TLDR: A new research paper by Benjamin Murphy and Twm Stone argues that advancements in artificial intelligence will significantly shift the cyber offense-defense balance, disproportionately endangering “trailing-edge organizations.” These organizations, characterized by legacy systems and underinvestment in security, have historically avoided major attacks due to human limitations on the attacker side. However, AI will reduce the cost and skill required for cyberattacks, accelerate exploit development, and make attribution harder, exposing these unprepared firms to a surge in sophisticated threats. The paper emphasizes the urgency for these organizations to modernize their defenses and for governments to implement policies that encourage better cybersecurity practices, as AI’s defensive benefits may not be realized quickly enough by those already behind.
A new research paper, authored by Benjamin Murphy and Twm Stone, sheds light on a critical and often overlooked aspect of artificial intelligence’s impact on cybersecurity: the disproportionate risk it poses to what they term ‘trailing-edge organizations’. While much of the conversation around AI and cyber focuses on the evolving offense-defense balance for well-equipped companies, this paper argues that the reality for most businesses is far more precarious.
Defining the ‘Trailing Edge’
Trailing-edge organizations are characterized by their heavy reliance on legacy software, understaffed security teams, and a struggle to implement basic best practices like rapid security patching. These firms often operate under the assumption that they are not attractive targets for cybercriminals due to a perceived lack of economic incentive, leading to underinvestment in their defenses. This approach, which may have been marginally sufficient in the past, is unlikely to remain viable as AI capabilities advance.
The Shifting Threat Landscape
The paper identifies two primary ways AI will heighten risks for these organizations. Firstly, AI will drastically alter the economics of cyberattacks, making it cheaper and easier to launch attacks. This means more attackers will target more organizations, more frequently. Secondly, AI will enable attackers to develop and deploy exploits much faster than before. This necessitates that trailing-edge organizations not only catch up to today’s leading defenders but also aim for significantly faster remediation timelines and more resilient software.
Why the Past Won’t Predict the Future
Historically, many trailing-edge organizations have avoided major cyberattacks due to human limitations on the attacker’s side. Cyberattacks traditionally required skilled human operators for various stages, from target identification to crafting social engineering attacks. The total pool of human capital for launching attacks was limited, and the threat of criminal sanctions deterred many. AI, however, threatens to remove these bottlenecks. It can automate many aspects of the cyber kill chain, expand the pool of individuals capable of launching attacks by lowering the skill barrier, and make it harder for law enforcement to attribute attacks, thus reducing perceived consequences for attackers.
Technical Threats Amplified by AI
Beyond economic shifts, AI also introduces significant technical threats. It can rapidly convert vulnerability disclosures (like those in the Common Vulnerabilities and Exposures system) into working exploits, dramatically shortening the window for organizations to patch their systems. AI can also identify clusters of similar vulnerabilities within a codebase once one is found, making attacks more resilient to single patches. Furthermore, AI will accelerate target identification by analyzing vast amounts of public data and network scans, leaving vulnerable systems less time to remain undiscovered.
The Limited Defensive Uplift for Some
While AI offers substantial defensive benefits, such as faster patch development, improved code review, better asset inventory, and advanced intrusion detection, the paper argues that trailing-edge organizations will struggle to realize these. Large-scale IT projects are expensive and slow, and integrating new AI-driven defensive capabilities into unique, often legacy, technical environments is complex and costly. These organizations, already struggling with basic security, may not have the capacity or willingness to make the necessary investments.
The Urgency of Action
The authors stress that complacency is no longer an option. A sharp increase in attacks could lead to a severe shortage of cybersecurity talent, making it difficult for organizations to respond even after an attack. Modernizing security postures takes years, meaning that delaying investment now will lead to prolonged vulnerability. Moreover, successful attacks generate significant negative externalities, harming consumers and society, which could trigger regulatory action. For a deeper dive into this critical issue, you can read the full research paper here.
Also Read:
- AI-Powered Disinformation Surges as U.S. Resources to Combat It Dwindle
- The Imperative of Secure Browsers in the Era of AI Agents: A New Cybersecurity Frontier
Recommendations for the Path Forward
The paper offers practical recommendations for both organizations and governments. Trailing-edge organizations should: assign clear organizational authority for cyber defense, incorporate vendors’ cyber track records into procurement, measure and optimize patch deployment timelines, integrate AI-assisted code review tools, and create a comprehensive catalogue of digital assets. Governments, on the other hand, should consider establishing a private right of action for data breaches, subsidizing security services for businesses lacking in-house expertise, and investing in the development of new defensive technologies that can benefit all organizations.
In conclusion, the paper highlights that the discussion around AI’s impact on cybersecurity must move beyond the offense-defense balance for leading-edge firms and address the glaring deficiencies in security practices prevalent among most organizations. Immediate action is crucial to prevent widespread harm across society.
