Charles Herring 14 September 2026
Charles Herring Tech Summit Cybersecurity AI Age

How many R's are in the word strawberry?

I opened with that question at the Canterbury Tech Summit at Te Pae on 16 September, and the point was never the answer. It was to get a room full of people to watch what their own brains did on the way to it. Everything else in the talk hangs off that thirty seconds. Here is the recording, and then the whole argument in writing, with the sources for every number I quoted.

Almost everyone got three. Now think about how you got there. You retrieved the spelling from memory. You broke the word into letters. You counted the ones that were R. Three steps, in order, every time, and you could walk someone else through each of them.

That is deterministic processing. Same input, same process, same answer. Reliable, repeatable, defensible. It works on a Wednesday exactly as it works on a Saturday.

Fifty Years of Deterministic Code

Counting the R's in a string is two lines of code. It is fast, it costs effectively nothing to run, it is accurate, and a human being wrote it (which means a human being can be asked to explain it).

That kind of code is not a niche. It streams your content. It runs your phone. It powers our games. It checks the accounting. It runs the internet. It is what carried the audience questions through the event app while I was standing there. Fifty years of people writing deterministic instructions, getting steadily cheaper and steadily faster, is most of what we actually mean when we say technology.

So Why Does the Model Get It Wrong?

Ask a language model on its own how many R's are in strawberry and there is a good chance it tells you two.

It is tempting to enjoy that. The machine is so dumb it cannot count to three, and everybody in this room can. But the reason it gets it wrong is the most important thing in the talk, so it is worth slowing down on.

The model was not coded. It was trained. Nobody ever wrote down, anywhere, the letter counts of every word in English, the way we wrote down multiplication tables. There is no dataset of letter counts for it to have learned from. So when you ask, it does not count. It guesses. It has no other move available to it.

How a Human Guesses Well

In 2012 I met my co-founder, Tim Bradford, at another security company. He was the seller and I was the engineer. In one of our first meetings together he ran the whole thing, and my job was to field anything he could not.

Late in the meeting a customer asked a genuinely complicated question about wide area networking and MPLS encapsulation. I thought, here we go, this is my moment. I waited for Tim to look over and hand it to me.

He did not. He opened his mouth and gave an answer better than the one I would have given. I was dumbfounded, and a bit crestfallen. Later that day I asked him how he knew so much about wide area networking.

He said: Charles, I have no idea what MPLS is. All I know is that when I get asked that question, that's the answer that works.

Tim had more than ten years of sitting in those meetings, hearing those questions, and hearing which answers landed. He was not reasoning about MPLS. He was pattern matching against an enormous personal dataset, and he was very good at it.

That is probabilistic processing, and it is exactly what these models do.

How a Model Learns

To make that concrete, I showed the room one of our open datasets. On the left is a raw firewall message. In the middle is the instruction: identify this message. On the right is the answer we expect, product ASA firewall, vendor Cisco.

One hundred and fifty-five thousand rows of that. Every format, every product, every vendor, every way a log line can be phrased. The model reads across all of it and becomes a very good guesser about what an unfamiliar message is and what it means.

It is Tim, at scale, for one narrow job.

The Pivot

Now look at what the user typed after the model got strawberry wrong. Two words: verify with code.

And it gets it right, because we have given it an enormous dataset for exactly that. Here is a problem, here is the code that solves it. The whole of open source, the whole of Stack Overflow, decades of people publishing problems next to their solutions. These models write code well because we trained them on the best-labelled dataset humanity has ever produced by accident.

So the model cannot count the R's. But it can write the two lines of code that count the R's, run them, and hand you a provable answer.

That is the pivot, and I think it is the part most people are still underrating. Probabilistic generation writing deterministic code, which gives you a deterministic answer with the working shown. I would argue that is a more valuable outcome from generative AI than its ability to guess well or to produce good derivatives. It is also the same argument I have been making here for a while, most directly by asking which detective you would actually hire.

