The Threat Landscape When Attackers Use AI

All courses / AI Red Team / Module 1 / Chapter 2

Learning objectives

After the lesson the participant can:

Classify ATT&CK tactics into the chapter's three bands of evidence for AI acceleration.
Explain why a mean time to exploit below zero moves the weight to controls that work before a patch is installed.
Label threat claims as observable, expected or speculation and state how each label may be used.
Draft a threat profile entry with technique mapping, vantage points, requirements per Function and coverage links.

Key concepts

Three bands of evidence: Figure 2.1 shades ATT&CK tactics by the strength of the evidence that AI accelerates them: strong evidence of acceleration, reported in AI-orchestrated campaigns, and tooling seen with limited evidence. The bands describe evidence, not importance.
Exploitation window: The time between disclosure of a vulnerability and its exploitation. Mandiant measured an average of 63 days in 2018 to 2019 and 5 days in 2023, and M-Trends 2026 estimated the mean time to exploit at minus seven days, so exploitation now routinely precedes the patch.
Observable, expected, speculation: Observable: a named vendor, agency or incident responder reported the behaviour from activity it saw, which justifies controls now. Expected: assessed as likely or demonstrated in research, which justifies preparation. Speculation: a plausible extrapolation that belongs on the horizon register with an owner and a review date.
Vantage point of a source: Every report is partial. Providers see misuse of their own services and show the leading edge, which sets the direction of the threat; agencies' syntheses show the typical case, which sets the volume the defence must absorb today.
AI-aware threat profile: A short, versioned profile of the AI-enabled threats relevant to the organisation, each entry written by ATT&CK or ATLAS technique, labelled by evidence, translated into testable requirements per Function and linked to its risk-register entry, detections and emulation scenarios.

Interactive exercises

Do them here and get feedback at once. Choose a card and then where it belongs, or drag it.

Interactive exercise 1 · Sort

Observable, expected or speculation

Sort each claim under the evidence label that Chapter 2 gives it in its table of claims.

Interactive exercise 2 · Put in order

Building an AI-aware threat profile

Put the steps of the chapter's practical guide for an AI-aware threat profile in order.

Teaching plan

15 min	The teacher traces the reporting from AI as a productivity aid to agentic offensive frameworks, and what the reports can and cannot see.
15 min	Participants sort a list of tactics into the three bands and discuss the Arup case as an attack on an approval process, not a system.
10 min	Review the exploitation-window figures and the consequence for service levels: attack-surface reduction, virtual patching, segmentation, detection of exploitation attempts and redeployment.
25 min	Exercise: groups write and label one threat profile entry following the practical guide and the Hansa Mutual entry HM-TP-004.
10 min	Groups present their label and its basis; the room challenges any entry that starts from the news and not from exposure.

Discussion

The agentic frameworks of 2026 traded stealth for velocity. What does that offer the defender, and under which conditions is the offer lost?
How should a threat profile treat a claim that rests on a single report from the provider whose model was misused?
Humans still choose the targets and decide what to do with access. What does that imply for where defensive effort has most effect?

Written exercise

Exercise · 25 minutes

Write an evidence-labelled threat profile entry

Following the practical guide, write one threat profile entry for Nordvik Region or for your own organisation. Start from exposure: choose an internet-facing service, an approval process, a supplier access path or an AI system. Describe the threat by ATT&CK or ATLAS technique at the level needed to design a control or test, never as procedures. Label it observable, expected or speculation, cite the kind of source and its vantage point, record likelihood and impact, write one testable requirement per CSF Function, and link the entry to a risk-register entry, detections and an emulation scenario. Set the next review date and the triggers.

Deliverable: One threat profile entry in the structure of HM-TP-004: label with history, technique mapping, sources with vantage points, assets in scope, requirements per Function, coverage links and review triggers.

Your work

Self-test

Choose an answer to see whether it is right, or open the answer below each question.

How does the chapter label the claim that fully autonomous intrusion pipelines operate in the wild?
Show the answer
C. Expected, not yet observed
The table of claims lists fully autonomous intrusion pipelines in the wild as expected, not yet observed, on the basis of GTIG in September 2026 and ENISA 2026.
What does the chapter conclude from the Arup case of 2024 for the Protect Function?
Show the answer
A. The control belongs in the process, through out-of-band verification and dual approval
None of Arup's internal systems were compromised; the approval process treated a familiar face and voice as proof of authority. The chapter places the control in the process, not in the person's judgement.
GTIG reported that only 0.23 per cent of disclosed vulnerabilities were exploited. What does the chapter draw from that figure?
Show the answer
D. That the small exploited fraction is the reason prioritisation works at all
The chapter notes that disclosures and exploitation both rose, yet only 0.23 per cent of disclosures were exploited, and states that this small fraction is the reason prioritisation works at all.