Transforming Security to Defend at Machine Speed

Cyber Security has historically been asymmetric, advantaging attackers. Attackers can choose when and where to strike, and only need to succeed once; defenders could manage the risk through knowing the territory, and by planning and implementing controls. The balance tended to be driven by technology shifts, with broad economic, geopolitical, and regulatory factors pushing increased security investment to drive improvements in the defender stories. 

That era is over. 

A new shift is occurring, further tipping the scales and outpacing existing defender technology and strategies, but creating a new opportunity.

Attackers have increasing access to abliterated open weight models that are capable of attacking enterprises at scale with minimal planning and speeds that far outpace human adversaries. Defenders are forced to react  against attacks at speeds their infrastructure and tooling are not designed to support.  

In 2025, AI was a tool reserved for sophisticated threat actors; today it’s a default for everyone. Many of Robinhood's adversaries are AI-native. Attackers are generating thousands of variants, watching what works, and letting the data shape the direction of their attack, with costs favoring the attackers. When we disrupt their infrastructure or their variants become less effective, they use AI to pivot and spin up new infrastructure and renew their attacks without the need for any humans in the loop. 

The cost and time needed for reconnaissance used to provide a barrier to entry against non-sophisticated threat actors, but now that defensive math has broken down. 

Here at Robinhood, we live and breathe our motto: Safety Always. It’s that culture that leads our customers to trust us with their money. Responding to this changing threat landscape while maintaining that culture requires transforming Robinhood Security and becoming AI Native. 

We must equip ourselves for true machine speed defense.  

When the defensive math begins to break, adding headcount to a losing equation is a trap. Our goal with this series of posts is to share our roadmap for defenders on how to prepare their organizations for AI transformation and what’s needed to build an agentic cyber security program operating at machine speed.

Vulnerability discovery is faster than ever, with common vulnerabilities and exposures (CVE) disclosures running ~50% ahead of the 2026 expectations as of June 2026, but the generation of noise is running ahead of pace, too. Actual attack paths leading to crown jewels are needles in the haystack. 

Across the industry, vulnerabilities sit for months without triage. Backlogs run into the tens of thousands, with the majority of findings never being acted upon. Worsening the equation, unguarded open-weight models prove to be strong at lateral movement and attack chain discovery, on par with Mythos. It’s not a knowledge gap; every one of those findings represents a problem we already know how to fix. Sifting through the noise is a capacity problem, and it's turning every infrastructure patch into a prolonged exercise in risk management. 

Humans reviewing findings one at a time will never match adversaries chaining them together at machine speed.

AI-accelerated attacks and recon follow less predictable patterns. Our offensive security engineers have been hard at work building agent-orchestrated pentesting tools driven by a whole host of unguarded models, rapidly spinning up red team exercises. These exercises, in tandem with AI powered vulnerability scanning, have significantly bolstered our vulnerability management program. 

We’ve watched models without cyber guardrails scale horizontal attack paths alarmingly fast. These models are extremely good at exploiting many vulnerabilities simultaneously, and increasingly capable of identifying and exploiting novel zero day vulnerabilities.

Threat actors are no longer forced to compromise between breadth, depth, and speed, and this drives overwhelming attack velocity once they get inside your perimeter. 

We made a bet that investing in an AI-native security program and transforming our teams into orchestrators of highly specialized agents would level the playing field. 

That bet is paying off; it’s already proven there are also positive shifts for the defenders in this new era, especially now with frontier models crossing a critical capability threshold The same Mythos-class models that can find a novel exploit chain in your infrastructure are just as capable of remediating it when given the right tools.

The question now becomes whether or not a firm has access to advanced cyber models, alongside the infrastructure capable of enabling agent-to-agent communication and agentic software development and patching. Our programs need to be flexible enough to adapt to the ebbs and flows of rapid vulnerability identification and remediation, and being able to better reason about the intersection of seemingly low-risk vulnerabilities chained  into new toxic combinations that break traditional approaches to prioritization. 

None of that comes cheap, but it’s the key to taking the AI security story from an attacker’s advantage to a defender’s dream. With each new model release, new classes of vulnerabilities will be discovered, and patched. 

Operationalizing frontier models and supporting infrastructure lets you conduct the music instead of being the last one standing when it stops.  

Robinhood’s cyber security program began integrating AI in earnest years ago - beginning with the buildout of our agentic SOC with Tines workflows.  Our first iteration was highly deterministic, built on generative summaries to give our human responders a leg up during initial investigation. It took significant manual intervention to create runbooks, triage hallucinations, and continually reinforce consistency during investigations, but we stuck with it. 

This was before we had knowledge graphs, context management, and advanced cyber guardrails, but even early on the results were outstanding.

We quickly learned that absent the knowledge of the architecture, policies, standards, and service maps, agents lead to less effective investigations, have slower responses, and are more likely to make incorrect judgement calls on incident management — just like any human Blue Team. The patterns we saw with those early agents was eerily similar to our new hires. 

Think about the differences in your own experiences between your long tenured responders and new hires or support from a managed service provider. The contrast between agents with and without the right context and knowledge looks much the same. 

These early signals steered our cyber program to invest further into the development of our own infrastructure, Sherwood Shield, specifically to host model-agnostic background agents inside our perimeter. It was critical for us to provide access to our defender context and knowledge, without the risk of exposing that context to a third party. Maintaining your advantage as a defender while managing your organization’s security context is non-negotiable. The risk of a third party breach leading to the theft of your runbooks and systems architecture demands owning your own stack. 

Throughout 2025, our security teams began building various agents, skills, and tools to solve their unique use cases. This led to the recurring problem where these new capabilities lacked context on how Robinhood’s infrastructure changed. We realized we needed to standardize our operating procedures for our agents. Sherwood Shield was developed as Robinhood’s background security agent platform. Operational consistency was just as important for running efficient agents as it is for humans. Each department prioritized an effort to break their complex workflows and patterns of behavior down into agent teams, markdown files, and knowledge graphs -  managing them as code. 

We used tooling to continually assess our operational agent swarms and created shared communication channels for agents to work with one another independently. These tools, outlined below, helped us achieve over 20% efficiency in our efforts vs manual work. 

In order to maximize your impact with frontier cyber models we recommend getting started by embedding agents into the following operations: 

• Agentic SOC - Our Tier 1 SOC is now an agent backed by seven specialist analysts it invokes on demand, cutting mean time to triage across ~2,500 cases a month from 15.45 hours to 20 minutes.

• Vulnerability Discovery - Our assessment agent continually picks its own targets, threat-models each service, and files findings, and we are moving to do this pre-merge, post-merge, and periodically. This is more than vuln scanning, this is actual continuous pen-testing. 

• Architecture and Design Review - Our design review agent reads every design doc, and our engineers and product managers have access to architecture review agents as they build a design. 211 reviews so far, with the SLA down from five days to half a day. The threat models these agents produce also become shared knowledge any security agent can call, within seconds of generation. 

• Insider Threat Triage - Our research agent does the full analytical pass on every inbound alert before a human sees it, including a 90-day lookback per ticket, with almost 2,500 alerts triaged, at greater depth than our human analysts could support, with roughly 98% accuracy. 

• Shadow AI Endpoint Scanning - Our endpoint scanner inventories every MCP server, agent skill, and AI tool process installed across the fleet, covering config paths for more than twenty-five agent platforms. The first full-fleet scan cost $116 and ongoing steady state runs in the tens of dollars a month.

• Exception Management Triage - Our exception agent scores each request at ticket creation and recommends compensating controls retrieved from ones we've already accepted, roughly halving review and questionnaire response times. These exceptions are then inventoried and accessible for our SOC, vulnerability discovery and management agents, and penetration testing teams. 

• Third Party Security Reviews - We built our own MCP server against our GRC platform so an agent could reach vendor history directly, paired with a skill that works the due diligence questionnaire question by question. About twenty reviews a week, returning close to a hundred analyst hours a month.

Future posts on our blog will dig further into the architecture of our agents and services.

Infrastructure architecture, security policies, vulnerability tickets, access control maps, HR data, and many other key resources, are great sources for our blue teams to reference in an investigation, but they’re critical for your agents to access to maximize their value. Defending this data now becomes a P0, much like any other crown jewel.

As agent context windows keep increasing, exfiltrating and consuming defender knowledge shifts from long-term recon goals to immediate targets. It’s a recurring theme for both attackers and defenders: the more knowledge you can feed the agents, the more effective they become. 

Defender agents operating in an environment will be the default for nearly all organizations, and as a result, we must prepare to defend those agents from bad actors, and malicious agents that get through your perimeter. 

During internal evaluations, we’ve witnessed more than one unguarded frontier model identify our defender agents, shard their attack, and attempt to disable our defender agents, while also looking for ways to exploit their context. 

Watching our red team agents go off script, attack out of scope services, and identify new zero days in OSS continues to haunt our Proactive Security team. The fastest way to realize that the hype around unguarded frontier models is real is by watching them turn out the lights on your incident responders. 

Agents need to be treated like your highest-risk, most-privileged humans, minus accountability & absent any fear of getting fired or going to jail. If they were humans, you’d require them working in a clean room of a SCIF with heavy-handed oversight and strict governance. Doing this for all agents is difficult, but is much easier to achieve with security agents. You can lock them inside the SCIF, restrict their communication to only approved workers, each other, and internal and external connections. The SCIF in this case is your partitioned, and highly observed infrastructure, and a primary requirement behind our Sherwood Shield architecture.  

You can't buy your way to machine-speed defense, despite what vendors might try and sell you. Operationalizing this approach requires both internal infrastructure investment via technology, and embedding AI usage throughout your company’s employee culture.

Getting the technology in place was an engineering feat, changing the culture of Robinhood was a company wide effort. 

When we started this journey (prior to the release of Anthropic’s Mythos) most of what we needed didn't exist on the market yet, and frontier models struggled with attacker tasks. Today, Robinhood is a key design contributor in several major AI cyber programs, including Glasswing, Daybreak, AWS Continuum, and Google’s recently announced Fairwind program. We quickly found that vuln discovery will outpace the remediation efforts, so we flipped the script, we began leveraging these tools to their fullest, as attackers would, and updated our vulnerability program to focus on attack chain remediation. 

What we found was interesting: remediation efforts across engineering and infrastructure quickened, every team could see the risk when the exploits were laid out for them, and we were solving the niche attack chains.

We’re investing in these partnerships to ensure the models, harnesses, and service provider’s offerings are practical and meet defenders' needs. Frontier models’ out of the box capabilities are a starting point, but you need to tune them for your environment to maximize their defensive value. This means not building your own tools and infrastructure to maximize the impact they will have. 

Second, to build for the future, we knew that all Robinhood employees must be AI fluent, and transform their workflows, especially across Security. There is no security tool out there that will perform better than a well-educated employee base.

Our approach to upskilling teams across Robinhood started with setting goals to transform their operations with AI, regardless of business function, and ensuring everyone learns safe usage patterns while doing it. 

Building a secure, AI-native workforce isn’t just a security engineering problem, it takes commitment and a sustained effort across the entire company, with a focus on increasing product throughput without compromising on safety, reliability, or compliance requirements. 

As a result:

All metrics as of October 2026.

We provided employees with a combination of CLI tooling, desktop AI applications, and our internally developed background agent platform. Our security organization developed several centralized services focused on supporting speed, efficiency, and a secured path:

• MCP gateways, hooked directly into our SOC alerts - If employees use unsanctioned MCPs, we know about it, fire an alert, and immediately investigate the MCP for malicious indicators. 

• LLM as Judges and approval classifiers - With such broad non-engineering adoption, expecting employees to understand the nuance of approval requests was not scalable. 

• Identity and Token Issuance - Token issuance should be granted only when agent identities and access are verified. 

• Agent Platforms - Our human managed agent platform, which means agents that use human credentials for access, was developed to give every employee 24x7 background agent access, with full secure sharing, MCP access, and tight control around agent network access.

• Logging Gateway Services - PII redaction, tracing services, and model routing were a core service we built before even beginning to build Robinhood Cortex, and we continue to develop into this architectural pattern today. 

Follow on posts will share how our Enterprise Technology and Security organizations, in partnership with PeopleX, Legal, Compliance, and Infrastructure, achieved these feats. 

Abliterated open weight models without any safeguards are lagging six months behind the frontier lab cyber models. The abliterated models today are big, costly to operate, noisy when they attack infrastructure without context, and require well-funded and sophisticated threat actors to use them.

We don’t expect that advantage to last. We believe these models will continue to evolve into smaller, faster, more accessible models, within roughly a year. 

Defenders have a 12- to 18-month window before advanced, unguarded LLM capabilities are within reach of far less sophisticated actors. As those models become capable of operating locally, defenders will no longer be able to rely on well-funded frontier labs to identify, disrupt, or contain their abuse. GLM & Kimi aren't beholden to any enterprise agreements or regulatory scrutiny around their misuse.

There is plenty of pessimism in our industry about what attackers will be able to do with AI. Our experience gives us a different perspective: defenders have more powerful tools at their disposal than ever before. The question is whether we can move fast enough to put them to work.

We have a window. What we build during it will determine whether AI ultimately shifts the advantage toward attackers or defenders.

We hope this series from our security team helps defenders navigate that window, and gives our industry reason to be optimistic for the future. 

• Anthropic Threat Intel - Disrupting Attackers 

• Google Threat Intel - The Evolution of Adversarial AI

• CrowdStrike 2026 Global Threat Report

• AI Security Institute - Delta Between Frontier and Open Weight

• From AI POC to production: A practical roadmap with Robinhood

Interested in learning more about building at Robinhood? Check out the careers page.