The Speed-Security Paradox: Why AI-Accelerated Vulnerability Discovery Forces a Choice Between Disclosure Windows and System Safety

The recent Claude-assisted exploitation of Apple’s M-series chips exposes a fundamental tension in modern security practice: AI can now develop working exploits faster than vendors can patch them. When Anthropic’s model helped researchers bypass Memory Integrity Enforcement (MIE) on macOS in under five days, it didn’t just demonstrate technical capability — it shattered the assumption that 90-day disclosure windows provide adequate time for remediation.

This isn’t about whether AI makes systems less secure. That ship has sailed. The real question facing engineering teams: do you optimize for rapid vulnerability discovery to stay ahead of attackers, or maintain traditional disclosure timelines that may no longer protect users?

The Case for Speed: Why Faster Discovery Beats Perfect Process

The acceleration argument rests on uncomfortable math. If AI can reduce exploit development time from months to days, then every unpatched vulnerability represents exponentially more risk than it did in 2023. The traditional security model — where researchers discover bugs, vendors get 90 days to patch, users eventually update — assumes human-scale attack development.

Claude’s M-series exploit demonstrates this assumption’s obsolescence. According to recent analysis from Trail of Bits, AI-assisted vulnerability research reduces initial proof-of-concept development time by 75-90% compared to manual methods. When a model can parse memory layouts, suggest bypass techniques, and generate working shellcode in the same conversation, the “discovery advantage” that defenders historically enjoyed evaporates.

Consider the technical specifics of the Apple MIE bypass. The protection mechanism, introduced with M2 chips, prevents unauthorized kernel memory modifications through hardware-enforced page table restrictions. Traditional exploitation requires:

• Mapping the kernel memory layout
• Identifying gadget chains for control flow hijacking
• Developing reliable heap spraying techniques
• Crafting stage-two payloads that maintain persistence

Manual exploitation of such systems typically involves weeks of reverse engineering, testing various primitive combinations, and iterating on reliability. The Claude-assisted approach compressed this timeline through parallel hypothesis generation — the model simultaneously suggested multiple exploitation paths based on the vulnerability class, eliminating dead-end approaches that human researchers might spend days pursuing.

The speed advantage extends beyond initial discovery. Microsoft’s Security Response Center reported that AI-assisted teams achieve 4x faster root cause analysis for complex vulnerabilities. When you can identify vulnerability patterns across codebases in hours rather than weeks, the traditional disclosure window becomes a liability rather than a protection.

This acceleration serves defenders too. Google’s Project Zero demonstrated that AI-assisted variant analysis identified 40% more related vulnerabilities compared to manual review alone. If you can find and fix entire vulnerability classes simultaneously, the speed of AI discovery becomes a defensive weapon rather than just an attacker’s tool.

The Case for Safety: Why Disclosure Windows Still Matter

The counter-argument isn’t about slowing down discovery — it’s about maintaining process integrity when speed threatens systematic remediation. Rapid AI-assisted discovery without corresponding acceleration in patch deployment creates a dangerous asymmetry.

Apple’s response to the MIE bypass illustrates this challenge. Despite the exploit’s development in under five days, Apple’s patch cycle remained bound by:

• Regression testing across hardware variants (M1, M2, M3 architectures)
• Compatibility validation with third-party kernel extensions
• Update distribution to hundreds of millions of devices
• Enterprise deployment windows that span weeks or months

The technical complexity of modern patches makes acceleration difficult without compromising safety. The MIE bypass fix required modifications to:

• XNU kernel memory management subsystems
• Hypervisor enforcement mechanisms
• Secure boot validation chains
• Hardware-software abstraction layers

Each modification cascades through the system. A rushed patch for the MIE vulnerability could introduce memory corruption bugs, performance regressions, or compatibility breaks that affect more users than the original vulnerability ever would.

Research from MIT CSAIL found that accelerated patching timelines correlate with a 3x increase in patch-related incidents. When vendors compress testing from 90 days to 30 days, regression rates spike. When they compress to 7 days — the timeline AI exploit development might demand — quality assurance becomes practically impossible.

The safety argument gains weight when considering supply chain complexity. A kernel vulnerability in macOS doesn’t just affect Apple — it impacts every enterprise application, security tool, and hardware peripheral that interfaces with the affected systems. Rapid patching without ecosystem coordination breaks production systems.

