Listen to this Post
Introduction
The cybersecurity industry is witnessing a fundamental asymmetry: general-purpose frontier AI models are becoming exponentially more capable at offensive security tasks—finding vulnerabilities, crafting exploits, and executing multi-step attack chains—while their defensive capabilities lag significantly behind. Corma, a Tel Aviv and San Francisco-based frontier AI lab founded in 2025, has emerged from stealth with $60 million in seed funding led by Sequoia Capital, with participation from Khosla Ventures and Coatue, to build the first foundation model purpose-built for defensive cybersecurity. The company’s research reveals that in enterprise simulations, AI attackers succeeded in 88% of cases while the same models detected only 12% of the threats they had previously created—a gap Corma calls the “defensive gap”.
Learning Objectives
- Understand the fundamental imbalance between AI-powered offensive and defensive cybersecurity capabilities, including the 88% attacker success rate versus 12% detection rate documented in enterprise simulations
- Learn how specialized foundation models for defensive security differ from general-purpose LLMs in architecture, training data, and operational deployment
- Acquire practical knowledge of AI-driven security operations, including log analysis automation, threat detection workflows, and autonomous response mechanisms
- Explore defensive strategies and tooling to counter AI-powered ransomware and autonomous attack campaigns
- Gain hands-on familiarity with Linux and Windows commands for security monitoring, log analysis, and incident response in AI-augmented SOC environments
You Should Know
- The Defensive Gap: Why General-Purpose AI Fails at Cybersecurity Defense
Corma’s research highlights a critical vulnerability in current security architectures. When the company tested four frontier models—Claude Opus 4.8, GPT-5.5, Grok 4.3, and DeepSeek V4—across 241 scored engagements in a simulated enterprise environment, the results were stark: models successfully implanted persistent backdoors in 85% of runs but detected only 19% of attacks. As Corma CEO Alon Pluda explained, “General foundation models are getting exponentially better at offensive security. They haven’t improved at the same rate on defensive security”.
The root cause lies in training data. Models are trained on vast amounts of prose and source code—exactly the kind of data that enables vulnerability discovery and exploit development. But defensive security tasks involve structured machine data: security logs, audit trails, configuration records, and endpoint telemetry. These data types are underrepresented in general-purpose training corpora, creating an inherent bias toward offensive capabilities.
Practical Implication: Organizations cannot rely on general-purpose LLMs for defensive security. The 88% attacker success rate documented by Corma echoes broader industry findings—Palo Alto Networks reports that prompt injection attacks alone have an 88% success probability, and AI-powered phishing campaigns achieve 54% success rates while bypassing multi-factor authentication.
Linux Command for Log Analysis Automation:
Aggregate and analyze authentication logs for anomaly patterns
sudo journalctl --since "24 hours ago" | grep -E "Failed password|Invalid user|Accepted password" | \
awk '{print $1, $2, $3, $9, $11}' | sort | uniq -c | sort -1r | head -20
Monitor real-time SSH brute-force attempts with rate limiting
sudo tail -f /var/log/auth.log | while read line; do
echo "$line" | grep -q "Failed password" && echo "[bash] SSH brute force detected: $line"
done
Parse Windows Event Logs for failed login attempts (from Linux with evextract)
evextract -f Security -e 4625 /mnt/windows/Windows/System32/winevt/Logs/Security.evtx | \
jq 'select(.EventData.TargetUserName != null) | {User: .EventData.TargetUserName, IP: .EventData.IpAddress}'
Windows PowerShell Commands for Security Monitoring:
Extract failed login attempts from Security event log
Get-WinEvent -LogName Security -FilterXPath "[System[EventID=4625]]" -MaxEvents 100 | `
ForEach-Object { $_.Properties } | `
Select-Object @{N='User';E={$<em>[bash].Value}}, @{N='SourceIP';E={$</em>[bash].Value}}, TimeCreated
Monitor for suspicious process creations (potential malware execution)
Get-WinEvent -LogName Security -FilterXPath "[System[EventID=4688]]" -MaxEvents 50 | `
ForEach-Object { $_.Properties } | `
Select-Object @{N='Process';E={$<em>[bash].Value}}, @{N='CommandLine';E={$</em>[bash].Value}}, TimeCreated
Detect multiple failed logins indicating brute force (threshold > 10 in 5 minutes)
$events = Get-WinEvent -LogName Security -FilterXPath "[System[EventID=4625]]" -MaxEvents 1000
$events | Group-Object { $<em>.Properties[bash].Value } | Where-Object { $</em>.Count -gt 10 }
- Building the Defensive Foundation Model: Architecture and Training
Corma is building what it describes as “the first foundation model designed specifically for defensive cybersecurity”, aiming for “superintelligence for defensive cybersecurity”. Unlike general-purpose models that optimize for language understanding and code generation, Corma’s model is pre-trained on security-specific data: logs, network flows, alerts, configurations, and attack patterns.
