The big surprise of the 2022–26 era for AI security policy is how cyber damages to the public don't seem to have increased much due to AI. In fact, they've stayed on-trend with the industrialization-of-cybercrime growth rates we've observed since around 2015, with perhaps a small AI-causal bump. It's useful to think about the position of cybercriminals to develop an intuition for this: * Imagine you're trying to build a cybercrime business and you want to take advantage of AI automation. * How do you find and retain talented engineers who can build and operate the software/infra stack you'll need, given that they'll often have non-criminal alternatives with today's AI labor demand (even in middle-income countries where this demand also exists)? * Where are you going to rent space for your workforce to work? * Who are you going to hire who's willing to live there and live a life of crime? * If you're running your business remotely, how will you ensure honor among thieves and manage hiring and firing? * What's your strategy for evading law enforcement and bribing your way out of trouble? * How can you access AI inference in a stable way that allows you to innovate your work processes and tech stack? * Given all this, how will your quarterly automation goals compare to those of, say, a regional call center business in the American Midwest? There's a lot of nuance here (e.g., state and state-sponsored cyber attackers are a very different group; capabilities can get built up there and then unleashed discontinuously, and this needs to be considered). But overall, the demographic picture of cyber attackers means that folks should stop thinking of cyber attackers as a bunch of implicit MIT grads anxious to absorb the latest in automation to scale their businesses... (Below are some related charts on the demographics of cyberattackers from a blog post I'm working on.)