Since 2025, IBM reported a 44% rise in attacks on public‑facing applications, a 40% jump in vulnerability exploitation, and a 50% surge in active ransomware operators. The AI cybersecurity threat is reshaping boardrooms, and former GCHQ intelligence lead Professor Julian Richards warned that executives who don’t grasp these shifts risk becoming blind spots. In an interview for the original report, Richards laid out why constant strategy changes are now non‑negotiable.
Key Takeaways
- AI models like Claude Mythos and GPT‑5.5 are already hunting software flaws.
- Threat actors are using AI to mimic state‑sponsored TTPs at industrial scale.
- Legacy infrastructure struggles to adopt active‑defense tools.
- Legislative disclosure windows lag behind AI‑driven exploit timelines.
- Executive upskilling is the fastest path to real‑time resilience.
Historical Context
AI in security didn’t appear overnight. Early attempts in the 2010s focused on pattern‑matching, where machine‑learning models flagged known malicious signatures. Those tools were useful, but they lacked the ability to generate new attack vectors. The breakthrough came when large‑language models began to understand code syntax and semantics. By the time Claude Mythos and GPT‑5.5 entered the market, the research community had already published papers on AI‑assisted vulnerability discovery. Those papers showed that a model could suggest a buffer overflow after reading a few lines of code.
That research fed directly into commercial products. Companies started offering AI‑driven static analysis as a premium feature, promising to catch “the bugs that humans miss.” The promise held enough appeal that enterprises began to allocate budget for these services. However, the same underlying technology also gave adversaries a sandbox for rapid weaponisation. When the IBM numbers surfaced, they reflected a decade‑long evolution that moved from experimental labs to a real‑world threat landscape.
Understanding that trajectory is vital. It explains why the current surge feels abrupt, even though the underlying capability has been simmering for years. The shift from “AI as a helper” to “AI as a weapon” marks a turning point for risk management.
AI Cybersecurity Threat: New Frontiers for Executives
What’s shocking is how quickly models such as Claude Mythos and OpenAI’s GPT‑5.5 have moved from research labs to real‑world hunting grounds. Those models can map vulnerable code, stitch together exploit chains, and even suggest weaponised payloads. That’s the catch. It didn’t work for every target, but the few successes have already forced defenders to rethink static defenses. We’re seeing a shift where the line between attacker and defender blurs, and that’s unsettling for any C‑suite that still thinks AI is just a defensive toy.
Attackers using AI at Scale
Jailbreaking lets threat groups run legitimate AI engines to scrape open‑source intel, automate reconnaissance, and rewrite malware on the fly. Richards noted that this capability levels the playing field with nation‑state actors. The IBM figures underline the trend: a 44% increase in public‑facing attacks, a 40% rise in exploit use, and a 50% growth in ransomware crews—all tied to AI‑enhanced workflows. It’s not a coincidence; it’s a direct result of AI‑driven automation.
Defenders Fighting Back with AI
On the flip side, defenders are deploying AI to dynamically map attack surfaces, even as threats mutate. Richards explained that AI can analyse thousands of log streams in seconds, flagging anomalous behaviour that humans would miss. That rapid feedback loop gives security teams a fighting chance, but only if leadership backs the technology with proper funding and policy. We’ve seen pilots succeed, yet many enterprises still cling to legacy SIEMs that can’t keep up.
Competitive Landscape
The market for AI‑enhanced security tools is crowded. Vendors range from cloud‑native providers that ship pre‑trained threat‑intelligence models to niche startups that specialise in on‑prem AI engines. Each promises a different value proposition. Cloud services boast elasticity; they can spin up additional compute when a surge in alerts hits. On‑prem solutions argue they can keep sensitive telemetry behind the firewall, reducing exposure to supply‑chain attacks.
Clients often run a hybrid mix. A midsize fintech might rely on a SaaS AI feed for external threat data while keeping an internal model for proprietary code analysis. A large retailer could deploy an AI‑driven endpoint detection platform that integrates with existing SOC tooling. The key differentiator is not just raw model size, but how well the solution integrates with an organisation’s existing workflows. Integration friction can negate any advantage a sophisticated model might bring.
