Aviatrix We Scored Our Own Security Plan – Here’s What Changed

Matt Snyder of Aviatrix presents durable risk reduction, a scoring model that ranks security work by how much it shrinks an attacker’s reach and how long it holds up, weighed against effort, technical debt, and cost. He shares results from scoring Aviatrix’s own Q3 security plan with an AI agent and the planning commitments that followed, then joins a closing Q&A on the framework. The session closed Aviatrix’s Security Field Day 16 presentation, with Willie Tejada and Chris McHenry joining the discussion.

Snyder argued that AI has collapsed the pyramid of pain, since changing tactics or tools is now just a matter of compute. Attacks can now move from initial access to full ransomware in under an hour, while defenders still work in 12-to-18-month planning cycles. He contrasted “sandcastles,” projects that sound impressive but wash away as attackers iterate, with “seawalls” that keep holding. The model assumes roughly a three-year shelf life for tools and processes. Replacing standing admin rights with just-in-time access scored highest, while a new SIEM correlation rule scored just 0.05. Snyder built an agent that scored about 30 Jira items five times and averaged the results before he reviewed them. Only three items qualified as seawalls, and the bottom twelve were sandcastles. Snyder also argued that decisions not to act, such as leaving a fragile application unpatched, should be scored too.

The results changed the plan: hardening comes first, and no new tools come in unless they solve a hardening problem. Every detection needs an automated response and a link to a preventive control, and rules that can’t justify their upkeep get cut. Snyder cautioned that scores can be inflated, can favor what sells, and have sometimes been wrong, so teams should debate them rather than accept the agent’s output. He shared the agent and scoring framework on GitHub. In Q&A, Tejada explained that each system’s value is set by the enterprise, sometimes taken from cyber insurance figures. A delegate called CVE-based risk reactive and nearly worthless in a post-Mythos world, and praised the model for serving both the CISO’s board reporting and practitioners’ prioritization. Tejada countered that patching still matters, since containment buys the time to do it right.