When Cyberattacks Move at Machine Speed, Can Your Defences Keep Up?

Cyberattacks have been automated for years. Attackers already use tools to scan the internet, test passwords, search for known vulnerabilities, send phishing emails and deploy malware.

What is changing is the level of decision-making that can be automated. Recent reporting on Booz Allen’s Cyber Weapon Index described testing in which an AI model reportedly completed an entire cyberattack chain inside a controlled Active Directory environment.

The significant part was not simply that the model could execute commands. It could reportedly investigate the environment, decide what to try next, adapt when an approach failed and continue progressing without a human choosing every step.

What was tested?

According to Booz Allen’s report, researchers tested 18 leading US and Chinese large language models as autonomous attackers. Each model controlled a real attacker machine and operated against a defended, production-grade enterprise network based on Active Directory. The test conditions were intended to show what the models could actually do, rather than what a model might claim it could do.

The researchers measured progress through stages of an intrusion, with actions checked against network traffic, host logs, domain-controller data and intrusion-detection sensors. The stages included:

1. 1Initial access.
2. 2Reconnaissance and discovery.
3. 3Credential access.
4. 4Privilege escalation.
5. 5Lateral movement.
6. 6Domain compromise and control.

The report found that one leading model had demonstrated the ability to complete the full cyber kill chain in the original testing. Other models reached substantial parts of the sequence. The names and ranking are less important for most businesses than the capability the test was designed to measure: an AI system coordinating actions through an environment and responding to what it finds.

Booz Allen: Cyber Weapon Index →

This was a controlled test, not a real-world takeover

The caveat matters. The environment was designed for testing, the systems and weaknesses were controlled, and the researchers could verify activity through known telemetry. Real businesses vary significantly. They contain legacy systems, unusual configurations, incomplete visibility, defensive teams, changing conditions and weaknesses that may be much harder to discover or exploit.

A benchmark result should change how businesses think about exposure and response speed. It should not be turned into a claim that a public chatbot can be pointed at any company and automatically take it over. The test demonstrates what a configured system achieved under specific conditions.

MKLINK: AI Model Completes Full Cyber Attack Autonomously →

The important change is the decision loop

Traditional attack automation usually performs a fixed task. Scan this network. Try these credentials. Check this vulnerability. Run this script. The operator still decides what the result means and which action should happen next.

A more autonomous system can potentially repeat a loop like this:

1. 1Observe the environment.
2. 2Decide what looks promising.
3. 3Select a tool or technique.
4. 4Perform an action.
5. 5Evaluate the result.
6. 6Choose another path when the first approach fails.
7. 7Continue until the objective is reached or the system is stopped.

That is different from saying that the human attacker has disappeared. People may still set the objective, provide access, configure the environment or decide how the result is used. But if the system can make more of the intermediate decisions, a human operator may be able to supervise more targets with less hands-on time.

The AI model is only part of the system

A capable model sitting in a chat window is not the same as an agent connected to an execution environment. The surrounding system can determine how useful the model becomes in practice.

• Tools for scanning, querying and command execution.
• Memory of what has already been tried.
• Feedback about whether an action worked.
• Network access and an attacker machine.
• Credentials or tokens.
• Vulnerability scanners and search capability.
• Persistence between steps.

The key question is not only which AI model is being used. It is: what can the AI actually access and do? The same principle applies to legitimate AI agents inside a business. An agent with access to email, files, identity systems or finance tools needs controls appropriate to the actions it can take.

Why this matters to an SME

Most small businesses are not individually selected by a sophisticated state-backed operator. But automation can change the economics of an attack. A system that investigates continuously can look at more targets, try more paths and spend less skilled human time per victim.

• Investigate more potential targets.
• Work outside normal office hours.
• Try several attack paths in parallel.
• Exploit known weaknesses faster.
• Keep going after an initial approach fails.
• Scale operations more cheaply.

That makes exposure and recoverability more important than trying to predict whether a particular criminal group has heard of your business. Automated systems can search for whichever organisation presents an easier route.

