Ali Ghodsi is betting that slow security automation will bring critical systems down

Ali Ghodsi, co-founder and chief executive of Databricks, is predicting that the failure to adopt security automation at speed will produce systems going offline, economic damage, and people getting hurt. The prediction carries a deliberate ceiling: he calls the consequences serious but not existential. That calibration matters as much as the warning itself.

The structure of Ghodsi’s call is worth examining on its own terms. He is not describing a slow, incremental degradation in security posture. He is describing a threshold event: whole systems stop working for a period, and the downstream effects reach people, not just balance sheets. By specifying that the consequences would not be existential, he is also implicitly naming the level of ambition he thinks automation needs to meet. The goal is not to prevent civilizational collapse. It is to prevent the more ordinary but still serious failure of critical systems going dark.

What makes the prediction checkable is its specificity about outcomes rather than mechanisms. Ghodsi does not name a particular attack vector, a specific sector, or a named adversary. He names observable results: sites going down, systems stopping, harm to people. Those are conditions that will either materialize or not. A reader returning to this prediction in two or three years will have clear criteria for scoring the call.

The bounded nature of the prediction also sets up a quieter secondary question. If the consequences of inaction are serious but not existential, the political and organizational urgency to act may remain lower than the technical urgency warrants. Institutions tend to mobilize around existential framings. History offers repeated examples of foreseeable, bounded harms that did not generate preventive action because the framing did not trigger emergency-level responses. A forecast of significant but contained damage may not produce the mobilization that would prevent it. That gap between the seriousness of a risk and the institutional response it generates is itself a risk that Ghodsi’s framing implicitly acknowledges by making the prediction public.

There is also a second-order implication in the “not existential” qualifier. Ghodsi is not a catastrophist. He is drawing a line between the level of harm that automation failure would produce and the level of harm that would follow from a more fundamental breakdown. That line is a form of credibility management: it makes the prediction harder to dismiss as alarmism. A speaker who claims the sky is falling is easy to ignore. A speaker who says the ceiling will crack in specific places, with specific consequences, is making a bet that can be tracked over time. Ghodsi is making the latter kind of bet.

The horizon on the prediction remains open. Ghodsi does not attach a year to his call, which means it cannot be falsified on a fixed schedule. But the urgency in the framing is legible: the conditional is “if we don’t do that,” with the implied time scale being soon rather than eventual. The phrase “could happen” is the only hedge in an otherwise direct chain of consequences, and it reads less like doubt about the outcome and more like the standard caution of someone who knows timing is genuinely uncertain. The prediction is not that disaster is inevitable. It is that the gap between where automation adoption currently stands and where it needs to be is wide enough that serious outcomes are plausible without a change in pace.

Whether organizations move fast enough to close that gap before the outcomes Ghodsi describes become visible is, at this point, an open question with a measurable answer. The criteria are concrete. The bet is on the table. The clock, as Ghodsi frames it, is already running.