📊 Full opportunity report: The Frameworks Can’t See the Thing That Matters: A Year of AI-Enabled Cyber Threats on ThorstenMeyerAI.com — validation score, market gap, and execution plan.
TL;DR
A year-long analysis shows AI is enabling less skilled attackers to carry out advanced cyber operations, undermining traditional threat assessment methods. The shift toward AI-driven techniques deep inside networks raises new security challenges.
A new analysis from Anthropic reveals that AI is significantly changing the landscape of cyber threats, enabling less skilled actors to perform complex attacks that previously required expertise. This shift challenges longstanding threat assessment frameworks and raises concerns about the evolving danger of cyberattacks in 2026.
Anthropic examined 832 accounts banned for malicious activity between March 2025 and March 2026, mapping their techniques onto the MITRE ATT&CK framework. The study found that a majority of these actors used AI primarily for preparing malware, with 67.3% employing AI to generate attack materials. More notably, a growing share—rising from 33% to 56% over the year—of attackers were classified as medium risk or higher, indicating an increase in threat level.
Importantly, the report highlights a shift in AI usage from initial access techniques, like phishing, toward post-compromise activities such as lateral movement and account discovery. AI’s role in these complex tasks has lowered the skill barrier, allowing less experienced actors to perform operations that previously required technical expertise. The data shows that the number of techniques used by actors no longer correlates with their threat level, as even less skilled actors employ nearly as many techniques as more advanced ones, thanks to AI assistance.
The frameworks can’t see the thing that matters
For decades, danger meant which techniques an attacker commands. A year of real AI-enabled attacks — 832 banned accounts mapped onto MITRE ATT&CK — shows that signal breaking, just as a new, harder-to-see one takes over.
A year of real misuse, mapped to the standard taxonomy
A window, not a census — these are the cases with enough detail to assess techniques thoroughly. Inside it, the risk level climbed fast.
WHAT WAS STUDIED
THE RISK CLIMB · MEDIUM-OR-HIGHER ACTORS
Python Scripting for Cybersecurity: Linux Edition: Volume 2 – Log Analysis, Network Visibility, and Threat Detection with Hands-On Python Projects
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
“More techniques” stopped meaning “more dangerous”
The old heuristic: count the techniques, judge the tooling. AI dissolved it — because the model supplies the techniques either way. Watch the old signal fail, then watch what it misses.
Risk score vs. technique count
Two ways to read the same attacker. One is going blind. Press play.
AI-powered malware analysis tools
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Deeper into the attack — and into less-skilled hands
Across the year, AI use drifted from getting in toward acting once already inside — the operationally demanding stages that used to require an expert.
The attack lifecycle · where AI is now applied
The center of gravity moved right — toward post-compromise work.
Network Intrusion Detection
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
From “what they know” to “what they’ve built”
The report sorts the signals into three tiers — one dead, one fading, one durable.
Technique count & tooling
16 vs. 20 between novice and expert; platform doesn’t correlate. The model supplies the techniques either way.
Where in the lifecycle AI is applied
Concentrating on operationally demanding, post-compromise stages is a better signal — but it’s eroding as the whole population heads there.
The scaffolding around the model
Architectures that let the model chain stages and run with minimal human input. Not what they know — whether they’ve built a system that lets AI run the attack.
cybersecurity threat assessment tools
As an affiliate, we earn on qualifying purchases.
As an affiliate, we earn on qualifying purchases.
Fixing the map before the territory moves again
A taxonomy that can’t name the most dangerous behavior on the field will quietly mislead the people relying on it. The response runs in two directions.
Fed back into the models
The findings informed safeguards on the most capable models, built to detect & block some of what was observed:
- Blocking malware development
- Blocking mass data exfiltration
- Putting tools in defenders’ hands first (Project Glasswing)
Taking it to the source
Following the Verizon work, Anthropic says it’s in discussions with MITRE about how ATT&CK might evolve:
- A vocabulary for agentic orchestration
- Naming the scaffolding that makes a model an operator
- An interactive technique visualization on the Red blog
Reading it in proportion
- The 832 cases are a detailed subset, not the full population — the precise percentages are directional, not definitive.
- “More autonomous” is not “fully autonomous” — even the standout case needed human input at key moments, which is itself a place for defenders to intervene.
- This is one vendor’s window — the company with visibility into misuse of its own model, publishing what it found. The right thing to do with the data, and worth remembering as you read it.
Impact of AI on Threat Assessment Frameworks
This development fundamentally alters how cybersecurity professionals evaluate threat actors. The traditional heuristic—more techniques and advanced tools indicate higher danger—no longer holds because AI enables less skilled actors to perform sophisticated operations. As a result, threat models based solely on observable techniques or tooling are increasingly unreliable, demanding new approaches to threat detection and assessment.
Evolution of Cyberattack Techniques in the AI Era
For decades, threat assessment relied on counting techniques and analyzing tools to gauge attacker sophistication. The MITRE ATT&CK framework became a standard for mapping tactics and techniques. However, recent developments show that AI can perform many of these techniques on behalf of less skilled actors, blurring the lines between novice and expert threat levels. This trend accelerates as AI models become more accessible and capable, transforming cyberattack patterns observed over the past year.
“Our analysis shows a significant shift toward post-compromise activities, with AI enabling less skilled actors to perform complex lateral movements and account discovery.”
— Anthropic’s research team
Unclear Implications for Future Cyber Defense Strategies
While the report highlights alarming trends, it remains unclear how cybersecurity defenses will adapt to these changes. The effectiveness of current threat detection methods, which rely on technique counts and tooling, is now in question. It is also uncertain how widespread AI-driven attack techniques will become beyond the subset analyzed, and whether new frameworks will emerge to better evaluate threat levels.
Next Steps for Cybersecurity in an AI-Driven Threat Landscape
Security professionals are expected to explore new threat assessment models that incorporate AI behavior patterns and operational signals. Further research will likely focus on developing AI-aware detection systems and updating threat frameworks to account for the democratization of advanced attack capabilities. Monitoring how attacker tactics evolve in response to defensive measures will be critical in the coming months.
Key Questions
How does AI change the way attackers operate?
AI enables attackers to perform complex, technical tasks—such as lateral movement and account discovery—that previously required expertise, lowering the skill barrier and increasing threat levels.
Does this mean traditional threat assessment methods are obsolete?
Not entirely, but the data suggests that relying solely on technique count and tooling as indicators of threat level is increasingly unreliable. New methods considering AI-driven behaviors are needed.
Are less skilled attackers now as dangerous as highly skilled ones?
According to the report, AI assistance makes less skilled actors capable of executing operations comparable to more advanced attackers, challenging previous assumptions about threat severity based on skill alone.
What should cybersecurity teams do in response?
Teams should develop AI-aware detection strategies, focus on operational signals, and update threat models to better identify and mitigate AI-enabled attacks.
Source: ThorstenMeyerAI.com
