Impact of AI on Offensive and Defensive Cyber Capabilities

While the preceding section highlights the challenges of measuring AI-enabled cybersecurity risk, it is equally important to understand how these capabilities are transforming both offensive and defensive activities across the cyber lifecycle.

Integration of AI into the Cyber Lifecycle

As discussed previously, cybersecurity is inherently adversarial, and recent advances in AI further intensify this ongoing arms race by enabling powerful new capabilities for both attackers and defenders. These interactions unfold across a sequence of activities often described as a "cyber lifecycle." Several frameworks help illustrate this structure from both offensive and defensive perspectives. The cyber kill chain (Lockheed Martin 2025) conceptualizes attacks as progressing through stages such as reconnaissance, weaponization, delivery, exploitation, installation, command-and-control, and actions on objectives. The MITRE ATT&CK framework (MITRE 2026) provides a more granular taxonomy of adversary behaviors, including tactics such as initial access, privilege escalation, lateral movement, persistence, and exfiltration. Complementing these, the National Institute of Standards and Technology (NIST) Cybersecurity Framework (NIST 2026) describes defensive activities organized around five core functions: identify, protect, detect, respond, and recover. While these frameworks differ in emphasis, together they highlight that cybersecurity is not a single activity but a set of interlocking processes spanning both attack and defense, each unfolding across multiple stages and timescales.

AI is reshaping this lifecycle end-to-end: attackers are using AI to accelerate reconnaissance, automate vulnerability discovery, and scale social engineering campaigns. At the same time, defenders are applying AI to continuously monitor networks, prioritize risks, detect anomalous behavior, and orchestrate responses. Rather than affecting a single phase, AI compresses and transforms the entire lifecycle, increasing the speed, scale, and adaptability of both offensive and defensive operations. AI may also enable more secure-by-design development practices, including automated identification and remediation of insecure code patterns, large-scale refactoring of legacy codebases into memory-safe languages, and the implementation of more continuous, security-first software development processes.

Most AI-enabled cybersecurity capabilities are inherently dual use: the same techniques that allow an attacker to identify a vulnerability can enable a defender to remediate it preemptively. This section examines how AI is changing (1) how systems are attacked, (2) how systems are defended—including how they are built, configured, and maintained—and (3) how the balance between attack and defense may shift as these capabilities mature. Rather than treating offense and defense as separate domains, the sections that follow are organized around these shared capabilities, examining how each is applied across different stages of the cyber lifecycle by both attackers and defenders.

Vulnerability Analysis and Patching

One of the most promising applications of generative model reasoning is vulnerability analysis. In the past, the vulnerability analysis process has been hindered by the limited modeling capabilities of static analysis techniques and by the limited coverage of dynamic ones. LLMs provide new ways to "understand" what a program does and

determine which inputs can trigger unexpected and undesirable behaviors. Cyber reasoning systems (CRSs) can now autonomously identify and patch vulnerabilities in complex, real-world software systems.

This point was demonstrated by the recent Artificial Intelligence Cyber Challenge (AIxCC) competition (DARPA 2025) sponsored by the Defense Advanced Research Projects Agency (DARPA) and Advanced Research Projects Agency for Health (ARPA-H), where participants developed CRSs capable of finding, exploiting, and patching vulnerabilities in software components routinely used in the nation's critical infrastructure (Box 2). The fact that these systems operated autonomously, without a human in the loop, is remarkable, as it suggests that vulnerability identification can be scaled and accelerated to levels previously unthinkable.

While vulnerability analysis can enable attacks, identifying and patching vulnerabilities before they are exploited is also central to strengthening infrastructure and supporting a shift from a reactive to a proactive security posture. That said, the challenge is not well captured by a simple asymmetry in the number of flaws each side must find. Exploitation and patch development operate under different constraints: attackers can often act on partial knowledge and target specific weaknesses, whereas defenders must verify root causes, ensure fixes do not introduce regressions, coordinate disclosure, and deploy patches reliably across diverse systems and environments. These differences make remediation a more complex and resource-intensive process, even when the same underlying vulnerability is at issue.

