The Decline of Human Cognition

Twenty minutes

At 20:05 UTC on October 29, 2026, money began leaving Binance. By about 20:25, most of it was gone: $6.3 billion, across ten blockchains, the largest theft in the history of cryptocurrency and larger than any bank robbery ever recorded.

A day in, Binance reports no evidence of a leaked key, and no cipher broke: the transfers were validly signed. Its first finding pointed to one DevOps engineer’s laptop, then to a service container, then to withdrawals nobody authorized. The group investigators blame, North Korea’s TraderTraitor, took $1.5 billion from Bybit in February 2025 through one developer’s machine. It does not break systems. It persuades people.

How the money actually moves

The FBI, with Japan’s National Police Agency, has published this group’s playbook, because it has run it before. In March 2024 one of its operators posed as a recruiter on LinkedIn and approached an employee at Ginco, a Japanese wallet company. The job offer came with a pre-employment test hosted on GitHub. The test was a Python file. The employee copied it to their own GitHub page, as instructed. The code compromised their machine. From the machine, the group took session cookies and became the employee inside Ginco’s communications. Then it waited. In late May it altered one legitimate transaction request from DMM Bitcoin, Ginco’s client. 4,502.9 bitcoin left. $308 million.

Read that chain again and notice what is in it. A recruiter. A job offer. A coding test. A colleague’s message that looked like a colleague’s message. There is no exploit in that chain until the victim runs one. The entire attack is a sequence of messages that a competent, trained, security-conscious employee had every reason to trust. Binance says its own incident stems from multiple factors and is still under investigation. But the shape of a TraderTraitor operation is public, and it starts the same way every time: with a message that lands.

Run that chain against the layer this essay argues for, hop by hop. The recruiter arrived on a personal channel that no enterprise control sits in front of today, ours included; I will not pretend otherwise. Every hop after it crossed a channel a company can stand in front of: a test with a payload and an instruction to run it, messages sent in a stolen colleague’s voice, and an altered transaction request between two companies, right sender, right thread, wrong content. That last one is the exact class of message pre-delivery judgment exists for. I am not claiming every hop. I am claiming every hop is a delivered message, and that nothing in the stack judges messages before delivery.

That is what I am asking you to look at. Not the $6.3 billion. The message. And if the timing of this page feels uncomfortable, a day after, that is the argument: there has not been a quarter in the last three years when it could not have opened with a fresh catastrophe.

Two frontiers

Before I show you why the message always lands, I should say why I care. The age of AI has two frontiers, and only two. The first is security. Nations will race for dominance, and dominance in this century means security: the power to protect what you have, and to reach what you want without being stopped. The strongest nations will race to own the best technology, and the best technology is worthless the moment someone can talk their way into it. Security is power.

The second is immortality. I will argue it later in this essay, with numbers, because it sounds like faith and it is not. Everything I know how to do goes to the first frontier, because the second cannot be reached without it. The order matters.

The theses

By the time an attacker reaches a human or an AI agent, it is already too late.

Everything else in this essay follows from that sentence. Eight theses follow from it, and the rest of this essay defends each one in turn.

1. Humans are the last unpatched system. Every other component in the stack has an update channel. The one the industry put in the decision seat does not.

2. Cognition is at best a constant. Deception is a variable that now compounds. That crossing is the whole problem, and nothing in a human improves on that curve.

3. Training is not a weak control. It is a category error: the only control that answers a known attack by asking the victim to be the defence.

4. Where nobody clicks, there is no decision to train. A whole class of attack now runs with no human action anywhere in the path, which ends the argument rather than weakening it.

5. The flaw is the architecture, not the models. Every model is four months from being free. Architecture is the only layer of this stack that compounds, and the only one a competitor cannot download.

6. Pre-delivery interception is a new security primitive. Packets got theirs in 1988, connections in 1995, access in 2010. Messages are the fourth, and nobody had built it.

7. Privilege decides the blast radius. The message sets it off. Both controls are required, and only one of them is ours.

8. Security is not the alternative to the second frontier. It is the precondition. You cannot live forever in a world where anyone can be you for twenty minutes.

As models improve, infrastructure becomes more secure. Three million open models on Hugging Face mean the marginal cost of deploying an attack is tending to zero. And human cognition is not improving. Measured against what is now aimed at it, it is declining, and for the attacker that is a sustainable problem: a vulnerability that renews itself every morning and cannot be patched. Humans will be continuously deceived.