What You Are Actually Using Is a Harness

What changed over the last twelve to eighteen months is not mainly the models. It is the harness around them.

You no longer send a prompt straight to a model and take the guess. You send it to a system that first asks probabilistic questions about your question. How do I break this into smaller tasks? For each task, do I need a guess, or do I need to run code, or do I need to go and fetch more information? Then it executes those tasks and merges the results.

When a product tells you it is thinking or reasoning, that is what is happening. It is guessing at how it should go about calculating your answer.

The output is genuinely remarkable, and I say that as someone who has been working this way daily for over a year (I have written up a good deal of that experience in Tokens, Time and the New Math of Getting Things Done). It can feel like working with an expert. But underneath, it is three tricks in combination:

  1. Look up data.
  2. Make a probabilistic guess.
  3. Calculate a deterministic answer.

Orchestrated well, those three tricks go a very long way. It is still worth knowing that is all they are.

The Car Wash

Second question, same rules. Watch what your brain does.

The car wash is 100 metres away. Do you drive, or do you walk?

A language model on its own says walk, and reasons about saving the energy. It is wrong, and the way it is wrong is instructive. It cannot guess the answer, because there is no dataset of car wash decisions. It cannot compute the answer, because there is no formula. It cannot recall the answer, because it is not in a riddle book.

You solved it instantly. Here is how. You pictured a car, and everyone in the room pictured a slightly different car. You pictured a car wash. Then you pictured yourself walking into that car wash without a car, and how silly you would look asking them to wash a car you did not bring.

You built a small world out of nothing and ran it. That is simulation, and you did it in under a second without noticing you had done it.

Computers can do this too. It is just not cheap. I played Elder Scrolls Online for an hour that morning: crafted things, sold things, killed things, harvested things, earned skill points, all of it inside a world with physics and economics and rules, every one of them defined in deterministic code. That is not two lines. It is millions of lines running across hundreds of machines. We do the same thing to forecast weather, and scientists do it to model the formation of the universe. Building one of these requires us to be extremely specific about every rule. We cannot train our way to one.

Three Price Tags

This brings me to cost, which I think is the most underrated part of the whole AI conversation, and which is the thread running through The Closing Window.

Deterministic code is cheap. Store it, retrieve it, run it. Those two lines that count the R's burn essentially no energy and no compute. Fifty years of getting cheaper.

Generative AI is expensive, and the trend is going the wrong way. The International Energy Agency's Electricity 2024 analysis put global data centre, AI and cryptocurrency electricity use at around 460 TWh in 2022, and projected between 620 and 1,050 TWh by 2026, with a base case just over 800 TWh. Their later Energy and AI report puts data centres alone at about 415 TWh in 2024 (roughly 1.5% of global electricity) heading for about 945 TWh by 2030.

Put a New Zealand frame on that. Our entire national electricity consumption, for everything we do, was 40,002 GWh in 2024. That is 40 TWh. The United States consumed about 4,058 TWh across its whole economy in 2025.

So the high case for global data centre demand is heading toward a quarter of everything the United States uses, and it is already more than twenty times everything New Zealand uses.

That supply does not appear on command. Gartner forecasts that 40% of existing AI data centres will be operationally constrained by power availability by 2027, and that incremental AI-optimised servers alone will need 500 TWh a year by then, about 2.6 times the 2023 level. Constrained supply against rising demand means prices go up, not down.

And simulation is the most expensive of the three. We cannot build a car wash in silicon anywhere near as cheaply as you just built one in your head.

The conclusion is not that AI is bad. It is that where a deterministic answer is available, it is better for the business on every axis that matters: cheaper, faster, and defensible.

What Is Missing

For the Star Trek fans in the room, what we have built is close to the ship's computer. You can talk to it, it can fetch things, interact with other systems, run calculations, and build databases on request. That is real and it exists now.

It is not Lieutenant Commander Data, and I want to be specific about why, because the gap is not a matter of scale.

