Despite advances in agentic AI, the technology so far remains a distant second to human operators when it comes to malicious cyber activity.
It’s humans who pick the targets and drive the intent of attacks, with AI as an operational component of cyber attacks only occurring in 8 per cent of incidents.
However, according to new research from cyber security firm Rapid7, that won’t be the case forever.
“Board decks often confuse the real explosion in AI-driven vulnerability discovery with actual exploitation, which hasn’t materialised. Only 8 per cent of tracked reporting cites AI as an operational component,” Christiaan Beek (pictured), vice president of Rapid7 Intelligence, said in a statement.
“But that’s a snapshot of adoption, not a ceiling. Agentic capabilities are advancing faster than any organisation, attackers included, can rework its processes around them. The question is when, not if, agentic exploitation scales. Defenders need to move past reactive patching and start grounding their risk appetite in concrete days of exposure.”
The new data comes from Rapid7’s Quarterly Threat Landscape Report, released overnight and based on observations of the company’s own MDR operations.
While the future will almost certainly feature a rise in agentic threats, the present is already pretty dangerous. Modern attackers are now capable of exploiting high-severity vulnerabilities within an average of three days, with 71 per cent of incidents occurring within the first week of disclosure.
‘Holy Grail’ vulnerabilities – those that require no user interaction or authentication to gain remote access into enterprise networks – continued to be a key driver of attacks, making up 79 per cent of exploited flaws.
At the same time, initial access brokers remain a key part of the cyber crime ecosystem. Forty-one out of 63 forum posts monitored by Rapid7 advertised some form of remote desktop or network access.
The ransomware landscape remains largely unchanged in terms of the most impactful groups. US organisations remain the top target with 1,112 leak-site listings, more than eight times the next most attacked country, Germany.
The most active ransomware actors also remained more or less steady for the quarter, with The Gentlemen, Qilin, and INC Ransom leading the pack.
You can read the full report here.
Want to see more stories from trusted news sources?Make Cyber Daily a preferred news source on Google.
