📊 Full opportunity report: The Frameworks Can’t See the Thing That Matters: A Year of AI-Enabled Cyber Threats on ThorstenMeyerAI.com — validation score, market gap, and execution plan.
TL;DR
A year-long analysis shows AI is transforming cyber threats by enabling less skilled actors to perform complex attacks. Traditional threat assessment methods are no longer effective, raising new security challenges.
New research from Anthropic indicates that AI is significantly increasing the danger posed by cyber attackers, with malicious actors now capable of executing complex techniques traditionally reserved for highly skilled hackers. This development challenges the longstanding methods security teams use to assess threat levels, making it a critical concern for cybersecurity in 2026.
Anthropic analyzed 832 accounts banned for malicious activity between March 2025 and March 2026, mapping their techniques onto the MITRE ATT&CK framework. The findings show a marked increase in AI use for preparing and executing cyberattacks, especially in activities like lateral movement and account discovery, which now involve less skilled actors.
Over the year, the proportion of actors classified as medium risk or higher rose from 33% to 56%, with a notable shift toward AI-assisted activities within already compromised networks. Importantly, the report highlights that AI enables less experienced actors to perform technically demanding tasks, undermining traditional threat assessment heuristics that focused on the number of techniques and tools used.
Consequently, the correlation between an attacker’s skill level and their apparent technical complexity has weakened, as AI supplies techniques regardless of the actor’s expertise. This trend suggests that threat evaluation based solely on techniques or tool usage is increasingly unreliable, complicating defense strategies.
The frameworks can’t see the thing that matters
For decades, danger meant which techniques an attacker commands. A year of real AI-enabled attacks — 832 banned accounts mapped onto MITRE ATT&CK — shows that signal breaking, just as a new, harder-to-see one takes over.
A year of real misuse, mapped to the standard taxonomy
A window, not a census — these are the cases with enough detail to assess techniques thoroughly. Inside it, the risk level climbed fast.
WHAT WAS STUDIED
THE RISK CLIMB · MEDIUM-OR-HIGHER ACTORS
Python Scripting for Cybersecurity: Linux Edition: Volume 2 – Log Analysis, Network Visibility, and Threat Detection with Hands-On Python Projects
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
“More techniques” stopped meaning “more dangerous”
The old heuristic: count the techniques, judge the tooling. AI dissolved it — because the model supplies the techniques either way. Watch the old signal fail, then watch what it misses.
Risk score vs. technique count
Two ways to read the same attacker. One is going blind. Press play.
WatchGuard Firebox T145 with 1 Year Basic Security Suite – Tabletop Firewall, 2.5Gb, 1Gb & SFP Ports, Enterprise Security for Branch Locations (WGT145031)
Watchguard T145 Firebox with 1 Year Basic Security Suite License (WGT145031) – The Firebox T145 delivers enterprise-grade protection…
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Deeper into the attack — and into less-skilled hands
Across the year, AI use drifted from getting in toward acting once already inside — the operationally demanding stages that used to require an expert.
The attack lifecycle · where AI is now applied
The center of gravity moved right — toward post-compromise work.
The Practice of Network Security Monitoring: Understanding Incident Detection and Response
Used Book in Good Condition
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
From “what they know” to “what they’ve built”
The report sorts the signals into three tiers — one dead, one fading, one durable.
Technique count & tooling
16 vs. 20 between novice and expert; platform doesn’t correlate. The model supplies the techniques either way.
Where in the lifecycle AI is applied
Concentrating on operationally demanding, post-compromise stages is a better signal — but it’s eroding as the whole population heads there.
The scaffolding around the model
Architectures that let the model chain stages and run with minimal human input. Not what they know — whether they’ve built a system that lets AI run the attack.
cyber attack simulation kits
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Fixing the map before the territory moves again
A taxonomy that can’t name the most dangerous behavior on the field will quietly mislead the people relying on it. The response runs in two directions.
Fed back into the models
The findings informed safeguards on the most capable models, built to detect & block some of what was observed:
- Blocking malware development
- Blocking mass data exfiltration
- Putting tools in defenders’ hands first (Project Glasswing)
Taking it to the source
Following the Verizon work, Anthropic says it’s in discussions with MITRE about how ATT&CK might evolve:
- A vocabulary for agentic orchestration
- Naming the scaffolding that makes a model an operator
- An interactive technique visualization on the Red blog
Reading it in proportion
- The 832 cases are a detailed subset, not the full population — the precise percentages are directional, not definitive.
- “More autonomous” is not “fully autonomous” — even the standout case needed human input at key moments, which is itself a place for defenders to intervene.
- This is one vendor’s window — the company with visibility into misuse of its own model, publishing what it found. The right thing to do with the data, and worth remembering as you read it.
AI’s Role in Democratizing Cyberattack Capabilities
This shift means that cyber threats are becoming more accessible to a broader range of malicious actors, including less skilled individuals. The ability of AI to automate complex attack techniques reduces the barrier to entry, raising the overall threat level and challenging existing security paradigms. Organizations must now reconsider how they assess and prioritize threats, as traditional indicators of attacker skill no longer reliably predict danger.
Evolving Threat Landscape and AI’s Impact
Historically, cybersecurity threat assessment relied on analyzing the techniques, tools, and interfaces used by attackers to gauge their skill and danger level. The MITRE ATT&CK framework has been central to this approach. However, recent developments show that AI models are now performing sophisticated tasks—such as lateral movement and account discovery—that previously required high expertise. This evolution aligns with broader trends of AI integration into malicious activities, as documented in recent security reports and analyses.
“The traditional correlation between skill and technique complexity no longer holds, as AI supplies many of the techniques previously associated with expertise.”
— Anthropic report authors
Unclear Extent and Future of AI-Driven Attacks
While the report provides a snapshot of the past year’s activities, it remains unclear how widespread and sustained these trends will be beyond March 2026. The full scope of AI’s role in democratizing cyberattack capabilities and the development of countermeasures is still emerging. Additionally, how threat actors might evolve in response to increased detection challenges is not yet known.
Monitoring AI-Enhanced Threats and Updating Defense Strategies
Security teams will need to adapt by developing new threat assessment tools that account for AI-enabled techniques. Continued research and real-time monitoring of attack patterns are essential to understand how threat actors evolve. Future efforts may include refining AI detection methods and reassessing risk models to better identify high-risk actors regardless of their apparent technique complexity.
Key Questions
How is AI changing the way cyber attackers operate?
AI is enabling attackers to perform complex tasks such as lateral movement and account discovery with less skill, making attacks more accessible and dangerous.
Why are traditional threat assessment methods becoming less effective?
Because AI supplies many of the techniques previously linked to attacker skill, the number of techniques used no longer reliably indicates threat level.
What can organizations do to improve cybersecurity in light of these trends?
Organizations should update their threat detection approaches to account for AI-enabled techniques and focus on signals beyond just technique count or tool used.
Is this trend likely to continue or accelerate?
While the report indicates a significant shift over the past year, ongoing developments in AI and cybersecurity suggest these trends may continue or intensify, requiring constant vigilance.
Source: ThorstenMeyerAI.com
