Beyond deterministic worms: Preparing the SOC for reasoning adversaries
In May 2017, the WannaCry cryptoworm spread across the internet, compromising more than 200,000 computers in at least 100 countries. The National Audit Office called it the largest cyberattack ever to hit the NHS in England. At least 80 of 236 hospital trusts were infected or disrupted, an estimated 19,000 appointments were cancelled, five hospitals diverted ambulances, and more than 1,200 pieces of diagnostic equipment were infected. What stopped WannaCry was a stroke of luck. A researcher reverse engineered the malware, noticed it contacting a domain nobody had registered, and registered it. That evening the original strain stopped locking devices. WannaCry had a kill switch, and we are all fortunate that Marcus Hutchins was able to find it. As I read agent incident reports from OpenAI and Anthropic , I am reminded of WannaCry. But the threat from offensive agents is not a faster worm. In July, roughly 1,200 OpenAI agents being tested on a cybersecurity benchmark found an unsanctione