Earlier this year, we experienced what has been described as the world’s first AI-enabled cyber attack. In July, hundreds of OpenAI agents escaped their testing environment and successfully hacked Hugging Face, a popular platform for AI developers.
With threat actors now leveraging AI and agentic tools to launch attacks and spot vulnerabilities at rates which are previously unimaginable, organisations are becoming increasingly vulnerable to these escalating threats. They must now reassess how effectively they are defending themselves.
Controlled testing is not enough
In response to these increasingly intelligent and powerful threats, companies are desperate to remain protected. However, the presence of cyber security software does not necessarily mean that an organisation is protected. As cyber threats become more sophisticated, businesses need confidence that their defences can withstand realistic attacks, not just perform well in controlled tests.
Security vendors develop solutions to both detect and protect against nation-state attacks, major ransomware campaigns and mass-scale phishing offensives. These solutions must be tested rigorously, in real-world environments, to demonstrate their abilities. Real-world incidents can involve complex, multi-stage attacks that expose weaknesses that individual product tests will miss.
We’ve seen firsthand how major cyber attacks, such as that directed at JLR last year, can cause serious problems beyond IT disruption. They can create wider economic downfall. JLR is cutting 4,000 jobs over the next two years, for example.
Security claims need to be tested in the real world
As cyber attackers continue to evolve their tactics, cyber security testing must evolve with them. Traditional security tests that focus on individual techniques will not reveal how effectively a product can withstand a highly sophisticated, multi-stage attack, particularly when AI enables attackers to move faster than ever.
The unit of testing needs to change from the individual technique to the complete campaign, operating under time pressure. This means trying out different ways of attacking and doing so over longer periods of time as well as very quickly, to copy how manual and AI-enabled attackers work. Only realistic testing is useful.
Detection is not the same as defence. A security platform can generate an accurate alert while still allowing the attacker to achieve their objective. Organisations need to know to what extent the product can prevent the initial activity, interrupt the attack chain (for example, restricting lateral movement), protect important assets and support recovery.
Cyber security testing must reflect the unpredictability of real-world threats. Reproducibility does not require giving participants the exam questions in advance. It means being able to prove how a test attack ran, and to be able to re-run it to help fix products.
By simulating unfamiliar attack scenarios without revealing exactly which techniques will be used in advance, independent testing can help establish whether security products can respond effectively to emerging threats, rather than simply recognise familiar patterns.
As AI continues to change the speed and complexity of cyber attacks, rigorous, independent testing continues to be essential in identifying weaknesses and improving protection. This is a critical step to ensure that businesses are prepared for the threats they face.
Join our LinkedIn group Information Security Community!
——————————————————-
Click Here For The Original Source.
