In cybersecurity, defenders have to get everything right. Cyber defense must patch every vulnerability, secure every endpoint, anticipate every exploit. Attackers, by contrast, only need to find one overlooked flaw. That imbalance, which has shaped decades of cyber conflict, has a biological analogue.
Lately I’ve read a few great reports coming out of the RAND Corporation on AI and biosecurity (see a full list of 2025 papers and reports at the end). In an August 2025 RAND Corporation report, Exploring the Offense-Defense Balance of Biology, Casey Aveggio and colleagues ask a sobering question: when it comes to biotechnology and biothreats, who holds the advantage, the offense or the defense? Their conclusion is clear: biology today is tilted toward the attacker. This paper isn’t focused on AI per se, but see the references at the end for those that do.
The five asymmetries
The RAND authors identify five broad asymmetries that define the biological offense-defense balance. Four favor the attacker, and one (barely) favors the defender.
Four of five asymmetries favor offense
The RAND paper outlines five asymmetries, four of which favor the offense
Speed of spread / kinetic considerations: Pathogens multiply and move exponentially once released. Vaccines and therapeutics, in contrast, are slow: they must be discovered, tested, approved, manufactured, and distributed. Even with record-breaking speed (as with COVID-19 mRNA vaccines) biology’s replication rate outpaces our regulatory timelines.
Cost imbalance: Making something dangerous is cheap; defending against it is expensive. Synthesizing a pathogen might cost hundreds of thousands of dollars. Manufacturing billions of vaccine doses, maintaining stockpiles, and staffing response systems cost billions more and those costs persist indefinitely.
Threat surface: There are over 1,500 known human pathogens—and countless possible engineered variants. Attackers can pick one; defenders must prepare for all. Offense gets to choose the timing and location; defense must be ready everywhere, all the time.
Tolerance for failure: Offense can fail repeatedly (experiments that don’t work, plots that are foiled) and simply try again. Defense can’t afford even a single failure. A single pathogen that slips through could trigger global catastrophe.
Only one favors defense (for now)
Biosecurity defense has one advantage (for now, at least).
Access to tools and knowledge. Defenders, including governments, research institutions, pharmaceutical companies, enjoy more funding, infrastructure, and access to open science. Attackers must operate covertly. But this advantage could erode as biotechnology becomes cheaper, decentralized, and AI-enabled.
Balancing the scales
The RAND team concludes that biology currently grants a distinct advantage to the offense in biosecurity. And as technology becomes more accessible, even the one area that still favors defenders — access to resources — may soon shift. The parallels to cybersecurity are stark: distributed, asymmetric, and accelerating.
However, biosecurity defense isn’t powerless, but may need to consider rethinking strategy. There are several levers that can start to tilt the balance back.
Accelerate defense innovation: Streamline regulatory review for vaccines and therapeutics so that biosecurity defense timelines can match the offense’s biological development speed.
Invest in broad-spectrum defenses: Build pathogen-agnostic tools (e.g., air and surface disinfection, rapid diagnostics, immune system modulation) that protect against many threats at once.
Harden the information ecosystem: Extend screening and governance around DNA synthesis and AI-enabled bioengineering tools. Trying to do this without stifling beneficial research is a challenge, and one I hope to write about soon.
Pursue differential technology development: Borrow an idea from AI safety and extend to biosecurity by prioritizing research that strengthens defense more than offense.
Differential technology development means steering innovation so that technologies that help defend against biothreats advance faster than those that make it easier to cause them. It’s not about stopping progress; it’s about shaping its trajectory. I’ll write a longer post about differential tech development later.
References
Attal-Juncqua, A. et al. Biosecurity Governance Across Uncertain Artificial Intelligence Futures: Perspectives from a Side Event on Biosecurity and Frontier AI at the 2025 AI Action Summit. https://www.rand.org/pubs/conf_proceedings/CFA4186-1.html (2025).
Aveggio, C., Patel, A. J., Nevo, S. & Webster, K. Exploring the Offense-Defense Balance of Biology: Identifying and Describing High-Level Asymmetries. https://www.rand.org/pubs/perspectives/PEA4102-1.html (2025).
Del Castello, B. & Willis, H. H. Assessing the Impacts of Technology Maturity and Diffusion on Malicious Biological Agent Development Capabilities: Demonstrating a Transparent, Repeatable Assessment Method. https://www.rand.org/pubs/research_reports/RRA3662-1.html (2025).
Dettman, J., Lathrop, E., Attal-Juncqua, A., Nicotra, M. & Berke, A. Prioritizing Feasible and Impactful Actions to Enable Secure Artificial Intelligence Development and Use in Biology. https://www.rand.org/pubs/working_papers/WRA4213-1.html (2025).
Manheim, D., Williams, A., Aveggio, C. & Berke, A. Understanding the Theoretical Limits of AI-Enabled Pathogen Design: Insights from a Delphi Study. https://www.rand.org/pubs/research_reports/RRA4087-1.html (2025).
Pannu, J. et al. Defining Hazardous Capabilities of Biological AI Models: Expert Convening to Inform Future Risk Assessment. https://www.rand.org/pubs/conf_proceedings/CFA3649-1.html (2025).
Patel, A. J. et al. Physical Approaches to Civilian Biodefense: Identifying Potential Preparedness Measures for Challenging Biological Threats. https://www.rand.org/pubs/research_reports/RRA4036-1.html (2025).
Webster, T. et al. Global Risk Index for AI-Enabled Biological Tools. https://www.rand.org/pubs/external_publications/EP71093.html (2025) doi:10.71172/wjyw-6dyc.