威胁民主化：攻防天平的倾斜
AI模型如 Mythos（Mythos: 演讲中提到的一种代表性高能力对抗性AI模型）正在颠覆网络安全领域的权力天平。过去，对一家企业发起高度定制化的网络攻击需要庞大的专业团队和深厚的资金支持；如今，两个心怀执念的攻击者加上一块 GPU，就足以对一家大型公司发起精准打击。这并非虚张声势的危言耸听，而是网络攻击民主化（Democratization: 攻击技术与工具向更广泛、低门槛人群普及的现象）带来的现实威胁。AI在赋能开发者提升生产力的同时，也让攻击者与防御者实现了能力的自我迭代。然而，这导致了一个残酷的现实：技术代差的消失。通过 Mythos，一个脚本小子（Script Kiddie: 缺乏深厚技术背景、仅依靠现成工具发起攻击的业余黑客）就能够完成过去只有极少数精英黑客团队才能实施的高难度攻击。真正的权力收敛并不意味着攻击速度的单纯提升，而是专业能力的门槛坍塌为了低廉的订阅服务。
这种变局正以级联效应向外扩散。它首先作用于个体攻击者，随后波及到企业，并最终走向国家级力量。例如，美国网络司令部（US Cyber Command）已经将 AI 整合为作战体系的一部分。然而，更具毁灭性且不受地缘政治与交战规则约束的，是那些获取了 Mythos 级别模型的“公民黑客”或个体攻击者。由于失去了规则的掣肘，他们的潜在威胁呈指数级增长。这导致近期诸如 Vercel 等处于成长阶段的明星企业屡屡爆出安全失陷的头条新闻，威胁的广度与烈度已不可同日而语。
Original English Source
Mythos changes the balance of power in cyber. Two people in a GPU with enough conviction can target a company. And I think that that will happen, but I also think like Mythos to me is not like existentially scary. Mythos is what we in security have been saying for years. Really, the question we should be asking is, okay, after Mythos, what's coming after? What are we ready for? We have a very unique window of time right now where we understand what is coming and we have the ability to adapt technology. The question is, can defenders adjust as quickly as the attackers can? Much like how AI has enabled productivity for developers, it's also allowed both attackers and defenders to uplevel themselves. Elite AI engineering or elite security judgment? Certainly elite security judgment. That gut instinct takes a decade or more to build, and that is a very small subset of people. But a Mythos allow a script kiddie, so a non-sophisticated threat actor, to be able to do things that used to be reserved to a very elite group of people. What the actual power convergence means is not "Hey, can I do things faster?" but rather the talent gap has collapsed to a subscription model. It impacts it in a cascading series of events. So it starts with the individual and then onto companies, because an individual can quickly adopt AI. A company can adopt AI relatively quickly. But ultimately this will go towards nation-states. We see that nation-states already. US Cyber Command is using AI as a part of its components. That is really, really concerning. But I also think like the broader, more existential question is what happens when the citizen hacker, when one person gets access to a Mythos-level model? Because they aren't governed by geopolitics and rules of engagement. They can do what they want. And I think that that will happen. The number of potential threat actors is dramatically increasing. You know, you've gone from a few score highly sophisticated groups to, honestly, two people in a GPU who with enough conviction can target a company. You see earlier stage companies being targeted. We've seen this in the headlines recently where growth stage companies like Vercel have had breaches. That's no fault of anyone's, but just when more people can do these things, you're going to see a greater indication and a greater veracity of threats.第一性原理：网络安全范式重构
在如此严峻的安全形势下，Nebulo（Nebulo: Damien 创立的上下文安全平台，亦在转写中被称为 Nebulon 或 Nebulock）的诞生正是为了解决企业安全防护中的核心痛点。创始人 Damien Lucius（Damien Lucius: 资深安全专家与创业者，转写中亦写作 Damien Lewke）拥有极为丰富的实战背景，他的职业生涯起步于国防巨头 诺斯罗普·格鲁曼（Northrop Grumman），随后在国防部（DoD）负责构建网络运营与威胁猎捕团队。后来，他作为早期员工加入 CrowdStrike 并经历了其上市的全过程，并先后在 帕罗奥图网络（Palo Alto Networks）和 Arctic Wolf 负责 AI 检测与安全研究，期间还在麻省理工学院（MIT）的计算机科学与人工智能实验室（CSAIL）完成了关于 AI 检测的安全研究。
正是在这一连串的安全运营实践中，Damien 发现了普遍存在的行业悖论：几乎所有客户都已经购买了市场上最顶级的安全工具——这相当于车库里停满了奥迪或法拉利——但他们依然面临系统失陷。原因在于，针对特定问题的单一攻击点解决方案（Point Solutions）无法从根本上阻断入侵。防御者必须回归第一性原理（First Principles: 从最本质的物理或逻辑规律出发，不带假设地重构问题解决路径的思维模式）重新审视安全范式。为此，他在 2024 年初毅然辞去高管职位，甚至做好了颗粒无收的准备，倾其所有创立了 Nebulo。作为创业者，Damien 认为必须对“问题”本身保持极致的偏执，而不是盲目崇拜某一种特定的“解决方案”。他的核心假设在于：攻击者必将利用 AI 来实现定制化访问操作的自动化，自动走完侦察、渗透、达成目标并悄无声息撤退的完整生命周期。Nebulo 的目标就是将这种最高杠杆率的安全猎捕能力民主化，打破预算与技术水平的壁垒，让所有企业都能在现有安全工具的缝隙中主动捕获隐蔽的威胁。
Original English Source
