For most of its history, cybersecurity has been limited by human speed on both sides. AI is changing that balance, and business leaders need to understand what it means for resilience.
A new kind of threat
In November 2025, Anthropic reported disrupting a cyber espionage campaign in which attackers manipulated its AI coding tool to attempt infiltration of roughly thirty global targets, succeeding in a small number of cases. By Anthropic's assessment, AI performed 80 to 90 percent of the campaign, with people stepping in at only a few critical decision points. Some independent analysts have questioned how autonomous it really was, but the direction is clear: attacks that once required large teams can now be scaled by far fewer people.
Identity is the front line
Attackers increasingly log in rather than break in. Microsoft's Digital Defense Report 2025 said identity-based attacks surged by 32% in the first half of 2025, and that more than 97% of identity attacks are password attacks. The same report says phishing-resistant multifactor authentication can stop over 99% of this type of attack.
For most enterprises, this is the single most practical place to start.
Building resilience
Adopt Zero Trust. Verify every user, device and request. Assume that a breach is possible and limit how far an intruder can move. If a supplier's account is compromised, it should not open a path to your ERP.
Manage identity rigorously. Remove standing administrator rights and review access regularly. Treat AI agents as identities too, each with its own credentials and minimum permissions.
Govern AI use. Define which tools are approved, what data they may access and who is accountable for them.
Be proactive. Use AI to help with threat detection and response, as Anthropic also advises defenders. Then rehearse incidents with the executive team, because resilience is a business capability as much as a technical one.