Black October! What Is Happening to the Internet?｜Bankless

Security CEOs Hari Mulackal and Odysseas Lamtzidis argue AI has made hacking cheap and scalable, so organizations and individuals must self-attack, raise attack costs, and assume services and cyber insurers may fail.

Hari Mulackal, CEO of Cantina Security, argues that the "Black October" cybersecurity panic is a public tipping point, not a new phenomenon: AI-driven hacking has been scaling for roughly 18 months, and the cost of attacking any company is falling toward zero. He and Odysseas Lamtzidis, CEO of Phylax, spend most of the conversation on the economics of scalable offense, the surge in disclosed vulnerabilities, and what defenders and individuals should do in the 12 to 18 months. The week's headline incidents themselves get only brief treatment; the episode is mostly a forward-looking threat briefing.

Both guests run security startups and speak from operational experience. Mulackal's firm sells an offensive security agent called Apex and counts Coinbase, Robinhood Crypto, and Mastercard among its customers; Lamtzidis's Phylax protects the Linea ecosystem and is preparing a new network launch. The reader should come away with a clear model of why hacking has become a factory business, why the "zero-day clock" has gone negative, and a concrete personal checklist for protecting assets and data.

Hacking has become a factory business with near-zero marginal cost

Mulackal's core claim is that the scope of hacking has changed, not just the volume. Historically, breaching a company required talented people working for weeks or months, and the attacker needed a profit at the end to justify the effort. That made hacking bespoke and unscalable. Now, he says, you can build a factory that takes a website as input and returns exploits with no human in the loop, at a cost of roughly $10 versus two weeks of human time. The ROI question disappears because the cost is trivial.

He quantifies the trend: capabilities that existed in January 2026 are now 15 times cheaper by his firm's internal measure, and he expects costs to fall another 10x every 6 to 12 months. Lamtzidis adds the consequence for target selection: crypto was previously the clear target because the money at the end was obvious, while Web2 monetization was murkier. At near-zero cost, attackers no longer need to answer the monetization question up front.

"Hacking has now become scalable where you can build a factory where you can give it a website... and we'll go hack it. You don't even have to think costs because it will cost like $10 as opposed to like two weeks of human time." — Hari Mulackal

"Hacking has now become scalable where you can build a factory where you can give it a website... and we'll go hack it. You don't even have to think costs because it will cost like $10 as opposed to like two weeks of human time." — Hari Mulackal

Mulackal describes the resulting cybercrime motion as extortion at scale: breach or threaten to breach a database unless the victim pays. He notes that the same actors who ran high-volume phishing are shifting to zero-day exploitation because the economics now support it.

The public panic lags a trend that is 18 months old

Both guests push back on the framing that the last week is unprecedented. Mulackal says incidents have been rising for 18 months and that many never get reported publicly; the PHP-related incidents and some healthcare breaches simply made the news. He dates the capability inflection to around January 2026, when models got good enough at cyber and cheap enough to blast at many companies at once. Cantina began running large-scale disclosure campaigns starting this year.

Lamtzidis frames the shift as the collapse of security through obscurity. Last year's wave was social engineering and deepfakes, which were targeted. The new wave is cheap, broad scanning of the entire internet. He notes that the internet was never a "dark forest" the way crypto was, and organizations built on the assumption of obscurity are now exposed.

The disclosure surge shows up in the CVE data. Mulackal walks through a chart of cumulative published CVEs that is mostly flat, then slopes upward, then goes vertical. He attributes the recent jump to initiatives started roughly six months earlier that are only now surfacing publicly, and warns the chart understates current reality because of disclosure lag.

The zero-day clock is now negative

Mulackal introduces the "zero-day clock" as a way to think remediation time. In the past, a company might have months or years to fix a vulnerability before it was exploited. Today the clock is negative: the vulnerability is exploitable before you can patch. Lamtzidis explains the mechanism — the moment a vulnerability is disclosed, anyone can point an agent at the affected software and find it, so there is no window for defenders to upgrade first.