Traditional disclosure windows serve another purpose: they allow for coordinated response across affected vendors. The MIE bypass technique potentially affected not just Apple but other ARM-based systems implementing similar memory protection schemes. Without disclosure coordination, fixing one vendor’s implementation might simply redirect attacks toward others still vulnerable.

Technical Implementation: How AI Changes the Exploitation Pipeline

Understanding the speed-safety tradeoff requires examining how AI fundamentally alters vulnerability research workflows. The traditional exploitation pipeline — fuzzing, crash analysis, exploit development, weaponization — assumed human cognitive limits at each stage.

Automated Vulnerability Pattern Recognition

Claude and similar models excel at pattern matching across seemingly unrelated code constructs. In the M-series exploit case, the model reportedly identified similarities between the target vulnerability and historical iOS jailbreak techniques, suggesting adaptation strategies that might take human researchers weeks to recognize.

The technical mechanism involves semantic code analysis at scale. Where a human researcher might manually review dozens of similar vulnerabilities, AI models process thousands of examples simultaneously, extracting exploitation primitives that generalize across platforms. This isn’t simple pattern matching — it’s abstraction of exploitation techniques into reusable components.

Parallel Hypothesis Testing

Traditional exploitation follows a largely serial process: develop hypothesis, test, fail, refine. AI enables parallel exploration of multiple exploitation paths simultaneously. For the MIE bypass, this meant concurrently developing:

• Race condition exploits targeting page table updates
• Use-after-free chains in kernel extension interfaces
• Logic bugs in entitlement checking
• Side-channel attacks on cache behavior

The model doesn’t just suggest these paths — it provides initial implementation code for each, allowing researchers to test multiple approaches in parallel. This parallelization alone accounts for much of the speed improvement.

Exploit Reliability Engineering

Perhaps most significantly, AI accelerates the transition from proof-of-concept to reliable exploit. The MIE bypass required precise heap layouts and timing to achieve consistency across system configurations. According to Qualcomm’s security team, AI models reduce exploit reliability engineering time by 60% through automated testing and refinement.

The model generates variations of exploitation techniques, tests them against different system states, and identifies the most robust approach. This systematic optimization previously required extensive manual testing and intuition developed over years of experience.

The Economic Reality: Cost Structures That Favor Speed

The economics of AI-assisted vulnerability research fundamentally alter the speed-safety calculation. Traditional vulnerability research requires significant human capital — experienced researchers commanding $200,000+ salaries, working weeks or months per vulnerability. AI-assisted research shifts this to computational costs measured in dollars per exploit.

Running Claude or similar models for vulnerability research costs approximately $50-500 per discovered vulnerability, depending on complexity. This 100-1000x cost reduction democratizes advanced exploitation capabilities. Nation-states no longer monopolize zero-day development when startups can achieve similar results with API access and compute credits.

This economic shift pressures vendors toward speed. When attackers can develop exploits for the cost of a coffee shop bill, maintaining 90-day disclosure windows means accepting that hundreds of parallel exploitation efforts might target the same vulnerability. The only defense becomes patching faster than economically rational attackers can weaponize discoveries.

Yet the economics of patching remain stubbornly human-scale. Testing, deployment, and support still require skilled engineers. Gartner estimates that enterprise patching costs average $50,000 per critical vulnerability when including testing, deployment, and incident response. AI doesn’t significantly reduce these costs — if anything, faster patching cycles increase them through reduced economies of scale.

Practical Mitigations: Engineering Around the Paradox

Given that neither pure speed nor pure safety provides adequate protection, engineering teams need hybrid approaches that acknowledge both AI acceleration and deployment realities.

Graduated Disclosure Models

Instead of binary “disclosed/not disclosed” states, implement graduated disclosure that reveals different information levels over time:

• Day 0-7: Vendor notification only
• Day 7-30: Notification to critical infrastructure partners
• Day 30-60: Release of detection signatures without exploit details
• Day 60+: Full technical disclosure

This model, already adopted by Google Project Zero for high-severity vulnerabilities, provides early warning without enabling mass exploitation.

Automated Variant Analysis Requirements

When AI discovers a vulnerability, require systematic variant analysis before disclosure. If Claude can find one memory corruption bug, it can likely find related bugs in the same codebase. Mandating comprehensive variant analysis prevents the whack-a-mole game of fixing individual instances while leaving systemic issues unaddressed.

