In this interview with Help Net Security, Jaya Baloo, COO & CISO at Aisle, examines the debate over restricting access to cyber-capable AI models. She lays out the strongest argument for gating these tools, then explains where it breaks down for security teams who depend on the same capabilities for defense. Baloo argues that policymakers misread how attackers and defenders operate, that open-weight models cut both ways, and that limiting access can widen the gap between well-resourced organizations and everyone else.

Make the strongest case for gating cyber-capable models, the version a thoughtful safety researcher would give you. Then tell me where you think that argument quietly falls apart in an operational environment.

The strongest argument for gating a cyber-capable model is that it reduces the expertise required to exploit existing ones. A capable model can compress years of accumulated knowledge into an accessible interface. The concern isn’t necessarily the elite nation-state operator. Those actors already possess advanced capabilities. The concern is the expansion of the group of people able to perform sophisticated offensive activity. We see this playing out in the open source community with maintainers being overwhelmed with vulnerability reports.

I can see it from the perspective of governments that know access controls create friction. And although they may not stop the most determined adversaries, they absolutely can slow proliferation, raise costs, and reduce the number of actors who can rapidly weaponize newly discovered techniques. From that perspective, restricting access to the most capable models can be likened to export controls on advanced hardware, imperfect, but potentially useful for buying time.

Where that argument is weak is when it comes to operational reality. Security isn’t a field where offensive and defensive capabilities are separated. The same capability that assists with exploit development assists with vulnerability research, remediation, threat hunting, incident response, and secure code review. You can’t provide a proper triage and plan for defense without understanding the severity and nature of the attack from offense.

It also feels like we’re in a time warp where we have to explain that cybersecurity capability is not analogous to strategic weapons technology. I remember when we had to prevent offensive tooling from getting on the list of the Wassenaar treaty and explain that vulnerability research and software analysis are defensive disciplines practiced by millions of engineers and researchers. The history of cryptographic export controls (Crypto Wars) in the 1990s is another lesson from the past. The restrictions primarily delayed defenders. There is a risk that we repeat that pattern with frontier AI, slowing defenders more effectively than adversaries.

If you sat across from the people writing these access policies, what is the one assumption about security operations you think they get wrong?

I think many policymakers implicitly assume that defenders and attackers start from roughly comparable positions. They don’t, as defenders are always trying to do more with less and always short on time, people and tools. Attackers usually have options that rarely restrict their focus on targets with mundane concerns like budget or procurement allowance. I don’t think they understand that they are hurting security operations teams a lot more than that they are hindering attackers.

The question should not be “Could this tool help an attacker?” A lot of security technology can be considered dual use. The question should be “Does the aggregate defensive benefit outweigh the offensive advantage?” This used to be the kind of thinking that got us the Vulnerabilities Equities Process in the US, where they would weigh the time to restrict or use a newly found vulnerability or newly minted exploit against the potential harm that it could cause if an adversary were to find and use it on critical infrastructure. The VEP wasn’t asking whether vulnerabilities were dangerous; it was asking whether society benefited more from disclosure or retention.

Open-weight models keep capability flowing even when commercial APIs tighten. Is a healthy open-weight ecosystem a defender’s insurance policy, an attacker’s gift, or unavoidably both, and how should a CISO plan around that?

It is unquestionably both. We can use the frontier models but also open weight models to prove a solution which gives defenders powerful capabilities and on their terms.

My advice to CISOs is simple. Assume your adversaries have access to capable models and build accordingly. Invest in faster detection, stronger identity controls, better software supply chain visibility, and more automated remediation. Plan for capability parity rather than capability exclusivity. Also there is a very compelling third-party risk management point that needs to be made which is that supply chain availability is something we as CISOs take for granted from a handful of frontier AI providers. In this example we need to prioritize the ability to manage this from a concentration risk, control, and sovereignty aspect.

Smaller firms and public-sector teams already lose the talent war. Does restricted AI access widen the distance between organizations that can defend themselves and those that cannot, and what does that do to the software everyone downstream depends on?

I think it might be because large companies and well funded government agencies can compensate through personnel and resources, they have buffers for this type of problem.

It doesn’t necessarily hold for small companies or smaller public institutions, where AI tools can act as force multipliers. They theoretically could compensate for skills shortages or capabilities. Restricting access to those capabilities can widen existing inequalities in cybersecurity outcomes.
One of the underappreciated consequences is downstream software quality, as much of the software the world depends on is maintained by relatively small teams (insert the KXCD comic).

Open source projects have been terribly overwhelmed with reviewing the sheer volume of AI generated vulnerability disclosures, with the maintainer of CURL recently announcing that they’re taking a month off from review to focus on development again. The question is whether the entire software supply chain becomes less resilient over time.

Looking five years out, do you expect the defender or the attacker to have gained more from this era of frontier AI, and what decision tips it one way?

I think defenders should ultimately gain more, but I think the current momentum favors attackers. Cybersecurity today suffers from an abundance of known problems and a shortage of human capacity. It’s been proven that AI is exceptionally good at addressing those capacity constraints and we can focus on helping defenders with superior visibility and remediation.

Over the next five years, I expect AI to become deeply integrated into a lot of aspects of cyber security, from vulnerability discovery and remediation, incident response, configuration management, identity governance, and compliance workflows. The greatest impact won’t just come from finding more issues but from fixing them faster. Attackers will inevitably benefit as well as phishing, exploit creation, and malware development will become easier and more prolific. In the long run though, I believe that security depends on empowering as many defenders as possible.

My board metric since 2012 has been the average time to respond to vulnerabilities and incidents which used to be counted in days and weeks. This does not work with the current reality posed by the Zero Day Clock which is realigning us to think in minutes, not hours. The winner in 5 years will be the one who is fastest and not necessarily the smartest, as raw intelligence from AI models will be a commodity.

Download: The IT and security field guide to AI adoption