How Security Leaders Can Adapt Cyber Defenses for Frontier AI

Cybersecurity has long been a race between attackers trying to get in and defenders trying to keep them out. But frontier AI is changing the pace of that race. By helping threat actors discover vulnerabilities, conduct reconnaissance and experiment with attack techniques more quickly and at a greater scale, AI can shrink the time security teams have to recognize a threat and respond before it causes damage. Offensive activities that once took weeks can increasingly be compressed into minutes. 

That shift also challenges a more fundamental assumption behind traditional detection: that defenders will recognize enough of an attack to know what they’re looking for. Frontier AI can help adversaries vary techniques, combine attack methods and explore unfamiliar paths at a scale that makes relying primarily on established signatures, indicators and playbooks increasingly risky. Cybersecurity guidance is consequently evolving toward models that account for AI-enabled attacks while also using AI to strengthen defense and proactively address emerging threats.

Preparing for that environment means looking beyond how quickly an organization can identify an attack to how much room for maneuver its systems leave an attacker in the first place. Members of the Senior Executive Cybersecurity Think Tank share deep expertise in enterprise cybersecurity strategies, data breach prevention, risk management, threat detection and modern security architecture. Below, they explore how security leaders should adapt their defenses for an AI-accelerated threat landscape and which capabilities are becoming most important.

“Detection is a mission-critical safety net, not the core strategy.”

– David Etue, CEO of Cyberbit

SHARE IT

See Everything and Harden It Continuously

David Etue, CEO of Cyberbit, argues that detection should serve as a safeguard within a broader security strategy, rather than form its foundation.

“Security programs built solely around detection were always on borrowed time,” Etue says. “If you don’t know what you have, how it’s configured and how it’s changing, security is guesswork. Detection is a mission-critical safety net, not the core strategy.”

AI raises the stakes by accelerating the process attackers can use to identify and exploit weaknesses.

“Frontier AI’s superpower is speed, not magic,” he says. “It compresses the window between exposure and exploitation and turns a misconfiguration, unmanaged asset or vulnerability into a race defenders risk losing.”

Etue says organizations need visibility into both their assets and the controls protecting them.

“Continuous asset discovery and attack surface management ensure you know your environment,” he says. “Configuration assurance and control validation across identities, endpoints, the cloud and networks make the adversary and their AI’s job harder by removing low-hanging fruit. A prepared security operations team with an AI-enabled control plane and robust telemetry can achieve continuous improvement and focused detection and response.”

His bottom line: “See everything and harden it continuously, with detection for exceptions.”

Move From Reactive to Proactive Security

Thomas Kranz, Founder and CISO of Thomas Kranz Consulting, says the limitations of reactive security predate the latest advances in AI.

“Defensive, reactive security hasn’t been efficient or successful for many years now,” Kranz says. “A reliance on frameworks like Mitre’s Att&ck has meant security teams have followed flowcharts rather than understood how hackers work.”

He sees AI agents and advanced data analysis as tools that can help security teams operate differently.

“Leveraging the capabilities of AI agents and complex data analysis moves security from reactive to proactive,” Kranz says. “This reduces the level of false positives we see with security alerts and combines probabilistic analysis and event correlation to focus security teams’ investigations on actual suspicious events.”

The shift could also change what security monitoring tools are able to do after potentially malicious activity is identified.

“Monitoring tools now have the potential not only to report the probability of suspicious activity—instead of an unhelpful criticality rating—but also to automatically respond,” Kranz says. “People have spoken about SOAR for many years, but now, with connected AI agents, we have the opportunity to proactively investigate and address suspicious activities, whether they are known indicators of compromise or not.”

Build Visibility Beyond the Perimeter

Kumar Ritesh, Founder, Chairman and CEO of CYFIRMA, says security leaders need to rethink where and when effective defense begins.

“Security leaders need to shift from reactive detection to preemptive, predictive defense,” Ritesh says. “That means continuous external attack surface monitoring, threat intelligence that anticipates adversary behavior before it hits your perimeter, and AI-driven correlation that spots anomalies, not just known signatures.”

For Ritesh, that requires a wider view of the threats and exposures developing outside an organization’s network.

“The capability that matters most now is comprehensive visibility into the external threat landscape,” he says. “This is achieved by combining multiple pillars of external threat management—attack surface, brand, vendor, dark web, vulnerability, third parties, situational awareness, and threat and digital risk intelligence—into a single, unified view with threat-led prioritization.”

He adds, “Defense built only on what’s inside your network is already a step behind.”