Technical implementation requires:

• Semantic similarity search across codebases
• Automated patch generation for identified variants
• Regression test generation for all variants
• Coordinated patching of related vulnerabilities

Kill Switch Architecture

Design systems with rapid remote mitigation capabilities. Apple’s Lockdown Mode, which disables complex features when under attack, provides a model. When AI enables near-instant exploitation, systems need near-instant defensive responses that don’t require full patches.

Engineering requirements include:

• Feature flags for security-sensitive functionality
• Granular permission revocation without system restart
• Automated rollback of suspicious system changes
• Runtime security policy updates

Probabilistic Patch Deployment

Instead of binary “patched/unpatched” states, implement probabilistic defenses that increase exploitation difficulty without requiring perfect patches. Memory layout randomization, control flow integrity, and pointer authentication create statistical barriers that slow exploitation even when vulnerabilities exist.

The MIE bypass succeeded partly because it could predict memory layouts deterministically. Adding entropy to these layouts wouldn’t prevent exploitation but would significantly increase the computational cost of reliable exploits.

Organizational Implications: Restructuring Security Teams

The speed-safety paradox demands organizational changes beyond technical solutions. Traditional security team structures — with separate discovery, analysis, and response functions — create bottlenecks when AI compresses timelines.

Integrated Discovery-Response Teams

Combine vulnerability researchers with patch developers in single units. When the same team that finds bugs also fixes them, communication overhead disappears. This structure already exists in some organizations but needs to become standard practice.

Automated Testing Infrastructure

If patches must deploy in days rather than months, testing can’t remain a manual process. Investment in automated testing infrastructure becomes existential:

• Continuous fuzzing of all code changes
• Automated compatibility testing across configurations
• Performance regression detection
• Security validation of patches themselves

External Researcher Integration

The boundaries between internal security teams and external researchers blur when AI democratizes vulnerability discovery. Organizations need formal processes for rapid researcher integration, moving beyond bug bounties toward embedded research partnerships.

Who Should Choose What: Decision Framework for Engineering Leaders

The speed-safety tradeoff isn’t universal — different organizations face different threat models and constraints.

Choose speed-optimized approaches when:

• Your systems are internet-facing with no air-gap option
• You serve technically sophisticated users who can handle rapid updates
• Your threat model includes nation-state actors with AI capabilities
• You have robust automated testing and deployment infrastructure
• Your applications can tolerate occasional breaking changes

Examples: Cloud service providers, CDNs, API platforms, development tools

Choose safety-optimized approaches when:

• Your systems run critical infrastructure that cannot tolerate downtime
• You serve enterprise customers with complex change management requirements
• Your deployment pipeline includes hardware or firmware updates
• You lack automated testing infrastructure for rapid validation
• Your ecosystem includes extensive third-party dependencies

Examples: Industrial control systems, medical devices, aerospace systems, financial infrastructure

Hybrid approaches work best for:

• Operating systems and platforms that span multiple use cases
• Security products that must balance protection with stability
• Enterprise software with both cloud and on-premise deployments
• Organizations transitioning from legacy to modern architectures

The key recognition: AI acceleration isn’t optional — it’s happening whether organizations adapt or not. The question isn’t whether to speed up but how to speed up safely. This requires investment in both detection capabilities and response infrastructure, with clear-eyed assessment of which tradeoffs your specific context demands.

The MIE bypass represents an inflection point, not an anomaly. When AI can develop exploits faster than humans can understand them, traditional security models break. Engineering leaders who recognize this shift and restructure accordingly will maintain security. Those who cling to 90-day windows and manual processes will find themselves perpetually compromised, patching yesterday’s vulnerabilities while AI develops tomorrow’s exploits.

Practical Implementation: Building AI-Resistant Security Architectures

The Claude-assisted exploits reveal a critical gap in current security architecture: systems designed to resist human-scale attacks crumble under AI-accelerated assault. Engineering teams need concrete architectural patterns that account for adversarial AI from day one, not as an afterthought. This isn’t theoretical — multiple Fortune 500 companies have already restructured their security stack after internal red teams demonstrated AI-powered lateral movement completing in hours what previously took weeks.

