AI Amplifies Existing Attack Vectors Without Changing Fundamentals
In the AI era, phishing remains the leading attack vector, appearing in 17% of breaches and contributing to an average breach cost of $5.29 million, according to the IBM Cost of a Data Breach Report 2026. While AI enables more personalized and convincing phishing content, leading to higher success rates, it does not introduce novel attack techniques. Instead, it accelerates familiar tactics such as initial compromise via phishing, privilege escalation, and lateral movement across networks.
Steve Wallin, director of core integration and R&D labs leader at IBM UK, emphasized that AI’s primary impact is temporal: it allows attackers to execute known attack patterns much faster and at unprecedented scale. "It just allows attackers to do the same familiar things much faster and at greater scale than ever before. The pressure comes from minimizing the time for defenders to respond," Wallin stated.
Defenders Must Adapt to Shrinking Response Windows
Although AI-generated attacks currently represent a minority — just over 20% of all incidents — their growing prevalence signals an imminent shift. Wallin warned that organizations must act now to strengthen defenses before AI-driven threats become dominant. The core challenge is not new technology but reduced dwell time: defenders have less opportunity to detect and contain intrusions.
According to Wallin, effective defense begins with self-awareness: "Organizations must understand their existing security posture." This aligns with the ancient principle of 'know thyself' and underpins a shift from reactive to proactive security. Proactive defense involves understanding attack methodologies, mapping enterprise infrastructure and business processes, and preparing for diverse scenarios through security by design.
Zero Trust and Resilience as Foundational Strategies
Wallin advocated for zero trust as a critical framework, noting that traditional perimeter defenses are obsolete. "You can no longer build a moat or wall around the infrastructure, so zero trust security by design must be built into the infrastructure, the applications, the API entry points, and the data management," he said. This approach requires a deep understanding of what data and systems are most valuable to the business.
John Kindervag, creator of the zero trust model, echoed this view in his book Cyber Resilience at Machine Speed: The Zero Trust Model for the AI Era. He clarified that while AI-generated traffic moves faster, it still relies on the same network pathways as traditional attacks. "Any AI-generated packet still has to move across the same network that attackers have always had to traverse – and correctly implemented zero trust can still halt it," Kindervag told SecurityWeek.
Both experts agree that AI has not altered cybersecurity fundamentals but has increased the statistical likelihood of breaches. This makes resilience more urgent. Defensive use of AI can assist in prioritizing risks, automating vulnerability discovery, and improving continuous monitoring — but it does not eliminate risk.
Recovery and Continuity Are Non-Negotiable Components
Wallin stressed that resilience must include recovery capabilities to ensure business continuity after an incident. Since no defense is foolproof, organizations need robust data restoration mechanisms. A cyber vault — whether built internally using air-gapping and write-once-read-many (WORM) technology or acquired externally — is essential for rapid recovery.
He cited the IBM Z mainframe’s cyber vault as an example, designed for high-assurance environments like banking and financial services. It provides automated validation, forensic analysis, and immutable backups to enable swift testing and restoration of corrupted data.
Ultimately, AI has not changed the core principles of cybersecurity. It has intensified the need for disciplined, proactive measures: knowing your environment, implementing zero trust by design, building resilience, and ensuring recoverability. As Wallin concluded, the fundamentals remain — but the stakes are higher, and the window to act is narrowing.
Source: SecurityWeek