A new category of threat’: Former ASD boss warns business on AI hack

Human attackers work one target at a time. AI agents work thousands in parallel, which changes what defense has to look like.

By Gammatek ISPL, Last updated: September 2026 | 14 min read

Author block: Gammatek ISPL advises industrial, pharmaceutical and manufacturing organizations on network security, compliance and operational resilience. [Add real credentials, years of experience and number of environments assessed.] This analysis draws on publicly reported research and disclosed incidents. It is not sponsored by any vendor named.

Why This Matters to Your Business This Quarter

If your security plan was written before 2025, it was written for a different kind of attacker. The warning from a former head of Australia's signals intelligence agency, that AI hacking is a new category of threat and not just a faster version of the old one, points to something concrete. Attacks that once needed a skilled human working slowly against one target can now be run by software agents against thousands at once. Your defenses, your insurance assumptions and your recovery plan all assume attackers move at human speed. They no longer do. This article covers what changed, what the evidence shows, and the specific controls, including enterprise backup and recovery and continuous monitoring, that hold up against machine-speed attacks.

I could not locate the original article the headline refers to, so I have not attributed any specific quote or claim to the former ASD official. Before publishing, add the person's name, the exact date and outlet, and one or two accurately quoted lines (under 15 words each, in quotation marks, with a link). Do not paraphrase claims you have not read. Readers and Google both penalize misattributed quotes.

What Actually Changed: From Human Speed to Machine Speed

For two decades, the economics of hacking were limited by human attention. A skilled attacker could only research so many targets, write so many tailored phishing emails, and probe so many networks in a day. That constraint quietly protected most mid-sized businesses. You were not worth an expert's afternoon.

AI removes the constraint. Three publicly documented developments show it.

1. Autonomous attack campaigns have already happened. Anthropic publicly disclosed what it described as the first documented cyberattack largely executed by AI: a Chinese state-sponsored group used AI agents to autonomously hack roughly 30 global targets, with the AI handling an estimated 80 to 90 percent of tactical operations independently (as reported by Axios). The human operators set direction. The software did most of the work.

2. Criminal adoption is accelerating. Threat intelligence firm Flashpoint's 2026 Global Threat Intelligence Report described an "era of total convergence" in cybercrime. It reported a roughly 1,500 percent rise in AI-related illicit discussion between November and December 2025, and said attackers increasingly use agentic AI frameworks for reconnaissance, phishing generation, credential testing and infrastructure rotation (as reported by TechRadar).

3. Frontier capability is moving toward offense. Axios reported in March 2026 that AI and government officials were warning that upcoming frontier models could be highly capable at attacking sophisticated systems at scale, and that employees experimenting with autonomous agents may unknowingly open new side doors into company networks.

Treat these as reported signals, not settled forecasts. But the direction across independent sources is consistent, and it matches what the former ASD chief is reported to be warning about.

[IMAGE: timeline graphic, "From human-speed to machine-speed attacks," three milestones: autonomous campaign disclosed, criminal AI adoption surge, frontier-model warnings] Alt text: "Timeline showing the shift from human-speed hacking to AI-driven autonomous attacks between 2025 and 2026" Caption: "Each milestone removes another human bottleneck from the attacker's workflow."

Old Threat vs. New Threat: A Direct Comparison

Dimension	Traditional attack	AI-driven attack
Speed of reconnaissance	Days to weeks of manual research	Minutes, automated across many targets
Phishing quality	Generic, often poorly worded	Personalized, fluent, can include cloned voice or video
Target selection	Focused on high-value victims	Economical to hit mid-sized and small businesses too
Exploit timing	Days after a vulnerability is published	Reported by Flashpoint as often within hours
Entry method	Break in through a technical flaw	Increasingly "log in" with stolen credentials and tokens
Adaptation	Human rewrites tactics when blocked	Agents retry variations without fatigue
What defenders must assume	Attackers are scarce	Attackers are effectively unlimited in attention

The last row is the important one. Security programs built on the idea that "we're too small to be worth attacking" lose their main assumption.

The Credential Problem Nobody Wants to Fund

The Flashpoint data contains a detail that should change budget conversations. The report estimated 11.1 million devices infected with infostealer malware in 2025, exposing roughly 3.3 billion credentials and cloud tokens, and concluded that attackers now prefer "logging in" to "breaking in."

