Bank of America has just shown us the last generation of security.
It looks like 1,000 contractors.
When the latest frontier AI models began exposing flaws in its software, the bank brought in 1,000 contractors on top of the 3,000 people already working in that area. In October 2026, CEO Brian Moynihan said the effort, together with related compliance work, cost “a couple hundred million plus” in a single quarter.
It is a rational response. It is also the old model at its limit: when the problem grows, add people.
Finding got cheap
For decades, security rested on a quiet assumption: flaws were hard to find. Finding them took rare skills, time and money. Plenty of weaknesses sat untouched for years because nobody looked.
That assumption has ended. Models that read software at machine speed make discovery cheap, fast and continuous. Soon every organisation’s weaknesses will be visible, all the time.
Hiring was yesterday’s answer
Fixing has always run on people. Someone decides, changes, tests and confirms. That worked while discovery moved at human speed too.
It doesn’t any more. Discovery now scales at machine speed. Hiring scales at human speed. Moynihan expects his costs to fall once the backlog clears, but when the scanning never stops, the backlog never clears. Adding people only buys time.
A problem that grows at machine speed cannot be solved at human speed.
A system that finds and fixes
This is not a forecast. The alternative is already running.
Autonomous operations closes the loop that people used to carry by hand. The system watches the estate continuously. It finds the exposed setting, the missing patch, the configuration that has drifted. It fixes it, checks that the fix held, and records what it did. Finding and fixing become one motion, not two departments and a queue.
Firemind’s IT Operations Engine works this way today. Your people set the boundaries. A human approves anything that matters. Engineers spend their time where judgement is needed: your own software, your vendors, the decisions that carry real business risk.
And every action leaves evidence. Regulators, auditors and insurers, in Europe through rules such as NIS2 and DORA, increasingly want proof that a weakness was closed, not a policy saying it would be. More people produce more effort. A system that finds and fixes produces proof, as it works.
The question leaders should be asking
The old question was “how many people do we need?” The new questions are different.
- How fast do we close a weakness once it’s found? Not how many we find, but how long each one stays open.
- How much of our fixing is routine? That share no longer needs to be done by hand.
- Can we prove every fix? If the answer depends on someone’s memory or a spreadsheet, it won’t hold up for long.
The organisations that stopped hiring their way through
For years, resilience meant defending what others couldn’t see. That era has closed.
The organisations that lead from here won’t be the ones that hire fastest. They’ll be the ones that no longer need to, because their systems find and fix at the speed weaknesses appear.
Finding the flaw is now the cheap part. With the right system, fixing it is too.
See security find-and-fix in practice
Firemind’s IT Operations Engine finds the missing patches, exposed settings and configuration drift across your cloud, ranks them by real risk, and fixes the routine ones inside the rules you set. Anything higher-risk waits for your team to approve. Every fix is verified and recorded, so you have the evidence auditors, regulators and insurers ask for.
