How AI is changing cybersecurity and cyber resilience

We've known for some time that AI would change the cyber landscape. What's becoming clearer is just how dramatically it could accelerate the contest between attackers and defenders.

OpenAI said one of its latest models had reached what it defines as a “Critical” level of cybersecurity capability – able, with the right tools and access, to identify previously unknown vulnerabilities and develop exploits across well-protected systems without a human directing every step.

That followed controlled cybersecurity evaluations in which highly capable research models, operating with reduced safeguards, circumvented controls intended to isolate them from the internet and ultimately accessed third-party infrastructure. Other frontier AI developers have reported similar incidents during cybersecurity testing.

These were unusual testing conditions, not every day commercial deployments. But taken together, they give us an important glimpse of where cybersecurity is heading.

How AI is accelerating cyber threats

Perhaps the biggest near-term change isn't an entirely new form of cyberattack. It's speed.

Cybersecurity has always been an asymmetric contest. Attackers need to find one exploitable weakness; defenders need to protect an entire environment. AI intensifies that challenge. Reconnaissance that once took days can happen in hours. Vulnerability research can run continuously, multiple attack paths can be explored at once and, when one approach fails, an AI system can adapt and try another.

We're already seeing signs of this. Recent threat intelligence has documented malicious actors using agentic AI for reconnaissance, exploitation and data theft, as well as adapting tooling in response to detection.

The techniques themselves may be familiar. What changes is the speed, scale and cost at which they can be deployed.

Put simply, organisations should assume their digital infrastructure will increasingly be examined by machines.

Why cyber resilience is critical in the age of AI

That has important implications for how we approach security.

Preventing attackers from gaining access remains essential. But as adversaries begin to operate at machine speed, resilience needs to be built into systems from the outset.

That means strong identity and access controls, encryption, secure software development, continuous monitoring, segmentation and robust recovery capabilities.

It also means thinking differently about software. As AI makes applications faster and cheaper to analyse, complexity or obscurity won't slow attackers down for long. Secure development and rapid patching remain fundamental, but deployed software must also become harder to analyse, manipulate and exploit.

No system can be made impossible to attack. The goal is to make an attack harder, slower and more expensive. Under this environment, time itself becomes a security control.

How AI can strengthen cyber defence

But AI isn't only changing the threat. The same capabilities can help defenders discover vulnerabilities earlier, analyse huge volumes of activity, identify anomalies and respond faster.

So, the future isn't an AI attacker facing a human defender. Increasingly, it will be AI-enabled attackers facing AI-enabled defenders.

That becomes particularly important for critical infrastructure. Energy, transport, communications and other essential services depend on interconnected software, operational technology, identities and data. In these environments, a cyber incident doesn't necessarily stay digital. It can have real-world consequences.

AI cybersecurity and critical infrastructure

We've been through shifts like this before.

Cloud computing changed how we thought about the perimeter, identity and data. Ransomware pushed resilience and recovery from an IT concern to a board-level priority.

Agentic AI could represent another such turning point.

At Thales, we see this from several perspectives. We protect data, identities, applications and software, as well as critical systems and infrastructure where cyber resilience has real-world consequences. We're also applying AI to both sides of the equation – understanding how it changes the threat while using it to strengthen defence.

That gives us a clear view of one thing: there won't be a single technology that makes the agentic age secure.
It will take layers - trusted AI, strong digital identities, protected data and software, secure communications, and infrastructure designed to keep operating when individual controls fail.

Building cyber resilience for the agentic AI era

The challenge isn't simply to make AI more capable. It's to ensure the systems around it can protect themselves, adapt and remain resilient as the threat evolves.

Because as cyber moves to machine speed, trust will depend on our ability to engineer resilience at the same pace.