The widening gap between attackers and defenders

AI asymmetry in cyber exploitation refers to the widening gap between attackers and defenders created when AI collapses the cost, skill, and time required to run sophisticated attacks, while defensive capacity remains bound by human speed and manual processes. In practical terms, a single adversary equipped with frontier AI can now discover vulnerabilities, chain exploits, and deliver payloads at a scale and velocity that no human-led security team can match request-for-request. The asymmetry is not that attacks are smarter; it is that offense now scales like software while defense still scales like labor.

Industrialization of cyber exploits

Over the past year, frontier AI models capable of autonomous vulnerability discovery, exploit chaining, and weaponisation have moved from theoretical concern to documented reality. According to the latest Digital Threat Report 2025-26, released collaboratively by SISA, CERT-In, and CSIRT-Fin, the most consequential change is not merely that attacks are more sophisticated; it is that they are becoming systematic, resulting in knock-on effects.

• One, AI moves adversaries from manual, specialist operations to repeatable, automated attack pipelines, meaning vulnerability discovery, exploit chaining, and payload delivery are industrialized more like software manufacturing than traditional tradecraft.

• Two, through autonomous reconnaissance, AI agents can map perimeter vulnerabilities and cloud misconfigurations without human fatigue or manual intervention.

The sheer scale and execution of this threat were demonstrated directly by the GTG-1002 campaign, where an AI agent scaled its operations by firing thousands of requests per second across roughly 30 organizations and executed roughly 80–90% of the attack chainⁱ. These machine-speed, AI-orchestrated campaigns fundamentally break traditional detection windows, creating an unprecedented machine-speed impact.

The Two Defining Shifts Driving AI Asymmetry

As outlined in the Digital Threat Report 2025-26, two key structural shifts define this new threat reality:

• Shift 1: Capability Proliferation: This shift is already underway rather than approaching. AI has shifted attacker economics: automation makes targeted campaigns cheaper to run, which increases the likelihood any given organization is probed. Ransomware groups and financially motivated actors that once depended on purchasing exploits from broker ecosystems can increasingly generate them independently, at marginal cost, against bespoke targets.

• Shift 2: Expanding Attack Reach: Frontier models have demonstrated autonomous vulnerability discovery across operating systems, browsers, and critical operational environments. Directly relevant to digital asset operations, frontier models produced working attacks against 207 of 405 historical smart contract exploits, totalling $550 million in simulated stolen fundsⁱⁱ.

What Must BFSI Institutions Do Now?

To maintain operational resilience against machine-speed exploitation, institutions must move on three immediate priorities over the next 12 months, each reinforced by proactive testing and evidence-based response frameworks.

1. Enforce immediate asset visibility and pipeline hygiene. Maintain a continuously updated inventory covering legacy systems, unmanaged endpoints, and unprotected remote access. Because AI-driven reconnaissance maps exposed assets faster than humans can, a running compromise assessment becomes essential here: hunting for dormant, memory-resident payloads that evade traditional compliance checks and bridging the visibility gap between what you think is exposed and what actually is.

2. Shift detection beyond signatures. AI-generated exploits frequently lack prior patterns in threat intelligence feeds, so institutions must test whether their managed detection can identify completely novel anomalous behavior. This is where Breach and Attack Simulation (BAS) earns its place: automated attack simulation actively mimics the behavior of AI-driven exploits, verifying whether payment systems, APIs, and authorization boundaries can withstand concurrent logic abuse and replacing static checks that fail against AI asymmetry with continuous validation under adversarial stress.

3. Operationalize Zero Trust as an operating model. Trust must be continuously verified for every user, device, and identity - recognizing that AI agents are now privileged identities requiring continuous behavioral monitoring.

Conclusion

AI asymmetry is not a future risk to plan for; it is a present condition to operate under. The economics of attack have already flipped, and any institution still relying on signature-based detection and periodic checks is defending against yesterday's threat model at yesterday's speed. Closing the gap means changing the terms of engagement: continuous asset visibility, behavior-based detection, always-on Zero Trust, and proactive validation through BAS and compromise assessment. For BFSI institutions, where a single breach carries systemic and regulatory weight, treating machine-speed resilience as an operating discipline rather than a compliance milestone is now the difference between containing an incident and being defined by one.

For a detailed analysis on the cyber shifts reshaping BFSI and the emerging threat landscape, download the Digital Threat Report 2025-26.

‍