📊 Full opportunity report: The Frameworks Can’t See the Thing That Matters: A Year of AI-Enabled Cyber Threats on ThorstenMeyerAI.com — validation score, market gap, and execution plan.
TL;DR
A year-long analysis shows AI is enabling cyber attackers to become more sophisticated and dangerous, challenging existing threat assessment frameworks. Attackers now perform complex tasks previously requiring expertise, making threat detection harder.
A new analysis from Anthropic indicates that artificial intelligence is significantly increasing the danger posed by cyber attackers, rendering traditional threat assessment methods ineffective. The report, based on a review of over 800 malicious accounts, shows attackers are using AI to perform complex tasks that previously required high-level technical skills, making threat detection more challenging and riskier than before.
Anthropic examined 832 accounts banned for malicious activity between March 2025 and March 2026, mapping their techniques onto the MITRE ATT&CK framework. The findings reveal that 67.3% of these actors used AI to prepare for attacks, primarily for malware creation. More concerning is the rise in AI use for post-infiltration activities, such as lateral movement within networks, which increased from 33% to 56% over the year.
Furthermore, the report highlights a shift in attack patterns: AI use moved from initial access techniques like phishing to deeper, more operational activities once inside a network. This democratization of advanced attack techniques means less skilled actors can now perform tasks that once required expert knowledge, increasing overall threat levels.
The frameworks can’t see the thing that matters
For decades, danger meant which techniques an attacker commands. A year of real AI-enabled attacks — 832 banned accounts mapped onto MITRE ATT&CK — shows that signal breaking, just as a new, harder-to-see one takes over.
A year of real misuse, mapped to the standard taxonomy
A window, not a census — these are the cases with enough detail to assess techniques thoroughly. Inside it, the risk level climbed fast.
WHAT WAS STUDIED
THE RISK CLIMB · MEDIUM-OR-HIGHER ACTORS
Python Scripting for Cybersecurity: Linux Edition: Volume 2 – Log Analysis, Network Visibility, and Threat Detection with Hands-On Python Projects
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
“More techniques” stopped meaning “more dangerous”
The old heuristic: count the techniques, judge the tooling. AI dissolved it — because the model supplies the techniques either way. Watch the old signal fail, then watch what it misses.
Risk score vs. technique count
Two ways to read the same attacker. One is going blind. Press play.
AI-based malware analysis tools
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Deeper into the attack — and into less-skilled hands
Across the year, AI use drifted from getting in toward acting once already inside — the operationally demanding stages that used to require an expert.
The attack lifecycle · where AI is now applied
The center of gravity moved right — toward post-compromise work.
Network Intrusion Detection
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
From “what they know” to “what they’ve built”
The report sorts the signals into three tiers — one dead, one fading, one durable.
Technique count & tooling
16 vs. 20 between novice and expert; platform doesn’t correlate. The model supplies the techniques either way.
Where in the lifecycle AI is applied
Concentrating on operationally demanding, post-compromise stages is a better signal — but it’s eroding as the whole population heads there.
The scaffolding around the model
Architectures that let the model chain stages and run with minimal human input. Not what they know — whether they’ve built a system that lets AI run the attack.
cyber attack simulation kits
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Fixing the map before the territory moves again
A taxonomy that can’t name the most dangerous behavior on the field will quietly mislead the people relying on it. The response runs in two directions.
Fed back into the models
The findings informed safeguards on the most capable models, built to detect & block some of what was observed:
- Blocking malware development
- Blocking mass data exfiltration
- Putting tools in defenders’ hands first (Project Glasswing)
Taking it to the source
Following the Verizon work, Anthropic says it’s in discussions with MITRE about how ATT&CK might evolve:
- A vocabulary for agentic orchestration
- Naming the scaffolding that makes a model an operator
- An interactive technique visualization on the Red blog
Reading it in proportion
- The 832 cases are a detailed subset, not the full population — the precise percentages are directional, not definitive.
- “More autonomous” is not “fully autonomous” — even the standout case needed human input at key moments, which is itself a place for defenders to intervene.
- This is one vendor’s window — the company with visibility into misuse of its own model, publishing what it found. The right thing to do with the data, and worth remembering as you read it.
Impact of AI on Threat Assessment Frameworks
This development fundamentally challenges the long-standing methods used by cybersecurity professionals to evaluate threat levels. The traditional correlation between the number of techniques used and attacker danger no longer holds, as AI enables even less skilled actors to perform complex, high-risk activities. This shift increases the difficulty of accurately assessing threats and prioritizing responses, potentially leaving organizations more vulnerable to sophisticated attacks.
Evolution of Cyberattack Techniques with AI
Historically, threat assessment relied on the assumption that more techniques and advanced tools indicated higher danger. The MITRE ATT&CK framework has been a standard for categorizing attack methods. However, recent developments show AI’s role in automating and simplifying complex tasks, allowing a broader range of attackers to execute sophisticated operations without extensive expertise. This trend has accelerated over the past year, driven by advances in frontier AI models.
“Once AI is involved, the link between an attacker’s skill level and the techniques they employ becomes increasingly tenuous.”
— Anthropic’s research team
Unclear Long-Term Impacts of AI-Driven Attacks
It remains uncertain how threat detection frameworks will adapt to this rapid evolution. While the report highlights current trends, the full extent of AI’s influence on future attack sophistication and the effectiveness of existing defense mechanisms is still developing. The pace of AI advancement and attacker adaptation continues to be unpredictable.
Next Steps for Cybersecurity Defense Strategies
Organizations will need to overhaul threat assessment models to account for AI-enabled attack capabilities. Developing AI-aware detection tools and updating threat intelligence practices are likely priorities. Continued research and real-time monitoring of attack patterns will be essential as threat actors evolve their techniques further.
Key Questions
How is AI changing the skills required for cyberattacks?
AI automates complex tasks like lateral movement and account discovery, reducing the need for high-level technical skills among attackers.
Does this mean traditional threat indicators are no longer useful?
Yes, the correlation between the number of techniques used and threat level is weakening, making it harder to assess danger based solely on technique count or tools.
What can organizations do to defend against AI-enabled attacks?
Organizations should update their detection systems to recognize AI-assisted activities, enhance threat intelligence, and train security teams on new attack patterns.
Are less skilled attackers now as dangerous as highly skilled ones?
According to the report, AI enables less skilled actors to perform operations that previously required expertise, increasing their threat level significantly.
Source: ThorstenMeyerAI.com
