| AI in cybersecurity describes both sides of the same technology: attackers using it to run faster, cheaper and more convincing campaigns, and defenders using it to spot trouble sooner. New Zealand’s National Cyber Security Centre calls this a dual-use challenge, and its advice is that the fundamentals still decide whether an attack lands. |
Every AI in cybersecurity article published this year says the same two things: the attacks are faster now, and you need something new to stop them. The first half is true and well evidenced. The second half is where most of the advice goes wrong, and it is an expensive place to go wrong.
New Zealand’s National Cyber Security Centre takes the opposite view of the second half, and states it plainly in its whole-of-government advice on frontier AI. Organisations do not need the most advanced models to stay protected. Readiness comes from applying the mitigations that already exist, consistently. That is a far less interesting sentence than the one the market prefers.
That ought to change how a business of thirty or three hundred people reads the AI in cybersecurity news. AI has not invented a new way into your network. It has made the existing ways cheaper to run at volume and shortened the time you have to notice one being tried.
The NCSC calls the result a vulnerability storm. Frontier AI raises the risk from known vulnerabilities, legacy systems and weak cyber hygiene, and it speeds up what happens when one of them is found. Every weakness in that list is one you already had before anyone mentioned AI in cybersecurity.
There is a version of AI in cybersecurity written for people who buy security platforms, and a version written for people who run businesses, and the two lead to different spending. This is the second one, and it is the cheaper one to act on.
What follows is what has really changed in AI in cybersecurity, what has not, and what an owner should do about it this quarter, most of which costs less than expected.
How Has AI Changed Cyber Attacks?
It has removed the human bottleneck, and that is most of the honest headline for AI in cybersecurity. The routes into a business network are the ones that were already there. Reconnaissance that took an analyst days now runs in hours, phishing that needed a fluent writer is generated at volume, and malware that took a team weeks can be produced at runtime. The skill floor dropped and the volume ceiling rose at the same time. Between them those two shifts are what AI in cybersecurity has done to the attacking side.
You can see the shape of it in the numbers. IBM’s 2026 X-Force Threat Index recorded a 49 per cent rise in active ransomware groups through 2025, 109 distinct extortion groups against 73 the year before. The growth came from small, transient operators reusing leaked tooling and established playbooks.
That matters more to a smaller business than the headline suggests. Attacks that were never worth a skilled operator’s time are worth an automated one’s, so being small offers less cover than it once did. That shift was gradual and nobody announced it.
The second change is speed. AI shortens the gap between a vulnerability being published and the first attempts to exploit it, so a patching cycle measured in weeks becomes real exposure. A quarterly cycle on anything facing the internet is now difficult to justify in writing.
None of this is a new door into your network. It is the same doors, tried more often and more quickly, by more people. The one genuinely new exposure sits elsewhere, in the AI tools your own business has started using, and that is covered further down.
It also explains why the advice below looks unfashionable. The eight ways attackers get in are the ones our guide to cyber attacks already covered, and AI has reordered how often each is attempted without adding a ninth.
What AI Attack Methods Are Actually in Use?
Six methods matter, and every one is a version of something you already defend against. This is the practical shape of AI in cybersecurity, not the conference version. The table below sets out what is genuinely operational, how it works, and what it changes for a New Zealand business.
| AI attack method | What it actually does | What it changes for you |
|---|---|---|
| AI-written phishing | Generates personalised, fluent messages at volume using public information | Spotting bad grammar stops working. Phishing-resistant login does not |
| Voice cloning | Clones a voice from a few seconds of audio for fraudulent phone requests | Finance approvals by voice alone need a second channel |
| Deepfake video | Impersonates people on live video calls to authorise payments | A familiar face on a call is no longer confirmation of who is on it |
| Runtime-generated malware | Writes new code each time it runs so no signature repeats | Signature-based antivirus stops being sufficient on its own |
| Agentic attack tooling | Runs most of an intrusion autonomously with people at checkpoints | More organisations become worth attacking, including yours |
| Automated scanning | Probes for known weaknesses at machine speed | A slow patch cycle is now the exposure, not the paperwork |
Read down the last column and a pattern appears.
Not one of these methods defeats multi-factor authentication, an offline backup or a patched internet-facing system. Each defeats the absence of those things, faster than before, and the size of that gap is the entire difference AI in cybersecurity has made.
The phishing row is the one with hard evidence behind it. In a 2024 study of 101 participants, fully automated AI spear phishing achieved a 54 per cent click-through rate. Emails written by human experts scored the same 54 per cent, against 12 per cent for a control group of ordinary phishing.
