Worms are not new.
Vulnerabilities are not new. Internet-connected devices being abused at scale is not new. Attackers using automation to discover, exploit, and chain weaknesses is not new either. ENISA’s 2025 threat landscape describes the same pattern in broader terms: threat groups keep reusing tools, introducing new attack models, exploiting vulnerabilities, and collaborating against digital infrastructure.
Even the idea of using AI to help find bugs, write exploits, or create new vulnerability patterns is not completely new. Security has always absorbed better tools. Fuzzers improved. Scanners improved. Exploit kits improved. Botnets improved. The attacker’s workflow has been getting more automated for a long time.
What is changing now is the speed.
AI makes more of the work cheap, repeatable, and parallel. It can read code, summarize documentation, generate payloads, test variations, explain errors, and keep iterating. Paired with automation and efficient code, that changes the tempo of both offense and defense. Palo Alto Networks’ May 2026 update on frontier AI and cybersecurity says recent models were “extraordinarily capable at finding vulnerabilities and changing them into critical exploit paths in near-real-time,” and that the company’s May advisory volume rose to 26 CVEs, representing 75 issues, after AI-assisted scanning across its products.
The threat is not that every attacker suddenly becomes a genius.
The threat is that average attackers may get faster, good attackers may get much faster, and defenders may have less time to notice, understand, and fix what is happening. An industry analysis published in May 2026 by Cogent Security claims the average time from CVE disclosure to working exploit fell from 125.3 days in January 2025 to 0.5 days by April 2026. Whether that exact number holds across every environment matters less than the direction of travel: the response window is compressing.
The Old Advice Still Matters
There has never been a single layer of defense that solves security.
Not a firewall. Not antivirus. Not endpoint detection. Not MFA. Not network segmentation. Not code review. Not user training. Each layer helps with part of the problem. None of them removes the need for the others.
Defense in depth is not a slogan. It is the admission that systems fail in different ways at different times. A vulnerability gets missed. A credential leaks. A device is misconfigured. A dependency goes stale. A user clicks something convincing. A monitoring rule does not fire. NIST’s Cyber AI Profile, updated with Spring 2026 working sessions, frames AI-related cybersecurity work across three overlapping areas: securing AI systems, conducting AI-enabled cyber defense, and thwarting AI-enabled cyberattacks. That framing is useful because it treats AI as something to secure, something defenders can use, and something attackers can use.
Good security assumes some layer will fail and asks what catches the failure next.
That posture matters more when attacks move faster. If a single missed patch lets an attacker cross the whole environment, the problem is not only the missed patch. The problem is the lack of containment. CISA’s 2026 guidance on AI in operational technology makes the same point in a more specific setting: new AI connection paths should still fit through approved device management, DMZ, or jump-host infrastructure instead of bypassing existing controls.
AI-Enabled, Not AI-Magical
Personally, I would call many of these AI-enabled threats.
That phrase is useful because it avoids pretending the underlying threat is brand new. The vulnerability still has to exist. The exposed service still has to be reachable. The device still has to be poorly secured. The credential still has to be useful. The software still has to have a bug.
AI does not remove the basics. It pressures the basics.
If attackers can scan faster, reason faster, adapt faster, and generate working code faster, then the old backlog of “we should get to that eventually” becomes a larger liability. CISA’s Secure by Demand guide is blunt about some of those basics, asking customers to demand products that support phishing-resistant MFA, eliminate default passwords, and reduce preventable vulnerability classes.
The camera on the flat network. The forgotten admin panel. The outdated dependency. The default credential. The overprivileged service account. The public storage bucket. The device no one owns anymore.
Those were never good. They were only easier to ignore when the expected time to exploitation felt slower than the expected time to cleanup. CISA’s Secure by Design pledge calls out default passwords as a continuing enabler of damaging cyberattacks, especially for internet-facing products, and recommends replacing them with safer mechanisms such as instance-unique credentials.
That assumption is getting weaker.
Humans Will Not Win On Speed
Humans are not going to beat machines at machine-speed work.
That does not mean humans become irrelevant. It means humans need to design the system, set the policy, make the judgment calls, and decide what matters. Then the repetitive parts need to be automated aggressively.
Secure coding has to improve. Not as a compliance checkbox, but as a default engineering habit. Input validation, authorization boundaries, dependency hygiene, secret handling, logging, testing, and review need to be closer to the work instead of added after the fact.
Internet-connected devices need to be treated as real computers on real networks. They should be patched, inventoried, monitored, and segmented. If they do not need broad access, they should not have it. If they cannot be updated, that risk should be visible instead of hidden in a closet. That is consistent with CISA’s AI-and-OT guidance, which recommends integrating AI systems into existing risk, vulnerability management, mitigation, monitoring, and security control processes rather than treating them as exceptions.
Security teams also need better automation. Continuous asset discovery, dependency scanning, configuration checks, detection engineering, log analysis, and response playbooks become more important when the attack cycle compresses. Palo Alto’s May 2026 guidance argues that autonomous AI-driven attacks can drive attack lifecycles to minutes and that security operations need automation to reach single-digit mean time to detect and respond.
The goal is not to make humans type faster.
The goal is to make secure defaults and automated feedback faster than the most common failures.
The Near Future
The practical lesson is uncomfortable.
Things that were survivable to ignore last time may not be survivable to ignore next time. Not because the category of threat is new, but because the interval between exposure and exploitation may shrink.
This is the part organizations should take seriously now. The work is not glamorous. Inventory systems. Patch what matters. Remove what is exposed for no reason. Segment networks. Reduce privilege. Rotate secrets. Test backups. Make logs useful. Build software with fewer obvious mistakes.
None of that is new advice.
That is exactly why it matters.
AI is not replacing the fundamentals of security. It is reducing the amount of time you can get away with neglecting them.
References
- ENISA Threat Landscape 2025, revised January 2026.
- Defender’s Guide to the Frontier AI Impact on Cybersecurity: May 2026 Update, Palo Alto Networks, May 13, 2026.
- Cogent Research: Exploits Outpace Scanner Detection for 62% of Critical Vulnerabilities as AI Compresses Time-to-Exploit to Under 12 Hours, PR Newswire, May 27, 2026.
- NIST IR 8596, Cybersecurity Framework Profile for Artificial Intelligence, initial preliminary draft with Spring 2026 working sessions.
- Secure by Demand Guide, CISA.
- Secure by Design Pledge, CISA.
- Joint Guidance: Principles for the Secure Integration of AI in Operational Technology, CISA and partners, January 2026.