Episode: Security Boulevard Podcast – Ep. 56, “Did AI Just Kill Security Through Obscurity?”
Hosts: Tom Hollingsworth, Event Lead, Tech Field Day, and Analyst, The Futurum Group · Fernando Montenegro, VP and Practice Lead, Cybersecurity, The Futurum Group · Drew Conry-Murray, Co-host, Packet Protector, Packet Pushers
Published: November 3, 2026
Listen: YouTube | Podbean | Techstrong TV
Futurum’s Fernando Montenegro, Tech Field Day’s Tom Hollingsworth, and Packet Pushers’ Drew Conry-Murray discuss how AI erased the learning curve that obscurity depended on, and what defenders should do with obscurity, secrecy, and deception now.
The Take
In 1883, Auguste Kerckhoffs wrote that a military cipher must stay secure even if the enemy captures it. Security has repeated the lesson ever since, and many organizations quietly ignored it anyway. Obscure platforms, unpublished admin pages, and legacy systems few people understood all felt safe because learning them took time.
AI has removed most of that time. An attacker can now get a working understanding of Common Business-Oriented Language (COBOL) or a supervisory control and data acquisition (SCADA) environment in an afternoon.
The panel agrees obscurity was never a real control. It was a delay. What matters now is what remains once the delay is gone: years of technical debt, decisions that only looked good because nothing went wrong, and a better use for hiding things on purpose.
What You’ll Hear
- What an 1883 paper on military ciphers already said about hiding how a system works.
- Why the bear you only had to outrun can now clone itself.
- The three terms security teams use interchangeably, and why mixing them up leads to weak architecture.
- How a shell company explains obscurity to an executive in one sentence.
- What a famous Super Bowl interception teaches about security decisions that “worked.”
The Insights
AI Removed the Learning Curve That Obscurity Relied On
Obscure targets were safe mostly because they were not worth the effort. A less common Linux distribution or a niche platform took longer to learn than a mainstream one, so attackers went elsewhere. AI assistance shrinks that effort, which makes less common targets attractive again. Those targets also tend to have fewer researchers looking for flaws and fewer defenders watching.
The implication: the “less attractive target” assumption behind many legacy and niche environments no longer holds, and risk models built on it need revisiting.
“I’ve heard people say things like, you don’t need to outrun the bear, you just need to outrun the second slowest person in the group. And now suddenly the bears are able to clone themselves, and that model doesn’t really work anymore.” — Drew Conry-Murray, Co-host, Packet Protector, Packet Pushers
Obscurity, Secrecy, and Deception Are Different Controls
Teams often use the three words as synonyms. Obscurity hides how something works. Secrecy protects keys, credentials, and access. Deception makes something behave differently from how it looks. Only the first one is losing value. Segmentation still limits what an intruder can see, and deception becomes more useful when AI-assisted attackers probe every obscure path they can find.
The implication: keep things private and segmented, but stop counting obscurity as protection. Consider decoys on the paths only an attacker would try, where any hit is a high-confidence alert.
“We talk about segmenting the network, and that’s effectively creating artificial obscurity, right? I create a bounded horizon for people so that they can’t see that there’s anything else going on out there.” — Tom Hollingsworth, Event Lead, Tech Field Day, and Analyst, The Futurum Group
A Bad Bet That Paid Off Is Still a Bad Bet
Much of today’s exposure comes from shortcuts that were meant to be temporary: an admin page nobody would find, an “allow any” rule, a system that was too minor to secure. Each felt reasonable because nothing happened. Decision science calls this “resulting,” judging a decision by its outcome rather than its quality.
The implication: security leaders can present this to executives as a changed threat model, not a past failure, and use it to fund the discovery, documentation, and response work that was deferred.
“If you make the decision to, I’m only going to … hide it, and that’s enough, and then nothing happens, it’s still a bad decision. It just happened to work out that way.” — Fernando Montenegro, VP and Practice Lead, Cybersecurity, The Futurum Group
The Big Picture
Technical debt is coming due, and AI is collecting it faster than most organizations can pay it down. The risk is not limited to exotic systems. Every organization that has shipped software or run IT carries shortcuts that depended on nobody looking closely.
Patching remains necessary, but it is also the easiest thing to measure, which makes it tempting to stop there. The organizations that come out ahead will map their environments honestly, shorten their response times, and treat segmentation and deception as deliberate design choices.
Obscurity still has a place as one layer among many. Organizations that keep treating it as their main defense are exactly the ones AI-assisted attackers will find first.
Listen & Resources
Listen to the full conversation: YouTube · Podbean · Techstrong TV
Mentioned in This Episode
- Auguste Kerckhoffs, “La Cryptographie Militaire” (1883), and Kerckhoffs’s principle
- Enigma and Bletchley Park
- AI-assisted attacks on legacy and niche platforms: COBOL, SCADA, AS/400
- Marcus Hutchins on why defenders need offensive AI capabilities, not only defensive ones
- Network segmentation and microsegmentation
- Deception: decoy responders on paths only an attacker would probe
- “When the facts change, I change my mind. What do you do, sir?”, a line often attributed to John Maynard Keynes
- Annie Duke, Thinking in Bets, and “resulting”
- Super Bowl XLIX goal-line interception
- Packet Protector podcast (Packet Pushers)
- Security Field Day
Disclosure: Futurum is a research and advisory firm that engages or has engaged in research, analysis, and advisory services with many technology companies, including those mentioned in this article. The author does not hold any equity positions with any company mentioned in this article.
Analysis and opinions expressed herein are specific to the analyst individually and data and other information that might have been provided for validation, not those of Futurum as a whole.
Other Insights From Futurum:
Anthropic Glasswing: AI Vulnerability Detection Has Crossed a Threshold
Can Frontier Virtual Patching Close the AI Exposure Gap?
Can IBM and ServiceNow Finally Make Legacy Systems AI-Ready?
Author Information
Fernando Montenegro serves as the Vice President & Practice Lead for Cybersecurity & Resilience at The Futurum Group. In this role, he leads the development and execution of the Cybersecurity research agenda, working closely with the team to drive the practice's growth. His research focuses on addressing critical topics in modern cybersecurity. These include the multifaceted role of AI in cybersecurity, strategies for managing an ever-expanding attack surface, and the evolution of cybersecurity architectures toward more platform-oriented solutions.
Before joining The Futurum Group, Fernando held senior industry analyst roles at Omdia, S&P Global, and 451 Research. His career also includes diverse roles in customer support, security, IT operations, professional services, and sales engineering. He has worked with pioneering Internet Service Providers, established security vendors, and startups across North and South America.
Fernando holds a Bachelor’s degree in Computer Science from Universidade Federal do Rio Grande do Sul in Brazil and various industry certifications. Although he is originally from Brazil, he has been based in Toronto, Canada, for many years.