This is why Mulackal says companies holding customer data, reputation, or money are "living on borrowed time" and needed to act six months ago; the best available time is today. He frames inaction as a breach of duty to customers.

The practical implication is that defense must run at machine speed. Mulackal's prescription for the 12 to 18 months is to attack yourself continuously, fix everything found, and raise the cost of attacking you from $1 to something like $10,000 so most attackers skip you. He predicts security will follow software engineering toward a "security factory" model within two years — always-on offensive testing plus proactive fixes.

Offense holds the advantage for 12 to 18 months

Mulackal is blunt that offense will dominate for the 12 to 18 months. Lamtzidis agrees and gives the reason it will take that long even though the defensive tools exist: bureaucracy. Startups like Phylax can adopt tools like Apex immediately, but large organizations have humans and process as bottlenecks. He uses the image of a huge ship that must turn while being attacked by small speed boats.

Lamtzidis also reframes crypto's history. The industry was mocked for weekly $100 million hacks in 2020–2021, but the whole software industry was equally insecure; crypto simply had high incentives and public visibility. Now the economics have changed for everyone. Mulackal's line: "welcome to the 2020 crypto war" — a big incident every week is the new normal for the real world.

"You have a tanker, a huge ship and you have to turn it while you're being attacked by small speed boats." — Odysseas Lamtzidis

"You have a tanker, a huge ship and you have to turn it while you're being attacked by small speed boats." — Odysseas Lamtzidis

The silver lining both guests offer is conditional. Lamtzidis expects a "bloodbath" followed by a return to more balanced attacker-defender combat. Mulackal expects software to be materially safer after 18 months, but warns that persistent AI attackers mean a world where one mistake is fatal — a world that was not built for that pressure.

Crypto's adversarial upbringing is a real but limited advantage

Hoffman's reflex is that this environment is bullish for crypto because blockchain systems were born in adversarial conditions. Mulackal partly endorses this: companies built under intense offensive pressure have an operational edge now that the rest of the internet faces the same conditions. He notes his firm's history securing money, which he calls the hottest target short of government-to-government cyber.

On Coinbase specifically, Mulackal says its incentive to defend has been high for far longer than a traditional bank's, so it is likely better prepared than a large financial institution. He cites North Korean actors exploiting ATMs and Target gift cards to show that legacy finance is not immune just because money can be clawed back. His conclusion: funds at Coinbase are not weaker today than a month ago, but Coinbase must keep investing.

Lamtzidis adds a counterpoint on self-custody. For the 12 months he suggests individuals may be better off not self-custodying, or splitting assets across multiple exchanges that employ professional security teams and carry cyber insurance with liability attached.

Cyber insurance may be the thing to break

Lamtzidis flags a data point he finds alarming: in 2024, Lloyd's, which he describes as the biggest carrier in the world, said LLMs would create more cyber risk, yet cyber insurance premiums have fallen consistently since 2024. He expects many carriers to fail over the coming months, which undermines insurance as a backstop for custodial risk.

The broader point is that second- and third-order harms are hard to quantify. He cites the Ledger database leak from around 2021, which was linked to wrench attacks: attackers identified high-net-worth individuals from leaked data and went after them physically. Mulackal extends the harm model to data, reputation, and money, and raises the political stakes of a major bank breach — a leak at the scale of JP Morgan would have second- and third-order effects that change a country's politics.

Personal defense: audit your providers, assume breach, reduce blast radius

Mulackal's top recommendation is a personal audit. List every product holding your data or money, ask each what it is doing to protect you, and leave if the answer has not changed since the crisis began. He calls it almost irresponsible for companies not to act now, and says responsibility ultimately lies with builders, not non-technical users.

Lamtzidis's framework is redundancy and blast radius: assume every service you use will be infiltrated, and arrange things so multiple independent failures are required before you lose money. His example is stacking self-custody defenses — a Ledger plus an iPhone-secured key plus a Safe transaction path — so a supply-chain attack on any one layer is not enough. He concedes there is no good answer for non-technical users.