I'm Damien Lucius. I'm the founder and CEO of Nebulo. Nebulo is a contextual security platform. Really, what we do is look at all the existing security tools that you have and we find potential threats hidden between the layers. We raised the $25 million series A led by First Mark with participation from all of our existing investors. So, Bain Capital Ventures, Decibels, Zetta Venture Partners, and Step Function. I'm very fortunate. I discovered my passion my first day on the job as an intern at a company called Northrop Grumman. So, I started my career in the DoD building out cyber ops and threat hunting teams before being a relatively early employee at CrowdStrike joining after the series C, being there through and after the IPO. My first job when I was in the DoD, I actually worked full-time and went to grad school at night to get a masters in aerospace systems engineering. What that taught me was not to be a hero every single day, but what was most important was that you showed up and did your best as best as you could day in day out. That's really expanded as I've gone throughout my career. So, on the personal side, I have a challenge where I run a thousand miles a year. It's the same kind of idea, which is like at 10:30 in the morning on a Tuesday in February, can you show up and do your best the same way that you would on a Friday morning when everything is going great. I then had a chance to experience network security at Palo Alto Networks and managed detection and response running the AI detection security research product teams at Arctic Wolf and I took a stint at MIT writing a graduate dissertation at of computer science and AI lab there. What led me to start Nebulon really was two-sided problem. So, the first is beginning as an operator, I saw the real problem that all of our existing customers had at Arctic Wolf and also what our 1,200 person security operations center had. The dissonance was everybody had already invested in these best-of-breed tools and despite owning the Audi or Ferrari of security, everybody was still getting compromised. And it was because different point solutions to specific problems were not the way to solve how to get breached. It was rethinking everything from first principles. Two years ago, my thesis was adversaries, so bad actors, are going to use AI to automate tailored access operations. They're going to be able to automate the entire life cycle of targeting an enterprise, compromising it, achieving their objective, and slipping out undetected. And it was those two problems that led me to build Nebulon. The idea being we can democratize the most high-leverage activity in security to all organizations regardless of size, skill set, or budget in a way that's flexible and integrates with the existing systems that they have. I got to a point in early 2024 where I to quit my job outright and focus on this problem. There was a core moment where I genuinely asked myself, could I try and solve this problem and make zero dollars doing it? And the answer was a resounding yes, and it was at that point that I knew I was ready. Thankfully, we've been able to grow and scale this business. I'm joined by some amazing folks. We get to partner with organizations from the Fortune 500 to growth stage security companies like Cribl as customers. Why was I okay making zero dollars and going after this? As a founder, I think what you really need to be obsessed with is the problem, not the solution. Ultimately, you build a team to help you design the solution and you validate your idea with the market to design the solution, but like you have to fall in love with the problem. And to me, the problem was just so pervasive, I realized like I had to do my absolute best. And you just got to show up day in day out and see like, "Hey, wait a minute. Is this something you can really go after?" And I was fortunate that I did early market discovery that validated the thesis and ultimately allowed us to build what we've built today. No matter how right or wrong the world tells you that you are about the idea you're pursuing as an entrepreneur, the key is that you have conviction and that you continue to back yourself up with that. I think that's really important as a founder.动态行为建模：破解绿旗伪装
在重构安全防御范式后，最关键的实操挑战在于应对攻击者隐蔽行为模式的转变。现代网络威胁的最大特征在于，攻击者不再像十年前那样暴露明显的恶意行径，而是竭力“隐匿于日常业务流量之中”。他们会通过窃取真实凭证在正常时间登录，其孤立来看的每一项操作完全是正常的“绿旗”合规行为。只有当我们跳出单一事件的视界，退后一步审视整体行为的上下文（Context）和事件序列（Sequence of Events）时，隐藏在合规伪装下的致命“红旗”异常才会显露出来。
