Penn opens Schlein Center for Cybersecurity to counter AI-fueled threats

A center built around AI-era threats

According to Penn Engineering, the Schlein Center will unite engineers, lawyers and policy experts, along with partners in industry and government. Its goal is to face a new generation of AI-fueled cyber threats. Ted Schlein (C'86, PAR'20) funded the center through what the university calls a transformative gift.

Schlein said AI is changing the scale and speed of the fight. In his words, it is "giving attackers unprecedented capabilities, but it is also giving defenders powerful new tools." He said the key question is whether there are enough people with the skills to use those tools, and that investing in the next generation of talent was his motivation for building the center.

Penn President J. Larry Jameson noted that Penn built ENIAC, the world's first general-purpose electronic computer, and said the center "will lead the way in securing the digital infrastructure that undergirds the modern world."

Secure by design instead of patching

The center is directed by Michael Hicks, the Cecilia Fitler Moore Professor in Computer and Information Science (CIS). He argued that patching is no longer enough: "We can't patch our way to security, especially as attackers armed with AI expose vulnerabilities at an unprecedented rate."

The center therefore emphasizes tools that make software secure by design, rather than the dominant practice of testing code for vulnerabilities after it is written. Penn points to an asymmetry: defenders must catch every bug, while attackers need to exploit only one. Older languages such as C, still common in critical software, often require manual memory management, so small programmer mistakes can become exploitable flaws.

Several projects reflect this approach:

• Vellvm: Steve Zdancewic's project helps automate the translation of legacy C code into Rust, a memory-safe language. In late 2023, CISA issued The Case for Memory-Safe Roadmaps, which recommends moving away from C.
• Formal verification: this method uses mathematical logic to prove that software meets specific requirements. Penn says it could one day help ensure that AI writes more secure code at scale instead of reproducing vulnerabilities found in human-written training data.
• Cedar: Hicks is developing this programming language, which he began as a researcher at Amazon. It uses mathematical proofs and extensive testing to control who can access digital resources.
• Zero-knowledge proofs: Sebastian Angel and Pratyush Mishra are working on techniques that let programs prove their safety to each other without revealing proprietary data.

Crossing disciplines and sharing space

Penn stresses that technology is only half the problem. Businesses may lack incentives to adopt more secure systems, since replacing legacy systems can be expensive and speed to market often takes priority. Retired Air Force General Timothy D. Haugh, former Commander of U.S. Cyber Command and Director of the National Security Agency, recently joined the center as a Senior Fellow. He said Penn can bring together expertise across engineering, business, medicine, communications, law and political science.

On October 15, the center co-sponsored a discussion with Penn Carey Law on whether cyber insurance actually motivates businesses to strengthen their defenses or merely creates the appearance of security.

The center is located on the sixth floor of Amy Gutmann Hall, which Penn says makes chance encounters between researchers more likely. One example: a graduate student attended a seminar where Hicks described an idea for AI agents competing like teams in a cybersecurity contest, some writing code and others trying to break it. The student brought the idea to his advisor, Eric Wong, Assistant Professor in CIS, and the group is now preparing a paper.

Opening event and what it means

On October 21, the center marked its opening with the event Cybersecurity at the Crossroads: Technology, Security and Society in the Age of AI, welcoming experts from academia, industry and government. Jen Easterly, CEO of the RSA Conference and a former CISA Director, took part, according to Penn.

For the field, the center signals a bet that AI-era security will depend on rethinking how software is built, not only on finding flaws faster, and on training people who can combine technical, legal and policy skills. Penn describes the center's research as pairing rigorous theory with real-world testing.