“Will frontier AI be what finally tips the scale toward attackers?”
I hear some version of that question from almost every security and identity team I talk to. After the past year, it’s a fair question. But it’s usually framed as an arms race of capability, where whoever gets AI working first wins.
That framing misses what’s actually changing. Security operations weren’t built against a specific attacker. They were built on assumptions about how human attackers work: how fast they move, what they cost, how they learn, when they quit, and what they leave behind.
AI agents break most of those assumptions. One holds, and it’s where defenders get their advantage back.
How we tested how AI attackers work
To get past speculation, a group of us across research, incident response, and product at Silverfort built an AI attack simulator. We kept it model- and tool-agnostic and ran it in a contained lab. A lab is cleaner than most production networks, so treat what follows as patterns, not benchmarks.
Assumption #1: Attacks are sequential
Human intrusions are paced by sequence and reasoning. An operator gets credentials, stops, decides what to do next, then does it: recon, then access, then escalation, then exfiltration. Most detection and response models are built around that pacing.
Agents don’t take turns. Our simulator typically ran five to 10 agents in parallel, each working a different phase toward the same objective. Once initial credentials were in hand, the phases stopped waiting on each other. One agent harvested more credentials while another moved laterally and a third escalated privilege, each acting on what the others had already found. The full chain to domain takeover completed in four to five minutes, faster than most teams can triage a single alert.
Agents move at machine speed, limited mainly by how fast they can take in and act on information. That outpaces any human-driven response, and often automated response too, when automation depends on shipping telemetry to a central platform and processing it before it can act.
The parallelism matters just as much. Detection logic and analyst intuition are tuned to recognize a kill chain unfolding in order. When phases overlap and feed each other instead of following in sequence, the early stage defenders are trained to catch may never show up on its own.
Assumption #2: Attacks scale with headcount
The usual read on AI economics is that attacks just got cheaper, and they did. Our simulator completed a full run for the equivalent of $12, which fell to about $4 over time. A failed run that kept iterating cost $25.
But cost isn’t the shift that matters. The real constraint on attackers has rarely been exploits or tooling. It’s the skilled labor between initial access and action on objectives.
Consider a ransomware crew with candidate access to a thousand organizations and enough skilled operators to properly work ten. The other 990 aren’t failed attacks. They’re unworked inventory. Initial access can already be generated far faster than humans can turn it into compromises.
That’s the bottleneck agents remove. Booz Allen Hamilton noted in When Cyberattacks Happen at AI Speed (March 2026) that parallel activity that once required several specialists can now be done by one person. Agents don’t need to outperform a skilled operator, and they don’t even need to be cheap.
They only need to make the next unworked foothold worth pursuing.
Assumption #3: Attackers rely on what they remember
In human operations, context is hard-earned. It lives in an operator’s head, their notes, and conversations with other actors, and it moves at the speed of people. Case management, personal knowledge management, and other tools have all improved information accessibility, but its consumption and regurgitation has always been bound by human limitations.
Our agent built a plan and spawned sub-agents. Each one wrote what it found, including assets, identities, and valid credentials, into a shared memory that every other agent could read and plan against. When a human operator finds something that changes the plan, they stop and reason through it. Agents re-plan in real time from a single source of context.
Human operators leave value on the table: a credential in a deployment script, an over-permissioned group noted and never revisited, a share that looked unimportant at 2 a.m. In a human operation, findings compete for one person’s attention. In an agent operation, every finding is immediately available to every agent that can use it. The attack surface stops being what one operator noticed and becomes the sum of everything any agent found.
Assumption #4: Attackers get tired, frustrated, or scared
Defenders have quietly relied on human friction for decades. “Burden the adversary” has been a mantra for good reason. A blocked operator gets frustrated, makes mistakes, worries about getting caught, and often moves on to an easier target.
An agent doesn’t. It is a truly persistent threat. In our simulator, a blocked task didn’t end in a give-up. It ended in another attempt, and another, with no natural limit on how many. Only when enough tasks failed did the agent step back and reconsider the plan itself. A closed door meant trying the handle again, then looking for a different door. It stopped only when it ran out of paths, never out of patience. The $25 failed run wasn’t waste. It was the agent refusing to quit.
This will change the shape of cybercrime. Much of it has been opportunistic, because tenacity was expensive and reserved for high-value targets. When tenacity costs almost nothing, less sophisticated adversaries can run sustained, targeted campaigns against a specific organization.
