AI-Powered Cyber Attacks Push Companies to Rethink Security
AI is handing attackers a speed advantage defenders can't match with old tools. Here's how the industry is responding.
Key points
- 88% of organizations plan to increase spending on offensive security strategies, per Omdia research published in 2026.
- AI-assisted attacks have cut the time from flaw discovery to exploitation from weeks to hours.
- 99% of organizations treat software supply chain security as a board-level concern.
Cybersecurity professionals packed into Las Vegas this summer for Black Hat USA 2026, and one theme kept coming up: attackers are using AI to move faster than defenders can react. As first reported by ThreatVectr, companies are responding by spending more on offensive security, where experts attack their own systems to find weaknesses before criminals do.
Why is AI changing security?
AI lets attackers find and exploit flaws faster than human teams can track. Penetration testing and red teaming, where security professionals simulate real-world attacks to surface weaknesses, can't keep pace when the window between discovery and exploitation has shrunk from weeks to hours. Theresa Lanowitz, principal analyst at Omdia, told the Dark Reading News Desk that the old methods are broken: "Those traditional cybersecurity practices that we've been using in offensive security, they're no longer working."
Omdia's 2026 research found 88% of organizations are ready to spend more on offensive strategies. Our earlier coverage on 28 August found companies already turning to AI to prioritize which vulnerabilities to fix first, and the pressure has only grown since.
Should we be worried about AI defenders?
Yes, and most organizations already are. AI agents, meaning programs that act on their own to complete tasks, can scan continuously for weaknesses. But they also carry real risks: they can be manipulated by crafted inputs, act in ways their operators didn't intend, and rack up steep computing costs. Lanowitz put it plainly: "You want to limit the blast radius of what that agent is actually able to do." In practice that means running agents inside sandboxes, sealed-off environments where a rogue program can't touch the wider network.
What does this mean for ordinary people?
For most of us the effect is real, even if it's indirect. A company whose defenses lag behind attackers puts customer records and financial data at risk. Breaches that once unfolded over months can now happen across a single weekend. Lanowitz's research also flags that AI is embedded in HR, accounting, and finance systems, which means every department is now part of the attack surface, not just IT.
If you work somewhere large, the practical upshot is simple: security prompts and unusual login checks aren't bureaucratic noise. They're the human layer that no AI agent has replaced yet.
Common questions
How can companies protect themselves against AI threats?
Companies need investment in both offensive and defensive AI strategies: security teams that simulate attacks, and AI agents that monitor for weaknesses continuously.
What should individuals do to protect their data?
Follow your organization's security guidelines and treat login prompts seriously. They exist because the human layer still matters.
Are AI tools reliable for cybersecurity?
Powerful, yes. Reliable without oversight, no. AI agents need human checks to ensure they don't become liabilities themselves.