The model powers autonomous AI agents that analyze security data, correlate signals across disparate sources, and respond to complex attack campaigns. These agents operate continuously, learning the environment once connected and acting as though an organization had added extra specialist staff.
Key Technical Differentiators:
- Specialized Pre-training: The model is trained from the ground up on defensive security data rather than fine-tuned from a general-purpose base
- Agentic Architecture: Agents can operate across multiple security functions—alert investigation, identity activity review, cloud configuration inspection, malware tracking, and response coordination
- Human-in-the-Loop: Agents gather evidence, build a picture of the attack, and request human approval before taking disruptive actions such as isolating endpoints, disabling accounts, or blocking network traffic
Early Deployment Results: Corma’s Fortune 100 and Fortune 500 customers in healthcare, financial services, energy, critical infrastructure, and retail have already deployed the platform. Early deployments show threat response times reduced by more than 94% and security coverage expanded by 15 times across different functions.
Tool Configuration for AI-Augmented Security Operations:
Example Suricata configuration for AI-enhanced threat detection /etc/suricata/suricata.yaml vars: address-groups: HOME_NET: "[192.168.0.0/16,10.0.0.0/8,172.16.0.0/12]" EXTERNAL_NET: "!$HOME_NET" port-groups: HTTP_PORTS: "80,8080,443,8443" SHELLCODE_PORTS: "!80,443" Enable eve.json output for AI log ingestion outputs: - eve-log: enabled: yes filetype: regular filename: eve.json types: - alert - http - dns - tls - files - smtp - flow Custom rule for AI-powered phishing detection alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"AI-Powered Phishing Attempt"; flow:established,to_client; content:"|3c|script|3e|"; http_server_body; pcre:"/window.location|document.cookie|eval(/i"; classtype:attempted-user; sid:1000001; rev:1;)
- AI Attackers Are Already Here: The 88% Success Rate Reality
The 88% figure is not hypothetical. Multiple industry reports confirm that AI-powered attacks are succeeding at alarming rates. Resilience’s 2025 report found that AI-powered attacks are 88% more effective than traditional ones, with phishing alone achieving a 54% success rate. Ransomware is now responsible for 91% of losses in 2025, and attackers are using cyber insurance policies as guides for ransom demands.
Anthropic has documented AI campaigns where the AI performed 80-90% of operational work autonomously. Meanwhile, LLM-generated malware alone is projected to account for 50% of detected threats in 2025, up from just 2% in 2021.
