AI Is Writing the New Cybercrime Playbook. Here Is How Defenders Are Answering
Automated attacks can now break through company defences in seconds. A new generation of AI-powered security tools aims to fight back at the same speed, before human analysts even see an alert.
Key points
- AI-powered attack tools can now plan and carry out multi-stage intrusions faster than any human security team can respond.
- Traditional security systems wait for a known threat signature before acting; newer AI-driven platforms try to block malicious behaviour before it executes.
- A concept called Agentic Endpoint Security focuses on protecting automated software agents, which often have deep access to company data, from being hijacked by criminals.
- Palo Alto Networks claims its Cortex XDR platform reduces the flood of security alerts analysts must review by up to 98 percent.
- Cortex XDR's automation layer is designed to handle up to 99 percent of security incidents without a human having to intervene manually.
For most of the past two decades, corporate security teams have operated on a simple, if exhausting, rhythm: wait for criminals to attack, spot the intrusion, patch the hole. That rhythm is breaking down.
Automatic attack tools built on artificial intelligence can now probe a company's defences, find a weakness and begin stealing data in seconds. Human security analysts, working through dashboards that can fire thousands of individual alerts a day, simply can't keep pace.
What is changing about modern attacks?
The shift is one of speed and scale. Older criminal campaigns relied on people typing commands by hand. Today's AI-assisted attacks chain together dozens of steps automatically, morphing as they go to avoid defences that look for known patterns.
Most corporate security systems are still built around those known patterns, called signatures, much like antivirus software that only catches viruses it has already seen. If the attack looks new, the old system may miss it entirely. Our 20 July story on the Hugging Face breach showed exactly that dynamic: an automated attacker ran tens of thousands of actions before anyone caught it.
How does AI-driven defence work?
Rather than waiting to recognise a known threat, newer platforms try to judge what a piece of software is trying to do, even if it has never been seen before. That approach is called behavioural analysis.
Palo Alto Networks' Cortex XDR platform, the subject of a piece originally published by CSO Online, uses thousands of machine-learning detectors running across a company's computers and network and cloud services at once. Instead of flooding analysts with separate alerts, the system stitches related signals into a single summary it calls an "attack storyline," giving the analyst one coherent picture rather than a pile of fragments.
| Claimed capability | Figure |
|---|---|
| Reduction in alert noise | Up to 98% |
| Incidents handled without manual action | Up to 99% |
| Pre-built response playbooks included | 120+ |
| Quick-action response options | 18 |
When a genuine threat is confirmed, the platform can act on its own: revoking a stolen login credential or isolating an infected computer from the rest of the network, without waiting for a human to click a button.
What is the 'agentic blind spot'?
Many companies now run automated software agents, small programs that perform tasks on their own, booking meetings, querying databases, summarising documents. These agents often hold wide access to company systems.
Criminals have noticed. Hijack an automated agent and you gain a foothold that sits invisibly inside normal-looking activity. Palo Alto Networks addresses this through a partnership with Koi Security, whose Agentic Endpoint Security product watches what automated agents do in real time, right down to individual commands they issue.
Should ordinary employees be worried?
Directly, most of this plays out below the surface of what staff ever see. But the downstream risk is real: a successful automated attack can expose payroll records or patient files. Staff credentials are frequently sold after a breach and used in follow-up attacks, so changing passwords promptly and not reusing them across accounts remains the single most practical step any employee can take. Watch for phishing emails, fake messages designed to trick you into handing over a password, in the days after your employer reports a breach.
The honest read on this story: Palo Alto Networks is selling a product, and the 98 and 99 percent figures are their own claims, not independent audits. What's real is the underlying problem. Automated attacks aren't slowing down, and most security teams still aren't built to match their speed.
