The enterprise software industry has long held on to the traditional assumption that while bugs are common, the expertise to exploit them, particularly at scale, is rare.
That scarcity has helped keep digital risk manageable, if never fully contained.
But a new report from Google published Monday (May 11) is turning that legacy assumption on its head by showing where artificial intelligence is compressing the cost and skill required to turn hacking into a scale business. The report revealed that entire attack chains are increasingly becoming software-defined and executed faster and cheaper than ever before.
The result is not simply more hacking. It is the industrialization of hacking.
Google Cloud researchers described what they believe to be the first observed case of an AI-developed zero-day exploit tied to a planned mass exploitation campaign, an event that security analysts inside and outside the tech giant increasingly view less as an isolated milestone than as an early signal of a broader structural transition toward an industrial-scale cyber threat landscape.
The key takeaway for enterprise leaders and chief financial officers assessing their firms’ new risk profiles is that nearly the whole tool kit of hacking tasks for fraudsters, including reconnaissance, exploit adaptation, vulnerability discovery, social engineering and more, no longer requires the same degree of specialized human expertise. On top of that, they are all becoming increasingly automatable. This first-principles shift matters because cybersecurity is ultimately an economic system.
Advertisement: Scroll to Continue
And economic systems change rapidly when the cost of production collapses.
See also: The Enterprise Security Stack Is Moving to the Edge
Cyber Attacks Shift From Craft Production to Mass Manufacturing
In practical terms, the ability for adversarial cyber threat groups to benefit from software-like scale efficiencies means enterprises are confronting a future in which sophisticated attacks are no longer exceptional events. They are becoming operationally routine.
When the marginal cost of generating attacks falls, the volume of attacks rises. The software industry has seen this dynamic repeatedly. Cloud computing reduced infrastructure costs and enabled startup proliferation, while social media collapsed publishing barriers and flooded the information ecosystem with content. Generative AI is now applying the same logic to cyber operations.
While traditional cyberattacks resembled artisanal production, AI has changed the production function for cybercrime. Whereas the compute skill and cost economics once limited high-end offensive capability to a relatively small set of fraudsters, the emerging danger is that AI enables ordinary attackers to operate with previously unattainable efficiency.
A phishing email no longer needs to be brilliant if millions can be generated and adapted instantly for different industries, executives and geographies. Malware no longer needs to be elegantly engineered if AI-assisted iteration allows attackers to rapidly test variations against defenses.
This can ultimately lead to attack surface saturation, where enterprises face a continuous stream of low-cost, semi-customized intrusion attempts generated at machine speed. In this environment, the sheer volume of threats becomes strategically significant even if individual attacks remain imperfect.
Read also: Cybersecurity’s Hottest New Job Is Negotiating With Hackers
How Firms Are Navigating Today’s Industrial-Scale Threat Landscape
Experienced attackers can still outperform automated systems in complex intrusions, but the threshold for good-enough offensive capability is rapidly dropping as the economics begin to favor persistence at scale.
For example, across the credit union (CU) landscape, PYMNTS Intelligence research found that fraud now occurs across the full CU member life cycle, from account opening and onboarding to authentication and transaction activity. CUs must now defend every interaction point rather than a single stage, and 77% of CUs have experienced unauthorized network access in the past year.
That does not mean defenders are powerless. AI also offers defensive advantages in detection, anomaly analysis, incident response and threat intelligence. Research from the PYMNTS Intelligence report “The AI MonitorEdge Report: COOs Leverage GenAI to Reduce Data Security Losses” showed that 55% of companies are employing AI-powered cybersecurity measures.
Still, in today’s threat environment, cybersecurity strategies increasingly resemble industrial risk management rather than perimeter defense. Few sectors may feel this shift more acutely than cyber insurance, where the existing market was built on actuarial assumptions pricing risk around relatively observable controls, including endpoint security, employee training, patch management, multifactor authentication and incident response maturity.
These assumptions look increasingly unstable in an AI-driven threat environment. Firms previously considered moderate risks could suddenly face elevated exposure simply because attackers can now economically target a much broader universe of companies.
As AI lowers barriers for attackers, the standard for what constitutes reasonable defense may evolve upward as well. Companies with mature security architectures, strong identity controls, segmented infrastructure and rapid patching capabilities may increasingly resemble low-risk operators in a high-risk economy.
The central executive question is no longer whether a company can prevent every intrusion. It is becoming whether the organization can remain operationally resilient in a world where sophisticated attacks become a continuous background condition of doing business.
For all PYMNTS AI coverage, subscribe to the daily AI Newsletter.