这种隐蔽性极高的入侵方式，往往只需要一个极其耐心的单兵就能完成。基于这一背景，威胁猎捕（Threat Hunting: 主动在网络中搜索和发现潜伏威胁的安全运营机制）的核心立足点必须是假设已遭入侵（Assume Breach: 预先假定攻击者已经突破了网络防线并在内网潜伏的防御假定）。在实操中，即使攻击者伪装得再好，其在内网活动时通常也必须暴露三大关键的入侵指示物（Indicator of Compromise: 标识系统已被入侵的残留痕迹或异常行为模式）：
- 隐蔽外泄：数据呈现缓慢但持续的外泄（Data Exfiltration），这种行为通常会被伪装成合规的数据备份行为，例如将桌面上的敏感文件持续上传至个人的 Google Drive；
- 越权访问：用户执行明显超出其初始角色 scope 边界的操作，例如一个市场部实习生突然开始频繁访问核心财务数据库；
- 持久化立足：在系统中植入某种持久化机制（Persistence Mechanism），例如悄悄安装远程管理工具以实现无限制访问，或者利用管理员权限复制和新建大量的服务账号。 Nebulo 作为上下文安全平台，其核心价值就在于通过关联企业现有的所有碎片化安全工具，识别出隐藏在这些“合规操作”夹缝中的致命异常。
Original English Source
So, do I think that cyber attackers are not just targeting governments or the Fortune 100, but normal people? Absolutely. They're able to remotely access your Google Workspace account. Once they have access to your Google Workspace account, they're able to access elements of your Google Drive and eventually are able to find a way to work their way onto your system, they can basically go wherever they want. They can move laterally and access critical cloud resources because again, they look completely normal. Those are the hardest spot because those are the ones who in isolation have green flag activity, but it's only when you take a step back, you look at the sequence of events and the context of their actions that you can actually spot a glaring red flag. Whereas about 10 years ago, cyber attackers behaved in bad ways. I think that's what's changed a lot, especially since I started in security, right? Attackers are going to try and blend in. They're going to log in at normal hours. They're going to steal your username and password so it doesn't look suspicious or malicious. Can I distinguish what Damian as Damian versus Damian whose account has been compromised? Like what that sequence of behavior looks like and based on that sequence, can I say, "Oh, that's Damian. It's totally cool." or "Hey, wait a minute. Damian's doing something he shouldn't be. He's been compromised." The real concern here is everything I described is being done by one person. So, you don't need a team to do all of these things anymore. You can do it as one very patient person. Threat hunting exists under the auspice that you should assume a breach. You should assume that an attacker is within your environment. So, does this specific person with these specific permissions have access to the kind of data they're touching? For example, there really three key things that an attacker will do that show compromise. The first is there will be a slow but consistent exfiltration of data that looks much like backup behavior. All desktop files being uploaded to a personal Google Drive. The second piece will be performing outside the scope of their initial role. So, the marketing intern accessing financial information. And then the third is at some point you will see some sort of persistence mechanism. That could be a remote management tool being installed so that they can access the system from any time. Or that might be the multiplication of accounts that they have access to. So, opening up service accounts when they're a human user, for example. Those are the three things. That's exactly why we exist, right? Like Nebulon because a contextual security platform. Really, what we do is look at all the existing security tools that you have and we find potential threats hidden between the layers.机器速度：从被动告警到主动猎捕
如果我们把网络杀伤链（Cyber Kill Chain: 描述网络攻击从侦察到达成目标各阶段的结构化模型）绘制在二维坐标轴上，横轴代表攻击阶段（侦察、靶向、漏洞利用、持久化、横向移动、目标达成），纵轴代表资金成本，我们会发现 AI 已经让前四个阶段的成本坍塌至接近于零。自动化漏洞侦察和钓鱼邮件编写几乎不需要任何资金消耗。尽管横向移动和最终目标实施目前仍需人类或人机协同，但整个攻击链条向“机器速度”演进已是不可逆的趋势。应对这种转变，防御者必须彻底改变过去被动应战的思维。传统的告警系统就像是烟雾探测器（Smoke Detector），只有当大火已经蔓延、坏事已经发生时才会拉响警报。而威胁猎捕者则扮演了防火巡查员（Fire Marshal）的角色——在火灾发生前进入大楼，排查潜在的火灾隐患与高风险区域。
防御者长期以来总是落后一步，因为我们一直在对警报进行被动响应，而不是主动预判攻击者绕过系统的路径。Damien 强调，面对 AI 攻防战，防御者最大的敌人不是 AI 的超强能力，而是防御者的不做作为（Inaction）。当前我们正处于一个极其宝贵且短暂的窗口期，必须以最快速度完成从被动响应到主动猎捕的范式转换。
在企业经营的重压之外，Damien 也分享了支撑他持续奋斗的个人基石。他通过每年跑一千英里的长跑来磨练自己“日复一日、风雨无阻做足准备”的日常纪律。而他的父亲作为他的深层导师，时刻提醒他要在 CEO 的社会身份与真实的自我（Truest Self）之间保持平衡。这种心力的维系，正是促使他去构建一个能让团队共同成长、发挥最大价值的韧性环境的核心源泉。
Original English Source