The finding is not that AI beat the experts. It matched them without needing them, and that turns a craft problem into a volume problem. Our guide to phishing scams covers what stops the result at the login rather than at the inbox, and passkeys are the strongest version of that, because they will not release a credential to a site that only looks right.
Credential theft is the quieter half of AI in cybersecurity and gets a fraction of the coverage. IBM found more than 300,000 ChatGPT credential sets advertised on dark web markets during 2025. The AI tools your staff signed up for are accounts like any other, and they often sit outside whatever process covers the rest of your logins.
What Is an Agentic AI Attack?
An attack where the AI does most of the work and a person only approves the big steps. Agentic tooling is the one development in AI in cybersecurity that earns the attention it gets, because it changes the economics of an intrusion without changing its method.
The clearest documented case is GTG-1002, reported by Anthropic in November 2025. A state-linked group used Anthropic’s own models to run an espionage campaign in which AI agents carried out an estimated 80 to 90 per cent of the tactical work, with human operators at checkpoints authorising the move from reconnaissance into exploitation and approving the final extraction. Around thirty organisations were targeted before the accounts were shut down. Anthropic also reported that the AI made mistakes, inventing credentials and overstating what it had found, so the operators still had to check its work. That limitation is part of the picture and is usually left out of the retelling.
Strip out the espionage framing and the lesson for a smaller business is about cost. Work that needed a team of skilled people can be run by a few with tooling. When the cost of an intrusion falls, the number of organisations worth intruding on rises, and that arithmetic reaches a long way down the size range.
Governments have moved on this faster than the market has. In May 2026 the NCSC published joint guidance on agentic AI with its counterparts in Australia, the United States, Canada and the United Kingdom, covering both the risk of agentic systems being attacked and the risk of what they do once deployed.
That second risk is the one businesses underrate. An agent connected to your mailbox, your file store and your finance system is an account with wide permissions and no judgement. Somebody should have reviewed those permissions before it was switched on, and in most businesses no one did.
Can Antivirus Still Stop AI-Generated Malware?
Not reliably, because signature matching depends on having seen the thing before, and this is where AI in cybersecurity broke an assumption that held for thirty years. Malware that writes fresh code each time it runs produces a signature that has never existed, so there is nothing in the database to match it against.
This is documented, though the confirmed samples are fewer than the coverage suggests. Google’s threat intelligence group has reported PromptSteal, the same family CERT-UA tracks under the name LameHug, used in operations against Ukrainian targets. PromptLock, which drew wide attention as the first AI-powered ransomware, turned out to be a research prototype built at New York University rather than anything found in the wild. The technique is real and in use. The sample count is small and worth keeping in proportion, which is more than most AI in cybersecurity reporting manages.
The answer is behaviour, not signatures. A tool that watches what a program does will notice a process encrypting files at speed, or reading a credential store it has never touched before, and it catches the thing regardless of what the code looks like, and this is the one place in AI in cybersecurity where the tooling had to change at all.
That is a real change in tooling, and it is worth being precise about how big it is. It replaces one control in a layered defence. It does not replace the layers, and a business with behaviour-based endpoint protection and no offline backup is still one bad morning from a very expensive fortnight. Our guide to ransomware protection sets out the order those controls belong in.
Do You Need AI Defences to Stop AI Attacks?
No, and the NCSC says so directly. Its advice on cyber readiness in the frontier AI era states that entities do not need access to the most advanced AI models to stay protected, and that effective readiness comes from consistently applying the mitigations and practices that already exist.
That is worth sitting with. It contradicts most of what is written about AI in cybersecurity, including a good deal written by people who sell security products.
The reasoning has nothing to do with AI attacks being overstated. They exploit the same weaknesses as everything else. An unpatched server facing the internet, a VPN without a second factor, an administrator account used for daily work, a backup nobody has restored from. AI finds those faster and it finds nothing else. Most coverage of AI in cybersecurity leaves that second half out.
So the honest version of the AI in cybersecurity argument for a smaller business is a dull one. The controls have not changed at all. What has changed is how much room you have to do them late, and there is now very little.
There is a commercial reading of this too, and it cuts against our own industry. A provider who answers a question about AI threats with a quote for a new platform, before telling you your multi-factor coverage or your patch compliance, has answered a different question from the one you asked, so ask for those two figures before anything else.
None of this means the AI in cybersecurity threat is exaggerated. The response to it is simply already written down, in guidance that predates the current wave, and most businesses have not finished working through it.
What Should a New Zealand Business Do First?
