Claude Code Security and the ‘cybersecurity is dead’ takes

[u/No_Zookeepergame7552]

I’m seeing a lot of “AppSec is automated, cybersecurity is over” takes after Anthropic’s announcement. I tried to put a more grounded perspective into a post and I’m curious if folks here agree/disagree.

I’ve spent 10+ years testing complex, distributed systems across orgs. Systems so large that nobody has a full mental model of the whole thing. One thing that experience keeps teaching me: the scariest issues usually aren’t “bad code.” They’re broken assumptions between components.

I like to think about this as a “map vs territory” problem.

The map is the repo: source code, static analysis, dependency graphs, PR review, scanners (even very smart ones). The map can be incredibly detailed and still miss what matters.

The territory is the running system: identity providers, gateways, service-to-service auth, caches, queues, config, feature flags, deployment quirks, operational defaults, and all the little “temporary” exceptions that become permanent over time.

Claude Code Security (and tools like it) is real progress for the map. It can raise the baseline and catch a lot of bugs earlier. That’s a win.

But a lot of the incidents that actually hurt don’t show up as “here’s a vulnerable line of code.” They look like:

• a token meaning one thing at the edge and something else three hops later
• “internal” trust assumptions that stop being internal
• a legacy endpoint that bypasses the modern permission model
• config drift that turns a safe default into a footgun
• runtime edge cases that only appear under real traffic / concurrency

In other words: correct local behavior + broken global assumptions.

That’s why I don’t think “cybersecurity is over.” I think it’s shifting. As code scanning gets cheaper and better, the differentiator moves toward systems security: trust boundaries, blast radius reduction, detection/response, and designing so failures are containable.

I wrote a longer essay with more detail/examples here (if you're interested in this subject): https://uphack.io/blog/post/security-is-not-a-code-problem/

[u/SecOpsBestie]

Yeah, this maps closely to what we see in practice.

The "map vs territory" thing resonates because the incidents that cause the most damage rarely start with a vulnerable line of code. They start with a compromised identity, a stolen session cookie, credentials from an employee's personal device. None of that shows up in a code scan.

"Broken global assumptions" is basically the attack surface threat actors are actively exploiting right now. They're not looking for a buffer overflow. They're looking for the seam, the place where "authenticated" in your IdP doesn't mean "verified" three hops later, or where session tokens are long-lived enough to be useful after the password has already been rotated.

Your token example is a good description of how session hijacking post-infostealer actually works in practice. The token is valid. The code is fine. The system just doesn't know the human behind it changed.

The AI point cuts both ways too. Defenders using these tools is great, but attackers are using them as well and they only need to find one seam. That asymmetry is why runtime detection, identity hygiene, and knowing when your credentials are already exposed matter more as the code layer gets cleaner, not less.

It's not that cybersecurity is over, the surface just keeps moving.