Mulackal's pragmatic tip is to stop clicking sketchy links, since most escalations require a user trigger. He also urges customers to pressure companies publicly.

Hoffman closes the discussion by asking custodians to make proactive public statements their security posture, naming Coinbase and Infinex as examples of the kind of transparency he wants to see.

The unresolved tension is between the guests' optimism safer software after the transition and Mulackal's warning that a world of persistent AI attackers is fundamentally different from the one the internet was designed for. The developments worth tracking are the CVE disclosure rate over the two quarters, whether cyber insurance carriers begin failing as Lamtzidis predicts, and whether large custodians publish concrete security commitments rather than reassurance.

Falling cyber insurance premiums since 2024, despite Lloyd's warning that LLMs increase cyber risk, suggest carriers are mispricing exposure — creating a window where insured custody looks safer than it may actually be.

Custodians holding customer assets face rising pressure to publicly communicate their security posture, as users are advised to audit and potentially migrate away from providers whose security programs haven't adapted.

Security is following software engineering toward "factories": continuous automated agents that both find breaches and fix them, replacing periodic human audits. Hari argues companies should attack themselves now and raise attacker cost from dollars to thousands of dollars to deter scalable attacks.

Large organizations face a bureaucracy bottleneck in adopting AI security tooling, while lean startups can deploy it immediately — meaning adaptation speed, not tool availability, will determine who gets breached.

For me it's all redundancies and blast radius. So assume you are going to be exposed to an incident... have a lot of redundancies such that a lot of organizations have to fail at the same time in order for you to lose money.

For me it's all redundancies and blast radius. So assume you are going to be exposed to an incident... have a lot of redundancies such that a lot of organizations have to fail at the same time in order for you to lose money.

If every individual is responsible for securing the software that they're using, that's not how it works. Most people are not technical... So the responsibility lies in the builders.

If every individual is responsible for securing the software that they're using, that's not how it works. Most people are not technical... So the responsibility lies in the builders.

Maybe for the foreseeable future, consider not self-custodying. Actually, maybe it's worth breaking up your assets into multiple exchanges, where not only you delegate the security to a professional team, but also they have cyber insurance.

Maybe for the foreseeable future, consider not self-custodying. Actually, maybe it's worth breaking up your assets into multiple exchanges, where not only you delegate the security to a professional team, but also they have cyber insurance.

Unfortunately, for the , I would say, 12 to 18 months, it's going to be largely dominated by offense. So the best way to understand what you need to do is to attack yourself.

Unfortunately, for the , I would say, 12 to 18 months, it's going to be largely dominated by offense. So the best way to understand what you need to do is to attack yourself.

If the cost to attack you is like a dollar, like you will get attacked. Like make it like $10,000. And most people like would not attack you.

If the cost to attack you is like a dollar, like you will get attacked. Like make it like $10,000. And most people like would not attack you.

Suddenly crypto was always the dark forest. And we grew up in that environment... But the internet was never a dark forest. Like security through obscurity worked.

Suddenly crypto was always the dark forest. And we grew up in that environment... But the internet was never a dark forest. Like security through obscurity worked.

Democratizing Security for the Agentic Web with Cloudflare CTO Dane Knecht

The New Apex Predator: CrowdStrike CEO George Kurtz on Adversaries Armed With AI Agents

Databricks CEO on What We’re Getting Wrong Existential Risk

AI Hackers Are Faster Than Your Pen Test — Eli Cohen, Snyk

Kevin Mandia on Why Security Starts With Offense

The Internet Is Under Attack. Is Crypto ?

The AI Industry is a Complete Mess

Unpacking Marvell's Analyst Day, OpenAI Revenue Rumors, and the Heterogeneous Rack

A Bear Market Inside a Bull Market

The Real Reason AI Founders Are Calling For a Slowdown | Conversations

Turing CEO on Super Intelligence, Open Source, Agents

France Protests Explained: Should America Worry? | The Week

Security CEOs Hari Mulackal and Odysseas Lamtzidis argue AI has made hacking cheap and scalable, so organizations and individuals must self-attack, raise attack costs, and assume services and cyber insurers may fail.