Ambition. No model has ever wanted anything. Leave it alone and it stops. Not one of us in that room had received a request from an artificial intelligence asking for a ticket to the event. We were all there because we are trying to make our organisations, our families and our communities better, and we are driven by that. There is nothing in these systems that wants an outcome.

Ingenuity. We can imagine the car wash, but we can also imagine things that do not exist yet. The light bulb, when the world had only candles. The printing press. Millions of inventions that began as one person imagining a different world. Generative AI makes derivatives, and it makes very good ones. I could tell it to re-shoot Sir Peter Jackson's Lord of the Rings trilogy with cats instead of humans, and with enough money and enough compute I would get something watchable. But it is a derivative. And the spark of making Aragorn a tabby cat came from me, not from the machine.

Judgment. This is the one that matters most. These systems cannot be stuck with the consequence. They do not care about losing their job, or dying, or what our children inherit, or being judged by anybody at all. You cannot put one in jail. They have also never fallen in love, broken a leg, or lost sleep before speaking in public. None of the experience that produces judgment is available to them. (This is the same ground the People > Machines series has been standing on since 2017, and which I reopened in The OODA Loop Strikes Back.)

Never Take Liberty, Property or Life on a Guess

So here is the line I would ask you to hold.

We should never take away someone's liberty, their property, or their life on the basis of a probabilistic guess. We need to show our work.

That applies to ending a career, charging a suspect, settling litigation, starting a war, and to any business decision large enough to matter. If you cannot explain how you arrived at it, you should not be acting on it. A model that guesses well cannot show its work, and dressing the guess in confident language does not change that.

The Black Hat: Three Impacts

Impact one: software attacks

We have all been ground down by patches. You cannot watch television without the television wanting to update itself first.

Behind that annoyance is a race that has been running for decades. A vulnerability is found, a patch ships, and defenders try to deploy it before an attacker can weaponise it. I first wrote about that clock in 2012 in Day Zero Is How Long??! and the honest summary is that it has only ever got tighter.

What AI changes is the tempo. The same models that read code well enough to help you write it read code well enough to find flaws in it. Attackers are using them to find vulnerabilities and write exploits faster than they ever could, and the volume is going one way. In 2025 there were 48,185 CVEs published, up 20.6% on 2024's 39,962. That is roughly 132 new published vulnerabilities every day, and every month the record goes again. NIST has had to change how it runs the National Vulnerability Database just to keep up. I worked through what that does to patching tempo in Blaster, Mythos, and the Patching Tempo We're About to Need.

Impact two: improved human attacks

This is Kevin Mitnick. When I was coming up he was the most famous hacker in the world, and he mostly did not write software exploits. He walked in with a clipboard, looked official, asked confident questions, and talked people into handing over what he needed. In his own testimony to the US Senate he said the most complex element in information security is the people, and that he was so successful in that line of attack that he rarely had to go toward a technical one.

Everything that made Mitnick effective just got cheaper and infinitely more scalable.

The tells are gone. Every piece of phishing awareness training we have delivered for twenty years taught people to look for bad grammar, odd spelling, and a landing page that looks slightly wrong. It is a lazy attacker now who does not run their campaign through a model to strip all of that out, personalise each message to the recipient's history and taste, and generate a landing page identical to the real bank. The signals we trained people to spot have been removed.

Your eyes and ears have stopped being evidence. I can put someone else's face on mine and someone else's voice on mine, in real time. I can generate bank statements, passports, driver licences, mortgage documents. Effectively every digital artefact can now be forged well enough to pass.

Four ways that is being used right now:

Fraud one: a voice you would know anywhere. A few seconds of a child's voice from a birthday video posted online is enough to clone it. The call goes to a grandparent. I am in trouble, I need help, please send money, please do not tell Mum. It sounds exactly like their grandchild, and the attacker is now working with every good instinct that grandparent has.

