And the scariest part? The person launching the attack might not even know how to code.
In 2009, NSA Director Lt. Gen. Keith Alexander warned that the next war would begin in cyberspace. Seventeen years later, his prediction is looking less like a warning and more like our daily reality.
$50 Per Intrusion
Consider this: Reuters recently reported that a single hacker used autonomous AI agents to attack more than 1,200 websites, successfully compromising systems at over 100 companies. The estimated AI compute cost? Roughly $5,000. That's about $50 per successful intrusion.
Let that sink in. We are entering an era where capabilities that once required entire teams of elite, highly skilled state actors can now be orchestrated by a single individual with a credit card and an API key.
But here is the uncomfortable truth that should concern every security leader.
The Defenders Had the Tools First
Security vendors have had access to frontier AI vulnerability-discovery tools since early spring, with industry-wide collaborative testing underway by April. These models can analyze massive codebases, pinpoint weaknesses, and draft working exploits at speeds previously unimaginable. Yet months later, we continue to see critical vulnerabilities disclosed across the security industry itself.
Is this negligence? No. It's exposure.
Frontier AI is NOT the silver bullet we were promised.
If these models could easily find and fix every vulnerability, we would see far fewer zero-day surprises. In a perfect world, vulnerabilities would be discovered, validated, and remediated long before they ever became public. But that's not the world we're living in. Is it human oversight? Poor prompt engineering? Training data limitations? The sheer complexity of modern software? It's likely all of them. And while defenders are trying to figure it out, adversaries aren't waiting around.
Attack Gets Easier Before Defense Gets Safer
What happens when AI makes attacking software exponentially easier before it makes defending software fundamentally safer?
The technical barriers to entry for cybercrime are collapsing. The gap between a script kiddie and a sophisticated threat actor is narrowing to a sliver. Imagine nation-states deploying tens of thousands of autonomous agents capable of discovering, exploiting, and adapting to vulnerabilities around the clock. No sleep. No fatigue. No waiting for human operators to approve the next step.
I remain optimistic that AI will eventually help us eliminate entire classes of vulnerabilities and build the most secure software in human history.
But we are not there yet. Not even close.
What We Must Do Now
Until then, we must recognize that the traditional economics of cybersecurity have permanently shifted: we cannot defend at human speed against adversaries operating at machine speed. My call to action is simple: stop treating AI-powered cyberwarfare as a future event. It is already here.
We must:
- Minimize the attack surface
- Shrink the blast radius
- Assume breach, deploy decoys everywhere
- Implement Zero Trust access best practices
- Minimize risk of AI assets
- Discover, prioritize, and fix vulnerabilities at machine speed
- Continuous red teaming
Bottom Line
The next arms race isn't about missiles, armor, or warships. It is about algorithms.
Here is the question every CEO, board member, and security professional needs to answer today:
Are we building AI-powered defenses fast enough, or are we unintentionally creating the single greatest offensive cyber advantage in human history?
Originally published on LinkedIn. Join the conversation there.