CERIAS Weekly Security Seminar - Purdue University

CERIAS Weekly Security Seminar - Purdue University

Eugene Spafford, AI: Cybersecurity Panacea or Existential Threat?

Oct 7, 2026 · 1 hr 5 min · 14 segments

Twenty years ago, the first post on the CERIAS blog took apart the rule that passwords must be changed every month. NIST retired the practice in 2017; some standards still require it. That is how a…

Twenty years ago, the first post on the CERIAS blog took apart the rule that passwords must be changed every month. NIST retired the practice in 2017; some standards still require it. That is how a security myth works: a plausible claim, repeated in enough checklists, becomes infrastructure, and nobody audits infrastructure that seems to be working. The newest myth is that AI makes security professionals optional. This talk separates the three claims that marketing bundles together. AI tools do find flaws in shipped code, and the evidence from Google, DARPA, Mozilla, and Microsoft is real. Autonomous agents do add kinds of risk that no deployed security architecture was designed for. Neither fact implies that fewer people are needed. The vulnerability flood of 2026 is an audit of forty years of deferred engineering, not a crisis AI created, and the bottleneck has moved to the human capacity to verify, coordinate, and fix. The organizations that bet on replacement are already rehiring, often at a premium, the judgment they discarded. Open positions in the field number in the hundreds of thousands. For students, the message is direct: AI is not replacing you; it is generating your workload. The talk closes with what grows, what shrinks, and how to prepare. The capacities that make you a professional are the ones that do not become obsolete with the next model release. About the speaker: Eugene H. Spafford is a Distinguished Professor of Computer Science at Purdue University and the founder and Executive Director Emeritus of CERIAS. He is co-author of\*Cybersecurity Myths and Misconceptions \*(Addison-Wesley, 2023).

Twenty years ago, the first post on the CERIAS blog took apart the rule that passwords must be changed every month. NIST retired the practice in 2017; some standards still require it. That is how a…

Speakers: Eugene H. SpaffordGuestShawn HuddyHost

Myths About Passwords and AI Replacing Workers1:47 – 6:05

Eugene H. SpaffordGuest

1:47

So let me start with an example of a myth.

Eugene H. SpaffordGuest

1:52

It was mentioned that that's the book that I authored recently, co-authored recently.

Eugene H. SpaffordGuest

1:58

There are a lot of myths in cybersecurity.

Eugene H. SpaffordGuest

2:00

And one here is about requiring you to change your password every month.

Eugene H. SpaffordGuest

2:07

And you may have been in an environment where that was required, may still be there.

Eugene H. SpaffordGuest

2:13

It turns out that is a myth.

Eugene H. SpaffordGuest

2:15

And if you follow it back far enough, it was created by someone who was just saying, I don't know how often we need to do it.

Eugene H. SpaffordGuest

2:22

Let's do it monthly.

Eugene H. SpaffordGuest

2:23

There was no study, there was no basis for it, and it lasted for years.

Eugene H. SpaffordGuest

2:29

2006, I did research on that and basically published an article saying that it was nonsense, it was a myth.

Eugene H. SpaffordGuest

2:36

And it took until 2017 for folks at NIST to agree.

Eugene H. SpaffordGuest

2:42

And in their publication, they also indicated that monthly changes or regular changes of passwords wasn't necessary unless it was exposed.

Eugene H. SpaffordGuest

2:51

But even now, the PCI standards for credit cards still require it.

Eugene H. SpaffordGuest

2:57

So it is a myth that's lasted for a very long time.

Eugene H. SpaffordGuest

3:01

It originated during the days of mainframe computing back in the 1970s and has persisted to this day, even though it doesn't really make a difference other than to annoy users.

Eugene H. SpaffordGuest

3:15

There's a new myth.

Eugene H. SpaffordGuest

3:17

that has been started primarily by people working in the AI industry, that AI is going to make security personnel obsolete.

Eugene H. SpaffordGuest

3:27

They're going to be optional.

Eugene H. SpaffordGuest

3:29

And you see various kinds of pronouncements about how AI systems are going to make humans redundant.

Eugene H. SpaffordGuest

3:36

They'll solve all the security problems as soon as we get them trained a little bit better.

Eugene H. SpaffordGuest

3:41

And first of all, yes, AI systems are good at finding bugs in code.

Eugene H. SpaffordGuest

3:48

No question about it.

Eugene H. SpaffordGuest

3:50

And yes, putting new AI agents in place exposes us to new risks.

Eugene H. SpaffordGuest

3:56

But what's false is that it's going to require fewer people.

Eugene H. SpaffordGuest

4:01

That's the part that isn't true.