AI-powered cyberattacks are rising: Can cybersecurity keep up with hackers?

Cyberattacks are becoming faster and more automated with AI. Here's how the technology is changing the battle between hackers and security teams

Just 27 seconds. That is all it took for hackers to break into a network and move from one system to another in one of the fastest cyberattacks ever recorded. As artificial intelligence (AI) becomes more powerful, cyberattacks are happening at a speed that many organisations are struggling to match.

 

AI is helping hackers find software flaws, plan attacks and spread through networks much faster than before. At the same time, companies are using AI to improve their own defences, but concerns over trust, accountability and errors are slowing wider adoption.

 

The result is a cybersecurity landscape where both sides are racing to use AI more effectively, but attackers currently appear to be moving faster.

 

AI changes speed, scale of cyberattacks

 

Cybercriminals have traditionally needed time and technical expertise to study a target and identify weaknesses. AI is changing that by automating much of the process.

 

According to a report by Nikkei Asia, researchers at the University of Toronto and other institutions tested an AI-powered agent in a virtual corporate network. The agent independently identified security gaps, developed attack plans and took control of nearly 70 per cent of computers and servers within about a week. The researchers used a freely available AI model, showing that even open-source systems are becoming capable of carrying out sophisticated attacks.

 

US cybersecurity company Qualys found that hackers began exploiting 46 out of 52 software vulnerabilities before organisations finished installing security updates. In half of the cases, so-called zero-day attacks began even before software developers publicly disclosed the vulnerabilities.

 

Once attackers gain access, they are also moving much faster. According to CrowdStrike's 2026 Global Threat Report, the average time taken by hackers to move across a network fell from 98 minutes in 2021 to just 29 minutes in 2025. The fastest recorded breakout took only 27 seconds.

 

Experts say AI is compressing the entire attack timeline.

 

Vishak Raman, vice-president of sales, India, SAARC, SEA & ANZ at Fortinet, told Business Standard that AI allows attackers to automate several stages of an attack at the same time instead of relying on manual effort.

 

Raman said FortiGuard Labs recorded 640 billion reconnaissance events and nearly 122 billion exploitation attempts globally in 2025, with attacks often beginning within 24 to 48 hours of a vulnerability being disclosed.

 

Rafe Pilling, director of threat intelligence at cybersecurity firm Sophos, told Business Standard, "The biggest shift is not that AI has suddenly created new forms of cybercrime, but that it is helping adversaries further industrialise existing tradecraft."

 

Attackers are increasingly using AI to test, adapt and launch attacks at machine speed while many organisations still depend on slower, human-led investigations and responses, said Suchit Karnik, chief operating officer at RAH Infotech.

 

Autonomous attacks are getting closer

 

Experts say fully autonomous AI-driven cyberattacks have not yet arrived, but the technology is moving in that direction.

 

Pilling pointed to recent incidents involving AI agent systems that were able to identify attack paths, chain together vulnerabilities and conduct intrusions with minimal human involvement. However, he said the immediate concern is not AI replacing hackers but making individual attackers far more productive. One person using AI can now achieve what previously required an entire team, allowing attacks to unfold at machine speed.

 

Karnik agreed that reliable end-to-end autonomy is still some distance away. Today's AI agents can analyse code, identify vulnerabilities and execute parts of an attack, but they are not consistently dependable against complex environments. "The immediate threat is, therefore, not a flawless autonomous hacker. It is one operator supervising multiple AI agents across many targets."

 

Does AI favour attackers or defenders?

 

For now, most experts believe attackers have the advantage because they can deploy AI with fewer constraints.

 

Karnik said attackers can experiment freely without worrying about accountability or false alarms, while defenders must ensure that automated decisions do not accidentally disrupt business operations. However, he believes defenders could eventually gain the upper hand because they control vast amounts of security data that AI can use to detect threats and contain attacks more effectively.

 

Pankit Desai, cofounder and chief executive officer of cybersecurity firm Sequretek, said, "Right now, attackers have a speed advantage, and let's not pretend otherwise. But the answer isn't panic; it's catching up smart."

 

He said organisations need continuous AI-driven visibility across their systems instead of relying on periodic security checks.

 

Others believe AI will ultimately strengthen both sides.

 

Pilling said AI gives defenders an opportunity to analyse enormous amounts of security data, automate repetitive work and improve threat detection. "I expect AI to become a force multiplier rather than a silver bullet for either side."

 

Similarly, Raman said AI is accelerating both attack and defence, and the advantage will ultimately depend on which side is better prepared and has stronger visibility across users, devices, networks and applications.

 

The biggest barriers

 

Despite rapid advances, many organisations remain cautious about allowing AI to make cybersecurity decisions on its own.

 

Experts say the biggest obstacle is not the technology itself but trust, governance and operational readiness.

 

Raman said autonomous defence requires visibility across systems, integrated security controls and clear rules on when AI can act independently and when humans should intervene.

 

Pilling said, "The most effective approach is to introduce autonomy gradually, starting with low-risk tasks where AI can demonstrate value while humans remain involved in oversight and decision-making."

 

Karnik said most companies are instead likely to adopt "bounded autonomy", where AI investigates alerts and handles routine actions while critical decisions remain with human experts.

 

The next five years

 

Experts expect AI to become deeply embedded in both cyberattacks and cyber defence over the next three to five years.

 

Raman said cybercrime will become more automated and specialised, with AI agents coordinating more stages of attacks. Identity theft, AI-enabled impersonation, adaptive malware and attacks targeting AI models are all expected to become more common.

 

Pilling expects rapid growth in AI-assisted fraud, highly personalised phishing, attacks on AI-enabled applications and attempts to compromise the data that powers AI systems.

 

Karnik warned that businesses should prepare for AI-led intrusion campaigns, deepfake-enabled identity fraud and attacks targeting enterprise AI systems. He said organisations should focus on stronger identity verification, faster vulnerability management and secure AI deployment instead of simply buying products carrying an AI label.