🎯AI is like a super-smart detective for both hackers and defenders. It helps find weaknesses in software faster, but also helps security teams catch bad guys quicker. This means companies have to be extra careful and ready to fix problems as soon as they pop up.
What Happened
AI is changing the landscape of cyber threats. Traditionally, defenders focused on a small number of vulnerabilities, often referred to as CVEs (Common Vulnerabilities and Exposures). These were the vulnerabilities that attackers frequently exploited. However, with the rise of AI and automation, attackers are now able to probe a much wider range of vulnerabilities. This shift means that security teams can no longer rely solely on a limited set of known exploits. Instead, they must adapt to a more dynamic threat environment where many vulnerabilities could be targeted.
Fortinet, a leader in cybersecurity, has noted that attackers are increasingly utilizing AI to automate the process of finding and exploiting vulnerabilities. This automation reduces the effort required to launch attacks, allowing cybercriminals to target a broader attack surface. Recent research from Wiz highlights that familiar risks, such as vulnerabilities, exposed secrets, and misconfigurations, still account for approximately 80% of documented cloud intrusions.
Adding to this concern, recent insights from Sophos indicate that AI agents are poised to flood the market with a steady stream of validated, exploitable, high-severity vulnerabilities, potentially faster than organizations can patch them. For instance, Anthropic's Claude Mythos Preview has already discovered thousands of zero-day vulnerabilities across major operating systems and web browsers, boasting a 72.4% exploit development success rate. Some of these flaws had been hiding in plain sight for decades. This fundamentally alters the economics of vulnerability exploitation, as adversaries can generate working exploits in hours rather than weeks.
Moreover, AI is significantly enhancing threat detection capabilities. According to Gartner, by 2028, 50% of threat detection, investigation, and response (TDIR) platforms will incorporate AI capabilities, up from less than 10% in 2024. This integration is expected to help organizations strengthen their threat detection and incident response, bridging persistent skills shortages in cybersecurity.
The Development
A recent report by N-able emphasizes that AI is not just a tool for attackers but also a powerful ally for defenders. The report highlights the emergence of AI-versus-AI warfare, where threat actors leverage generative AI for sophisticated phishing campaigns and automated vulnerability scanning. This duality underscores the necessity for organizations to adopt AI-driven security solutions that can keep pace with adversarial tactics.
AI also introduces new challenges for incident response (IR). Traditional IR relies on predictable patterns, but AI systems can produce unpredictable outputs, complicating the identification of root causes. The new model of AI-driven incidents may not just involve a single line of code but a complex interaction of training data, user inputs, and contextual factors. This necessitates an expanded taxonomy for incident classification to include new types of harm that do not fit neatly into traditional categories of confidentiality, integrity, and availability.
Additionally, as AI accelerates vulnerability discovery, security leaders must adapt their software supply chain strategies. Wade Woolwine from Rapid7 emphasizes that the speed at which vulnerabilities are surfaced creates a greater operational gap between discovery and remediation, particularly in open source dependencies. Organizations need to take a more disciplined approach to managing software risk across the entire lifecycle, ensuring that they understand what dependencies are essential and how they can introduce risk into the environment.
Who's Behind It
The shift towards AI-driven attacks is not limited to amateur hackers. Advanced threat actors, including state-sponsored groups and organized cybercriminals, are leveraging AI to enhance their capabilities. These groups are either modifying existing AI models or developing their own systems to conduct attacks more efficiently. The goal is not just to exploit known vulnerabilities but to adapt and create new attack vectors quickly. Sophos's Pacific Rim investigation documented a five-year campaign by multiple interlinked Chinese state-backed threat groups systematically targeting perimeter devices. This highlights the sophistication of attacks and the critical need for organizations to be aware of their vulnerabilities, especially as AI tools enable adversaries to exploit these weaknesses at unprecedented speeds. The investigation revealed that vulnerabilities in firewalls, VPN concentrators, and other edge infrastructure were exploited to compromise critical targets, including nuclear energy suppliers and military hospitals.
