Keynote: The Art of Looking Deeper

October 20th, 2026 – Alisa Esage

Underneath the fast-moving landscape of the cybersecurity industry sits a layered mechanism that barely ever changes. Just a few years ago, deep thinking to understand the core system was a matter of art: beautiful and optional. Now as AI commoditizes surface skills and shallow bugs, it becomes the new baseline. The attackers will go deeper first; the defense must follow accordingly. Following is a synopsis of the opening keynote that I delivered at c0c0n 2026 conference in Kochi, India, on October 9th, reflecting on these ideas.

Opening keynote — c0c0n 2026, Kochi, India

Full slides are here.

The Heart of Cyber

Consider this physics metaphor. Point speed on a rotating sphere - linear velocity - is highest on the surface. Towards the center the speed decreases, until it stops. At the zero point - the axis of rotation - nothing moves. The rate of change in human-made systems behaves similarly. Most participants in the cybersecurity industry perceive a head-spinning chaos of trends, threats, bugs, and hype cycles. However, those who learn to see the deeper system only ever see repetition of the familiar - and predict accurately. But how does it work?

It helps to think of the world's systems as generatively composed hierarchies. Elements are not equal - they follow a dependency graph. The nature of the "dependency" property varies: it can be degrees of freedom, levels of privilege, simplicity/complexity, or functional reliance. Every system in existence builds on simpler systems - not the terminal elements - like a fractal. In physics, everything goes down to quanta and probability fields, and there is neither evidence nor a formal proof that it terminates there. In human biology, the body builds on organs build on cells build on organelles build on chemical compounds build on chemical elements build on … quanta and probability fields. Socio-technological systems follow the same principles - except the elements aren't always defined with academic rigor. Even without a rigorous formalism, this, as a guiding mindset, generates insights where logic can't.

The software ecosystem dependency graph is one concrete example of this abstract model. The hierarchy of deep system matters here because of how impact transfers through a dependency graph. The deeper the impact application point, the more elements downstream it affects. This idea is famously shown by xkcd #2347.

Looking at cybersecurity with this mindset, it quickly becomes clear that the root of its dependency graph is the vulnerability - and the exploit, as its complement which turns a mere bug into leverage. A system compromise requires a vulnerability, whether technical or social. Without the bug, the entire industry breaks down with no reason to exist. There would be nothing to exploit, nothing to defend against, nothing to build the policy of defending, nothing to harden with offensive research. It doesn't mean that everything else in the industry is noise. It means that the fundamental laws that govern the bug should transfer, through the dependency graph, onto everything else in the industry. Scoping down in this way allows us to extract the deep laws that govern the entire industry, from a compact object. Understand the bug and the exploit to understand anything in cyber - and thereby, solve it. This was the way of thinking that, back in 2021, led me to founding Zero Day Engineering as a system of offensive research and intelligence from the first principles. In particular, the training system that I created is based on the methodology of thinking deeper, grasping what's underneath the surface and learning to generate every skill and every bit of information that you need regardless of the landscape you're standing on. As the exploit landscape now churns faster and faster, with AI commoditizing both the shallow skills and information, the method that could be deemed extra a few years ago is now an essential baseline.

Predictive Models

As I was navigating the industry with this mindset, one deep trend became apparent soon: pattern recurrence. Getting started with vulnerability research around 2010, I made a habit of studying the bugs of the past. Going back far enough in reading archived blogs and reverse-engineering forgotten patches, I'd notice something interesting: bug patterns recur more widely than most people realize. A related trend: at any point in time, majority of security researchers believe that a certain bug class is dead. In 2015, the "dead" bug was a browser Use-after-free; #1 in browsers outside of JSE now. In 2020, the "dead" bug was a buffer overflow; the bug that owned most embedded targets at Pwn2Own competitions for years, up to last year when the target category was eliminated. In 2026, the "dead" bug is apparently SQLi and people believe in it enough to claim it in my Twitter comments; several major compromises this year alone. A professional delusion then convinces the general public, which results in disproportionate hype cycles around mundane bugs and hoarding defense products that solve nothing. But the trend that I am referring to is more interesting and specific. It's not about general buffer overflows, which obviously repeat themselves - rather, it's about high-specificity bug patterns that have every reason to no longer exist, but they do.