Fraud two: investment and romance fraud. It starts with a wrong number, or a message that looks like an innocent mix-up. A friendship forms, sometimes a romance, over weeks or months. Then an investment opportunity comes up naturally in conversation. There is a convincing platform and convincing documentation, all forged. A small transaction goes in and a return comes back. It escalates until everything is gone. The FBI reported US$7.2 billion in cryptocurrency investment fraud losses for 2025, the single largest category of loss, largely run by organised crime out of Southeast Asia using trafficked people as forced labour. INTERPOL has asked us to stop calling this pig butchering and call it romance baiting, because the older term shames victims and stops them reporting. That seems right to me, so I have changed the words I use.

Fraud three: a payment instruction from the boss. An email, a text, or a voice note. New supplier, new bank details, needs to go before close of business. The voice was lifted from a webinar exactly like the one I was standing in. There is urgency, there is hierarchy, and the wire goes out without a second check. Business email compromise cost 24,768 US complainants over US$3 billion in 2025.

Fraud four: a bad hire. This one is growing fast, and it matters most if you are in critical infrastructure. North Korean and organised criminal IT workers apply for remote roles with forged credentials, forged references, and a manufactured online presence, and swap their face in the video interview if they need to. In July 2026 the United States, New Zealand and nine other countries issued a joint alert on exactly this. We are not being breached here. We are onboarding them, issuing the laptop, and granting the access ourselves.

Impact three: agentic AI

The third impact is new, and it is the one we are building for the attacker ourselves.

Prompt injection is the attacker talking to your agent and confusing it into acting on their behalf. That might be a customer-facing support chatbot they can reach directly, or an agent running on your machine that they reach through a foothold they already have.

The reason this is serious is not the technique. It is the permissions. Look honestly at what we have already handed these systems: our email, our protected files, our trade secrets, our source code, our IT systems, our HR systems, our billing systems.

An attacker used to need to break into seven systems. Now they need to reach one agent that already has access to all seven. (This is the failure mode I described in Supersonic Broken Processes, only worse: we are not merely automating a broken process, we are handing it the keys.)

What We Do: Naval Postgraduate School, 2003

Here is the good news, and I think it is better news than most people expect.

In 2003 I was the network security officer at the US Naval Postgraduate School. That very young man on the slide is me. It looks like I ate him and had an allergic reaction.

We had about 5,000 devices on public IP space. No firewall between them and the internet. No decent endpoint protection. No patch management programme worth the name. None of that was unusual for 2003.

In August of that year the Blaster worm hit us, and it was devastating. It exploited a flaw in the Windows RPC interface that Microsoft had patched in MS03-026 the month before. We spent weeks, all hands, wiping machines and restoring backups.

About nine months later a proof of concept exploit was published for the flaw that would become Sasser. Microsoft had shipped the LSASS patch in MS04-011. I could see the same thing coming at the same network.

I had three options and only three. Get a firewall up, which IT could not move fast enough to do. Get endpoint protection onto every machine, which procurement could not clear in time and which would not have covered the personal devices or the schools running their own kit. Or get the patch deployed everywhere.

So we got the patch deployed everywhere. It took some fairly unusual methods, which I have written up separately in Blaster, Mythos, and the Patching Tempo We're About to Need. Sasser did not touch us. Blaster had.

I want to name what actually happened there, because I had just described three security controls. Patch management. Firewalls. Endpoint protection. Nothing exotic, nothing that needed a budget cycle. Both of those worms, incidentally, trace back to teenagers: Sven Jaschan was a German teenager when he wrote Sasser, and in the Blaster case the US Department of Justice prosecuted 19-year-old Jeffrey Lee Parson for releasing a variant that infected over 48,000 computers, while saying publicly that the investigation into the original was continuing.

The Framework I Recommend

Go to the Center for Internet Security and get the Critical Security Controls. Version 8.1, eighteen controls. If you write down one thing from the whole talk, write down that.

I walked the room through eight of the eighteen, because those eight carry most of the load against everything described above.

