# Depreciating Skills, Compounding Judgement

October's [php2shell](https://www.theregister.com/security/2026/10/21/php-devs-publish-critical-bug-fix-as-site-owners-warned-pull-em-offline-if-youre-unpatched/5304519) critical vulnerabilities only cemented further one of my biggest worries going on my "Late Escalation" journey - *How relevant is this learning for me in 2026?*

Much of my career has been cyber-adjacent (project managing cyber projects), my [Late Escalation](https://lateescalation.hashnode.dev/page/about) is a mid-career pivot to learning the ins and outs of the coal face of cyber security. My main interest is red teaming, hacking as the good guy. But as I work tirelessly through simulations, crafting the perfect bash commands, learning Metasploit, combing logs for clues, I can't help but consider … AI **can** do this better.

What takes me a full day to learn, imperfectly, AI can execute in minutes with a well crafted prompt. A decent AI can walk a learner (or an attacker) from "suspicious upload form" to "reverse shell" in 30 minutes. So what of the humble entrant to this space who wants a fulfilling career pivot?

## Accepting the Depreciating Skills

Like buying a new car, I have accepted that the skills I am learning depreciate as soon as I leave the training ground and try to apply them in the real world, a real job. The methodology of exploiting many vulnerabilities is a commodity now. AI handles these best, known patterns - running `sqlmap`, crafting payloads, firing Metasploit modules.

And as we saw with php2shell, AI excels at taking complex vulnerabilities, requiring precision execution, and crafting the perfect exploit, tailored to the target.

I continue to learn basic techniques as a strong foundation. Building my own pattern library for my brain. Not only do I find it fascinating, but learning these skills, although depreciating in of themselves, will actually help me compound everything else.

## What Compounds

One of my biggest takeaways from the labs is not so much devising the right commands to take over a box, but more:

- Which end points to poke?
- What clues does this 400 error give me?
- What do I do with this screen full of ports and processes?

**Context is Everything**. The labs call this out constantly. A forensics room handed me decrypted C2 (Command & Control) traffic and no further instructions - the skill wasn't the decryption, it was deciding what to hunt for in the wreckage. The tools give you the data; the judgement decides which data matters.

**But even this is under assault.** For example, Wiz's Red Agent - generally available since July 2026 - is an autonomous AI attacker that reasons about architecture and application logic, chaining multi-step attack paths by drawing on context from its Security Graph across cloud, identity and data.

It reportedly surfaced over [17,000 findings](https://labs.cloudsecurityalliance.org/research/csa-research-note-ai-autonomous-red-team-agent-findings-2026/) across roughly 1,000 environments in its first month of preview. So the machine now has context too. But notice what that context is: technical and environmental. It's fed by ingesting schemas and graphs, not by sitting across the table from a client. It doesn't know which finding threatens the CFO's flagship project.

For this reason even Wiz positions itself with human-in-the-loop workflows.

## The Part after the Findings

I have no doubt the first draft of every pentest report will soon be machine-generated (if not already!).

But after nearly twenty years of project and risk work, I know the hard part is sitting in front of a client whose budget you're threatening, watching them push back on a severity rating. It's translating "unrestricted file upload" into "an attacker can persist in your estate and you'd struggle to evict them."

And AI-generated reports produce confident nonsense. A hallucinated CVE, an overstated risk. And clients don't sue the AI.

## Summary: Making Best Use of my Learnings

At worst, I've invested evenings learning the mechanics of systems most people assume are magic. That alone puts me ahead of the project-people who've never touched a terminal.

But the pivot's still on. The sweet spot isn't competing with AI on execution. **Why I am on this journey:**

- I will know how to use the AI tools, and what they are doing under the hood.
- I will verify what they output.
- I will stand in front of the client and explaining what it means to them.

My guiding statement as I go through this journey is that "it's never too late to escalate." Turns out that applies to the machines too. I'm just choosing to escalate alongside them.