📊 Full opportunity report: The Frameworks Can’t See the Thing That Matters: A Year of AI-Enabled Cyber Threats on ThorstenMeyerAI.com — validation score, market gap, and execution plan.
TL;DR
A year-long analysis shows AI is transforming cyberattack capabilities, making attackers more sophisticated and reducing the effectiveness of existing threat models. The use of AI for post-compromise activities has increased, blurring the lines between skilled and unskilled actors.
A recent analysis from Anthropic indicates that AI is significantly increasing the danger posed by cyberattackers, with traditional methods of threat assessment no longer reliable in distinguishing high-risk actors from amateurs. The report examines 832 banned malicious accounts and finds that AI is enabling less skilled actors to perform complex, high-impact activities inside networks.
Anthropic’s report, based on 832 accounts banned between March 2025 and March 2026, shows that AI is being used predominantly to prepare for attacks, especially in malware creation and lateral movement. Over the year, the proportion of actors classified as medium risk or higher increased from 33% to 56%, driven by AI’s growing role in post-intrusion activities.
Notably, AI’s use shifted from initial access techniques, like phishing, towards more advanced, operational activities such as account discovery and lateral movement. This shift indicates that AI is democratizing access to sophisticated attack methods, reducing the skill gap traditionally necessary for such actions. The report emphasizes that the link between an attacker’s skill level and their observed techniques is weakening, complicating threat detection and assessment.
The frameworks can’t see the thing that matters
For decades, danger meant which techniques an attacker commands. A year of real AI-enabled attacks — 832 banned accounts mapped onto MITRE ATT&CK — shows that signal breaking, just as a new, harder-to-see one takes over.
A year of real misuse, mapped to the standard taxonomy
A window, not a census — these are the cases with enough detail to assess techniques thoroughly. Inside it, the risk level climbed fast.
WHAT WAS STUDIED
THE RISK CLIMB · MEDIUM-OR-HIGHER ACTORS
Python Scripting for Cybersecurity: Linux Edition: Volume 2 – Log Analysis, Network Visibility, and Threat Detection with Hands-On Python Projects
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
“More techniques” stopped meaning “more dangerous”
The old heuristic: count the techniques, judge the tooling. AI dissolved it — because the model supplies the techniques either way. Watch the old signal fail, then watch what it misses.
Risk score vs. technique count
Two ways to read the same attacker. One is going blind. Press play.
OSINT 2.0: AI-Powered Open-Source Intelligence for Beginners (OSINT 2.0 — Artificial Intelligence for Open-Source Intelligence and Cyber Investigations Book 1)
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Deeper into the attack — and into less-skilled hands
Across the year, AI use drifted from getting in toward acting once already inside — the operationally demanding stages that used to require an expert.
The attack lifecycle · where AI is now applied
The center of gravity moved right — toward post-compromise work.
Network Intrusion Detection
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
From “what they know” to “what they’ve built”
The report sorts the signals into three tiers — one dead, one fading, one durable.
Technique count & tooling
16 vs. 20 between novice and expert; platform doesn’t correlate. The model supplies the techniques either way.
Where in the lifecycle AI is applied
Concentrating on operationally demanding, post-compromise stages is a better signal — but it’s eroding as the whole population heads there.
The scaffolding around the model
Architectures that let the model chain stages and run with minimal human input. Not what they know — whether they’ve built a system that lets AI run the attack.
Practical Threat Intelligence and Data-Driven Threat Hunting: A hands-on guide to threat hunting with the ATT&CK™ Framework and open source tools
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Fixing the map before the territory moves again
A taxonomy that can’t name the most dangerous behavior on the field will quietly mislead the people relying on it. The response runs in two directions.
Fed back into the models
The findings informed safeguards on the most capable models, built to detect & block some of what was observed:
- Blocking malware development
- Blocking mass data exfiltration
- Putting tools in defenders’ hands first (Project Glasswing)
Taking it to the source
Following the Verizon work, Anthropic says it’s in discussions with MITRE about how ATT&CK might evolve:
- A vocabulary for agentic orchestration
- Naming the scaffolding that makes a model an operator
- An interactive technique visualization on the Red blog
Reading it in proportion
- The 832 cases are a detailed subset, not the full population — the precise percentages are directional, not definitive.
- “More autonomous” is not “fully autonomous” — even the standout case needed human input at key moments, which is itself a place for defenders to intervene.
- This is one vendor’s window — the company with visibility into misuse of its own model, publishing what it found. The right thing to do with the data, and worth remembering as you read it.
Implications of AI-Enhanced Attack Capabilities
This development fundamentally alters cybersecurity threat models. As AI enables less skilled actors to carry out complex, high-impact techniques, traditional indicators of threat level—such as the number of techniques used or the tools employed—are losing their predictive power. This trend increases the risk of underestimating threats and challenges current defense strategies, requiring a reevaluation of how threat actors are identified and prioritized.
Evolution of Cyber Threat Assessment in the AI Era
Historically, cybersecurity experts assessed threat levels based on the number of techniques an attacker used and the sophistication of their tools. This approach relied on the assumption that more techniques and better tools indicated a more dangerous actor. However, recent developments show that AI is lowering the technical barriers, allowing less skilled actors to perform advanced operations previously reserved for experts. The report from Anthropic builds on prior concerns about AI’s dual role in security—both as a tool for defense and an enabler for attack.
“Our analysis shows that attackers are increasingly focusing AI on operational techniques inside networks, which are more indicative of threat level than the sheer number of techniques used.”
— Anthropic report author
Unclear Impact of AI on Long-Term Threat Detection
It is still unclear how cybersecurity defenses will adapt to these changes. While the report highlights the decline of traditional indicators, the effectiveness of new detection methods based on attack scaffolding or behavioral signals remains to be seen. Additionally, the full extent of AI’s democratization of attack capabilities, especially among less skilled actors, is still developing and not fully quantified.
Next Steps for Cybersecurity Defense Strategies
Security professionals are likely to focus on developing new detection models that account for AI-driven attack techniques, emphasizing behavioral and contextual signals over technique count. Further research will be needed to understand how attackers build and leverage AI scaffolds, and how defenses can identify these patterns early. Monitoring AI’s role in threat evolution will be critical in the coming months.
Key Questions
How is AI changing the skills required for cyberattacks?
AI is enabling less skilled attackers to perform complex activities such as lateral movement and account discovery, which previously required significant technical expertise.
Why are traditional threat indicators no longer effective?
Because AI can perform highly technical tasks on behalf of less skilled actors, the link between an attacker’s skill level and the number of techniques they use has weakened, making these indicators unreliable.
What does this mean for cybersecurity defenses?
Defenses will need to shift towards behavioral and contextual analysis, focusing on how attack scaffolds are built and used, rather than just counting techniques or tools.
Will AI make cyberattacks more frequent?
The report suggests that AI is increasing the sophistication and danger of attacks, but whether it will lead to higher frequency remains uncertain. The key concern is the increased threat level per attack.
Source: ThorstenMeyerAI.com