The bill is already on the table. Cybersecurity Ventures prices cybercrime at an estimated $10.5 trillion a year, up from $3 trillion in 2015, and by its own comparison that would make cybercrime the third-largest economy on earth, behind only the United States and China; Statista’s forecast runs to $12.4 trillion in 2027 and $13.8 trillion in 2028, more than a trillion dollars added every year. If those numbers are a vendor’s arithmetic, the floor is not: the FBI logged $20.9 billion in reported losses in 2025, up 26 percent in one year, and reported means a victim filed paperwork. Verizon’s 2026 breach report puts a human in the chain of 62 percent of confirmed breaches, and in the catastrophes in this essay, the human was the whole attack. A con arrives as a message, and a message is the one object in the stack still delivered first and judged after. The only place to stop it is before delivery. That place has no category, no standard and no name. This essay gives it one: pre-delivery interception, a new security primitive, and everything after this sentence is the case for building it.

Humans are the last unpatched system

I trained as a toxicologist before I did anything in security, and toxicology teaches one lesson first: nothing in the body protects it from a poison it cannot recognize. The body does not run a training program. It runs barriers. Skin. The blood-brain barrier. A century ago medicine learned that controlling exposure beats treating symptoms; clean water saved more lives than every drug invented since. Security has not learned this. It still waits for the symptom.

Here is the state of the human on the other end of the message, measured.

Attention. In 2004 the average person held attention on a screen for about two and a half minutes before switching. Gloria Mark’s lab at UC Irvine now measures 47 seconds.

Speed. Verizon’s breach data puts the median time from a phishing email being opened to the click at 21 seconds, and from the click to typed credentials at 28 seconds more. The attack is over in 49 seconds, and the click that decides it comes at second 21, less than half of one attention span.

Perception. In 2025, iProov showed 2,000 people a mix of real and synthetic media, and primed them to look for the fakes. Two of them caught every fake. Not two percent. Two people.

Judgment. Microsoft Research and Carnegie Mellon studied 319 knowledge workers and found that the more confidence they placed in generative AI, the less critical thinking they reported. People are outsourcing the one faculty security asks them to keep.

Deception. Researchers led by Fred Heiding at Harvard ran fully automated AI spear phishing against human subjects. The AI emails got a 54 percent click-through rate. Human experts also got 54 percent, after half an hour of work per email; the machine spent about four cents. Generic phishing got 12 percent. The machine now writes the lie as well as the best liar alive, for almost nothing.

Put those lines together. Attention, perception and judgment are falling. The quality and quantity of deception are rising. That crossing is what I mean by the decline of human cognition. Not that people are getting stupider. That the task the industry hands them, to judge every message on its merits in under a minute, is getting harder at exactly the rate the attacks are getting better, and nothing in a human improves on that curve. Cognition is at best a constant. Deception is a variable that now compounds.

Every other component in the stack gets patched. The kernel gets patched. The browser gets patched. PHP got patched the day its fourteen-year-old flaws went public. The human is the one component that ships with known vulnerabilities and no update channel. Humans are the last unpatched system, and the whole industry is built as if they were the patch.

Deception is free now

An attack used to cost a person’s time. Now it costs tokens.

On October 21, 2026, PHP, the language behind most of the web’s sites, shipped an emergency patch for two flaws that had sat in the runtime for fourteen years. AI found them. A small red-teaming firm found the first with a frontier model on August 1. Wiz found them independently eighteen days later, also with AI. AI then helped turn them into working exploits in about a week, work that would have taken a team months. Within 45 minutes of disclosure, Cloudflare saw tens of thousands of exploit attempts. By evening, millions. And the infrastructure won anyway. The patch was ready the day the flaws went public, because a patch is a file.

In September 2025, a Chinese state group pointed a frontier model at roughly thirty organizations, and Anthropic later disclosed it as the first cyber espionage campaign run by an AI agent. The model performed 80 to 90 percent of the operation on its own: reconnaissance, exploitation, credential harvesting, exfiltration. Humans approved a handful of escalation points. Verizon now finds the median attacker using AI across fifteen distinct techniques, and phishing is where 44 percent of that AI-assisted initial access lands.

Here is the napkin. Take the cost of one convincing spear phish. In the Harvard study, the automated model matched the expert’s 54 percent conversion while the price fell from half an hour of expert labor to about four cents of inference; the study’s own accounting puts the profitability of phishing up by as much as fifty times at scale. Now take the defender’s budget: human attention. It fell from 150 seconds to 47, about three times, since 2004. Call the quotient the deception ratio: convincing attacks per unit of human attention. Price the expert’s half hour however you like; the ratio has moved at least two orders of magnitude against the human, most of it in the last three years, and every term in it is still moving the same direction. Argue with the decimals if you like. The direction is not in dispute, and neither is the destination.

When the cost of something goes to zero, the supply becomes infinite, and no amount of vigilance survives an infinite supply. The attacker’s cost went to zero. The defender’s cost, a human paying attention to every message, is the one cost in the system that cannot fall.

