The commercial shift
More opportunity. Less human effort.
Why would anyone spend time attacking us? For a smaller business, the better question is: what happens when finding a company to hack costs far less?
Employee research, supplier analysis and adapting attacks consume human effort. AI can assist repeatedly and cheaply. It is a force multiplier, not proof that sophisticated attacks operate independently of people.
Ransomware-as-a-service, credential and exploit marketplaces, initial-access brokers, rented infrastructure and open-source offensive tools already divide work between specialists. Bitcoin and other cryptocurrencies enabled cross-border criminal payments. The NCSC and NCA describe this service economy; AI did not invent it.
Some commercial and open-source models can be downloaded, run privately and adapted. In its assessment to 2027, the NCSC judged that proliferating AI-enabled tools would highly likely widen access to intrusion capability, not give every novice expert-level skills.
The Scaling Constraint Is Changing
Traditional cybercrime
- 1Research limited organisations
- 2Choose valuable target
- 3Build attack
- 4Execute
- 5Analyse results
Human time = bottleneck
AI-assisted cybercrime
Research → Identify opportunity → Personalise → Monitor → Learn
Illustrative scenario, not a reported incident
The consultancy nobody deliberately targeted.
Imagine a 150-person UK consultancy. An AI-assisted system correlates public staff profiles, leadership changes, job vacancies, suppliers, conference posts, internet services and clues about Microsoft 365. It compares apparent technologies with newly disclosed vulnerabilities.
Public information is not compromise, but together it may reveal a useful relationship or weakness. The consultancy has not grown. The cost of discovering the opportunity fell.
Criminals already refine campaigns. AI will make testing, observing replies and repeating successful approaches far cheaper.
- Experiment
- Observe
- Improve
- Scale
The latest authoritative assessment
An evolving threat
The NCSC's 3 November 2026 assessment judges it highly likely that nation states will routinely use AI-cyber by 2028, increasing the scale and speed of sophisticated attacks facing the UK. It judges it almost certain that many systems will remain vulnerable to tools that identify and exploit weaknesses.
Its three scenarios explore how the threat could evolve by 2028. The separate Annual Review 2026 assesses that human operators highly likely remain essential. Microsoft's 2026 Digital Defense Report likewise describes AI accelerating familiar methods while most complex observed intrusions retain meaningful human direction.
The second change
The defensive window is collapsing.
The NCSC's earlier assessment said disclosure-to-exploitation windows had shrunk to days and AI would almost certainly reduce them further. Separately, criminals can operationalise access extremely quickly.
Instead of breach, explore, decide, prepare, execute, preparation can precede compromise. Investigation and containment may need to happen while the attacker is already progressing.
From Hours to Seconds
The old defensive assumption
- Compromise
- Detection
- Investigation
- Decision
- Attacker acts
The emerging reality: preparation happens first
- Compromise
- Automated action
- Data access / next stage
22 seconds
Median initial-access hand-off in 2025, versus more than eight hours in 2022.
Mandiant M-Trends 202631%
Vulnerability exploitation as initial access in non-Error, non-Misuse breaches analysed.
Verizon 2026 DBIR, Figure 1048%
Third-party involvement in breaches assessed for this measure, including vendor-software vulnerabilities.
Verizon 2026 DBIR, Figure 19Mandiant's specialised hand-off measure is not full attack duration.
Human judgement remains essential. Human speed alone is increasingly insufficient.
An unusual sign-in, PowerShell activity or large download is not enough by itself to justify shutting down a business service. Analysts need context and correlated evidence. Machine-speed collection and correlation should help people reach informed decisions faster, not trigger indiscriminate automated shutdowns.
Rethink trusted access
Zero Trust cannot stop at the laptop.
Backup tools, remote administration, security applications, SaaS platforms and service identities can hold extensive permissions. The ConnectWise Cloud Backup, formerly SkyKick, incident illustrates the consequences when a legitimate application identity is compromised. No application should be assumed incapable of failure.
Apply least privilege to applications and AI agents, not just employees. Review MSP platform architecture and blast radius. Security architecture should assume an individual trusted tool or control can fail, then limit what that failure can reach.
A practical leadership agenda
Eight changes that strengthen the response.
