Secure the universe

Over the past couple of decades the role of cybersecurity has extended from protecting information stored in computers to protecting everything that software touches. Software can now decide and act in the physical world. It moves machines, flies rockets, runs factories, powers economies and keeps people alive.

Protecting systems 20 years ago was a different problem. The focus was on defined corporate boundaries and data protection, and the digital surface was much smaller than what it is today. Every innovation forces the creation of new layers of software and physical systems, and every new layer depends on layers built by someone else, resulting in a chain of dependencies in which the failure of one component spreads far beyond the organization that owns it. Cybersecurity stopped being an IT problem the moment we wired the physical world to the internet. A computer breach back then was understood mainly as a loss of information, today it also means losing control of the physical systems people depend on.

As society digitizes every foundational pillar, civilization as a whole increasingly relies on software, and cybersecurity's role changes from an IT function to a form of civil defense to keep civilization going. Unfortunately, every system that creates value attracts people who want to exploit it.

Every computer is a door, and most doors don't have a doorman looking over to see who is walking through.

And unlike the thieves of the past who slipped in to steal our secrets, today's intruders are walking in to turn off the lights, poison the water, and tear down the house.

The cybersecurity balance of power has always tilted toward attackers over defenders. The defender has to be right everywhere, every time while the attacker only needs to be right once. This asymmetry has recently widened because defenders are still running a race that has no finish line and no rest against an opponent that never sleeps because the opponent is increasingly a machine.

We are forcing human-speed isolated organizations to fight machine-speed asymmetric warfare. Skill used to be the expensive part of an attack. With AI, what once took a nation state's budget and years of training now costs almost nothing.

Defense, on the other hand, became heavier.

Every new threat gets answered with another tool, another dashboard, another set of alarms, until so many are going off that nobody can tell which one means fire, on top of a vulnerability list growing faster than any team can work through it. And most organizations lack the tools and talent, so they sit below the cyber poverty line spending just enough to pass inspection rather than to actually be safe because nobody gets credit for the fire that never started, so the money only arrives after the building has burned.

No hospital, school, town or business should need a nation state budget to survive a machine-speed attack, and pouring more money into a broken approach does not fix the approach, it buys a more expensive version of the same failure.

We have built a civilization that runs entirely on software, and then priced the protection of that software out of reach for almost everyone who depends on it.

Our belief is that to support civilization, defense must fundamentally change. These are our principles:

1. It has to be collective, because both signal and expertise have to cross organizational lines. What one defender learns has to reach the next defender in time to matter, and the knowledge needed to defend a given environment already exists somewhere in the world, so a correlated defense takes away the attacker's ability to find one weakness and reuse it against everyone else. Every investigation has to leave the system better informed than it was before so that defense accumulates the way attacks do and the network grows harder to attack each time any node on it is attacked.
2. It has to be autonomous, because human-speed organizations cannot fight machine-speed warfare, and if the opponent is increasingly a machine then the work of investigating and containing has to be done by machines as well, running without pause and closing the loop from signal to resolution rather than waiting for anyone to reach the bottom of a queue.
3. It has to be universal, whether what it protects is a cloud role, a controller running a water plant, a robot on a warehouse floor or a ground link to a satellite, because underneath it is the same loop every time, where something produces a signal, someone has to understand what it means, decide, act, and prove what was done.
4. It has to be governed, since autonomy without a record is a liability and a defense that breaks the thing it was protecting has not defended it, so the authority to act has to be something each organization grants on its own terms, and every action taken on its behalf has to be something it can defend after the fact.
5. It has to be provable, because most organizations believe their defenses are adequate and few ever test whether the fix they deployed actually removed the risk, and a defense that cannot show what it prevented will always lose a budget argument to a function that can show revenue.

We believe software can continue expanding human capability without making civilization more fragile. Any organization should be able to inherit protection as easily as they inherit computing. Security should become stronger, faster, and more accessible with every new participant.

This is a security problem, an AI problem, a distributed systems problem, and a public infrastructure problem. Solving it requires working at the boundary between software and the physical world, and we truly believe that the systems protecting civilization should be as ambitious as the systems advancing it.

We believe it, so we are building it.

Software now sustains life on Earth. In the next decades it will sustain humans off-world. In the next century it will sustain civilizations off-world. Every system that keeps a person alive out there will be networked, autonomous, and physically consequential. A spoofed sensor or an injected command will not be a data breach. It will be a death with no first responder within two hundred million miles.

Cybersecurity is not a feature of that future. It is the precondition for it.