Cognition Security Chief Alex Stamos Says AI-Driven Hacking Has Pushed Cybersecurity Into a 'Dark Age'

Alex Stamos has a blunt message for the cybersecurity business: the old model is breaking, and the pain is just starting.

Stamos is chief security officer at Cognition and a lecturer at Stanford University's Cyber Policy Center. He laid out his case in an interview with Nilay Patel on The Verge's Decoder podcast, released today, Nov. 7, 2026. It is part one of a special series on AI in real life.

A month of breaches

Stamos called October, normally "security awareness month," a stretch dominated by major bugs. He pointed to flaws in PHP and Node.

What got less attention, he said, was the number of companies that were breached. He described a series of AI-related companies, the so-called neoclouds, that were hit in succession.

That is Stamos's account. He is an industry insider describing what he sees, not an independent tally of incidents.

Why he says this is different

Stamos argues that both private actors and state actors, including Russia and North Korea, are breaking into systems with AI helping them detect and exploit vulnerabilities in the same motion. Finding the hole and using it used to be separate jobs. In his telling, they are collapsing into one.

He compares the mood to the 1990s, when an always-online world was new and nobody had settled how to defend it. Patel summarized his view as a coming "dark age" while the industry works out how to adapt.

Patel also framed Stamos's argument as saying the multibillion-dollar cybersecurity industry "as we've known it" is overdue for the waves of AI-boosted hacks, breaches and attacks. Companies spent heavily on defensive tools built for a slower attacker.

What the consulting world is saying

FTI Consulting, in its own analysis of agentic AI and cyber risk, describes the same shift in more clinical language. It says agentic AI can "compress the time between vulnerability discovery and exploitation," letting attackers move at a speed traditional controls "were not designed to address."

FTI makes a specific point about how companies triage. Most vulnerability programs fix critical and high-severity flaws and defer lower-severity ones because of budget or resource limits. FTI says that approach gets harder to defend, because an autonomous system may combine several individually low-scoring weaknesses into a serious attack path.

Its recommendation: stop ranking by severity alone. Weigh exploitability, external exposure, asset criticality, existing controls and whether weaknesses can be chained.

Where the experts stop short of panic

Neither account says defense is hopeless.

Stamos is not a doomer in the long run, according to Patel's description of the interview. His claim is that there is a rough stretch to get through before things improve.

FTI frames the change as "risk remapping rather than complete risk elimination." It says organizations can no longer rely only on human analysts reacting in real time and will need some automated tools. But it insists "human judgment remains essential."

Its line on automation is specific. Defined, reversible, lower-impact containment actions can be pre-authorized under documented conditions. Higher-impact actions that touch critical operations or business continuity should require human approval.

What FTI says companies should do

FTI treats AI agents themselves as privileged systems that need their own governance. Its listed safeguards include zero-trust principles, least-privilege tool permissions, tightly scoped credentials and controlled network access.

It also recommends updating incident response playbooks to account for machine-driven attack patterns, with pre-authorized containment protocols. Tabletop exercises and simulations, it says, can stress-test AI-augmented response scenarios.

That is practical advice. It also amounts to an admission that many existing playbooks were written around human attackers working at human speed.

What to watch

No regulator or government agency is cited in these accounts as having set a response, and no single incident total has been published. The claims about the pace and scale of AI-assisted intrusions come from Stamos and from a consulting firm that sells advice on the problem.

The Decoder interview is billed as the first installment of a series. Stamos's central prediction, that defenders face a dark age before they adapt, will be tested by whether the next round of breaches looks like October's.