Exploring Intelligence-Hungry versus Intelligence-Full Cyber Tasks
3 months ago, like many on LinkedIn, I posted a hot take on Mythos.
My thesis was, given how good frontier models are and will continue to be at cyber tasks, cyberwarfare will eventually become a function of whoever can expend the most compute. Asymmetric inference costs between offense and defense (Shahed to Patriot missile cost analogy) will become a defining problem in cybersecurity.
It’s crazy just how fast we went from tokenmaxxing to conserving inference spend. Enterprises are now using routers and vastly cheaper open models only a few months off the frontier. Coinbase already defaults to GLM 5.2 and Kimi 2.7 via their LLM gateway. I guess this is the natural evolution of things when major enterprises burn through their entire AI budgets in April (sorry Uber).
There’s a great mental model that I came across in a Substack article from Judith Dada in August of last year. She splits tasks into two kinds:
Intelligence-Hungry -> performance improves with more intelligence. These are usually creative tasks, like copywriting or research.
Intelligence-Full -> complexity is fixed, so performance caps out at a certain intelligence level, making SOTA models unnecessary. Judith gives the example of payroll automation, because once a system is able to pay employees accurately and on time, there is no competitive advantage to making it smarter.
I believe every enterprise security team (and every cybersecurity startup that wants to keep its margins high) will need to start asking: which cyber tasks are Intelligence-Hungry versus Intelligence-Full?
My initial assumptions:
Threat hunting and detection engineering are Intelligence-Hungry -> These are open-ended exploration/research tasks, a bit like planning in software engineering. They require creativity and a deep understanding of the environment.
Alert triage is Intelligence-Full -> Once an agent is able to correctly triage a type of alert, there is no added benefit to making that agent smarter. (Brand new alert types are the exception.)
Threat intelligence is Intelligence-Hungry -> Creative pivoting and broad domain contextual analysis is needed.
Penetration testing is Intelligence-Full -> Like in software engineering, pentest planning will probably be handled by frontier models, but the execution of specific, bounded TTPs can be cheaply handled by less intelligent models. This is already happening. Dreadnode (IQT portco!) recently fine-tuned an 8B model on synthetic Active Directory data, making it smart enough to get Domain Admin.
I’m curious where folks might differ in opinion - which of my categorizations are right/wrong?