Contrary to the implicit mental models of many on this website, cybercriminals aren't the security-engineer Waluigis of Stanford-educated big tech engineers, or the criminal analogs of a16z-backed AI pentesting startups. They're generally less talented, recruited from middle-income countries with weak legal oversight and fewer legal tech job options, and struggle with arrests, sanctions, retaining talent, and stable access to AI inference. Ransomware took years to become a scaled business under these conditions, and AI-native organized criminal syndicates that fully leverage the power of AI to scale may take awhile too. Nation-states, meanwhile, are quick to adopt AI for vulnerability research and exploit development, but historically slow to deeply retool military operations with new technologies. And potentially devastating agentic cyber swarms may become weapons in their arsenals alongside e.g. ballistic missiles that they possess but don't immediately use. So to those calling php2shell "the worst day in cyber ever" and expecting immediate spikes in cyber damages: there isn't the direct relationship between new capabilities and new damages you're imagining. This is good news, obviously. It means defenders have time to prepare (and we should be shouting from the rooftops that we're in a defense-advantaged interregnum, currently). Huge risks are approaching but at the pace of technology diffusion into less innovative parts of the world economy and state sector, not at the pace of AI capability growth. Full version: joshuasaxe181906.substack.co…