Assumption #5: Attackers use tools defenders can recognize
Detection has long worked in layers. Some detections key on specific attack tools. Better ones key on techniques, the behavior an attack produces regardless of the tool behind it. Beneath both sit broad behavioral analytics that fire constantly. Confidence usually comes from correlating across those layers, and that takes context and time.
Agents don’t need novel malware to stress that model. Attackers have already been moving toward trusted tooling: signed admin utilities, commercial remote access, and whatever is native to the environment. Agents accelerate that shift. They’re fluent in PowerShell, WMI, LDAP queries, and built-in utilities, and they compose them on the fly for each environment rather than carrying a known kit. Tool-specific detections lose their grip, and what’s left looks a lot like administration.
That leaves defenders leaning on their lowest-fidelity layer at the moment they need certainty most, while many parallel trails flood it with noise. Teams that can’t tell which signals matter contain broadly, and broad containment becomes its own business disruption. The attacker causes damage through the defender’s response.
What the agent can’t compose its way around is authentication. Whatever tooling it uses, it still has to present a credential. It’s no coincidence that the technique detections that hold up best, like anomalous Kerberos ticket requests or directory replication from a host that isn’t a domain controller, are anchored in authentication and directory behavior. Scoping by identity, meaning which accounts authenticated where and which of those authentications were legitimate, collapses the complexity of dozens of trails into the few identities actually driving them.
What doesn’t change because of AI attacks: agents still run on access
Attack agents were built on how human attackers operate, so the overlap is as revealing as the differences.
The first overlap is identity. Like a human, an agent moves through an environment using legitimate credentials. Once it holds a valid identity, its activity looks like normal authentication, and a compromised account behaving a little oddly rarely trips EDR or network controls.
Part of the reason is how security operations treat identity. In most SOCs, identity is an artifact: a field in a log, an attribute that enriches an alert, something to pivot on after the fact. It’s rarely treated as what it is in an intrusion, both the vehicle the attacker rides and the control point where the ride can be stopped. Agents exploit that gap at machine speed.
The second overlap is the path of least resistance. Across our runs, the agent went after non-human identities first and showed a clear preference for service accounts. Service accounts often far outnumber human identities. They’re usually over-permissioned and rarely have a single point of control.
The accounts organizations monitor least are the ones agents target most.
None of this is new. Abuse of privileged and trusted identities played a central role in intrusions like SolarWinds. What’s new is that an agent can turn everything frontier models know about attacks like that into something close to instinct, applied in minutes. The identities hardest to manage are often the ones the business depends on most. Against an attacker that goes after them first, they can no longer be neglected.
Those identities are also where the agent was stopped. When we reran the same attack with two controls enforced at authentication, a service account restricted to the systems it legitimately needed and MFA required on a domain admin across all protocols, the outcome flipped from domain compromise to “could not reach objective.” The agents re-planned around each block, but every new route still ran through an identity they couldn’t use. What mattered was where the controls sat: at the access decision, the one point the agents couldn’t route around.
Access isn’t a matter of skill. It either exists to be abused or it doesn’t.
Identity Security controls are one piece of the puzzle in defending against AI attacks
Almost every intrusion has an identity component, and lateral movement and privilege escalation have to pass through authentication. That’s where the agent is most constrained and the defender has the most leverage.
But Identity Security controls aren’t a complete answer, and it’s worth being precise about where they stop. If an agent abuses access an identity already legitimately holds, no single access decision may look wrong. Data moving through permitted paths, or an exploit against an exposed service that needs no credentials, sits outside the access decision entirely. Those still need detection, data controls, and patching.
3 questions for security leaders in the AI attack era
So does AI tip the scale? Only where access is left undefended. The shift is from treating identity as an artifact to treating it as a control. Answering AI attackers with faster detection runs into the math. A team that can’t triage at the speed of the attack won’t close the gap by triaging slightly faster. The more useful question is what your decisive first line of defense will be. Three questions help answer it:
- Which non-human identities can authenticate to your most critical assets, and does anyone own them?
- Which of those access decisions can you deny or challenge in real time, rather than detect after the fact?
- If a service account were compromised mid-incident, how long would it take to restrict it without breaking production?
If the answers are “we don’t know,” “few,” and “hours,” that’s the gap an agent will find first.
You won’t out-triage an AI agent. You can deny the access it depends on, at the moment it tries.
Learn more about how to stop AI attacks by getting your copy of the AI Attack Readiness Kit.