The Attackers’ Advantage:
- Speed: Agentic AI gives attackers a structural speed advantage
- Scale: AI can automate reconnaissance, vulnerability discovery, and exploit development at machine speed
- Evasion: AI-generated phishing bypasses multi-factor authentication and traditional email security
- Autonomy: Near-autonomous AI agents can execute multi-stage attack campaigns with minimal human intervention
Defensive Commands for AI-Powered Threat Detection:
Monitor for unusual outbound connections (potential C2 beaconing)
sudo ss -tunap | grep ESTAB | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -1r
Detect crypto-mining malware via CPU usage spikes
top -b -11 | head -20 | grep -E "cpu|%Cpu" && ps aux --sort=-%cpu | head -10
Scan for unauthorized scheduled tasks (Linux)
sudo crontab -l 2>/dev/null && for user in $(cut -f1 -d: /etc/passwd); do
sudo crontab -u $user -l 2>/dev/null; done
Windows: Detect anomalous PowerShell execution (common AI attack vector)
Get-WinEvent -LogName "Microsoft-Windows-PowerShell/Operational" -MaxEvents 100 | `
Where-Object { $_.Id -eq 4104 -or $_.Id -eq 4103 } | `
Select-Object TimeCreated, @{N='Script';E={$<em>.Properties[bash].Value}} | `
Where-Object { $_.Script -match "Invoke-|DownloadString|IEX|Base64" }
Windows: Monitor for new service creation (persistence mechanism)
Get-WinEvent -LogName System -FilterXPath "[System[EventID=7045]]" -MaxEvents 50 | `
ForEach-Object { $</em>.Properties } | `
Select-Object @{N='ServiceName';E={$<em>[bash].Value}}, @{N='ImagePath';E={$</em>[bash].Value}}, TimeCreated
- The Agentic Security Workforce: AI as a Force Multiplier
Corma’s vision extends beyond a single model to what it calls an “AI-powered defensive workforce”. The platform deploys specialized AI agents across defensive security functions, each continuously learning and adapting to the environment.
Agent Capabilities:
- Alert Investigation: Agents triage and investigate security alerts, reducing analyst fatigue
- Identity Monitoring: Review identity activity for compromised credentials and privilege escalation
- Cloud Security: Inspect cloud configurations for misconfigurations and compliance violations
- Threat Hunting: Track malware and coordinate response across security tools
- Evidence Gathering: Collect and correlate evidence across systems to build attack context
Human-AI Collaboration Model: The approval step is critical. As demonstrated in a real-world incident, a security executive received a notification on his smartwatch from a Corma agent that said, “I just caught a live attack. I need your permission to block it”. The executive approved the action; the agent blocked the malware and stopped the attacker from moving across the network in under 10 minutes.
Cloud Hardening Commands for AI-Augmented Defense:
AWS: Audit IAM policies for over-privileged roles (AI attack vector)
aws iam list-roles --query 'Roles[?contains(AssumeRolePolicyDocument.Statement[].Action, ``)]' --output table
AWS: Check for publicly accessible S3 buckets (common data exfiltration target)
aws s3api list-buckets --query 'Buckets[].Name' --output text | xargs -I {} aws s3api get-bucket-acl --bucket {} --query 'Grants[?Grantee.URI==`http://acs.amazonaws.com/groups/global/AllUsers`]' --output table
GCP: Audit firewall rules for overly permissive configurations
gcloud compute firewall-rules list --format="table(name, network, direction, priority, sourceRanges.list():label=SRC_RANGES, allowed[].map().firewall_rule().list():label=ALLOW)"
Azure: Check for storage accounts with public access
az storage account list --query "[?allowBlobPublicAccess==`true`].{Name:name, ResourceGroup:resourceGroup}" --output table
Kubernetes: Detect overly permissive RBAC configurations
kubectl get clusterrolebindings -o json | jq '.items[] | select(.subjects[].kind=="User") | {name: .metadata.name, subjects: .subjects}'
5. Defensive Strategies Against AI-Powered Ransomware
CrowdStrike’s 2025 Ransomware Report confirms that AI attacks are outpacing defenses. CISO’s best defense remains what experts call “boring cybersecurity hygiene”—implementing CIS and NIST controls. However, AI-powered defenses are becoming essential:
- CIEM (Cloud Infrastructure Entitlement Management): Provides visibility, least-privilege enforcement, continuous monitoring, and automated remediation