Five things, in order, and not one of them is an AI product. Everything AI in cybersecurity has changed is answered by doing these faster. Confirm multi-factor authentication covers every service reachable from the internet, patch internet-facing systems on a cycle short enough to matter and treat anything under active exploitation as this week’s work, hold one backup copy nobody can delete, separate administrator credentials from daily work, and make sure someone by name receives the alerts.
Then add the one item AI has newly put on the list. Write down which AI tools your staff actually use, who has access to each, and whether those accounts carry a second factor. Most businesses cannot answer that today. The accounts are usually personal sign-ups made in a hurry, and nobody in IT knows they exist.
The order matters more than the completeness. A firm with multi-factor authentication, current patching and an untouchable backup is in better shape than one running an expensive detection platform on top of none of them, and that comparison is not hypothetical, because we are called into both kinds.
Speed is where AI in cybersecurity changes the arithmetic. A patch window that used to be a fortnight is now a fortnight of exposure, and the same is true of the days between an alert being raised and somebody reading it. The controls are the old ones and the clock is faster, so the work is to shorten every gap in the list above.
If you want a view of where you actually stand against all of this, our cyber security team assesses exactly that. It is a shorter conversation than most owners expect, and the findings are usually specific and seldom alarming.
Where Does AI Actually Help on Defence?
In detection and triage, where the volume defeats people and the difficulty does not. This is the defensive half of AI in cybersecurity. It is real, and narrower than advertised. Tools that learn what normal looks like on your network flag the unusual login or the strange file access sooner than someone reading logs, and they do it at three in the morning.
Email filtering is the second place it does useful work. Filters trained on the phishing of two years ago struggle with messages that are well written and specific to the reader. Analysing sender behaviour and context catches more of those than pattern matching manages, and this is the second honest use of AI in cybersecurity on the defending side.
Both are useful and both are worth money once the fundamentals are finished.
The NCSC set out its own view of AI in cybersecurity on the defending side in Opportunities for AI in Cyber Defence, published in August 2026. It works through govern, identify, protect, detect, respond and recover, and finds something worth having in each. The conclusion is the part to carry away. Human oversight, governance and secure by design practices remain essential, and strong cyber security fundamentals remain most important.
Buying either while the fundamentals are unfinished is the specific mistake AI in cybersecurity coverage encourages, and it is an easy one to make when that coverage is this loud and this constant.
There is also a defensive question most businesses have not asked, and it is what AI you are already running. Copilot, an agent wired into a mailbox or a chatbot on the website all hold permissions, and each of them widens what an attacker reaches if the account behind it is taken. Our post on AI adoption covers deciding where AI belongs before it arrives by accident.
Treat the defensive side of AI in cybersecurity the way you would treat any other tool. It belongs once the basics are in, and buying it earlier tends to defer the work that would have made the larger difference.
What New Risks Do AI Tools Introduce?
Two that did not exist before, and both arrive through your own AI tools rather than through an attacker’s. This is the part of AI in cybersecurity that is genuinely new, and it is the part least likely to come up in a vendor briefing.
The first is prompt injection. An assistant that reads email, documents or web pages treats what it reads as information, and it cannot reliably separate content from an instruction hidden inside that content. A message written to be read by the assistant rather than by the person can persuade it to reveal what it has access to or to act on the sender’s behalf. There is no patch for this in the ordinary sense, which is why the guidance is about limiting what an assistant can reach. It is the one AI in cybersecurity risk with no real equivalent before these tools arrived.
The second is permissions. An agent wired into your mailbox, your file store and your finance system holds the combined access of all three and none of the judgement a person would apply. If the account behind it is taken, the attacker inherits that reach in a single step. Most businesses connected these tools without anyone writing down what they could touch, and this is the half of AI in cybersecurity that your own decisions control.
Neither risk needs a security product. Both need decisions, and the table below sets out the six that matter.
| Area | Practical action |
|---|---|
| AI accounts | List which tools staff actually use, move them onto business accounts and put a second factor on each |
| Agent permissions | Write down what each connected agent can read and change, then remove anything it does not need |
| Untrusted content | Assume anything an assistant reads may carry instructions, and keep it away from actions it can take unsupervised |
| Data going in | Name what must never be pasted into a public tool, and say where the approved alternative sits |
| Work coming out | Require a person to check AI-drafted work before it leaves the business or moves money |
| Suppliers | Ask which AI your providers have added, and what it can reach inside your systems |
These six decisions are the AI in cybersecurity work nobody can do for you. Deciding where AI belongs before it arrives is also a shorter exercise than retrofitting the answer afterwards. Our page on AI solutions covers how we work through that with clients.
How Exposed Is Your Business to This?