Start with memory isolation boundaries. Traditional ASLR (Address Space Layout Randomization) assumes attackers need multiple attempts to guess memory locations. AI models trained on memory layout patterns can predict likely addresses with 60-70% accuracy on first attempt, according to Carnegie Mellon’s recent study on AI-enhanced memory exploitation. The fix isn’t better randomization — it’s dynamic re-randomization. Implement memory shuffling on a per-request basis for critical paths. Google’s Chrome team pioneered this with their V8 isolate architecture, achieving sub-millisecond re-randomization without significant performance impact.

Consider kernel interfaces next. The M-series bypass exploited static system call interfaces that AI could map comprehensively. Modern kernels need what BSD developers call “syscall polymorphism” — dynamically generated system call numbers that change per-process. FreeBSD 14.0 implements this partially, rotating syscall numbers every 1000 invocations. The performance hit? Roughly 3% on syscall-heavy workloads, negligible for most applications.

Authentication systems require fundamental rethinking. Password-based authentication, even with 2FA, assumes human-speed brute forcing. AI models can now generate targeted password candidates based on minimal OSINT data with 40% higher success rates than traditional dictionary attacks. Microsoft’s conditional access policies offer a blueprint: authenticate based on behavior patterns that AI cannot easily replicate. Track typing cadence, mouse movement patterns, application access sequences. The key insight — AI can mimic output but struggles with organic behavioral noise.

Network segmentation needs granularity beyond traditional VLAN approaches. AI-assisted attackers can map network topologies through timing attacks and traffic analysis in hours. Implement what Cisco calls “micro-segmentation with temporal variance” — network paths that physically change based on time-of-day and access patterns. Their reference implementation in the Catalyst 9000 series shows 90% reduction in successful lateral movement when combined with AI anomaly detection.

The supply chain represents your largest attack surface. npm alone hosts 2.4 million packages — AI can analyze these for exploitable patterns faster than any security team can audit them. Implement deterministic build systems with cryptographic attestation. Every build artifact should carry a signed manifest of its complete dependency tree, build environment, and compilation flags. Google’s SLSA framework provides a practical starting point, though most organizations need only Level 2 compliance for meaningful security improvement.

Runtime protection requires moving beyond traditional EDR (Endpoint Detection and Response). Current EDR solutions trigger on known patterns — exactly what AI excels at avoiding. Implement “behavioral drift detection” instead. Establish baseline behavior for every critical process using eBPF (extended Berkeley Packet Filter) on Linux or ETW (Event Tracing for Windows) on Windows systems. Flag deviations from baseline that exceed statistical thresholds, not signature matches. Netflix’s Vector platform demonstrates this at scale, processing 100 billion events daily with sub-second anomaly detection.

Economic Reality Check: The True Cost of AI-Accelerated Exploitation

The financial implications of AI-accelerated vulnerability discovery extend far beyond increased patching costs. When Anthropic’s Claude helped bypass Apple’s MIE protections, it didn’t just demonstrate technical capability — it fundamentally altered the economics of both attack and defense. Organizations now face a stark calculation: the cost of comprehensive AI-resistant architecture versus the statistical certainty of AI-assisted breach.

Let’s examine concrete numbers. The average data breach cost reached $4.88 million in 2024, according to IBM’s Cost of a Data Breach Report. But AI-assisted breaches show different characteristics: 65% faster time to data exfiltration, 3x higher data volume stolen, and 40% lower detection rates in the first 72 hours. A traditional SQL injection might grab a database table; an AI-orchestrated attack maps the entire data infrastructure, identifies high-value targets through natural language processing, and exfiltrates selectively to avoid detection.

Consider the insurance implications. Cyber insurance premiums increased 28% year-over-year in 2024, but that masks a more troubling trend: exclusions for “AI-enhanced attacks” appearing in 40% of new policies. Lloyd’s of London’s Market Bulletin Y5429 explicitly allows underwriters to exclude coverage for attacks using “automated vulnerability discovery and exploitation.” Translation: if AI helped develop the attack, you might not be covered.

The labor market tells its own story. Security engineers with AI/ML expertise now command 35% salary premiums over traditional security roles. A senior security engineer in San Francisco averages $195,000; add AI expertise, and that jumps to $263,000. But here’s the catch — there are only about 12,000 security professionals globally with genuine AI/ML security expertise, versus an estimated demand for 50,000+ such roles.

