Defending Against the Risk of Weaponized AI

Cybersecurity defenses have traditionally been designed around a human adversary. Security teams have built their tools, processes and operating models on assumptions about how people identify weaknesses, move through an environment and use stolen information. The arrival of AI challenges those assumptions because attackers can now combine human intent with machine speed, scale and analytical capabilities.

This change is not simply allowing threat actors to perform familiar tasks more quickly. AI can examine environments comprehensively, identify connections that a person might miss and support sophisticated operations that were previously associated with highly resourced nation state groups. These capabilities are also becoming accessible to a much wider range of attackers.

After 20 years in cybersecurity, including incident response, proactive consulting, remediation and recovery work, I believe weaponized AI represents a generational risk. Security leaders cannot respond by doing slightly more of what they already do. Patching faster and adding further hardening measures will remain necessary, but these steps alone will not prepare an organization for machine-based attacks.

Why Weaponized AI Requires a Different Defense

AI is changing the way attackers operate throughout the intrusion process. Early signs included more advanced phishing and the use of AI tools to evaluate large amounts of stolen data, reducing the time between gaining access and achieving the objective. Those were efficiency gains. What has changed since is the ceiling. In June, one of A Security’s researchers used publicly available frontier models to go from a cold start to a working zero-click remote code execution exploit against Zoom's proprietary, undocumented annotation protocol in under 24 hours and fewer than 20 prompts. Zoomsday was three CVEs rated 9.0, affecting every platform the client ships on. There was no click, no download, nothing but being in a meeting with the attacker. Work that once required a specialist nation-state team and months of reverse engineering is now a day's effort.

Those examples provided an early indication of what would happen as more of the attack process became automated. Recent cases involving AI agents have demonstrated how multiple agents can explore and exploit an environment within a period that would be difficult for a human team to match. The concern is therefore not limited to attackers generating better emails or scripts. It is about machines being used to discover and connect opportunities across an environment.

Security teams must continue strengthening identities, networks and zero trust controls because these measures remain an essential part of reducing exposure. However, organizations need to reconsider how they manage vulnerabilities, misconfigurations and their wider security posture.

Most vulnerability programs concentrate on individual findings, often creating extensive lists of issues that must be investigated and ranked. This approach already places considerable pressure on security teams, and it becomes less effective when an AI based adversary can assess many weaknesses simultaneously and determine how they might be combined.

The appropriate unit of analysis is no longer an isolated vulnerability or misconfiguration. Defenders need to examine the exploitable kill chains that exist within their environments, understand the business impact that could result and remediate the combinations of weaknesses that give an attacker a viable route to its objective.

Finding the Weaponized AI Risk That Matters

Mature security organizations are beginning to make this shift by focusing on exploitability instead of vulnerability volume. They are asking how an attacker could actually use a weakness, what other conditions would be required and whether those elements can form a complete path through the environment.

Attack path visibility has existed for some time, but visibility by itself does not provide sufficient assurance. Many tools identify theoretical relationships between assets, vulnerabilities and permissions without demonstrating that an attacker could use the entire path from beginning to end. A possible route may deserve investigation, but it should not automatically receive the same priority as an attack path that has been shown to be exploitable.

Security teams therefore need to distinguish between theoretical exposure and an exploitable attack path that could produce a measurable business impact. This gives defenders a more practical basis for prioritization and helps remediation teams direct their limited resources towards the conditions most likely to result in a breach.

Organizations making progress in this area generally share three characteristics. They are using AI to respond to AI enabled threats, they are testing exploitability rather than relying only on vulnerability findings, and they are working towards autonomous remediation within safe and controlled boundaries.

Human penetration testing remains important, but it has limitations when used as the main method for assessing a large and continuously changing environment. Experienced testers are scarce and expensive, while every team brings its own specialist knowledge and preferred techniques. Testing engagements are also restricted by time and scope, which means they can only examine a portion of the organization at a particular moment.

Traditional automated security testing has different constraints. Scripted tools can identify known classes of weaknesses, but they often struggle with business context, business logic vulnerabilities and situations that fall outside their predefined tests. Once those scripts have been exhausted, the tools may not be able to pursue new lines of investigation in the way an adaptive adversary can.

Neither periodic human testing nor deterministic automation can continuously provide the contextual and comprehensive assessment required for weaponized AI. Defenders need an offensive security engine that can search for exploitable kill chains, validate whether they can be completed and use the results to direct remediation.

