By Dan Lohrmann.
Let me start with two yes or no questions:1. Do you believe AI-enabled attackers are already changing the cybersecurity risk facing your organization? 2. Has your organization adjusted its cybersecurity priorities because AI can accelerate vulnerability discovery or exploitation? These were the same questions I asked the audience at Secure Delaware* on Tuesday, Oct. 27, 2026, as I moderated a session entitled “Combatting the Artificially Enhanced Threat Actor.”And as you might expect, most hands in the packed room went up to answer “yes.”The two expert panelists for the session were:Dovid Clarke, Chief Executive Officer, RedShield Amad Sheikh, Chief Information Security Officer, University of Delaware They both painted a picture of growing cyber threats as a result of AI, as well as growing use of AI in governments and universities around the world. Examples were provided that ranged from Hugging Face (and AI that is not governed properly) to shadow AI challenges to the increasing number of ransomware and other cyber attacks powered by AI from bad actors that organizations of all sizes are facing.The questions that we covered, along with some answers, included:Where is AI genuinely changing the capabilities of cyber adversaries, and where does the perceived threat exceed the current reality? Genuinely, AI scales phishing and accelerates social engineering, lowering barriers for low-skill attackers. Hype exceeds reality in autonomous zero-day discovery; fully self-driving complex breaches remain rare. The real threat lies in volume and velocity, while total autonomous orchestration remains exaggerated.How does AI change the amount of time defenders may have between vulnerability disclosure, discovery and exploitation? AI compresses the time from vulnerability disclosure to weaponized exploitation from weeks down to hours. Attackers automate exploit generation instantly, while defenders remain trapped by manual testing and change windows. Traditional patching cycles are too slow, transforming disclosure into an immediate race against machine-speed attacks.Which traditional cybersecurity fundamentals have become even more important as attackers gain greater automation capabilities?Rigorous asset management and strict identity access controls prevent automated lateral movement and minimize your expanded attack surface. Rapid patch management alongside continuous backup verification ensures resilient recovery when machine-speed exploits bypass initial perimeter defenses.How can organizations prioritize vulnerabilities and defensive actions when adversaries can scan and exploit environments more quickly? Shift from static CVSS scores to threat-informed prioritization based on active exploitation data, focusing automated patching and isolation on high-risk external assets first. By integrating contextual threat intelligence with continuous attack surface management, large public-sector and university security teams can outpace machine-speed scans, allocate limited resources efficiently, and safeguard critical infrastructure against automated exploitation waves.What role can information sharing and collective defense play in helping state, local, tribal and territorial organizations keep pace with increasingly automated threats? (Note: I added some of my own thoughts here as well.)Information sharing through groups like REN-ISAC and MS-ISAC enables universities and local governments to pool threat intelligence instantly. By transforming individual detections into automated, collective blocklists and defensive playbooks across institutions, public-sector organizations can neutralize machine-speed threats together faster than any single entity could achieve alone.How can cybersecurity leaders communicate emerging AI risks to executives without allowing hype to distract from the most important security priorities? Cybersecurity leaders must ground executive discussions in business risk and operational impact rather than technical hype. Frame AI threats through the lens of accelerated velocity and scale on existing vulnerabilities — such as automated phishing and faster exploit delivery — rather than speculative sci-fi scenarios. Use objective threat intelligence to separate proven adversary tactics from vendor marketing, emphasizing that foundations like asset visibility, identity control and rapid patching remain the primary strategies. By presenting AI as a risk multiplier rather than a new paradigm, CISOs keep leadership focused on funding critical baseline security controls that defend against both automated and traditional attacks.FINAL THOUGHTSWhat I enjoyed most were the practical stories and real-life impacts from these experts, and the questions from the audience, most of which covered awareness and helping enterprise business leaders and government leaders understand the risks and benefits of AI.What was clear at the session was that personal roles still have a huge impact, and we can never get rid of the basics. It still comes down to people, process and technology solutions — and people problems and solutions are the most important piece.*Secure Delaware is hosted by Government Technology.
window.fbAsyncInit = function() {
FB.init({
appId : ‘314190606794339’,
xfbml : true,
version : ‘v2.9’
});
};
(function(d, s, id){
var js, fjs = d.getElementsByTagName(s)[0];
if (d.getElementById(id)) {return;}
js = d.createElement(s); js.id = id;
js.src = “https://connect.facebook.net/en_US/sdk.js”;
fjs.parentNode.insertBefore(js, fjs);
}(document, ‘script’, ‘facebook-jssdk’));
——————————————————-
Click Here For The Original Source.
