AI-Driven Cyberattacks Expose Growing Gap Between Attack Speed and Enterprise Defense

Artificial intelligence is reshaping the cybersecurity threat landscape, enabling attackers to discover vulnerabilities, chain exploits and execute social-engineering campaigns at a speed that increasingly outpaces traditional enterprise defenses.

The emerging threat is forcing organisations to reconsider security strategies built around manual monitoring, alert triage and conventional authentication, as machine-driven attacks place greater pressure on already stretched security teams.

In an open letter issued in late August, OpenAI, Anthropic, Google, Microsoft, AWS and more than 100 technology leaders warned governments and enterprises that AI-enabled threats are expected to become increasingly sophisticated.

The coalition argued that the existing security status quo will not be sufficient, identifying weak authentication, excessive permissions, misconfigurations and legacy technical debt among the vulnerabilities most exposed to machine-driven exploitation.

AI Raises the Speed of the Attack

According to David Brauchler, Technical Director and Head of AI and ML Security at NCC Group, AI is changing the economics of cyberattacks by making previously difficult activities faster and more accessible to threat actors. “AI has raised the floor of what attackers consider low-hanging fruit,” Brauchler said, arguing that organisations can no longer rely on obscurity as a security strategy.

The warning comes amid a series of cyber incidents and disclosures highlighting the potential consequences of increasingly automated attacks.

Water and wastewater utilities in at least seven US states reported cyberattacks beginning in late July, according to an FBI and EPA public service announcement. OpenAI also disclosed a July security experiment in which AI agents gained unauthorised access to Hugging Face while conducting cybersecurity tasks in what researchers believed was a secure testing environment.

Against this backdrop, the technology leaders' open letter called for greater collaboration between governments, technology companies, cybersecurity professionals and enterprises.

It also urged frontier AI companies to provide responsible model access, funding, training and hands-on support, particularly to defenders protecting critical infrastructure.

The Password Problem Gets Bigger

The acceleration of AI-driven attacks is also putting renewed pressure on one of the oldest components of enterprise security: passwords.

Thi Nguyen-Huu, CEO of cybersecurity company WinMagic, argued that organisations need to rethink authentication in an environment where attackers increasingly steal rather than guess credentials.

According to Nguyen-Huu, compromised credentials from previous breaches can be reused against new systems, while attackers can also target additional authentication factors and session credentials.

He advocated stronger cryptographic approaches capable of verifying both users and the devices they are using.

One model he highlighted is mutual Transport Layer Security (mTLS), which enables both client and server to authenticate each other using digital certificates.

Such approaches could become increasingly relevant as enterprises seek authentication systems that are more resistant to credential theft and automated attacks. Enterprises Are Finding Vulnerabilities Faster Than They Can Fix Them

Robbie Mueller, Technical Lead for Cybersecurity at application security platform ArmorCode, said AI-driven attacks are intensifying a problem that already exists inside many enterprises: the growing gap between vulnerability discovery and remediation.

According to Mueller, the average enterprise operates more than 40 security scanners that collectively generate millions of findings, while security teams remediate only about one in 10 open vulnerabilities each month.

“It’s a capacity problem,” Mueller noted, noting that discovering vulnerabilities has become easier while fixing them remains constrained by unclear ownership, competing priorities and fragmented workflows.

The implication is significant: if attackers continue increasing the speed and volume of exploitation while organisations maintain the same remediation capacity, the security gap will continue to widen.

Exploitability Matters More Than Alert Counts

Security teams may therefore need to move away from measuring their exposure primarily by the number of vulnerabilities or alerts generated.

Mueller argued that the more important question is which vulnerabilities can be combined into a realistic attack path leading to a valuable business target.

Once that path is disrupted, he said, the risk can be reduced either by fixing one of its links or introducing an effective mitigating control.

This approach shifts enterprise cybersecurity from counting vulnerabilities to understanding business risk.

It also creates an opportunity for AI to assist defenders, provided human oversight remains in place.

Automation Needs Human Oversight

Brauchler said organisations can use AI tools and cybersecurity partners to accelerate vulnerability discovery and reduce the time required to patch identified weaknesses.

However, he cautioned against treating AI as a completely autonomous security solution.

According to Brauchler, current AI tools are not sufficiently reliable to operate without human oversight, while fully automated patch-to-production pipelines could introduce new vulnerabilities if changes are deployed without adequate validation.

The priority, therefore, should be to identify bottlenecks in patch management and enable security teams to review, validate and deploy mitigations closer to the speed at which vulnerabilities are being discovered.

Passwordless Security Gains Momentum

Mueller also argued that enterprises should begin moving towards passwordless authentication, particularly for high-value systems.

He recommended phishing-resistant multifactor authentication, including passkeys and hardware security keys.

For systems that cannot immediately transition away from passwords, password managers could serve as an interim measure while organisations develop migration plans aligned with established authentication guidelines.

The broader objective is to make stolen credentials significantly less useful to attackers.

The Answer May Not Be More Security Tools

Despite the growing sophistication of AI attacks, Mueller cautioned that adding more security products alone will not necessarily close the enterprise security gap.

Instead, organisations need a clearer understanding of their existing systems, vulnerabilities and exposure points before determining where additional controls are required.

The focus should then shift from raw vulnerability numbers to real-world exploitability and business impact.

Automation can play a role by handling repetitive processes such as triage, assigning ownership, creating tickets, escalating issues and verifying remediation.

The objective is to eliminate delays between vulnerability discovery and action.

As Mueller put it, many of the delays occur during hand-offs between teams. Closing those operational gaps could increase remediation capacity without necessarily requiring organisations to add more personnel.

A New Cybersecurity Operating Model

The emerging AI threat environment is therefore presenting enterprises with a broader challenge than simply defending against more sophisticated attacks.

It is exposing the limitations of security processes designed for a slower threat environment.

For enterprises, the emerging priorities include stronger authentication, faster remediation, exploitability-based risk assessment, cross-team visibility, infrastructure awareness and carefully governed AI-assisted security operations.

The central challenge is increasingly clear: attackers can operate at machine speed, while many enterprise defenses still depend on human-speed processes.

Closing that gap may become one of the defining cybersecurity priorities of the AI era.