- Pre-operation (setup and reconnaissance): The weeks-long setup phase has been accelerated into mere moments. Gathering Open-Source Intelligence (OSINT), provisioning infrastructure, building organizational charts, and configuring command-and-control (C2) servers can now be delegated to agentic AI. This significantly reduces the time and manual effort needed to get an operation off the ground, though complex infrastructure decisions still require experienced operators. Pre-op usually starts off exciting (new op coming) but often ends in a grind. We love the acceleration AI has provided here.
- Mid-operation (enumeration and attack): during active engagements, AI acts as a real-time, on-demand expert. Operators use AI interactively to generate custom audit scripts, rapidly adapt strategies, and query unfamiliar technology stacks on the fly. By utilizing an LLMs-as-judges workflow, where one model’s output is vetted by another for correctness and risk before execution, attackers can ensure highly confident, automated actions. Enumeration and attack is where all the excitement and adrenaline happens. We are using AI to help here, but it’s not replacing us humans (yet).
- Post-operation (reporting and deconfliction): reporting has historically been the most tedious burden of any engagement. Today, nine to ten months of raw C2 logs can be piped into a frontier model to generate a comprehensive deconfliction report in under 20 minutes. These tools can map every executed command to the MITRE ATT&CK framework, cross-reference threat intelligence, and translate highly technical data into clear, actionable narratives for board-level executives. The output still requires manual review. AI gets you to a first draft in minutes instead of days, but an operator needs to verify findings, validate ATT&CK mappings, and ensure accuracy before delivery. Ticketing and follow-up are the bane of most red teams. AI has become an awesome sidekick to our teams to build our reports and do lots of the tedious work.
The talent divide: judgment as the ultimate differentiator
With AI automating basic enumeration, scanning, and scaffolding, the core red-teaming skill set — critical thinking, architectural understanding, adversarial judgment — is as valuable as it’s ever been. AI doesn’t replace that. But operators who can leverage AI alongside those skills will outperform those who can’t. The differentiator isn’t AI versus no AI; it’s whether you have the foundational knowledge to direct it effectively and validate what it gives you. This is fundamentally shifting the required profile of a successful cybersecurity professional. As a result, the industry is quickly diverging into two distinct categories of practitioners:
- The “unicorns” (high performers): These are the practitioners who bring critical thinking and deep adversarial judgment to AI. They understand exactly where trust boundaries fail and where architectures are weak. They use AI to execute on these insights efficiently, offloading the busywork to focus on complex exploitation.
- The “slop cannons”: Operators who use AI as a mindless copy-paste shortcut. They rely entirely on unverified outputs without understanding the underlying mechanics, producing noisy, easily detectable work that wastes time and triggers alarms.
Consequently, hiring practices must change. The primary screening criterion for new talent can no longer be a stack of legacy certifications; it must be their hands-on curiosity, their fundamental understanding of network architecture, and their experience building tools with frontier AI models. Certifications still matter, but hiring must also evaluate whether candidates can think critically about systems and leverage AI tools effectively — not just operate them blindly
Strategic imperatives for 2027
For security leaders looking to survive this paradigm shift, the path forward requires immediate action. Based on our observations, here are the critical priorities for the next 18 months:
