📊 Full opportunity report: The Frameworks Can’t See the Thing That Matters: A Year of AI-Enabled Cyber Threats on ThorstenMeyerAI.com — validation score, market gap, and execution plan.
TL;DR
A year-long analysis shows AI is enabling cyber attackers to perform more complex, dangerous activities, blurring the lines of threat assessment. Traditional metrics no longer reliably identify high-risk actors, raising new security challenges.
New research from Anthropic reveals that AI is significantly increasing the threat level of cyber attackers, with malicious actors now performing more complex and dangerous activities than ever before. This shift challenges longstanding methods used by security teams to assess threat severity and identify high-risk actors.
Anthropic examined 832 accounts banned for malicious cyber activity between March 2025 and March 2026, mapping their techniques onto the MITRE ATT&CK framework. The findings show that AI is primarily used to automate the creation of attack tools, such as malware, with 67.3% of accounts employing AI for this purpose. More concerning is the increased use of AI for post-infiltration activities, such as lateral movement within networks, which rose from 33% to 56% over the year.
Importantly, the report indicates that AI is enabling less skilled actors to perform complex, technical operations that previously required expertise. The use of AI for activities like account discovery increased by nearly 9%, while reliance on traditional phishing decreased slightly. This democratization of advanced attack techniques means threat actors of all skill levels can now carry out more sophisticated intrusions, fundamentally altering threat landscapes.
The frameworks can’t see the thing that matters
For decades, danger meant which techniques an attacker commands. A year of real AI-enabled attacks — 832 banned accounts mapped onto MITRE ATT&CK — shows that signal breaking, just as a new, harder-to-see one takes over.
A year of real misuse, mapped to the standard taxonomy
A window, not a census — these are the cases with enough detail to assess techniques thoroughly. Inside it, the risk level climbed fast.
WHAT WAS STUDIED
THE RISK CLIMB · MEDIUM-OR-HIGHER ACTORS
Ghidra for Digital Forensics and Malware Investigation: A Practical Guide to Reverse Engineering, Code Analysis, and Threat Detection (cybersecurity digital tools)
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
“More techniques” stopped meaning “more dangerous”
The old heuristic: count the techniques, judge the tooling. AI dissolved it — because the model supplies the techniques either way. Watch the old signal fail, then watch what it misses.
Risk score vs. technique count
Two ways to read the same attacker. One is going blind. Press play.
AI-Powered Cybersecurity Automation with Python: A Beginner’s Guide to Building Security Tools, Automating Threat Detection, and Protecting Systems
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Deeper into the attack — and into less-skilled hands
Across the year, AI use drifted from getting in toward acting once already inside — the operationally demanding stages that used to require an expert.
The attack lifecycle · where AI is now applied
The center of gravity moved right — toward post-compromise work.
Network Intrusion Detection
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
From “what they know” to “what they’ve built”
The report sorts the signals into three tiers — one dead, one fading, one durable.
Technique count & tooling
16 vs. 20 between novice and expert; platform doesn’t correlate. The model supplies the techniques either way.
Where in the lifecycle AI is applied
Concentrating on operationally demanding, post-compromise stages is a better signal — but it’s eroding as the whole population heads there.
The scaffolding around the model
Architectures that let the model chain stages and run with minimal human input. Not what they know — whether they’ve built a system that lets AI run the attack.
cyber attack simulation kits
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Fixing the map before the territory moves again
A taxonomy that can’t name the most dangerous behavior on the field will quietly mislead the people relying on it. The response runs in two directions.
Fed back into the models
The findings informed safeguards on the most capable models, built to detect & block some of what was observed:
- Blocking malware development
- Blocking mass data exfiltration
- Putting tools in defenders’ hands first (Project Glasswing)
Taking it to the source
Following the Verizon work, Anthropic says it’s in discussions with MITRE about how ATT&CK might evolve:
- A vocabulary for agentic orchestration
- Naming the scaffolding that makes a model an operator
- An interactive technique visualization on the Red blog
Reading it in proportion
- The 832 cases are a detailed subset, not the full population — the precise percentages are directional, not definitive.
- “More autonomous” is not “fully autonomous” — even the standout case needed human input at key moments, which is itself a place for defenders to intervene.
- This is one vendor’s window — the company with visibility into misuse of its own model, publishing what it found. The right thing to do with the data, and worth remembering as you read it.
Implications of AI-Driven Threats on Cybersecurity Strategies
This development matters because it undermines traditional threat assessment heuristics, which relied on the number of techniques and tool sophistication to gauge attacker danger. With AI automating complex tasks, even less skilled actors can pose significant risks, complicating detection and response efforts for security teams. The shift toward deeper, post-infiltration activities also means defenses must adapt to more subtle and persistent threats, increasing the challenge of preventing breaches and mitigating damage.
Evolution of Cyberattack Techniques and AI Integration
Historically, threat assessment focused on the variety of techniques used and the sophistication of tools. The assumption was that more techniques and advanced tools indicated higher threat levels. However, recent developments show AI’s role in automating and simplifying complex tasks, enabling less skilled actors to perform at levels once reserved for experts. The rise of AI in cybercrime coincides with a broader trend of attackers shifting their focus from initial access to post-compromise activities, emphasizing lateral movement and privilege escalation.
“Our findings show that AI is democratizing advanced attack techniques, making dangerous activity accessible to a broader range of actors.”
— Anthropic’s research team
Unclear Impact of Evolving Attack Scaffolding
While the report emphasizes that attackers build around AI models, it remains unclear how widespread or standardized these scaffolding techniques are, and how quickly defenders can adapt their detection methods to these new attack structures. The long-term effectiveness of existing defenses against AI-enhanced threats is still uncertain, as threat actors continue to innovate.
Anticipated Developments in AI-Driven Cybersecurity Challenges
Security teams will need to develop new detection and assessment tools that go beyond traditional technique counts. Monitoring for signs of AI-assisted post-infiltration activity and understanding the evolving attack scaffolding will be critical. Additionally, further research is expected to explore how threat actors are integrating AI into their operations and how defenses can keep pace with these innovations.
Key Questions
How does AI change the way attackers operate?
AI enables attackers to automate complex tasks such as lateral movement and account discovery, making these activities accessible to less skilled actors and increasing overall threat levels.
Why are traditional threat assessment methods no longer reliable?
Because AI allows even less experienced attackers to perform sophisticated techniques, the correlation between the number of techniques used and threat severity breaks down, rendering old heuristics ineffective.
What can organizations do to defend against AI-enabled threats?
Organizations need to develop new detection strategies that focus on post-infiltration activity, attack scaffolding, and behavioral anomalies rather than just technique counts or tool sophistication.
Is this trend likely to accelerate?
Yes, as AI technology becomes more accessible and integrated into attack workflows, the trend toward more dangerous, automated cyber threats is expected to grow, requiring ongoing adaptation from defenders.
Source: ThorstenMeyerAI.com