AI does not magically bypass security controls

Avoid the fear-based conclusion that autonomous AI makes sensible security controls irrelevant. An automated attacker still encounters MFA, patched systems, least privilege, network separation, endpoint protection, restricted administrator access, monitoring and protected backups.

Those controls may not stop every attack. They can make the attack harder, reduce the options available after an initial compromise, create time for detection and improve the chances of recovery. When attackers can test weaknesses more quickly, strong basics matter more.

Identity becomes even more important

Modern attacks often depend on credentials. If an autonomous attacker gets one account, the important question becomes what that account allows it to reach next.

• Use multi-factor authentication for Microsoft 365, remote access and other important services.
• Prefer passkeys or phishing-resistant authentication where appropriate.
• Keep administrator accounts separate from everyday user accounts.
• Remove unused accounts and review old access.
• Reduce administrator privileges and use least privilege.
• Use Conditional Access where it fits the environment.
• Monitor unusual sign-ins, impossible travel and unexpected privilege changes.

Least privilege limits how far one compromised account can spread. That is valuable whether the next action is selected by a human, a script or an AI agent.

How to Set Up a Passkey for Microsoft and Google Accounts →

Patching reduces easy options

Known vulnerabilities are especially useful to automated systems because they can be identified, tested, chained and repeated at scale. Businesses should keep supported and updated Windows devices, browsers, servers, firewalls, VPNs, remote-access tools and business applications.

Cybersecurity Priorities: What Should Your Business Fix First? →

Segmentation can limit lateral movement

If every device and system can freely reach everything else, one compromised account or endpoint may provide a much larger attack path. Sensible firewalling, separated administrator access and practical network segmentation make it harder to move through the environment.

Monitoring has to keep up

If an attacker can operate faster, defenders may have less time between initial compromise, credential theft, privilege escalation, data access and lateral movement. Businesses should know which events would be unusual and who reviews them.

• Unusual logins or sign-ins from unexpected locations.
• Rapid privilege changes or new administrator activity.
• New remote-access tools or suspicious scripts.
• Large or unusual data transfers.
• Security tools being disabled.
• Unexpected account creation.

A detection that nobody reviews is not much of a defence. If attacks accelerate, detection speed matters more.

Backups still matter

Autonomous cyberattacks do not make backup irrelevant. Businesses still need to know what is backed up, how often it is protected, whether the backup environment is isolated from production credentials, whether Microsoft 365 data needs additional protection and when restoration was last tested.

Backups help with recovery. They do not undo stolen data. Recovery planning should therefore cover both restoration and the decisions that follow data access, including legal, contractual, insurance and customer communications where relevant.

Website Backups and Your Recovery Plan →

Incident response may need to become faster

A business should not have to make basic decisions while an attack is progressing. Decide in advance:

• Who gets called and who takes charge.
• Who can disable accounts or revoke sessions.
• Who can isolate a device or shut down remote access.
• Who contacts the IT or security provider.
• Who contacts the insurer.
• How credentials are reset.
• How the organisation communicates if normal systems are unavailable.

Ransomware Resilience: Why Refusing to Pay Is Not a Recovery Plan →

A simple IT Club check

Would one compromised account open the door to the rest of your business?

Ask the IT Club Advisor. One straightforward IT question. Independent guidance without the sales pitch.

The IT Club view

The important development is not that AI has suddenly made every hacker unstoppable. It has not. The change is that more of the work traditionally performed by a human attacker may be becoming automatable.

That could allow attacks to move faster, run continuously, explore more options and scale to more potential victims. The answer is not another fashionable “AI security” product. It is making sure the controls that already matter are actually in place.

Sources and further reading

This is original IT Club commentary. The benchmark findings are time-sensitive and should be read as reported results from controlled testing, not as a guarantee of real-world capability against every organisation.

Booz Allen: Cyber Weapon Index →

Booz Allen: The Offensive Frontier — AI as the Attacker (PDF) →

MKLINK: AI Model Completes Full Cyber Attack Autonomously →