Frontier AI Changes the Economics of Cyberattacks

2026 has been quite the year for cybersecurity professionals.

In April, an AI model found thousands of previously unknown high-severity vulnerabilities across every major operating system and web browser. In July, an OpenAI evaluation agent escaped its sandbox, chained misconfigurations across four external services, and ended up inside Hugging Face's production infrastructure. Nobody told it to, it was just chasing a benchmark score. Neither company recognized what was happening for the better part of a week.

Also in July, Moonshot AI published the weights for a 2.8-trillion-parameter model. Anyone can download it. Government evaluators found its safeguards didn't stop it from attempting offensive cyber work.

A lot of very smart people looked at that sequence and are now concluding the risk to humanity itself is somewhere north of zero. That's a real conversation, but one we're certainly not going to settle here.

Here's the more immediate issue: none of this required superintelligence. It required a machine that could read an unfamiliar system's permission model and figure out what to do with it. That capability shipped and it’s cheap. Soon enough, it'll be sitting on a laptop with the safety training filed off.

Which changes something specific about your job.

For decades, both sides triaged

For twenty years, enterprise security ran on an unspoken bargain: both sides triaged.

Attackers have had cheap automated reconnaissance since the nineties. What was scarce was more narrow and more valuable:  the judgment to look at an unfamiliar application's data model, understand its permission structure, and work out what a stolen credential actually unlocks. That took a specialist. Specialists don't scale.

So attackers deprioritized the boring stuff, and defenders spent accordingly. On endpoints. On networks. On cloud infrastructure. The dormant tokens and the departed employee whose app-level access never got revoked all sat in a long tail that nobody (on either side) found worth the trip.

Your risk register scores nodes, but the adversary is now buying paths.

Individually, none of these findings is alarming. That was always true, and your triage process was correct to defer them. A dormant token is a low. A local admin outside the IdP is a low. An over-scoped OAuth grant is a low.

But adversaries no longer need any single item to be severe. It just needs a few of them to connect. A public portal leaking API endpoints, into a dormant token in a repo, into a service account with no IP restriction, into a local admin who can authorize a new integration with org-wide read. Five lows. One catastrophic outcome.

The reason this didn't matter before is that finding those combinations was expensive. Now it isn't. One operator can point many agents at your identities, APIs, and integrations in parallel, adaptively, for pennies. And when one approach fails, try another.

The long tail is now the front line. It just became the cheapest thing in the enterprise to attack, and the easiest to chain.

The long tail is growing while you read this

The third-party application estate was already the enterprise long tail: hundreds of applications, thousands of integrations and non-human identities, years of accumulated grants nobody has revisited.

AI is expanding it faster than any governance process can absorb.

Someone on your team is connecting a note-taker to their calendar right now. Someone else is authorizing a research assistant against Drive. There's no procurement conversation and no security review, because adoption is integration. The user clicks Allow and the application joins the estate in seconds. 

Every consent screen is a standing grant that outlives the enthusiasm that created it. The token doesn't expire when interest fades. It doesn't appear in your IdP. It doesn't disappear when the employee leaves. Scope granted is blast radius inherited. And Context.ai showed exactly how a small vendor's compromise propagates straight into the tenants it was connected to.

The raw material is compounding from two directions at once: attackers got cheaper at exploring it, and your organization got faster at creating it.

It’s about to bury your queue

There is another problem. And if you run a security team you're going to feel it before your CISO does.

The same models that make chaining cheap also make finding cheap. Defensive scanning, AI-assisted pentesting, agentic assessment tools. All of it is about to generate findings at a volume no human triage process was designed for. Overwhelmingly in the low and medium categories. Overwhelmingly in the parts of the estate you already can't get to.

What good is more findings when prioritization is the bottleneck?

Speed is not the most important axis

The market's answer to all this has been a race: patch faster, triage smarter.

But a frontier-capable adversary doesn't need your zero-day. It needs just one valid token and a path.

The industry's own data has been saying this for a while. Unit 42 found identity weaknesses played a material role in 90% of its 2026 investigations, with 65% of initial access driven by identity-based techniques. CrowdStrike's own 2026 report found 82% of detections involved no malware at all:  valid credentials, trusted identity flows, approved SaaS integrations. 

You can’t outrun a counterparty who has more compute than you and isn't racing you in the first place. 

What changed was economic. The response has to be economic too: lower your cost, raise the attacker's, and cap what a foothold is worth.

The three things that have to be true

If that's the shape of the problem, the requirements fall out of it.

1. Discovery. Lower the cost of defense, by knowing what exists and how it's permissioned. 

Not a quarterly assessment. A live, relationship-aware model of every identity, integration, agent, application, and data path. One that can tell the difference between what was granted and what is actually used, and that traces multi-hop paths instead of listing findings. Point-in-time doesn't work on a surface that's drifting and growing in the dark. 

2. Governance. Raise the cost of attack, by continuously enforcing least privilege and breaking the attack chains that matter.

Seeing the estate doesn't shrink it. The requirement is continuous movement toward least privilege: retire what's dormant, tighten what's overprivileged, and control who can create new exposure in the first place, so the long tail stops regenerating as fast as it gets cleaned up. Prioritized by the paths each item sits on and the sensitivity of the data at the end of them. 

Some good news: chains are fragile. Break one link and every path that runs through it is invalidated. 

3. Enforcement. Cap what a foothold is worth, by detecting a violation and containing it before it matters. 

A vendor advisory is not a detection; by the time it lands, the access might have been live for days. And containment has to be narrow. Revoke too broadly and you stop the business; revoke too little and the access survives. 

And ideally, learnings multiply across organizations. A technique that works in one enterprise should get reused across many, fast. If a detection built in one environment becomes protection in every environment, the defender's cost of learning goes down while the attacker's cost of trying goes up. That's the only mechanism in this market that scales defense the way compute scales offense.

Where this leaves us

Few organizations have been securing the long tail. The third-party applications where the work actually happens and the data actually lives. For twenty years that was a defensible allocation, because the long tail was expensive to attack.

Not anymore.

‍