Adam Ely’s Post

The penetration testing landscape is quietly undergoing one of its biggest shifts in years — and most organisations haven't caught up yet. AI is no longer just the target. It's now the attacker's toolkit. We're entering an era where adversarial machine learning, LLM prompt injection, and AI-assisted reconnaissance will become standard in offensive security playbooks. If you're not testing your AI systems the same way you test your infrastructure, you have a blind spot the size of a data centre. Continuous Automated Red Teaming (CART) is replacing the annual pentest model faster than most compliance frameworks have noticed. The idea that a point-in-time assessment captures a moving threat landscape is — frankly — outdated. The future is persistent, autonomous, and deeply integrated with your CI/CD pipeline. Meanwhile, cloud-native and Kubernetes environments have created an entirely new attack surface that traditional pentesters weren't trained to exploit. Misconfigured IAM roles, overprivileged service accounts, and lateral movement through workload identities are now prime real estate for attackers — and remain poorly understood at the board level. Social engineering is also evolving at a frightening pace. Deepfake audio, hyper-personalised spear phishing generated by AI, and synthetic identity fraud are pushing human-layer testing into territory that no phishing simulation tool was designed for. The best pentesters of the next decade won't just be technically elite — they'll need to think like product managers, understand DevSecOps pipelines end-to-end, and communicate risk in business language, not CVE scores. The attack surface is growing. The talent gap is real. The window to get ahead of this is narrowing. The question isn't whether your defences will be tested — it's whether you test them first. #PenetrationTesting #CyberSecurity #RedTeam #AIRisk #Infosec #EthicalHacking

🛑 The "New Normal" of Cyber Warfare: 10 AI-Driven Threats to Watch in 2026 Artificial Intelligence isn't just changing how we work—it’s rewriting the attacker’s playbook. We've moved beyond simple phishing and basic malware. In 2026, the threat landscape is defined by automation, personalization, and scale. Attackers are now using the same LLMs and ML frameworks we use for productivity to find zero-day vulnerabilities in seconds and craft deepfakes that can bypass biometric MFA. I’ve put together this infographic covering the Top 10 AI-Based and Classic Cyber Attacks that every organization needs on its radar right now: 1️⃣ Deepfake-Based Social Engineering: Real-time voice and video impersonation of executives to authorize fraudulent transfers. 2️⃣ Automated Phishing & Lure Creation: AI generating hyper-personalized, emotionally manipulative messages that bypass traditional filters. 3️⃣ Data Poisoning (Adversarial ML): Corrupting training data to "brainwash" an AI model into making biased or harmful decisions. 4️⃣ Intelligent Botnets & C&C: Self-managing botnets that evolve their own code to evade signature-based detection. 5️⃣ Automated Vulnerability Discovery: AI systems that scan and exploit software flaws faster than humans can patch them. 6️⃣ Bypassing AI-Based Defenses: Using adversarial samples specifically designed to be "invisible" to security AI. ... and more (see the full breakdown in the image!). 💡 The Strategy for 2026: We cannot fight AI-driven attacks with manual processes. To stay resilient, organizations must move toward: Identity-Centric Security: Making identity (not the network) the new perimeter. AI vs. AI Defense: Deploying automated detection that can keep pace with machine-speed attacks. Continuous Vetting: Moving from "one-time trust" to "continuous behavioral validation." Which of these threats is your team prioritizing this year? Let's discuss in the comments. 👇 #CyberSecurity #AI #InfoSec #DigitalTransformation #CISO #TechTrends2026 #CyberAwareness

