Rapid developments in artificial intelligence (AI) have consequently and inevitably led to rapid movements in cyber security. In a short space of time AI has become a force multiplier across the entire ecosystem – for cybercriminals and for cyber security professionals alike. It’s proven to improve the speed, scale, and accessibility for people on the offensive and defensive sides.
Quorum Cyber’s 2026 Global Cyber Risk Mid-Year Review, written by its Threat Intelligence team, explains how the threat landscape has evolved in the past six months and what organisations need to do to fortify their cyber resilience for the near future and beyond
Attackers are weaponizing AI
AI has equipped attackers with faster reconnaissance, more persuasive social engineering, and easier malware and scripting support. It’s lowered the skill barrier for threat actors who previously lacked the expertise to conduct any of these activities well enough to do any significant harm to organisations and evade detection.
European police agency Europol has warned that AI-driven attacks are becoming more precise and more devastating. US AI company Anthropic, which recently launched the now-famous Project Glasswing, reports that attackers are increasingly using AI for post-compromise activity such as account discovery, privilege escalation, and lateral movement – in addition to the well-known use of malware generation.
One of the biggest impacts felt by AI is that it’s compressed the time between intent and action. It’s accelerated the actions of threat actors, enabling them to move much more quickly from target research to pretext creation, localisation, scripting, and operational decision support. People still need to be involved in key decisions, but it allows them to conduct smoother campaigns. This shorter timescale gives defenders less warning time and puts them and their security systems under more pressure.
Is the tide turning in defenders’ favour?
Attackers, however, don’t have AI all for themselves. Cyber security companies are moving fast to deploy AI too, embedding it into production security workflows for one. Microsoft has reported that a Dynamic Threat Detection Agent integrated into Security Copilot and Microsoft Defender is already operating across tens of thousands of customer environments, achieving 80% precision from customer feedback and generating novel alerts in around 15% of investigated incidents.
In a separate randomised trial, Microsoft’s phishing triage agent delivered up to 6.5 times as many true positives per analyst minute and improved verdict accuracy by 77%.
All this provides growing evidence – and confidence – that the tide is finally beginning to turn in the defenders’ favour to give them the advantage.
The optimal cyber security model, however, remains one in which people work together with AI to create a team that’s greater than the sum total of its parts. Cyber security analysts are enhanced by AI, not replaced by it. And AI is more effective when it runs alongside people’s expertise, experience, and judgement. That’s why defenders are using AI for triage, enrichment, prioritisation, and code review, while keeping high-consequence decisions, control changes, and incident command under human oversight.
In a nutshell, the main effects of AI on attackers are:
- Shorter path from intent to action
- More persuasive and scalable campaigns
- Lower skill threshold for operators
- Less warning time for defender.
While the key effects of AI on defenders are:
- Higher analyst throughput
- Faster prioritisation
- More consistent decisions in repeatable tasks
- Best results in bounded workflow.
Check out the 2026 Global Cyber Risk Mid-Year Review
Download the report today to understand how to strengthen your organisation’s cyber resilience in an era of AI, disinformation, and political risk.
Contact us if you have any questions about the content of the report or any concerns about your cyber security and data security.
Our upcoming webinar, AI, Identity and Trust: Secure the Foundations of Cyber Resilience in 2026, on Tuesday 18th August at 11am ET / 4pm BST covers the key topics from the report.
2026 Global Cyber Risk Mid-Year Review
The 2026 Global Cyber Risk Mid-Year Review describes the state of the global threat landscape and reveals that cybercriminals are increasingly adopting an extortion-led business model to monetise stolen data, identities, and cloud access rather than relying on ransomware and data encryption.
