Depreciating Skills, Compounding Judgement

October's php2shell critical vulnerabilities only cemented further one of my biggest worries going on my "Late Escalation" journey - How relevant is this learning for me in 2026?

Much of my career has been cyber-adjacent (project managing cyber projects), my Late Escalation is a mid-career pivot to learning the ins and outs of the coal face of cyber security. My main interest is red teaming, hacking as the good guy. But as I work tirelessly through simulations, crafting the perfect bash commands, learning Metasploit, combing logs for clues, I can't help but consider … AI can do this better.

What takes me a full day to learn, imperfectly, AI can execute in minutes with a well crafted prompt. A decent AI can walk a learner (or an attacker) from "suspicious upload form" to "reverse shell" in 30 minutes. So what of the humble entrant to this space who wants a fulfilling career pivot?

Accepting the Depreciating Skills

Like buying a new car, I have accepted that the skills I am learning depreciate as soon as I leave the training ground and try to apply them in the real world, a real job. The methodology of exploiting many vulnerabilities is a commodity now. AI handles these best, known patterns - running sqlmap, crafting payloads, firing Metasploit modules.

And as we saw with php2shell, AI excels at taking complex vulnerabilities, requiring precision execution, and crafting the perfect exploit, tailored to the target.

I continue to learn basic techniques as a strong foundation. Building my own pattern library for my brain. Not only do I find it fascinating, but learning these skills, although depreciating in of themselves, will actually help me compound everything else.

What Compounds

One of my biggest takeaways from the labs is not so much devising the right commands to take over a box, but more:

• Which end points to poke?
• What clues does this 400 error give me?
• What do I do with this screen full of ports and processes?

Context is Everything. The labs call this out constantly. A forensics room handed me decrypted C2 (Command & Control) traffic and no further instructions - the skill wasn't the decryption, it was deciding what to hunt for in the wreckage. The tools give you the data; the judgement decides which data matters.

But even this is under assault. For example, Wiz's Red Agent - generally available since July 2026 - is an autonomous AI attacker that reasons about architecture and application logic, chaining multi-step attack paths by drawing on context from its Security Graph across cloud, identity and data.

It reportedly surfaced over 17,000 findings across roughly 1,000 environments in its first month of preview. So the machine now has context too. But notice what that context is: technical and environmental. It's fed by ingesting schemas and graphs, not by sitting across the table from a client. It doesn't know which finding threatens the CFO's flagship project.

For this reason even Wiz positions itself with human-in-the-loop workflows.

The Part after the Findings

I have no doubt the first draft of every pentest report will soon be machine-generated (if not already!).

But after nearly twenty years of project and risk work, I know the hard part is sitting in front of a client whose budget you're threatening, watching them push back on a severity rating. It's translating "unrestricted file upload" into "an attacker can persist in your estate and you'd struggle to evict them."

And AI-generated reports produce confident nonsense. A hallucinated CVE, an overstated risk. And clients don't sue the AI.

Summary: Making Best Use of my Learnings

At worst, I've invested evenings learning the mechanics of systems most people assume are magic. That alone puts me ahead of the project-people who've never touched a terminal.

But the pivot's still on. The sweet spot isn't competing with AI on execution. Why I am on this journey:

• I will know how to use the AI tools, and what they are doing under the hood.
• I will verify what they output.
• I will stand in front of the client and explaining what it means to them.

My guiding statement as I go through this journey is that "it's never too late to escalate." Turns out that applies to the machines too. I'm just choosing to escalate alongside them.