- Malware Vaccines: Cosmetic changes to Windows systems—decoy files, registry key edits, simulated infection markers—deter AI-driven malware by signaling that the system is already compromised
- DNS and Egress Controls: Inline runtime enforcement woven into the cloud network fabric
Incident Response Commands for AI-Powered Attacks:
Linux: Isolate compromised host by blocking all outbound traffic except to security tools
sudo iptables -I OUTPUT -j DROP
sudo iptables -I OUTPUT -d <SIEM_IP> -j ACCEPT
sudo iptables -I OUTPUT -d <EDR_IP> -j ACCEPT
Linux: Capture forensic data before reboot
sudo tar -czf /tmp/forensic_$(date +%Y%m%d_%H%M%S).tgz /var/log /etc/passwd /etc/shadow /var/spool/cron /root/.bash_history
Windows: Isolate endpoint via Windows Firewall
New-1etFirewallRule -DisplayName "Emergency_Isolation" -Direction Outbound -Action Block
New-1etFirewallRule -DisplayName "Emergency_Isolation_Inbound" -Direction Inbound -Action Block
Windows: Capture memory dump for forensic analysis
WinDbg -y . -z C:\memory.dmp -c ".dump /ma C:\full_memory.dmp; q"
Windows: Kill suspicious processes and remove persistence
Get-Process | Where-Object { $<em>.CPU -gt 50 -and $</em>.ProcessName -match "powershell|cmd|wscript|cscript" } | Stop-Process -Force
Get-ScheduledTask | Where-Object { $<em>.State -eq "Running" -and $</em>.TaskPath -match "\Microsoft\Windows\" } | Unregister-ScheduledTask -Confirm:$false
What Undercode Say
- Key Takeaway 1: The cybersecurity industry faces a fundamental “defensive gap”—general-purpose AI models are inherently better at attacking than defending. Organizations that rely on generic LLMs for security are exposing themselves to unacceptable risk. Specialized defensive foundation models represent the next frontier in cybersecurity architecture.
-
Key Takeaway 2: The 88% attacker success rate is not an isolated statistic—it reflects a systemic imbalance across the AI security landscape. From phishing to ransomware to autonomous attack campaigns, AI is giving attackers a structural speed and scale advantage that traditional defenses cannot match.
Analysis: Corma’s emergence from stealth with $60 million in seed funding signals a significant shift in cybersecurity investment. Sequoia Capital, Khosla Ventures, and Coatue are betting that the defensive gap represents a generational market opportunity. The company’s early traction with Fortune 100 customers and 94% reduction in response times suggests that specialized defensive AI can deliver measurable ROI. However, the race is asymmetric—attackers already have a head start, and autonomous AI agents are becoming increasingly capable of executing full attack chains with minimal human oversight. Organizations must move beyond traditional security hygiene to AI-1ative defense postures. The question is no longer whether AI will transform cybersecurity, but whether defenders can catch up before the gap becomes unbridgeable.
Prediction
- +1 Specialized defensive foundation models like Corma’s will become the standard for enterprise security within 24-36 months, creating a new category of AI-1ative security operations centers (SOCs) that operate at machine speed
-
-1 The 88% AI attacker success rate will continue to rise as attackers refine their techniques, potentially exceeding 95% within 18 months unless defensive AI adoption accelerates significantly
-
+1 The agentic security workforce model—human-AI collaboration with human approval gates—will emerge as the dominant security operations paradigm, reducing Mean Time to Respond (MTTR) by over 90% across the industry
-
-1 LLM-generated malware, projected to account for 50% of detected threats in 2025, will likely become the primary attack vector by 2026, overwhelming traditional signature-based detection systems
-
+1 Regulatory frameworks will emerge requiring AI-1ative defensive capabilities for critical infrastructure, creating a compliance-driven market for defensive AI platforms
-
-1 The “defensive gap” will widen before it narrows, as frontier models continue to improve faster at offensive than defensive tasks, necessitating urgent investment in specialized defensive AI research
▶️ Related Video (72% Match):
https://www.youtube.com/watch?v=-VvBcaP7NsE
🎯Let’s Practice For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
IT/Security Reporter URL:
Reported By: https://lnkd.in/p/ez5NtsKJ – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
