Eight Ways AI Is Changing Threat Intelligence and Cyber Defense

Summary

Recorded Future leaders discuss how AI is accelerating threats and defense, including a supply-chain compromise that used an LLM to find credentials, and why real-time intelligence and careful automation matter.

Key points

• The article argues that AI is accelerating exposure discovery and threats, increasing pressure on security teams to act quickly without sacrificing accuracy.
• It describes a software supply-chain compromise in which attackers used stolen credentials to publish a malicious package update; an LLM on infected developer machines searched for local credentials, which were exfiltrated through a public GitHub repository.
• The article says the credential-search activity evaded EDR because it resembled ordinary LLM usage, and warns that attackers may repurpose AI tools already installed on target devices.
• It presents context-aware access—adjusting permissions based on factors such as location, time, and context—as an alternative to relying solely on endpoint lockdown.
• The authors expect human approval of high-stakes actions to continue, while routine security operations may move toward autonomous systems with lighter human oversight.
• The article highlights real-time threat intelligence as important for prioritizing vulnerabilities and defending against threats that may emerge faster than teams can assess them.
• It argues that model knowledge alone may be stale or limited, and that intelligence quality and access to relevant data are important to effective AI-supported defense.

People

Vendors