AI-Powered Attackers Are Running Past Traditional Defences, CrowdStrike Data Suggests
With roughly four in five intrusions now leaving no malware behind, security teams are being forced to rethink what a break-in even looks like.
Key points
- CrowdStrike's Global Threat Report estimates about 79% of attacks in the last year involved no malware at all.
- Attackers are increasingly using stolen logins and legitimate tools instead of viruses, making them harder to spot.
- Security operations centres, the teams that watch company networks around the clock, are being pushed to add new layers of detection.
- AI is now on both sides of the fight, helping criminals move faster and helping defenders sift through alerts.
For two decades, the pattern in cybersecurity was almost boring. Defenders built walls. Attackers found ladders. Defenders built taller walls.
That rhythm is breaking.
According to reporting from The Hacker News, attackers armed with artificial intelligence are now outpacing the tools most companies rely on to catch them. The clearest evidence sits in a single number from CrowdStrike, a large security vendor: about 79% of attacks the company tracked involved no malware at all.
That matters because most business defences are still built to spot malware, meaning malicious software that infects a computer. Antivirus programs, and their modern cousins known as endpoint detection tools, are trained to notice files behaving badly.
But if there's no bad file, there's nothing for them to notice.
So how are the criminals getting in without malware?
They're logging in. Attackers buy or steal a valid username and password, often from a worker tricked by a phishing email, which is a fake message designed to harvest login details. Once inside, they use the same everyday software a real employee would use: remote access tools, cloud dashboards, file-sharing apps.
To a monitoring system, it looks like Karen from accounts doing her job. It isn't Karen.
This technique is called "living off the land." The attacker brings almost nothing with them and borrows what's already there.
AI has made this style of attack far cheaper to run at scale. Criminals now use large language models to write convincing phishing emails in fluent English, generate fake voice messages for phone-based scams, and sift through stolen data faster than any human could. As we reported on 14 July, AI agents are now running entire attack campaigns from start to finish, cutting the time to ransack a company from weeks to hours.
The old defensive stack wasn't built for this. It was built to catch a virus attached to an email in 2011.
What defenders are actually doing about it
The response, at least among better-resourced companies, is to stop relying on any single detection layer. Instead of watching only the laptop or only the email server, security teams stitch together signals from across the business: identity systems that track logins, cloud platforms that record file access, network tools that watch traffic patterns.
The idea is simple. One weird event is noise. Five weird events in the same hour, involving the same account, is a story.
"Multi-layered detection" isn't marketing. It's an admission that no single sensor is enough any more, a reality that's complicated further by AI coding tools that trip the same alarms designed to spot real break-ins, as we found on 8 July.
AI is helping on the defensive side too. Security operations centres are drowning in warnings. Machine learning groups related alerts, ranks the urgent ones, and closes the false alarms, freeing analysts to chase intrusions that actually matter.
Should you worry?
If 79% of attacks now start with a stolen login, the single most useful thing most people can do is protect their own credentials. Turn on multi-factor authentication, the extra code sent to your phone, on every account that offers it. Treat unexpected password reset emails with suspicion.
And if a message at work asks you to click quickly, quiet urgency is usually the tell. Real IT departments almost never rush you.
The walls-and-ladders game isn't coming back. What replaces it is messier and far more dependent on the humans in the middle. That's not a reassuring conclusion, but it's the honest one.
