INTEL-12: The Defender's Window

The INTEL  

Red Canary’s position is explicit: “We continue to think that AI benefits defenders more than it benefits adversaries.”

Their analysis of 110,000 threats across 4.5 million protected assets found that AI-powered threats “represent an evolution in tooling, not a revolution in attack techniques.” Existing detection methods remain effective. From a detection standpoint, there are “minimal changes to how threats present themselves” — adversaries continue to use the same techniques, AI simply lowers the barrier of entry.

IBM X-Force’s data supports this — AI “has not changed the fundamentals of cyberattack campaigns.” The transformation is in democratization of advanced capability, not creation of new attack methods.

But IBM also delivers the warning: AI is “a force multiplier actively used by both defenders and adversaries” that has “dramatically increased the speed, scale and efficiency of operations.” The democratization means less sophisticated actors now punch above their weight. And entirely new attack surfaces — prompt injection, training data poisoning, AI supply chain compromise — have no mature defensive playbook.

The defender advantage is real. It is also temporary.

Why It Matters  

The security industry is so focused on AI as a threat that it’s underinvesting in AI as a defense. Every conference panel, every vendor pitch, every board briefing emphasizes what AI enables attackers to do. Meanwhile, the data from both reports says something different: the attacks are still using the same fundamental techniques, and defenders have better data access, larger telemetry volumes, and more to gain from AI-powered automation than attackers do.

This is a window, not a permanent state. IBM’s data shows AI adoption among threat actors accelerating. The organizations that use this window to deploy AI-powered defensive capabilities — identity behavior baselines, configuration compliance at scale, automated response to commodity patterns — will have a structural advantage when the window closes. Those still debating AI risk while underdeploying AI defense will find themselves behind.

What To Do  

Deploy AI-powered defensive capabilities this quarter — not to detect novel AI threats, but to automate defense of fundamentals. The data is clear: AI defending basics stops more attacks than AI hunting advanced threats. Start with the three areas where AI scales best on defense: continuous identity behavior monitoring (detect anomalous access patterns that humans miss at volume), automated configuration compliance (catch drift across thousands of assets before attackers find the gaps), and real-time response to commodity attack patterns (contain the 109-group ransomware swarm faster than manual triage allows). The window is open. Use it.

MITRE ATT&CK  

• T1078 — Valid Accounts: AI-powered behavioral baselines can detect anomalous use of valid credentials at scale — the dominant attack vector across both reports
• T1190 — Exploit Public-Facing Application: Automated configuration monitoring can identify the 56% of no-auth vulnerabilities before attackers scan for them

Learn More  

• Red Canary Threat Detection Report 2026 — Primary source
• IBM X-Force Threat Intelligence Index 2026 — Primary source
• FIR Risk Tuesday E86 — Castles on Quicksand — Full dual-report analysis

Powered by FIR Risk Platform — AI-driven threat intelligence for enterprise risk leaders.