The increasing pressure to patch vulnerabilities rapidly may further elevate the importance of formal methods and verification techniques that can help ensure critical system properties are preserved and that mitigations do not introduce unintended side effects (NASEM 2025). Emerging approaches seek to combine AI-assisted software

development with formal methods, verification, threat modeling, strong type systems, memory-safe software architectures, and other security-by-design approaches to prevent broad classes of vulnerabilities from being expressed in the first place. Historically, use of these methods has been constrained by the expertise and effort required. Emerging AI systems may help automate portions of this process; they do not eliminate the need for expert oversight but may reduce barriers that have limited adoption. Such approaches could help shift cybersecurity away from a predominantly reactive "penetrate-and-patch" model and toward more inherently secure systems (Hicks and Lipner 2026).

The resulting asymmetry between exploitation and remediation calls for collective investment in resources for the systematic and continuous assessment of the security of mission-critical software. Early identification and remediation of vulnerabilities benefit a large swath of stakeholders. For example, even before the emergence of generative AI systems, efforts such as Google's OSS-Fuzz, in which thousands of software components are continuously subjected to billions of inputs to trigger crashes, had a substantial impact on the overall security of open-source software. As of May 2025, OSS-Fuzz had helped identify and fix more than 13,000 vulnerabilities and 50,000 bugs across 1,000 projects (Google 2025).

On the development side of the same capability, AI-enabled tools can assist developers by identifying insecure code patterns, highlighting risky deployment configurations, such as credential exposure or weak authentication processes, and supporting secure-by-design development practices (Holley 2026). However, these systems may also reproduce insecure coding practices present in their training data, and studies have shown that AI-generated code can still contain significant vulnerabilities or unsafe patterns (Holz, 2025). Improving the security of generated outputs may therefore require careful prompting, expert oversight, and integration into broader secure development practices rather than reliance on AI-generated code alone.

Exploitation, Red Teaming, and Network Posture Assessment

The ability to identify vulnerabilities in software has been extended to compromising systems and networks, with various results demonstrating that autonomous CRSs can now perform multi-step attacks in complex networks (Folkerts et al. 2026) and win capture-the-flag (CTF) competitions that were once the arena where elite hackers would prove their skills.

The defensive mirror of this capability is continuous, agent-based red teaming. While AI-enabled automated attack tools will generate threats at unprecedented speed and scale, agent-based red teaming can provide continuous assessment of an organization's network security posture, taking into account not only flaws in deployed software components but also the security risks associated with their configuration and interactions. This "always on" assessment, potentially combined with digital twins for highly critical environments such as hospitals and chemical plants (NASEM 2024), represents a new opportunity to improve the overall security of national infrastructure.

More broadly, the assessment of an organization's network security posture is currently performed using a combination of vulnerability scans, network configuration analysis, and red teaming. These approaches, while useful, cannot keep pace with the dynamic nature of modern computer infrastructures and the ever-evolving threat landscape and can demand specialized human skills to interpret, triage, and remediate. As discussed earlier, the challenges of vulnerability remediation stem not only from identifying weaknesses but from the more complex processes required to validate, coordinate, and deploy fixes across diverse systems. In this context, the ability of LLMs to translate information in heterogeneous formats into a common ontology, automate aspects of analysis and response, and identify security risks arising from both software weaknesses and deployment errors creates an

opportunity for adaptive and continuous monitoring of a network's security posture. Additionally, the creation of a shared knowledge base of network-related data would allow different agents to contribute the outputs of different analyses and build on one another's results.

Intelligence Gathering and Cyber Threat Intelligence

The scale and speed at which autonomous AI agents can analyze heterogeneous information sources, interpret natural-language text, and correlate large volumes of data support the discovery of new vulnerabilities, analysis of complex targets, and the development of attack tactics that combine software engineering, vulnerability analysis, malware adaptation, and multi-step attack campaigns.

For example, a threat actor could use AI to analyze organizational and employee data, identify evidence of outdated software from tech support, and select a spear phishing target using social media information. After gaining initial access to the network using stolen credentials, the attacker could exploit known vulnerabilities to move laterally and deploy a tailored malicious payload that has been automatically customized based on the information gathered in the initial phases of the attack.

The same underlying capability—extracting structured meaning from heterogeneous natural-language sources—also underpins cyber threat intelligence (CTI). By extracting tactics, techniques, and procedures of adversaries from threat reports, AI-based defenses can align deployed prevention and detection mechanisms with the evolving threat landscape (Krašovec et al. 2025).

CTI is valuable because threat actors often reuse tools and methods against similar targets (a specific industry vertical, a specific class of users, etc.). Effective information sharing among victims and potential targets enables organizations to reassess their defenses proactively. However, CTI generation remains largely manual and cannot match the speed and scale of sophisticated adversaries.