Day 2 of #SecureWorldBoston While AI continued to be the word of the day, many of today’s sessions focused on the human side of cybersecurity. I was glad to see that emphasis. The fundamentals of security haven’t changed since antiquity - only the attack vectors have. Whether your adversary is advancing in a phalanx, a shield wall, mobile infantry, or through a keyboard with a script, the core principles remain the same: - Defense in depth (moat, walls, archers → firewall, IPS, EDR) - Human intuition and pattern recognition - spotting when something just feels off, whether on a battlefield or in a log file - Stoic principles applied to incident response: staying composed and executing your role under pressure, even as chaos unfolds AI dominated the morning discussions, including a session on how it can now replicate voice and video with just a few seconds of audio. That reality makes it clear: traditional phishing simulations and security awareness training will need to adapt and evolve. My career pivot from support to security is going to keep me very busy. A standout panel on resilience and incident response reinforced the importance of immutable backups, and just as importantly, ensuring teams actually know how to restore them under pressure. One CISO shared a simple but painful lesson: they had documented procedures for graceful server shutdowns… but when the time came, no one could find them. A reminder that documentation only matters if it’s accessible when you need it. The highlight of the conference was the final session. Mark Annati, CISO for the Commonwealth of Massachusetts, shared his personal journey adopting AI in both his professional and personal life. His experience felt familiar and grounding; much of what he shared mirrored my own approach. It’s easy to feel behind with the constant noise around AI - ads, hype cycles, and “must-learn” lists. His perspective helped cut through that. We’re all learning in real time. And like many of us, he sees AI not as a replacement, but as an amplifier of human capability. His caution was clear, though: it will soon be obvious who has embraced AI, and who hasn’t. He also spoke about phishing, and I was genuinely heartened to hear that he personally reaches out to users who click. That human touch still matters, even in an increasingly automated world. That wraps up #SecureWorld Boston 2026. I had the chance to network with peers, reflect on shared challenges across the industry, earn some CPEs, and even carve out time to prepare for my next certification step. See you in the field! #Cybersecurity #InfoSec #InformationSecurity #NeverStopLearning

𝙄 𝙬𝙚𝙣𝙩 𝙩𝙝𝙧𝙤𝙪𝙜𝙝 𝙩𝙝𝙚 𝙂𝙡𝙤𝙗𝙖𝙡 𝙏𝙝𝙧𝙚𝙖𝙩 𝙄𝙣𝙩𝙚𝙡𝙡𝙞𝙜𝙚𝙣𝙘𝙚 𝙍𝙚𝙥𝙤𝙧𝙩 2026 — 𝙖𝙣𝙙 𝙤𝙣𝙚 𝙩𝙝𝙞𝙣𝙜 𝙞𝙨 𝙘𝙡𝙚𝙖𝙧: 👉 Cyber threats are no longer human-speed. They are machine-speed. ⚠️ What’s changing? (Impact) • AI-driven cyberattacks are up by 1500% in just one month • Over 3.3 billion credentials already compromised • 1 in 3 vulnerabilities now has public exploit code • Ransomware attacks increased by 53% YoY 💡 The biggest shift? 👉 Attackers don’t “hack” systems anymore. 👉 They log in using stolen identities. Identity is the new attack surface. ⚠️ And it gets more serious… AI is no longer just a tool. It’s becoming an autonomous attacker • Learns from failed attacks • Adapts strategies in real-time • Runs full attack chains without humans Real Risk for Organizations • Your employee’s browser = entry point • Your SaaS tools = attack surface • Your AI integrations = new vulnerabilities 👉 Security is no longer just IT’s job 👉 It’s everyone’s responsibility What should leaders do? (Precautions) 1. Treat Identity as Critical Infrastructure Monitor credentials, sessions, and access behavior continuously 2. Move from Reactive → Predictive Security Focus on early threat intelligence, not post-incident response 3. Secure AI Workflows & APIs Most attacks now target integrations, not systems 4. Strengthen Human Layer Train teams against phishing, vishing, and social engineering 5. Reduce Attack Window Zero-day exploits now happen within 24 hours 6. Build Redundant Intelligence Systems Don’t rely only on public databases (CVE/NVD risks highlighted) 🎯 Final Insight: We are entering a world where: 👉 AI attacks at scale 👉 Identity replaces passwords as risk 👉 Speed decides security 💬 Question for leaders: Is your organization still protecting systems… or are you ready to protect identities, AI, and trust? #CyberSecurity #AI #DigitalTransformation #RiskManagement #Leadership #CISO #DataSecurity #FutureOfWork #Technology #aloktomar

