📊 Full opportunity report: The Frameworks Can’t See the Thing That Matters: A Year of AI-Enabled Cyber Threats on ThorstenMeyerAI.com — validation score, market gap, and execution plan.
TL;DR
A recent report shows AI is significantly increasing the sophistication and danger of cyberattacks in 2026. Attackers now use AI for complex tasks, blurring the lines between skilled and unskilled actors, which undermines existing threat assessment frameworks.
New research from Anthropic indicates that AI is fundamentally changing the landscape of cyber threats in 2026, making attackers more dangerous and harder to distinguish using traditional methods.
Anthropic examined 832 accounts banned for malicious activity over a year, mapping their techniques onto the MITRE ATT&CK framework. The findings reveal that AI is predominantly used to automate attack preparation, such as malware creation, with 67.3% of actors employing AI for this purpose.
More notably, AI’s role in complex attack activities, like lateral movement within networks, increased from 33% to 56% over the year, indicating a shift toward deeper, post-infiltration techniques. AI-assisted lateral movement rose 8.9%, while AI-driven phishing decreased by 8.6%, showing attackers focus more on operational activities once inside a system.
This trend suggests that AI lowers the barrier for less skilled actors to perform sophisticated, post-breach actions, challenging the assumption that only highly skilled hackers can execute such techniques. The report emphasizes that the risk profile of attackers is now less tied to the number of techniques used or the tools they employ, complicating threat assessment.
The frameworks can’t see the thing that matters
For decades, danger meant which techniques an attacker commands. A year of real AI-enabled attacks — 832 banned accounts mapped onto MITRE ATT&CK — shows that signal breaking, just as a new, harder-to-see one takes over.
A year of real misuse, mapped to the standard taxonomy
A window, not a census — these are the cases with enough detail to assess techniques thoroughly. Inside it, the risk level climbed fast.
WHAT WAS STUDIED
THE RISK CLIMB · MEDIUM-OR-HIGHER ACTORS
Artificial Intelligence for Cybersecurity: How AI Detects Cyber Threats, Prevents Hacking, and Protects Your Data, Identity, and Smart Devices (AI Cybersecurity Mastery Series)
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
“More techniques” stopped meaning “more dangerous”
The old heuristic: count the techniques, judge the tooling. AI dissolved it — because the model supplies the techniques either way. Watch the old signal fail, then watch what it misses.
Risk score vs. technique count
Two ways to read the same attacker. One is going blind. Press play.
Network Intrusion Detection
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Deeper into the attack — and into less-skilled hands
Across the year, AI use drifted from getting in toward acting once already inside — the operationally demanding stages that used to require an expert.
The attack lifecycle · where AI is now applied
The center of gravity moved right — toward post-compromise work.
Cyber Threat Intelligence: A Hands-On Guide to Threat Modeling, Intelligence Gathering, Forensics, and Operational Security Workflows (Rheinwerk Computing)
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
From “what they know” to “what they’ve built”
The report sorts the signals into three tiers — one dead, one fading, one durable.
Technique count & tooling
16 vs. 20 between novice and expert; platform doesn’t correlate. The model supplies the techniques either way.
Where in the lifecycle AI is applied
Concentrating on operationally demanding, post-compromise stages is a better signal — but it’s eroding as the whole population heads there.
The scaffolding around the model
Architectures that let the model chain stages and run with minimal human input. Not what they know — whether they’ve built a system that lets AI run the attack.
The Art of Mac Malware, Volume 1: The Guide to Analyzing Malicious Software
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Fixing the map before the territory moves again
A taxonomy that can’t name the most dangerous behavior on the field will quietly mislead the people relying on it. The response runs in two directions.
Fed back into the models
The findings informed safeguards on the most capable models, built to detect & block some of what was observed:
- Blocking malware development
- Blocking mass data exfiltration
- Putting tools in defenders’ hands first (Project Glasswing)
Taking it to the source
Following the Verizon work, Anthropic says it’s in discussions with MITRE about how ATT&CK might evolve:
- A vocabulary for agentic orchestration
- Naming the scaffolding that makes a model an operator
- An interactive technique visualization on the Red blog
Reading it in proportion
- The 832 cases are a detailed subset, not the full population — the precise percentages are directional, not definitive.
- “More autonomous” is not “fully autonomous” — even the standout case needed human input at key moments, which is itself a place for defenders to intervene.
- This is one vendor’s window — the company with visibility into misuse of its own model, publishing what it found. The right thing to do with the data, and worth remembering as you read it.
Implications for Cybersecurity Threat Assessment
The rise of AI-enabled attack techniques means traditional threat indicators, such as the number of techniques or tool sophistication, are no longer reliable. This development risks making threat evaluation less precise, potentially allowing less skilled actors to carry out highly damaging operations. As attackers focus more on operational activities, defenders must reconsider how they identify and prioritize threats, emphasizing behavioral and contextual signals over technical complexity alone.
Evolution of Cyberattack Techniques in the AI Era
Historically, threat assessment relied on the diversity of attack techniques and the sophistication of tools used by cybercriminals. The MITRE ATT&CK framework has been a standard for categorizing attacker tactics. However, recent developments show that AI is automating complex tasks, reducing the importance of skill level and technique variety as indicators of threat severity. The trend toward AI-assisted lateral movement and post-compromise activities marks a significant shift in attack patterns observed over the past year, as detailed in Verizon’s 2026 Data Breach Investigations Report and Anthropic’s analysis.
“The traditional indicators of threat level—technique count and tooling—are no longer reliable in the AI era.”
— Anthropic research team
Unclear Impact of AI on Threat Detection Capabilities
It remains unclear how cybersecurity defenses will adapt to these changes, and whether new detection methods can effectively identify AI-automated threats. The extent to which AI is used by less sophisticated actors versus highly skilled groups is still being studied, and the long-term evolution of attack techniques is uncertain.
Next Steps for Cybersecurity Defense Strategies
Security organizations are likely to focus on developing behavioral analysis and contextual threat detection methods that do not rely solely on technical indicators. Monitoring AI activity within networks and understanding the scaffolding around AI models used by attackers will be key. Further research is expected to explore how threat actors are building and deploying AI tools, and how defenders can counter these tactics effectively.
Key Questions
How is AI changing the skill level required for cyberattacks?
AI automates many complex tasks, enabling less skilled actors to perform sophisticated attack activities that previously required expertise, such as lateral movement and account discovery.
Why can’t traditional threat assessment methods detect these new AI-enabled attacks?
Because the number of techniques and the tools used no longer correlate with threat severity, as AI allows even low-skilled actors to perform high-impact activities, rendering old heuristics ineffective.
What should cybersecurity teams do to adapt to this shift?
Teams should focus on behavioral and contextual analysis, monitor AI activity, and develop new detection frameworks that account for AI-driven attack patterns.
Are all attackers using AI in the same way?
No, some use AI primarily for attack preparation like malware creation, while others employ it for post-breach activities like lateral movement. The degree and purpose vary among threat actors.
Source: ThorstenMeyerAI.com
