Artificial intelligence is changing the cybersecurity landscape at an unprecedented pace. Security teams are using AI to discover software vulnerabilities, analyze threats, and improve their ability to detect weaknesses before attackers exploit them. At the same time, cybercriminals are exploring AI to automate attacks, develop malicious tools, and identify opportunities to compromise vulnerable systems.
This creates a new challenge for organizations. The same technology that helps defenders strengthen their security can also increase the speed and sophistication of cyberattacks. Understanding both sides of this transformation is essential for building a resilient cybersecurity strategy.
How AI Is Improving Vulnerability Discovery
Traditional vulnerability research often requires significant time and specialized expertise. Researchers must examine source code, understand application behavior, reproduce errors, and determine whether a weakness can be exploited.
AI-assisted security tools can accelerate several of these activities. They can analyze code, identify suspicious patterns, suggest potential attack paths, and help researchers investigate weaknesses that might otherwise remain undiscovered.
In its March 2026 article, Thompson InfoSec highlighted Anthropic's disclosure that Claude Opus 4.6 had identified more than 500 high-severity vulnerabilities over a two-week period, including previously unknown Firefox vulnerabilities. The article also discussed Google's efforts to incorporate AI-assisted vulnerability discovery into its vulnerability reward programs.
These developments illustrate the potential value of AI in defensive security. Faster discovery can give software vendors more opportunities to investigate weaknesses, develop fixes, and distribute patches before attackers exploit them.
Benefits of AI-Assisted Security Research
- Faster vulnerability discovery: AI can help researchers examine large codebases and identify suspicious patterns more efficiently.
- Improved code analysis: AI tools can assist with reviewing code for insecure practices and potential vulnerabilities.
- Automated security testing: AI can help generate test cases and investigate possible failure conditions.
- Better prioritization: Security teams can combine vulnerability information with asset context to identify weaknesses that require urgent attention.
- More efficient research: Researchers can use AI to investigate technical leads and focus their expertise on validating important findings.
However, AI-generated findings must still be validated. A suggested vulnerability is not necessarily exploitable, and automated analysis does not replace secure development practices or experienced security researchers.
The Rise of AI-Powered Cyberattacks
AI is not limited to defensive security. Threat actors can also use large language models and automated agents to support malicious operations.
AI can help attackers analyze technical information, adapt existing code, automate reconnaissance, and coordinate multiple steps in an attack. Depending on the capabilities and access available, these tools can reduce the amount of manual effort required to investigate and exploit weaknesses.
The March 2026 Thompson InfoSec article discussed reporting on AI capabilities being incorporated into malware, as well as AI-assisted ransomware development. It also highlighted a red-team exercise in which an autonomous AI agent reportedly compromised McKinsey's internal AI platform within two hours.
These examples underline an important distinction: AI can be used to assist an attacker throughout an operation, rather than simply helping write a small piece of code.
How AI Can Increase Cybersecurity Risks
- Automated reconnaissance: AI tools can help analyze exposed services, application configurations, and publicly available technical information.
- Malware development: Threat actors may use AI to modify malicious code, experiment with techniques, or accelerate development.
- Adaptive attack behavior: AI-enabled systems may adjust their next actions based on observed results, depending on their permissions and design.
- Faster attack execution: Automation can reduce delays between discovering a weakness and attempting to exploit it.
- Social engineering: Generative AI can help produce convincing phishing messages and impersonation attempts at scale.
These capabilities do not make every AI-assisted attack successful or fully autonomous. Attackers still encounter technical limitations, security controls, and operational constraints. Nevertheless, automation can increase the pressure on organizations that already struggle to manage their security risks.
The Growing Gap Between Vulnerability Discovery and Patching
One of the most important cybersecurity challenges is the time between a vulnerability becoming known and an organization successfully fixing it.
When vulnerabilities are discovered faster, security teams may face a growing number of findings that require investigation and remediation. If attackers can also use automation to identify exposed systems and exploit weaknesses, the available response window may become shorter.
This creates a potential speed gap between discovering vulnerabilities and deploying effective defenses.
Organizations with incomplete asset inventories, inconsistent patching processes, and limited monitoring are particularly vulnerable to this pressure. Even a well-designed security program can struggle if it cannot identify affected systems or determine which vulnerabilities present the greatest immediate risk.
The solution is not to patch every vulnerability in the same order. Instead, teams need a risk-based approach that considers exploit activity, internet exposure, asset importance, available mitigations, and the potential business impact of a compromise.
Why Attack Surface Management Matters More Than Ever
An organization's attack surface includes the systems, applications, identities, APIs, cloud resources, and services that could potentially be targeted by an attacker.
As infrastructure grows, new assets and integrations can appear across cloud accounts, development environments, third-party platforms, and production systems. Without a reliable inventory, security teams may not know which assets are exposed or whether they contain known vulnerabilities.
AI-assisted reconnaissance makes this visibility increasingly important. Automated tools can help attackers analyze large amounts of information quickly, while defenders must ensure that exposed services and weaknesses are identified before they become entry points.
Steps to Improve Attack Surface Visibility
- Maintain an up-to-date inventory of cloud resources, applications, APIs, domains, and internet-facing services.
- Identify systems that are exposed directly to the internet and verify that exposure is necessary.
- Review cloud configurations, identity permissions, security groups, and network access rules.
- Monitor newly deployed assets and investigate unexpected changes.
- Assign clear ownership to systems so vulnerabilities can be remediated quickly.
- Use continuous monitoring and periodic security assessments to identify previously overlooked assets.
Good attack surface management helps organizations understand what they need to protect and where limited security resources should be focused.
How Organizations Can Strengthen Their Defenses
AI changes the speed and scale of cybersecurity operations, but effective defense still depends on strong security fundamentals. Organizations should focus on controls that reduce the likelihood and impact of a compromise.
Prioritize Vulnerabilities Based on Risk
Not every vulnerability presents the same level of danger. Prioritize actively exploited vulnerabilities, weaknesses affecting internet-facing systems, and issues that could expose sensitive data or critical infrastructure.
Use vulnerability severity as one input alongside exploitability, asset criticality, exposure, and available mitigations. Establish clear remediation deadlines and verify that fixes have been applied successfully.
Strengthen Identity and Access Management
Compromised accounts remain a common route into corporate environments. Enforce multi-factor authentication, apply least-privilege access, review privileged accounts, and remove unnecessary permissions.
For cloud environments, regularly audit service accounts, access keys, workload identities, and third-party integrations. Restrict permissions to the minimum required for each workload.
Improve Patch Management
Maintain a repeatable process for identifying affected assets, testing security updates, deploying patches, and verifying remediation.
Automate routine patching where appropriate, but establish emergency procedures for critical vulnerabilities that are actively exploited. Systems that cannot be patched immediately should receive appropriate compensating controls.
Strengthen Network Segmentation
Network segmentation limits how far an attacker can move after compromising a system. Separate sensitive workloads, restrict unnecessary communication between environments, and limit administrative access to critical infrastructure.
In cloud environments, review security groups, network access controls, private connectivity, and management interfaces to reduce unnecessary exposure.
Secure AI Platforms and Agents
AI systems are themselves potential attack surfaces, particularly when they can access corporate data, execute tools, connect to external services, or interact with production infrastructure.
Organizations should evaluate the permissions and capabilities of AI applications before deployment. Restrict tool access, protect credentials, isolate untrusted inputs, monitor agent activity, and require human approval for high-impact actions.
AI agents should not receive broad administrative privileges simply because they are intended to automate work. Their access should be limited to the specific tasks they are authorized to perform.
Prepare for Incident Response
Even strong defenses cannot eliminate every risk. Organizations need an incident response plan that defines responsibilities, escalation paths, containment procedures, and recovery steps.
Conduct exercises that simulate compromised credentials, exploited vulnerabilities, suspicious AI agent behavior, and third-party security incidents. Ensure that teams can isolate affected systems, revoke access, preserve evidence, and restore trusted operations.
How to Adopt AI in Cybersecurity Responsibly
AI can help security teams work more efficiently, but its adoption should be supported by clear governance and validation.
- Define approved use cases: Identify where AI can assist with code review, alert triage, vulnerability analysis, and incident investigation.
- Protect sensitive data: Establish rules for sending source code, logs, customer information, and credentials to AI services.
- Validate AI outputs: Require human review for security-critical findings and remediation recommendations.
- Control tool permissions: Limit the actions AI agents can perform and require approval for consequential changes.
- Monitor AI activity: Log relevant requests, tool calls, permission changes, and security events.
- Measure effectiveness: Evaluate whether AI reduces investigation time, improves detection, or helps remediate vulnerabilities more reliably.
The objective is to use AI to strengthen the security team's capabilities without introducing uncontrolled access or new sources of risk.
Conclusion
Artificial intelligence is transforming cybersecurity by accelerating vulnerability discovery and creating new opportunities for automated attacks. Defenders can use AI to find weaknesses earlier, analyze threats, and improve security workflows. Attackers can use similar capabilities to automate reconnaissance, assist malware development, and move through attack sequences more efficiently.
This means organizations must improve their ability to identify assets, prioritize vulnerabilities, protect identities, secure AI integrations, and respond to incidents quickly.
AI does not eliminate the need for fundamental security practices. It makes those practices more important. Organizations that combine AI-assisted defense with strong access controls, disciplined patch management, continuous monitoring, and tested incident response processes will be better positioned to manage the evolving threat landscape.
The key question is not whether AI will influence your organization's cybersecurity. It is whether your security program is prepared to use AI effectively while managing the risks it introduces.
Frequently Asked Questions
How is AI changing cybersecurity?
AI is helping defenders automate vulnerability analysis, identify suspicious activity, and improve security workflows. Threat actors can also use AI to support reconnaissance, phishing, malware development, and attack automation.
Can AI discover software vulnerabilities?
Yes. AI-assisted tools can analyze code and help identify potential weaknesses. Security researchers must validate the findings, determine their impact, and ensure that appropriate fixes are developed and deployed.
What is AI-powered malware?
AI-powered malware refers to malicious software that incorporates AI capabilities or is developed with AI assistance. Depending on its design, it may support adaptive behavior or automate certain tasks. Not every malware sample developed with AI is itself AI-enabled.
How can organizations defend against AI-powered cyberattacks?
Organizations should maintain accurate asset inventories, prioritize actively exploited vulnerabilities, patch exposed systems, enforce least-privilege access, segment networks, monitor suspicious activity, and test incident response procedures.
Why is attack surface management important?
Attack surface management helps organizations identify exposed assets, understand their risk, and prioritize remediation. Better visibility reduces the likelihood that forgotten or misconfigured systems will become entry points for attackers.
Should organizations use AI security tools?
AI security tools can improve efficiency when deployed with appropriate controls. Organizations should evaluate their accuracy, data handling practices, permissions, integration risks, and suitability for the intended use case.