📊 Full opportunity report: The Frameworks Can’t See the Thing That Matters: A Year of AI-Enabled Cyber Threats on ThorstenMeyerAI.com — validation score, market gap, and execution plan.
TL;DR
A year-long analysis shows AI is increasingly used by cyberattackers to enhance their capabilities, rendering traditional threat assessment frameworks ineffective. Attackers now perform more sophisticated, post-compromise activities with AI assistance, challenging existing detection methods.
A recent analysis from Anthropic reveals that AI is fundamentally changing the landscape of cyber threats, with attackers increasingly using AI to perform complex activities once inside networks. This shift renders traditional threat assessment frameworks ineffective and raises new security challenges for organizations worldwide.
Anthropic examined 832 accounts banned for malicious cyber activity between March 2025 and March 2026, mapping their techniques onto the MITRE ATT&CK framework. The findings indicate a significant rise in AI-assisted attack activities, especially post-compromise techniques like lateral movement and account discovery. Over the year, the proportion of actors classified as medium or higher risk increased from 33% to 56%, with a notable shift toward deeper network activities.
Most AI use involved mundane tasks such as malware creation, but a growing share of attackers employed AI for more sophisticated operations. The report highlights that AI enables less skilled actors to perform tasks previously requiring expertise, such as lateral movement, thus democratizing advanced attack capabilities. Additionally, the traditional markers of threat level—technique diversity and tool complexity—no longer reliably indicate threat severity, as even less skilled actors now appear highly capable due to AI assistance.
The frameworks can’t see the thing that matters
For decades, danger meant which techniques an attacker commands. A year of real AI-enabled attacks — 832 banned accounts mapped onto MITRE ATT&CK — shows that signal breaking, just as a new, harder-to-see one takes over.
A year of real misuse, mapped to the standard taxonomy
A window, not a census — these are the cases with enough detail to assess techniques thoroughly. Inside it, the risk level climbed fast.
WHAT WAS STUDIED
THE RISK CLIMB · MEDIUM-OR-HIGHER ACTORS
Ghidra for Digital Forensics and Malware Investigation: A Practical Guide to Reverse Engineering, Code Analysis, and Threat Detection (cybersecurity digital tools)
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
“More techniques” stopped meaning “more dangerous”
The old heuristic: count the techniques, judge the tooling. AI dissolved it — because the model supplies the techniques either way. Watch the old signal fail, then watch what it misses.
Risk score vs. technique count
Two ways to read the same attacker. One is going blind. Press play.
AI-powered malware analysis tools
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Deeper into the attack — and into less-skilled hands
Across the year, AI use drifted from getting in toward acting once already inside — the operationally demanding stages that used to require an expert.
The attack lifecycle · where AI is now applied
The center of gravity moved right — toward post-compromise work.
Network Intrusion Detection
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
From “what they know” to “what they’ve built”
The report sorts the signals into three tiers — one dead, one fading, one durable.
Technique count & tooling
16 vs. 20 between novice and expert; platform doesn’t correlate. The model supplies the techniques either way.
Where in the lifecycle AI is applied
Concentrating on operationally demanding, post-compromise stages is a better signal — but it’s eroding as the whole population heads there.
The scaffolding around the model
Architectures that let the model chain stages and run with minimal human input. Not what they know — whether they’ve built a system that lets AI run the attack.
cybersecurity monitoring hardware
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Fixing the map before the territory moves again
A taxonomy that can’t name the most dangerous behavior on the field will quietly mislead the people relying on it. The response runs in two directions.
Fed back into the models
The findings informed safeguards on the most capable models, built to detect & block some of what was observed:
- Blocking malware development
- Blocking mass data exfiltration
- Putting tools in defenders’ hands first (Project Glasswing)
Taking it to the source
Following the Verizon work, Anthropic says it’s in discussions with MITRE about how ATT&CK might evolve:
- A vocabulary for agentic orchestration
- Naming the scaffolding that makes a model an operator
- An interactive technique visualization on the Red blog
Reading it in proportion
- The 832 cases are a detailed subset, not the full population — the precise percentages are directional, not definitive.
- “More autonomous” is not “fully autonomous” — even the standout case needed human input at key moments, which is itself a place for defenders to intervene.
- This is one vendor’s window — the company with visibility into misuse of its own model, publishing what it found. The right thing to do with the data, and worth remembering as you read it.
Implications of AI-Driven Attack Skill Democratization
This development signifies a major shift in cybersecurity, as the old heuristic—more techniques and better tools mean higher threat—no longer applies. Attackers of all skill levels can now perform complex, post-breach activities, increasing the overall threat landscape. Organizations must reconsider threat assessment strategies, as the indicators of danger have shifted from technical sophistication to behavioral patterns and operational focus.
Evolution of Cyberattack Techniques with AI
For decades, threat assessment relied on counting techniques and tool sophistication to gauge attacker danger. Recent years saw the rise of AI, initially used for mundane tasks like malware creation, but increasingly employed for advanced activities such as lateral movement and account discovery. The 2025-2026 period marks a turning point, with AI enabling less skilled actors to perform highly technical operations, blurring the lines between novice and expert attackers.
“Traditional indicators like technique count and tool choice are no longer reliable markers of threat level in an AI-augmented attack landscape.”
— Anthropic’s research team
Unclear Aspects of AI’s Impact on Cyber Threats
It remains uncertain how quickly organizations will adapt their detection strategies to these new attack patterns or how widespread AI-enabled attacks will become beyond the studied subset. The full scope of AI’s influence on the threat landscape is still emerging, and it is unclear whether new frameworks will be developed to replace traditional models.
Next Steps for Cybersecurity in an AI-Driven Era
Security professionals will need to develop new detection methodologies that account for behavioral and operational signals rather than solely technical indicators. Further research is expected to quantify the full extent of AI’s role in future attacks, and organizations may need to invest in AI-specific defense tools and training to stay ahead of evolving threats.
Key Questions
How does AI make attackers more dangerous?
AI enables attackers to perform complex post-breach activities, such as lateral movement and account discovery, with less technical skill, increasing their effectiveness and stealth.
Why are traditional threat assessment methods no longer effective?
Because AI-assisted attackers can perform a wide range of techniques regardless of their skill level, making technique count and tool complexity unreliable indicators of threat severity.
What can organizations do to defend against AI-enabled attacks?
Organizations should focus on behavioral analytics, operational signals, and adaptive detection strategies that go beyond traditional technique-based frameworks.
Is this trend likely to accelerate?
Yes, as AI tools become more accessible and easier to use, the adoption of AI in cyberattacks is expected to grow, increasing the threat landscape.
Source: ThorstenMeyerAI.com
