AI Cyber Race Is a Fight for Governance, Says Redpoint’s Brescia

Key Concepts

• AI Governance & Visibility: The practice of monitoring, controlling, and securing AI activity within an enterprise.
• Responsible Disclosure: A cybersecurity framework where vulnerabilities are reported to the vendor before being made public; applied here to AI model safety.
• Open Source vs. Closed Models: The debate between the transparency of smaller, open-source models versus the controlled, limited access of powerful proprietary models (e.g., Anthropic, OpenAI).
• Project Glasswing: An initiative involving the Linux Foundation to facilitate collaborative research and safety testing for AI models.
• Zero-Day Vulnerability: A previously unknown security flaw that hackers can exploit before a patch is available.

1. The Intersection of Defense and AI

The relationship between the technology sector and government entities (like the Pentagon) is undergoing a strategic shift. The core argument is that as AI models become more powerful, private and public sectors must collaborate to ensure safety. Because malicious actors will inevitably attempt to weaponize these models, the defense strategy must focus on maintaining a "one step ahead" advantage through constant dialogue and shared intelligence.

2. AI’s Role in Cybersecurity and Open Source

Erica, a techno-optimist, argues that AI is a net positive for the internet’s infrastructure (open source).

• Vulnerability Management: AI can be utilized to proactively identify and patch security vulnerabilities faster than traditional manual methods.
• Enterprise Security: She highlights Jetstream, a portfolio company focused on AI governance. Jetstream provides visibility by creating a "dynamic graph" of AI activity across an organization, allowing companies to implement necessary security controls as AI proliferates.

3. The Debate: Open vs. Closed Models

There is a tension between the industry preference for smaller, open-source models (which allow for collective, transparent research) and the "limited access" approach of companies like OpenAI and Anthropic.

• The "Guardrail" Argument: Proponents of closed models argue that limiting access is a safety feature in itself.
• The "Responsible Disclosure" Framework: Erica draws a parallel to cybersecurity. Just as researchers must report a "zero-day" vulnerability responsibly before public disclosure, AI researchers should follow a similar path. She supports initiatives like Project Glasswing, which allows vetted researchers to study powerful models to build defensive tools without exposing the public to unnecessary risk.

4. Organizational Adoption and Real-World Applications

The most successful companies are not limiting AI to software engineering; they are integrating it "across the stack."

• Product Development: AI is accelerating product shipping, feature evolution, and coding velocity.
• Go-to-Market (GTM) & Operations: Companies like Railway are utilizing AI to run their entire GTM strategy. Ramp is cited as a prime example of a company transforming its internal culture by enabling employees to build AI-driven tools for finance, HR, and support.
• Venture Capital: Erica notes that even in venture capital, investors are building custom AI tooling to optimize their own workflows.

5. Synthesis and Conclusion

The overarching takeaway is that AI represents a dual-use technology that requires a balanced approach. While the potential for malicious use is significant, the defensive capabilities—specifically in identifying vulnerabilities and automating security governance—are equally powerful. The path forward involves a hybrid model: leveraging the transparency of open-source collaboration for research while maintaining rigorous, responsible disclosure protocols for the most powerful, proprietary models. Ultimately, the competitive advantage belongs to organizations that integrate AI into every facet of their operations, from technical development to administrative and go-to-market functions.