A cyberattack that once might have taken weeks or months to unfold can now go from initial access to a complete system takeover in minutes. That was the lesson CJ Moses, CISO of Amazon, shared with Shahar Peled. Peled is CEO and co-founder of Terra Security, and they spoke during the opening episode of AI Native Cybersecurity. It is a new podcast examining how artificial intelligence is changing the balance between attackers and defenders.
The conversation offers a look at the operational challenges facing security teams as AI accelerates vulnerability discovery, reconnaissance, and exploitation. Through the podcast, Terra Security aims to bring security leaders together. They discuss practical lessons from deploying AI, separating hype from reality, and preparing for the next phase of cyber defense.
The window between discovery and exploitation is shrinking
One of the most striking examples Moses shared came from Amazon’s MadPot honeypot infrastructure, which monitors adversary behavior. In one observed incident, an attacker moved from having no access to taking over the compromised system and expanding through its available access. It took 12 minutes and 42 seconds.
“In the past, this would have been a campaign by an adversary. Weeks, sometimes months, would go on forever. This was 12 minutes to just shy of 13 minutes.” CJ Moses, CISO, Amazon
The example illustrates a fundamental change in the assumptions underlying vulnerability management. Security teams have historically operated with patching windows measured in days or months. But attackers can now move through reconnaissance, exploitation, and lateral movement in a fraction of an hour. When they do, the time available to identify and contain a threat becomes much shorter.
For Moses, the central issue is velocity. AI gives adversaries the ability to do more within a shorter period. That makes speed of response as important as the number of vulnerabilities discovered.
Why more security tools may not be enough
Security programs have traditionally relied on layers of defensive controls to prevent intrusions or slow attackers down. Moses argued that this strategy still has value. But AI-enabled adversaries can increasingly connect individual weaknesses into longer attack paths.
That changes the role of offensive security. Rather than relying exclusively on defensive controls, organizations need to test their environments continuously. They need to determine which vulnerabilities can actually be exploited.
Referring to security checks during software development, Moses warned against slowing down.
“The reality is if you slow down, you’re actually playing into the hands of the thing we talked about in the beginning.” CJ Moses
At Amazon, the approach includes integrating security scans into continuous integration and continuous delivery pipelines. AI-assisted scanning can identify issues as code is developed, while additional testing can validate the finished product. This allows security teams to address weaknesses without unnecessarily delaying software delivery.
Moses also described how Amazon uses intelligence from its MadPot infrastructure to inform patching priorities. Understanding what adversaries are targeting helps teams decide which weaknesses require immediate attention.
AI is expanding the threat beyond software
The risks extend beyond vulnerabilities in applications and infrastructure. Moses described North Korean operations that use AI to generate personas and support fabricated identities. Their aim is to obtain jobs at companies.
Amazon has stopped at least 2,900 North Korean actors during its hiring process, according to Moses. The example demonstrates how AI can amplify identity-based threats, complicating the work of security and hiring teams alike.
Amazon’s integrated security model brings together cyber intelligence, personnel security, investigations, and other capabilities. The objective is to connect information across business units so that warning signs do not remain isolated in separate organizational functions.
As AI makes it easier to scale deceptive operations, that ability to combine information becomes increasingly important.
Measuring exposure instead of counting vulnerabilities
The episode concludes with a challenge to one of cybersecurity’s most familiar metrics: the number of vulnerabilities a team finds or patches.
“I think the measure of a good security program won’t be how many vulnerabilities you found.” CJ Moses
Instead, he expects the industry to focus on the time between discovering a vulnerability and patching or otherwise mitigating it. The appropriate response may involve blocking access, isolating a system, or applying another effective control rather than waiting for a conventional patch.
That shift would measure security performance by how quickly an organization reduces exposure to real attacks, rather than how many weaknesses appear on a dashboard.
As AI continues to accelerate both offense and defense, the practical question for security leaders is becoming less about how many vulnerabilities they can identify. It is more about whether they can close the window of opportunity before an attacker acts.