Topic starter
01/08/2026 10:44 pm
TL;DR: AI is compressing the time between exposure and exploitation, and the ECB has told major European institutions to submit action plans for AI-enabled cyber threats by October 31, according to Horizons.ai. The real shift is that security is becoming an evidence problem, not a visibility problem, because defenders now need proof of exploitability and remediation impact before attackers move.
Editorial analysis by NHI Mgmt Group, based on content published by Horizons.ai: “Cybersecurity Needs a New Operating Model”.
By the numbers:
- The ECB directed every significant institution under its supervision to submit a comprehensive action plan by October 31, 2026.
Key questions
Q: How should security teams adapt resilience programmes when AI shortens the exploit window?
A: They should move from periodic assurance to continuous evidence generation.
Q: Why do AI-enabled attacks change the value of traditional vulnerability management?
A: They reduce attacker cost and speed up reconnaissance, phishing, and exploitation, which means the defender’s old timeline no longer fits the threat.
Q: Where do identity controls fail when cyber operations speed up?
A: They fail when access governance assumes there will be time to review privileges after they are granted.
Practitioner guidance
- Implement evidence-based validation loops Replace assumption-based reporting with repeated checks that show whether a weakness is actually exploitable in the current environment.
- Prioritise exploitability over inventory completeness Use risk context to rank exposures that can be chained into real attack paths, not merely those that appear in a scan or asset list.
- Shorten the verification window for identities and privileges Move access validation closer to issuance and change events so standing access does not persist long enough to become an exploitable path.
Bottom line: AI changes cyber resilience by shrinking the time defenders have to prove that exposure is not exploitable.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
01/08/2026 10:53 pm
Evidence, not visibility, is becoming the controlling concept in cyber resilience. Security programmes built around inventories and periodic reviews cannot keep pace when attackers can validate exploitation paths in minutes. The decisive question is no longer what exists, but what can be proven exploitable right now. Practitioners should therefore shift governance from reportable coverage to demonstrable risk reduction.
A question worth separating out:
Q: What should regulated institutions evidence to supervisors about AI-driven cyber risk?
A: They should show what was exploitable, how remediation changed the attack path, and how they know the risk reduction is real. Supervisors are increasingly looking for proof that controls reduce operational risk under current threat conditions, not just evidence that the controls exist on paper.
👉 Read our full editorial: AI is forcing a new cyber resilience operating model