And here is the claim I want to make, which is the heart of it. Looking at the AI-driven attacks we have data on, I have not found one that a mature programme running CIS-level controls would not have stopped. The same hygiene that would have stopped two teenagers in 2003 and 2004 stops these. That is not a coincidence, and I will come back to why. (I am about 90% confident in that claim rather than 100%, and I would genuinely like to see a counter-example if you have one.)

Eight of the Eighteen

One, patch management. The gap used to be measured in weeks. It is now measured in hours. WitFoo starts every working day with a patch stand-up: read the report of where patches are missing, and fix those before doing the work that was actually planned. That is a cultural change more than a technical one, and it is the single highest-value habit the company has built. It is also the practical version of the argument in An Ounce of Prevention is Worth a Pound of SOAR.

Two, the firewall. Unlike 2003, firewalls are now on almost everything. The work is no longer acquiring them. It is confirming they are configured properly and that nobody has opened a large hole for convenience. If an attacker cannot reach the port, they cannot exploit the software behind it.

Three, endpoint protection. On every machine. Laptops, servers, phones, tablets. All of them. Anything with access to your systems needs something watching it for bad behaviour.

Four, multifactor, passkeys and PKI. Passwords stink, they stank twenty-five years ago when Mitnick was working, and they have not aged well. If you are still on passwords alone, these attacks will guess them or simply find them already dumped online. Multifactor authentication today slows attackers down substantially. Passkeys and public key infrastructure are better, because there is nothing to phish and nothing to guess.

Five, advanced email controls. This is the one place I am happy to point probabilistic processing straight at the problem. Run inbound mail past a model and ask it a probabilistic question: does this look like phishing? I do this on my own mail and it catches things the deterministic filters miss. Ask your provider what advanced options you are already paying for and have not switched on.

Six, hardened browsers. The inbox delivers it, but the browser executes it. Look at the policies you apply to browsers on laptops and phones, isolate execution, and block known-bad destinations.

Seven, backups, and when did you last test them? Ransomware stops being a catastrophe and becomes an inconvenience when you can wipe everything and restore. That is precisely what saved us in 2003. Without those backups the school would have lost years of research. Make sure the backups exist, make sure they are protected against an attacker who is already inside the network, and make sure you have actually rehearsed the restore. Disaster recovery is the control organisations most often skip. It is not fun, but it is a great deal better than paying a multimillion dollar ransom.

For the people who make software. If you ship software, you have to patch your own. Old-school static code analysis, dynamic analysis, application penetration testing and code fuzzing catch almost everything, and they are deterministic and cheap, so do those first. You can then run generative AI over the code as an additional scan. It is expensive, and in our experience it finds some things rather than a great many things, but it does have the real benefit of helping write the patch once something is found.

Eight, zero trust, which governs all the others. Deny all, then permit. Every control above is only as good as its configuration, and the permissions we hand our AI belong in this conversation too. Poke the smallest possible hole you can, then go back and audit the holes you already poked. In the eighteen months I have been here I have found there are very good security people in New Zealand (Kordia, Defend and SSS among them), and they will help you build the strategy rather than just sell you the box.

Does Any of This Actually Work?

Fair question, so here is our own data rather than an assertion.

This is the attack flow into WitFoo's own infrastructure, pulled the week before the talk. People trying to take our services down and steal our data. In one month, 45,234 attacks identifiable as AI-driven, against fewer than 500 that were not.

Every one of the 45,234 was boring. Low suspicion, low impact, no new technique. Not one of them did anything a determined human attacker in 2004 could not have done.

That is the rock. The waves are bigger than anything we have seen and they are breaking faster and harder, and the rock does not move, because the rock was built out of controls that were designed by people, on purpose, and still hold. Attackers have new speed. They do not have new ideas. Remember what we established at the start: there is no ingenuity in these systems. They generate derivatives at volume, and those are derivatives of attacks we already know how to stop.

The risk is not that they invent something we have never seen. The risk is that the volume finds the one machine you forgot to patch.

