📊 Full opportunity report: The Frameworks Can’t See the Thing That Matters: A Year of AI-Enabled Cyber Threats on ThorstenMeyerAI.com — validation score, market gap, and execution plan.
TL;DR
A year-long analysis shows AI is making cyber attackers more dangerous and harder to identify using traditional methods. Threat assessment models no longer reliably distinguish skilled from unskilled actors, as AI democratizes advanced attack techniques.
New analysis from Anthropic reveals that AI is significantly enhancing the capabilities of cyberattackers, making threat assessment based on traditional metrics increasingly unreliable in 2026.
Anthropic examined 832 accounts banned for malicious activity between March 2025 and March 2026, mapping their techniques onto the MITRE ATT&CK framework. The report finds that AI is primarily used to automate attack preparation, such as malware creation, with 67.3% of actors employing AI for this purpose. More concerning, however, is the increased use of AI for complex post-breach activities like lateral movement, which rose from 33% to 56% over the year.
Furthermore, the report indicates that AI-enabled activities are shifting deeper into attack chains, with less skilled actors now capable of performing sophisticated tasks that previously required expertise. This democratization of attack capabilities challenges existing threat models, which rely heavily on the number of techniques used and the tools employed to gauge threat severity. The traditional markers no longer reliably distinguish between high- and low-risk actors, as even less skilled actors now perform technically advanced actions with AI assistance.
The frameworks can’t see the thing that matters
For decades, danger meant which techniques an attacker commands. A year of real AI-enabled attacks — 832 banned accounts mapped onto MITRE ATT&CK — shows that signal breaking, just as a new, harder-to-see one takes over.
A year of real misuse, mapped to the standard taxonomy
A window, not a census — these are the cases with enough detail to assess techniques thoroughly. Inside it, the risk level climbed fast.
WHAT WAS STUDIED
THE RISK CLIMB · MEDIUM-OR-HIGHER ACTORS
AI-powered malware detection software
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
“More techniques” stopped meaning “more dangerous”
The old heuristic: count the techniques, judge the tooling. AI dissolved it — because the model supplies the techniques either way. Watch the old signal fail, then watch what it misses.
Risk score vs. technique count
Two ways to read the same attacker. One is going blind. Press play.
cyber threat intelligence tools
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Deeper into the attack — and into less-skilled hands
Across the year, AI use drifted from getting in toward acting once already inside — the operationally demanding stages that used to require an expert.
The attack lifecycle · where AI is now applied
The center of gravity moved right — toward post-compromise work.
The Practice of Network Security Monitoring: Understanding Incident Detection and Response
Used Book in Good Condition
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
From “what they know” to “what they’ve built”
The report sorts the signals into three tiers — one dead, one fading, one durable.
Technique count & tooling
16 vs. 20 between novice and expert; platform doesn’t correlate. The model supplies the techniques either way.
Where in the lifecycle AI is applied
Concentrating on operationally demanding, post-compromise stages is a better signal — but it’s eroding as the whole population heads there.
The scaffolding around the model
Architectures that let the model chain stages and run with minimal human input. Not what they know — whether they’ve built a system that lets AI run the attack.
advanced intrusion detection systems
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Fixing the map before the territory moves again
A taxonomy that can’t name the most dangerous behavior on the field will quietly mislead the people relying on it. The response runs in two directions.
Fed back into the models
The findings informed safeguards on the most capable models, built to detect & block some of what was observed:
- Blocking malware development
- Blocking mass data exfiltration
- Putting tools in defenders’ hands first (Project Glasswing)
Taking it to the source
Following the Verizon work, Anthropic says it’s in discussions with MITRE about how ATT&CK might evolve:
- A vocabulary for agentic orchestration
- Naming the scaffolding that makes a model an operator
- An interactive technique visualization on the Red blog
Reading it in proportion
- The 832 cases are a detailed subset, not the full population — the precise percentages are directional, not definitive.
- “More autonomous” is not “fully autonomous” — even the standout case needed human input at key moments, which is itself a place for defenders to intervene.
- This is one vendor’s window — the company with visibility into misuse of its own model, publishing what it found. The right thing to do with the data, and worth remembering as you read it.
Implications for Cybersecurity Threat Assessment in 2026
This development fundamentally alters how cybersecurity professionals must evaluate threats. The reliance on technique count and tool sophistication as risk indicators is no longer valid, as AI enables less skilled actors to perform complex, high-impact activities. The shift toward deeper, post-compromise activities indicates that threat actors are becoming more dangerous overall, even if their outward technical signatures appear similar to amateurs. This democratization increases the risk of widespread, sophisticated attacks by a broader pool of malicious actors, complicating defense strategies and requiring new approaches to threat detection and mitigation.
Evolution of Cyberattack Techniques and AI’s Role
Historically, threat assessment focused on the number of techniques and the sophistication of tools used by attackers. The MITRE ATT&CK framework provided a structured way to classify and evaluate threat actors based on their tactics. However, recent developments show that AI is enabling less skilled actors to perform complex tasks, such as lateral movement and privilege escalation, which previously required high technical skill. The trend emerged over the past year, with a marked increase in AI-assisted activities during the second half of 2025, as reported in Verizon’s 2026 Data Breach Investigations Report and analyzed by Anthropic.
“Our analysis shows a significant shift towards deeper, post-breach activities driven by AI, which increases the threat landscape’s complexity.”
— Anthropic’s research team
Unclear Impact of AI on Threat Actor Skill Levels
It remains uncertain how widely these AI-enabled techniques will be adopted across different threat actor groups and whether new detection methods will keep pace with these evolving tactics. The full scope of AI’s democratizing effect and its implications for global cybersecurity are still emerging, and further research is needed to quantify the risks comprehensively.
Next Steps in Cyber Threat Detection and Defense
Cybersecurity agencies and firms are expected to develop new frameworks that account for AI-enabled attack techniques, focusing less on technique count and more on behavioral and contextual signals. Monitoring the evolution of attack scaffolding and operational patterns will be critical, as will the development of AI-resistant detection tools. Continued research and real-time threat intelligence sharing will be vital to adapt defenses to this changing landscape.
Key Questions
How does AI change the way cyberattackers operate?
AI automates and enhances various attack techniques, allowing less skilled actors to perform complex activities like lateral movement and privilege escalation, which previously required expertise.
Why are traditional threat assessment methods no longer effective?
Because AI enables attackers to perform sophisticated techniques regardless of their skill level, the correlation between technique count or tool sophistication and threat severity has weakened.
What are the risks of democratizing cyberattack capabilities?
It increases the likelihood of widespread, complex attacks by a broader range of malicious actors, making cybersecurity defenses more challenging and less predictable.
What should cybersecurity professionals do next?
They need to develop new detection frameworks that focus on attack behavior and operational patterns, and continuously update threat intelligence to keep pace with AI-enabled tactics.
Source: ThorstenMeyerAI.com
