Key points
- AI removes traditional constraints on attacker time, resources, and specialized expertise.
- Security teams must shift from periodic assessments to continuous exposure management.
- Proving which vulnerabilities are exploitable matters more than simply listing them.
The short version
- Horizon3.ai released research stating that artificial intelligence has fundamentally altered the economics of cyberattacks.
- The report argues that modern security requires continuous exposure management built around evidence and verified outcomes.
- Traditional defenses were designed for human-speed attackers, but AI enables machine-speed operations.
The details
Horizon3.ai published first-hand research titled "AI Changed the Economics of Cyberattacks," which argues that artificial intelligence has transformed the speed, scale, and financial dynamics of cyber threats. According to the report, cybersecurity programs historically operated under the assumption that attackers possessed limited time, resources, and specialized skills. Reconnaissance previously took days, while vulnerability research required weeks of effort. Building complex attack paths demanded skilled operators who could manually piece together weaknesses.
The publication states that artificial intelligence is removing those historical constraints. Machine learning tools allow adversaries to analyze environments, identify exploitable weaknesses, and discover attack paths with significantly reduced time and effort. This shift means that the complexity of modern infrastructure—spanning cloud services, software-as-a-service platforms, APIs, identities, third-party vendors, and AI infrastructure—matters differently when attackers can process those relationships at machine speed.
The context
The report emphasizes that visibility alone no longer answers the critical question of whether attackers can compromise an environment today. Security teams currently possess vast amounts of data, including asset inventories, vulnerability metrics, threat intelligence, alerts, and telemetry dashboards. However, Horizon3.ai argues that knowing vulnerabilities exist is distinct from proving which ones attackers can actually exploit.
To address this gap, the research advocates for Continuous Threat Exposure Management (CTEM) as an operating model. This approach turns exposure management into a continuous discipline for discovering, validating, prioritizing, and reducing exposures as environments change. The core requirement is evidence: teams must determine which exposures are exploitable, which attack paths create meaningful risk, and whether security controls effectively stop real attacks.
What to watch
Organizations should monitor how their defenses perform against machine-speed threats rather than relying solely on recovery metrics. The report notes that resilience can no longer be measured only by how effectively an organization recovers after an attack. Instead, entities must demonstrate that their defenses can withstand the attacks that matter most. This involves continuously measuring outcomes, adapting defenses, verifying results, and reducing exploitable risk. The future of cybersecurity will be defined by who can prove the most, not who sees the most.
What to do and how to stay safe: Horizon3.ai
- Validate which identified vulnerabilities are actually exploitable in your specific environment rather than treating all findings as equal risks.
- Implement continuous monitoring for attack paths across cloud, SaaS, and API surfaces to detect changes in real time.
- Verify that security controls effectively block simulated attacks to ensure defenses work as intended against machine-speed threats.
- Measure remediation efforts by confirming that specific actions reduced meaningful risk, not just by closing ticket counts.
Step-by-step guide: Shadow AI Mistakes That Put Corporate Data at Risk
General security guidance from the TechSec Headlines newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
How has AI changed the economics of cyberattacks according to Horizon3.ai?
AI has reduced the time, effort, and specialized expertise required for attackers to understand environments and exploit weaknesses at scale.
What is Continuous Threat Exposure Management (CTEM)?
CTEM is an operating model that turns exposure management into a continuous discipline for discovering, validating, and reducing exposures.
Why is visibility alone insufficient for modern security?
Visibility does not prove which vulnerabilities attackers can actually exploit or whether security controls effectively stop real attacks.
