COMMENTARY: AI's real effect on threats has been speed. It shrinks the time between an adversary's intent and their action, and with it the decision space protectors depend on.
Friction has always worked in the protector's favor. An adversary had work to do: identify a target, run reconnaissance, find useful information, map relationships and vulnerabilities, build a convincing pretext, and figure out how to reach the target or move an audience.
[SC Media Perspectives columns are written by a trusted community of SC Media cybersecurity subject matter experts. Read more Perspectives here.]
If the objective was serious, add surveillance, access, planning, and capability. None of that made an attack impossible, but each step took time and effort.
That friction gave us something valuable: it gave us time to spot an indicator, work out what it meant, advise a principal, reduce an exposure, and step in before an attack escalated.
AI dramatically reduces that friction. The most important effect isn't a new catalog of attack methods. It’s all very familiar: reconnaissance, impersonation, social engineering, influence, exploitation, targeting. What's changed is the speed at which an adversary can do all of it. AI isn't rewriting the attack cycle: it accelerates it.
The clock keeps ticking
Recent threat reporting shows how quickly this has developed. In a September report, Google Threat Intelligence Group (GTIG) described threat actors compromising a cloud resource and then planning, building, and executing an agent-enabled mass credential-harvesting campaign in under six hours.
GTIG tracked that activity earlier in the year, and the point isn't what AI can do in a lab. It's what adversaries already do in the field. Google's researchers concluded that growing agentic autonomy, and less time spent by humans directing individual tasks, has compressed the response window defenders have relied on.
Microsoft Threat Intelligence sees a similar pattern, with threat actors using AI across the attack lifecycle: reconnaissance, social engineering, infrastructure, malware development, and post-compromise activity. It’s worth it for teams to focus-in on Microsoft’s read: AI reduces technical friction and speeds execution, while human operators still decide objectives, select targets, and deploy capabilities. The adversary hasn't gone anywhere, and intent still comes from a person. AI just helps that person do more, faster.
We can see the same dynamic outside cyber operations. The FBI has warned about actors impersonating senior U.S. officials through text and AI-generated voice messages, targeting current and former officials and people in their networks, working to build credibility and move them onto other platforms where accounts and sensitive information become reachable. Impersonation isn't new, and neither is exploiting trust.
What's changed? How easily an attacker can make the deception convincing and deploy it fast.
It's tempting to fixate on the artifacts: the synthetic voice, the fake persona, the clean phishing message. Those matter, but they're outputs. The bigger change is the speed at which an adversary can research, build, adapt, and act.
This matters most when we move from cybersecurity to protective intelligence. There has always been information available about executives, public officials, prominent people, and their families: property records, corporate bios, photos, relationships, travel, hobbies, social media, charitable ties.
For years, one of our protections was fragmentation. The information was public, but someone still had to find it, validate it, connect it, and judge what was useful. AI shortens the distance between what's publicly available and what's operationally useful.
That's a problem, because real threats rarely stay inside the neat categories we build to manage them. In The Protector's Edge, my co-authors and I describe a Hybrid Threat Targeting Cycle that runs from Reconnaissance to Exposure to Amplification to Physical Action to Converged Crisis, tracking how a threat migrates across digital, physical, reputational, and narrative domains.
AI now compresses the time between those stages. Research speeds up, scattered information comes together faster, personas and messages are quicker to build and tailor, and technical snags clear sooner.
Access to a model doesn't turn an amateur into a foreign intelligence service. Skill, intent, judgment, resources, and access still matter. But the floor has risen. The inexperienced can do more, the capable can move faster, and the sophisticated can operate at greater scale.
Move to the left
For protective intelligence teams, this should shift the conversation. The answer isn't collecting more information, since most of us already have more than we can use well. It also isn't simply responding faster. Protective intelligence needs to move more to the left. That means understanding exposure before a specific threat forms, looking for trajectories instead of treating every indicator as an isolated event, and connecting digital, physical, reputational, and behavioral signals while leaders still have room to act.
Change a movement, reduce an exposure, look into a developing fixation, alter an itinerary, bring in law enforcement, brief an executive. The value isn't in knowing more. It's in knowing something early enough to do something about it.
For years, time was on our side. The friction between intent, capability, and action gave us room to detect, understand, and intervene. That room has gotten smaller. The attack cycle hasn't disappeared, and AI hasn't rewritten how people form intent, choose targets, or cause harm. It’s taking the friction out of the process.
So the question for protectors isn't how we can respond faster, it’s about how we can see attacks sooner.
Chuck Randolph, chief strategy officer, 360 Privacy
SC Media Perspectives columns are written by a trusted community of SC Media cybersecurity subject matter experts. Each contribution has a goal of bringing a unique voice to important cybersecurity topics. Content strives to be of the highest quality, objective and non-commercial.
