For most of enterprise security’s history, adversaries were constrained by human skill and time. Reconnaissance would take weeks, exploit development required expertise, and successful phishing campaigns needed a well-crafted narrative created by a skilled writer. Every intrusion consumed significant operator time, which often meant that many organizations were simply not worth the effort for attackers. However, a significant shift has occurred in the cybersecurity landscape—offensive AI has emerged, fundamentally changing the nature of cyberattacks and, in effect, redefining the threat landscape for companies.

What Actually Changed

Today, every step of an attack has been automated and streamlined, drastically reducing costs for attackers. Vulnerabilities, once exploited over the course of days or weeks, can now be weaponized within mere minutes. The reconnaissance phase of attacks is running continuously and unattended, which enables attackers to gather vital information about their targets at any time without raising alarms. Sophisticated phishing campaigns can now be generated for specific targets in their local language, referencing actual suppliers and even real people, thus increasing the chances of success.

Also Read503 Service Unavailable Error Causes Frustration for Users

The most significant change, however, is the collapse of the skill barrier. Offensive capabilities that once required years of study and hands-on experience can now be accessed and rented. This democratization of attack methods means virtually anyone with a small budget can execute significant cyberattacks.

The Offensive AI Toolkit, as Documented Today

  • Uncensored “dark” large language models (LLMs). Models like WormGPT and FraudGPT, among others, are being offered by subscription to facilitate large-scale business email compromises, phishing attacks, and malware deployment. Experts at Palo Alto Networks’ Unit 42 have classified these as purpose-built malicious models that can set the stage for attacks on a grand scale.
  • Agentic Attack Frameworks. Tools like HexStrike AI can drive over 150 offensive capabilities with one singular objective. Reportedly, attackers have claimed successful compromises of Citrix NetScaler in under 10 minutes. Offshoots of these tools can strip out any human checks, making their use even more straightforward. Other frameworks like Villager layer LLM automation onto existing tools such as Cobalt Strike, allowing attackers to simulate real attack scenarios with minimal human input.
  • Borrowed Infrastructure. Reports indicate that attackers are increasingly hijacking exposed self-hosted inference endpoints to run their malicious activities on someone else's computing infrastructure, effectively outsourcing their attacks. This trend is expected to persist through 2026.

The implications of these changes are evident in incident response data. Unit 42’s 2026 Global Incident Response Report has documented that the fastest intrusions saw a mere 72 minutes from initial access to confirmed data exfiltration. This marks an astonishing year-on-year reduction in attack timelines, reinforcing the urgency with which organizations must respond to potential threats. According to CrowdStrike’s 2026 Global Threat Report, the average time for attackers to move laterally within a compromised environment now stands at just 29 minutes, indicating a profound increase in the speed and efficiency of cyber intrusions.

Moreover, roughly 65% of initial access to systems is now identity-based rather than relying on commonly acknowledged software vulnerabilities (known as CVE). This includes the utilization of stolen credentials, misconfigured cloud environments, and existing trust relationships that often go unnoticed in risk assessments.

No Longer an Enterprise-Only Problem

One of the most alarming shifts in the cybersecurity landscape is that automation does not discriminate by company revenue or size. Attackers are broadening their targeting strategies, sweeping through a wide array of potential victims, from mid-sized manufacturers to private hospitals, municipal utilities, and even small suppliers servicing larger corporate clients. This means that once a sufficiently obscure mid-sized organization might have felt secure from attackers, this is no longer the case. Now, the lack of visibility that smaller teams bring becomes a liability against increasingly sophisticated adversaries.

The reality is that obscurity is no longer a protective mechanism. Instead, smaller organizations are often considered attractive targets precisely for the access they provide to larger enterprises. A small supplier with federated access into a significant customer can serve as an easier entry point than breaching the customer’s own defenses. As a consequence, smaller organizations find themselves increasingly in the crosshairs of cybercriminals.

The Defender’s Structural Disadvantage

When contrasting the two sides—attackers and defenders—the disparity is startling not necessarily concerning budget or efforts expended. Attackers can rely on one continuous, integrated operation that moves with relentless focus towards a singular objective. In contrast, defenders operate multiple discrete tools across various domains, each providing a slice of the security picture: a scanner here, endpoint detection and response (EDR) there, security information and event management (SIEM), identity and access management (IAM), compliance processes, and the list goes on.

Individually, each of these tools can perform admirably within their own scope, but they fail to communicate the bigger picture where an intrusion might occur. This disconnect is precisely where the attackers exploit the vulnerabilities present in the defender’s defenses. Validation differs significantly; while quarterly penetration tests are common, they only cover a narrow scope and leave ample room for lapses throughout the year.

Additionally, compliance technologies often overwhelm security teams with hundreds of thousands of findings sorted by severity without providing answers or suggesting actionable paths forward. This lack of visibility means that while attackers can traverse networks relatively unchecked, defenders are left grappling with isolated fragments of information.

Illustration depicting cybersecurity defense strategies against AI-driven attacks.

Restoring the Balance

Achieving parity in this ongoing battle does not stem from simply deploying more scanning tools. Instead, it requires adopting the very same strategy being employed by attackers. Defenders must build a unified view encompassing every digital asset, identity, credential, and exposure, allowing teams to analyze risks in terms of movement through the network rather than isolated findings. This means shifting focus from assumptions to proactive validation, ensuring that a path is proven exploitable before entering any remediation efforts.

This methodology aligns with Gartner’s continuous threat exposure management (CTEM) framework, which faces hurdles primarily rooted in the complexity of continuous operations. While various stages like scoping, discovery, prioritization, validation, and mobilization can be executed manually, continuous implementation becomes the linchpin to effective cybersecurity. This is where automation emerges as a crucial component, and agentic AI stands ready to fill that gap.

RedRok was specifically designed to address this imbalance. Utilizing four agents, each empowered with a distinct view of the network environment, the platform merges data to create a validated graph of vulnerabilities. This approach enables the identification of attack paths that would otherwise remain obscured. Moreover, in a typical organization, just three targeted remediations can remove risks from nine out of eleven possible attack chains. By gaining a clear assessment of risk based on validated paths, organizations can implement remediation strategies that are both effective and scalable, translating into straightforward metrics that boards can easily comprehend.

The adversary has efficiently automated their side of the cybersecurity conflict; it is essential that defenders follow suit. Without a shift towards this automation and broad-spectrum strategy, the disparity in control and capability will only stretch wider.

  • The author, Uri Levy, is CEO and active chairman of RedRok. RedRok's agentic AI platform for continuous threat exposure management is available in South Africa through Solid8 Technologies. For demonstrations or additional information, please contact [email protected]
  • Explore more insightful articles by Solid8 Technologies.
  • This content was sponsored by the party concerned.