Cybersecurity professionals who respond to the current wave of AI-enabled attacks report severe overload and growing fatigue. A stream of attacks, newly disclosed vulnerabilities and numerous false positives are making it hard to determine which incidents are genuine threats.
Why it matters
Although many attacks are being augmented by artificial intelligence, humans remain the ones who operate on the frontlines. They are having difficulty triaging massive volumes of threat data to find out who has been compromised and which intrusions pose real operational or business risk.
What responders are reporting
Justin Timothy, a threat intelligence consultant at GuidePoint Security, told Axios: "The last month has been the longest year of my life." Even before the period dubbed "Black October," Timothy was already overwhelmed as ransomware-focused hacker groups returned from a seasonal summer slowdown. These groups, long responsible for disabling pipelines, hospitals, education software and other critical services, continue to pose a major threat.
Experts expect the situation to worsen this year because powerful new AI systems are increasing attackers' capabilities faster than defenders can secure large swathes of the unprotected internet.
Incident response demand and team strain
Troy Bettencourt, who leads Palo Alto Networks' global digital forensics and incident response practice, told Axios that demand for his team's services has risen by double digits over the past six weeks. Unlike previous spikes tied to major incidents such as SolarWinds, this year's workload is relentless: "It's just a continuous grind that increases," he said.
Across the industry, incident response subcontractors are at capacity. Tasks that once could be handled by a single consultant now require teams of five to 20 people. Palo Alto Networks has been reallocating staff from other projects into incident response and preparing for more attacks exploiting recently disclosed PHP vulnerabilities.
Customer-side impact
Samantha Lewis, head of threat intelligence at Armadin, said her team has been overwhelmed with customer inquiries from organizations trying to determine whether they are affected by AI-discovered flaws in foundational internet code. "This week has been pure chaos," she said. Her team spent days sifting through hundreds of alleged exploits, many of which did not work, to identify the genuine risks.
Jack Nelson, Ivanti's chief information security officer and deputy general counsel, said he got "less sleep than normal this past week," despite the company's limited exposure to the PHP vulnerabilities. "It's been busy, there's no doubt about it," he added.
AI as both problem and partial solution
AI's capacity to surface more software flaws threatens to further overwhelm defenders. In response, security firms are increasingly using AI and automation to discover weaknesses and speed up investigations. Samantha Lewis warned that the number of personnel required to keep up could become "entirely untenable."
At the same time, the shift toward AI tools introduces another stress: employees are exhausted by the caseload and anxious that the very AI systems meant to ease their burden could displace jobs. "They're burning out, and they're hearing everything in the media that AI is going to take everyone's job," Bettencourt said. "It's a tough balance."
Outlook
Cyber defenders cannot sustain the current pace indefinitely, but many are hopeful that AI will provide additional capabilities to help in a campaign some expect to last another 12 to 18 months.
