I spent last evening at a white hat security meetup. The conversations stayed with me.
Three DevSecOps engineers sat around a table, coffee growing cold. Their problem wasn’t sophisticated attacks or zero-day exploits. Their problem was volume. Too many findings. Too many false positives. Not enough hours in the day.
They pipe everything into the SIEM, or Security Information and Event Management. Then they drown in alerts.
Many of their triaged issues turn out to be nothing. But they have to check each one. The signal gets lost in the noise.
The problem is speed. They can’t review fast enough. By the time they close one ticket, three more appear.
I mentioned AI agents. Their expressions shifted from skepticism to cautious interest.
The Security Audit Gap
The conversation reminded me of a recent blog post I read: ‘Fear of the Walking Zig: The Security Audit Gap’ by Krzyś, published December 7, 2025. The post examines how compile-time code execution in languages like Zig creates new attack surfaces that traditional security tooling struggles to detect.
Krzyś describes the attacker workflow that fast iteration enables:
- AI generates comptime payload variant
- Compilation attempts (< 5 seconds)
- Did it compile? Did the comptime logic execute?
- If no: AI generates new variant based on error
- If yes: Does it produce the desired effect?
- Iterate until successful
- Generate 50 more variants with slight mutations
- Package the most reliable ones into dependencies
Five seconds per iteration. Thousands of variants per hour. That’s the pace attackers can operate at when AI meets fast compilation.
The speed comes from Zig’s design. Zig 0.15.1 released with its own x86 backend, 5 times faster than LLVM. As Andrew Kelley explains, Zig doesn’t depend on LLVM. LLVM is slow, limits innovation, and makes building from source difficult. Zig’s own backend enables faster compilation and more control over the toolchain.
The post hit me because it describes the same fundamental problem those engineers at the meetup face: a gap between attack velocity and defensive capacity. Attackers evolve faster than defenders can respond.
Building a 10x Agent
I’m developing an AI agent designed to close that gap. The goal is simple to state, hard to achieve: 10x faster iteration, 10x smaller footprint than traditional AI agents.
Through my own implementation, I’ve learned that iteration speed isn’t just performance. The feedback loop emerges from tool-calling LLMs. The LLM selects tools, executes them, observes results, and adapts. This cycle repeats in seconds. When each iteration compounds learning, execution speed becomes execution capability.
The security space moves too fast for slow feedback loops. New vulnerabilities emerge daily. New attack patterns evolve hourly. Defenders need tools that match that velocity.
Fast iteration enables something I call ‘agentic execution.’ Rather than waiting for humans to analyze a new threat, write signatures, deploy updates, an agent can:
- Detect anomalies in real-time
- Generate hypotheses about attack patterns
- Validate hypotheses against behavioral signals
- Update detection logic within minutes
Each cycle makes the system smarter. The compound effect transforms reactive defense into adaptive defense.
Why Speed Matters More Than You Think
The DevSecOps engineers understood the concept immediately. One asked the right question: ‘How do you handle false positives at that speed?’
The answer is iteration. Speed without learning just means faster mistakes. Speed with feedback means rapid improvement. The agent must observe its own false positives, learn from them, and adjust.
Krzyś’s post describes how AI combined with fast compilation creates ‘mutation engines’ for attacks. The same principle applies to defense. Fast iteration turns the tables. Defenders can mutate their detection patterns as quickly as attackers mutate their payloads.
The gap isn’t insurmountable. It requires tools that match the pace of change.
The Path Forward
They’re skeptical, as they should be. Security professionals learn to distrust easy solutions.
But they’re also desperate. The volume problem isn’t hypothetical. It’s the daily reality of keeping systems safe in a world where attack surfaces expand faster than teams can review them.
Iteration speed isn’t a silver bullet. It’s a fundamental capability that enables everything else: rapid learning, adaptive defense, compound improvement.
The security audit gap exists. The question is whether defenders will close it before attackers exploit it further.
Inspired by conversations at the white hat security meetup and ‘Fear of the Walking Zig: The Security Audit Gap’ by Krzyś.