Amazon’s CISO Discusses Rapid Cyberattack Evolution on Terra Security’s Podcast

A cyberattack that once might have taken weeks or months to unfold can now go from initial access to a complete system takeover in minutes. That was the lesson CJ Moses, CISO of Amazon, shared with Shahar Peled, CEO and co-founder of Terra Security, during the opening episode of AI Native Cybersecurity. This new podcast examines how artificial intelligence is changing the balance between attackers and defenders.

The conversation highlights the operational challenges facing security teams as AI accelerates vulnerability discovery, reconnaissance, and exploitation. Through the podcast, Terra Security aims to unite security leaders to discuss practical lessons from deploying AI, separating hype from reality, and preparing for the next phase of cyber defense.

The Window Between Discovery and Exploitation is Shrinking

One of the most striking examples Moses shared came from Amazon’s MadPot honeypot infrastructure, which monitors adversary behavior. In one observed incident, an attacker moved from having no access to taking over the compromised system and expanding through its available access in just 12 minutes and 42 seconds.

“In the past, this would have been a campaign by an adversary. Weeks, sometimes months, would go on forever. This was 12 minutes to just shy of 13 minutes,” Moses said.

This example illustrates a fundamental change in the assumptions underlying vulnerability management. Security teams have historically operated with patching windows measured in days or months. However, attackers can now navigate through reconnaissance, exploitation, and lateral movement in a fraction of an hour, significantly shortening the time available to identify and contain a threat.

For Moses, the central issue is velocity. AI enables adversaries to accomplish more in a shorter period, making the speed of response as crucial as the number of vulnerabilities discovered.

Why More Security Tools May Not Be Enough

Security programs have traditionally relied on layers of defensive controls to prevent intrusions or slow attackers down. Moses argued that this strategy still holds value, but AI-enabled adversaries can increasingly connect individual weaknesses into longer attack paths.

This shift changes the role of offensive security. Organizations need to continuously test their environments to determine which vulnerabilities can actually be exploited, rather than relying solely on defensive controls.

Referring to security checks during software development, Moses warned against slowing down. “The reality is if you slow down, you’re actually playing into the hands of the thing we talked about in the beginning,” he stated.

At Amazon, the approach includes integrating security scans into continuous integration and continuous delivery pipelines. AI-assisted scanning can identify issues as code is developed, while additional testing can validate the finished product, allowing security teams to address weaknesses without unnecessarily delaying software delivery.

Moses also described how Amazon uses intelligence from its MadPot infrastructure to inform patching priorities. Understanding what adversaries are targeting helps teams decide which weaknesses require immediate attention.

AI is Expanding the Threat Beyond Software

The risks extend beyond vulnerabilities in applications and infrastructure. Moses described North Korean operations that use AI to generate personas and support fabricated identities to obtain jobs at companies.

Amazon has stopped at least 2,900 North Korean actors during its hiring process, according to Moses. This example demonstrates how AI can amplify identity-based threats, complicating the work of security and hiring teams alike.

Amazon’s integrated security model combines cyber intelligence, personnel security, investigations, and other capabilities. The objective is to connect information across business units so that warning signs do not remain isolated in separate organizational functions.

As AI makes it easier to scale deceptive operations, the ability to combine information becomes increasingly important.

Measuring Exposure Instead of Counting Vulnerabilities

The episode concludes with a challenge to one of cybersecurity’s most familiar metrics: the number of vulnerabilities a team finds or patches. “I think the measure of a good security program won’t be how many vulnerabilities you found,” Moses said.

Instead, he expects the industry to focus on the time between discovering a vulnerability and patching or otherwise mitigating it. The appropriate response may involve blocking access, isolating a system, or applying another effective control rather than waiting for a conventional patch.

This shift would measure security performance by how quickly an organization reduces exposure to real attacks, rather than how many weaknesses appear on a dashboard.

As AI continues to accelerate both offense and defense, the practical question for security leaders is becoming less about how many vulnerabilities they can identify and more about whether they can close the window of opportunity before an attacker acts.

 

Source: The Next Web