Start with exposure and ownership. Reactive IT leaves gaps that faster attackers can exploit; risk-led security makes improvement systematic.
Own vulnerability management
Discover, assess, prioritise, remediate and verify. A vulnerability report is not a fix. Give significant weaknesses an owner, a deadline and evidence that the exposure has been removed.
Keep technology supported
Identify obsolete software, firmware and devices. Windows 10 normal support ended on 14 October 2025; eligible Extended Security Updates and specialist lifecycles exist. Legacy systems should be known, risk-managed exceptions, not invisible technical debt. Microsoft ESU guidance.
Verify patching actually happened
Deployment does not equal successful patching. Offline devices, failed updates, storage problems and pending reboots leave gaps. Independently verify patch levels and resolve exceptions rather than treating deployment as proof of protection.
Correlate signals through a capable SOC
A new location, mailbox rule and large SharePoint download can each be legitimate. Together they may indicate compromise. A Security Operations Centre needs connected evidence, investigation, escalation and a tested response.
Manage risk against a framework
Use CIS Controls or another recognised framework to examine identity, devices, data, applications, access, recovery and monitoring systematically. Leadership needs visible risk, ownership, progress and outstanding actions, not simply more products.
Use AI defensively
Automate log collection, device queries, correlation and evidence summaries. AI should accelerate understanding within enforceable permissions, with people accountable for consequential decisions. Unusual activity should not automatically trigger disruptive shutdowns.
Know every device accessing business data
Understand managed and personal devices alike. Browser-only access reduces some risks, but compromised devices may still observe information or expose sessions. If a device accesses important company information, understand its risk.
Treat Geo-IP as a signal
Geography restrictions help, but residential proxies, compromised endpoints and cloud infrastructure can make overseas attackers appear local. Location is useful context. It is not proof of identity. Combine it with device and behaviour checks.
- New authentication
- Mailbox change
- Mass download
- Investigate connected risk
Illustrative scenario, not a reported incident
The patient LinkedIn relationship.
An employee accepts a plausible industry connection. Over weeks, the contact comments on posts, shares an article and discusses a conference. Later, a report or collaboration link arrives. Trust, rather than urgency, makes the request credible.
LinkedIn connections are not inherently dangerous. Recognise when a relationship asks someone to cross a security boundary. AI could maintain many patient interactions previously requiring substantial labour. Awareness must extend beyond spelling mistakes and suspicious emails.
AI does not have to be in a hurry.
Verify unexpected requests through an independent channel, particularly when they involve credentials, software, sensitive information or a changed payment process.
The Wavex response
Defending at the Speed of the Threat
Wavex combines prevention, detection, automation and human judgement. CIS-aligned proactive risk management gives leaders visible gaps, owners and improvement actions. Least permission limits exposure; temporary, justified and auditable administration, including Microsoft Privileged Identity Management where appropriate, reduces standing privilege.
Vulnerability management tracks discovery through remediation. Patch and lifecycle oversight highlights missing or failed updates, unsupported platforms and exceptions. SOC operations connect datasets for correlation, investigation, escalation and response. None is a magic shield; together they reduce exposure and improve informed action.
AI-assisted investigation helps engineers aggregate information, query device state and summarise evidence. Jakob, Wavex's AI support assistant, can help users gather context about suspicious device behaviour or warnings, alongside a 24x7 helpdesk staffed by real engineers. A consolidated security dashboard makes vulnerabilities, patch position, events and outstanding actions easier to manage than information spread across separate portals.
Use AI for speed. Use people for judgement.
Staying Ahead of an AI-Assisted Threat
- Govern
- Discover
- Reduce exposure
- Monitor
- Correlate
- Investigate
- Contain
- Recover
- Improve
Speed and correlationHuman engineers
Judgement and accountabilityGovernance
Risk ownership and priorities
The implication for leadership
Familiar weaknesses. A different equation.
Vulnerabilities, credentials, excessive privilege and human trust remain familiar weaknesses. AI can make finding and exploiting them faster, cheaper and more scalable. A security model that depends entirely on human-speed investigation is increasingly inadequate. AI is changing cybercrime. Resilient organisations will change their defences with it.