AI Isn’t a Tool Anymore. It’s an Operator. Notes from the SANS AI Cybersecurity Summit

The urgent message from the SANS AI Cybersecurity Summit speakers: Attackers are operating autonomously at AI speed, our defenses are still human-speed, and the gap keeps widening in their favor.

Anne Neuberger, who spent years thinking about this at NSA, described the shift with brutal clarity. In the past, “it was a race against an attacker jiggling a doorknob at a time. Now what we have is a set of attackers who can really jiggle every doorknob all at once.” She meant it literally. Not checking one system, one user, or one service, but all of them. Simultaneously. Automated. That’s not a tactic. That’s infrastructure.

Greg Isenberg captured the asymmetry even more precisely: “AI made it 100x easier to build. It also made it 100x easier to attack.” The barrier to entry collapsed for both sides at the same time. Asymmetry is dead.

The uncomfortable part wasn’t the threat data. It was watching people realize that most of what we’ve built for “incident response” is built for human-speed attacks that unfold over weeks. Attackers now operate in seconds. (I’ve been saying this for years. Seeing it land in the room validated something I was hoping I was wrong about.)

Here’s what actually changed my thinking during the summit:

Jacob Klein, head of threat intel from Anthropic was direct: “The landscape has already changed. It’s not just changing in the future, though it is. The landscape has changed today.”

He pulled numbers showing 48% of tracked malicious actors saw meaningful capability uplift from AI between July 2025 and February 2026. Not just usage: uplift. The median attacker isn’t using AI for one step of their chain anymore: they’re automating an average of 16 techniques from reconnaissance through exfiltration. (I’ve seen the data. This isn’t speculation.) That’s not “AI-assisted attacks.” That’s AI as infrastructure.

Yotam Perkal nailed the threat modeling problem: “Stop threat modeling AI like a tool and start threat modeling it like an operator.” We’re still modeling attackers as humans using tools. AI introduces what he called a “third operator” into our environments. When you give an autonomous agent business context, access to tools, and permission to act, it stops being software. It becomes an actor, a privileged actor. We’re still threat modeling it like it’s a calculator. (Yeah, we’re way behind on this.)

Julie Davila from GitLab pointed out that we’re looking in the wrong place. “Failures rarely occur where you’re watching. They occur in the seams between the components.” While everyone obsesses over prompt injections and model outputs, the real vulnerabilities live in the orchestration layers, the APIs and the points where untrusted AI output gets serialized into privileged execution boundaries without validation.

Complex systems don’t usually fail at the obvious points. They fail at the integration points no one thought to harden because they weren’t built with AI in mind. Any time AI-generated data crosses a trust boundary that assumes human input, failure is guaranteed. Sounil Yu put it differently: “AI is a great magnifying glass in the sense that a lot of these issues are the result of brittle primitives that existed well before the LLM craze.” We didn’t invent these problems. AI just weaponized them.

The meta-problem underneath all of this: we built security controls assuming we were defending against humans or relatively simple malware. Not autonomous agents or systems that can test thousands of variations in the time it takes you to sip your coffee. (And yes, someone in the room actually said this problem was “unprecedented.” It’s rarely unprecedented; we’re just repeating history faster.)

So, the threat is real, and we’re unprepared. What do you do Monday morning?

Stop modeling the AI. Start modeling the workflow. Most teams I talk to are still thinking about “securing the model” or “securing the output.” That’s the wrong frame. The question isn’t whether Claude could do something bad. The question is: what does your workflow do when Claude makes a bad decision? If your AI system can approve a transaction, trigger an alert, or query sensitive data, you’re not running a chatbot, you’re running a system with business authority.

Map every place in your environment where AI makes decisions or accesses data. Ask what happens when it’s wrong. Then ask whether a human is actually reviewing that decision or just clicking “approved” at AI speed. (That’s still failure. You’re just more efficient at it.)

Know what you’re running. Build a basic AI asset inventory. What models are your teams using? Where are they deployed? What data are they touching? Use AI Bills of Materials (AIBOMs) the same way you use software BOMs, now, not later. Most teams can’t answer basic questions like “how many models are interacting with our sensitive data?” or “which models are developers pulling from Hugging Face?”

You can’t defend what you don’t know exists. (We learned this lesson 20 years ago with shadow IT. Apparently, we’re learning it again.)

→ Rest of my writeup is at sans.org on what speakers said about decision velocity, what to never outsource, and embracing deception.

→ Check out the SANS AI Summit 2026 NotebookLM to chat with the content. All speaker sessions and materials were loaded in to interact with. Ask about a speaker or topic. Chat is private to you and not shared. Start here: The 20 Deepest Insights from SANS AI Summit 2026 or here: Analyst’s AI Burn Book: SANS AI Summit Notes

Rob T. Lee is Chief AI Officer & Chief of Research, SANS Institute

→ If you want to work on this problem directly, check out the Find Evil! hackathon and our proof of concept for AI-augmented incident response; Protocol SIFT. It’s what happens when you wire an AI agent into a forensic workstation full of trusted tools and tell it to behave. It's an early capability with real outputs, failure modes. Join our community effort to make it something defenders can deploy. 42 days to enter. An incredible 2,500+ builders and teams are in as of today. $22K in cash prizes. Sponsored by SANS Institute. Register findevil.devpost.com

→ I kicked off a LinkedIn Learning course on how to get AI tools approved. If we don’t get business teams and security talking and working together, the risk stays in the shadows. Module 1 (90-sec video + worksheets) here.

Transcript from video: Jacob Klein, head of threat intel at Anthropic

Now, one thing before I continue and go through sort of a landscape analysis, I always want to keep in mind when I go through these cases is my job is to find bad actors and understand what they’re doing.

But a lot of folks here are working on defense for your own organization. Much of the same techniques and tools that I’m seeing bad actors using, a defender could use as well. You could look at your own endpoints at scale, your own code at scale to understand vulnerabilities to hopefully then patch them.

If you have a detection and response team, you can use AI to understand signals and quickly investigate the signals as well. So it’s very much a dual-use piece of technology. I just happen to be talking from the risk side of the angle, but I don’t want to pretend that almost everything I’m walking through can’t be used by a defender as well.