The Intersection of Encryption and AI
Bruce Schneier argues encryption is necessary but not enough, and says AI is now changing cybersecurity by speeding both attacks and defenses.
Intelligence analysis by GPT-5.4 Mini
Schneier revisits his long-running argument that cryptography solves only part of security. He says AI is now reshaping the field by making it easier to find flaws and write exploits, with patches likely to follow.
Schneier says locks alone do not protect a whole house. AI may help bad guys spot broken windows faster, but it may also help repair them faster too.
Analysis
What Schneier is revisiting
This post is framed as part of Dark Reading’s 20th anniversary, where cybersecurity writers were asked to pick a favorite past piece and reflect on it today. Schneier points back to his 2010 column, "The Failure of Cryptography to Secure Modern Networks", and says he has been making the same core argument since 2000: cryptography is powerful, but it cannot solve the full range of security problems.
Why encryption is not enough
He contrasts cryptography with broader computer security. In his telling, cryptography has a mathematical advantage for defenders: small increases in key length can impose far greater costs on attackers than on defenders. Security in real systems is different. It is an ongoing arms race where attacks and defenses quickly iterate, vulnerabilities appear constantly, and the balance can swing fast. His point is that math may be precise, but it does not secure anything on its own unless it is implemented, deployed, operated, and maintained inside complex software, hardware, and networks.
The AI shift
The new development, in Schneier’s view, is artificial intelligence. He says AI is not improving cryptography, but it is changing cybersecurity by showing a superhuman ability to find software vulnerabilities and write exploits. He adds that the ability to write patches in a similar way is probably coming. That creates a new race around what he calls "instant software," where attackers and defenders may both move much faster than before.
Bottom line
The post does not argue that encryption is obsolete. It argues that encryption has always been only one layer, and AI is now accelerating the parts of security where human speed used to matter most.
Key points
- Schneier revisits his long-standing claim that cryptography is necessary but not sufficient for security.
- He says cryptography has a mathematical advantage for defenders, unlike broader computer security.
- AI is now changing the arms race by helping find vulnerabilities and write exploits.
- He expects patch-writing capabilities may also arrive, which could speed up defense too.
- The post frames modern security as an increasingly fast contest around "instant software."
If AI’s patch-writing ability arrives alongside its exploit-finding ability, defenders could respond much faster to bugs. That would help turn the same speed that helps attackers into a tool for protection.
If AI makes finding bugs and building exploits much easier than fixing them, attackers could gain a large advantage. Schneier also warns that security is fragile, so fast-moving software systems may become even harder to defend.