Most owners have never had the question answered, and the answer on AI in cybersecurity is usually less alarming and more specific than the headlines suggest. Exodesk has operated since 1989, with offices in Christchurch and Dunedin serving businesses across New Zealand.
We check the five controls, tell you which are switched on and not merely purchased, and find the AI accounts nobody registered. Then we fix what turns up, in the order that matters. Our AI in cybersecurity offer is no larger than that, and we would sooner be honest about its size than dress it up.
What we usually find is unremarkable. Multi-factor authentication on email but not on the VPN, a patch cycle nobody can state out loud, and three staff signed into an AI tool with their personal addresses, none of which will ever make the news.
Very little of it needs a new platform to fix. Most of it needs somebody to look, and to keep looking on a schedule that somebody signs.
Frequently Asked Questions
What is AI in cybersecurity?
AI in cybersecurity covers both sides of one technology. Attackers use it to write phishing, clone voices, generate malware at runtime and automate parts of an intrusion. Defenders use it to spot unusual behaviour and filter email. The NCSC in New Zealand treats it as a dual-use problem and holds that the existing fundamentals remain the most effective defence.
Has AI created new types of cyber attack?
Mostly no. It has made the existing ones cheaper, faster and available to less skilled operators, and the routes in are still a stolen credential, an unpatched internet-facing system or a person persuaded to act. The one genuinely new category is aimed at AI systems themselves, where instructions hidden in content an AI tool reads can make it act against the business running it.
Do small businesses need AI security tools?
Not before the basics are done, and AI in cybersecurity does not change that order. Official New Zealand advice is that readiness comes from applying existing mitigations consistently, and not from buying advanced capability. Behaviour-based endpoint protection and AI-assisted email filtering are both worth the money, and they are worth it after multi-factor authentication, patching and an undeletable backup.
Should a small business worry about agentic AI?
Indirectly, and not because anyone is running a state-grade campaign against a thirty person firm. The concern is that automating most of an intrusion lowers its cost, and cheaper attacks reach further down the size range. The practical response is the same list of controls, not a different one.
Do we need to replace our antivirus?
Probably upgrade, not replace, and it is not the first thing to do. Endpoint protection that judges behaviour instead of matching signatures handles malware written at runtime, and most business security suites already include it. Turn it on and check it is reporting somewhere a person reads.
How much better is AI phishing than ordinary phishing?
Not better. Equal. In a 2024 study of 101 people, messages written entirely by AI and messages written by human experts both persuaded 54 per cent of recipients to click, against 12 per cent for ordinary bulk attempts. AI in cybersecurity terms, that makes it a volume problem and not a quality one.
Are AI tools themselves a security risk?
They are accounts, and in AI in cybersecurity terms they carry the same risks as any other account. Over 300,000 ChatGPT credential sets were advertised on dark web markets during 2025. An AI agent connected to your mailbox or file store also holds real permissions, so the question is who reviewed those permissions before it was switched on.
What is the vulnerability storm the NCSC refers to?
It is the phrase the NCSC uses for what frontier AI does to weaknesses a business already has. Old systems, missing patches and loose habits all become riskier at once, because they are found and used faster than before. The existing items simply come due sooner than they used to.
How fast do we now need to patch?
Faster than most businesses currently manage. Automated scanning finds published vulnerabilities quickly, so the gap between disclosure and exploitation has narrowed. Anything known to be under active exploitation deserves attention within days on an internet-facing system, and a quarterly cycle on anything public-facing is difficult to defend. The right interval for internal systems depends on what each one does and what it would cost you if it stopped.
Should staff be banned from using AI tools?
Banning them tends to move the usage somewhere you cannot see. It works better to name which tools are approved, require a business account with a second factor, and be clear about what must never be pasted into one. That is a shorter policy than most businesses expect.
Does cyber insurance cover an AI-assisted attack?
Cover generally follows the type of loss rather than the tools used, so an AI-written phishing email leading to a fraudulent payment is assessed the same way as any other incident. What matters is whether the controls you described on the proposal form were actually in place.
How does Exodesk approach AI in cybersecurity?
We start with the five controls, confirm which of them are actually on, and find the AI accounts nobody registered. Where AI-assisted detection or email filtering adds something once the fundamentals are done, we say so. We do not recommend a platform as an answer to a gap in multi-factor coverage.
NEXT STEP
Which of the five controls is actually switched on?
Before spending anything on AI security tooling, it is worth knowing your multi-factor coverage, your patch position on internet-facing systems, whether any backup copy is beyond reach, and which AI accounts your staff opened without telling anyone. We can work through all four with you.
Or start with an IT assessment.
