Countering AI-assisted cyber-attacks
The use of AI in assisting a cyber-attack is often unprovable. But if you cannot detect AI’s fingerprints, how do you protect and defend against the consequences? We talk to Tom Van de Wiele, Offensive R&D Lead at DNV Cyber, about the threats of AI-enabled cyber-attacks and how to prepare for and respond to them.
Catching artificial intelligence enabling or amplifying autonomous cyber-attacks makes headlines – but AI’s role may all-too-often be invisible. The main risk is not that such an attack will look radically new. Instead, it is that familiar attacks may already be AI-assisted in ways defenders cannot see or measure.
AI involvement may well be suspected If a phishing campaign is more convincing than expected, if a criminal group profiles a target unusually well, or if an attacker finds an indirect route into an organization. But defenders may never be able to prove that AI did play a role.
“The attack can look familiar from the outside even if AI helped with reconnaissance, target profiling, scripting, tool creation or tactical decision-making behind the scenes,” explains Van de Wiele. “This creates a headache for security leaders, as waiting for clear evidence may mean waiting for proof that will never exist.”
AI does not need to create an entirely new class of cyber-attack to matter. It can make existing attacks faster, cheaper, more scalable and harder to attribute.
“So, the practical question isn’t whether every incident can be called AI-enabled. It’s how organizations should defend when attackers can quietly use AI to fill in gaps, test possibilities, and find paths that classic attack surface management may miss,” says Van de Wiele.
Attacks are becoming faster, cheaper, scalable, and targeted
Integrating AI creates structural efficiencies heavily favouring attackers by automating costly and time-consuming phases of the cybersecurity ‘kill chain’, a framework of eight cyber-attack stages – reconnaissance, weaponization, delivery, exploitation, installation, command and control, action on objectives, and monetization.
| Key ways attackers are using AI in various stages of cyber-attacks | |
| Phishing and Social engineering | Large Language Models (LLMs) used to improve the quality and persuasion of social engineering |
| Scripting and Technical assistance | LLMs used as highly efficient coding assistants to write or debug automation scripts |
| Reconnaissance | Generative AI used to conduct open-source intelligence (OSINT) querying and vulnerability research |
| Malware development | AI-written malicious code deployed in the wild |
Generative AI (GenAI), which creates new content, significantly lowers the entry barrier for novice threat actors. They can now generate highly authentic, culturally convincing social engineering lures at scale, and in minority languages without needing native fluency. This increases the volume of effective threats.
Ransomware groups are using AI to automate victim profiling and script customized extortion negotiations. This reduces the manual work involved in executing complex double-extortion campaigns. It enables attackers to scale operations with minimal operational costs.
| How threat actors are using AI to enable and amplify cyber-attacks | |
| Attack stages most affected by AI | New entry points and vulnerabilities |
|
AI can be used across any part of the kill chaina and can support:
|
AI-assisted attacks can:
|
AI gives attackers a growing speed disadvantage
AI-driven automated vulnerability scanning and code-generation tools drastically accelerate exploit development. Threat actors can immediately generate exploitation scripts once a software vulnerability is publicly added to common vulnerabilities and disclosures (CVEs). This lets attacks progress before system administrators have time to deploy security patches.
Van de Wiele commented: “AI-enabled defence and detection mechanisms that organizations use today often depend on vendor roadmaps, or on bespoke security engineering that this is still often subpar. So, attackers get more time to experiment and adapt than defenders have to deploy reliable controls. This asymmetry is widening. In particular, smaller operators of critical and essential infrastructure often lack the specialized security employees or budgets to counter exploit generation automated by AI.”
| Attackers experiment at machine speed while defenders deploy at organizational speed | |
|
Attackers (AI-powered scaling) |
Defenders (Structural bottlenecks) |
|
Unconstrained scaling: AI agents automate reconnaissance, scripting and polymorphic exploit delivery at zero marginal cost. No bureaucracy: Attackers operate with immediate agility, testing and deploying new AI capabilities in real time. Continuous adaptation: Adversaries have endless time to experiment, find gaps in defences, and adapt automated models. |
Limited budgets: Restricts capacity to deploy innovative AI security controls and recruit top-tier AI defence talent. Ethics and governance constraints: Compliance, privacy, and regulatory safety governance limit speed of implementation and response. Sustainability requirements: Long-term green computing, compliance alignment, and strict audit requirements limit unbridled scaling. Vendor and engineering dependence: Dependence on vendor roadmaps or bespoke security engineering causes delay in AI detection. |
Case studies in critical infrastructure and OT environments
For cybersecurity, Operational Technology (OT) and Industrial Control Systems (ICS) have historically relied on air gaps between and OT and IT, or on obscure, legacy protocols. ‘Air-gapping’ means having no network interface controllers connecting a computer/network with other networks. But they are now facing automated, AI-driven exploitation.
The table below illustrates how AI has moved from being a theoretical risk to an active utility used by state-sponsored and financially motivated actors to streamline and automate established cyber-attack workflows on critical infrastructure and industrial control systems (ICS).
It is important to note that the evidential strength differs among these cases. The assessments distinguish between observed AI use, likely AI-generated tooling, and attempted rather than successful compromise of operational technology.
| Year/target/campaign | AI role(s) |
| 2026: Active campaign targeting programmable logic controllers (PLCs) in the USa | National Security Agency (NSA) and other agencies reported cyber actors conducting targeted reconnaissance and capability development against specified US-based PLCs by using AI-generated exploitation scripts disguised as legitimate monitoring National Security Agency (NSA) and other agencies reported cyber actors conducting targeted reconnaissance and capability development against specified US-based PLCs by using AI-generated exploitation scripts disguised as legitimate monitoring tools. Targets included energy generation/distribution, water/wastewater, chemical processing, critical manufacturing, food/agriculture, and commercial facilities. |
| 2026: Attempted hack of municipal water and drainage utility, Mexicob | Attacker used hosted AI services during reconnaissance, lateral movement, enumeration, exploitation and exfiltration. After compromising the utility’s IT, the AI found a potential way into OT, researched documentation, generated credential lists and conducted a password-spraying attack. But attempted OT penetration failed. |
| 2025: Spying on Vietnam telecommunications infrastructurec | AI company detected a threat actor resembling a Chinese Advanced Persistent Threat group using hosted AI for the espionage attempt. Case illustrates AI-assisted reconnaissance and operational support for spying campaign. |
| 2025: Chinese state-sponsored group targeted critical infrastructure abroadd | A hosted AI provider detected a threat actor assessed with high confidence to be a Chinese state-sponsored group manipulating the AI to conduct reconnaissance, discover vulnerabilities, write exploit code, harvest credentials, create backdoors, and assist exfiltration. Targets in several countries included chemical manufacturers, financial institutions, technology companies and government agencies. |
| 2025: Destructive campaign against Polish energy and industrye | Coordinated destructive cyber-attacks on 30+ wind and solar PV farms, a major combined heat-and-power (CHP) plant, and a manufacturer. Attackers accessed industrial automation equipment including remote terminal units, human-machine interfaces, and protection/communications devices. LazyWiper destructive script used against the manufacturer was judges to have most likely been generated mainly by AI. |
| 2025: North Korean state-sponsored phishing and social engineering campaignsf | Remote IT workers were observed using AI to improve the scale and sophistication of their operations, steal data, and generate revenue for North Korea. They used AI tools to replace images in stolen employment and identity documents; make North Korean IT worker photos look more professional; and change voices. |
| a: NSA (2026) NSA and Others Release Report on Active Threats of Programmable Logic Controllers. National Security Agency; b: Dragos (2026) AI-Assisted ICS Attack on a Water Utility; c: Anthropic (2025) Detecting and countering misuse of AI: August 2025; d: Anthropic (2026) Disrupting the first reported AI-orchestrated cyber espionage campaign; e: CERT Polska (2026) Energy Sector Incident Report - 29 December 2025; f: Microsoft (2025). Jasper Sleet: North Korean remote IT workers’ evolving tactics to infiltrate organizations. Microsoft Threat Intelligence, blog 30 June 2025. |
|
Why it is tough to detect AI’s fingerprints in an attack
While the case studies confirm real threats, caveats by authorities who assess them reinforce the message that AI use may currently be difficult to detect. Attribution is often uncertain, and organizations should not rely on incident evidence alone to assess the risk.
