AI in Cybersecurity: How Attackers and Defenders Are Using the Same Technology

Key takeaways

• AI hasn't invented new types of attack. It has made old weaknesses faster and cheaper to find and exploit, which is exactly what the NCSC is now warning about.

• The gap between a flaw being disclosed and being exploited has shrunk to hours. Cloudflare saw attempts to exploit newly disclosed PHP flaws jump from thousands to millions within hours.

• The NCSC dealt with 80 nationally significant incidents in the year to August 2026 and believes AI-powered malware could feature in a ransomware attack on UK critical infrastructure by 2028.

• Defenders are using AI for detection, triage and response at scale, but it still needs human analysts to check its work.

• With tens of thousands of new vulnerabilities every quarter, threat intelligence is what tells you which ones attackers are going after.

Why is AI now a weapon for both sides?

Early November 2026 saw a series of high-profile cyber incidents. Crypto exchange Binance reported a record $6.3 billion theft, refrigeration systems in supermarkets across Europe were remotely tampered with, and Ukraine's air-alert app was compromised to issue false nuclear warnings. The Guardian has since questioned whether we are in the foothills of a hacking epidemic.

Not every one of those incidents involved AI. But the common thread is speed, and that's where AI is changing the game. As Reuters reported, executives from Booking.com to Holcim now describe security as an arms race where both sides are running the same technology. Booking.com's chief security officer called it "a never-ending game of cat and mouse, with very high stakes."

From where CYJAX sits, tracking threat actors and criminal marketplaces every day, the shift is less about brand-new techniques and more about volume and pace. Things that used to take a skilled attacker days now take hours, and the people doing them don't need to be that skilled.

How are attackers using AI?

• Better phishing and deepfakes. Attackers no longer need good English or a flair for writing to send a convincing email. As Harvard Extension School's panel on AI and the future of cybersecurity points out, AI can mine public data and build highly personalised deepfake phishing with very little effort.

• Finding and exploiting vulnerabilities. On 21 October, two AI-discovered flaws in PHP, which powers a huge share of the web, sent governments and companies scrambling to patch. Nearly 37,000 vulnerabilities were disclosed in Q3 2026 alone, and one security firm showed Reuters it could reproduce a known weakness using AI in 28 minutes for $6.

• Agentic attacks at machine speed. In India, the cybercrime coordination centre I4C has warned banks, NBFCs and fintechs that criminals are using AI agents to break into unpatched systems and abuse payment APIs, moving money faster than traditional controls can react. It's a useful early warning for UK financial services, because the same tools are available to everyone.

• Smarter malware. The NCSC judges that AI is highly likely to speed up ransomware, social engineering and vulnerability exploitation, and that AI-powered malware could feature in a ransomware attack on UK critical national infrastructure by 2028.

What does the UK threat picture look like right now?

The NCSC Annual Review 2026, published on 3 November, recorded 1,831 reports of cyber attacks on UK organisations between September 2025 and August 2026. Its team supported 337 incidents, and 80 were classed as nationally significant. That's down from 204 the year before, but the NCSC is clear this shouldn't be read as a trend.

In fact, NCSC chief executive Richard Horne warned that the UK faces "a real prospect of an unprecedented rise in the number of cyber incidents." His point is that AI doesn't create new holes, it finds the ones organisations have tolerated for years, at a scale that wasn't possible before. In his words, "for decades, we have collectively got away with doing tech on the cheap."

The government is responding with £60 million for the first phase of a national Cyber Shield, £70 million for a National Exposure and Real-Time Vulnerability Centre, and a new AI Cyber Security Centre of Excellence in Manchester run by the NCSC.

How are defenders using AI to fight back?

The good news is that the same technology works just as well in defence. Security teams are using AI to spot unusual network behaviour, flag phishing and fraud, automate parts of incident response and sift through datasets far too large for any human team. One security leader told the Harvard panel that AI lets a responder start investigating a critical alert within minutes, where handoffs used to take hours.

Large organisations are investing heavily. Reuters reports that hundreds of engineers at Booking.com are working on AI-powered defences, Siemens is testing advanced AI models for security, and the Port of Rotterdam is building its own AI "cyber shield". McKinsey expects spending on external cybersecurity products and services to grow from $223 billion in 2025 to $346 billion by 2029.

The pressure is also changing how teams work. As the CTO of German hosting firm Ionos put it, a nine-to-five security team is "no longer good enough" when attackers work around the clock.

What new risks does AI create for security teams?

AI also brings its own blind spots:

• Shadow AI: staff using unapproved AI tools can leak sensitive data without anyone noticing.

• Model poisoning: attackers can tamper with AI models so they give unreliable results or open new routes in.

• Third-party exposure: one Harvard panellist estimated that 70% of attacks on his organisation came in through vendors, including AI vendors.

• Hallucinations: AI tools can be confidently wrong, which is why a human analyst still needs to check the output before anyone acts on it.

How can organisations stay ahead of AI-powered attacks?

There's no single fix, but a few things make a real difference:

• Patch based on what attackers are exploiting, not just CVSS scores.

• Cut unnecessary internet exposure and follow the NCSC's Cyber Essentials baseline.

• Ask suppliers how they use and govern AI, and write it into contracts.

• Train staff to recognise AI-generated phishing, voice cloning and deepfake requests for payment.

• Make sure someone is watching outside office hours, whether that's an in-house team or a partner.

How does CYJAX help?

CYJAX combines an intelligence platform with an experienced analyst team, so you get both the speed of automation and the judgement of people who understand how threat actors think.

We track threat groups, criminal forums and dark web marketplaces to show you which vulnerabilities are being actively exploited, which tools are being sold, and which leaked credentials or stealer malware infections relate to your organisation. That means your team can prioritise the handful of threats that matter instead of chasing thousands that don't.

When both sides have AI, the advantage goes to whoever has the better intelligence. Book a demo to see the CYJAX platform in action, or ask an analyst about the AI-driven threats facing your sector.

‍