One example of such a bug pattern is my Pwn2Own 2021 Parallels bug - a directory traversal in deep hypervisor internals, which I exploited to achieve a full VM escape. For a hypervisor researcher, the attack scenario doesn't make sense. Hypervisors are binary programs, and logic bugs in them are rare. A hypervisor directory traversal is unheard of. In fact, there were ~5 of them in the entire history of virtualization. But the more important point isn't just rarity, it's the time scale AND rarity AND several other anomalies clustered. The first instance of a directory traversal in a hypervisor was around 2010 (I have a story about this in the Hypervisor Vulnerability Research course). It is such a trivial bug class that it's the first thing that gets patched out of open source web applications upon first scrutiny. Instead it kept recurring across a variety of unrelated binary hypervisors for decades. I thought at first it was just a coincidence. As I kept researching, attacking browsers and other hardened systems, I saw the pattern.

I called it Mythic Bugs. It's a highly specific bug pattern - a deep one, more of an archetype than a class - which combines several traits that make it particularly relevant at this point in time. The most interesting property of a Mythic Bug is that it evades both general VR tooling and human common sense. This leads to the situation where an apparently simple bug hides in the open, undetected for years. Furthermore, these bugs are likely to be mispatched and resurface as an incomplete fix.

Another deep trend that I noticed doing vulnerability research and observing the industry with the deep mindset was the systematic overestimation of tooling by expert practitioners.

Invention of tools is the driving factor of human evolution (a jumping factor, in fact). I touched the era when all that hackers had was a primitive disassembler producing megabytes of unreferenced, unlabeled and unsymbolized assembly code. I still remember what it's like to open the binary program in the hex editor, search for the specific byte sequence which represents assembly opcodes of a software license check, and change them to other opcodes to bypass the check. Nowadays, writing even the most advanced binary exploits, we barely need to touch the code. At every new baseline of tooling, majority of practitioners tend to believe it solves the problem. It happened twice with fuzzing: first with random fuzzing tools, then with feedback-guided evolutionary fuzzing algorithms. Same sentiment every time: now, vulnerability problem is solved. Doom for researchers, hope for defenders, ressentiment valve for the rest. It took years for most practitioners to realize that fuzzing technology has inherent limits and blind spots, and can't find certain classes of bugs by construction - unless the algorithm is overfit to the extent of defeating the whole premise of a universal solution. For someone who was looking deeper, it was clear from the beginning. Now the history is repeating itself with AI tools. To be fair, AI technology scales differently than fuzzing - but still has structural limits that few people see. Interestingly, senior executives and multi-smart-person-boards suffer from the same overestimation bias. In April 2026 Google all but killed the Chromium VRP, believing that AI now lets them solve bugs internally and cut the external contributor out of the loop. Just days ago, the Chromium VRP payouts were raised again. It's okay to change your mind. Setting the belief cycles aside, the constant is this: baseline shifts, challenges remain.

Here, I show a radial perspective on the same levels of VR tooling, which rhymes with the rotating sphere metaphor. Each new evolutionary level of tooling commoditizes the surface slice of the information system in the industry, which moves fastest. A human with a hex editor cannot outpace advanced automation tools, nor should he. What happens here - not just in cybersecurity - is the individual human practitioner being pushed away from entertaining shallow skills towards a deeper mindset. And the most powerful entity in this picture isn't the human alone or the tool alone. It's the integrated hybrid.

How about looking even deeper? Both trends that I mentioned are rooted in human cognition. Overestimation of tooling is clearly a human bias. Bug pattern recurrence is less obviously so. But vulnerabilities are aspects of code written by humans, and so it is. Even as AI generates code, it sources from the data distribution created by humans - inheriting its deepest biases. And so the cognitive factor is the real solution point. For the human in the game, leverage is learning how vulnerabilities and exploits work — to make better decisions and write secure code, instead of perpetuating the same cycles of vulnerability, now with AI acceleration. This realization is the reason I am building Exploit Intelligence - to allow a broader technical audience, not just vulnerability researchers, to understand exploits from the independent perspective that doesn't sell another security product.

An estimated 49K CVEs were assigned in 2025 - a progressive rise through past years. This year, the number is projected to skyrocket due to recent progress in AI models. Of this number, it takes ~1.5 to compromise a system. In the deep system that is yet-unreached by tooling automation, there is plenty of space for it.

This is the mindset that I've built into the Zero Day Vulnerability Research training since 2021, and now transmit through my intelligence community.