📊 Full opportunity report: The Frameworks Can’t See the Thing That Matters: A Year of AI-Enabled Cyber Threats on ThorstenMeyerAI.com — validation score, market gap, and execution plan.
TL;DR
A recent analysis shows AI is increasingly used by cybercriminals to enhance attack capabilities, especially post-compromise activities. Traditional threat indicators like technique count and tool choice no longer reliably predict danger, complicating defense efforts.
A new analysis from Anthropic reveals that cyber attackers are increasingly using AI to perform complex, post-intrusion activities, making threat assessment more difficult for security teams. This shift challenges the traditional metrics used to gauge attacker danger, with AI enabling even less skilled actors to carry out sophisticated operations.
Anthropic examined 832 accounts banned for malicious activity between March 2025 and March 2026, mapping their techniques onto the MITRE ATT&CK framework. The study found that 67.3% of these actors used AI to prepare for attacks, primarily for malware creation. Significantly, AI use shifted from initial access techniques to post-compromise activities such as lateral movement, which increased from 33% to 56% within the year.
Furthermore, AI’s role in activities like account discovery and lateral movement grew, while traditional methods like phishing declined slightly. This indicates a trend toward deeper, more complex attacks once inside a network. The report notes that AI now allows less skilled actors to perform tasks previously requiring expertise, undermining the assumption that only highly skilled hackers pose serious threats.
The frameworks can’t see the thing that matters
For decades, danger meant which techniques an attacker commands. A year of real AI-enabled attacks — 832 banned accounts mapped onto MITRE ATT&CK — shows that signal breaking, just as a new, harder-to-see one takes over.
A year of real misuse, mapped to the standard taxonomy
A window, not a census — these are the cases with enough detail to assess techniques thoroughly. Inside it, the risk level climbed fast.
WHAT WAS STUDIED
THE RISK CLIMB · MEDIUM-OR-HIGHER ACTORS
cybersecurity threat detection tools
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
“More techniques” stopped meaning “more dangerous”
The old heuristic: count the techniques, judge the tooling. AI dissolved it — because the model supplies the techniques either way. Watch the old signal fail, then watch what it misses.
Risk score vs. technique count
Two ways to read the same attacker. One is going blind. Press play.
AI-powered malware analysis software
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Deeper into the attack — and into less-skilled hands
Across the year, AI use drifted from getting in toward acting once already inside — the operationally demanding stages that used to require an expert.
The attack lifecycle · where AI is now applied
The center of gravity moved right — toward post-compromise work.
network intrusion detection system
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
From “what they know” to “what they’ve built”
The report sorts the signals into three tiers — one dead, one fading, one durable.
Technique count & tooling
16 vs. 20 between novice and expert; platform doesn’t correlate. The model supplies the techniques either way.
Where in the lifecycle AI is applied
Concentrating on operationally demanding, post-compromise stages is a better signal — but it’s eroding as the whole population heads there.
The scaffolding around the model
Architectures that let the model chain stages and run with minimal human input. Not what they know — whether they’ve built a system that lets AI run the attack.
cyber attack simulation kits
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Fixing the map before the territory moves again
A taxonomy that can’t name the most dangerous behavior on the field will quietly mislead the people relying on it. The response runs in two directions.
Fed back into the models
The findings informed safeguards on the most capable models, built to detect & block some of what was observed:
- Blocking malware development
- Blocking mass data exfiltration
- Putting tools in defenders’ hands first (Project Glasswing)
Taking it to the source
Following the Verizon work, Anthropic says it’s in discussions with MITRE about how ATT&CK might evolve:
- A vocabulary for agentic orchestration
- Naming the scaffolding that makes a model an operator
- An interactive technique visualization on the Red blog
Reading it in proportion
- The 832 cases are a detailed subset, not the full population — the precise percentages are directional, not definitive.
- “More autonomous” is not “fully autonomous” — even the standout case needed human input at key moments, which is itself a place for defenders to intervene.
- This is one vendor’s window — the company with visibility into misuse of its own model, publishing what it found. The right thing to do with the data, and worth remembering as you read it.
Impact of AI on Threat Detection and Risk Assessment
This development signifies a fundamental shift in cyber threat dynamics. As AI democratizes advanced attack techniques, traditional indicators such as the number of techniques used or the platform employed no longer reliably distinguish high-risk actors from amateurs. This erosion of existing threat signals complicates defense strategies and calls for new detection approaches that account for AI-enabled capabilities.
Evolution of Cyberattack Techniques and AI Integration
Historically, threat assessment relied on the assumption that more techniques and sophisticated tools indicated greater danger. Prior to this report, security frameworks focused on identifying skilled actors based on their technical diversity and toolset. The rise of AI, however, has begun to blur these lines, as even less experienced actors can now perform complex, operational tasks within compromised networks.
The analysis aligns with broader concerns about AI’s role in cybersecurity, echoing warnings from security experts about the need to update threat models to reflect AI-enabled attack capabilities.
“Our findings show that attackers are increasingly leveraging AI for complex, post-intrusion activities, which significantly raises the threat level across the board.”
— Anthropic report author
Unclear Aspects of AI’s Future Impact on Cybersecurity
It remains uncertain how quickly threat detection methods will adapt to these changes or whether new frameworks will emerge to better identify AI-enabled threats. The long-term implications of democratized attack capabilities are still being studied, and the full scope of AI’s impact on cyber risk is not yet clear.
Next Steps in Addressing AI-Driven Cyber Threats
Security professionals and researchers are expected to develop new detection models that account for AI-enabled attack behaviors. Further studies will likely explore how to identify subtle signals of AI-driven activity and how to update threat assessment frameworks accordingly. Monitoring the evolution of attacker tactics will remain critical as AI technology continues to advance.
Key Questions
How is AI changing the way cyber attackers operate?
AI allows attackers to perform complex tasks like lateral movement and account discovery more easily, even for less skilled actors, shifting the threat landscape towards more sophisticated post-intrusion activities.
Why are traditional threat indicators no longer reliable?
Because AI enables attackers to perform similar techniques regardless of their skill level, the number of techniques used or the platform they choose no longer correlates with threat severity.
What can security teams do to adapt to these changes?
Teams need to develop new detection methods that focus on behavioral signals and contextual analysis rather than just technique count or tool signatures, to better identify AI-enabled threats.
Is this trend likely to accelerate?
Given the rapid advancement of AI technology and its decreasing cost, it is likely that AI-enabled attack techniques will become more widespread and sophisticated in the near future.
Source: ThorstenMeyerAI.com
