安全工程师谈 AI 威胁：SOC 2 认证挡不住 AI 攻击
安全圈吵起来了：有人说 SOC 2 就够防 AI 攻击，Gergely Orosz 拿 Binance 被偷 60 亿美元的例子反驳，观点很直接。
一位安全工程师认为，只要落实 SOC 2 等认证要求的纵深防御，AI 不会让防守变得难很多。Gergely Orosz 反驳：Binance 拿着全套认证仍被攻破，损失 60 亿美元，创史上最高纪录。他指出传统安全体系防不了零日漏洞，而被破解限制的 AI agent 能发现并利用这些漏洞进入信任边界。他认为未来需要用 AI 持续扫描自身系统、做红队测试、近实时修补 CVE，才可能够用。
From a security engineer, on the AI threat landscape:
"I actually don't think it's right that defense is going to get a lot harder because of AI.
Most of these breaches, if there's already a security program in place at all that follows the kind of things that companies claim to be doing in SOC 2s or in other certifications, will provide the defense in depth to prevent these breaches from having any meaningful impact on their environments."
I hate to say it, but Binance had every single on of these certifications, and got popped open, attackers stealing the largest-ever sum, $6B.
I don't think the "traditional" secutity industry realized how bad things are. SOC2 does not protect you from zero days (that abliterated AI agents can and do find), nor from abliterated AI agents getting inside your trust boundary.
In a few years I'm sure we'll have the certifications that mandate how to continioulsy scan your own systems with (abliterated?) models, red-teaming; and continiously monitor your live metrics (to spot anythig suspicious); and have near-realtime patching of CVEs (also surely with AI); and that MIGHT be enough
But it's putting your hand in the sand assuming that pre-AI security posture will work just fine... unless it's secutity posture that is formally proven to work (see: cryptography)
