Back in June, the Five Eyes intelligence alliance warned that AI is drastically reducing the time between an exploit being discovered and it being deployed in the wild. Without human analysis slowing down operations, threat actors can get to work much faster with AI tools in their arsenal.
“We used to talk about vulnerability discovery and exploitation in terms of weeks or months,” Ramtin Rampour, Principal Solution Architect at Opengear, explained to CISO Voice. “AI has compressed that into days, sometimes hours … the exploit window isn’t just shrinking; it’s shrinking faster than defenders can adjust their processes to keep pace.”
This could have a monumental impact on the enterprise world. With the need to adapt ever more quickly to a changing threat landscape, the old rulebook is being rewritten as we speak. Attackers can spin up effective malware in hours instead of days or weeks, significantly increasing the volume of active malware strains.
How exactly can you survive in this brave new world? To find out, we spoke to a range of cybersecurity experts to hear about how strategies must evolve, now that weaknesses can be abused at breakneck speed. With the ground shifting under our feet, cybersecurity is starting to look very different indeed.
Just as things change…
“Your attack surface changes every week, and your understanding of it should too.” That’s the concise point made by Martin Zugec, Technical Solutions Director at Bitdefender, who explained to CISO Voice that the increasing pace of adversarial threat development means that “Patch cycles measured in weeks, and change freezes that treat emergency fixes as the exception, are a standing invitation when weaponization takes hours.”
Sandeep Johri, CEO at Checkmarx, agreed. Johri told us that “organizations can no longer rely on periodic scans and lengthy review cycles as their primary line of defense … Success depends on quickly identifying which issues represent genuine business risk and addressing those first. The organizations that adapt will be the ones that can validate, prioritize, and remediate risk continuously instead of waiting for the next scheduled review.” In this new era, a lax approach is not only sub-optimal, but it can be dangerous.
When facing this new normal of high-volume malware propagation, changing your thinking is key, argued Johri: “Many security programs were built around scheduled assessments, manual reviews, and remediation processes that assumed people would always have enough time to investigate every issue. AI has changed those assumptions.”
While that means that security has to step up the pace, “That doesn’t mean removing people from the process,” Johri insisted. “It means giving security teams better visibility, stronger governance, and more automation so they can focus on the risks that truly matter. Human judgment remains essential, but technology has to do more of the heavy lifting.”
If that sounds familiar, it’s because it’s exactly what cybersecurity experts told us when we investigated how AI is changing ransomware. But with AI tools handing hackers a sizeable speed boost, responding faster (and knowing what to hand off to AI defenses of your own) can be the difference between breach and containment.
…So they stay the same
Interestingly, many of the people we spoke to highlighted that while AI has increased the volume of attacks that companies are now facing, not everything is changing. Many of the defenses that work against standard attacks can be equally effective now that AI is shrinking the exploit gap.
This is particularly relevant if a firm is deploying AI at scale, without properly understanding the consequences. According to Mike Wehrs, COO at TieTechnology, “Organizations don’t necessarily need to reinvent security from scratch. They need to apply the same discipline they’ve spent years building around sensitive information to AI systems.” Many businesses already silo key areas like HR, and financial information. “Those same boundaries need to exist for AI” if it is deployed at your firm, Wehrs cautioned. “Just because a model can access multiple systems doesn’t mean it should.”
Zugec agreed and argued that “Most of the organizations getting hit do not need to evolve to counter AI. They need to catch up on the basics they have been skipping for years. AI has not out-innovated their defenses. It has raised the cost of neglect.”
Why is that? According to Zugec, it’s a question of quantity over quality. Many new AI threats, he argued, are “industrialized, mediocre malware: derivative, assembled from existing code, nothing we have not seen the shape of before. Tellingly, we have not had to update our detections to catch it.” As the Bitdefender director put it, “The danger is not cleverness. It is volume,” before adding that “AI does not need to be sophisticated to be dangerous.”
AI’s ability to speed up development is not the same as increasing its products’ potency. But with threats proliferating at an escalating pace, even the most basic threats can still wreak havoc if they find a way in. It’s, therefore, more important than ever to get the basics of defense right at your organization.
Turning the tables
One of the most important questions in all of this is one of the simplest: should your company be using AI on the cyber front lines, just as the hackers are?
Absolutely you should, all our experts agreed.
“AI can be an incredibly effective defensive tool when it’s deployed with the right controls,” Wehrs argued. “One of its greatest strengths is its ability to continuously evaluate systems for weaknesses at a scale that’s impossible for humans alone.” In other words, why leave the speed advantage solely to the black hats?
That said, Johri offered the reminder that “organizations shouldn’t assume AI will solve every security problem. AI systems can make mistakes, inherit biases, or miss important context.” And Wehrs encouraged companies to keep AI well away from sensitive databases and critical systems, instead ensuring that it operates only “inside carefully designed security boundaries.”
That’s vital, no matter what field your business operates in, Rampour said. “Access should be limited to specific devices, specific ports, and specific actions – nothing broader. Boards should hear this plainly, too: this isn’t just an IT checklist item; it’s a business continuity requirement.”
When that’s done correctly, though, AI can be as good at reducing the developmental deficit for defenders as it can be for attackers. As an example, Zugec said that AI agents can spot a threat, then “pull in what our researchers already know about that threat and come back as usable context in seconds instead of hours. That closes a gap attackers have relied on for years.”
But Zugec also counseled against ascribing every new threat to the growing role of AI, lest your organization focus its efforts on the wrong place. Was that recent breach truly because of new superpowers enabled by AI, or was it because hackers exploited a vulnerability that anyone could have spotted?
“When you hear that AI has made some defense obsolete, it is worth asking whether the thing was already obsolete, or whether the ‘new AI capability’ is something the field has had for twenty years under a different name,” Zugec suggested.
The Bitdefender director reasoned that hackers are “economically rational, and they reach for the cheapest thing that works. Most of the time, that is not AI … If AI ever becomes the cheapest, most reliable path to their objective, they will use it. Until then, be careful not to build your defenses around the version of the threat that makes better headlines than it does economics.”
AI is undoubtedly changing the cybersecurity game in new and concerning ways. As the experts have advised here, shoring up your defenses and adopting a continuous approach to risk remediation will be your best bet to keep out the attackers. They might be working faster than ever, but with the right tools at your disposal, you can be too.