So, if I could draw an axis across the cyber kill chain, reconnaissance, targeting, exploitation, persistence, lateral movement, and then action on objectives, AI is already automated kind of the first three core components and humans are being orchestrated on the last part. And then if I have like a cost on my Y axis, like the cost would be very low and then it would get very high. So, you kind of have like kill chain on your X axis, cost on your Y axis. If I were a threat actor right now, reconnaissance basically $0. Writing a phishing email, also very cheap. Vulnerability exploitation is getting significantly cheaper. Establishing persistence is also relatively cheap. Right now, lateral movement and ultimately like achieving your objective still requires a human. It's a bit more expensive. A human plus an agent can get there together, but you still need a human. But the first four components of that is basically automated. As attackers go to machine speed, do we think that defenders are going to machine speed as well? I think we have the opportunity to do that now. The core thread that I saw was that as defenders were always one step behind the attackers. In the DOD, we had to operate with the information that we had access to without knowing everything the adversary could. At CrowdStrike, we scaled that effectively on the endpoint, but the endpoint was only part of the enterprise puzzle. The same at Palo Alto Networks, right? We had the network, but that was only part of the puzzle. And then finally, from the managed detection and response side at Arctic Wolf, you had best of breed solutions, but you could only solve problems as best as the existing tools that you had and you were responding to everything reactively. So, the common thread was attackers were always one step ahead of defenders, and that's because we were always reacting to alerts as opposed to proactively leaning into how threat actors might be getting around our systems. And it was that gap that prompted me to start Nebulon. That's really where threat hunting comes in. Threat hunting is analogous to cybersecurity operations, much like the difference between a fire marshal and a smoke detector. So, in cybersecurity, when you have an alert system, that's your smoke detector. There's a fire going off and I'm alerting you that something bad has happened. Whereas a threat hunter is like a fire marshal. They go into a building before the fire and they point out the risks or risk areas that might be impacted should there be a fire. Cybersecurity very quickly is becoming like an existential question. Which is not, "Hey, will something bad happen?" But when something bad happens, what do we do about it? The key that we all have to accept is at some point a threat actor will target us. That's not to fear monger, it's just the reality of a world where the democratization of cyber attacks is a reality. I would not fear that AI is going to catastrophically destroy everything when it comes to security. But rather that AI is here both to create and solve the challenge for network defenders. So, the sky is not falling. What I would tell them to fear or be concerned about is inaction. That we don't see these warning signs and instead do nothing. So, I think we have again like a very rare window to act. And that whole thesis, that whole idea is exactly why Nebulock exists. To democratize the highest leverage thing, which is all about finding bad activity before it becomes like a persistent breach and giving that back to the people. Now, I think one thing that as a founder most people don't think about is there's you the business person and then there's you the person. Having a personal support network is really, really important. I think what makes my dad so great as a mentor to me is he understands me deeply. I mean, he's my dad. I'm very fortunate in that regard to have access to someone who I have a long-standing and deep and meaningful relationship with. And he also reminds me to show up as like my truest self as opposed to hyper-optimizing to be like just Damien the CEO, but rather like Damien the person, Damien the founder, Damien who wants to build an environment where people can thrive and grow and do their best work. So, I was not anticipating that question. And you got me a little emotional. [snorts]📌 文中提及的人物和组织
公司/组织: Nebulo, CrowdStrike, Northrop Grumman
产品/模型: Mythos