Nearly eight out of 10 global IT decision-makers say artificial intelligence now poses a significant security threat, according to a new cyberwarfare report released Tuesday.
Cyber conflict is entering a new phase as AI becomes deeply embedded across economies, organizations, and everyday digital life, the fourth annual Armis State of Cyberwarfare Report found, based on a survey of 1,900 IT decision-makers worldwide at companies with more than 1,000 employees.
But with that dependency comes exposure, it noted. Today, 79% of IT decision-makers state that AI-powered attacks pose a significant threat to their organizations’ security.
“AI-powered attacks move faster and enable less experienced adversaries to launch sophisticated attacks at an accelerated rate, making them hard for typical security teams to detect,” Nadir Izrael, CTO and co-founder of Armis Labs, the research arm of Armis, a cyber exposure management and security company in San Francisco, told TechNewsWorld.
Izrael, who wrote the introduction to the 23-page report, added that a majority of respondents (69%) agree that AI will enable non-state actors to operate with nation-state-level sophistication. “The barriers to entry are gone, even as the impact of attacks continues to rise,” he said.
“Today, we are facing progressively sophisticated cybersecurity attacks, driven by the growth of AI,” explained Seth Spergel, managing partner at Merlin Ventures, of McLean, Va., a network of affiliates that invests in, enables, and scales cyber technology companies.
“While AI is powering a new generation of defensive tools, it also makes the types of attacks that were once the domain of only very experienced threat actors much more accessible,” he told TechNewsWorld. “As a result, organizations are seeing both nation-states and criminals probe their defenses at a significantly higher volume than before.”
From Nuisance to Sophisticated Threat
AI-powered attacks have all but removed the barrier to entry for sophisticated attacks, maintained Jim Sherlock, vice president for AI and cybersecurity R&D at ProCircular, a cybersecurity consulting firm in Coralville, Iowa.
“Traditionally, the casual armchair hacker ran pre-packaged exploits they didn’t understand against targets they found by accident,” he told TechNewsWorld. “They were nuisances, not existential threats.”
“What AI enables is something else entirely,” he continued. “A low-skill adversary can now deploy autonomous agents that reason about a target environment, chain exploits using current context, adapt to defensive responses and make lateral movement decisions on the fly.”
“A script kiddie runs someone else’s exploit and hopes it works,” he said. “An AI-equipped attacker builds its own exploit chain on the fly and knows it will.”
“The line between commodity malware and nation-state-grade attacks is shrinking,” he added. “What used to require resources and expertise now just requires intent.”
Attack Acceleration
Rajeev Raghunarayan, head of go-to-market at Averlon, an AI-powered cloud security company in Redmond, Wash., asserted that AI-powered attacks are a significant threat not just because they are more sophisticated, but because they operate at a different speed and scale.
“Recent research, including Anthropic’s documentation of an AI-assisted cyber espionage campaign, shows that attackers have begun to automate parts of the attack lifecycle, such as reconnaissance, vulnerability discovery, and lateral movement,” he told TechNewsWorld.
“That changes the math for defenders,” he continued. “Most organizations already have visibility into their risks but struggle to act on them quickly. When AI compresses the time between vulnerability discovery and exploitation, the gap between finding an issue and fixing it becomes the critical risk window.”
“Many organizations are underestimating this shift,” he said. “AI lowers the barrier for attackers, allowing even less sophisticated actors to operate at scale, which increases pressure on already constrained security teams. The question is no longer just what vulnerabilities exist, but how fast you can prioritize and remediate the ones that matter before attackers exploit them.”
“AI compresses the timeline from initial access to full compromise from hours to minutes, and most security operations are still built around the assumption that human analysts have time to investigate before things get worse,” added Michael Bell, CEO of Suzu Labs, in Las Vegas, a provider of AI-powered cybersecurity services.
“When an autonomous agent is already moving through your network faster than your team can open a ticket, the entire detection-and-response model breaks,” he told TechNewsWorld.