#AI has changed the economics of cybercrime, and many organizations are still defending against a threat model that no longer exists. In the last year alone, AI-assisted attacks rose by 89%. At the same time, 82% of observed threats no longer rely on traditional malware, making many legacy defenses less effective. #Cybercrime now causes an estimated $10.5 trillion in global damage each year. This is not just more of the same. It is a STRUCTURAL SHIFT. #Phishing is now faster, cheaper, and far more convincing because generative AI can produce personalized, context-aware messages at scale. Ransomware continues to hit the sectors that matter most, including manufacturing, healthcare, energy, finance, and transport. #Deepfakes have also moved from novelty to weapon. They are now being used in fraud, impersonation, and corporate social engineering, while human detection remains unreliable. Zero-day exploitation is accelerating as well. AI is shrinking the window between vulnerability disclosure and active exploitation from weeks to hours. Supply chain attacks are growing too, as attackers use automation to identify weak vendors, open-source dependencies, and underprotected partners. But the most important shift is WHAT comes next. Generative AI gave attackers better tools. Agentic AI gives them autonomous operators. That means systems capable of reconnaissance, phishing, exploitation, adaptation, and persistence with minimal human input. The attack chain itself is becoming automated. At the same time, defenders face a severe talent shortage, fragmented tooling, and slower decision cycles. Attackers are moving at machine speed. Most security teams are not. That is the real gap. The biggest mistake leadership can make right now is to treat this as another chapter in the old cyber cycle. It is not! We are entering a phase where phishing, identity attacks, deepfakes, zero-days, and infrastructure compromise merge into a continuous AI-enabled attack flow. The question is no longer whether AI will reshape cybersecurity. It already has. The question is whether organizations can redesign defense fast enough, with AI-native detection, stronger identity controls, faster response, and security operations built for machine-speed threats. Because companies still relying on static, perimeter-first thinking are not just behind. They are exposed!

The next AI risk for the enterprise is not just bad output. It is machine-speed offense. IBM’s latest announcement on agentic attacks matters because it signals a shift many boards still underestimate: frontier AI is not only changing how enterprises work, it is changing how they will be attacked. IBM says attackers are already using frontier models to accelerate every phase of the attack lifecycle, lowering the time, cost and expertise needed for sophisticated attacks. That should reset the executive conversation. For the past year, most AI discussions in the boardroom have centered on productivity, copilots and use cases. The harder question now is this: What happens when both your business and your adversaries start operating at machine speed? This is where many leadership teams are exposed. A recent executive survey reported by Axios found that roughly 80% of leaders believe their organizations would fail an AI governance audit. That is a serious warning sign, because the companies racing to deploy AI without operational controls may be creating two risks at once: more automation inside the business, and a larger attack surface outside it. Why executives should care: AI-enabled attackers can compress reconnaissance, vulnerability discovery, phishing, exploitation and lateral movement. That means the traditional gap between detection and response becomes far more dangerous. If your controls, patching, identity model, monitoring and escalation processes still depend on human-speed coordination across siloed tools, you are designing yesterday’s defense for tomorrow’s threat. IBM’s new offering is explicitly built around that premise. What I would ask as a CEO, CIO, CTO or CISO right now: Do we know where AI meaningfully changes our threat model? Can we identify which business processes, identities, APIs and data flows would be most exposed to autonomous or semi-autonomous attack activity? Can our security stack detect and respond fast enough if attacks become persistent, adaptive and machine-paced? Do we have governance that covers not just model use, but agent behavior, tool access, remediation authority and auditability? And are we testing our resilience against AI-enabled attack paths now, before an incident forces the lesson? My view: 2026 will be the year that AI leadership stops being measured by how many agents you deploy, and starts being measured by whether you can operate safely in an environment where both innovation and adversary capability are compounding at the same time. Capability still matters. But control, resilience and response speed are becoming the executive differentiators. #AppliedAI #AgenticAI #CyberSecurity #AIGovernance #AIControls #CIO #CTO #CISO #EnterpriseAI #RiskManagement

