AI-driven attacks: what security teams need to act on

TL;DR: AI is shrinking attack timelines, with cybercriminals using AI-powered tools to improve attack success rates, accelerate reconnaissance, and move from initial access to broader compromise in under 30 minutes on average, according to Blackpoint Cyber. The security advantage now belongs to teams that pair AI speed with human judgment, accountability, and containment discipline.

Editorial analysis by NHI Mgmt Group, based on content published by Blackpoint Cyber: “How AI Is Reshaping Cybersecurity (& the MSP Opportunity)”.

By the numbers:

• 81% of cybercriminals now leverage AI-powered tools to improve attack success rates.
• Cybercriminals are moving from initial access to broader system compromise in less than 30 minutes on average.
• The average underground price for initial access dropped by 69%.

Key questions

Q: How should security teams set boundaries for AI-assisted decisions?

A: Security teams should separate tasks AI can accelerate from decisions that carry accountability, approval, or risk acceptance.

Q: Why do shadow SaaS and weakly governed integrations increase the risk of credential abuse and lateral movement?

A: Shadow SaaS bypasses normal governance, so attackers can enter through compromised credentials, then pivot through integrations, APIs, and misconfigured roles.

Q: What are the signs that AI-driven detection is not working well in machine-to-machine environments?

A: Common signs include excessive alerts from benign activity, missed anomalies in normal traffic, and slow analyst response because the system cannot separate routine machine behavior from suspicious patterns.

Practitioner guidance

• Define AI response boundaries Document which containment actions an AI system may take autonomously, which require analyst review, and which must remain manual for identity, endpoint, and network events.
• Prioritise identity abuse detection Tune detections for credential theft, impersonation, and suspicious approval activity so AI-assisted social engineering is not assessed only by message content.
• Baseline high-risk user and service behavior Establish behavioral baselines for privileged users, service accounts, and support workflows so machine-speed deviations are visible before containment decisions are made.

Bottom line: AI is accelerating familiar attack chains rather than inventing entirely new ones, which makes response speed and decision authority the main defensive differentiators.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →