Anton Chuvakin

Cisco Vice President of Product Management Anton Chuvakin has 25 years of security research experience and previously served as a Gartner Research Vice President and a member of the Google Cloud CISO Office.

Chuvakin believes second-level vulnerability exploitation is unrealistic, because even if a model runs in just a few seconds, no one can discover a vulnerability within seconds.

During his time at Gartner, Chuvakin proposed the concept of the "patching sound barrier," referring to an insurmountable speed ceiling in enterprise patch deployment processes, with typical timelines measured in months or even quarters.

The key to breaking the patching sound barrier is not AI but modernization (containers, microservices, cloud deployment), which enables systems to be rebuilt from pipelines in minutes; for enterprises heavily using third-party software such as Oracle, SAP, or Windows, modernization efforts offer limited help, and they should shift toward mitigation rather than fixating on patching.

Chuvakin designed the "15-minute patch experiment" thought experiment, hypothesizing that all patches could be deployed within 15 minutes and working backward to determine what conditions would need to hold, in order to expose an organization's real bottlenecks.

Chuvakin leans toward the view that even a mid-tier attacker with top-tier AI would still struggle to carry out truly sophisticated intrusions, because friction in enterprise environments equally impedes attackers; he is closer to the camp of "increased risk but no doomsday."

Chuvakin defines "vulnerability doomsday" as the simultaneous occurrence of more vulnerabilities, more exploitation, and more incident damage; if the number of vulnerabilities surges but they are not exploited, it is merely an increase in patching workload and does not count as doomsday.

Chuvakin believes the core argument is not "do basic controls" but "comprehensively verify that basic controls are truly everywhere," using AI or agents to continuously assess configuration management and MFA coverage in every corner.

Chuvakin believes logging is the most overrated coverage item: enterprises often say they have logs, but during incident response key DHCP logs, outbound traffic logs, or east-west traffic logs are often missing; he offers the "3 a.m. test" answer: one year of log retention is a good rule of thumb.

Chuvakin believes treating CVEs as units of work rather than identifier strings is the root cause of many failing vulnerability management programs.

Chuvakin distinguishes workforce agents (employee assistants, whose permissions are analogous to those of an employee and should be a sub-identity of the employee identity) from workload agents (business process agents, governed as non-human identities, NHI).

Chuvakin emphasizes "no fat agents": when an agent's mission is so broad that it covers HR, IT, and finance, least privilege becomes impossible; only by narrowing the agent's mission can least privilege be achieved at the tool level and data level.

Chuvakin offers 30-day action recommendations: focus on mitigation rather than fixating on patching; figure out how agents (including shadow agents) are operating in the environment; edge devices must be patched, and you cannot mitigate a firewall with a firewall.