AI doesn’t create new cyber threats

* AI supercharges existing attack techniques, allowing attackers to perform attacks faster and more easily across a wider range of targets.
* AI has democratized cybercrime by providing tools like AI-assisted phishing kits and deepfake attacks to non-skilled actors.
* Attackers use legacy techniques at larger scales, such as Infostealer variants built solely on AI.
* Deepfake attacks and fraudulent meetings impersonating known contacts are expected to become more frequent.
* Insider threats will become more believable due to the ease of creating realistic identity documents like passports.
* Attackers can duplicate streaming service pages using automated tools without specialized skill.
* Attackers use legitimate platform infrastructure and HTTPS certificates to create fake sites for scams, including cryptocurrency airdrops.
* Attackers converge lookalike domains, search optimization, and visual mimicry to create fraudulent infrastructure at scale.
* Defenders must prioritize attacks by scale and exploitability rather than novelty.
* Focus should be placed on protecting people and identities because social engineering is made more convincing by AI.

The central dynamic described is a shift in the arms race between defenders and attackers, driven not by technological invention but by accessibility. Attackers are leveraging AI to multiply the volume and believability of low-skill attacks, creating a scenario where defense must pivot from stopping specific novel threats to managing overwhelming scale and human factors. The pattern emerging is the exploitation of trust and process: by making impersonation and social engineering indistinguishable, attackers bypass technical defenses by targeting the weakest link—the human element—and exploiting institutional response lag. The emphasis on prioritizing attacks by exploitability rather than novelty suggests a realization that incremental sophistication in tools is less dangerous than exponential increase in volume against human attention. Furthermore, the focus on leveraging external threat intelligence implies a systemic gap: organizations are currently operating with reactive, siloed intelligence, while attackers operate proactively using ubiquitous digital resources for mass compromise. The implication for agency is that security success moves beyond perimeter defense to encompass organizational resilience against inevitable human error amplified by machine capabilities.
Bridge questions: How should organizations structurally integrate external threat intelligence into their real-time response protocols when facing high-volume AI-amplified attacks? What governance structures are necessary to ensure that controls focused on reducing the consequences of human mistakes are prioritized over preventing every potential mistake? What specific mechanisms can effectively bridge the gap between identifying large-scale attack campaigns and executing proportionate, preemptive defensive actions?