Every year brings the same headline. Attacks are up, breaches are up, and the numbers are worse than 12 months ago. What has changed lately is not the volume so much as the tempo. Artificial intelligence (AI) has lowered the cost of entry for people who want to attack organisations, and it has stripped out much of the waiting that used to sit inside a campaign.
Much of the commentary around AI today conflates capability with deployment. But what a model can do in a laboratory is not necessarily what threat actors are demonstrably doing at scale. The two are worth separating, because the changes showing up in real campaigns are less cinematic than the headlines, but rather more consequential.
The pauses are disappearing
Take capability first. In 2025, Anthropic documented a UK-based operator running a ransomware business who relied on a commercial model for almost every technical step, from building the malware to setting the ransom demand. That operator could not have done the work alone. Skills which took years to acquire can now be rented by the hour.
Malware creation attracts attention, but it is the part organisations should worry about least. AI-written malicious code is still immature and remains recognisable to a competent detection stack. The bigger change is either side of the malware, where the results are much harder to see.
Reconnaissance is the first of those. A Chinese state-linked actor has been observed using models to establish where satellite ground station terminals physically sit, what technology surrounds them and which parts are worth going after, then to generate payload ideas. None of that is an exploit. It is homework, at a pace no research team could match on its own.
The second is what happens after data is taken. In the MOVEit campaign of 2023, the theft was quick, but working out what had been stolen, from whom, and what it was worth stretched on for months, which bought victims time to respond. Handed the same material today, a model answers a question such as “find everything relating to debt, contracts or trade secrets, in any language” in an afternoon. Models are markedly better than traditional tooling at spotting sensitive material in languages other than English, opening them up to victims in global markets.
At a macro scale, attackers are building infrastructure of their own. Open-weight models sit only a few months behind the frontier and run on hardware an operator already owns, using tools such as Ollama. Research from SentinelLabs and Censys found roughly 175,000 exposed Ollama hosts worldwide, outside any platform’s abuse monitoring, and the North Korean group Kimsuky has been seen gathering self-hosting tools and agent development packages. That AI cannot be revoked by a provider.
None of that amounts to a new attack. It is the same attacks with the pauses taken out, and the gaps defenders relied on for time are closing. Matching that pace is now the defensive problem.
The autonomous SOC is a heading, not a purchase
A common instinct for businesses is to point AI at its own estate and find the holes before an attacker does. Offensive self-testing is legitimate, but it generates enormous work for people already stretched repelling today’s attacks. Producing security findings has never been the constraint. Reviewing, verifying, approving and safely deploying them is.
The better starting point is getting faster at the work already in the queue. Triage, enrichment, investigation, drafting and reviewing playbooks. Not every task needs a frontier model either, and routing each one to the cheapest capable model is more useful than chasing the top of a benchmark table.
The autonomous SOC is widely misunderstood here. It is not a product to be bought but a maturity model, and most organisations sit in the middle of it, using AI to assist triage and investigation while people make the decisions. The question is not how autonomous a SOC should be, but whether the organisation retains control over the decisions that matter.
A useful comparison is the flight deck. A pilot does not work every surface of the aircraft by hand. The job is monitoring the systems, applying judgement and remaining accountable, on the loop rather than in it and present for the moments that need a person.
The reason that matters is arithmetic. If the threat landscape sets the pace and the first two steps of an investigation still run on human timescales, the maths does not work. Automate where confidence is highest, keep people where judgement is needed, and build trust between the two deliberately rather than by accident.
Bounded projects, a code audit or a detection rule refresh are sensible places to begin. Done well, the shift moves analysts from operating to orchestrating, and the skills that made them good remain the foundation for what comes next.
Same tools, different discipline
Attackers are using AI in exactly the way legitimate users do. They ask questions, get answers faster than they could find them alone, and act. The advantage will not go to whoever adopts AI first, but to whoever works out what to hand over and what to keep hold of. That decision is better made now than halfway through an incident.
Chris Hosking, AI and cloud security evangelist at SentinelOne.
