How is AI changing offensive security for attackers and defenders?

AI is making offensive work faster and cheaper: drafting convincing messages, summarising a target's public footprint, reading code for flaws and speeding up tooling. It has not changed what defenders must do first. Patching, access control and quick detection still decide most outcomes, only on a shorter clock.

What does offensive security mean here?

Offensive security covers authorised testing, such as penetration tests and red team exercises, and also what real attackers do. The techniques overlap, so changes that help one side tend to help the other. This post treats AI as a speed and scale change and avoids detail that would work as instructions.

Where does AI help the attacker side?

Reconnaissance. Collecting and summarising public information about a company, its staff and its technology is a text task, which models do well.

Social engineering. Fluent, personalised messages in any language remove the clumsy phrasing that once gave phishing away.

Code reading. A model can read source or decompiled code and point at suspicious areas, shortening the time a skilled person spends searching.

Tooling. Writing and adapting small scripts is faster, which lowers the skill needed for routine tasks.

Treat claims of fully autonomous attacks cautiously, and check them against primary reports before repeating them. Much of the current evidence is vendor demonstration, not independent measurement.

What does it do to AI systems themselves?

AI features are also targets. MITRE ATLAS is a public knowledge base of adversary tactics and techniques against AI enabled systems, built in the style of ATT&CK. NIST AI 100-2 gives a taxonomy of attacks on machine learning, covering evasion, poisoning, privacy and misuse of generative systems. Both are useful for threat modelling your own deployments.

What changes for defenders?

Time. Cheaper, faster tooling can only shorten the window between a flaw becoming public and someone trying to exploit it, so prioritisation matters more. CISA's Known Exploited Vulnerabilities Catalog lists flaws with evidence of active exploitation, and the FIRST Exploit Prediction Scoring System gives a probability that a vulnerability will be exploited. Using both lets you spend limited patching time where attacks are most likely.

Phishing defence shifts from spotting bad grammar to verifying actions. Out of band confirmation for payments and credential resets, phishing resistant authentication and clear reporting channels hold up even when the message is perfect.

What should security testers do differently?

Authorised testers can use the same assistants to move faster, with three cautions. Keep client or customer data out of tools whose retention terms you have not read. Record which parts of a finding came from a model and verify each by hand before it goes in a report, since confident wrong statements are a known failure. And keep to the written scope: an automated agent that wanders outside it is a legal problem, however good the intent.

What stays the same?

Most intrusions still start with stolen credentials, an unpatched internet facing system or a configuration mistake. A faster attacker finds those sooner, which raises the value of fixing them. Inventory, least privilege, multifactor authentication, segmentation and tested backups remain the core.

A constructed example

A finance clerk receives an email that matches a real supplier's tone, references a genuine recent project and asks for new bank details. Reading the message gives no warning. The company's rule says any change to payment details is confirmed by a call to a number already on file, and that rule stops the fraud. The control never depended on spotting the fake.

How to check or apply this

1. Build a list of internet facing systems and patch those on the exploited list first.
2. Prioritise with exploitation evidence and likelihood, not severity score alone.
3. Move staff and administrators to phishing resistant authentication.
4. Add out of band checks for money movement and credential resets.
5. Threat model your own AI features with ATLAS and NIST AI 100-2.
6. Use AI in your own testing, under written authorisation and with the same scoping rules as any other test.
7. Shorten your measured time from advisory to patch, and report it.

Quick check

Sources

• MITRE ATLAS
• NIST AI 100-2 E2025, Adversarial Machine Learning
• CISA Known Exploited Vulnerabilities Catalog
• FIRST, Exploit Prediction Scoring System

Last reviewed: 18 October 2026.