Loading story…
Cybersecurity leaders are increasingly investing in threat intelligence programs, with a focus on automation, high-fidelity indicators, and cross-functional collaboration to improve both detection and strategic decision-making. According to industry surveys, a significant majority of organizations are raising their threat intelligence budgets and aiming to mature their programs, leveraging AI to augment analyst workflows and address the challenge of information overload. Practitioners emphasize the importance of integrating intelligence into business strategy and risk communication, as well as the need for better tools to transform large data volumes into actionable insights.
Despite these advancements, fundamental security gaps such as the lack of enforced multi-factor authentication (MFA) continue to enable large-scale cloud data breaches. Security experts highlight that attackers are exploiting cloud collaboration services through information-stealing malware, and that many breaches could be prevented with basic controls like MFA. Additionally, the evolving landscape of AI in cybersecurity is prompting new defense strategies, such as poisoning knowledge graphs to protect sensitive data, and raising concerns about the risks associated with autonomous AI systems in critical infrastructure and public safety contexts.
Pull IOCs and campaign context straight into your stack.
5 events from the most recent confirmed update back to the earliest known activity.
Recorded Future published practitioner insights summarizing the 2025 State of Threat Intelligence Report and panel commentary from Adobe, Global Payments, and Superhuman on automation, tailored intelligence, leadership education, and third-party risk priorities.
The same ISMG discussion highlighted emerging AI-focused security ideas, including poisoning knowledge graphs with plausible false data to reduce the value of stolen information, and warned that autonomous AI robots in public spaces should be treated as safety-critical systems because compromise or failure could cause physical harm.
An ISMG editors' panel said major cloud data breaches continue to be enabled by organizations failing to enforce multifactor authentication, with attackers exploiting cloud collaboration services using credentials harvested by information-stealing malware.
The report found that 76% of organizations were already spending more than $250,000 annually on threat intelligence and 91% planned to increase that spending in 2026, reflecting broader treatment of threat intelligence as a strategic business function.
Recorded Future's 2025 State of Threat Intelligence Report was based on a survey of 615 cybersecurity executives and practitioners, capturing organizations' spending, maturity, and operational priorities for threat intelligence programs.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Artificial intelligence is rapidly transforming both the threat landscape and defensive strategies in cybersecurity, prompting CISOs and security leaders to rethink their approaches. A global study by Gigamon found that 86% of CISOs now view metadata and packet-level data as essential for detecting threats in complex hybrid cloud environments, but 97% admit to making trade-offs that leave visibility gaps. The rise of AI-driven attacks is fueling demand for real-time visibility and observability tools, with 75% of CISOs regarding public cloud as their highest security risk and 73% considering moving workloads back to private clouds. Security teams are investing heavily in AI-specific security tools, with 73% of companies spending over $1 million annually, yet 70% cite the rapid pace of AI development as their top concern. Recent high-profile breaches, such as those at LexisNexis Risk Solutions and McLaren Health Care, illustrate the increasing scale and sophistication of attacks, often amplified by AI. AI is accelerating the reconnaissance phase of attacks, enabling adversaries to map environments and identify vulnerabilities with unprecedented speed and precision, though human direction remains necessary for effective exploitation. The proliferation of AI-generated code, including through practices like 'vibe coding,' introduces new risks as less experienced developers may overlook security fundamentals, leading to insecure applications. Agentic AI systems, which act autonomously or on behalf of users, present urgent challenges in authentication, authorization, and identity management, with experts calling for scalable frameworks and robust credentials to prevent security lapses. CISOs are urged to build security into the design phase of software development, leveraging platform-native controls and enforcing policies like Row Level Security to minimize risk. The integration of AI into security operations is seen as both an opportunity and a challenge, requiring adaptive access solutions, post-quantum cryptography, and continuous monitoring. As AI reshapes digital transformation, organizations must balance the benefits of rapid innovation with the imperative to secure their environments against increasingly sophisticated, AI-powered threats. The consensus among experts is that security must evolve in tandem with AI capabilities, emphasizing proactive risk management, cryptographic agility, and a culture of security awareness across all levels of the organization.
Jun 29, 2026
Security leaders and practitioners are increasingly focused on the integration of artificial intelligence (AI) into cybersecurity operations, particularly in areas such as firmware analysis and infrastructure protection. Recent discussions highlight the transition from traditional security methods to AI-driven approaches, emphasizing both the benefits and the new risks introduced by these technologies. Experts point out the importance of prompt specificity for effective vulnerability discovery, the need for robust guardrails when deploying AI, and the potential for AI-generated reports to impact cybersecurity workflows. The creative monetization of vulnerabilities, especially in IoT devices, and the use of man-in-the-middle techniques are also emerging concerns as AI becomes more deeply embedded in security processes. Security leaders at high-growth AI infrastructure companies are adopting threat-model-driven frameworks and prioritizing detection observability over prevention controls in fast-moving environments. The rise of AI agents is fundamentally altering the security landscape, making previously manageable security gaps potentially catastrophic. Building security programs from the ground up now requires a focus on host integrity from firmware through userspace, and a mandate for "AI-first" detection platforms. These developments underscore the need for concrete threat models, careful prioritization of security investments, and a shift in how organizations approach security debt in the age of AI.
Jun 29, 2026
Cybersecurity leaders are facing a rapidly evolving threat landscape shaped by the integration of artificial intelligence (AI) into both attack and defense strategies. According to a report from VikingCloud, 71% of surveyed security leaders have observed an increase in the frequency of cyberattacks over the past year, with 61% noting that the impact of these incidents has also grown. Nation-state actors are increasingly targeting a broader range of industries, including retail, healthcare, and hospitality, often leveraging AI to scale their operations and exploit third-party software vulnerabilities. The use of generative and agentic AI by attackers has enabled more sophisticated phishing, social engineering, and ransomware campaigns, with deepfakes and voice-based fraud becoming more prevalent. Security leaders report that AI is now commonly used to automate the creation of polished, linguistically sophisticated phishing emails, making them harder to detect and more convincing to recipients. Attackers are also targeting AI assistants embedded in workplace tools, using malicious prompts hidden in emails to manipulate these systems into leaking sensitive information or executing unauthorized actions. Research from Columbia University and the University of Chicago, as well as Barracuda Research, has documented how attackers exploit weaknesses in AI-driven security tools and tamper with systems that use retrieval-augmented generation (RAG), leading to unreliable outputs and poor decision-making. Despite these challenges, organizations are increasingly adopting AI to bolster their defenses, automating threat detection, identity management, and patching to free up security teams for more strategic tasks. However, a significant skills gap persists, as highlighted by the AI Workforce Consortium, which found that AI technical skills are now required across 50 job roles in ICT, yet the market lacks enough professionals with these capabilities. The demand for expertise in areas such as LLM architecture, prompt engineering, and generative AI is outpacing supply, putting additional pressure on security teams. Security leaders are also concerned about reduced government oversight, with many citing cuts to agencies like CISA and NSA as factors that have increased organizational vulnerability. The interplay between AI-driven attacks and defenses is creating new security, compliance, and governance challenges that organizations must address to safely deploy advanced AI systems. As both attackers and defenders race to leverage AI, the need for skilled professionals and robust governance frameworks has never been greater. The evolving threat landscape underscores the importance of continuous learning and adaptation for cybersecurity teams. Organizations must remain vigilant against AI-powered threats while investing in workforce development to close the skills gap. The integration of AI into cybersecurity is not only transforming technical requirements but also reshaping risk management and strategic decision-making at the highest levels.
Jun 29, 2026