Preparing Defenders for Weaponized AI

Advanced frontier models such as Mythos have already become a boardroom subject, and security leaders are being asked what their organizations are doing to prepare, even though the most capable systems are not yet available to everyone. Waiting for that access would be a mistake.

Current frontier models can already identify many of the issues and kill chains that more advanced models will eventually exploit, and open-source models continue to give threat actors useful capability, which means the practical risk was never dependent on the release of any one system. The barrier to high-quality offensive work has already come down for everyone.

The work of preparing starts now, and for most organizations it comes down to six decisions:

1. Start with the models available today. The weaknesses a more advanced model would exploit are largely the same weaknesses a current one can find. In some environments, models available right now can surface between 60 and 80 per cent of the issues that future models could use. Every path closed before stronger capabilities arrive is exposure that never gets tested by a real adversary. The exploitation window is collapsing faster than any procurement cycle.

2. Require proof of exploitation, not theoretical severity. A severity score describes a condition in isolation. Ask instead whether an approach can execute the intrusion and show you what happened: the path taken, the objective reached, and a logged, reviewable trail of the whole sequence. That evidence is what converts a security conversation into a business one, and in regulated environments it is also what an auditor or regulator will accept in place of an assertion.

3. Insist on cross-domain chaining and blast radius. Most tooling assesses identity, cloud, code, and endpoint as separate problems, because that is how human attackers were forced to work through them. An AI adversary holds all of it at once, chaining a low-severity finding in one domain into a critical outcome in another. Evaluate two things together: whether an approach reasons across those boundaries to build the full path, and whether it can then tell you how far a proven compromise pivots. Breadth without proof is a list. Proof without breadth is an anecdote. Real decisions require both.

4. Make environmental change the trigger, not the calendar. An annual penetration test and a quarterly scan are calibrated to human tempo, and a faster engagement is still an engagement someone has to schedule. The standard to hold vendors to is testing that fires when the environment changes: a new deploy, a new config, a new endpoint. That is the moment the adversary is already looking. Ask what initiates a test. If the answer is a date or a request, the gap between change and coverage is still measured in months.

5. Treat validation as a filter, not another feed. Traditional programs generate findings faster than any team can act on them, and tools that apply AI carelessly hallucinate at scale on top of that, producing volume that looks like coverage and behaves like debt. The great majority of flagged issues turn out to be impossible to execute, and the ones that remain usually arrive with no business context at all. Validation is what removes both problems at once: it proves which exposures a real attacker could reach, and it attaches the business impact that tells you which of those actually matters. Anything that reaches an analyst's queue unvalidated is work you have chosen to fund.

6. Require the loop to close, and to close without you. Discovery and validation that hand a proven path back to an already-stretched team have moved the work, not finished it. The standard is a single motion: discover, prove, remediate, and re-test until the path is confirmed gone. Gartner expects only about 30 per cent of organizations to link validation results to automated remediation by 2029, which makes this the criterion most tools on the market today will fail, and the one worth asking about first. It also changes the metric. It's not findings produced, but viable routes to actual, and critical, assets eliminated, and how quickly each one disappeared after it appeared.

Taken together, these six describe something the market has not finished naming. Offensive security that runs autonomously, proves what it finds, and fixes what it proves. Legacy tools were built to assess conditions that human adversaries could detect and use.

AI attackers will exploit many of the same weaknesses, but they will also combine information, test possibilities, and move through environments in ways people cannot reproduce at the same speed or scale. Matching that requires defenders to operate the same way. The organizations that start now will be reporting on exposure they have removed while others are still assessing their readiness.

The Time to Act is Now

Weaponized AI has become a boardroom-level concern, and the gap between adversary capability and traditional defensive testing is widening by the quarter. Security leaders should begin evaluating Autonomous Offensive Security (AOS) platforms immediately. The guidance in this article helps to evaluate, and select, the solution that best fits their specific needs.

As you evaluate, look for a platform that closes the loop instead of widening it.

At A Security we bring offensive security and remediation together within one platform. Instead of producing another list of vulnerabilities for your team to investigate manually, it examines whether weaknesses and misconfigurations can be combined into an attack that reaches the systems and data your business actually depends on. Once an exploitable kill chain has been validated, your organization can focus its resources on exactly what matters: removing the conditions that make the attack possible.

My team is ready to help you at any time a.security/get-a-demo