With promises of operational efficiencies many organisations are accelerating the adoption of AI. At the same time other organisations are struggling to step back and assess the real benefits AI offers. There is uncertainty about “sharing” sensitive information with an unknown AI assistant.
This challenge isn’t new. Cyber security has long grappled with building trust in existing systems and the controls that protect them. In truth, most businesses still haven’t achieved effective cyber security risk management practices for traditional technologies, let alone for emerging ones like AI. Now is the time to recalibrate your defence strategies.
What’s different now is scale and speed. AI amplifies attackers’ capabilities, enabling them to identify and exploit weaknesses faster and more precisely than ever. For organisations already struggling to contain cyber risk, the leap to maintain cyber resilience in an AI-driven threat landscape adds another degree of difficulty.
The Baseline for New AI Risks
Many security teams are introducing AI security solutions into environments while foundational risks remain unresolved. Breaches, both trivial and sophisticated, continue to rise for familiar reasons:
- Patching fatigue: The sheer number of updates makes it difficult to keep systems secure.
- Control gaps: Measures like MFA, access controls and backups may exist, but are often ineffectively applied.
- Underinvestment: Security is still perceived as complex, costly, or “someone else’s problem.”
In a world where operating costs continue to be a challenge, the risks and costs of a cyber breach are too easily discounted. Funding is often limited and protection is left to “best efforts” relying on free or open-source tools and manual processes. This reactive mindset leaves organisations exposed, often only apparent when insurance claims are rejected.
The challenge compounds when IT services are outsourced or hosted in the cloud, making it harder to see how well controls are performing against evolving threats. Assurance without evidence is not enough. Third parties may unwittingly introduce their own vulnerabilities, or become attack vectors themselves.
Strong cyber security is ultimately the responsibility of senior leaders in every organisation. Cyber hygiene controls remain the cornerstone of all cyber security frameworks. And, in an AI-enabled threat environment, ensuring they work effectively is more important than ever.
This “perfect storm” of insufficient control recently prompted a ministerial letter to FTSE CEOs in the UK, urging tighter governance, improved security controls, and supply chain assurance. It’s a reminder that compliance dashboards alone are not security, not in a world moving at AI speed.
Enter the AI-Enabled Attacker
In Huntsman’s Cyber Security Predictions for 2026, we anticipate a significant AI-powered or AI-assisted attack, and this is no longer an alarmist view.
The reality is simple: attackers are already using AI to automate reconnaissance, exploit vulnerabilities, and scale campaigns. The recent NCSC Annual Review, reminded organisations that the gap between cyber threats (AI-assisted and others) and national defence capability continues to widen. To keep pace, security operations must mature rapidly.
Here’s what every security leader should prioritise:
Stay Ahead of AI-Driven Adversaries
AI-enabled attackers will find any vulnerability. Certainly faster than a human can. The only defence is to detect them early and reduce their number quickly. Visibility of threats and effective cyber posture management will be enhanced with a layered defence-in-depth strategy.
Security technologies must go beyond manual checks or periodic audits. Continuous, automated detection and response are now table stakes.
Move to Continuous, Evidence-Based Security
Annual audits and quarterly penetration tests are no longer sufficient. With AI adding to attack effectiveness businesses need real-time visibility into their security posture, detecting and remediating issues before they accumulate into unmanageable risk.
Claims like “patching can’t be done faster” or “data isn’t available”, no longer hold up. Timeliness is now synonymous with resilience.
Track Every Asset: Especially the Unknown Ones
Shadow IT, IoT and OT devices often sit outside the security team’s field of vision. These hidden assets create blind spots ripe for exploitation.
Every device must be known, tracked and managed, whether owned by IT, business units or third parties. Ongoing awareness and containment of unprotected IT assets are essential to prevent AI-assisted attacks from finding and exploiting them.
Detect Changes in Real Time
Modern infrastructures evolve constantly. New systems are spun up, cloud resources deployed, accounts added or removed.
Security teams must now routinely detect and assess these ongoing changes to ensure that the overall cyber posture remains adequate. Automated processes mean that even small lapses in configuration can prevent the AI-assisted exploitation of vulnerabilities.
Deliver Evidence for Governance and Oversight
Boards and executives are now directly accountable for cyber risk governance. To exercise that responsibility, they need trustworthy, timely data about the organisation’s ongoing control effectiveness and vulnerabilities in a changing threat environment.
Objective, evidence-based reporting ensures informed decisions and demonstrates effective cyber risk management and compliance with evolving regulatory expectations.
Thwarting the AI-Equipped Attacker
In an increasingly automated world, businesses must evolve from working harder to working smarter. Like business operations more generally, cyber governance must transform. Two priorities stand out:
- Close control gaps fast. The responsiveness of IT and security risk management practices must match the speed and precision of AI-equipped adversaries.
- Maintain real-time visibility. Posture reporting must be accurate, timely, and comprehensive to support confident governance decisions.
Remaining static while threats accelerate is not an option and may even border on negligence. AI has permanently shifted the risk landscape. The organisations that succeed will be those that can respond to that change.
Products
Solutions
Learning & Resources
About Huntsman
