The integration of artificial intelligence (AI) into everyday work and life has prompted businesses and regulatory bodies to take action. AI is a force introducing entirely new categories of threat, making heightened cyber resilience essential. However, amidst the panic to get in front of this, it should be noted that not all the hype is entirely accurate.
Vice President and Global Head of Pentesting at LevelBlue.
The underlying vulnerabilities organizations face today are largely the same ones they faced five or ten years ago: unpatched systems, weak identity controls, excessive privileges, insecure third-party integrations.
In some cases, these weaknesses have existed for some time, and most likely, will continue to exist because the first fundamental constraint of computer science is that the removal of all vulnerabilities is impossible. Therefore, no amount of tooling or budget will ever make any business 100% secure. Equally, that doesn’t mean improvements should simply be dismissed – especially in the age of AI.
Latest Videos FromTechRadar
Speed, not novelty
While not introducing anything inherently new, there is still some cause for concern surrounding AI. The nature of existing weaknesses remains the same. However, AI does significantly change the speed and scale at which they can be identified and exploited. Tasks that once required time, skill, and persistence can now be automated, accelerated, and in some cases delegated.
The barrier to entry has been lowered for less sophisticated actors to operate with greater efficiency and success.
We are already seeing early signs of this shift. Elements of the attack lifecycle can be automated, be that reconnaissance or lateral movement. Nation-state actors have begun experimenting with using these systems to coordinate multi-stage operations, and we’ve recently seen a fully autonomous attack take place, without any human supervision.
At the same time, more familiar techniques are being enhanced rather than replaced. Malware can be generated or iterated more quickly to evade detection. Social engineering has become more convincing through deepfakes, and phishing campaigns have become easier to scale.
None of this represents a fundamentally new playbook, simply the acceleration of an existing one.
The distraction problem
The distinction between novelty and speed matters because it shapes how organizations respond. If AI is treated as a novel and exceptional threat, it encourages a reactive mindset. Security teams are pushed towards finding “AI-specific” solutions, often at the expense of addressing longstanding gaps in their environment. In practice, those gaps still remain the most reliable entry points for attackers.
The risk that the current level of attention on AI creates, is a form of strategic distraction. Boards and executives are rightly asking questions about AI risk, but those conversations can become detached from the basics. Patch management programs remain inconsistent. Asset inventories are incomplete. Third-party exposure is poorly understood. Identity and access management remains fragmented across systems.
These are the same issues that security professionals were tackling before the advent of AI and the technology does not take them off the board. If anything, these become more consequential as the speed of exploitation increases.
The right response
It is worth being clear about the limits of control. No organization will ever be 100% secure. There will always be unknown vulnerabilities, many of which the new frontier models will be able to fish out.
However, the idea that AI introduces risk that can be entirely “solved” is misleading. Even if advanced models identify previously unknown weaknesses, the response remains the same as it has always been: prioritize, remediate and reduce exposure over time.
For defenders, matching this increased tempo requires a combination of discipline and adaptation. Established practices such as red teaming and tabletop exercises need to evolve to incorporate AI-enabled scenarios. Incident response teams need to be prepared to handle new forms of evidence, including those generated or manipulated by AI systems.
In addition, training programs need to reflect the growing sophistication of social engineering, particularly where deepfakes and voice cloning is concerned.
AI-driven detection and response capabilities can play an important role, particularly in identifying patterns at scale. But they are not a substitute for secure-by-design principles, robust access controls, or a clear understanding of where critical data resides. Therefore, organizations should observe caution about over-rotating towards new tools without addressing foundational weaknesses.
The expansion of the attack surface through enterprise AI adoption adds another layer of complexity. Threat actors are already targeting AI workflows directly, exploiting vulnerabilities in software development environments, and using techniques such as prompt injection to manipulate system behavior.
In some cases, malicious instructions can be embedded within otherwise benign content, triggering unintended actions when processed by an AI system.
Again, these developments are best understood as extensions of familiar concepts. Input validation, supply chain risk, and data integrity have always been central to security. AI introduces new contexts in which these issues manifest, but not entirely new categories of risk.
From a governance perspective, this reinforces the need for clarity rather than novelty. Boards should be focused on defining risk tolerance, ensuring accountability, and maintaining visibility over how AI is used within the organization.
This includes integrating AI considerations into existing risk frameworks rather than treating them as a separate domain. Legal, technical, and communications teams need to be aligned, particularly in scenarios involving misinformation or synthetic media, where response speed is critical.
What matters now
There is value in the current focus on cyber risk. Increased attention at the board level can drive investment and accountability in ways that were previously difficult to achieve. But that attention needs to be directed towards the right problems. Treating AI as an entirely new threat risks misallocating resources and overlooking the vulnerabilities that are already present.
AI will continue to evolve and so will the ways in which it is used by both attackers and defenders. In cyber security, progress is often less about discovering new answers and more about applying existing ones with greeted consistency and speed.
The organizations that navigate this shift most effectively will be those that remain grounded in a clear understanding of what has and has not changed.
We’ve featured the best endpoint protection software.
This article was produced as part of TechRadar Pro Perspectives, our channel to feature the best and brightest minds in the technology industry today.
The views expressed here are those of the author and are not necessarily those of TechRadarPro or Future plc. If you are interested in contributing find out more here: https://www.techradar.com/pro/perspectives-how-to-submit
