📊 Full opportunity report: The Frameworks Can’t See the Thing That Matters: A Year of AI-Enabled Cyber Threats on ThorstenMeyerAI.com — validation score, market gap, and execution plan.
TL;DR
A year-long analysis shows AI is transforming cyber threats by enabling less skilled actors to carry out sophisticated attacks. Traditional threat indicators no longer reliably predict danger. This shift demands new defense strategies.
New research from Anthropic reveals that AI is significantly increasing the danger posed by cyberattackers, with less skilled actors now capable of executing complex, high-risk attacks. This development challenges longstanding threat assessment frameworks and has major implications for cybersecurity defenses.
Anthropic examined 832 accounts banned for malicious activity between March 2025 and March 2026, mapping their techniques onto the MITRE ATT&CK framework. The analysis shows that AI is mainly used to prepare for attacks, such as malware creation, with 67.3% of actors employing AI for this purpose. Notably, AI use for lateral movement and internal navigation increased over the year, with a 1.7-fold rise in threat level indicators.
Furthermore, AI’s role has shifted from initial access techniques to post-compromise activities, such as account discovery and lateral movement. The data indicates that AI now enables less skilled actors to perform tasks previously requiring expertise, leading to a democratization of attack capabilities. The threat landscape is evolving as AI-driven techniques become more accessible and sophisticated, blurring the lines between novice and advanced threat actors.
The frameworks can’t see the thing that matters
For decades, danger meant which techniques an attacker commands. A year of real AI-enabled attacks — 832 banned accounts mapped onto MITRE ATT&CK — shows that signal breaking, just as a new, harder-to-see one takes over.
A year of real misuse, mapped to the standard taxonomy
A window, not a census — these are the cases with enough detail to assess techniques thoroughly. Inside it, the risk level climbed fast.
WHAT WAS STUDIED
THE RISK CLIMB · MEDIUM-OR-HIGHER ACTORS
Python Scripting for Cybersecurity: Linux Edition: Volume 2 – Log Analysis, Network Visibility, and Threat Detection with Hands-On Python Projects
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
“More techniques” stopped meaning “more dangerous”
The old heuristic: count the techniques, judge the tooling. AI dissolved it — because the model supplies the techniques either way. Watch the old signal fail, then watch what it misses.
Risk score vs. technique count
Two ways to read the same attacker. One is going blind. Press play.
AI-powered malware analysis tools
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Deeper into the attack — and into less-skilled hands
Across the year, AI use drifted from getting in toward acting once already inside — the operationally demanding stages that used to require an expert.
The attack lifecycle · where AI is now applied
The center of gravity moved right — toward post-compromise work.
network intrusion detection system
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
From “what they know” to “what they’ve built”
The report sorts the signals into three tiers — one dead, one fading, one durable.
Technique count & tooling
16 vs. 20 between novice and expert; platform doesn’t correlate. The model supplies the techniques either way.
Where in the lifecycle AI is applied
Concentrating on operationally demanding, post-compromise stages is a better signal — but it’s eroding as the whole population heads there.
The scaffolding around the model
Architectures that let the model chain stages and run with minimal human input. Not what they know — whether they’ve built a system that lets AI run the attack.
cyber threat intelligence platform
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Fixing the map before the territory moves again
A taxonomy that can’t name the most dangerous behavior on the field will quietly mislead the people relying on it. The response runs in two directions.
Fed back into the models
The findings informed safeguards on the most capable models, built to detect & block some of what was observed:
- Blocking malware development
- Blocking mass data exfiltration
- Putting tools in defenders’ hands first (Project Glasswing)
Taking it to the source
Following the Verizon work, Anthropic says it’s in discussions with MITRE about how ATT&CK might evolve:
- A vocabulary for agentic orchestration
- Naming the scaffolding that makes a model an operator
- An interactive technique visualization on the Red blog
Reading it in proportion
- The 832 cases are a detailed subset, not the full population — the precise percentages are directional, not definitive.
- “More autonomous” is not “fully autonomous” — even the standout case needed human input at key moments, which is itself a place for defenders to intervene.
- This is one vendor’s window — the company with visibility into misuse of its own model, publishing what it found. The right thing to do with the data, and worth remembering as you read it.
Implications for Cybersecurity Threat Assessment
This report underscores a fundamental shift in cyber threat dynamics, where traditional indicators like technique diversity and tool sophistication no longer reliably distinguish dangerous actors. The increasing use of AI by less skilled attackers to perform complex tasks means that threat assessment models based on skill and technique count are outdated. Organizations must reconsider how they evaluate risk and develop new detection strategies that account for AI-enabled attack capabilities.
Evolution of Cyber Threats and AI’s Role
For decades, cybersecurity relied on the assumption that more techniques and advanced tools indicated higher threat levels. The MITRE ATT&CK framework provided a structured way to assess attacker capabilities. However, recent developments show AI’s role in automating and simplifying complex attack steps, making it easier for less experienced actors to pose significant risks. The study from Anthropic builds on prior concerns about AI in cybercrime, providing concrete data on how attack patterns are changing over the past year.
“Our analysis indicates that traditional threat indicators no longer reliably predict attacker danger, as AI enables less skilled actors to perform advanced techniques.”
— Anthropic research team
Unclear Aspects of AI-Driven Threat Evolution
It remains unclear how quickly threat actors will adopt increasingly sophisticated AI tools or how defenders can effectively counter these new techniques. The extent to which AI will automate and amplify attack campaigns across different sectors is still being studied, and the long-term impact on global cybersecurity resilience is uncertain.
Next Steps in Monitoring and Defense Strategies
Cybersecurity organizations are expected to develop new detection frameworks that incorporate AI activity patterns. Ongoing research will focus on identifying emerging attack techniques and understanding how AI-driven automation influences threat proliferation. Policymakers and security firms are likely to prioritize AI safety and attack surface reduction in response to these findings.
Key Questions
How is AI making cyberattacks more dangerous?
AI automates complex attack tasks like lateral movement and account discovery, enabling less skilled actors to carry out sophisticated attacks that previously required expertise.
Why do traditional threat indicators no longer work?
Because AI allows attackers to perform many techniques with fewer tools and less skill, making technique count and tool type unreliable indicators of threat level.
What does this mean for cybersecurity defenses?
Defenders must develop new detection methods that focus on AI activity patterns and operational signals rather than relying solely on traditional threat metrics.
Is this trend likely to accelerate?
While the data suggests increasing AI adoption in cybercrime, the pace of future adoption and its impact remain uncertain and are subject to ongoing research.
What can organizations do now?
Organizations should update their threat models, invest in AI-aware detection tools, and enhance monitoring of internal network activities for signs of AI-assisted attack techniques.
Source: ThorstenMeyerAI.com
