AI-Powered Cyberattacks Raise Global Security Concerns as Hackers Exploit Software Vulnerabilities Faster

TEL AVIV, Nov 10: The growing use of artificial intelligence by cybercriminals is creating fresh challenges for organisations worldwide, with security experts warning that automated attacks are exploiting software vulnerabilities faster than traditional defence systems can respond.

Jonathan Zanger, chief technology officer at cybersecurity company Check Point, has warned that outdated software infrastructure and increasingly sophisticated AI-powered attacks are leaving large sections of the internet exposed to potential security breaches.

Speaking during an interview on the sidelines of Tel Aviv University’s Cyber Week on Tuesday, Zanger highlighted the growing gap between the speed at which attackers can identify software weaknesses and the time organisations require to install security updates.

He said the period between the public disclosure of a software vulnerability and its exploitation by cybercriminals has reduced significantly over recent years.

According to his assessment, the median time between vulnerability disclosure and exploitation was previously around three to four months. That window has now fallen to only a few days in many cases.

The changing threat environment has raised concerns among cybersecurity professionals, particularly as AI tools allow attackers to automate activities that previously required substantial technical expertise.
Artificial intelligence changes the nature of cybercrime
Artificial intelligence has become an increasingly important tool in cybersecurity, helping organisations identify suspicious behaviour, examine network traffic and respond to potential threats.

However, the same technology is also being adopted by criminal groups seeking to improve the speed, scale and effectiveness of their operations.

In earlier stages of AI adoption, cybercriminals primarily used the technology to prepare convincing phishing messages, generate malicious code and improve social engineering campaigns.

The situation has become more complicated as AI agents gain the ability to perform multiple tasks with limited human intervention.

These systems can potentially assist attackers in identifying vulnerable internet-facing services, analysing available information and coordinating different stages of an operation.

Zanger said AI was no longer simply helping criminals with individual activities but was increasingly being used as an operational tool capable of managing parts of complex cyber campaigns.

This development has increased pressure on organisations to improve their security systems and reduce the time between identifying a weakness and applying an effective response.

Traditional cybersecurity teams often depend on human analysts to review alerts, investigate suspicious activity and coordinate software updates.

However, automated attackers can operate continuously and examine large numbers of potential targets within a short period.

The difference in operating speed creates a serious challenge for companies relying exclusively on conventional security procedures.
Outdated software creates significant exposure
One of the major concerns highlighted by Zanger is the continued use of outdated software across internet infrastructure.

Many organisations continue to operate applications and systems that were developed years ago but have not received sufficient security updates.

Such infrastructure can become an attractive target for cybercriminals because known vulnerabilities may remain uncorrected for extended periods.

Zanger specifically referred to PHP-to-shell vulnerabilities, warning that weaknesses of this type can allow unauthorised remote execution of commands on affected systems.

He estimated that vulnerabilities involving this category could affect approximately 70 per cent of websites worldwide.

The figure reflects his warning about the scale of exposure and should not be interpreted as meaning that 70 per cent of websites have been confirmed compromised.

Remote command execution vulnerabilities are particularly dangerous because attackers may be able to execute instructions on a targeted server without requiring legitimate authentication.

Depending on the configuration and permissions of the affected system, such access could allow criminals to steal information, install malicious software or interfere with services.

Websites running outdated content management systems, plugins and server components may face additional risks if security updates are not applied regularly.

The problem is not limited to large companies. Small businesses, educational institutions and independent website operators can also become targets because they may lack dedicated cybersecurity teams.
Security patching faces growing pressure
Security patches are among the most widely used methods of protecting computer systems against known vulnerabilities.

Software developers regularly release updates to correct programming errors, improve security controls and address weaknesses identified by researchers.

However, the growing speed of AI-assisted cyberattacks is placing pressure on the traditional patching process.

Organisations must first identify the affected systems, assess the seriousness of the vulnerability, obtain the appropriate update and test it before deployment.

In large enterprises, these activities may involve multiple departments and complex technology environments.

Delays can leave vulnerable systems exposed even after a security update becomes available.

Zanger cited an incident involving Amazon Web Services in which attackers reportedly began exploiting a vulnerability before an official patch was released.

The example illustrates the growing importance of early threat detection and preventive security measures.

He argued that organisations cannot depend entirely on manual patching procedures when automated attackers are capable of operating at machine speed.

The challenge is particularly serious for businesses operating thousands of connected devices, cloud applications and distributed networks.

Even when security teams respond quickly, a single unpatched component could provide an entry point into a wider corporate environment.
Autonomous AI tools increase attack capabilities
The emergence of autonomous AI agents has introduced another dimension to cybersecurity risks.

AI agents are designed to carry out tasks by analysing information, selecting actions and interacting with different software systems.

In legitimate business environments, they can automate customer support, data processing, research and administrative work.

However, similar capabilities can be misused by attackers.

According to Zanger, the adoption of protocols such as the Model Context Protocol has expanded the ability of AI systems to interact with external tools and services.

This can make it easier for automated systems to perform interconnected activities rather than simply generating text or code.

The cybersecurity expert referred to a threat actor identified as Vapor Panda, which he described as a Chinese state-sponsored group.

He said the group had targeted more than 200 organisations across 14 countries using an open-source infrastructure known as RTX.

The example demonstrates the potential scale of coordinated cyber operations involving automation and advanced technical infrastructure.

However, attributing cyberattacks to particular groups remains a complex process and requires careful examination of technical evidence, infrastructure and operational patterns.

