What do cyber defense and Allied transatlantic convoys in WWII have in common?

“AI-driven attacks need AI-enabled defense” might be the most often repeated, but completely unfounded, assertion of cyber 2026. It sounds logical. It’s also the wrong way to frame the problem.

Not because AI isn’t useful, but the appeal of that assertion miscommunicates what has actually changed with AI-enabled attack.

This isn’t a problem of needing a tool to do the same work as before, just faster. It is in fact a problem created by AI's impact on the physics of attack itself.

AI changes the physical properties of the fight by altering the speed, cost and scale (massively parallel) of attack. Reconnaissance and exploitation can operate at machine speed and near-zero marginal cost. If an attacker can launch millions of probes while you must analyze millions of events, you’ve already lost on math alone. Even with AI. The problem of human-led observe → analyze → decide → act migrates into a defensive AI problem, with the attacker still controlling the tempo, volume and scope of the attack.

Your costs rise with every event they generate. Theirs barely move. And the computational constraints of agentic to ‘get it right in time’ are tested to the breaking point (limits explained here: https://lnkd.in/eyGWW4kb). That’s the logical extension of an arms race that still favors attack.

Winning defenses don’t have to mirror the better weapon. They address the underlying problem (in this case the asymmetry embedded in the physics).

Early in the US transatlantic supply of Great Britain in WWII, German U-boats nearly collapsed Allied shipping. Sounds like applying today’s cyber mantra to that problem would have meant building a bigger fleet of submarines to fight submarine with submarine. 

But that wouldn’t have worked, and they knew it. Instead the physical challenge of attack was massively increased by forming large convoys with escorts and mines, etc.. They changed the dynamic between attacker and defender along the physical properties of the engagement itself by changing the shape of the target.

In cyber, the goal is not simply to chase faster. It is to change the target—and the ledger. Ridgeback’s Phantom resources answer discovery attempts in unused address space, putting synthetic targets in the path of reconnaissance rather than leaving the network as passive terrain.

Under configured, approved policies, those interactions can trigger automatic enforcement, including path denial or isolation of the originating host. The defender defines the response in advance instead of making every probe a new decision.

That is the economic shift Ridgeback is designed to create: disrupt attacker progress while limiting the downstream work an intrusion can generate. Like the convoy, change the conditions of engagement—not just the speed of pursuit. Deny. Deceive. Disrupt. Change the ledger, change the fight.