AI is changing cyber attacks. Is your business changing fast enough?

Cyber security has always been a race. Businesses strengthen their defences, attackers look for a way around them. Vulnerabilities are discovered, patches are released, and the cycle starts again. But AI is beginning to change the speed of that race.

Recent warnings from cybersecurity experts and the UK’s National Cyber Security Centre (NCSC) point towards a future where AI does not necessarily create entirely new ways to attack businesses. Instead, AI cyber attack methods are faster, more scalable and potentially far more disruptive.

Black October

This October, researchers raised the alarm following the discovery of serious vulnerabilities in PHP, the programming language used by a huge proportion of websites. The vulnerabilities themselves were significant, but arguably more important was how they were discovered.

Using advanced AI models, hackers uncovered weaknesses that had previously gone unnoticed, demonstrating the growing ability of AI to analyse code and identify vulnerabilities much faster than traditional methods.

For defenders, that’s potentially very useful. AI can help security teams identify weaknesses before attackers do.

The problem is, attackers get AI too. The same ability to analyse systems, identify weaknesses and automate processes could make it possible for cyber criminals and state-backed groups to find vulnerable organisations at considerably greater speed and scale.

AI is helping to industrialise cyber attacks

That concern was echoed by the NCSC in November. They warned that AI is “helping to industrialise cyber attacks” and said it is highly likely to be used in attacks against Britain’s critical national infrastructure by 2028. But one of the most important points in the warning was that AI isn’t necessarily inventing completely new attack techniques.

NCSC chief executive Richard Horne explained that vulnerabilities which businesses have tolerated for years can now be discovered and exploited at a scale that was once unimaginable.

That’s the bit businesses should be paying attention to.

The risk isn’t confined to futuristic AI-powered cyber attacks. It’s the unsupported server that hasn’t been replaced, or even the old system that’s connected to the network because “it’s always worked”.

AI has the potential to make those existing weaknesses easier to find and faster to exploit.

The consequences aren’t always digital

Perhaps the starkest part of the NCSC’s warning was its emphasis on the physical consequences of cyber attacks. The NCSC received 1,831 reports of cyber attacks over the year.

Its warning referenced a future where cyber incidents contribute to businesses failing, lights going out and supermarket shelves being left empty.

Cyber security isn’t just about protecting data anymore, it’s about business continuity. If a critical system disappeared tomorrow or a supplier went offline for a week, could your teams continue working?

Speed is becoming part of cyber resilience

At Enhanced, we’re closely watching how AI is changing both sides of cyber security.

And one thing is becoming increasingly clear: businesses can’t control how quickly attackers evolve, but they can control how prepared they are when something happens.

That means cyber resilience needs to go beyond buying another security tool. Businesses need to understand what technology they have, where their vulnerabilities sit and how quickly they can respond when a new threat emerges.

That includes:

• Maintaining visibility of assets, devices and software
• Applying critical security updates quickly
• Addressing legacy and unsupported technology
• Monitoring systems for unusual behaviour
• Using layered security controls rather than relying on one line of defence
• Testing backups and recovery procedures
• Having a documented and tested incident response plan
• Assessing the resilience of critical third-party suppliers
• Making cyber risk visible at leadership and board level

Because as the time between a vulnerability being discovered and exploited gets shorter, the businesses that can identify, respond and recover quickly are going to be in a much stronger position.

Don’t wait for AI to find your weaknesses first

There is a positive side to all of this. The technology making cyber attacks faster is also giving defenders new capabilities. AI can support threat detection, vulnerability discovery, investigation and response too. But technology alone won’t compensate for weak foundations.

The businesses best placed for the next era of cyber security won’t necessarily be the ones with the biggest security budgets. They’ll be the ones that understand their exposure, continually strengthen their environment and have a clear plan for when something goes wrong.

The message from recent events isn’t that businesses should panic about AI, it’s that the pace has changed and our approach to cyber resilience needs to change with it.

Is your cyber security keeping pace?

Cyber security is moving faster, and waiting for a vulnerability to become a problem is no longer a particularly convincing strategy.