AI in the wild: Preparing for the AI driven attack era

Cyber attacks are undergoing a fundamental shift from malware driven events with clear indicators to AI-accelerated, identity based operations that blend into normal business activity.

Historically, defenders focused on detecting malicious files, signatures, and known attack patterns. Today, attackers increasingly operate using valid credentials, trusted tools, and cloud-native access, making their actions difficult to distinguish from legitimate users. The challenge has moved from identifying obvious threats to recognising subtle deviations in behaviour.

AI is accelerating this shift. In identity takeover scenarios, highly personalised phishing, impersonation, and MFA bypass techniques allow attackers to gain access without triggering traditional alerts. Once inside, AI-assisted, hands-on-keyboard activity enables rapid navigation of environments, with actions that closely resemble standard administrative tasks.

To ground this in reality, we will unpack an AI-generated command-and-control (C2) sample located by our team in the wild. We will demonstrate how AI-assisted techniques are already being used in active attacks, highlighting how accessible, adaptable, and scalable these capabilities have become.

Looking ahead, SOC teams face a more complex operating environment. Attack activity increasingly mirrors legitimate behaviour, reducing the effectiveness of traditional detection methods. At the same time, the volume of alerts and telemetry continues to grow, placing pressure on analysts to distinguish meaningful signals from routine activity. The challenge shifts from simply identifying threats to making fast, confident decisions with incomplete or ambiguous information.

Preparation requires more than additional tooling. It depends on improving how teams operate under pressure, clarifying escalation pathways, strengthening coordination between SOC, IR, and business stakeholders, and regularly testing response capabilities against realistic scenarios.

By 2028, the organisations that respond effectively will not be those with the most alerts, but those with the ability to recognise intent, prioritise risk, and act decisively.