📊 Full opportunity report: The Frameworks Can’t See the Thing That Matters: A Year of AI-Enabled Cyber Threats on ThorstenMeyerAI.com — validation score, market gap, and execution plan.
TL;DR
A year-long analysis shows AI is making cyber attackers more sophisticated and harder to identify using traditional methods. Threat detection frameworks are no longer sufficient as attackers leverage AI for complex tasks, blurring skill distinctions.
New research from Anthropic indicates that AI is fundamentally changing the landscape of cyber threats, with attackers increasingly using AI to automate complex tasks and evade traditional detection methods.
Anthropic analyzed 832 accounts banned for malicious activity between March 2025 and March 2026, mapping their techniques onto the MITRE ATT&CK framework. The findings show that 67.3% of these actors used AI to prepare for attacks, primarily for malware creation and reconnaissance. Notably, AI’s role shifted over the year towards post-compromise activities, such as lateral movement and account discovery, with these techniques rising by nearly 9%.
Importantly, the report highlights that the traditional markers of threat level—such as the number of techniques used or the platform employed—no longer reliably indicate risk. Both novice and skilled actors now appear similar in their technique counts, as AI supplies many of the tactics, making threat assessment based on these signals ineffective. Instead, the report suggests that the focus should shift to how attackers deploy AI during different attack stages, especially the more operationally demanding techniques.
The frameworks can’t see the thing that matters
For decades, danger meant which techniques an attacker commands. A year of real AI-enabled attacks — 832 banned accounts mapped onto MITRE ATT&CK — shows that signal breaking, just as a new, harder-to-see one takes over.
A year of real misuse, mapped to the standard taxonomy
A window, not a census — these are the cases with enough detail to assess techniques thoroughly. Inside it, the risk level climbed fast.
WHAT WAS STUDIED
THE RISK CLIMB · MEDIUM-OR-HIGHER ACTORS
SQL for Cyber Threat Hunting: Playbooks for Detection, Investigation, and Incident Response (Cybersecurity Coding Mastery Series: High-Performance … Tools, Automation, and Detection Engineering)
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
“More techniques” stopped meaning “more dangerous”
The old heuristic: count the techniques, judge the tooling. AI dissolved it — because the model supplies the techniques either way. Watch the old signal fail, then watch what it misses.
Risk score vs. technique count
Two ways to read the same attacker. One is going blind. Press play.
Artificial Intelligence for Cybersecurity: Develop AI approaches to solve cybersecurity problems in your organization
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Deeper into the attack — and into less-skilled hands
Across the year, AI use drifted from getting in toward acting once already inside — the operationally demanding stages that used to require an expert.
The attack lifecycle · where AI is now applied
The center of gravity moved right — toward post-compromise work.
The Tao Of Network Security Monitoring: Beyond Intrusion Detection
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
From “what they know” to “what they’ve built”
The report sorts the signals into three tiers — one dead, one fading, one durable.
Technique count & tooling
16 vs. 20 between novice and expert; platform doesn’t correlate. The model supplies the techniques either way.
Where in the lifecycle AI is applied
Concentrating on operationally demanding, post-compromise stages is a better signal — but it’s eroding as the whole population heads there.
The scaffolding around the model
Architectures that let the model chain stages and run with minimal human input. Not what they know — whether they’ve built a system that lets AI run the attack.
The Art of Mac Malware, Volume 1: The Guide to Analyzing Malicious Software
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Fixing the map before the territory moves again
A taxonomy that can’t name the most dangerous behavior on the field will quietly mislead the people relying on it. The response runs in two directions.
Fed back into the models
The findings informed safeguards on the most capable models, built to detect & block some of what was observed:
- Blocking malware development
- Blocking mass data exfiltration
- Putting tools in defenders’ hands first (Project Glasswing)
Taking it to the source
Following the Verizon work, Anthropic says it’s in discussions with MITRE about how ATT&CK might evolve:
- A vocabulary for agentic orchestration
- Naming the scaffolding that makes a model an operator
- An interactive technique visualization on the Red blog
Reading it in proportion
- The 832 cases are a detailed subset, not the full population — the precise percentages are directional, not definitive.
- “More autonomous” is not “fully autonomous” — even the standout case needed human input at key moments, which is itself a place for defenders to intervene.
- This is one vendor’s window — the company with visibility into misuse of its own model, publishing what it found. The right thing to do with the data, and worth remembering as you read it.
Implications of AI-Driven Threat Democratization
This development means that less skilled cybercriminals can now perform complex, high-impact activities previously limited to experts. As AI tools become more accessible and capable, the traditional threat assessment models, which relied on the number of techniques and tool sophistication, are becoming obsolete. This shift could lead to an increase in the volume and severity of attacks, challenging existing cybersecurity defenses and requiring new detection strategies.
Evolution of Cyberattack Techniques and AI Integration
Over the past decade, threat assessment has depended on counting techniques and evaluating tool complexity to gauge attacker danger. However, recent advances in AI, especially frontier models like those analyzed by Anthropic, have enabled even less experienced actors to perform sophisticated tasks such as lateral movement and account discovery. The report’s data, covering a year of activity, underscores this trend, marking a significant change in the threat landscape as AI becomes embedded in attack workflows.
“The traditional markers of threat level are no longer reliable because AI is enabling less skilled actors to perform complex, high-risk activities.”
— Thorsten Meyer, AI security researcher
Unclear Impact of AI on Future Threat Detection
It remains uncertain how cybersecurity defenses will adapt to these changes. The effectiveness of existing threat detection frameworks is in question, and it is not yet clear what new methods will be required to identify AI-enabled threats reliably. Further research and development are needed to understand how to counteract this evolution in attacker capabilities.
Next Steps for Cybersecurity in an AI-Enabled Era
Security professionals are expected to reevaluate threat assessment models, focusing on behavioral signals rather than technique counts. Investment in AI-aware detection tools and proactive monitoring of operational techniques will likely increase. Ongoing research from organizations like Anthropic and industry partners will be crucial in developing new strategies to counter AI-empowered attacks.
Key Questions
How is AI changing the skills required for cyberattackers?
AI automates complex tasks such as lateral movement and account discovery, reducing the need for technical expertise and enabling less skilled actors to carry out sophisticated attacks.
Why are traditional threat assessment methods becoming less effective?
Because AI supplies many of the techniques attackers use, making skill level and technique count less indicative of threat potential.
What should cybersecurity teams focus on now?
Teams should monitor how attackers deploy AI during different attack stages, especially in operationally demanding techniques, and develop AI-aware detection methods.
Will existing security tools be sufficient to counter AI-driven threats?
Current tools may be inadequate; new detection strategies that understand AI-enabled behaviors are needed to effectively identify and mitigate these threats.
What is the significance of this shift for future cyber defense?
It signals a need for a fundamental change in threat assessment and defense strategies, emphasizing behavioral analysis over technique enumeration.
Source: ThorstenMeyerAI.com