That matters because most security spending goes to perimeter tools built to stop break-ins: firewalls, network filtering, patching. Those remain necessary. But an attacker holding a valid employee credential and session token walks through the front door. Defending against that requires:

• Multi-factor authentication that resists phishing, such as hardware keys or passkeys, and not only SMS codes.

• Short-lived tokens and conditional access, so a stolen token expires quickly and fails from unfamiliar devices or locations.

• Continuous behavioral monitoring, since a logged-in attacker looks like a user until their behavior diverges.

This is where enterprise network monitoring software earns its place. Signature-based detection catches known malware. It does not catch a valid account doing unusual things at 3 a.m. You want monitoring that baselines normal behavior and flags deviation, including lateral movement between systems, unusual data transfers and new administrator activity.

Where Most Businesses Are Actually Exposed

Preparedness data suggests the gap is wide. In ISACA's research on 2026 threats among European IT and cybersecurity professionals, only 14 percent said their organization felt very prepared to manage the risks of generative AI, while 82 percent said they were only somewhat prepared or worse. Just 7 percent were extremely confident their organization could handle a ransomware attack.

Those two numbers together describe the real exposure. Even businesses that expect to be hit do not feel confident recovering. That is why the second half of this article focuses on resilience: assuming some attack will get through, and designing so that it does not become an existential event.

Defense Layer 1: Assume Breach, Then Make It Survivable

The most reliable protection against AI-accelerated ransomware is not a better lock. It is the ability to recover quickly without paying. That depends on your enterprise backup and recovery design far more than on the brand of software you bought.

Common failure patterns we see when reviewing backup setups:

1. Backups reachable from the production network. If the account that can delete production data can also delete backups, an attacker with those credentials wipes both. Backup administration should use separate credentials, separate MFA and, ideally, separate identity systems.

2. No immutable copy. Immutability means backups cannot be altered or deleted for a set retention window, even by administrators. It is the single most effective control against destructive attacks.

3. Untested restores. A backup you have never restored is a hope, not a control. Many organizations discover corrupted or incomplete backups only during an incident.

4. Recovery time nobody measured. Restoring hundreds of terabytes over a normal connection can take days. Your recovery time objective (RTO) has to reflect real restore speeds, not vendor brochures.

5. SaaS data assumed to be protected. Cloud email and file platforms generally protect their own infrastructure, not your accidental or malicious deletions. Cloud backup for business data held in Microsoft 365 or similar platforms is a separate responsibility in most contracts. Check your provider's shared-responsibility terms.

How to choose enterprise backup software (a practical framework)

When evaluating the best enterprise backup software or any corporate backup software for an AI-era threat model, judge candidates on these criteria before comparing price:

Criterion	What to look for	Why it matters against AI-driven attacks
Immutability	Write-once storage or object lock with enforced retention	Prevents attackers from deleting recovery points
Access separation	Independent admin credentials and MFA from production	Stops credential theft from reaching backups
Anomaly detection	Alerts on unusual deletion or change rates	Early signal of ransomware in progress
Restore performance	Published, tested RTO at your data volume	Determines downtime cost
Coverage	Servers, endpoints, SaaS, databases, OT-adjacent systems	Attackers hit the gap
Restore testing	Automated verification or scheduled test restores	Confirms backups actually work

Analyst evaluations such as Gartner's backup and recovery research can help you shortlist vendors, but they assess vendors in general. They do not assess your environment. Run a proof of concept with your own data and a timed restore before committing.

Defense Layer 2: See Attackers Early

Backup limits the damage. Monitoring shortens the time attackers have to cause it. Machine-speed attackers compress the window between initial access and encryption from weeks to hours in many reported cases, so detection has to be continuous and mostly automated.

What good enterprise network monitoring software provides in this context:

• Baseline behavior modeling for users, devices and services, so anomalies stand out.

• East-west visibility, meaning traffic moving between internal systems and not just traffic crossing the perimeter. Lateral movement is where attackers spend most of their time once inside.

• Automated containment hooks, such as isolating a device or disabling an account when confidence is high, so response does not wait for a human to read an alert at 3 a.m.

• Log retention long enough for investigation, since AI-assisted intrusions can be slow and patient when they need to be.