Hari Mulackal, CEO of Cantina Security, argues that the "Black October" cybersecurity panic is a public tipping point, not a new phenomenon: AI-driven hacking has been scaling for roughly 18 months, and the cost of attacking any company is falling toward zero. He and Odysseas Lamtzidis, CEO of Phylax, spend most of the conversation on the economics of scalable offense, the surge in disclosed vulnerabilities, and what defenders and individuals should do in the 12 to 18 months. The week's headline incidents themselves get only brief treatment; the episode is mostly a forward-looking threat briefing.

Both guests run security startups and speak from operational experience. Mulackal's firm sells an offensive security agent called Apex and counts Coinbase, Robinhood Crypto, and Mastercard among its customers; Lamtzidis's Phylax protects the Linea ecosystem and is preparing a new network launch. The reader should come away with a clear model of why hacking has become a factory business, why the "zero-day clock" has gone negative, and a concrete personal checklist for protecting assets and data.

Hacking has become a factory business with near-zero marginal cost

Mulackal's core claim is that the scope of hacking has changed, not just the volume. Historically, breaching a company required talented people working for weeks or months, and the attacker needed a profit at the end to justify the effort. That made hacking bespoke and unscalable. Now, he says, you can build a factory that takes a website as input and returns exploits with no human in the loop, at a cost of roughly $10 versus two weeks of human time. The ROI question disappears because the cost is trivial.

He quantifies the trend: capabilities that existed in January 2026 are now 15 times cheaper by his firm's internal measure, and he expects costs to fall another 10x every 6 to 12 months. Lamtzidis adds the consequence for target selection: crypto was previously the clear target because the money at the end was obvious, while Web2 monetization was murkier. At near-zero cost, attackers no longer need to answer the monetization question up front.

"Hacking has now become scalable where you can build a factory where you can give it a website... and we'll go hack it. You don't even have to think costs because it will cost like $10 as opposed to like two weeks of human time." — Hari Mulackal

"Hacking has now become scalable where you can build a factory where you can give it a website... and we'll go hack it. You don't even have to think costs because it will cost like $10 as opposed to like two weeks of human time." — Hari Mulackal

Mulackal describes the resulting cybercrime motion as extortion at scale: breach or threaten to breach a database unless the victim pays. He notes that the same actors who ran high-volume phishing are shifting to zero-day exploitation because the economics now support it.

The public panic lags a trend that is 18 months old

Both guests push back on the framing that the last week is unprecedented. Mulackal says incidents have been rising for 18 months and that many never get reported publicly; the PHP-related incidents and some healthcare breaches simply made the news. He dates the capability inflection to around January 2026, when models got good enough at cyber and cheap enough to blast at many companies at once. Cantina began running large-scale disclosure campaigns starting this year.

Lamtzidis frames the shift as the collapse of security through obscurity. Last year's wave was social engineering and deepfakes, which were targeted. The new wave is cheap, broad scanning of the entire internet. He notes that the internet was never a "dark forest" the way crypto was, and organizations built on the assumption of obscurity are now exposed.

The disclosure surge shows up in the CVE data. Mulackal walks through a chart of cumulative published CVEs that is mostly flat, then slopes upward, then goes vertical. He attributes the recent jump to initiatives started roughly six months earlier that are only now surfacing publicly, and warns the chart understates current reality because of disclosure lag.

The zero-day clock is now negative

Mulackal introduces the "zero-day clock" as a way to think remediation time. In the past, a company might have months or years to fix a vulnerability before it was exploited. Today the clock is negative: the vulnerability is exploitable before you can patch. Lamtzidis explains the mechanism — the moment a vulnerability is disclosed, anyone can point an agent at the affected software and find it, so there is no window for defenders to upgrade first.

