Why AI is accelerating old cyber risks, not creating new ones

In the wake of the rapid integration of artificial intelligence (AI) into daily operations, businesses and regulators are scrambling to adapt. AI presents a new landscape of potential threats, making robust cyber defenses more critical than ever. However, the hype surrounding AI's transformative impact often overshadows the persistent vulnerabilities that have plagued organizations for years.

These fundamental weaknesses—unpatched systems, inadequate identity controls, excessive privileges, and insecure third-party integrations—are as prevalent today as they were five or ten years ago. They are unlikely to vanish entirely anytime soon, given the immutable nature of computer science that dictates the complete elimination of vulnerabilities is unattainable.

Consequently, no amount of technology or resources can guarantee absolute security. While AI does not introduce entirely novel risks, it does accelerate the pace and scale of existing threats. Traditional weaknesses that once required considerable time, skill, and effort to exploit can now be automated, magnified, and even delegated to less sophisticated actors.

This shift has already manifested in the form of AI-assisted reconnaissance and lateral movement, with some nation-state actors exploring the use of AI to orchestrate multi-stage operations autonomously. Similarly, malware generation and social engineering tactics have been expedited through the use of AI-generated deepfakes, amplifying the threat landscape.

However, these advancements represent an intensification of existing strategies rather than the emergence of entirely new tactics. The speed and scale of exploitation have heightened the urgency for organizations to address their weaknesses, but the fundamental issues remain unchanged. This urgency can lead to a reactive approach focused on AI-specific solutions, which may divert attention from the core vulnerabilities that continue to serve as prime entry points for attackers.

In this context, the strategic distraction posed by the AI narrative can hinder organizations from tackling longstanding security gaps. The reality is that no organization can achieve 100% security. The presence of unknown vulnerabilities, some of which advanced AI models can uncover, underscores the importance of continuous remediation and risk reduction.

However, the notion that AI can single-handedly "solve" cyber risks is misguided. Even with AI's capability to identify previously unknown weaknesses, the response remains consistent with past practices: prioritize remediation and minimize exposure over time. Achieving this level of responsiveness demands a blend of discipline and adaptability.

Established security practices, such as red teaming and tabletop exercises, must evolve to integrate AI scenarios. Incident response teams must be equipped to handle new forms of evidence generated or manipulated by AI systems. Additionally, training programs should reflect the heightened sophistication of social engineering techniques, particularly those involving deepfakes and voice cloning.

AI-driven detection and response tools can be valuable assets, particularly in identifying patterns at scale. Yet, these tools should complement, not replace, foundational security principles such as secure-by-design architecture, strong access controls, and a clear understanding of critical data assets. The expansion of AI adoption within enterprises further complicates the security landscape.

Threat actors are increasingly targeting AI workflows directly, exploiting vulnerabilities in software development environments, and employing techniques like prompt injection to manipulate system behavior. In some cases, malicious instructions can be embedded within seemingly innocuous content, triggering unintended actions when processed by AI systems.

These developments are best viewed as extensions of familiar concepts such as input validation, supply chain risk management, and data integrity. AI introduces new contexts for these issues, but not fundamentally novel categories of risk. From a governance standpoint, organizations must remain clear and focused rather than overly ambitious in their pursuit of new solutions.

Boards should define risk tolerance, ensure accountability, and maintain visibility into AI usage within the organization. This involves integrating AI considerations into existing risk frameworks rather than treating them as a separate domain. Collaboration among legal, technical, and communications teams is essential, particularly in scenarios involving misinformation or synthetic media, where response speed is critical.

In summary, the current emphasis on AI-driven cyber risks is warranted. The heightened attention underscores the need for vigilance and proactive measures. However, organizations must maintain a balanced perspective, recognizing that addressing foundational weaknesses remains paramount. By aligning their governance frameworks with AI considerations, businesses can navigate the evolving threat landscape more effectively, ensuring that security adapts to new challenges without losing sight of the enduring principles that underpin effective cybersecurity.