Key challenges include extracting relevant signals from noisy data and determining which information can be safely and usefully shared. Security-relevant events are often lost in the background of normal events and attack logs may contain sensitive information (e.g., user identities or internal network information), while some technical artifacts may not generalize across contexts. These constraints make CTI production labor-intensive and expertise-driven.

AI offers opportunities to automate CTI generation and sharing. Reasoning models can identify sensitive information that should be withheld and assess the relevance of intelligence for detecting similar attacks elsewhere. Techniques from data leak protection could be extended to support this process. Automated pipelines that continuously share curated threat intelligence could enable a form of "herd protection," allowing organizations to respond collectively at the scale and speed of modern attacks.

Social Engineering and Synthetic Identity

AI systems can enhance social engineering by generating realistic, interactive personas using deepfakes and extracting detailed personal and organizational context from heterogeneous data sources. Combined with information from social networks and compromised accounts, these capabilities enable highly targeted and adaptive deception at scale.

Attacks have evolved beyond email- or voice-based scams and into fully interactive impersonation in videoconferences, where adversaries convincingly mimic trusted individuals in real time. As with other AI-enabled

capabilities, this approach integrates multiple components—data aggregation, natural-language interaction, and synthetic media generation—into coordinated attack workflows. Beyond traditional cyber intrusions, these capabilities may also accelerate AI-enabled scams, fraud, and impersonation campaigns—including the use of synthetic identities or "fake workers"—that operate above the layer of conventional cybersecurity defenses and increase pressure for mechanisms that can establish the authenticity and provenance of digital interactions and content.

Unlike vulnerability analysis or CTI, there is no direct defensive analog that mirrors this capability. Instead, mitigation relies on a combination of technical controls, institutional practices, and user behavior.

A commonly proposed approach is to label or watermark AI-generated content. Some jurisdictions have begun to require such disclosures (Future of Life Institute 2026; TrustArc 2025), and there are current proposals to establish federal legislation.⁵ However, current techniques are easily circumvented by motivated adversaries, and their reliability is limited. False positives and false negatives may reduce trust in labeled content without meaningfully constraining attackers. In the long term, it is plausible that AI-generated and human-produced content will become indistinguishable in practice.

A more robust technical approach focuses on provenance rather than detection. Cryptographic signatures and strong account authentication can more reliably associate digital assets with verified individuals and organizations, regardless of whether AI tools were used in their creation. This approach shifts the problem from identifying real versus fake content to verifying the origin and integrity of information. However, the effectiveness of these approaches at scale remains an open question, with concerns raised about their practical implementation, coverage, and potential limitations in real-world environments.

Nontechnical measures remain important but have inherent limitations. Traditional security awareness training can be extended to address AI-enabled impersonation and spear phishing, though its effectiveness has historically been uneven. Well-crafted attacks are designed to exploit predictable human tendencies, such as trust in authority, urgency, and social familiarity, which limits the impact of training alone.

Accordingly, organizations may need to complement training with procedural safeguards. For example, workflows for high-risk actions—such as financial transfers, credential resets, and access approvals—may need to be revised to incorporate verification steps that are resilient to impersonation, such as multi-party authentication.

Threat Detection and Security Operations Centers

The ability to operate on security "data lakes" at scale supports better detection capabilities. Currently, attacks are detected using a combination of network- and host-based detection techniques, both of which rely on misuse- and anomaly-based approaches. Detection remains fragmented, and the task of reassembling the puzzle of a complex multi-step attack is left to security operations center (SOC) analysts, who are overwhelmed by a barrage of detection events that must be triaged, analyzed, and correlated.

Supporting SOC analysts has been one of the earliest applications of reasoning models in security, and all the major AI companies have created tools to assist SOC analysts in their work. There are nevertheless opportunities to extend and improve on these initial approaches by giving AI agents access to low-level network telemetry data and tools for

the active probing of the network infrastructure. With access to forensic evidence and investigative tools, AI agents can form hypotheses about ongoing attacks, dynamically verify them, and provide timely feedback to the human operator.

This capability is largely defensive because attackers do not have unfettered access to the underlying data feeds, but it has an offensive shadow. AI-enabled malware that, once deployed, connects to LLMs to reason about its surroundings and develop plans for further compromise has already emerged. These agentic malware components, equipped with advanced reasoning capabilities, will pose a formidable threat in the near future, and they are precisely the kind of adaptive adversary that fragmented, pattern-based detection is least equipped to catch.

