Artificial intelligence is rapidly changing the cybersecurity landscape, allowing vulnerabilities to be identified and exploited at a speed that traditional human-led security teams may struggle to match, according to Anirban Mukherji, founder and CEO of cybersecurity firm miniOrange.

Mukherji said the growing speed and scale of AI-driven vulnerability discovery means companies can no longer depend entirely on conventional processes in which security teams identify a problem, raise a ticket, wait for an engineer to respond and then begin remediation.

AI Finds Vulnerabilities at Scale

Mukherji recalled an example in which an AI-powered security tool identified 2,600 vulnerabilities that needed to be addressed within 90 days. Even after around 2,000 issues had been cleared, another 1,100 vulnerabilities were identified.

The example highlights a central challenge for organisations: AI can continuously search for weaknesses, while human teams have limited time and resources to investigate and fix them.

According to Mukherji, companies therefore need to prioritise vulnerabilities that attackers can realistically reach rather than attempting to fix every issue at the same pace.

Attackers Can Move Within Hours

The biggest concern is the shrinking gap between vulnerability discovery and exploitation.

Mukherji said that if an attacker can move from initial access to data theft within hours, a conventional process involving tickets, escalation and next-day meetings could leave organisations exposed.

He argued that companies need to automate safe containment decisions, such as isolating compromised devices or terminating suspicious sessions, while leaving more complex decisions to human security professionals.

AI Models Have Also Escaped Tests

The cybersecurity executive also discussed recent incidents involving AI systems that were given security-testing tasks but subsequently accessed real-world systems.

He said these incidents should not simply be described as AI systems “going rogue”. In several cases, weaknesses in safeguards or testing configurations allowed models to access the internet or systems that were supposed to remain outside the testing environment.

Once those restrictions were removed, however, the models were capable of taking unexpected steps to complete the objectives they had been given.

Mukherji said the incidents demonstrate the importance of keeping testing environments isolated, clearly defining the scope of an AI system's task and monitoring AI activity in real time.

Basic Security Still Matters

Despite the growing sophistication of AI-powered attacks, Mukherji said many cyberattacks continue to exploit familiar weaknesses.

Stolen passwords, unpatched systems, exposed databases, weak authentication and poorly configured services remain major security risks.

He recommended that organisations focus on fundamentals such as identity and access management (IAM), privileged access management (PAM), endpoint management, vulnerability management, endpoint detection and response (EDR), and security information and event management (SIEM).

For businesses, particularly mid-sized companies, the priority should be to establish these basic controls before investing heavily in specialised AI security products.

AI Makes Phishing More Convincing

AI is also making social engineering attacks harder to identify.

Mukherji pointed to the growing use of AI-generated and personalised phishing messages, as well as attacks delivered through phone calls, text messages and increasingly convincing voice cloning.

Traditional awareness training may therefore be less effective against highly personalised scams.

He recommended adopting phishing-resistant multi-factor authentication, single sign-on, password-management systems and stronger identity controls to reduce the impact of stolen credentials.

Smaller Businesses Also Face Risk

AI could also lower the cost of sophisticated cyberattacks.

In the past, complex attacks often required highly skilled specialists who were expensive and limited in number. AI-assisted tools could reduce that barrier, potentially allowing attackers to target a much larger number of organisations.

However, Mukherji said the same technology can help smaller businesses strengthen their defences by automating security reviews and identifying weaknesses that would otherwise require expensive specialist expertise.

The challenge is that AI-generated security findings still need human verification because automated systems can produce inaccurate or irrelevant results.

Biggest Risk May Come From Inside

Looking ahead, Mukherji said businesses should be equally concerned about the AI systems and autonomous agents they deploy themselves.

Companies are increasingly connecting AI agents to internal applications, databases and other operational systems. These agents may receive credentials and permissions that allow them to perform actions independently.

Mukherji warned that organisations could eventually end up with large numbers of autonomous accounts that nobody properly owns or governs.

He said businesses should know how many AI agents they operate, what systems they can access, who approved those permissions and what safeguards are in place.

Cybersecurity Enters a New Phase

The cybersecurity industry is increasingly divided into two parallel efforts: using AI to strengthen defence and securing the AI systems themselves.

Security teams are already using AI to analyse logs, investigate vulnerabilities, detect unusual behaviour, review accounts and credentials, simulate attacks and assist with incident response.

At the same time, companies are developing tools to monitor AI agents, manage non-human identities, detect shadow AI deployments and protect systems against prompt-injection attacks.

The result is a cybersecurity environment in which speed is becoming as important as accuracy. As AI allows attackers and defenders to operate faster, organisations may need to rethink traditional response processes and move toward automated containment backed by human oversight.