Why SpecterOps Signed OpenAI’s Call for Collective Cyber Defense
Our response to OpenAI’s call for stronger, more widely shared cyber defense
We are signing OpenAI’s call for collective action on cyber defense because we agree with the three principles at its center: the weaknesses already exist, advanced AI needs to reach more defenders, and the response must be collective and widespread.
SpecterOps has operated this way for years. We have seen that when practitioners can examine attacker tradecraft, reproduce it, and see how it moves through an environment, they can build better defenses. This is empowerment through transparency, one of our values and a practical way to reduce risk.
The weaknesses already exist
The letter is right that AI-enabled attackers will exploit weaknesses that are already present: excessive permissions, misconfigurations, legacy systems, and years of accumulated trust relationships. AI will increase the speed of discovery and exploitation, leaving defenders less time to understand a finding before an attacker can use it.
Attackers still need a path to what matters. Enterprise environments are dense networks of identities, permissions, applications, systems, and trust relationships. A configuration that appears minor on its own can become dangerous when it connects to several others. AI agents add more identities, delegated permissions, data access, and system connections to that graph.
Identity Attack Path Management gives security teams a way to see how an attacker could traverse the environment, identify the choke points that create meaningful exposure, and remove the paths that lead to critical assets. For boards and security leaders, one measure captures that progress: How many dangerous paths to our most important assets have we eliminated?
PowerShell and the value of visibility
Years ago, many of the practitioners who went on to build SpecterOps came out of the PowerShell tradecraft community. PowerView, along with the research, talks, and training around it, showed how an operator could discover privileged users, map relationships, and move through an Active Directory environment.
Publishing that work gave defenders concrete behavior to study. They could reproduce techniques, test controls, build detections, and teach others what to look for. As the PowerShell security ecosystem matured, capabilities such as script block logging and the Antimalware Scan Interface gave defenders greater visibility into activity on their systems.
PowerView also became a precursor to BloodHound. The original BloodHound collector built on PowerView functions and made chains of permissions and trust relationships visible. Defenders could see the same attack paths that operators used and decide where to intervene. That visibility helped establish attack path management as a practical discipline.
We continue that approach through BloodHound Community Edition, technical research, open-source tools, and training. When we retired our Adversary Tactics: PowerShell course, we released the materials for free so practitioners could continue to learn from them.
Advanced AI needs to reach more defenders
OpenAI’s letter argues that cyber-forward AI needs to reach more defenders. We agree. Frontier models can help security teams identify weaknesses, validate findings, prioritize risk, and develop fixes more quickly. Wider access also requires authorization, safeguards, accountable use, and people responsible for consequential decisions.
Our participation in the OpenAI Daybreak Cyber Partner Program reflects that view. We are working to apply frontier capabilities in governed defensive workflows and to share what we learn through research, tools, training, and practical guidance. Effective capabilities become more valuable when defenders can use them safely and understand how they work.
Our commitments
The letter calls on organizations, cybersecurity companies, technology partners, governments, and AI labs to contribute. Our signature reflects three responsibilities: strengthen our own defenses, help others address serious weaknesses, and share practical tools and lessons that raise the defensive baseline.
Security leaders can act on the same principles now. They can identify critical assets, map the identities and permissions around them, close dangerous attack paths, verify that fixes hold, test AI systems before expanding their authority, and exercise response and recovery plans.
AI will surface more problems, faster. When defenders can see how to remediate risk, they do.