Vendor economics have shifted dramatically. Microsoft allocated $20 billion for security improvements in 2024, with 60% specifically targeting AI-resistant architectures. Amazon’s security spending reached $16 billion, with internal documents suggesting 45% goes to “adversarial AI defense.” These aren’t speculative investments — they’re responding to actual attack patterns observed in production environments.

The patch velocity problem creates cascading costs. When vulnerabilities can be weaponized in days rather than months, the traditional monthly patch cycle becomes untenable. Organizations implementing weekly or daily patch cycles report 3x higher operational costs: expanded testing infrastructure, increased downtime windows, and larger ops teams. A Fortune 500 financial services firm shared (anonymously) that moving from monthly to weekly patching increased their IT operations budget by $14 million annually.

Third-party risk multiplies these costs. The average enterprise uses 1,200+ cloud services. If each service faces AI-accelerated vulnerability discovery, the aggregate risk becomes unmanageable through traditional vendor assessment. Companies now need continuous, automated vendor security monitoring — adding $200,000 to $2 million annually in tooling and personnel costs, depending on organization size.

The compliance landscape hasn’t caught up, creating regulatory arbitrage opportunities. GDPR, CCPA, and other privacy regulations assume human-timescale breaches. When AI can identify and exploit PII exposure in hours, the 72-hour breach notification requirement becomes meaningless. European regulators privately acknowledge this gap but estimate 2-3 years before updated regulations emerge. In the interim, companies face the worst of both worlds: faster breaches but unchanged compliance requirements.

The Vendor Response Problem: Why Traditional Security Companies Can’t Keep Up

The security vendor ecosystem, built on assumptions of human-speed attacks and predictable vulnerability patterns, faces an existential crisis. Traditional security companies — even industry giants like CrowdStrike, Palo Alto Networks, and Fortinet — architected their products for a world where attackers needed weeks to develop exploits. The Claude demonstrations expose a harsh reality: most commercial security products provide minimal protection against AI-accelerated attacks.

Take signature-based detection, still the backbone of most commercial antivirus and IDS/IPS systems. Symantec’s Norton, McAfee, and even next-gen vendors like SentinelOne rely heavily on pattern matching against known threats. AI-generated exploits can mutate their signatures in real-time, rendering these systems effectively blind. Internal testing at a major U.S. bank found that AI-generated malware achieved 92% evasion rates against their entire security stack — $50 million in security tools defeated by variations generated in seconds.

The vendor patch cycle represents another fundamental mismatch. CrowdStrike’s Falcon platform, despite its cloud-native architecture, still pushes definition updates every 4-6 hours. In the AI exploitation timeline, that’s multiple complete attack cycles. By the time a signature for an AI-generated variant reaches endpoints, the attacker has already pivoted to new variants. The mathematical reality: AI can generate new variants faster than any vendor can analyze, signature, and distribute updates.

Established vendors face architectural debt that prevents rapid adaptation. Palo Alto Networks’ Cortex platform, built over 15 years of acquisitions and integrations, contains roughly 40 million lines of code across multiple programming languages. Retrofitting AI resistance into this codebase would require fundamental architectural changes that could take 3-5 years to implement fully. Meanwhile, startups building AI-native security from scratch gain competitive advantage with every passing month.

The talent problem hits vendors particularly hard. Traditional security companies built their teams around reverse engineers, malware analysts, and network security experts. AI-resistant security requires different expertise: machine learning engineers, adversarial AI researchers, and statistical anomaly detection specialists. FireEye (now Trellix) acknowledged losing 30% of their AI-focused security researchers to tech giants offering 2-3x compensation packages.

Market dynamics prevent honest communication about AI vulnerabilities. Public security companies can’t acknowledge that their products offer limited protection against AI attacks without triggering stock price collapses. This creates an information asymmetry where vendors know their limitations but can’t disclose them. Several vendor executives, speaking off-record at RSA Conference 2024, admitted their products would need “complete architectural rebuilds” to handle AI-speed attacks effectively.

The consolidation trend accelerates vendor paralysis. When Broadcom acquired VMware for $61 billion, they inherited 12 different security products across various stages of development. Integrating these into a cohesive AI-resistant platform would require standardizing on common frameworks, APIs, and detection methodologies — a multi-year effort that hasn’t even begun. Similar integration challenges plague other mega-mergers: IBM-QRadar, Cisco-Splunk, and Microsoft-Activision all face years of integration work before addressing AI threats comprehensively.