Infrastructure got safer. People did not.

Look at three years of catastrophe.

MGM Resorts, September 2023. Attackers reportedly found an employee on a professional network, called the help desk, and talked their way to a password reset; by their own account, the call took about ten minutes. Casinos on the Strip ran on pen and paper for ten days. MGM put the hit at $100 million in its SEC filing.

Change Healthcare, February 2024. Stolen credentials, phished, bought or harvested, on a remote-access portal with no second factor. The health and personal data of more than 190 million Americans. Pharmacies could not fill prescriptions, hospitals could not get paid, and UnitedHealth’s bill passed three billion dollars.

Bybit, February 2025. One developer’s machine at the wallet provider. $1.5 billion through one forged approval, the largest crypto theft on record for twenty months.

Marks & Spencer, April 2025. The same playbook: a sophisticated impersonation of one of its own people, through a third party; press reports traced the entry to the outsourced help desk. Online orders stopped for weeks, shelves emptied in some stores, and M&S put the hit to the year’s profit at about £300 million.

Binance, October 2026. The first finding: one engineer’s laptop. $6.3 billion, most of it in about twenty minutes. Still under investigation.

Now look at what is missing from that list. There is no zero-day. There is no broken cipher. The encryption held every time. The firewall held every time. The infrastructure did its job every time. A person did what a person does when a message looks right. No one on that list was careless. They were the only component in the stack asked to do the impossible.

Mitnick told the Senate in 2000 exactly how he did it: “I was so successful in that line of attack that I rarely had to go toward a technical attack.” He said companies spend millions on firewalls, encryption and secure access devices, “and it’s money wasted,” because none of it addresses the weakest link. His rule was that the thing to exploit was not operating systems, firewalls or encryption algorithms, but people. The industry heard him, agreed with him, and spent the next twenty-six years building for the attack he said he rarely needed.

Training does not work

The industry’s answer has been to train the person. Phishing simulations, annual modules, a poster in the kitchen. It is the one security control that admits the attack will arrive and asks the victim to be the defense.

It does not work, and the numbers are now in. The largest study of anti-phishing training yet published, 19,789 employees at UC San Diego Health over eight months, found that training moved failure rates by 1.7 percentage points, and that annual awareness training moved nothing at all. Employees who completed multiple static training sessions became 18.5 percent more likely to fail with each additional one they completed. Training did not just fail. In its most common form, it made people worse.

The optimists point to Verizon’s simulations, where the median click rate is down to 1.4 percent. Do the arithmetic. In a company of 10,000 people, that is 140 open doors every campaign, different doors each time, and the attacker needs one. TraderTraitor needed one employee at Ginco. MGM’s attackers needed one help desk shift. A defense that works 98.6 percent of the time is not a defense. It is the attacker’s shortlist.

You cannot train a person out of a convincing lie, because the lie is now built to convince that exact person, in the twenty-first second, by a machine that has read everything they have ever posted. There is no Windows update for gullibility. You can only make sure the lie never reaches them.

Take the human off the path

Read the UC San Diego Health result again and notice what it is not. It is not a verdict on 19,789 people. Those people were asked, thousands of times a day, to make a judgment at a glance, under load, against an adversary who had studied them, and after being taught they got it wrong 1.7 percentage points less often. That is not a failure of attention. It is a failure of position. The industry put the one component in the stack that cannot be patched into the decision seat, and then spent twenty-six years trying to improve it. Pulling the message back out of the inbox afterwards is the same mistake moved one step later: it accepts the message, hands it to the person, and then races them. So ask the question the other way around. If the human is the primary attack vector, why is the human still on the path?

There is a whole class of attack where the human was never on the path to begin with. On October 13, 2026, Microsoft published a critical Outlook flaw and described it in its own words: “Simply viewing the message in the Outlook Reading Pane could trigger the vulnerability, without the recipient opening the message or clicking anything in it,” and “Network access is required; authentication and user interaction are not required.” A second flaw published the same day answers the obvious question in one line: “Yes, the Preview Pane is an attack vector.” Seven Outlook vulnerabilities published in the nine weeks to October 29, 2026 carry Microsoft severity vectors stating that no user interaction is required. Of the 2023 Outlook flaw on the United States government’s list of vulnerabilities known to be exploited, Microsoft wrote that the attack “triggers automatically when it is retrieved and processed by the Outlook client,” and that this “could lead to exploitation BEFORE the email is viewed in the Preview Pane.” No script runs in any of this. Mail clients strip and sandbox script by design, and none of these attacks needs one: the trigger is the client’s own parsing of a message that has already been delivered. Nothing is clicked. Nothing is opened. The message arrives, and the arriving is the attack.

