Tony Evans already named what makes Astra dangerous — the systems nobody modernised
On Ep10, *Are Companies Sleepwalking Into the AI Era?, Tony Evans argued that as AI spread, "we have to invest far more in cybersecurity, etc., etc., to make sure this doesn't happen." Then he added the part that actually stings: "I'm not a cybersecurity expert, but the amount of people who still got systems that they're relying on that are like way outdated and they haven't modernised it… and that's the problem." It sat inside his wider argument about organisations sleepwalking: "there's corporations who could be doing a lot more and they think they're doing enough because I've given some people access to some gen AI."*
What it actually means
Tony's point reframes today's story. An autonomous exploit-finder is only frightening in proportion to what's sitting there unpatched, and most estates have plenty.
The capability is new. The exposure isn't. It has been on the risk register for years, deprioritised every year because nothing had come along cheap enough to exploit it at scale.
That's the bit that changed. Not the vulnerability, the cost of finding it. Which makes the action here boring and immediate: the modernisation work you keep rolling forward is no longer a hygiene item. It's the thing standing between you and a capability that doesn't get tired.
The capability is new. The exposure isn't — it's been on your risk register for years.
Source: Brew Bytes Ep10 — Tony Evans · Thursday 3 September 2026