This is why Mulackal says companies holding customer data, reputation, or money are "living on borrowed time" and needed to act six months ago; the best available time is today. He frames inaction as a breach of duty to customers.

The practical implication is that defense must run at machine speed. Mulackal's prescription for the 12 to 18 months is to attack yourself continuously, fix everything found, and raise the cost of attacking you from $1 to something like $10,000 so most attackers skip you. He predicts security will follow software engineering toward a "security factory" model within two years — always-on offensive testing plus proactive fixes.

Offense holds the advantage for 12 to 18 months

Mulackal is blunt that offense will dominate for the 12 to 18 months. Lamtzidis agrees and gives the reason it will take that long even though the defensive tools exist: bureaucracy. Startups like Phylax can adopt tools like Apex immediately, but large organizations have humans and process as bottlenecks. He uses the image of a huge ship that must turn while being attacked by small speed boats.

Lamtzidis also reframes crypto's history. The industry was mocked for weekly $100 million hacks in 2020–2021, but the whole software industry was equally insecure; crypto simply had high incentives and public visibility. Now the economics have changed for everyone. Mulackal's line: "welcome to the 2020 crypto war" — a big incident every week is the new normal for the real world.

"You have a tanker, a huge ship and you have to turn it while you're being attacked by small speed boats." — Odysseas Lamtzidis

"You have a tanker, a huge ship and you have to turn it while you're being attacked by small speed boats." — Odysseas Lamtzidis

The silver lining both guests offer is conditional. Lamtzidis expects a "bloodbath" followed by a return to more balanced attacker-defender combat. Mulackal expects software to be materially safer after 18 months, but warns that persistent AI attackers mean a world where one mistake is fatal — a world that was not built for that pressure.

Crypto's adversarial upbringing is a real but limited advantage

Hoffman's reflex is that this environment is bullish for crypto because blockchain systems were born in adversarial conditions. Mulackal partly endorses this: companies built under intense offensive pressure have an operational edge now that the rest of the internet faces the same conditions. He notes his firm's history securing money, which he calls the hottest target short of government-to-government cyber.

On Coinbase specifically, Mulackal says its incentive to defend has been high for far longer than a traditional bank's, so it is likely better prepared than a large financial institution. He cites North Korean actors exploiting ATMs and Target gift cards to show that legacy finance is not immune just because money can be clawed back. His conclusion: funds at Coinbase are not weaker today than a month ago, but Coinbase must keep investing.

Lamtzidis adds a counterpoint on self-custody. For the 12 months he suggests individuals may be better off not self-custodying, or splitting assets across multiple exchanges that employ professional security teams and carry cyber insurance with liability attached.

Cyber insurance may be the thing to break

Lamtzidis flags a data point he finds alarming: in 2024, Lloyd's, which he describes as the biggest carrier in the world, said LLMs would create more cyber risk, yet cyber insurance premiums have fallen consistently since 2024. He expects many carriers to fail over the coming months, which undermines insurance as a backstop for custodial risk.

The broader point is that second- and third-order harms are hard to quantify. He cites the Ledger database leak from around 2021, which was linked to wrench attacks: attackers identified high-net-worth individuals from leaked data and went after them physically. Mulackal extends the harm model to data, reputation, and money, and raises the political stakes of a major bank breach — a leak at the scale of JP Morgan would have second- and third-order effects that change a country's politics.

Personal defense: audit your providers, assume breach, reduce blast radius

Mulackal's top recommendation is a personal audit. List every product holding your data or money, ask each what it is doing to protect you, and leave if the answer has not changed since the crisis began. He calls it almost irresponsible for companies not to act now, and says responsibility ultimately lies with builders, not non-technical users.

Lamtzidis's framework is redundancy and blast radius: assume every service you use will be infiltrated, and arrange things so multiple independent failures are required before you lose money. His example is stacking self-custody defenses — a Ledger plus an iPhone-secured key plus a Safe transaction path — so a supply-chain attack on any one layer is not enough. He concedes there is no good answer for non-technical users.

