AI enables faster vulnerability exploitation in data breaches
Threat actors are using generative AI to accelerate the exploitation of known cybersecurity vulnerabilities, compressing the response window from months to hours according to Verizon's annual incident report. Anthropic's Mythos model, which can identify vulnerabilities and devise exploitation methods, has raised widespread cybersecurity concerns.
What happened
According to Verizon's annual report on over 31,000 security incidents, AI-detected vulnerabilities surpassed stolen credentials in data breaches, with 31% of breaches starting with vulnerability exploitation. Verizon warned that threat actors are using AI 'to accelerate the time to exploit known vulnerabilities, shrinking the window for defense from months to mere hours.'
Hackers are using generative AI across all stages of attacks including targeting, initial access, and development of malware. Threat actors have researched or used AI assistance in 15 different techniques, with some using as many as 50. Anthropic's Mythos model has raised widespread cybersecurity concerns due to its high-level coding skill and ability to identify vulnerabilities and devise exploitation methods.
Reported impact
The acceleration of vulnerability exploitation enabled by AI has shortened the window for defenders to respond and patch systems, from months to hours, increasing the risk of successful attacks.
Index analysis
Verizon assessed that AI's primary current impact is operational: automating and scaling known attack techniques rather than unlocking novel attack surfaces. However, the report notes this assessment might become obsolete as AI continues to advance rapidly.
Governance controls
Verizon's chief information security officer Nasrin Rezai stated: 'We need to fight AI with AI. We need to incorporate them into our practices. We need to bring them into our software development life cycle, in our testing processes, in our cyber defense processes at a scale that we have never done before.'
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.