AI in Cybersecurity: What’s Real, What’s Hype

Ask ten people whether AI has changed cybersecurity and you will get ten confident answers, most of them wrong in opposite directions. One camp says nothing has really changed. The other says autonomous AI attackers are already dismantling networks unsupervised. Neither is accurate, and the gap between them is where most organisations end up making poor decisions about where to spend money and attention.

Threat modelling, the practice of working out who might realistically attack you and how, works best when it is specific. Not “AI is dangerous,” but a clear-eyed list of what current-generation models can reliably do against a target today, separated from the speculative capabilities that get far more coverage than they deserve. This article is that list, written for people who are newer to security and want the real picture without the marketing.

First, what we mean by an AI model here

When people say “AI” in a security context in 2026, they almost always mean a large language model, or LLM. These are systems trained on enormous quantities of text and code that predict and generate language. Practically, that makes them very good at three things: writing convincingly, reading and producing code, and summarising scattered information into something coherent.

Hold onto those three capabilities, because every genuine AI-driven threat in this article is a direct consequence of one of them. Nothing here requires a science-fiction breakthrough. It requires an attacker with an account, some patience, and a willingness to ignore the terms of service.

Reliable today: language and code fluency at scale

The first category is the most immediately dangerous, and the least dramatic.

Convincing pretext text in any register. A pretext is the cover story an attacker uses to make contact seem legitimate: the invoice that looks like it came from a supplier, the internal note that reads like it came from HR, the recruiter message aimed at an engineer. Historically, the single most reliable way to spot a phishing email was that it read badly. Clumsy grammar, odd phrasing, a tone that did not match the supposed sender. That tell is gone. A model will produce fluent, contextually appropriate text in any language, any professional register, and any corporate voice, at no meaningful cost per message.

This matters enormously for awareness training, because a great deal of that training implicitly taught people to look for sloppiness. Staff who were trained to spot bad English are now, in effect, untrained. The advice that still holds is behavioural rather than linguistic: be suspicious of unexpected urgency, of requests to change payment details, of any message that pressures you to bypass a normal process. Those signals survive because they are properties of the attack, not of the writing.

Working exploit code for known vulnerability classes. An exploit is code that takes advantage of a specific flaw in software. Models are demonstrably capable of producing working exploit code for vulnerability types that are already well documented. This does not create new categories of weakness. What it does is collapse the skill required to weaponise an existing, published one, which widens the pool of people capable of using it.

Rapid malware variant generation. A great deal of traditional antivirus works by signature matching: recognising a specific known-bad file by its fingerprint. If an attacker can cheaply produce hundreds of functionally identical but textually different variants of the same malicious program, signature-based detection degrades badly. Models make that cheap. This is a strong argument for behaviour-based detection, which watches what a program does rather than what it looks like.

None of this requires a novel model breakthrough. It requires an attacker with API access and a few hours.

Reliable today: reconnaissance synthesis

Reconnaissance is the homework phase of an attack: working out what an organisation looks like from the outside before touching anything. Who works there, what they use, what is exposed to the internet, which credentials have appeared in past breaches.

Pulling together scattered public information, leaked credentials, org charts, technology fingerprints, and turning it into an actionable target profile used to be manual analyst work, measured in days. Models are now genuinely good at this specific synthesis task, which shortens the reconnaissance phase of an attack more than any single tool has in years.

The uncomfortable implication is that attackers now understand your external footprint faster than most organisations understand it themselves. Plenty of teams cannot produce an accurate list of their own internet-facing systems, because that list changes constantly as staff spin up services, register domains, and connect third-party tools. If an attacker can assemble that picture in an afternoon and you cannot, the asymmetry is not about sophistication. It is about basic visibility, and it is fixable.

Reliable today: synthetic voice and video

Text is not the only thing models generate well. Voice cloning has become convincing from very short samples, and video synthesis has improved to the point where a brief clip on a low-quality video call is no longer proof that you are speaking to who you think you are.

The security consequence is specific rather than general. Most organisations have an approval process somewhere that ultimately rests on voice recognition: a finance team that will release a payment because the request came from a familiar voice, an IT helpdesk that will reset credentials because the caller sounds like the person they claim to be. Those processes were designed around the reasonable assumption that impersonating a specific individual’s voice was hard. It is no longer hard.

