## Sources

1. [The Tidy House](https://www.oreilly.com/radar/the-tidy-house/)
2. [Predict, Don’t Enumerate](https://www.oreilly.com/radar/predict-dont-enumerate/)

---

### **Predict, Don’t Enumerate – Michael Roytman**

In this article, Michael Roytman discusses a paradigm shift in cybersecurity necessitated by the overwhelming volume of software vulnerabilities, arguing that **static enumeration must give way to predictive modeling** [1, 2].

*   **The Machine-Scale Problem:** Cybersecurity has reached a "machine-scale" level of noise, where enterprise scanners generate millions of findings monthly, far exceeding the capacity of human teams to remediate them [3].
*   **Endorsement of EPSS:** Anthropic recently endorsed the **Exploit Prediction Scoring System (EPSS)**, a statistical model that predicts the probability of a flaw being exploited within 30 days based on real-world attacker activity [1, 4]. This is notable because a leading AI lab is recommending a purpose-built predictive model rather than an LLM for defensive prioritization [3].
*   **Pointing vs. Knowing Machines:** Roytman adopts a vocabulary that distinguishes between "pointing machines," which merely enumerate and name vulnerabilities, and **"knowing machines,"** which understand code behavior within a specific environment to recognize genuine risks [5, 6].
*   **Vulnerability Density:** The author notes that vulnerabilities are "dense" (like weeds in a field) rather than "sparse" [7]. AI-driven discovery tools, such as Anthropic’s upcoming **Mythos model**, are expected to increase vulnerability findings by an order of magnitude, making human-scale solutions like CVSS (Common Vulnerability Scoring System) obsolete [2, 8].
*   **The Importance of Local Context:** While EPSS is a global model, it cannot see internal organizational details [6]. The "next decade of the field" will focus on **local models** trained on an organization’s specific asset inventory, application topology, and telemetry to provide an asymmetrical advantage to defenders [9].
*   **Necessary Policy Shifts:** To survive this shift, organizations must:
    *   **Rewrite SLAs** to prioritize probability of exploitation and asset exposure over static severity scores [10].
    *   **Change board reporting** to track "exploitability-weighted exposure" rather than simple vulnerability counts [11].
    *   **Invest in telemetry** to create a feedback loop between prioritized risks and observed exploits [12].
    *   **Engage auditors** to move away from regulatory inertia that favors outdated severity-based frameworks [12].

### **The Tidy House – Tim O’Reilly (featuring DJ Patil)**

Tim O’Reilly interviews DJ Patil, the first U.S. Chief Data Scientist, who argues that the primary obstacles to AI adoption are **organizational and economic, not technical** [13, 14].

*   **The "Broken Promise" and Job Anxiety:** Patil highlights a growing "anger and angst" among workers and students who feel "terrified" of being replaced by AI [15]. He notes a significant internship gap where even top-tier university students are unable to find roles despite high application volumes [15, 16].
*   **Mechanism Design for Value Creation:** O’Reilly argues that current AI labs are designing "games" that concentrate value among first movers rather than distributing it across the economy [17, 18]. He advocates for **mechanism design**—rules that produce desired outcomes—using YouTube’s ContentID as an example of a system that created a new "creator economy" [18].
*   **Building a "Tidy House":** Patil uses the term "the tidy house" to describe the essential, **"dumb, boring" data infrastructure** (unified data environments, clean pipes, and metadata) required for AI to be useful [19]. Organizations that invested in this infrastructure early can deploy AI immediately, while those that didn't must pay high "GPU costs" to reconstruct context [19, 20].
*   **Institutional Bottlenecks:** In sectors like healthcare, the "replacement" narrative has caused labor to resist AI, even though it could automate administrative burdens and allow workers to focus on their core roles [21, 22]. The constraint is **organizational capacity**, not the technology itself [22].
*   **Empowering Domain Experts:** Patil emphasizes putting AI tools directly in the hands of frontline workers [23]. At Devoted Health, **clinicians and pharmacists are building their own agents** to monitor bad drug interactions, leveraging their domain expertise without waiting for technical product managers [23, 24].
*   **The Power of Simple Data Products:** Patil asserts that the **histogram** remains one of the most powerful data products and advocates for data democratization while maintaining guardrails to prevent errors in how data is queried [24, 25].
*   **Future Opportunities:** The next cycle of innovation will likely occur in the **layers above AI models** through architectural innovation and "mechanism design" rather than in the models themselves [14, 26]. Patil is also launching a **makerspace** to help students without internships gain tangible skills by building civic tech or other projects [27, 28].