AI-driven cyberattacks are outpacing human defenders by a factor of 47, according to research cited in the SANS Secure AI Blueprint. As artificial intelligence capabilities accelerate across both attack and defense, security teams face a critical choice: adopt AI-powered safeguards or risk being overwhelmed by threats that move at machine speed.

The speed disparity is not theoretical. MIT autonomous agent research demonstrated that AI systems could perform privilege escalation and exploit chaining in seconds to minutes, compared to hours for human operators. Meanwhile, real-world data shows the threat landscape is shifting rapidly. The 2025 Verizon Data Breach Investigations Report found that over 75% of social engineering breaches showed signs of AI-assisted generation, and CrowdStrike's 2026 Global Threat Report documented an 89% increase in AI-enabled attacks year-over-year.

How Are Attackers Using AI to Breach Organizations?

AI has fundamentally lowered the technical barrier to launching sophisticated attacks. Attackers now use AI to tailor phishing campaigns with precision, manipulate audio and video for social engineering, chain exploits without human intervention, and adjust tactics mid-operation to evade defenses. The speed advantage is particularly dangerous for lateral movement, privilege escalation, and data exfiltration, where AI systems can operate faster than security teams can detect and respond.

Testing by Horizon3's NodeZero platform reached full privilege escalation in about 60 seconds, illustrating just how quickly automated attacks can compromise systems. This speed advantage means traditional reactive security approaches, where analysts investigate threats after detection, are increasingly insufficient.

What New Vulnerabilities Emerge When Organizations Deploy AI?

The irony of AI in cybersecurity is that deploying AI systems introduces new attack surfaces that defenders must protect. Organizations face several emerging risks that go beyond traditional security concerns:

• Model Poisoning: Attackers can corrupt the training data that AI systems rely on, causing the model to make incorrect decisions or miss threats. Mitigation requires continuous validation of the model to ensure data integrity.
• Prompt Injection Attacks: Crafted prompts can manipulate large language models (LLMs), which are AI systems trained on vast amounts of text data, to subvert their safety guardrails or exfiltrate sensitive information. This is the most common attack vector against LLMs and requires layered input validation and intelligent monitoring.
• Shadow AI: Employees using unapproved AI tools can expose sensitive company data to unknown platforms, creating uncontrolled security risks that leadership may not even know exist.
• Data Leakage: Misconfigurations and errors can expose the proprietary data that powers AI models, requiring auditable end-to-end logging, strict permission controls, and comprehensive encryption.

These risks highlight a critical reality: AI is likely already present in most organizations, whether leadership realizes it or not. This includes AI use by third-party vendors, software with AI integrations, and unauthorized use of AI tools by employees.

How Can Security Teams Adopt AI Without Introducing New Risks?

The SANS Secure AI Blueprint provides a structured three-track framework designed to help organizations integrate AI into their security programs safely and effectively. Rather than treating AI as a standalone tool, the framework emphasizes organizational alignment and governance.

• Protect AI: This track addresses the security of AI systems themselves, ensuring operations stay continuous and resilient. It requires collaboration between security teams, engineers, and AI/machine learning developers to deploy advanced defense measures against adversarial threats.
• Utilize AI: This track focuses on integrating AI into defensive operations while maintaining operational control. It requires leadership from Chief Information Security Officers (CISOs) who must invest in their security operations center (SOC) managers, analysts, incident responders, and threat hunters to use AI effectively.
• Govern AI: This track addresses leadership accountability, requiring executive suites, boards, and business leaders to become fluent in AI and take charge of documentation, audits, and alignment with industry standards.

The real-world integration of AI to prevent cyberattacks must happen at every level of the organization simultaneously. Tools in the hands of analysts and responders are only effective when supported by engineering rigor and executive oversight.

Why Can't Security Teams Just Hire More Analysts?

The analyst shortage is not a new problem, but it has become a bottleneck that AI can help address. Most security operations centers operate with between two and ten full-time analysts, a number that has remained steady since SANS began tracking it in 2017. Meanwhile, the scope of required coverage has expanded dramatically to include cloud environments, remote endpoints, software-as-a-service (SaaS) platforms, and other resources.

AI offers a practical solution by optimizing parts of the job that slow analysts down. The SANS Secure AI Blueprint notes that "AI offers a practical path forward by optimizing parts of the job that slow analysts down: the disorganization, repetitive steps, and cognitive overhead." When paired with capabilities like Model Context Protocol, language models can integrate telemetry, threat intelligence, asset metadata, and user history into a single view, tailoring it to each unique situation the analyst faces. This gives analysts enriched, case-specific summaries instead of raw events.

"MIT autonomous agent research demonstrated privilege escalation and exploit chaining in seconds to minutes compared to hours for human operators," noted Rob T. Lee, SANS Chief AI Officer and Chief of Research.

Rob T. Lee, SANS Chief AI Officer and Chief of Research

The outcome for security teams is clear: AI is no longer optional. Organizations that fail to adopt AI-powered defenses will find themselves unable to match the speed and scale of AI-enabled threats. The question is not whether to use AI in cybersecurity, but how to do so safely, effectively, and with proper governance in place.