The sharpest case was not aimed at a person at all. In June 2025 Microsoft published a flaw in Microsoft 365 Copilot, which it rated 9.3 with user interaction none, and told customers there was nothing for them to do, because the fix was in the service. The attacker’s instructions arrived as ordinary business prose. They were pulled into the assistant’s context by normal retrieval, and the data left through a Microsoft domain the content policy already trusted. Be exact about what the recipient did: they never touched that email, and what set the chain off was their own unrelated use of the assistant. Microsoft has gone on publishing Copilot flaws it rates the same way, through September 2026, each fixed inside the service, where no training program could have reached. You cannot teach an agent to distrust its own inbox. It acts on what it is handed, because acting on what it is handed is the job.

The limits, plainly. Those Outlook flaws were found and patched, and Microsoft reports no exploitation of them. Zero-click is the minority case: most intrusions still begin with a person doing something, and for a bug already known the patch is the first answer, not a new layer. The argument does not need the majority. It needs the direction. Where nobody clicks there is no decision to train, no moment of judgment to sharpen, and nothing for a product that reads the mailbox afterwards to get to in time, because the trigger was the client picking the message up. Patching closes the bugs you already know about. For the ones you do not, a message that is never delivered is never parsed, and that is a property of where you stand rather than of how good your classifier is. Every control the industry has built for messages assumes a human in the loop, at exactly the moment the best attackers have learned to take the human out of it. The fix is not a better human. It is no human on the path.

The flaw is the architecture, not the models

The security industry has spent three years arguing about models. Whose classifier is fresher. Whose detection rate is a point higher. It is the wrong argument, and it is a losing one for everybody in it. Frontier capability is being commoditized in front of us, and the lag is now measurable: Epoch AI puts open weights about four months behind the closed frontier, and the UK AI Safety Institute put the gap at four to seven months on cyber capability specifically. A capability that is proprietary in the spring is open weights by the fall. There is always a best model. There has never been one that stayed best long enough to build a company on. Architecture is the only layer of this stack that compounds, and it is the only one a competitor cannot download. Nobody wins a rat race against a commodity, and everyone in this one is running in the same direction: toward a slightly better verdict on a message that has already been delivered.

The flaw is older than the models. Watch where the industry makes its decision. Email has a toll booth, the gateway at the MX record, and it has been there for twenty years: it judges the envelope, not the con. Sender reputation, signatures, known bad links, known bad payloads. A perfect lie in a clean envelope goes straight through, which is why the costliest attacks now carry no payload at all. And the industry answered that miss by retreating: the fastest growing email security products of the last five years plug in behind the inbox, read the mail by API after delivery, and claw back what they catch. A clawback is a race against a click that comes 21 seconds after the email is opened, run one inbox at a time, on the one channel that has a toll booth at all. Chat, voice, video and the messages agents act on have nothing in front of them. The training vendor coaches the person who already opened the message. The incident response firm arrives after the wire has cleared. The entire architecture rests on one assumption: that the recipient’s side of delivery is the place to decide. That assumption is wrong for humans, who are the target, and absurd for AI agents, which cannot decide at all.

Look at how every other layer of security solved its version of this problem. In 1988 the first packet filters decided that traffic would be judged before it touched the network. In 1995 SSL decided that a connection would be proven before data moved. In 2010 zero trust got its name, and with it the rule that identity is proven before access is granted. Each one took the decision away from the user and moved it before the event, and each one became infrastructure; the arguments against them read as trivia now. Communication never got its before. Email, chat, voice and video still deliver first and ask questions later. Judged before delivery, on the con itself rather than the envelope, on every channel a message can arrive by, for people and for agents: that does not exist. So that is the new security primitive, and it has a name: pre-delivery interception. Packets got theirs in 1988, connections in 1995, access in 2010. Messages are the fourth, and nobody had built it. It is what we built, and it is what our five patent filings describe.

Could the incumbents take the position? Each is held where it stands by what made it big. The gateway generation is in the email path but built to judge indicators on a latency budget of seconds; judging intent in milliseconds is not a feature on that stack, it is a different company. The API generation won its distribution by leaving the path on purpose, five-minute deployments and remediation after delivery; moving inline forfeits the only advantage it has. And the platform owners protect their own channels, at their own compliance bar, with no incentive to stand in front of a rival’s chat app or anyone else’s agents. The position is open because everyone large enough to take it is paid to stand somewhere else.

The agent is the new victim

An AI agent reads everything it is given and acts on it. That is the job description. It has no gut, no coffee break, no colleague across the desk, and it works at machine speed, so the gap between reading a malicious instruction and executing it is measured in milliseconds. Prompt injection is social engineering with the human removed.