Note what the fix is not. There is no reliable way to train staff to hear the difference, and detection tooling remains an arms race. The durable defence is procedural: high-value actions should require verification through a separate channel that the attacker does not control. If a request arrives by call, confirm it through a known internal system or a callback to a number from your directory rather than one supplied in the request. This is unglamorous, costs nothing, and defeats the entire category regardless of how good the synthesis becomes.

For newcomers, this is a useful illustration of a broader principle. The strongest defences against AI-assisted attacks are rarely AI-based countermeasures. They are process designs that stop relying on signals AI has made unreliable.

Reliable today: manipulating the AI systems you deploy

There is a category most threat briefings underplay: as soon as you deploy an AI assistant yourself, it becomes part of your attack surface.

Language models struggle to distinguish between instructions from you and instructions hidden in the data they are asked to process. If your assistant summarises a web page, and that page contains text telling it to ignore its previous instructions and reveal the conversation, it may simply comply. The same applies to email bodies, PDFs, support tickets, and calendar invitations. This is known as prompt injection, and it is a live issue for any organisation connecting AI tools to real business data.

If you are evaluating AI tooling, this is the question to ask vendors: what does your system do when the content it processes contains instructions? A vendor without a considered answer has not thought about it.

Emerging, not yet reliable: autonomous multi-step operations

This is the scenario that dominates headlines: AI that carries out an entire attack by itself, moving from initial research through break-in to spreading across an internal network without a human directing each step. That last part is called lateral movement, and it is where most serious breaches actually do their damage.

Agentic tooling that can chain reconnaissance, exploitation, and lateral movement with minimal human steering exists in research and in a handful of documented incidents. It is not yet the default mode of attack, and it is not yet reliable enough that most attackers prefer it over a human operator with AI assistance at each step. Real networks are messy and unpredictable, and small errors compound quickly across a long chain of actions.

Treat this as the category to watch, not the category to panic about. The distinction matters, because budget spent bracing for autonomous attackers is budget not spent on the phishing and exposure problems already hitting you weekly.

Overstated: novel vulnerability discovery at scale

Models are useful for triaging and explaining known vulnerability classes and for finding variations on known bug patterns in code they can read. Discovering genuinely novel, high-impact vulnerability classes at the rate vendor marketing implies is not what is actually happening in most documented incidents. The bottleneck there remains deep domain expertise, not raw model capability.

Worth being precise about the difference. Finding a variation on a known bug in code you can read is a pattern-matching task, and models are good at pattern matching. Discovering a fundamentally new class of weakness requires reasoning about a system in ways nobody has framed before. The first is happening at volume. The second remains rare and human-led, whatever the product page claims.

What this means for prioritization

Spend defensive attention on the reliable capabilities first: faster, more convincing phishing; faster reconnaissance of your real external footprint; faster malware iteration against static detection. These are happening now, at scale, against ordinary organizations, not just high-value targets. The speculative autonomous-attack scenario is worth monitoring through threat intelligence, but it should not be crowding out investment in the fundamentals that are already under measurably higher pressure.

If you are newer to this and want a concrete starting order, this one holds up well:

1. Know what you expose. Build and maintain an accurate inventory of internet-facing systems. You cannot defend an asset you do not know exists, and this is the single gap AI-assisted reconnaissance exploits hardest.
2. Harden identity. Multi-factor authentication and tight access control blunt credential theft, which is where most convincing phishing ultimately leads. Better writing does not help an attacker who cannot use the password.
3. Retrain your people on behaviour, not grammar. Update awareness training to focus on unexpected urgency, payment-detail changes, and process bypasses.
4. Move detection toward behaviour. Reduce reliance on signature matching alone, given how cheap variant generation has become.
5. Govern your own AI deployments. Treat every assistant connected to business data as part of your attack surface, and test how it handles untrusted input.

None of these are exotic. That is rather the point. AI has changed the economics of attack, making good-quality offensive work dramatically cheaper and faster, without yet changing its fundamental shape. The organisations struggling most are generally not the ones facing novel AI attacks. They are the ones who had visibility and identity gaps already, now being found and exploited far more quickly than before.

Building the understanding in-house

Understanding AI in cybersecurity is no longer a specialist concern, because the tools are already in your organisation whether or not anyone approved them. CyberNova’s Foundational AI Skills and Cybersecurity Fundamentals courses cover this ground from first principles, including how models work, where they fail, and how attackers use them. If you would rather start with a picture of your own exposure, our attack surface monitoring shows you what an attacker’s reconnaissance would surface about you today.