AGI-Pilled Cyber Defense: Automating Digital Forensics w/ Asymmetric Security Founder Alexis Carlier

Episode Summary

Executive Summary: The episode explores how AI is reshaping cybersecurity through the lens of Asymmetric Security’s founder, Alexei Carlier, who argues AGI will force a shift from reactive alert triage to proactive, continuous digital forensics. The conversation covers today’s threat landscape, AI’s current and future impact on attacks and defense, and why services-first, human-in-the-loop systems plus proprietary data/evals may let defenders outpace attackers.

Main Topics: AGI as the premise for rethinking cyber defense: Carlier says his company is built on the assumption that AGI is coming and will act like near-infinite intelligent labor, requiring security to be redesigned around that future rather than current tooling. Current cyber threat landscape: The discussion breaks down attackers into unsophisticated phishing crews, organized ransomware gangs, and sophisticated nation-state operators focused on IP theft, disruption, and regime funding. North Korean remote-worker operations: A notable example of state-backed cyber activity is North Korea placing operatives into Western tech jobs to earn salaries and access funds and information, showing cybercrime can blend espionage and revenue generation. Digital forensics as the next security layer: Asymmetric aims to automate deep incident investigation, moving beyond static rules and noisy alerts toward rich forensic reasoning over logs, email activity, and account behavior. AI capability jaggedness and evaluation limits: Carlier emphasizes that models can already do many investigative tasks well, but reliability, long-horizon reasoning, and lack of public incident data make cybersecurity especially hard to benchmark and automate. Services-first go-to-market and insurance distribution: The company is entering via email-based incident response, using human-AI teams and insurance carrier panels to build trust, data, and a flywheel before broader productization. Intentional defensive acceleration of AI: He argues digital forensics may be a domain where AI can be selectively accelerated on the defensive side without equally boosting offensive hacking, creating a model for other fields like biosecurity.

Key Arguments: Most cyber attacks are still low-skill and opportunistic, especially phishing and known-vulnerability exploitation, so basic hygiene like MFA and patching defends against a large share of risk. Nation-state threats are qualitatively different: they are stealthier, better resourced, and often aim at long-term IP theft or persistence rather than immediate monetization. Static detection systems are limited because they produce too many false positives and miss subtle, slow-moving attacks that require deep contextual reasoning. Digital forensics is currently too expensive and slow to run continuously, but AI can lower the cost enough to make proactive, always-on investigation feasible. Current models already achieve about 90% accuracy on simpler email investigations, but high-stakes security work needs near-perfect reliability, so humans remain necessary for now. The biggest bottlenecks for improving defensive cyber AI are lack of private incident data and lack of expert evaluators; the solution is to operate a services business that generates both. Cybersecurity may be a special case where defensive AI can be advanced faster than offensive AI because incident response specialists do not strongly transfer to elite hacking skills. The long-term opportunity is not just automating existing human workflows but making previously impossible levels of security economically viable. Insurance companies are a key distribution channel because they already route breach response through approved incident-response vendors. A broader strategy is emerging: curate data sets, evals, and environments in hardening domains to intentionally pull the model frontier toward defense.

Data Points: Share of attacks from unsophisticated actors: ~80% - Carlier estimates most attacks are by relatively unsophisticated amateurs or criminals. Share of attacks that are social engineering/phishing: ~70-80% - He says most attacks start with phishing or other social engineering because attackers choose the path of least resistance. Time reduction for email investigations: from ~2 days to 1 week down to a few hours - Asymmetric’s current AI-assisted platform shortens incident-response time for business-email-compromise cases. Model accuracy on simpler email investigations: ~90% - He says off-the-shelf models can already reach roughly this level on straightforward investigative tasks. CrowdStrike IR team size: ~60 people - Used to illustrate how constrained expert forensic talent is. Jaguar ransomware impact: $2 billion loan - He cites Jaguar reportedly needing this loan after a ransomware incident disrupted operations. Estimated economic damage ratio: ~10:1 - He says ransomware damage relative to attacker capture is likely around ten-to-one or worse. Cybersecurity services market: ~$40 billion - He cites this as the size of the forensic/response market Asymmetric is initially entering. Broader detection market: ~$500 billion - He frames proactive AI-driven detection/forensics as a potential substitute for a much larger market. North Korean manpower for offensive cyber: hundreds of thousands - He says the CCP also has vast manpower committed to offensive cyber efforts, estimated in the hundreds of thousands. Applications deadline for GovAI: February 15 - Mentioned in the sponsorship segment for AI policy researcher roles. Help desk automation target for Serval: 50% by week four - Mentioned in the sponsor read as a performance guarantee. Blitzy autonomous work share: 80%+ - Sponsor claim that its platform completes most work autonomously.

Pivotal Quotes: "“What makes most sense from a cyber defense perspective assuming that [AGI]?”" — Alexei Carlier: He explains his company’s foundational premise: design security for a world where AGI exists. "“The strong assumption should be stuff is going to get in.”" — Alexei Carlier: He argues that perfect prevention is unrealistic, so detection and forensic response remain essential. "“What would you do if you had 100x intelligence labor at your disposal?”" — Alexei Carlier: He uses this framing to argue that AI should scale security work that was previously too expensive to do continuously.

Implications: Security will increasingly shift from point-in-time alerts to continuous, AI-assisted investigation. The biggest winners may be vendors who build proprietary data, evals, and trust channels now—especially in defensive domains where capability can be accelerated without equally empowering attackers.