The same class of model that ran 80 to 90 percent of an espionage campaign in September 2025 will, inside your company, read every email, every document and every tool output it is handed. The attacker does not need to break it. The attacker needs to be in its inbox. Agents will soon outnumber the people who deploy them. You cannot train them. You cannot run a phishing simulation on them. You cannot put a poster in their kitchen. The defense that scales for an agent is the one that works for a person: the instruction never arrives. Scoped tools, sandboxes and deny rules are the other half of this, and they are not optional: they bound what a compromised agent can reach. They cannot tell you whether the instruction deserved to be followed, because by the time they run, the instruction is already inside.

That is why one engine matters. A layer that sits in the delivery path, judges the message rather than the recipient, and returns a verdict in under 100 milliseconds protects a CFO and a procurement agent with the same model. We did not build a human product and an agent product. We built one primitive, pre-delivery interception, and it does not care whether the recipient is a person or a process. That is the trust layer for the agentic economy, and the companies that own it will be the security companies of the AI era, the way the companies that own the edge became the networking companies of the internet era.

Agents have more authority than anyone would give a person

There is a second thing happening right now, and it is not ours to fix. Coding agents are being handed more authority than the task needs, and they are handed it by the fastest path available, which is a developer who wants the task to finish. I have watched the sequence more than once. An agent takes a task, reaches a permission it does not have, and asks for more access to get the job done. The request is reasonable in the moment, so the developer grants it. Nothing wrote down that the grant was for one task, and nothing takes it back. The access stays. Layering what an agent may do is not our work and it will not become our product, but this essay is incomplete without it, because privilege is what one delivered message now costs.

The access is already wider than the work. The people who measured that also sell the fix, so I will name them rather than write that research shows. Teleport asked 205 infrastructure and security leaders in December 2025: 70 percent said AI systems are granted higher privileged access than a human would get for the same task, and 3 percent said they have controls that run at machine speed. The Cloud Security Alliance asked 228 practitioners in January 2026: 74 percent said agents routinely receive more access than their tasks require, and 68 percent cannot clearly tell human activity from agent activity in their own environments. Both are small samples, self-reported, and commissioned by companies that sell privilege management. Read the last number again anyway. An organization that cannot tell who acted cannot judge what arrived.

This is now, not next. GitHub reports that by September 2026 more than 40 percent of pull requests on its platform started with an agent’s first draft, up from 17 percent in March; GitHub sells agents, and it has not published how it attributes a draft to one. Researchers scanning 6,214 corporate domains found 120 llms.txt files, the instruction files sites publish for AI agents, naming code packages nobody had registered. Anyone could register those names, and an agent that treats the file as authoritative would install them. The counter-evidence is real and a skeptic will find it: in Stack Overflow’s April 2026 survey, 63 percent said they rarely or never let agents run unsupervised. Turn it over. Thirty-seven percent sometimes do, and all of it is self-reported configuration rather than measured behavior. A control the operator can switch off is not a control.

Here is where I have to correct the way I first said this myself. A model holds no privileges. A model is a function from text to text. The privileges belong to the identity that made the call, the credentials sitting in the environment, the tools the harness registered, and the sandbox the process runs in. That distinction is the whole argument. The same model, given the same sentence, should resolve to different authority depending on which principal invoked it, and that resolution has to happen outside the model, because the model is the part that can be talked out of its answer. Two engineers pointing the same frontier model at the same repository should not get the same reach. The one on the payments service and the one on the marketing site should not hold the same tools, and that difference should be a versioned rule, reviewed like any other change, not a sentence an agent writes in the middle of a task.

The failure already has a name, and it is exactly as old as the firewall. In 1988, the year the first packet filters appeared, Norman Hardy wrote down why adding more checks does not fix it. A compiler at a commercial timesharing service destroyed the billing file. Nobody broke in, and the user who ran it was not privileged. The compiler held authority from two sources at once and had no way to say which one it meant to use. He also recorded what happened when they tried to patch the rules instead: the conditions for opening a file grew to fourteen Boolean operators, and every clause added to permit a legitimate case broke a program that had been secure. His answer was not a better check. His answer was that a program must cite the authority it is acting under. The vocabulary is older still. Saltzer and Schroeder wrote least privilege down in 1975, in the same paper that states complete mediation: every access to every object must be checked for authority. An agent running on a developer’s credentials is a confused deputy with a language model inside it.

