Automating Security Testing with AI at Night

Tech"We Attack Ourselves Every Night for Three Hours"

TL;DR

A company runs automated AI-powered security attacks on their codebase every night from 2–5 a.m. using open-source models on cheap spot compute to find vulnerabilities before customers encounter them.

Key Takeaways

1The company runs an automated security testing system called Kimmy K3 every night from 2 a.m. to 5 a.m. that proactively attacks their own codebase to find vulnerabilities.
2They use open-source frontier models that don't require security clearance to conduct the automated attacks, making compliance less of a blocker for their testing methodology.
3Running the security scans during off-hours on cheap spot compute makes the testing essentially free, allowing them to continuously scan without adding operational costs.
4The nightly automated attacks find not just security vulnerabilities but other issues throughout the codebase, providing broader code quality benefits beyond traditional security testing.
5This approach emerged because formal compliance certifications like SOC 2 and ISO don't guarantee actual security if AI can still find exploitable vulnerabilities in the code.

Notable Quotes

“We attack ourselves every night for three hours, from 2 a.m. to 5 a.m., to figure out vulnerabilities in the code.”
— Speaker

“It's essentially free because we're running it on off-hours so we can use very cheap spot compute.”
— Speaker

“Having SOC 2 compliance or ISO whatever doesn't really mean anything if you can just have an agent find vulnerabilities in your codebase.”
— Speaker

Chapters

1. The Problem with Compliance

Compliance certifications like SOC 2 and ISO provide false security if vulnerabilities still exist in the codebase, which the company views as inherently pointless when AI agents can quickly find exploits.

2. The Solution: Nightly Automated Attacks

The company implemented an automated security system running from 2 a.m. to 5 a.m. each night using Kimmy K3, an open-source frontier model, to attack their own codebase and identify vulnerabilities.

3. Cost Optimization via Off-Hours Computing

Running tests during off-hours on cheap spot compute makes the security scanning essentially free, with the added advantage that the company sells compute resources, further reducing expenses.

4. Broader Benefits Beyond Security

The nightly attacks discover not just security issues but general code quality problems throughout the entire codebase, providing comprehensive insights across the system.

Key People & Entities

Kimmy K3: Open-source frontier AI model used for automated security vulnerability testing

Glossary

PR (Pull Request): A submission of new code or features to the codebase that gets reviewed before integration.
SOC 2: A compliance certification standard for security, availability, processing integrity, confidentiality, and privacy controls.
Spot Compute: Discounted cloud computing resources that can be interrupted; typically much cheaper than on-demand pricing.
Open-source Frontier Model: A cutting-edge AI model released publicly that doesn't require special security clearance or restrictions to use.

Explore