“Hackers sometimes slip up, but you can’t count on it,” said Van de Wiele. “AI’s involvement in code development is often only detectable due to developer negligence rather than technical differences in execution.”
For example, the AsyncRAT AI-generated ‘dropper’ – a term for ‘Trojan horse’ software designed to covertly install malware onto a computer – was originally identified only because the scripts were completely ‘unobfuscated’ (not disguised from people and security tools) and heavily commented. Thanks to its default settings, the large language model (LLM) AI used described what almost every line of code did. If the comments had been removed or obfuscated, it would have been impossible to prove AI involvement.
In most cases today, defenders may not be able to prove whether a phishing campaign, target profile, or successful intrusion relied on AI, because the visible attack may look similar from the outside when analysing only the ultimate operational payload or system outcome.
For example, once an exploit is executed, the resulting system activity looks identical regardless of whether the code was typed by a human developer or generated by AI in the form of an LLM. Examples of system activity include modifying Windows Registry keys, launching scheduled tasks, or establishing encrypted connections to a remote command and control (C2) server.
Malware in some infected hosts communicates directly with legitimate, high-reputation AI application programming interfaces (APIs) to fetch dynamically generated malicious payloads. Troublingly for defenders, this traffic blends in invisibly with non-malicious daily corporate queries to commercial, hosted GenAI platforms.
What organizations should do today
Do not rely purely on incident evidence to assess risk, advised Van de Wiele: “Attacks succeeded before AI. So, it’s unrealistic to assume attackers aren’t using tools that make them faster, cheaper, and better informed.”
But assuming the worst need not paralyse decisions on what technical, human and organizational pillars of cybersecurity to invest in to safeguard business resilience, whether or not cyber risks may involve attackers using AI maliciously and largely undetectably.
Van de Wiele’s checklist of actions to take now includes re-performing threat modelling and running an exposure management exercise rather than focusing only on the attack surface. The exercise should aim to identify which security controls are no longer appropriate, and which need to be replaced or complemented with machine-resilient controls.
Balancing attack surface and exposure management
Attack surface management that runs scanners to ensure infrastructure does not contain any technical vulnerabilities is undeniably important. But if someone who already knows the password or has insights – which can now be AI-sourced – can just walk in with the right password, then that risk needs to be picked up in exposure management.
"AI can do a complete holistic analysis and tell an attacker where to attack first or where the weak spots are – just like a predator looking at a herd. So, both types of cyber risk management need to be applied, and in a balanced way," said Van de Wiele.
“It's also vital to review security controls against the actual threat, not only against compliance requirements,” he added. “Many existing controls were designed for human attackers and human-scale attacks, and may no longer make sense when attackers use AI to automate, infer, and adapt.”
Adjusting to the new threat era
Beyond these practical steps, there are longer-term challenges in raising awareness of the risks and the need to invest in OT and IT systems-wide solutions factoring in the threats presented by attackers using AI.
“One major concern is lack of interest and understanding among cybersecurity defenders and decision makers in cyber-operated environments that many controls were designed for human attacks and human attackers,” said Van de Wiele.
“If organizations continue to prioritize compliance over the actual threat, they may maintain controls that look acceptable on paper but are poorly suited to AI-enabled attacks,” he continued. “AI-aided attackers can find indirect exposure assets and use them against the target organization. It does not matter how many security tests were performed against the infrastructure if an attacker can find passwords, configuration details or other useful information on the internet and use AI to make educated guesses.”
Relevant DNV Cyber services:
11/2/2026 10:19:00 AM