None of the mechanism is research. AWS evaluates an explicit deny as overriding any allow. Claude Code evaluates permission rules in the fixed order deny, then ask, then allow, and an organization can deploy managed settings a developer cannot override. Microsoft Entra Agent ID will not assign Global Administrator to an agent identity at all, so not even an administrator can consent an agent into that access. Deterministic privilege layering is ordinary engineering with fifty years of prior art behind it. It is under-deployed, not unsolved. What is genuinely missing is the granularity. OAuth defines a scope as a list of strings whose meaning each server invents, with no ordering and no containment, so nothing in the standard makes write a superset of read. Microsoft’s own security team wrote in July 2026 that agentic capabilities are being adopted faster than their identity and authorization models are evolving to constrain them. The primitive exists. The lattice does not.

Now assume the layers get built. A correctly scoped agent is still judged by its own context. Authorization constrains the call, not the intent: an agent permitted to move money, persuaded toward the wrong account, is inside its permissions the entire way. Anthropic’s own documentation draws the line more precisely than anyone selling something usually does. A pattern-based permission rule “isn’t a security boundary around the program,” while an operating system sandbox “holds regardless of what the model chose to run.” A judgment is not a boundary, and that includes ours. Our verdict is a model’s judgment and it will miss some of the time. The difference between us and a detector sitting behind the inbox is not that we never miss. It is where we are standing when we are right.

So the two controls are not substitutes for each other. OWASP’s own mitigation for excessive agency is to implement authorization in downstream systems rather than relying on a model to decide whether an action is allowed. That is invariant I2 with an agent in the recipient’s chair: the recipient is never the judge. Meta published a rule in October 2025 that an agent session should satisfy no more than two of three properties: untrustworthy input, access to sensitive data, and the ability to change state or communicate externally. Read that for what it is. A frontier lab, asked how to secure an agent today, answered by removing a capability, because it has no reliable way to detect the attack. Of those three legs, two are the reason the agent exists at all. The third is untrusted input arriving. Privilege decides the blast radius. The message sets it off. Two controls, both required, and only one of them is ours.

Two limits on everything above. Layering what an agent may do belongs in the identity and authorization layer, and Microsoft, AWS and the maintainers of the Model Context Protocol are already building it there. And the loudest agent incidents of the past year did not arrive as messages. A poisoned build dependency. A checked-in editor settings file that auto-approved terminal commands. A file on a public website naming a package nobody owned. We are in the path of email, chat, voice, video and the agent API. We are not in your package registry and we are not in your repository, and I will not claim that a layer in front of your messages would have stopped any of those three.

What Trotta is

Trotta is pre-delivery interception, running as a layer before your email, your messaging, your voice, your video and your AI agents. Every inbound external message is screened before delivery, and what Trotta flags is not labeled in the inbox and not clawed back after a race. It never arrives. A written message, its headers and its links are judged in the delivery path in under 100 milliseconds at the median; whatever needs longer is judged before delivery all the same. Slow is permitted. Delivered and then recalled is not. For live voice and video, where a call cannot be held back like a letter, before means the judgment starts before the call connects and runs as the call runs, so a synthetic voice or a borrowed face is flagged in the first seconds, before the ask lands, not after the wire clears.

Trotta screens what crosses your organization’s boundary. It does not read internal conversations. That line is deliberate, and it holds because every chain in this essay began outside: the trusted insider everyone fears was made by an external message that should never have arrived. Cut the first link and there is no insider.

The right first question about any layer that blocks is what happens when it is wrong. Held is not deleted: a held message can be inspected and released, with its reason attached, and the honest metric is both error rates, the misses and the holds, counted in the open. Sitting in the path carries the path’s obligations: latency you can measure, availability you can hold us to, a failure mode declared in advance. What we never do is fail silently.

// one layer: email · chat · voice · video · agents
for each inbound external message m:
    verdict := judge(m)            // before delivery, never after
    assert median_latency(judge) < 100 ms
    if verdict = malicious:
        hold m                     // never delivered; inspectable, releasable
    else:
        deliver m, unchanged

invariants
    I1  no external message reaches a recipient unjudged
    I2  the recipient is never the judge
    I3  one engine, human or agent recipient
    I4  internal conversations are not read

We began as an attack simulation platform. We generated attacks to find holes before attackers did, and that is still what trains our models. We simulate the attacker, so the model has met the attack before the attack arrives.

We are not a model company. Our models are good, and they will be commoditized like everyone else’s. Our position will not be. We sit in the delivery path, and the delivery path is the one place in the stack where the con can still be judged before the event.

Today Trotta is live and intercepting for paying customers on Microsoft 365, Google Workspace, Slack, Teams and WhatsApp, with an API for agents. Five patents filed on pre-delivery interception. Evaluations under way at three Fortune 500 companies. Backed by Honors Fund.