From Controls to Reports

The research I do at WitFoo sits on top of all of this. I do not make any of the eight controls. What we build takes the data coming off the controls you already own and turns it into reports for the people who have to read them: auditors, insurers, your board, your own team.

The question do we have the controls in place, and are they working correctly? should be answerable from evidence, control by control, covered, partial or unmet. That is a deterministic inventory, not a guess, and it is exactly the kind of question you should refuse to answer with a probabilistic one.

Collective Defence

I want to finish on the thing I think matters most, and which I have been arguing on this blog for over a decade.

Criminals cannot share. They compete with each other. They do not warn each other. There is no forum where one crew tells another that a technique has stopped working.

We can share, and we mostly do not.

Every one of us is generating billions of signals a day about where attacks are coming from. If an attack starts in Christchurch at nine in the morning and we tell each other, it can be completely impotent by lunchtime. Whether you use our software or somebody else's, tell your neighbour what is hitting you. That is what good neighbourhoods are made of, and safe digital neighbourhoods work exactly like safe physical ones. We talk to each other, we talk to our members of Parliament, we talk to the Police, and we listen to the Police and to the NCSC.

Two things make this work in practice. First, sharing has to be possible without handing over commercially sensitive information, which is why a good deal of my research goes into anonymising intelligence at the point it leaves your building. Second, if you do have an incident worth investigating, collect the signals from all of those controls as though they are evidence, because they are. Treat them that way from the start and investigators, the NCSC and the Police can determine what actually happened, which protects you and protects everyone who comes after you. (The prosecution argument is the long thread here: Profit and Loss (PNL) of Cyber Security, Lava & Cyber Insurance, and the 2020 FBI Internet Crime Report post all sit on it.)

There is also a straightforward financial case. Buying and running this stack alone runs to roughly NZ$400,000 a year. Ten organisations across a sector, or a region like Canterbury, brings it to about NZ$75,000 each. At the scale of something like New Zealand health, a thousand organisations, the per-organisation cost can fall under NZ$20,000.

We do not each run a private police force. We share one, because it is both more effective and cheaper. The same logic applies here, and we have not acted on it yet.

Three Takeaways

One. Attackers can launch boring attacks faster than they ever could. Not cleverer. Faster, and far more of them. So roll out the critical security controls and close the gaps. Keep a control-by-control readiness inventory so the rock is actually a rock and not a pile of pebbles. There are good partners here who will help you build that.

Two. Criminals can forge digital video, voice, email and documents. So spend your care on the channels that are hard to forge. Walk down the corridor and look at the person. Agree passphrases with your family and your finance team. Use the phone number you already have, not the one in the message. Type the URL, do not click the link.

Three. Use our human superpowers. Judgment, because they cannot be answerable for anything. Ingenuity, because they only make derivatives. And community, because criminals cannot collaborate and we can. That combination is worth more than anything an attacker can generate at speed, and it is the one advantage they have no way to copy.

Wrap Up

The machines got a new gear this year, and they did not get a new idea. That is the whole talk in a sentence. Attackers are faster, they can forge anything your eyes and ears would have accepted as evidence, and they can now reach your agents, but every one of those attacks still lands on controls that were designed decades ago by people who were thinking clearly.

Get the eighteen controls. Run eight of them properly. Then tell your neighbours what is hitting you, because that is the one move the other side cannot make.

If you were in the room at Te Pae and I got something wrong, or if you have a counter-example to the claim about CIS-level controls, I would like to hear it. Reply to [email protected] and I will read it.

References

WitFoo

Energy and cost

Vulnerabilities and controls

Attacks and fraud

Kevin Mitnick

Blaster and Sasser

New Zealand

Attachment
talk-deck-canterbury-tech-summit-2026-09-16_v13.pptx (7.47 MB)

Tags

A note on how this was written: I use artificial intelligence tools to help me research, check facts, and edit these posts. The ideas, the arguments, and any mistakes are mine. I read the sources, I check the claims, and I take full responsibility for what I publish here. The views are my own and the writing is my intellectual property.