Tactics & Techniques
As attackers become more adept at using AI, their tactics evolve. They no longer rely solely on a handful of proven exploits. Instead, they can experiment with various vulnerabilities and techniques, increasing the likelihood of finding a successful attack vector. Wiz's findings indicate that AI has supported and accelerated existing attacker workflows, such as reconnaissance and automation, reducing friction in the intrusion process.
Sophos's experiments with AI tools like OpenClaw have demonstrated that current-generation models can compress reconnaissance phases dramatically, producing actionable findings in a fraction of the time. For example, using pre-Mythos models, a red-team exercise compressed a three-day Active Directory reconnaissance phase to just three hours, yielding 23 actionable findings from a single unprivileged account. This evolution necessitates a shift in how security teams approach threat intelligence, moving beyond a focus on individual vulnerabilities to a broader perspective that considers the overall risk landscape.
Furthermore, AI is helping security teams process vast amounts of telemetry data to identify behavioral anomalies that might otherwise remain buried in the noise. For instance, organizations are seeing efficiency gains of roughly 40-50% for lower-tier SOC tasks, allowing human analysts to focus on more advanced investigations and response activities.
Defensive Measures
To combat these evolving threats, organizations need to enhance their security frameworks. This includes investing in platforms that provide integrated visibility across networks, endpoints, and cloud environments. By doing so, security teams can better understand how new techniques are being used and adapt their defenses accordingly.
Moreover, it is crucial for organizations to prioritize collaboration and knowledge sharing within the cybersecurity community. Initiatives like the World Economic Forum’s Cybercrime Atlas can help build intelligence packages that support law enforcement and other stakeholders in combating cybercrime. Additionally, understanding the relationships and dependencies between cloud assets is essential, as systemic weaknesses can amplify the impact of familiar risks.
Organizations must also turbocharge their patching processes. If still running monthly patch cycles for internet-facing infrastructure, they are operating on borrowed time. Treating perimeter device patching like incident response and ensuring that automatic hotfixing is enabled can significantly reduce risk. The lessons learned from the Pacific Rim experience emphasize the importance of proactive measures and rapid response capabilities. Sophos has introduced features such as automatic firmware update scheduling and a hotfix capability that pushes critical patches over the air without requiring a firmware upgrade, which can greatly enhance security.
N-able's report stresses the shift from traditional perimeter security to a model of continuous cyber resilience. This approach emphasizes always-on monitoring, continuous validation of security postures, and real-time response capabilities. Organizations are encouraged to view resilience not as a product but as an operational state that must be maintained continuously.
AI also introduces new categories of harm and accelerates response timelines, which require fresh preparation and skills that many teams are still developing. Traditional incident response principles remain effective, such as prioritizing containment and transparent communication, but the rapid nature of AI incidents necessitates new tools and judgments to manage them effectively.
By fostering a culture of continuous learning and adaptation, organizations can better prepare for the future of threat intelligence shaped by AI. The growing discrepancy between the velocities of vulnerability discovery and patch deployment means that organizations must act swiftly to mitigate risks, ensuring that patching is treated as a priority rather than an afterthought. As AI continues to evolve, it will be essential for security teams to incorporate human oversight in threat detection processes to avoid potential pitfalls associated with full automation.
Software Supply Chain Resilience
As AI-driven vulnerability discovery accelerates, organizations must also enhance their software supply chain resilience. This involves a deeper inventory of dependencies across source, build, and runtime environments to connect direct and transitive packages with real environments and owners. Security teams should monitor threat intelligence continuously for new vulnerabilities and compromised packages and develop a well-defined process for scoping and remediating emerging threats. Collaboration between Engineering, DevOps, and Security teams is crucial to establish trust and reputation scoring mechanisms for supply chain dependencies, ensuring that organizations can respond effectively to vulnerabilities and maintain a secure software supply chain.
N-able emphasizes that AI threat detection can significantly reduce alert noise, allowing security teams to focus on real threats. By building behavioral baselines and correlating telemetry data, organizations can detect and contain threats faster, thus improving overall cyber resilience. This integrated approach not only enhances detection capabilities but also ensures that recovery processes are in place to address incidents swiftly, further solidifying the organization's defense against evolving AI-driven threats.
As AI continues to evolve, organizations must prioritize continuous monitoring and rapid patching to keep pace with the accelerated discovery of vulnerabilities.