Incident Response

AI has the potential to dramatically improve the incident response phase. While playbooks and other security automation mechanisms have evolved this field from purely manual approaches to semi-automated processes, humans remain in the loop because of the risk of false positives (and actions taken in response to them) causing more harm than good. Furthermore, a purely pattern-based automated response system could be exploited by an adversary, triggering responses that would damage the network mission or even drive the network into a more insecure state.

The reasoning capabilities of LLMs provide important support here. On the one hand, by providing basic response tools to agents (such as firewall reconfiguration primitives or network segmentation directives), it becomes possible to generate highly customized and dynamic incident response playbooks for detected incidents. On the other hand, LLMs have the capability to reason about the consequences of a proposed plan of action and may be able to identify negative effects or unwanted collateral damage, something that pattern-based playbooks are unable to do (Castro et al. 2025).

Toward Continuous Defense-in-Depth

A common architectural theme runs through the capabilities discussed in this section: AI in general, and agentic workflows in particular, present a significant opportunity to improve the cybersecurity lifecycle. Traditional security controls are deployed, assessed, and updated periodically, with limited coordination across functions such as vulnerability management, threat detection, and incident response. This structure reflects both technical and organizational constraints, including fragmented data, manual workflows, the cost of hiring security evaluators, and the need for human coordination across teams.

AI enables a shift toward continuous defense-in-depth, in which posture assessment, vulnerability discovery and patching, formal verification, threat detection, intelligence generation, and incident response operate as ongoing, interconnected processes. These processes increasingly draw on shared data and a continuously updated picture of systems and their operating environments, allowing signals from one stage of activity to inform actions in others, such as detection insights informing patch prioritization or incident response data feeding back into system hardening. The agents that continuously monitor for vulnerabilities and misconfiguration might even adapt by implementing moving target approaches or deceptive techniques.

This shift depends on several key design choices. Systems that clearly separate data collection—such as telemetry, configurations, and policies—from reasoning about the data may be more robust to ongoing improvements in AI capabilities. Although this choice involves tradeoffs, it allows organizations to evolve or replace reasoning components as models improve, without requiring corresponding changes to the underlying systems responsible

for collecting, organizing, and maintaining security-relevant information. The use of generic tools to probe, test, and modify an organization's network enables more flexible and adaptive responses to emerging threats, while shared knowledge bases allow multiple agents to build a common representation of system state. Together, these elements support more flexible and dynamic detection and response mechanisms than traditional, predefined workflows.

Continuous defense-in-depth also leverages a structural advantage for defenders: persistent visibility into their own systems. As data accumulates and processes become more integrated, defensive capabilities may improve over time, creating increasing returns that are difficult for attackers to replicate.

Workforce Implications

Cyber defense is a demanding task that requires a highly skilled workforce. AI has the potential to act as a workforce multiplier, automating certain tasks and assisting humans in their decision-making across every phase of the defense lifecycle described above. However, the implications for the workforce are more complex than simply alleviating a shortage of workers. AI is likely to change both the types of skills required and the value placed on different skill levels. As AI systems take on routine tasks, demand may shift toward higher-level capabilities such as system design, integration, oversight, and adversarial reasoning, while reducing the need for some entry-level or intermediate roles. At the same time, effectively directing AI systems may itself become a specialized skill. Developing prompts, workflows, and operational constraints that reliably produce secure code, sound analysis, or low false-positive and false-negative rates may require significant technical expertise and domain understanding.

This shift raises important questions about the structure of the workforce pipeline. As discussed earlier, increased reliance on AI may reduce opportunities for "learning by doing," particularly for junior practitioners. This dynamic may parallel emerging trends in software development, where early evidence suggests that AI coding tools are already concentrating productivity gains among senior engineers while compressing demand for some junior roles. If similar patterns emerge in cybersecurity, there is a risk of a "hollowing out" of the workforce pipeline, in which fewer opportunities exist for developing foundational expertise, even as demand for advanced skills increases. In the near future, cybersecurity roles may increasingly shift from direct operational work toward the coordination and oversight of large numbers of AI-enabled agents, placing greater emphasis on higher-level reasoning, integration, and adversarial analysis skills rather than routine operational tasks alone.

