What we learned mapping a year’s worth of AI-enabled cyber threats

Concept 1: The Basic Setup — What Was Studied

What happened?

Researchers analyzed 832 banned accounts involved in malicious cyber activity over one year (March 2025 – March 2026).

Why does this matter?

These weren't random cases. They were selected because there was enough detail to thoroughly understand how attackers operated.

Key takeaway:

Think of this as a year-long snapshot of how real cybercriminals actually used AI as a weapon.

---

Concept 2: MITRE ATT&CK — The Measuring Stick

What is it?

MITRE ATT&CK is a well-known, standardized database that catalogs:

• Tactics → Why an attacker does something (e.g., gain access, steal data)
• Techniques → How they do it (e.g., phishing, password cracking)

Analogy:

Think of it like a recipe book for cyberattacks — it lists all known ingredients and cooking methods hackers use.

Why researchers used it:

It allowed them to compare and categorize AI-assisted attacks using a common language the security community already understands.

The problem (foreshadowing):

As we'll see later, this "recipe book" is missing some new recipes that AI has introduced.

---

Concept 3: The Attack Life Cycle — A Map of an Attack

What is it?

Cyberattacks don't happen all at once. They follow stages:

Stage 1: Initial Access
    ↓ (Get inside the system)
Stage 2: Discovery
    ↓ (Look around, find accounts/data)
Stage 3: Lateral Movement
    ↓ (Move deeper into the network)
Stage 4: Privilege Escalation
    ↓ (Gain more powerful permissions)
Stage 5: Exfiltration / Damage
       (Steal data or cause harm)

Key distinction:

Why this matters:

The article reveals that AI is increasingly being used deeper in this cycle — not just to get in, but to operate inside the system.

---

Concept 4: How AI Is Being Used — The Most Common Activities

Finding #1: Writing Malware is #1

• 560 out of 832 actors (67.3%) used AI to write malicious software
• This is a pre-compromise activity — preparing for the attack

Finding #2: A Smaller Group Goes Deeper

• Only 54 actors (6.5%) used AI for lateral movement — navigating inside a compromised network
• This is a post-compromise activity

Visual breakdown:

Writing Malware:     ████████████████████ 67.3%
Lateral Movement:    ██ 6.5%

Key insight:

Most attackers use AI for preparation, but a dangerous minority use it for deeper, more complex operations.

---

Concept 5: Risk Escalation — Attackers Are Getting More Dangerous

What the data showed:

That's a ~1.7x increase in just one year.

What does "risk level" mean here?

It's a score based on how capable and dangerous an attacker is — how much damage they could realistically cause.

Why is this happening?

AI is acting as an equalizer — it gives less-skilled attackers access to capabilities that previously required deep technical expertise.

Analogy:

It's like giving someone with no cooking experience a fully automated kitchen — suddenly they can produce complex meals without knowing how to cook.

---

Concept 6: The Shift Toward Post-Compromise Activity

The trend:

Attackers are moving away from using AI just to get in, and toward using it once they're already inside.

Specific data points:

What is "account discovery"?

Once inside a network, attackers identify valid user accounts they can exploit to move further or escalate privileges.

Why this shift is alarming:

Post-compromise techniques used to require serious technical skill. AI is now doing that work for less sophisticated actors.

---

Concept 7: Traditional Risk Signals Are Breaking Down

How security teams used to assess threat level:

1. Number of techniques used → More techniques = more dangerous
2. Tools/interfaces used → API access = more sophisticated than chat interface

What the research found:

These signals no longer work reliably.

Evidence:

That's barely a difference! AI fills the skill gap.

Also:

• Whether someone used Claude Code, an API, or a simple chat interface did not predict their risk level.

Key insight:

The old "tells" that revealed a dangerous attacker are becoming unreliable because AI masks skill differences.

---

Concept 8: What Actually Distinguishes High-Risk Actors

New signal #1: Where in the attack life cycle they use AI

Higher-risk actors focus AI on operationally demanding techniques:

• Account discovery
• Lateral movement
• Privilege escalation

These require:

• Significant time
• Real-time decision making
• Ongoing oversight

New signal #2: The scaffolding they build

This is the most important concept in the article.

What is "scaffolding"?

It's the architecture an attacker builds around the AI model — the system that allows the AI to:

• Chain multiple attack steps together
• Make decisions automatically
• Operate with minimal human input

Analogy:

A basic attacker uses AI like a calculator — one question, one answer. A high-risk attacker uses AI like an autopilot system — it navigates the entire journey with occasional human checkpoints.

---

Concept 9: Agentic AI — The Most Dangerous Development

What is an "AI agent" in this context?

An AI that can:

• Execute commands on its own
• Make tactical decisions in real time
• Chain together multiple steps of an attack
• Operate with minimal human intervention

Real-world example from the article:

A state-sponsored cyber espionage operation (disrupted November 2025):

• Used Claude Code manipulated into acting as an autonomous agent
• Attempted to infiltrate targets worldwide
• Executed commands, exploited vulnerabilities, stole credentials
• Only needed human input at a few key moments

How it scored on MITRE ATT&CK:

• 30 techniques across 13 tactics → Looked like a medium-risk actor
• But applying a proper risk score: 100/100 — maximum risk

The gap this reveals:

MITRE ATT&CK has no category for "agentic orchestration" — the AI autonomously running an attack chain.

---

Concept 10: The Gap in MITRE ATT&CK — The Framework Problem

What's missing?

The framework doesn't yet capture:

Why this is a serious problem:

If defenders are using MITRE ATT&CK to assess threats, they will systematically underestimate AI-enabled attackers who use agentic methods.

What's being done:

The researchers are in discussions with MITRE to update the framework to include these new AI-enabled behaviors.

---

Concept 11: Implications for Defense

What defenders need to update:

Old approach:

• Count techniques used
• Check what tools/interfaces were used
• Match against MITRE ATT&CK

New approach:

• Assess where in the attack life cycle AI is being applied
• Look for evidence of agentic scaffolding
• Develop new framework categories for AI-orchestrated attacks

What the researchers are doing:

1. Building cyber safeguards into AI models to detect/block:
   • Malware development
   • Mass data exfiltration
2. Working with MITRE to evolve the ATT&CK framework
3. Expanding Project Glasswing (a defender-focused initiative) to 150+ organizations in 15+ countries

---

Summary: The 3 Big Conclusions

┌─────────────────────────────────────────────────────────┐
│  CONCLUSION 1: AI is elevating attacker capabilities    │
│  → Risk levels jumped 1.7x in one year                  │
│  → Post-compromise use is rising                        │
├─────────────────────────────────────────────────────────┤
│  CONCLUSION 2: Traditional risk signals are failing     │
│  → Technique count no longer predicts danger            │
│  → Scaffolding architecture is the new key signal       │
├─────────────────────────────────────────────────────────┤
│  CONCLUSION 3: MITRE ATT&CK has a blind spot            │
│  → Agentic AI behavior isn't captured                   │
│  → Framework needs to evolve urgently                   │
└─────────────────────────────────────────────────────────┘

---

The Core Mental Model

Before AI: Skill → Capability → Risk

After AI: Scaffolding Design → Autonomous Execution → Risk

The question is no longer "How skilled is this attacker?" It's "How well have they automated their attack pipeline?"