🤖 2026: The Era of AI-on-AI Warfare The cybersecurity landscape has officially shifted. We are no longer just defending against hackers; we are defending against Offensive GenAI. In 2026, tactical operations are being automated at a staggering scale of 80-90%. The battlefield is now a clash of silicon, where the "Blue Team" and "Red Team" are both powered by the same underlying LLM technology. 🛡️ Defensive GenAI (The Blue Team) Primary Tool: Automated Forensics. We’ve moved beyond alerts to "Self-Healing" postures that repair vulnerabilities in real-time. Communication: Incident Summarization. Turning millions of cryptic logs into human-readable SOC reports in seconds. Strategy: Adversarial Simulation. Using AI to dream up "synthetic" attacks, finding zero-day gaps before the enemy does. ⚔️ Offensive GenAI (The Red Team) Primary Tool: Vibe Coding & Polymorphic Malware. Attackers are generating code that bypasses signatures faster than we can catalog them. Communication: Deepfake Phishing. Real-time voice and video cloning are making social engineering "high-alpha" and incredibly difficult to detect. Strategy: Malicious Chaining. Using MCP servers to link multiple AI tools into complex, multi-stage espionage campaigns. ⚠️ The Emerging Threat: "Shadow AI Agents" Just as "Shadow IT" defined the last decade, Shadow AI defines this one. Employees are now building their own "vibe-coded" AI automations to handle sensitive data without IT oversight. A staggering 92% of security professionals are now concerned about these unmanaged agents acting within their corporate supply chains. The Bottom Line: In 2026, security isn't just about having the best firewall; it's about having the most resilient AI Governance. We must secure the models that secure us. #CyberSecurity #GenerativeAI #InfoSec #AIWarfare #2026Trends #BlueTeam #RedTeam #ShadowAI

An AI model just spent a few weeks autonomously finding zero-day vulnerabilities in every major operating system and every major browser. Not helping humans find them. Finding them. On its own. Overnight. That's what Anthropic announced last week with Claude Mythos. And they made the decision not to release it publicly because the offensive capability is too dangerous to put in the open. That's not a typical product launch. That's a warning. Here's what I keep thinking about: the time between a vulnerability being discovered and being weaponized has already collapsed from months to hours. This compresses it further. Most organizations are still operating on the assumption that attackers have to work hard to get in. That finding weaknesses takes time. That they'd see it coming. That assumption has been wrong for a while. Now it's very publicly, very formally wrong. The 2026 Identity Exposure Report we published last month showed 65.7 billion identity records already sitting in criminal hands. That's before AI-assisted attackers get significantly cheaper and faster at finding new ways in. For security leaders, the question worth sitting with right now isn't "are we patched?" It's "how much of our identity data is already out there, and how fast can we act on it when someone decides to use it?" Curious how your teams are thinking about the AI threat acceleration problem. What's changing in your planning conversations? #CISO #CyberSecurity #IdentitySecurity #AI #SpyCloud

Every CIO and CISO I talk to is dealing with the same tension right now - the business wants AI everywhere, but the security team is already stretched thin just keeping up with the basics. The WEF just published their 2026 Global Cybersecurity Outlook. 87% of organizations said AI vulnerabilities are the fastest-growing risk they're facing. Ransomware costs are projected to hit $74 billion this year. And there are still 4.8 million unfilled cybersecurity roles globally. So the ask keeps getting bigger, the threats keep getting smarter, and the teams aren't getting any larger. What I keep hearing from leaders is that AI governance isn't a "nice to have" anymore - it's becoming a prerequisite for using AI at all. But most orgs don't have a clear owner for it, and the people closest to it (security teams) are already underwater. The orgs figuring this out aren't waiting for perfect. They're giving their teams visibility into how AI is actually being used, putting practical guardrails in place, and leaning on partners to fill the gaps they can't hire for fast enough. If you're navigating this right now, I'd be curious to hear how you're thinking about it! #AI #SecOps #Governance #Cybersecurity

👉 Anthropic built an AI they reportedly considered too dangerous to release So they shared it with 40 companies. 😬 Then one of those instances was leaked. And that’s where this stops being just a cybersecurity headline. Claude Mythos is said to uncover thousands of zero-days across major OS and browsers 🧠 It can chain multi-step attacks autonomously. No fatigue. No hesitation. And now parts of it are showing up in places like Discord. 👉 Meanwhile, many organizations are still stuck in patch queues, approvals, and slow risk cycles 🕒 ✔️ Here’s the uncomfortable reality: The defenders got the press release. The attackers got the capability. 💥 👉 Projects like Glasswing the intent is good. But they also expose a hard truth in frontier AI: Once distributed, this level of capability is almost impossible to contain. Every CIO and CISO should be asking: 👉 Are we building for today’s threat model or the one that’s already changed? #Cybersecurity #AI #CISO #GRC #RiskManagement #Governance