📊 Full opportunity report: The Frameworks Can’t See the Thing That Matters: A Year of AI-Enabled Cyber Threats on ThorstenMeyerAI.com — validation score, market gap, and execution plan.
TL;DR
A recent analysis shows AI is significantly increasing cyberattack risks by enabling less skilled actors to perform complex techniques. Traditional threat assessment methods are no longer effective, raising urgent security concerns.
A new analysis from Anthropic reveals that AI has radically changed the landscape of cyber threats, enabling less skilled actors to carry out complex and dangerous attacks. This development challenges long-standing threat assessment models and raises questions about future security strategies.
Anthropic examined 832 accounts banned for malicious cyber activity between March 2025 and March 2026, mapping their techniques onto the MITRE ATT&CK framework. The findings show a sharp increase in AI-assisted activities, especially after the initial breach, with attackers using AI for tasks like lateral movement and account discovery. Notably, the proportion of actors classified as medium risk or higher rose from 33% in the first half of the year to 56% in the second, indicating a rapid escalation in threat levels. Importantly, the report highlights that AI enables less skilled actors to perform technically demanding operations that previously required expertise, such as privilege escalation and deep network navigation. This democratization of attack capabilities diminishes the effectiveness of traditional threat indicators based solely on technique diversity or tool usage, which no longer reliably differentiate between high- and low-risk actors.The frameworks can’t see the thing that matters
For decades, danger meant which techniques an attacker commands. A year of real AI-enabled attacks — 832 banned accounts mapped onto MITRE ATT&CK — shows that signal breaking, just as a new, harder-to-see one takes over.
A year of real misuse, mapped to the standard taxonomy
A window, not a census — these are the cases with enough detail to assess techniques thoroughly. Inside it, the risk level climbed fast.
WHAT WAS STUDIED
THE RISK CLIMB · MEDIUM-OR-HIGHER ACTORS
Python Scripting for Cybersecurity: Linux Edition: Volume 2 – Log Analysis, Network Visibility, and Threat Detection with Hands-On Python Projects
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
“More techniques” stopped meaning “more dangerous”
The old heuristic: count the techniques, judge the tooling. AI dissolved it — because the model supplies the techniques either way. Watch the old signal fail, then watch what it misses.
Risk score vs. technique count
Two ways to read the same attacker. One is going blind. Press play.
Artificial Intelligence for Cybersecurity: Develop AI approaches to solve cybersecurity problems in your organization
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Deeper into the attack — and into less-skilled hands
Across the year, AI use drifted from getting in toward acting once already inside — the operationally demanding stages that used to require an expert.
The attack lifecycle · where AI is now applied
The center of gravity moved right — toward post-compromise work.
Applied Network Security Monitoring: Collection, Detection, and Analysis
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
From “what they know” to “what they’ve built”
The report sorts the signals into three tiers — one dead, one fading, one durable.
Technique count & tooling
16 vs. 20 between novice and expert; platform doesn’t correlate. The model supplies the techniques either way.
Where in the lifecycle AI is applied
Concentrating on operationally demanding, post-compromise stages is a better signal — but it’s eroding as the whole population heads there.
The scaffolding around the model
Architectures that let the model chain stages and run with minimal human input. Not what they know — whether they’ve built a system that lets AI run the attack.
cyber attack simulation kits
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Fixing the map before the territory moves again
A taxonomy that can’t name the most dangerous behavior on the field will quietly mislead the people relying on it. The response runs in two directions.
Fed back into the models
The findings informed safeguards on the most capable models, built to detect & block some of what was observed:
- Blocking malware development
- Blocking mass data exfiltration
- Putting tools in defenders’ hands first (Project Glasswing)
Taking it to the source
Following the Verizon work, Anthropic says it’s in discussions with MITRE about how ATT&CK might evolve:
- A vocabulary for agentic orchestration
- Naming the scaffolding that makes a model an operator
- An interactive technique visualization on the Red blog
Reading it in proportion
- The 832 cases are a detailed subset, not the full population — the precise percentages are directional, not definitive.
- “More autonomous” is not “fully autonomous” — even the standout case needed human input at key moments, which is itself a place for defenders to intervene.
- This is one vendor’s window — the company with visibility into misuse of its own model, publishing what it found. The right thing to do with the data, and worth remembering as you read it.
Implications of AI-Driven Threat Democratization
This shift means that threat actors with minimal technical skill can now execute complex cyberattacks, increasing the overall threat landscape. Traditional methods of assessing attacker danger—based on the number of techniques or sophistication of tools—are becoming obsolete. Security teams must now consider new indicators, such as how attackers leverage AI within their operational workflows, to better anticipate threats. The rise of AI-enabled attacks also raises concerns about the speed and scale of future cyber incidents, as barriers to executing advanced techniques are lowering.
Evolution of Cyberattack Techniques with AI
Historically, cybersecurity relied on assessing threat actors by their technical skill, number of techniques, and tools used. The MITRE ATT&CK framework provided a standardized way to categorize attack tactics. Over recent years, attackers have increasingly adopted AI to streamline and enhance their operations. The latest data from Anthropic covers a year of malicious activity, offering a rare glimpse into how AI is reshaping threat behaviors and capabilities. This analysis builds on prior concerns about AI’s role in cybercrime but provides concrete, real-world evidence of its impact over a significant period.
“The data shows that AI is fundamentally changing who can be a threat, making the old heuristics for threat assessment unreliable.”
— Thorsten Meyer, AI security researcher
Unclear Impact of AI on Future Threat Landscape
It remains uncertain how quickly security tools and frameworks will adapt to these changes or whether new threat indicators will be developed to reliably identify high-risk actors. Additionally, the full scope of AI’s role in cybercrime is still emerging, and whether these trends will accelerate or stabilize is not yet known.
Next Steps for Cybersecurity Strategies
Security professionals will need to revise threat assessment models to account for AI-enabled capabilities. Developing new detection techniques that focus on attack workflows and AI usage patterns will be critical. Further research is expected to analyze more extensive datasets and explore how defenders can counteract AI-driven attack escalation.
Key Questions
How does AI make attackers more dangerous?
AI enables less skilled actors to perform complex attack techniques such as lateral movement and account discovery, which previously required high-level expertise, thus broadening the threat landscape.
Why are traditional threat assessment methods no longer effective?
Because AI allows attackers with minimal skill to execute techniques that once indicated high threat levels, the correlation between technique diversity and danger has broken down.
What should cybersecurity teams do in response?
Teams should update their threat models to include AI usage patterns and focus on attack workflows rather than just techniques or tool signatures.
Is this trend likely to continue?
While the current data shows rapid growth, the future trajectory depends on how quickly defenses adapt and how attackers leverage AI further, which remains uncertain.
Source: ThorstenMeyerAI.com
