AI Accelerates Cyberattacks Beyond Traditional Patching Speeds

Jonathan Zanger, the chief technology officer at Check Point, issued a warning on Tuesday regarding the growing disparity between the speed of AI-driven cyberattacks and the pace of traditional security responses. Speaking during Tel Aviv University's Cyber Week, Zanger described the global internet as being burdened by a significant amount of outdated software. He argued that artificial intelligence is currently accelerating the exploitation of these aging systems, creating a critical vulnerability for organizations worldwide.

The primary target of these attacks is aging software infrastructure, with PHP-to-shell vulnerabilities identified as a particularly severe threat. Zanger noted that these specific vulnerabilities affect approximately 70% of websites globally. He emphasized the gravity of this issue, stating that the flaw allows for unauthenticated remote code execution. This means attackers can take full control of a system rather than just disrupting a specific service, leading to the maximum potential for damage.

The integration of AI into offensive strategies has fundamentally altered the timeline for vulnerability exploitation. Zanger explained that the median time between a vulnerability being publicly disclosed and its active exploitation by hackers has shrunk dramatically. Just a few years ago, this window was typically three to four months. Today, however, that period has been reduced to mere days. He cited a recent incident involving Amazon Web Services, where attackers began exploiting a vulnerability before an official security patch was even released by the vendor.

Because human teams cannot manually respond at the speed of automated systems, traditional patching cycles are no longer sufficient. Zanger stated that organizations cannot outpace machines with manual updates. Consequently, the strategic focus must shift from detection and response to prevention. He argued that companies need to prioritize stopping attacks before they occur, as the speed of modern threats leaves little room for reactive measures.

The role of AI in cybercrime has evolved significantly in recent years. In 2024, the technology was primarily used as an assistant to help craft phishing emails. By 2025, Zanger observed that AI software had adopted protocols such as the Model Context Protocol, enabling it to operate autonomously across the internet. This shift means AI is no longer just a tool but an active operator capable of carrying out complex attack sequences independently.

Zanger highlighted the case of Vapor Panda, a Chinese state-sponsored threat actor, as an example of this new trend. This group targeted more than 200 organizations across 14 countries using open-source infrastructure known as RTX. He noted that attackers are building increasingly sophisticated infrastructure to conduct large-scale campaigns, with AI serving as the central driver behind these operations rather than a mere support tool.

Despite the rise of autonomous technology, human behavior remains a critical weakness in corporate security. Zanger explained that while organizations implement defense in depth strategies to secure their networks, attackers continue to target the weakest link. This often involves sophisticated social engineering campaigns designed to manipulate employees into bypassing technical safeguards.

The scale of these human-targeted attacks is growing rapidly. Zanger pointed to a 500% surge in the use of ClickFix, a technique where attackers impersonate IT administrators to trick employees into performing actions that compromise system integrity. Major corporate breaches are also increasingly relying on these coordinated social tactics rather than purely technical brute-force methods.

He referenced the massive Binance hack as a case study in this evolving landscape. The attack did not begin with a technical breach of the company's systems. Instead, attackers conducted fake job interviews to trick employees into downloading malware. Once inside, the attackers used AI to move laterally through the network, gaining access to additional systems after the initial entry point was secured.

Zanger concluded that as these tactics become more prevalent, companies must adapt their defense strategies. He advised organizations to combine traditional cybersecurity defenses with intensive security awareness training. This dual approach is necessary to prepare employees for emerging threats and to address the human element that software patches alone cannot fix.