Key Takeaways
- • Andreessen Horowitz, in its "Defense in Depth, Rebuilt for Machine Speed" report published November 6, 2026, proposes an AI security workflow that blocks vulnerabilities in running systems within hours and then repairs the underlying code without a restart.
- • The approach links temporary live protection, such as request filtering, in-application input blocking and in-memory patching, with permanent source-code fixes produced through AI-generated pull requests.
- • The report identifies three core metrics for evaluating such systems: hours from disclosure to protection, days to a permanent fix, and how often live protection blocks legitimate traffic.
- • The report cites 48,185 vulnerabilities published in 2025, of which 884 were newly exploited, and notes CISA's finding that most exploited weakness types have had known prevention methods for decades.
- • Andreessen Horowitz cautioned that faulty fixes deployed at machine speed could cause downtime, making staged deployment and automatic rollback essential product features.
Summary
Andreessen Horowitz, in a report titled "Defense in Depth, Rebuilt for Machine Speed" published on November 6, 2026, outlines an AI-driven security model that would protect production systems first and then permanently repair the underlying code. According to the report, the approach could block vulnerabilities in running systems within hours without requiring an application restart. Available protection options include filtering malicious requests, blocking dangerous inputs inside an application, and applying patches directly in memory.
The firm says managing live fixes has been difficult because internal and third-party libraries run across many versions. Coding agents could generate protections tailored to the versions actually deployed, check compatibility, prepare a matching source-code patch, open a pull request, and verify that the permanent repair aligns with the live protection. The live layer could run on infrastructure companies already use, including content-delivery networks and API gateways. The product would read vulnerability advisories, check deployed versions, and create narrowly targeted fixes, testing them against live or recorded traffic before expanding enforcement in stages with automatic rollback. Once a permanent patch ships, the temporary protection would be removed.
The report also proposes a deeper defensive layer aimed at recurring attack techniques rather than individual vulnerabilities. It cites 48,185 vulnerabilities published in 2025, of which 884 were newly exploited, and references CISA's review finding that most weakness types behind its exploited-vulnerability list have had known prevention methods for decades. Monitoring hooks would sit where applications parse untrusted input or call operating-system functions, detecting cases such as a web server unexpectedly launching a shell. A small AI model would decide in real time whether to allow, block, or escalate activity, with a larger model or analyst reviewing escalations within seconds. Responses could range from dropping a request to terminating a process or isolating a machine.
Andreessen Horowitz cautioned that faulty fixes deployed at machine speed could themselves cause downtime, making staged deployment and automatic rollback essential features. The firm's proposed performance measures are time from disclosure to protection, time to a permanent fix, and the rate at which live protection blocks legitimate traffic.
The firm says managing live fixes has been difficult because internal and third-party libraries run across many versions. Coding agents could generate protections tailored to the versions actually deployed, check compatibility, prepare a matching source-code patch, open a pull request, and verify that the permanent repair aligns with the live protection. The live layer could run on infrastructure companies already use, including content-delivery networks and API gateways. The product would read vulnerability advisories, check deployed versions, and create narrowly targeted fixes, testing them against live or recorded traffic before expanding enforcement in stages with automatic rollback. Once a permanent patch ships, the temporary protection would be removed.
The report also proposes a deeper defensive layer aimed at recurring attack techniques rather than individual vulnerabilities. It cites 48,185 vulnerabilities published in 2025, of which 884 were newly exploited, and references CISA's review finding that most weakness types behind its exploited-vulnerability list have had known prevention methods for decades. Monitoring hooks would sit where applications parse untrusted input or call operating-system functions, detecting cases such as a web server unexpectedly launching a shell. A small AI model would decide in real time whether to allow, block, or escalate activity, with a larger model or analyst reviewing escalations within seconds. Responses could range from dropping a request to terminating a process or isolating a machine.
Andreessen Horowitz cautioned that faulty fixes deployed at machine speed could themselves cause downtime, making staged deployment and automatic rollback essential features. The firm's proposed performance measures are time from disclosure to protection, time to a permanent fix, and the rate at which live protection blocks legitimate traffic.
Go deeper than the headline
Research every firm in this story, track the ones that matter and get the daily briefing — free for 7 days.