpenAI got something like a hundred and fifty companies, Anthropic, Microsoft, Cisco, CrowdStrike, most of the security industry, to sign an open letter last month calling for a coordinated push on cyber defense. I went in expecting a vendor pitch dressed up as urgency and came out mostly agreeing with it. The core argument, that AI is about to make attackers and defenders both dramatically more capable and we’ve got a shrinking window to make sure defenders come out ahead, holds up. I just think the letter buries its best point under a few paragraphs of momentum before it ever gets there.
Read the section where the letter explains why status quo security won’t cut it. It names excessive permissions, misconfigurations, weak authentication, unpatched systems, technical debt in legacy environments. Every breach report I’ve read in fifteen years names the same list, and none of it is AI’s fault.
What AI changes is how fast those weaknesses get found and exploited. IBM X-Force’s 2026 research put a number on it: a phishing email that used to take an attacker sixteen hours to research and write now takes about five minutes with generative AI, something like two hundred times the output per attacker. The attacks are the same, the weaknesses are the same, and most security teams were never built to operate at that speed. Verizon’s 2025 DBIR put the median time to click a phishing link at twenty-one seconds, which isn’t enough time for any human-driven detection process to meaningfully intervene.
That gap is worst exactly where the letter says the stakes are highest: hospitals, water treatment, the parts of critical infrastructure running on hardware nobody’s touched since the last decade. Forescout’s most recent scan found roughly 3.4 million exposed remote access servers globally, and about 670 of them were VNC connections handing out direct, unauthenticated access to ICS and OT control panels. Over 40% of the exposed RDP servers they found were still running Windows 10, which went end of support last October. You can’t drop an AI SOC copilot into an environment with PLCs running firmware from 2011 and call the problem handled, no matter how good the demo looked.
The letter does get this part right: when a system can’t be patched without taking down essential services, you need compensating controls, verified, not just written down somewhere and forgotten. And that’s more or less a description of what network access control has been doing this whole time: see the device the second it shows up, decide whether it belongs, hold the line on it without ever touching the thing itself. Nobody’s funded that discipline properly in years, and that underfunding is a bigger part of the status quo security problem than the letter gives it credit for.
The most useful line in the whole letter is buried in the section addressed to frontier AI companies: “ensure agentic identities are traceable and accountable.” I’ve spent a good chunk of this year arguing some version of that same point, using CoSAI’s agentic identity framework as a starting point.
The scale of the problem is bigger than most people realize. The exact multiple depends on who’s counting, anywhere from the high teens to well over a hundred to one depending on the survey, but Palo Alto Networks’ 2026 Identity Security Landscape report put it at 109 machine identities for every human identity in the average enterprise, up from 82-to-1 the year before, with AI agents accounting for most of that growth. The 2026 Infrastructure Identity Survey found systems running AI agents with least-privilege access saw a 17% incident rate, against 76% for the same systems running over-privileged, which is about as clean a proof point as you’re going to get for scoping access tightly by default.
I’m glad to see the traceability line land on a list like this one. Writing it into a letter doesn’t build the mechanism for it, though. In practice it means treating every agent the way you’d treat any new device that shows up on your network: identify it before it acts, scope it tight, log everything, cut it off fast. Stop treating an agent like a service account nobody remembers to rotate, and start treating it like an actual identity in your IAM stack, one you can audit, scope, and kill the instant it does something you didn’t expect. That’s the same lesson identity and access people already learned with service accounts and machine credentials, just showing up now attached to something faster, more autonomous, and multiplying at a ratio most identity programs were never sized for.
None of this makes the letter wrong, and getting this many organizations to put their name on the same page is rare enough to be worth noting by itself. I just don’t think the answer is stacking more AI tooling on top of infrastructure that still can’t tell you what’s plugged into it, or identity programs that were sized for a world with one machine account per employee instead of a hundred. The fundamentals here are the same as they’ve always been: know what’s on your network, know what it can reach, and make sure you can revoke that access when something goes wrong. AI is going to help you find those gaps faster than you ever could on your own, but it’s not a substitute for having the access-control layer in place to actually act on what it finds.