Pair monitoring with endpoint detection on user devices. Neither replaces the other. For a deeper comparison of vendors at the network and endpoint layers, see our guide on Fortinet vs Palo Alto vs CrowdStrike vs SentinelOne for industrial environments

Defense Layer 3: Manage the Risk You Are Adding Yourself

Here is the uncomfortable part. Some of the AI exposure your business faces is self-inflicted. Employees paste sensitive data into public AI tools. Teams connect autonomous agents to email, file storage and internal systems without review. Developers ship AI-generated code that nobody audited. Security researcher Rachel Tobac told Axios that more organizations will be hacked because part of their site was "vibe coded," meaning quickly generated with AI and insufficiently reviewed.

This is an enterprise risk management problem before it is a technical one. Effective enterprise risk management software helps you keep a register of AI tools in use, the data each can access, the owner responsible, and the controls applied. Without that inventory, you cannot answer basic questions after an incident: what did the agent have access to, and who approved it?

A workable minimum policy for AI agents and assistants:

1. Maintain an inventory of every AI tool and agent connected to company data.

2. Grant least privilege. An agent that summarizes email does not need permission to send email or delete files.

3. Require human approval for irreversible or high-value actions such as payments, permission changes and external sharing.

4. Log agent activity in a place the agent cannot alter.

5. Review third-party AI vendors for data retention, training use and breach notification terms.

   
   

Original Analysis: A 90-Day Plan by Business Size

Most guidance assumes a large security team. This sequencing works for lean teams, ordered by risk reduction per unit of effort.

Days 1-30: Stop the easy wins

• Enforce phishing-resistant MFA on email, remote access and administrator accounts.

• Inventory AI tools and agents in use, officially or not.

• Verify one full restore of your most critical system and record how long it took.

Days 31-60: Contain the blast radius

• Separate backup credentials from production identity and add immutability.

• Segment the network so a compromised office laptop cannot reach critical systems.

• Turn on behavioral monitoring for privileged accounts and file servers.

Days 61-90: Prove it works

• Run a tabletop exercise: "An AI-driven attack encrypts our file servers on Friday evening. What happens?"

• Measure detection time and recovery time against your targets.

• Feed the gaps into your risk register with owners and dates.

The exercise in the final step is the highest-value item on the list. It converts assumptions into measured numbers, which is exactly what boards, insurers and auditors increasingly ask for.

A Note for Industrial and Regulated Operations

If you run manufacturing, chemical or pharmaceutical operations, the stakes differ. IT systems are only part of the picture: operational technology (controllers, SCADA, monitoring systems) often runs on older software that cannot be patched quickly or protected by standard endpoint agents. AI-accelerated reconnaissance makes unsegmented plant networks a more attractive target than before.

The practical answer is network segmentation between IT and OT, restricted remote access with full logging, and backup and recovery plans that cover configurations and controller programs, not just office data. Regulated plants also have to demonstrate these controls to auditors, so documentation matters as much as the technology. We cover the compliance side in our piece on why firewalls alone don't meet plant compliance requirements

What the Warnings Get Right, and What to Watch For

Three honest caveats keep this in perspective.

Not every claim is verified independently. Some vendor announcements about AI hacking capability are marketing as much as research. For example, one security company's CEO told Fortune that his firm's AI tool gained access to sensitive files in a demonstration in under five minutes. That is a vendor claim about a controlled test, not proof of what attackers achieve in the wild. Read vendor numbers with that in mind.

Defenders also gain from AI. The same automation that speeds attacks also improves detection, triage and response. Businesses that adopt AI-assisted security tools carefully may close some of the gap. The risk is in the asymmetry: attackers face fewer constraints than corporate security teams do.

Fundamentals still work. Strong authentication, segmentation, patching discipline, immutable backups and tested recovery blunt most of these attacks, including AI-driven ones, because they limit what any attacker can do once they have a foothold.

The Bottom Line

The reported warning from a former ASD leader lines up with what threat researchers are documenting: AI has changed the economics of attack, and businesses of every size are now realistic targets. You do not need to predict exactly how the technology evolves. You need to reduce dependence on assumptions that no longer hold. Assume credentials will be stolen. Assume some attack will get through. Design so that detection is fast, damage is contained, and recovery is proven. Do that, and the "new category of threat" becomes a manageable risk instead of an existential one.

Next Step

If you want an independent view of how your network security, backup posture and compliance documentation would hold up against AI-accelerated attacks, Gammatek offers assessments built for industrial, pharmaceutical and manufacturing environments. [Request a security and compliance readiness review → https://www.gammateksolutions.com/post/it-s-all-fun-and-games-until-you-give-ai-your-credit-card