May the 4th be with you.

In celebration of Star Wars Day, here's what a galaxy far, far away can teach us about security. The films work surprisingly well as a case study, and not in the obvious way. It's not the lasers, androids or the lightsabers. It's that the Empire and the First Order both fall into the same trap most security programs walk into every day. 

In this post, we'll walk through what the films get right about modern security challenges, how AI is making them worse, and what to do about it. 

How a Two-Meter Port Took Down a Moon 

In Star Wars: A New Hope, the Rebel Alliance obtains the Death Star blueprints and finds something the Empire never considered a threat: a two-meter thermal exhaust port that, if hit precisely, would destroy the entire station. 

It was a design feature, not a vulnerability. Nobody flagged it. Nobody investigated it. Besides, the station had shields, turbolasers, and thousands of troops. What could one small opening possibly do?

Here's the platform architect explaining it himself in this classic hot take:

Sound logic, but we all know how that turned out... And the First Order didn't learn from it either. They built Starkiller Base, a bigger and more powerful version, with the same fatal flaw. They didn't fix the underlying problem. They just scaled it up, and got the same result.

That pattern should resonate with anyone working in security today.

The Death Star Problem Is Still a Problem

The original Death Star analogy maps cleanly to how organizations have historically managed security. They build and maintain a list of known assets, protect those assets, and assume anything not on the list isn’t worth worrying about.

And that's the job now, to look at your own surface from the outside in, the way an attacker would. 

The problem is the view is never complete. Over time, organizations accumulate forgotten subdomains, old APIs that never got decommissioned, cloud instances that someone spun up and lost track of, and infrastructure inherited from acquisitions that nobody fully audited.

What this goes back to is the defender's dilemma, a structural asymmetry RAND researchers formalized all the way back in 2015. 

It outlines a simple truth. The game is not balanced. Defenders have to be right every time, but attackers only have to get it right once. 

The Rebels didn't need to out-engineer the Empire. They needed just one flaw the Empire hadn't catalogued. A single exposure they missed, to take the whole enterprise down.

AI Is Building New Exhaust Ports

If the original Death Star showcases the offender-defender asymmetry, Starkiller Base shows what it looks like in the age of AI. 

Same underlying issue, but on a completely new scale. 

Developers are shipping code with AI coding assistants. Employees are connecting third-party AI tools to company data without going through IT. Teams are spinning up AI-powered chatbots, automation workflows, and data pipelines that quietly touch sensitive systems in the process.

Each one creates potential exposure. Most of them aren't on your asset list.

The new "exhaust ports" this creates:

• AI coding assistants with weak auth
• Shadow AI connected to core systems without security guardrails
• Over-permissioned API keys for LLMs
• AI automation with execution paths nobody fully understands
• Third-party AI vendors with access to your data

And so on, and so forth.

What makes this worse is that threat actors are using AI too. They're using it to speed up reconnaissance and to identify zero-day issues at scale. 

Anthropic's Mythos preview found thousands of unknown zero-days across every major operating system and web browser in a matter of weeks. Recon that used to take seasoned experts days now takes hours, performed at the skill level of the best attackers in the world.

Knowing About the Flaw Isn't Enough 

Someone adds an AI tool on a Tuesday, by Thursday it's touching production data through an integration nobody reviewed. It may never make it into the official asset inventory at all. Firewalls, endpoint protection, vulnerability scanners, and laser turrets are no help here. They all need a target, and this one was never on the list. 

This is where continuous threat exposure management (CTEM) comes in. The premise is simple: your attack surface never stops changing, so your visibility into it shouldn't either. Discovery, prioritization, validation, and mobilization, on repeat, not on a quarterly schedule.

And as important as discovery is, validation is where most organizations have the biggest gap. The Empire knew the exhaust port existed. They just assumed nothing could exploit it. That assumption is what made Death Start go BOOOM.

That's the story. The Empire built infrastructure with a flaw they didn't test. The First Order built bigger infrastructure with the same untested flaw. 

Most attack surfaces have a few of those. AI is adding more of them every week, and giving attackers the speed to find them faster than ever. The question you should ask yourself is: when was the last time anyone actually tested yours?