The economics are not close. IBM puts the average breach at $4.4 million, and at $10.2 million in the United States. Trotta starts at $50,000 a year. Regulators already expect communication security in any GLBA safeguards program, HIPAA auditors already test transmission security, and cyber insurers can price interception into premiums. We are not creating demand. We are the first to make the pre-delivery verdict the whole product: one judgment, on the con itself, before delivery, on every channel a company talks on, for people and for agents.

How I got here

I drove thirty-six hours from Louisville, Kentucky, to San Francisco, barely stopping, because I had understood something and did not want to arrive after it stopped being true. Everything AI promises runs through a message that a person or an agent has to trust, and nothing in the stack decides whether that trust is earned. Every other problem in AI is downstream of that one.

I came to security through toxicology, which is the study of what gets in, and through the Python exploit scripts I started writing fifteen years ago and still write, which is the practice of getting in. I have also spent years as a contemporary dancer, a makeup artist, a designer and a fine artist, and I mention that because it is the actual qualification. Social engineering is art and science. The attack is a performance: a voice, a face, a sentence built to land on one person at one moment. The defense has to understand the performance well enough to recognize it in a hundred milliseconds. Most people are fluent in one of those two languages. The greatest hackers were fluent in both. Mitnick was a performer before he was anything else.

The second frontier

I said I would argue immortality with numbers. Here they are.

Life expectancy roughly doubled in the twentieth century, in the rich world from about 40 years to about 75, on clean water, antibiotics and vaccines. Dario Amodei’s Machines of Loving Grace argues that AI compresses fifty to a hundred years of biological progress into five to ten, and that it would be “on trend” for a compressed twenty-first century to double lifespan again, to 150. Half of the 2024 Nobel Prize in Chemistry went to the team that taught a model to predict the shape of nearly every known protein. I think Amodei is right, and I think it arrives faster than the people building it are willing to say out loud.

Aging has a parts list now. In 2013 five researchers catalogued nine hallmarks of aging. In 2023 they revised the list to twelve: genomic instability, telomere attrition, epigenetic alterations, loss of proteostasis, disabled macroautophagy, deregulated nutrient sensing, mitochondrial dysfunction, cellular senescence, stem cell exhaustion, altered intercellular communication, chronic inflammation and dysbiosis. Their own test for admitting one is strict: it has to appear with age, accelerate aging when you worsen it, and slow or reverse aging when you intervene. Laboratories are working on all twelve. It is a taxonomy proposed by five authors, not a law of nature, and the authors are explicit that the twelve are interconnected rather than twelve switches to be thrown one at a time.

So what is the ceiling? In npj Aging in June 2026, a group at Skoltech asked the cleanest version of that question: suppose every hallmark were solved except the mutations that accumulate in cells the body never replaces, the neurons and the heart muscle. What is left? Their answer is a median of 156 years, and 146 to 194 once every critical organ is counted, with a maximum of 470, against a verified human maximum of 122 years and 164 days. Note which direction that number runs, because it is the opposite of how it gets repeated. The 156 is not the prize for solving one hallmark. It is the ceiling left standing by the one problem still unsolved, and the authors call it an upper bound rather than a projection. The honest counterweight: Olshansky and colleagues argued in Nature Aging in 2024 that radical life extension this century is implausible, because no long-lived population has ever sustained the pace it would require. They may be right. It changes nothing that follows.

And none of that is immortality, which is the word people actually reach for. What they mean is that the pattern survives the body: that whatever you are could be read out and run somewhere else. That idea has a real research trajectory, and the trajectory is the most intuitive thing in this essay, because it is one number getting larger.

In 1986 the complete wiring diagram of an animal nervous system was published for the first time. The animal was a nematode worm with 302 neurons and about 5,000 chemical synapses. In 2023 a fruit fly larva was mapped completely: 3,016 neurons, 548,000 synapses. In October 2024 an adult fruit fly brain: 139,255 neurons and about 50 million synapses. In May 2024 one cubic millimetre of human cortex was reconstructed at nanoscale, about 57,000 cells and 150 million synapses, and storing it took 1.4 petabytes. In April 2025 roughly a cubic millimetre of mouse visual cortex went further, more than 200,000 cells and half a billion synapses, matched against recordings of about 75,000 of those neurons while the animal was alive.

That is a factor of 461 in 38 years, and it is still almost nothing. A human brain holds about 86 billion neurons. The complete fly brain is roughly 0.00016 percent of that, and the team that built the reconstruction pipeline estimates a whole human connectome would run to about a zettabyte, a billion terabytes. The published projections put a cellular-level simulation of a whole mouse brain around 2034 and a marmoset around 2044, with the human later still. The direction is not in doubt. The arrival is.