“Security leaders should assume AI will make exploit discovery faster than remediation. Annual tests and monthly patch reviews are not enough.”

– Harikrishnan Muthukrishnan, Principal IT Developer for BCBS FLORIDA

SHARE IT

Continuously Test and Strengthen Defenses

Harikrishnan Muthukrishnan, Principal IT Developer for BCBS FLORIDA, says organizations should plan for an environment in which traditional remediation schedules can’t keep pace.

“Security leaders should assume AI will make exploit discovery faster than remediation,” he says. “Annual tests and monthly patch reviews are not enough.”

Muthukrishnan asserts that vulnerability management will need to become faster and more responsive.

“Defense must include real-time vulnerability intake, risk-based prioritization, automated patch validation, emergency change paths and compensating controls when patching cannot happen immediately,” he says. “Detection must move from known indicators to behavior: identity analytics, endpoint telemetry, cloud baselines and anomaly detection tied to business context.”

Muthukrishnan also stresses that organizations need to test whether their defenses can withstand realistic attacks rather than simply assume controls will perform as intended.

“Defenders should continuously test through red teaming, breach simulation and purple-team exercises to prove controls stop realistic attack paths,” he says. “Finally, secure engineering must move upstream through threat modeling, API security, secrets management, dependency governance and IaC scanning.”

Focus on Disrupting Attack Paths

Bhavya Bhandari, Cybersecurity Risk Management Leader, Financial Services at Ernst & Young US LLP, says faster vulnerability discovery is weakening the value of security practices built around periodic reviews.

“Frontier AI is reducing the time available to discover vulnerabilities, making traditional approaches based on periodic assessments and severity ratings less effective,” Bhandari says. “Security leaders need to shift from a detection-focused mindset to a disruption-focused one.”

That change puts greater emphasis on addressing exploitable weaknesses before adversaries can act on them.

“Organizations should prioritize continuous exposure management, AI-assisted vulnerability discovery and remediation, and attack-path analysis,” he says. “The goal is no longer limited to finding threats after compromise; we must also reduce exploitable exposure and remediate risks faster than adversaries can weaponize them.”

Building a Defense Model for an AI-Accelerated Threat Landscape

• Treat detection as a safety net, not the foundation of your security strategy. Prioritize continuous asset discovery, configuration assurance and control validation so attackers have fewer weaknesses to exploit.
• Harden the environment continuously, not periodically. AI can compress the time between exposure and exploitation, making static inventories and infrequent reviews increasingly risky.
• Use AI and advanced analytics to make security operations more proactive. Probabilistic analysis, event correlation and connected agents can help teams focus on genuinely suspicious activity and respond more effectively.
• Look beyond known indicators and established playbooks. Security teams need capabilities that can identify anomalous behavior and investigate suspicious activity even when it doesn’t match a familiar pattern.
• Expand visibility beyond the organization’s perimeter. External attack surface monitoring, threat intelligence and digital risk data can help security teams identify emerging exposures before they become internal incidents.
• Unify external threat information around risk and prioritization. Bringing attack surface, vendor, vulnerability and threat intelligence into a consolidated view can help teams focus on the exposures most likely to matter.
• Accelerate vulnerability management to match the pace of modern threats. Real-time vulnerability intake, risk-based prioritization, automated patch validation and compensating controls can reduce the gap between discovery and remediation.
• Continuously test whether security controls work against realistic attacks. Red teaming, breach simulations and purple-team exercises can expose weaknesses before adversaries do.
• Move secure engineering further upstream. Threat modeling, API security, secrets management, dependency governance and infrastructure-as-code scanning can reduce exploitable weaknesses before they reach production.
• Focus on disrupting viable attack paths, not simply identifying threats after compromise. Continuous exposure management and attack-path analysis can help organizations reduce the opportunities adversaries have to turn vulnerabilities into successful attacks.

Make Attackers Work Harder

Frontier AI is increasing the speed and variability of offensive cyber activity, but the answer isn’t simply faster detection. Security leaders need broader visibility, stronger and more continuously validated controls, more responsive vulnerability management, and a greater ability to recognize suspicious behavior. Just as importantly, they need to reduce the number of exploitable paths available to attackers in the first place.

As AI continues to lower the cost and time required to probe systems for weaknesses, the advantage may increasingly go to organizations that can make their environments difficult to exploit before an alert is ever triggered. Detection will remain essential, but the strongest defense models will pair it with continuous hardening, proactive intelligence, realistic testing and rapid disruption of attack paths.