For organisations, the broader lesson is that cyber threats can no longer be treated as isolated incidents involving individual hackers.

Criminal networks and state-linked actors may use automated systems to coordinate campaigns across different countries and industries.
Social engineering remains a major security weakness
While AI-assisted technical attacks are receiving increasing attention, human behaviour continues to represent a major weakness in organisational security.

Cybercriminals frequently attempt to manipulate employees into revealing confidential information, opening malicious attachments or downloading harmful software.

These techniques are commonly described as social engineering.

Attackers may impersonate company executives, IT administrators, customers or recruitment agencies to convince individuals that a request is legitimate.

AI tools can make such attempts more convincing by helping criminals prepare realistic messages and personalise their communication.

Zanger highlighted the growing use of a technique known as ClickFix, in which attackers impersonate technical support personnel and persuade victims to carry out actions that compromise their own devices.

He cited a reported increase of 500 per cent in the use of this technique.

Such attacks are particularly difficult to prevent because they exploit trust and familiarity rather than relying exclusively on technical vulnerabilities.

An employee may unknowingly execute a malicious command after receiving instructions that appear to come from a legitimate support team.

The consequences can include unauthorised access, information theft and the installation of malicious software.

The growing sophistication of these campaigns makes employee awareness and internal security procedures increasingly important.
Corporate breaches demonstrate the danger
Cybersecurity incidents involving major businesses have shown how attackers can exploit human weaknesses to gain access to otherwise protected networks.

Zanger referred to the Binance hack, describing how attackers allegedly used fraudulent job interviews to trick employees into downloading malware.

According to his account, the attackers subsequently used AI-assisted techniques to move laterally through the company’s network.

Lateral movement refers to the process by which an attacker who has gained initial access attempts to reach additional systems and obtain broader privileges.

This can allow criminals to expand their access beyond the original compromised device.

The incident illustrates why organisations must monitor internal network activity rather than focusing exclusively on preventing external access.

A company may have sophisticated firewalls and endpoint security systems, but attackers who successfully compromise an employee’s device could still attempt to move through connected systems.

Security teams therefore need to monitor unusual login patterns, suspicious file transfers, unauthorised software installations and unexpected communication between internal devices.
Why businesses need a preventive security strategy
The changing threat environment is encouraging cybersecurity professionals to reconsider traditional approaches to digital protection.

For many years, organisations concentrated heavily on detecting attacks after suspicious activity had already occurred.

Although detection and response remain important, experts increasingly emphasise the need to prevent attackers from gaining access in the first place.

A preventive strategy involves identifying weaknesses before they are exploited and reducing the number of opportunities available to cybercriminals.

Companies can strengthen their defences by regularly updating software, removing unsupported applications and reviewing access permissions.

Multi-factor authentication can provide an additional layer of protection by requiring users to verify their identity through more than one method.

Network segmentation is another important measure. It divides a corporate network into separate sections, limiting the ability of attackers to move freely if one part becomes compromised.

Organisations should also maintain reliable data backups and test recovery procedures to ensure that critical information can be restored following an incident.

AI-based security monitoring can help analyse large volumes of network information and identify suspicious activity more quickly.

However, businesses must ensure that their own automated systems are properly configured and monitored.
India’s critical infrastructure faces similar challenges
The growing use of AI in cybercrime is also relevant for countries such as India, where digital services have become essential to financial transactions, communications and government operations.

Indian telecom networks support more than one billion users and carry enormous volumes of data every day.

Banking platforms, digital payment systems and public-sector services depend on reliable internet connectivity and secure information infrastructure.

The Department of Telecommunications has been holding discussions with major operators, including Reliance Jio, Bharti Airtel, Vodafone Idea and BSNL, to strengthen protections against AI-driven cyberattacks.

The Indian Computer Emergency Response Team has also issued advisories highlighting the risks associated with autonomous AI agents and their potential misuse in identifying and exploiting vulnerabilities.

These developments demonstrate that cybersecurity is becoming an increasingly important part of national infrastructure planning.

Any major disruption to telecommunications or financial networks could affect businesses, consumers and public services.
Need for stronger employee awareness
Experts have repeatedly stressed that technology alone cannot eliminate cybersecurity risks.

Employees must understand how to identify suspicious communication and avoid carrying out instructions from unverified sources.

Companies should conduct regular security awareness programmes and simulated phishing exercises to prepare workers for evolving threats.

Access to confidential systems should be restricted according to job responsibilities, while sensitive operations should require additional verification.

Organisations should also establish clear procedures for reporting suspicious activity so that security teams can investigate potential incidents without delay.

The growing use of AI-generated messages and realistic impersonation techniques makes it particularly important for employees to verify unusual financial requests and unexpected software instructions.
The future of global cybersecurity
The rapid development of artificial intelligence is creating both opportunities and risks for the global technology industry.

While businesses can use AI to strengthen their security operations, cybercriminals are also benefiting from automation and advanced analytical capabilities.

The reduction in the time available to respond to vulnerabilities is emerging as one of the most significant challenges for organisations.

Companies that continue to depend on outdated infrastructure and slow security procedures may face greater exposure as automated attacks become more sophisticated.

The warnings delivered during Tel Aviv University’s Cyber Week underline the need for a broader approach involving preventive security, continuous monitoring, updated software and employee education.

As AI becomes increasingly integrated into business operations, protecting digital infrastructure will require cooperation between technology providers, governments and private organisations.

The future of cybersecurity will depend not only on developing stronger defensive tools but also on ensuring that businesses can respond at the speed demanded by an increasingly automated threat environment.