Every hack has a half-life.

The thing that broke security research was not a model trained to break security research. It was a model that got better at reasoning, at writing code, and at staying on a task without being told what to do next. The capability arrived sideways. Nobody aimed it at the category it went on to reorganise.

Which raises the obvious question, and a lot of people are asking it: what else is sitting there, protected mostly by the fact that nobody has pointed an autonomous agent at it yet?

Alon Huri put a name on one answer, in a public post written in Hebrew, and the name is good enough that we are going to use it: the growth zero-day. A crack in customer acquisition that works for no better reason than that nobody has found it yet. His argument is that this is the bigger category, that it runs on the same motifs security does, and that whoever builds agents which hunt these things down autonomously is going to matter. We did not come up with that frame. We built against it, and the credit belongs where it started.

The part of his post worth arguing with is not the prediction. It is a single structural claim, and he is right about it: the order in which this gets cracked is set by the quality of the feedback. Paid campaigns first, because there is a real cost per customer and the loop closes in hours. Outbound next, because replies are countable. Organic last, because you find out slowly or never.

If the feedback decides the order, then the feedback is the machine. The agents hunting are the easy half.

Sit with that for a second, because it inverts where everyone is spending. The researcher agent is not hard. Finding things that worked for businesses shaped like yours is a solved shape. Running them is not hard either. The hard part, the part that sets the order of the entire field, is the thing standing at the end holding a verdict.

He names one more difference between the two worlds, and this is the one that decides what you should actually be building. In security, a zero-day survives for years, until somebody writes a patch. In growth, the market is the patch. The moment a move works, competitors arrive, the cost of attention goes up, and the window closes on its own. The hack decays by being used.

The hack decays by being used. Whatever you paid for it, you are renting.

So the hack was never the asset. It cannot be. Anything with a half-life that short is inventory, not capital. What compounds is the thing still standing after the window shuts: the part that can tell you it shut, tell you when, and be believed.

And that turns out to be the expensive thing to build, for a reason that has nothing to do with engineering. Almost all measurement is built to avoid saying the unflattering sentence. Not through fraud. Through defaults. A missing cost quietly becomes zero, and now the cost per lead looks superb. A failed read renders as no activity, and nothing happened is indistinguishable from we could not see. Ten leads and three of them closed becomes a conversion rate, printed to one decimal place, and carried into a meeting.

A number you cannot trust is not a result. It is a decision you already made, wearing a decimal point.

An honest verifier says four unglamorous things, and it says them far more often than anyone building one expects. Not enough sample to call that a rate. No spend on record, so there is no cost per lead, and no, that is not zero. Unknown, which is a different fact from nothing happened and will not be blurred into it. And the one that stings: refused, because the test is too small to prove anything, so it did not run.

The first time we pointed that machinery at our own work, it went looking for bets that had quietly stopped moving and settled every one of them at nothing. No outcome. Not a single salvageable result in the batch. That is an awkward thing to build and a worse thing to keep, and it is the only reason any later verdict from it is worth reading. A system that has never told you bad news has not been tested. It has been decorated.

None of which argues against the hunting. Hunt. The hunting is the fun part and it is genuinely coming. But a workforce that finds a hundred moves and cannot tell you which four survived contact with reality has not automated growth. It has automated the meeting where everyone agrees things are going well.

Every hack has a half-life. The verifier does not. Build the half that outlives the window, because the other half is already expiring while you read this.