Anyone who’s ever pushed a website to the internet knows who the first visitor is going to be. Not you making sure your fonts loaded correctly, not the friend you just texted to make sure it looks good on their machine – bots. Thousands of them.
There is a public feed called CertStream where every single TLS certificate gets dumped in real time. It is a firehose. Automated systems watch it all day. When a new certificate pops up, the domain gets thrown into a scan queue. HUMAN security recently did a study on this. They spun up a totally blank web server. No links, no PR announcements- literally nothing on the page. They just sat back and watched the traffic. On an average day, nearly 70 percent of the traffic hitting that empty server was just scanners. Some days it was 100 percent.
What were the scanners looking for? If you’ve ever checked your logs right after you deploy, you know you will see tons of requests to .env files, .git folders and the like. This is because the scanners just relied on super basic automation – they used to be stupid. A script ran through a dictionary of common file names, logged whatever sent back a 200 OK, and moved on to the next victim. You could handle that. You patched the obvious CVEs and covered the basics. The whole security model essentially relied on the assumption that automated attacks were dumb and couldn't actually think. Figuring out how to chain a seemingly empty subdomain into RCE took a real human being who actually cared enough to sit there and mess with your specific app. Most of us just aren't that interesting.
How Things Changed
Now, the exact same AI models that developers use to write code are now being used to break it. Anthropic’s new Mythos announcement is just the tip of the iceberg. There are tools right now that probe web apps exactly like a bored human pentester would. They look at how the server responds, make a guess about the backend logic, and try a new angle. They don't use static checklists. And because it's fully automated, they can run this kind of deep analysis against every single target on the internet continuously and will never be bored.
The Mess We Are Making
There is another piece to this that people in the industry are oddly quiet about. Codebases are massive now. Teams are pushing updates at ridiculous speeds because AI is writing the code for them. And nobody is reviewing that code (maybe another AI is, though!) We skim it, check if the tests pass, and ship it.
The attack surface is growing way faster than any human team can audit. Maybe you scaffolded an API endpoint at 2 in the morning to hit a deadline. Maybe your package manager dragged in some undocumented dependency while you were sleeping. These are all open doors. To be sure, some are locked,but nobody actually knows how many doors exist in their own house any longer. Human-driven auditing is at this scale is like using an abacus to calculate real-time data for the Artemis rocket.
Why Quarterly Pentests Are Useless
So what do companies do? They hire a consulting firm once a year or maybe every quarter to run a pentest. The pentesters spend two weeks poking around identifying vulnerabilities which are recorded and, if lucky, patched in the next development shipping cycle. Management feels that they have done the right thing. But that model is completely broken. It assumes the company stops shipping code. It assumes the application just sits there frozen in time.
Companies don't stop shipping. Dependencies get introduced every day. The attack surface from the Q2 pentest is completely gone by the time Q3 rolls around. The botnets don't care that the company paid eighty grand for a security report in April.
What is more, many companies still hang onto an idea that they are too small to get hacked. They think attackers ration their attention. That used to be true when attacks cost time and money. It is not true anymore. The Romanian Distillery botnet was a massive scanning operation based out of a compromised industrial network, and it was hitting brand new domains within hours of their certificates being issued. It hit everyone. All at once. The scanner doesn't know what your startup does. It just knows your IP address exists.
How To Actually Fix It
Companies and consultancies cannot hire enough security engineers to fix this. There aren't enough of them on the planet to review every single commit being pushed right now in real time
The security checks have to live right inside the pipeline. They have to be automated. They have to run on every single commit. They have to hard-block the deployment if they find something bad. Teams need dynamic testing that throws real attack chains at their staging environment before it ever sees production.
None of this is new technology. The tools are right here. The only reason people don't do it is because they don't feel panicked yet. But when that HUMAN honeypot went live, the scanners didn't wait a week. The gap between a domain going live and a bot finding your exposed config file is shrinking to minutes. There is no grace period left. Now it’s urgent.