THE article discusses the declining confidence in autonomous security tools, particularly in light of how adversaries exploit the governance structures designed to protect these systems. The author notes that as organizations rely less on autonomous penetration testing, the methods used by adversaries have evolved. With autonomous systems bound by established rules, adversaries can effectively probe these systems without needing to breach them directly.
The concept of 'cap weaponization' is introduced, which refers to the exploitation of governance layers as an attack surface. To combat this, the article suggests maintaining an independent record of authority enforcement, conducting long-window reviews instead of short-term assessments, and red-teaming the governance as well as the technical code.