Will AI Vulnerability Scanning Depreciate Over Time? A Deep Dive into Offensive-Defensive Economics

A Question Worth Pondering

As AI model capabilities skyrocket and prices continue to plummet, an economic question about cybersecurity emerges: Will the value of AI-driven vulnerability scanning services depreciate over time, remain constant, or continuously appreciate?

This discussion originally stemmed from a Twitter user's observation. They noted that OpenAI's cybersecurity models will likely become cheaper, and the next-generation Kimi model's costs will drop even further. But on the other side, the tools in attackers' hands are simultaneously growing more powerful. This creates a classic "offensive-defensive" dynamic equilibrium problem.

Notably, the two models mentioned here represent important industry trends. In 2025, OpenAI began optimizing its model capabilities specifically for cybersecurity scenarios, releasing specialized models with code auditing and vulnerability pattern recognition abilities. Kimi is a large language model from Chinese AI company Moonshot AI, known for its extremely low inference costs. The entire industry is experiencing a so-called "inference cost Moore's Law"—every few months, the cost of AI inference at equivalent capability drops by an order of magnitude. This steep cost curve means that deep scanning capabilities once only affordable to large security firms are rapidly being democratized.

The Core Logic Behind AI Vulnerability Scanning Depreciation

The original author's judgment is: The value of vulnerability scanning will still decline over time, but at a slower rate than model price reductions (at equivalent capability levels).

Behind this viewpoint lies a key assumption—there's only so much attack surface.

Attack surface is a core concept in cybersecurity, referring to the sum of all points in a system where an unauthorized user could potentially gain entry or extract data. It includes the network attack surface (open ports, API endpoints, network protocols), software attack surface (input validation points in code, dependency libraries, configuration interfaces), and physical attack surface (hardware interfaces, storage media). Attack Surface Management (ASM) has become an independent security sub-market, with Gartner listing it as a key security technology trend. The deeper implication of the "finite" attack surface assertion is: for any given system version, the number of exposed attack entry points is enumerable rather than infinitely expandable, similar to the mathematical concept of a finite set.

Why Does a Finite Attack Surface Imply Value Depreciation?

Think of it this way: the value of vulnerability scanning fundamentally depends on "how many undiscovered, unpatched vulnerabilities remain." When AI scanning tools become cheap enough and widespread enough, the vast majority of common, pattern-based vulnerabilities will be quickly identified and patched. Over time:

• The software stack itself continuously evolves, gradually phasing out high-risk legacy components
• Automated scanning picks more and more of the "low-hanging fruit"
• Remaining vulnerabilities become increasingly difficult to find, and marginal value diminishes accordingly

The term "low-hanging fruit" in the security industry specifically refers to common vulnerability types easily found by automated tools, such as SQL injection, cross-site scripting (XSS), unpatched components with known CVEs, and default credentials. Most vulnerability categories listed in the OWASP Top 10 fall into this category. Historical data shows that average bounty amounts and discovery frequency on bug bounty platforms (such as HackerOne and Bugcrowd) exhibit clear stratification: 80% of reports concentrate on 20% of common vulnerability types, while truly high-value zero-day vulnerabilities are increasingly difficult to discover, requiring exponentially greater research depth and time investment. This perfectly illustrates the economic law of diminishing marginal returns.

In other words, once scanning capability becomes commoditized, the "incremental security gain" from each scan shrinks. This mirrors the value curve of many technology services: the more widespread the capability, the lower the unit value.

The Paradox of Simultaneous Offensive-Defensive Escalation

To be specific, this judgment is not without opposing forces. The growth of AI model capabilities is a double-edged sword:

"OpenAI's cybersecurity model may be cheaper, the next-gen Kimi will be cheaper, but along with that comes increased attacker capabilities."

This means that while defenders lower their costs, attackers also gain equally cheap and powerful weapons. Theoretically, if attacker capabilities grow fast enough, the value of vulnerability scanning should actually increase—because you need stronger defense to counter stronger offense.

However, the original author's judgment still leans toward "depreciation," with the reasoning returning to that core premise: the physical ceiling of the attack surface. Regardless of how the arms race between offense and defense escalates, the entry points through which a system can be attacked are ultimately finite. Once these entry points are systematically hardened, the incremental value that pure software-level vulnerability scanning can deliver will inevitably diminish.

The Ultimate Form of Security: Descending from Application Layer to Hardware Layer

One particularly forward-looking viewpoint in the article concerns the path to "cybersecurity-maxx":

"You can make code as secure as possible, but if you truly want to push security to the extreme, you should switch to a more secure tech stack, and that might mean going all the way down to the hardware level."

Defense in Depth: From Application Layer to Hardware Layer

This reveals an important shift in security thinking: relying solely on application-layer vulnerability scanning has a ceiling. True security requires rethinking from an architectural level:

• Tech stack selection: Adopting memory-safe languages (like Rust), formally verified systems, to reduce vulnerability categories at the source
• Hardware-level security: Trusted Execution Environments (TEE), Hardware Security Modules (HSM), Secure Boot, etc., anchoring the root of trust in hardware

Rust is the representative memory-safe language, eliminating entire classes of vulnerabilities—buffer overflows, null pointer dereferences, data races—at compile time through its ownership system and borrow checker. Microsoft's research shows that approximately 70% of security vulnerabilities in their products are memory safety issues, meaning language choice alone can eliminate the majority of vulnerability categories at the source. Formal verification goes even further, using mathematical methods to prove that a program satisfies its specification. The seL4 microkernel is the first operating system kernel to undergo complete formal verification and has been used in military and aerospace applications. The proliferation of these technologies will fundamentally change the value equation of vulnerability scanning—if vulnerability categories themselves are eliminated, tools that scan for those categories naturally lose their purpose.

Regarding hardware security, Trusted Execution Environments (TEE) are isolated secure regions within processor chips that can protect code and data running within them from being observed by even the operating system or hypervisor. Intel SGX, ARM TrustZone, and AMD SEV are mainstream implementations. Hardware Security Modules (HSM) are dedicated physical devices for securely generating, storing, and managing cryptographic keys, widely used by banks and certificate authorities. Secure Boot ensures that every step from firmware to operating system loading undergoes signature verification, forming a Chain of Trust from hardware to software. These technologies anchor the Root of Trust at the hardware level, ensuring that even if software is completely compromised, critical assets remain protected.

When defenses are pushed to lower layers of the stack, the relative value of software vulnerability scanning is naturally further diluted.

The Most Fortified and Most Vulnerable: The Two Extremes of the Tech Stack

The article concludes with a thought-provoking observation—the best attack surface always exists at the two extremes of the tech stack: the very top and the very bottom:

"Ultimately, the best attack surface will be at the very top and very bottom of the stack—the humans who have control or physical access to the machines."

This insight strikes at the essence of cybersecurity:

The Top: The Human Factor

No matter how fortified the tech stack is, humans are always the weakest link. Social engineering attacks, insider threats, privilege abuse—none of these can be prevented through code scanning. Administrators and developers who possess system control are themselves the highest-value attack targets.

Social engineering attacks exploit human psychological weaknesses (such as trust, fear, curiosity) to bypass technical defenses. The massive 2024 MGM Resorts attack began with a phone phishing call targeting the IT help desk. The Verizon Data Breach Investigations Report (DBIR) has consistently shown for years that over 74% of security incidents involve the human factor. Insider threats are even harder to defend against—employees with legitimate access can steal data without triggering traditional detection systems. No matter how powerful AI becomes, it cannot fully predict irrational human behavior and social dynamics. This explains why security training, Zero Trust architecture, and the Principle of Least Privilege—human-centered security measures—will never become obsolete.

The Bottom: Physical Access

The other extreme is physical access to machines. Once an attacker can physically touch the hardware, nearly all software defenses can potentially be bypassed. This is why data center physical security and supply chain security are so critical.

Supply chain attacks compromise upstream software or hardware suppliers to indirectly attack the final target. The 2020 SolarWinds incident affected over 18,000 organizations including multiple U.S. government agencies, and the 2021 Codecov and Kaseya incidents further highlighted the destructive power of this threat vector. At the hardware level, backdoor implantation during chip manufacturing (hardware trojans) is nearly undetectable. The U.S. CHIPS Act and EU Chips Act were enacted partly due to concerns about semiconductor supply chain security. These threats cannot be discovered through application-layer AI scanning and require comprehensive multi-layered controls spanning procurement audits, code signing, SBOM (Software Bill of Materials), and physical security.

Conclusion: The Right Direction for Security Investment in the AI Era

Although this brief discussion was framed as a "bet," it outlines a clear picture of cybersecurity economics in the AI era:

1. AI vulnerability scanning will continue to depreciate, because the attack surface is finite and scanning capability is being commoditized;
2. Depreciation will be slower than model price drops, because offense and defense are escalating simultaneously and defensive needs won't disappear;
3. The true security moat lies in architecture and hardware layers, not merely application-layer scanning;
4. Humans and physical access remain the ultimate attack surfaces, a blind spot that no AI tool can fully cover.

For security practitioners and enterprise decision-makers, this suggests we shouldn't bet our entire budget on increasingly cheaper AI scanning tools. Instead, we should invest more in security architecture, supply chain governance, and personnel security awareness—these are the areas whose long-term value won't depreciate.