The pace of AI adoption further complicates workforce development. Educational institutions and training programs already struggle to keep curricula aligned with rapidly evolving technologies and practices (World Economic Forum 2024). Closer coordination between academia, industry, and government could ensure that graduates enter the workforce with relevant skills and that the overall system produces an appropriate distribution of expertise across experience levels. Structured apprenticeships, rotational programs, work-integrated learning, and opportunities for continuous upskilling may become increasingly important in ensuring that junior practitioners continue to develop foundational reasoning skills even as AI systems absorb more routine operational tasks.

Addressing workforce challenges in this environment will require a broader approach than increasing the number of trained professionals alone. Investments in education and training will need to account for changing skill requirements and the potential erosion of traditional career pathways. AI may ultimately enable a more productive and effective cybersecurity workforce, but realizing this potential will depend on deliberate efforts to align workforce development with the evolving demands of an AI-enabled cybersecurity landscape.

Policy Considerations

The dual-use nature of AI-driven cybersecurity capabilities creates strong incentives to restrict access to advanced tools, particularly during the near-term period in which attacker advantages may be most pronounced.

One approach is to provide advanced capabilities through controlled services with restricted access, selectively enabling use by trusted organizations and individuals responsible for defense while limiting availability to potential adversaries. This model can delay the widespread availability of powerful tools, giving defenders additional time to identify and mitigate vulnerabilities before those tools are broadly accessible. Several frontier AI developers have adopted controlled deployment models that limit access to advanced capabilities. Anthropic has pursued such an approach through programs such as Project Glasswing, including releases like the Claude Mythos preview (Anthropic 2026), while other providers have introduced cybersecurity-focused capabilities, such as OpenAI's GPT-5.5-Cyber (OpenAI 2026), through staged or restricted-access frameworks designed to manage dual-use risks.

More broadly, OpenAI, Anthropic, Google, Microsoft, and xAI have participated in voluntary arrangements to provide governments with early access to frontier models for security evaluation prior to broader deployment (Eastland and Ghaffary 2026). Most recently, Anthropic announced an expansion of Project Glasswing to approximately 150 organizations across more than 15 countries, including NATO, the European Union Agency for Cybersecurity (ENISA), and operators in the energy, healthcare, and semiconductor sectors, reflecting growing international demand for access to frontier cyber capabilities (Murgia and John 2026).

Government involvement in these efforts has also increased. On June 2, 2026, the Trump administration issued an executive order establishing a voluntary 30-day pre-release review period for frontier models and a Treasury-led clearinghouse intended to support cross-sector vulnerability remediation and coordination.⁶ In effect, these measures aim to create a window in which defenders can find and fix vulnerabilities before comparable capabilities become widely available.

While the responsible deployment of these powerful dual-use technologies may help mitigate risk, this approach is effective only for proprietary models that are deployed as services. A contrasting dynamic is the rapid diffusion of capabilities through open-weight and open-source models.⁷ In these settings, access controls are largely ineffective: models can be modified, redistributed, and fine-tuned with relatively few constraints, and safety measures can often be circumvented. At the current pace of technological development, comparable capabilities are likely to emerge in open-weight and open-source models within a relatively short time horizon, limiting the duration of any advantage gained through restricted access. Early evidence suggests that open-weight models—particularly when combined with scaffolding or fine-tuned on domain-specific cybersecurity data—can already perform certain cybersecurity tasks at levels approaching more advanced frontier systems (de Gregorio 2025). As a result, any advantage gained through restricted access may be short lived (Figure 1).

These dynamics reinforce a broader challenge discussed earlier in the report: the persistent misalignment between incentives and security outcomes. The pressure to deploy increasingly capable systems, combined with the difficulty of assessing their security implications, creates incentives to prioritize capability adoption over resilience

and risk reduction. In this environment, stronger accountability mechanisms, security evaluation practices, and investments in adversarial testing may help narrow the gap between capability development and security practice during a period of rapidly diffusing AI-enabled cyber capabilities.

These contrasting cases illustrate a broader tension. Controlled-access models can slow the diffusion of advanced capabilities, but they operate within a global ecosystem in which comparable tools may emerge through open-source channels or from providers outside a given regulatory jurisdiction. This dynamic also highlights the challenges of regulation in this domain. While it might be feasible to influence how domestically operated AI services are deployed and accessed, it is significantly more difficult to control the availability or use of open models, or of systems developed and hosted internationally.

SOURCE: Data from Wang et al. 2025.