Companies Are Spending More on Cyber 'Attack Drills' to Keep Up with AI-Powered Hackers
New research from Omdia finds 88% of organisations plan to increase spending on offensive security, as AI gives attackers a speed advantage that human-paced testing can no longer match.
Key points
- 88% of organisations said they are willing to spend more on offensive security strategies, according to Omdia research presented at Black Hat USA 2026.
- Traditional practices such as penetration testing and red teaming, where security professionals simulate attacks to find weaknesses, are no longer keeping pace with AI-assisted attackers.
- AI agents used defensively carry real risks: they can act unpredictably, be manipulated by outside inputs, and consume significant computing resources.
- 99% of organisations told Omdia they are investing in software supply chain security, treating it as a board-level concern.
- Speed is now the single biggest worry for security teams, as AI lets attackers find and exploit flaws faster than humans can respond.
The cybersecurity industry gathered at Black Hat USA 2026 in Las Vegas this summer, and one theme dominated the conversations: attackers are now using artificial intelligence to move faster than defenders can track. Research from Omdia, a technology analysis firm, suggests companies have taken notice.
Theresa Lanowitz, principal analyst at Omdia, presented findings from a study called Offensive Security Strategies: Granting the Same AI Advantages to the Defender, speaking with Dark Reading's Rob Wright at the News Desk. The core message was blunt: the old playbook is broken.
What exactly is 'offensive security', and why does it matter?
Offensive security means hiring experts to attack your own systems before real criminals do, so you can fix the gaps first. Methods include penetration testing (experts attempt to break in using the same tricks real hackers use), red teaming (full simulated attacks on people and technology alike), and vulnerability assessments (systematic scans for weaknesses in software).
Lanowitz told the audience that all of these methods are falling short. "Those traditional cybersecurity practices that we've been using in offensive security, they're no longer working," she said. AI has shortened the window between a flaw being discovered and criminals exploiting it, and human-speed testing cannot keep up.
The answer her research points to: deploy AI on the defender's side too. Software agents, meaning programs that act independently, can continuously scan for exposed weaknesses, discover assets across an organisation's entire IT estate, and flag which problems carry the greatest business risk. Threat Vectr covered one firm already building toward that model in our August report on XBOW and Nico Waisman.
Should organisations worry about AI defenders going rogue?
Yes, and most already do. Lanowitz said survey respondents raised three honest concerns about using autonomous AI agents for security work.
| Concern | Plain-English meaning |
|---|---|
| Prompt injection | A hacker tricks the AI with a carefully worded input, hijacking what it does next |
| Unintended actions | The agent, acting autonomously, does something its operators did not expect or want |
| Resource costs | Running AI agents continuously burns computing power and can be expensive |
The second concern is the trickiest. Unlike a script that runs the same steps every time, an AI agent makes its own decisions. That flexibility is also a vulnerability, a point our 20 August story on rogue AI agents examined in detail.
"You want to limit the blast radius of what that agent is actually able to do," Lanowitz said, using a phrase borrowed from explosives terminology to mean: make sure a misbehaving agent cannot cause damage beyond a tightly defined area. In practice, that means running agents inside sandboxes, sealed-off digital environments where a program operates without touching the wider network.
What should ordinary people take from this?
For most people, the impact is indirect but real. When a company's defences lag behind attackers, customer records and financial data are what end up exposed. Faster, AI-assisted attacks mean breaches that once took months can now unfold over a weekend.
If you work for a large organisation, the practical upshot is this: security prompts and unusual login requests are not bureaucratic nuisances. They are the human layer of a defence no AI agent can fully replace. Lanowitz noted that AI is now embedded in HR systems and finance platforms, which means every department sits inside the attack surface, not just IT.
The spending numbers suggest boards are finally treating this seriously. Whether the tools can outpace the threat is the question nobody, including Omdia, can answer yet.
