How AI Is Changing the Cyberthreat Landscape

Much of the concern around AI-driven cyberattacks centers on the prospect of fully automated attack chains. While that risk is evolving, successful large-scale attacks still depend on several factors, including finding an exploitable entry point, automating activities at scale and avoiding detection. AI can support parts of this process, but today’s tools still have a learning curve, requiring attackers to gain new skills and often generate activity that can be detected by security teams. For now, fully autonomous attacks remain more difficult to execute than headlines often suggest. Still, this forces organizations to rethink how they will handle incident responses against LLM-orchestrated postbreach activities.

AI-augmented attacks now go beyond impersonating employees to include biometric fraud and disinformation campaigns, giving organizations more ways to be targeted. While deepfake detection tools can help, the best defense is often stronger verification processes and additional checks for high-risk requests and transactions. Attackers are also using generative AI to help them work faster and more effectively, much like businesses use it to improve productivity. 

Despite growing interest in AI-powered malware, most observed use cases remain experimental. Threat actors are using AI coding assistants to accelerate malware creation, convert existing malware into new programming languages and test ways to reduce detection. 

Recent advances in LLM-driven vulnerability discovery and automated penetration testing are creating new opportunities for attackers. The bigger challenge is not necessarily speed, as threat actors already exploit vulnerabilities quickly, but scale — more unsophisticated attackers are gaining access to automation that was previously the exclusive domain of advanced threat actors. As AI helps identify more potential entry points, organizations may face a growing volume of attack attempts against public-facing systems. Early examples of automated attacks have emerged, but so far their impact has remained relatively limited.

The most immediate effect of AI-driven automation may be in postbreach activities rather than initial compromise. New offensive security tools are making it easier to automate tasks that previously required significant manual effort, allowing attackers to operate more efficiently once inside an environment. As these capabilities mature, organizations should expect continued experimentation with increasingly automated attack workflows. This makes incident detection, response and visibility across systems critical to limiting the potential impact of an attack.