📊 Full opportunity report: The Frameworks Can’t See the Thing That Matters: A Year of AI-Enabled Cyber Threats on ThorstenMeyerAI.com — validation score, market gap, and execution plan.
TL;DR
A recent analysis shows AI is increasingly used by cyberattackers to enhance their techniques, blurring distinctions between skilled and amateur actors. This shift challenges existing threat assessment models and raises new security concerns.
New research from Anthropic indicates that AI is fundamentally changing the landscape of cyber threats, enabling less skilled actors to perform complex attack techniques previously requiring expertise. This development challenges traditional threat assessment models and underscores the evolving danger in cybersecurity.
Anthropic analyzed 832 accounts banned for malicious activity between March 2025 and March 2026, mapping their techniques onto the MITRE ATT&CK framework. The findings show that 67.3% of these actors used AI to prepare for attacks, primarily for malware creation. More concerning, AI was increasingly employed for sophisticated post-intrusion activities such as lateral movement and account discovery, with the share of medium-risk or higher actors rising from 33% to 56% over the year.
The report highlights a shift: attackers are moving AI use from initial access techniques to deeper network activities. This trend indicates that AI enables less skilled actors to perform complex tasks, eroding the link between attacker skill level and threat severity. Traditional indicators—technique count and tool choice—no longer reliably distinguish high-risk actors, as AI fills in the technical gaps for less experienced individuals.
The frameworks can’t see the thing that matters
For decades, danger meant which techniques an attacker commands. A year of real AI-enabled attacks — 832 banned accounts mapped onto MITRE ATT&CK — shows that signal breaking, just as a new, harder-to-see one takes over.
A year of real misuse, mapped to the standard taxonomy
A window, not a census — these are the cases with enough detail to assess techniques thoroughly. Inside it, the risk level climbed fast.
WHAT WAS STUDIED
THE RISK CLIMB · MEDIUM-OR-HIGHER ACTORS
Python Scripting for Cybersecurity: Linux Edition: Volume 2 – Log Analysis, Network Visibility, and Threat Detection with Hands-On Python Projects
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
“More techniques” stopped meaning “more dangerous”
The old heuristic: count the techniques, judge the tooling. AI dissolved it — because the model supplies the techniques either way. Watch the old signal fail, then watch what it misses.
Risk score vs. technique count
Two ways to read the same attacker. One is going blind. Press play.
OSINT 2.0: AI-Powered Open-Source Intelligence for Beginners (OSINT 2.0 — Artificial Intelligence for Open-Source Intelligence and Cyber Investigations Book 1)
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Deeper into the attack — and into less-skilled hands
Across the year, AI use drifted from getting in toward acting once already inside — the operationally demanding stages that used to require an expert.
The attack lifecycle · where AI is now applied
The center of gravity moved right — toward post-compromise work.
Network Intrusion Detection
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
From “what they know” to “what they’ve built”
The report sorts the signals into three tiers — one dead, one fading, one durable.
Technique count & tooling
16 vs. 20 between novice and expert; platform doesn’t correlate. The model supplies the techniques either way.
Where in the lifecycle AI is applied
Concentrating on operationally demanding, post-compromise stages is a better signal — but it’s eroding as the whole population heads there.
The scaffolding around the model
Architectures that let the model chain stages and run with minimal human input. Not what they know — whether they’ve built a system that lets AI run the attack.
Threat Intelligence & Incident Response Handbook: Detect, Investigate, and Contain Cyber Attacks Using Modern SOC Analysis, Threat Hunting, and Security Monitoring Techniques
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Fixing the map before the territory moves again
A taxonomy that can’t name the most dangerous behavior on the field will quietly mislead the people relying on it. The response runs in two directions.
Fed back into the models
The findings informed safeguards on the most capable models, built to detect & block some of what was observed:
- Blocking malware development
- Blocking mass data exfiltration
- Putting tools in defenders’ hands first (Project Glasswing)
Taking it to the source
Following the Verizon work, Anthropic says it’s in discussions with MITRE about how ATT&CK might evolve:
- A vocabulary for agentic orchestration
- Naming the scaffolding that makes a model an operator
- An interactive technique visualization on the Red blog
Reading it in proportion
- The 832 cases are a detailed subset, not the full population — the precise percentages are directional, not definitive.
- “More autonomous” is not “fully autonomous” — even the standout case needed human input at key moments, which is itself a place for defenders to intervene.
- This is one vendor’s window — the company with visibility into misuse of its own model, publishing what it found. The right thing to do with the data, and worth remembering as you read it.
Impact of AI on Cyber Threat Assessment
This shift significantly alters cybersecurity risk evaluation. The traditional focus on the number of techniques and sophistication of tools as indicators of threat level is no longer effective, as AI democratizes complex attack capabilities. Security teams must now develop new methods to identify high-risk actors, focusing on how they deploy AI within their operations rather than just their technical arsenal.
Evolution of Cyberattack Techniques with AI
Historically, threat assessments relied on counting techniques and analyzing toolsets to gauge attacker danger. The MITRE ATT&CK framework has been central to this approach. Over the past year, the integration of AI into cyberattacks has begun to upend this paradigm, with attackers increasingly using AI for both mundane tasks like malware creation and complex operations such as lateral movement, making threat assessment more challenging.
“The link between an attacker’s skill and their threat level is weakening as AI takes over complex tasks.”
— Anthropic report author
Unclear Impacts on Threat Detection Strategies
It remains uncertain how cybersecurity defenses will adapt to these changes. While the report shows AI is enabling less skilled actors to perform complex tasks, it is not yet clear how detection methods can evolve to reliably identify high-risk threats based on operational behaviors rather than technique counts or tool signatures. The long-term effectiveness of current frameworks is still under question.
Next Steps for Cybersecurity Defense Strategies
Security professionals will need to develop new detection approaches that focus on behavioral analysis and operational signals rather than traditional technical indicators. Ongoing research and collaboration between AI developers and cybersecurity experts are essential to address the emerging threat landscape. Monitoring how attackers continue to integrate AI will be crucial in shaping future defenses.
Key Questions
How is AI changing the way attackers operate?
AI is enabling attackers to perform complex tasks such as lateral movement and account discovery more easily, even for those with less technical skill, by automating and enhancing attack techniques.
Why are traditional threat assessment methods becoming less effective?
Because AI allows less skilled actors to execute techniques previously associated with highly skilled attackers, making technique count and tool choice unreliable indicators of threat level.
What can organizations do to improve detection of AI-enabled threats?
Organizations should focus on behavioral and operational signals, such as attack patterns and activity sequences, rather than solely relying on technical indicators or tool signatures.
Will AI make cyber defenses obsolete?
Not necessarily, but it will require adapting strategies and developing new detection methods to keep pace with AI-enabled attack capabilities.
What is the significance of this development for future cybersecurity policies?
It highlights the need for updated policies emphasizing behavioral analysis and AI-aware threat detection, as well as ongoing research into AI’s role in cyber threats.
Source: ThorstenMeyerAI.com