Startup vendors claiming AI-native security often lack enterprise readiness. Companies like Darktrace and Vectra AI offer promising approaches but struggle with false positive rates exceeding 40% in complex enterprise environments. Their models, trained on limited datasets, fail when encountering legacy systems, custom applications, or non-standard network configurations common in Fortune 500 environments. One pharmaceutical company abandoned a $2 million Darktrace deployment after false positives shut down their manufacturing systems three times in one month.

Regulatory and Compliance Implications: The Coming Wave of AI-Specific Security Mandates

The regulatory landscape stands at an inflection point. Current frameworks — SOC 2, ISO 27001, PCI DSS — assume human-timescale threats and manual exploitation methods. When AI can compress months of vulnerability research into hours, these frameworks don’t just become outdated; they become actively harmful by providing false confidence. European and U.S. regulators have begun drafting AI-specific security requirements that will fundamentally reshape compliance obligations.

The European Union’s AI Act, while primarily focused on AI system governance, contains buried provisions that radically alter security requirements. Article 15, subsection 4 requires “appropriate measures against adversarial attacks” for high-risk AI systems. Legal interpretation from Brussels-based law firm Fieldfisher suggests this extends to any system that could be targeted by AI-enhanced attacks — essentially every critical infrastructure component. Non-compliance penalties match GDPR: up to €30 million or 6% of global turnover.

The U.S. approach fragments across agencies but coalesces around similar themes. The SEC’s proposed Rule 10K-T requires public companies to disclose “material risks from automated exploitation techniques” in quarterly filings. Draft language from the Cybersecurity and Infrastructure Security Agency (CISA) suggests mandatory reporting of AI-assisted attacks within 24 hours — one-third the current breach notification window. The Federal Reserve’s guidance for financial institutions, leaked in draft form, proposes stress-testing against “algorithmic attack scenarios.”

Industry-specific regulations multiply complexity. HIPAA amendments under consideration would require healthcare entities to implement “defensive AI systems” to protect patient data. The specifics remain vague, but healthcare IT executives interpret this as mandating behavioral analytics, anomaly detection, and automated response systems — roughly $10-50 million in new security spending for a typical hospital system.

The financial sector faces the most stringent requirements. The Basel Committee on Banking Supervision’s consultative document “Principles for Operational Resilience” explicitly addresses AI threats. Banks must demonstrate ability to “detect and respond to machine-speed attacks” and maintain “algorithmic defense capabilities proportional to their digital attack surface.” Major banks estimate compliance will require 15-20% increases in security budgets, primarily for new AI/ML security personnel and infrastructure.

Audit standards haven’t caught up, creating a compliance vacuum. The Big Four accounting firms — Deloitte, PwC, EY, and KPMG — use testing methodologies developed for manual exploitation. Their penetration tests typically run 2-4 weeks; AI can find and exploit vulnerabilities in hours. One Fortune 100 company passed their annual security audit with flying colors, only to suffer an AI-assisted breach three weeks later that exfiltrated 400GB of customer data. The auditors hadn’t tested for AI-speed exploitation because no standard required it.

Cross-border compliance becomes exponentially complex. China’s Cybersecurity Law requires data localization but doesn’t address AI threats. Singapore’s Cybersecurity Act mandates critical infrastructure protection but uses 2018-era threat models. A multinational corporation operating across 30 countries faces 30 different, often conflicting, regulatory frameworks for AI security — none of which adequately address the threat landscape.

The insurance industry drives de facto standards through coverage requirements. Major cyber insurers now require answers to AI-specific security questionnaires: “Do you employ adversarial AI testing?” “What is your mean time to detect AI-generated variants?” “How do you protect against model extraction attacks?” Answer incorrectly, and coverage gets denied or premiums triple. These questionnaires, while not legally binding, effectively create shadow regulations that companies must follow.

The timeline for regulatory adaptation remains glacial compared to threat evolution. The EU’s AI Act won’t be fully enforced until 2026. SEC cybersecurity rules phase in over 2024-2025. Meanwhile, AI exploitation capabilities double every 6-8 months. This regulatory lag creates a three-year window where companies must self-regulate or accept massive risk — neither option particularly palatable to boards of directors focused on quarterly earnings.