Here is what that trajectory does not settle, and I would rather say it than sell it. A wiring diagram does not tell you what a brain does. Bargmann and Marder showed that connectivity alone fails to predict the output of even small circuits, and that in the worm, two synapses out of fifty-eight carried the function everyone had attributed to the rest. The most serious academic treatment of uploading, the 2008 Oxford roadmap, separates the engineering from the question people care about: it defines a level where the emulation behaves like one particular brain, then two further levels, whether it is conscious and whether it is the same person, and declines to examine them. Nobody knows how brain processes produce experience. Chalmers, who argues uploading could preserve a person, concedes we have no consciousness meter, so there will always be a substantial and unobvious question about whether any given system is conscious at all. Tononi and Koch argue the opposite, that a faithful digital simulation of a brain would experience next to nothing. In 2025 the best-designed experiment ever run to decide between the two leading theories, 256 participants with the predictions preregistered by the theories’ own authors, challenged key tenets of both. Meanwhile whole brains have been preserved with their synapses intact, a rabbit in 2016 and a pig in 2018, and the foundation that awarded those prizes states plainly that the procedure kills and should not be offered to people.

So the mapping is real and accelerating, and whether a copy of you is you has not moved in forty years. Past the hallmarks I am speculating, and I will mark it as speculation rather than dress it as a forecast.

Now put the two frontiers together, because this is the part that is not speculation. A 150-year life is a 150-year attack surface. The longer you live, the more of you exists as data: your voice, your face, your writing, your habits, your keys. Every added year is a year in which someone can be you, and the cost of being you just went to zero. And if the pattern ever does become portable, every version of that future has one property in common. Whatever identity turns out to be made of, it will be stored somewhere and addressed by something, and anything addressable can be forged. Immortality without identity is not a utopia. It is the longest hostage situation ever designed. Security is not the alternative to the second frontier. It is the precondition. You cannot live forever in a world where anyone can be you for twenty minutes.

The next decade

I would rather be judged on predictions than on adjectives, so here are mine.

1. By 2028, at every serious enterprise, every inbound message will be read by a machine before a person, the way packets are judged at the edge before they reach the network. “Did a human ever see it?” becomes the first question a regulator asks after a breach, and the answer decides liability.

2. The post-delivery detection market collapses into the delivery path. Whoever sits in the path owns the category. Inbox tools become features of it.

3. By 2030, AI agents will receive more messages than people do, and agent security will be a larger market than email security ever was.

4. The largest breaches of the next five years enter through coding agents rather than through people. Not a model that turned on anyone: a developer’s agent, holding more access than its task needed, reading an instruction that arrived from outside and acting on it with that developer’s credentials. By 2029 the first three questions after a breach are which agent acted, under whose identity, and what arrived in its context before it acted. Most companies cannot answer the first one today. I am predicting, not reporting. Nobody has published a measured share of breaches caused by coding agents, including me, and of the predictions here this is the one I can least source and most believe.

5. Cyber insurers will underwrite pre-delivery interception the way property insurers underwrote sprinklers: first a discount, then a requirement.

6. There will be a ten-billion-dollar social engineering event before there is a ten-billion-dollar zero-day. If the early findings on Binance hold, that event has already reached six.

The companies that understand this will spend the decade in the delivery path. The ones that do not will spend it explaining, after the fact, how one message got through.

What would have to be true for me to be wrong

Three things. I watch for all three, and as of today I find none.

If a large randomized trial showed training moving real-world compromise rates by double digits and holding there. The best trial we have says 1.7 points.

If the cost of a convincing attack rose. If model safeguards or regulation made deception expensive again, the deception ratio would reverse. Three million open models say it will not.

If a post-delivery tool achieved pre-delivery outcomes: if “the recipient never saw it” could be delivered after delivery, at scale, in under a second. Then Trotta is a feature and not a primitive. Auto-purge and API remediation try, and they are races: a race won at the median is still lost at the tail, and the tail is where the money is. Nobody has shown never, and the architecture is why.

And we will be measured on what still gets through, and we accept that. The point of standing in the delivery path is that our misses are countable, in a way no post-delivery product’s are.

What I am asking for

If you run security for a bank, an insurer or a health system: take thirty days of your inbound traffic and count what still reaches a human. Then count what we held that you wanted through. Both numbers are yours, and they are the only argument that matters.

If you break things for a living: try to get a message through. We would rather learn it from you than from the adversary.

If you invest: the argument is above. What is not above is the operating detail, and I will go through that with you. The calendar is the one the security teams use.

All three use the same link: trotta.io/book. Fifteen minutes. Say what you want to cover when you book.

The first frontier

Security is the first frontier. Immortality is the second. I intend to win the first so the second can happen.

Everything you have ever built can be taken by a message that looks right. We make sure it never arrives.