Lee Rossey is the CTO and co-founder of SimSpace, and he’s spent the last 25 years building in the deep end of cybersecurity, including 15 years at MIT Lincoln Laboratory. His worldview is refreshingly practical: if you can’t measure it, you don’t really understand it… and if you can’t test it under pressure, you don’t actually trust it.

In this episode, we dig into what “proving grounds” means in the AI era. Red teams and penetration tests are valuable, but production systems have guardrails for a reason. You can’t take down a hospital, bank, or power company just to prove a point. SimSpace helps organizations create realistic, representative replicas of their environments so they can push tools and teams to failure safely, run repeatable attack scenarios, and build true muscle memory.

AI is the accelerant on both sides. Defenders use it to cut through noise and respond faster. Attackers use it to craft more convincing lures, move through kill chains quicker, and exploit complexity. Lee’s core message lands clean: the future belongs to the organizations that don’t just buy AI security, but prove it… in reality… before betting the business on it.

Key takeaways

• AI security needs proving grounds, because “trust” has to be earned through testing, not marketing.
• Production environments can’t be fully stress-tested, so realistic replicas are how you train and validate safely.
• Automation makes testing practical. If building the environment takes months, it won’t happen often enough to matter.
• The kill chain is compressing. AI reduces the time from recon to exploit, so defenders must shorten detection-to-response.
• Agentic tools introduce new attack surfaces like prompt injection and manipulation of decision-making.
• Humans aren’t disappearing, but their role shifts. The new norm is operators working side by side with AI.