How Security Teams Can Prepare for AI-Accelerated Cyber Threats
Summary
The article argues that AI speeds up vulnerability discovery and attacks but does not replace core security work. It recommends strengthening continuous vulnerability management, MFA, segmentation, automation, and governance.
Key points
- The article says AI increases the speed and scale of threats, while the five NIST Cybersecurity Framework functions remain relevant.
- It describes AI-driven zero-day discovery, autonomous attack chains, and risks from AI-generated code and agents as key concerns.
- It recommends continuous vulnerability discovery and remediation through a dedicated VulnOps function rather than relying on periodic testing and ticket queues.
- It advises deploying phishing-resistant MFA, such as FIDO2 keys or passkeys, for privileged accounts.
- It recommends network and identity segmentation, plus egress filtering, to limit the impact of exploitable vulnerabilities.
- The author urges security teams to automate response and posture checks, and to speed up cross-functional decisions on defensive measures.
- The article also calls for broader governance of advanced AI capabilities, including independent audits and disclosure of aggregate performance metrics.
Article Details
- Defense Focus
- Improve resilience and shorten detection and response cycles as AI accelerates vulnerability discovery and attacks.
- Detection Methods
- Run continuous vulnerability discovery and remediation across internal systems and third-party and open-source components.
- Continuously check identity posture, including dormant accounts and administrator MFA coverage.
- Use AI agents to support incident response, code review, threat triage, and audit data collection.
- Data Sources
- Asset and attack-surface inventories
- Vulnerability findings across internal, third-party, and open-source components
- Account activity and identity posture, including dormant accounts and administrator MFA status
- Code review and audit data
- Platforms
- Identity systems
- FIDO2 hardware keys
- Platform passkeys
- Defensive Actions
- Establish VulnOps as a permanent function with a continuous discovery and remediation pipeline.
- Require phishing-resistant MFA for privileged accounts; use FIDO2 hardware keys or platform passkeys.
- Apply east-west and identity segmentation, along with egress filtering, especially when patches are unavailable.
- Automate containment and build repeatable incident-response workflows.
- Create a cross-functional process to evaluate threats and deploy defensive technology quickly.
- Continuously verify that identity controls are effective rather than relying on assumed onboarding and offboarding processes.
- Develop resilient architectures and deploy defensive agents.
People
Bruce SchneierContributed to the CSA Mythos-ready brief and advocated coordinated governance, auditing, and disclosure frameworks.Rob FullerAuthored a CISO field brief on security-program priorities; identified as VP of Information Security at a Fortune 500 company and Chair of the Vulnerability Management Research Group.
Vendors
AnthropicProject Glasswing was a positive step. Anthropic gave 40 vendors early access to the patch before release. However, the global attack surface is much larger than any partner group can cover. As Mythos-class capabilitiesCrowdStrikecompany valuations dropped. The market responded to the idea that if AI can replicate what CrowdStrike and Tenable built in years, the value proposition changes.Tenablevaluations dropped. The market responded to the idea that if AI can replicate what CrowdStrike and Tenable built in years, the value proposition changes.
Products
Claude Opus 4.6major operating systems and browsers. It produced 181 working Firefox exploits, compared to two from Claude Opus 4.6. This is a significant leap.Linux kernelApply deep segmentation. The Mythos preview showed that Linux kernel defense-in-depth was effective. Segmentation can turn an exploitable issue into one that is not exploitable in your environment. Use east-westMozilla Firefoxmodel found thousands of zero-days across major operating systems and browsers. It produced 181 working Firefox exploits, compared to two from Claude Opus 4.6. This is a significant leap.MythosMythos made headlines on social media recently. Public cybersecurity company valuations dropped. The market responded to the idea that if AI can replicate what CrowdStrike and Tenable built in years, the value