Mulackal's pragmatic tip is to stop clicking sketchy links, since most escalations require a user trigger. He also urges customers to pressure companies publicly.

Hoffman closes the discussion by asking custodians to make proactive public statements their security posture, naming Coinbase and Infinex as examples of the kind of transparency he wants to see.

The unresolved tension is between the guests' optimism safer software after the transition and Mulackal's warning that a world of persistent AI attackers is fundamentally different from the one the internet was designed for. The developments worth tracking are the CVE disclosure rate over the two quarters, whether cyber insurance carriers begin failing as Lamtzidis predicts, and whether large custodians publish concrete security commitments rather than reassurance.

Falling cyber insurance premiums since 2024, despite Lloyd's warning that LLMs increase cyber risk, suggest carriers are mispricing exposure — creating a window where insured custody looks safer than it may actually be.

Custodians holding customer assets face rising pressure to publicly communicate their security posture, as users are advised to audit and potentially migrate away from providers whose security programs haven't adapted.

Security is following software engineering toward "factories": continuous automated agents that both find breaches and fix them, replacing periodic human audits. Hari argues companies should attack themselves now and raise attacker cost from dollars to thousands of dollars to deter scalable attacks.

Large organizations face a bureaucracy bottleneck in adopting AI security tooling, while lean startups can deploy it immediately — meaning adaptation speed, not tool availability, will determine who gets breached.

For me it's all redundancies and blast radius. So assume you are going to be exposed to an incident... have a lot of redundancies such that a lot of organizations have to fail at the same time in order for you to lose money.

For me it's all redundancies and blast radius. So assume you are going to be exposed to an incident... have a lot of redundancies such that a lot of organizations have to fail at the same time in order for you to lose money.

If every individual is responsible for securing the software that they're using, that's not how it works. Most people are not technical... So the responsibility lies in the builders.

If every individual is responsible for securing the software that they're using, that's not how it works. Most people are not technical... So the responsibility lies in the builders.

Maybe for the foreseeable future, consider not self-custodying. Actually, maybe it's worth breaking up your assets into multiple exchanges, where not only you delegate the security to a professional team, but also they have cyber insurance.

Maybe for the foreseeable future, consider not self-custodying. Actually, maybe it's worth breaking up your assets into multiple exchanges, where not only you delegate the security to a professional team, but also they have cyber insurance.

Unfortunately, for the , I would say, 12 to 18 months, it's going to be largely dominated by offense. So the best way to understand what you need to do is to attack yourself.

Unfortunately, for the , I would say, 12 to 18 months, it's going to be largely dominated by offense. So the best way to understand what you need to do is to attack yourself.

If the cost to attack you is like a dollar, like you will get attacked. Like make it like $10,000. And most people like would not attack you.

If the cost to attack you is like a dollar, like you will get attacked. Like make it like $10,000. And most people like would not attack you.

Suddenly crypto was always the dark forest. And we grew up in that environment... But the internet was never a dark forest. Like security through obscurity worked.

Suddenly crypto was always the dark forest. And we grew up in that environment... But the internet was never a dark forest. Like security through obscurity worked.

Democratizing Security for the Agentic Web with Cloudflare CTO Dane Knecht

The New Apex Predator: CrowdStrike CEO George Kurtz on Adversaries Armed With AI Agents

Databricks CEO on What We’re Getting Wrong Existential Risk

AI Hackers Are Faster Than Your Pen Test — Eli Cohen, Snyk

Kevin Mandia on Why Security Starts With Offense

The Internet Is Under Attack. Is Crypto ?

The AI Industry is a Complete Mess

Unpacking Marvell's Analyst Day, OpenAI Revenue Rumors, and the Heterogeneous Rack

A Bear Market Inside a Bull Market

The Real Reason AI Founders Are Calling For a Slowdown | Conversations

Turing CEO on Super Intelligence, Open Source, Agents

France Protests Explained: Should America Worry? | The Week