Amazon CISO CJ Moses described an attack that moved from initial access to system takeover and lateral movement in 12 minutes and 42 seconds. He shared the case with Terra Security CEO Shahar Peled in the opening episode of the AI Native Cybersecurity podcast. The observation came from Amazon MadPot honeypot infrastructure that tracks adversary behavior. For companies, the lesson is direct: patching windows measured in days no longer match attacker speed.
What Moses revealed in the podcast debut
AI Native Cybersecurity is a new podcast focused on how artificial intelligence shifts the balance between attackers and defenders. Terra Security presents it as a forum for security leaders to discuss practical deployment of AI, separation of hype from working practice, and preparation for the next stage of cyber defense. The first conversation centers on operational pressure inside security teams as AI accelerates vulnerability discovery, reconnaissance, and exploitation. Peled hosts the discussion, while Moses speaks from the position of Amazon CISO. The format is built around field cases rather than abstract forecasts.
The central case is the MadPot incident, where an adversary with no prior access compromised a system and expanded through available permissions in under 13 minutes. Moses contrasted this with past campaigns that stretched for weeks or months. His point was velocity: AI lets attackers fit more steps into a shorter interval, from scanning to exploitation to movement inside the environment. Defensive layers still matter, but isolated weaknesses can now be linked into longer attack paths much faster. Response speed therefore carries weight equal to discovery volume.
Amazon counters this pressure by embedding security checks into continuous integration and continuous delivery pipelines. AI-assisted scanning flags issues while code is being written, and further testing validates the finished product before release. Moses warned against slowing development in the name of control, arguing that delays work in favor of fast-moving adversaries. Intelligence from MadPot feeds patching priorities by showing which weaknesses attackers actively target. The model connects cyber intelligence, personnel security, and investigations so signals do not stay locked inside separate units.
What faster attacks mean for companies
For organizations that build and run software, the change affects release discipline and triage. Teams with CI/CD pipelines can add automated checks early and reserve deeper validation for release candidates, keeping delivery pace while cutting obvious exposure. Smaller firms without dedicated offensive testing gain less from vulnerability lists and more from knowing which flaws are actually reachable. Larger enterprises need shared telemetry across security, engineering, and HR, because isolated queues miss combined attack paths. Procurement shifts toward tools that rank risk by observed adversary interest.
The limits of this approach deserve careful reading. Faster scanning does not prove that every finding is exploitable, and continuous testing still requires tuning to avoid noise and developer fatigue. Moses noted identity-based operations as a separate blind spot: Amazon stopped at least 2,900 North Korean actors during hiring, with AI used to generate personas and support fabricated identities. That type of threat is not fixed by a patch and needs coordination between security and hiring teams. Buyers should ask vendors how exploitability is confirmed, how priorities are set, and what temporary controls apply before a fix ships.
The marker to watch is whether exposure time replaces vulnerability counts as the main performance metric. Moses expects strong programs to be judged by the interval between discovery and mitigation, whether through patching, blocking access, or isolating systems. A practical signal will be reporting that pairs each critical weakness with time-to-containment and evidence of active targeting. If vendors and internal teams adopt that measure through 2026, security budgets will follow speed of closure rather than volume of findings.
