The Decline of Human Cognition

On October 29, 2026, $6.3 billion left Binance, most of it in about twenty minutes. Binance’s first finding: no private key leaked, no cipher broke, one engineer’s laptop. The group investigators blame, North Korea’s TraderTraitor, does not break systems. It persuades people. It took $1.5 billion from Bybit through one developer’s machine, and $308 million from DMM Bitcoin through its wallet vendor, with a fake recruiter and a coding test.

That is the rule, not the exception. MGM Resorts: one call to the help desk, $100 million. Marks & Spencer: a sophisticated impersonation of one of its own people, about £300 million off the year’s profit. Change Healthcare: a stolen login on a portal with no second factor, more than $3 billion, the health data of more than 190 million Americans. Cybersecurity Ventures prices cybercrime at $10.5 trillion a year, up from $3 trillion in 2015; as a country, it would be the third-largest economy on earth. The floor under that estimate is the FBI’s: $20.9 billion in reported losses in 2025, up 26 percent in one year. Verizon puts a human in the chain of 62 percent of confirmed breaches. Kevin Mitnick told the United States Senate in 2000 that he rarely needed a technical attack. The industry has spent twenty-six years building as if he were lying.

Eight theses follow. This is the one they all stand on.

By the time an attacker reaches a human or an AI agent, it is already too late.

Code gets patched in a day. Fourteen-year-old flaws in PHP were found with AI, turned into working exploits with AI inside a week, and fixed the day they were disclosed. People do not get patched at all. Attention on a screen has fallen from two and a half minutes to 47 seconds. The median click on a phishing link comes 21 seconds after the email is opened. Shown deepfakes, and primed to look for them, two people in two thousand caught every fake. Humans are the last unpatched system.

Meanwhile, deception became free. An AI-written spear phish converts as well as one written by an expert: the expert needs half an hour, the machine about four cents. There are three million open models on Hugging Face. The supply of convincing lies is now unbounded. The supply of human judgment is not. As models improve, infrastructure becomes more secure and human cognition does not. For the attacker that is a sustainable problem: a vulnerability that renews itself every morning and cannot be patched. Humans will be continuously deceived.

Training does not fix this. The largest study of anti-phishing training yet published, 19,789 hospital employees over eight months, found training moved failure rates by 1.7 points, and the most common form made people worse. Even when training works on 99 people in 100, the attacker needs one. It is not a defense. It is the attacker’s shortlist. You cannot train a person out of a convincing lie. You can only make sure the lie never reaches them.

And there is a whole class of attack where the human never had a decision to train. Microsoft’s own advisory for a critical Outlook flaw published this October says that simply viewing the message in the Reading Pane can trigger it, “without the recipient opening the message or clicking anything in it,” and that user interaction is not required. Nothing is clicked. Nothing is opened. The arriving is the attack. Awareness training has no moment to reach, and a tool that reads the mailbox afterwards is already late.

The flaw is not the models. There is always a best model, and open weights are about four months behind it; nobody wins a rat race against a commodity. Architecture is the only layer of this stack that compounds, and it is the only one a competitor cannot download. Every era of security moved its decision before the event: the firewall before the network, TLS before the data, zero trust before access. The con is still judged after it arrives. The email gateway checks the envelope, not the lie. The inbox tools race a click that comes 21 seconds after the email is opened. A $200 billion industry is built on the wrong side of the inbox. Packets got their layer in 1988, connections in 1995, access in 2010. Messages never got one. That missing layer is a new security primitive, and it has a name: pre-delivery interception.

Trotta is the layer before. Before your email, your messaging, your calls, your video and your AI agents. A written message is judged in the delivery path, in under 100 milliseconds at the median, and a flagged one never arrives. A live call is judged from before it connects, so the con is caught before the ask, not after the wire. For people, and for agents, which no awareness training reaches. The recipient is increasingly an agent holding more access than its task needs: in two separate 2026 surveys of security practitioners, about seven in ten said AI systems are granted more privileged access than a person doing the same job. Privilege decides what one delivered message costs. It does not decide whether the message should have arrived. It is the missing security primitive, and it is the trust layer for the agentic economy.

The age of AI has two frontiers: security and immortality. I am building the first, because the second depends on it. You cannot live forever in a world where anyone can be you for twenty minutes.