Shortly after Artificial Intelligence took over our news feeds, questions arose about how it would affect the speed and skill of attacks. The second question was if defenders could use it to get ahead. Unfortunately, as the story played out, it gave Red Teams (and therefore adversaries) an advantage they didn’t need. Still, it would no doubt be exploited to the fullest. As it currently stands, Red Teams have a 2:1 advantage in this overall situation. Thankfully, the story hasn’t fully played out, and there is still time to change the outcome.

Red team advantage 1

I’ve worked in technology for nearly 20 years, and I’ve seen many technologies deployed rapidly to keep organizations competitive. However, I’ve never seen a technology deployed so ballistically and carelessly as AI. It’s like everything we learned about security was immediately forgotten when a shiny new toy appeared. To double down, everyone proceeded to give poorly configured AI access to tools (code execution), remote control, and critical data. Red Teams no longer need to crack the perimeter when one misconfigured AI server gives up everything needed.

Red Team advantage 2

Red Teams also benefit from AI’s speed and scale when actively operating, developing capabilities, and scaling initial foothold discovery. Frontier models have many safeguards in place to slow their use for this purpose (though approved access loosens these restrictions). Still, honestly, they don’t do much. At best, it creates a minor inconvenience; at worst, we have to write or modify code by hand, which wasn’t an issue before AI. Even though AI can’t Red Team as it stands, it’s been a huge help as an assistant for Red Team operations or during capability development.

Blue Team advantage 1

For defenders digging into large data sets to discover threats, AI is infinitely useful. It provides scale, speed, and analysis never previously possible. But Red Teams and Adversaries are also generating events at that scale when using AI. Defenders have a huge opportunity at this stage in the AI timeline. If used properly, these advantages could level the playing field in future rounds of this match. However, defenders can only gain these advantages if they aren’t fighting the security regression caused by poorly secured AI technologies.

Closing thoughts

The situation is evolving rapidly, and Red Teams (and therefore Adversaries) have the advantage. If defenders lean into this once-in-a-lifetime opportunity, they could create significant friction and frustration for Red Teams. Sadly, Red Team Advantage 1, where people are punching holes in the attack surface with poorly configured AI technologies, isn’t helping. I’m seeing strong innovation in this space for defenders, and I’m confident they will not leave any advantage on the table. I’m even more confident that Red Teamers won’t either.