Pricing models also vary. Subscription‑based licences tie cost to data volume, while perpetual licences require upfront investment in hardware. Decision‑makers must weigh the total cost of ownership against the speed at which AI can generate new exploits. In many cases, the fastest path to protection is to combine a lightweight cloud feed with a modest on‑prem engine that handles the most critical assets.
Why C‑Suite Upskilling Is No Longer Optional
Executives who don’t understand AI‑driven threats can’t allocate resources effectively. Richards argued that upskilling isn’t about learning to code; it’s about grasping the strategic impact of AI on risk. When boards recognise that a single AI‑generated exploit can bypass traditional controls, they’re far more likely to approve budgets for adaptive defenses. That’s why the gap between knowledge and action is widening — and it’s widening fast.
Practical Upskilling Paths
- Enroll senior leaders in short AI‑focused cyber risk workshops.
- Invite threat‑intel analysts to brief execs on AI‑enabled TTPs.
- Integrate AI scenario simulations into boardroom drills.
- Make AI literacy a KPI for security leadership.
Active Defense vs Legacy Infrastructure
Many firms still run on aging servers that can’t host modern AI analytics. Richards warned that trying to bolt AI tools onto legacy stacks often leads to false positives and performance bottlenecks. The result? Security teams spend more time chasing ghosts than hunting real threats. That’s why a tailored approach matters: you can’t throw a one‑size‑fits‑all AI solution at a heterogeneous environment and expect miracles.
Tailoring Strategy to Scale
Every organisation has a unique risk profile, and the defense strategy must mirror that. Small‑to‑mid‑size firms might start with cloud‑based AI threat‑intelligence feeds, while large enterprises can afford on‑prem AI engines that ingest internal telemetry. Richards emphasized that the right broker can make the difference between a coherent defense and a patchwork of broken tools. You’ve got to match the tool to the threat, not the other way around.
Legislation Lagging Behind AI Speed
Compliance frameworks still rely on disclosure windows that were drafted for slower, human‑only exploits. Richards pointed out that the law moves at a glacial pace compared with AI’s rapid exploitation cycles. When a vulnerability is disclosed today, an AI model could already be weaponising it tomorrow. That mismatch means companies must often go beyond the letter of the law to protect themselves.
Future of Disclosure Windows
We anticipate tighter, more flexible breach‑notification mandates as regulators catch up. Until then, executives should treat legal compliance as a floor, not a ceiling. By building internal rapid‑response playbooks that incorporate AI‑driven detection, organisations can shrink the gap between discovery and mitigation. It’s a proactive stance that keeps you ahead of the curve.
What This Means For You
For developers, AI’s growth‑enhanced threats means you’ll need to bake security checks into the CI/CD pipeline that can run against AI‑generated test cases. Don’t rely on static code analysis alone; integrate dynamic AI scanners that can mimic attacker behaviour. That way, you’ll catch the same flaws that an AI‑powered adversary would exploit.
For founders and tech leaders, the takeaway is clear: invest in executive AI literacy now, or risk being blindsided by the next automated attack. Prioritise budgets for adaptive AI tools, but pair them with a governance framework that keeps pace with regulatory change. The cost of inaction is no longer just a data breach — it’s a strategic disadvantage.
Security ops teams should expect a shift in alert triage. An AI‑generated alert will arrive with context that a human‑only system cannot provide. Teams that train to interpret that context will cut response times dramatically. Those that cling to legacy ticketing workflows will fall behind.
Compliance officers will need to rethink audit trails. Traditional logs may not capture the rapid iteration of AI‑crafted exploits. Embedding AI‑aware logging into critical systems creates a record that satisfies both internal risk reviews and external regulators. It also gives auditors a clearer picture of how quickly a vulnerability can be weaponised.
Will the next wave of AI‑driven exploits force a fundamental rewrite of corporate risk models, or will the market adapt fast enough to stay ahead?
Key Questions Remaining
- How can organisations balance the speed of AI‑enabled detection with the risk of over‑reliance on automated decisions?
- What governance structures will emerge to oversee the ethical use of AI in both offensive and defensive cyber operations?
- Will regulators eventually mandate AI‑specific disclosure timelines, and how will that reshape breach‑response playbooks?
- How will talent pipelines evolve to supply both AI expertise and traditional cyber‑security skills?
Sources: TechRadar, IBM
