AI Is Not Just Innovation. It Is Now Part of Your Threat Model.
Over the last year, I’ve sat in more AI strategy conversations than I can count.The energy in those rooms is familiar. Optimism. Curiosity. A little urgency. Sometimes competitive anxiety. AI is framed as acceleration, efficiency, advantage.What I hear less often is a sober discussion about how AI changes our exposure.The latest 2026 X-Force Threat Intelligence Index from IBM, published by IBM X-Force, provides data that should rebalance that conversation. Not because it is dramatic.Because it is directional.
The report shows a 44% year-over-year increase in exploitation of public-facing applications. Forty percent of incidents began with vulnerability exploitation rather than phishing. Ransomware and extortion groups grew by 49%. More than 300,000 AI and chatbot credentials were observed for sale in underground markets.Those numbers are not random spikes. They reflect a shift in tempo. Attackers are becoming faster. More automated. Less dependent on deep expertise. AI reduces the time needed for reconnaissance. It assists with scripting. It helps iterate payloads. It personalizes communication at scale.The barrier to entry is lowering. And when barriers lower, volume rises.
The Compression of Time
What concerns me most is not the sophistication of AI itself. It is the compression it introduces. In cybersecurity, time has always been a silent variable. Time to detect. Time to patch. Time to respond. Time to recover.If reconnaissance once took days and now takes hours, if exploit development can be accelerated with model assistance, if campaigns can be refined dynamically, then the defender’s margin for error shrinks.
The 40% statistic around vulnerability exploitation is particularly telling. For years, phishing dominated board-level discussions. Now exploitation of exposed systems is leading initial access. This does not mean phishing has disappeared. It means automation has matured. When attackers can scan, analyze, and prioritize weaknesses at scale, exposure becomes more visible to them than it is to us.
That is not a technology problem alone. It is a governance problem.
Identity Is Quietly Becoming the Center of Gravity
The discovery of more than 300,000 AI-related credentials for sale should not be dismissed as an isolated statistic. AI platforms increasingly sit inside workflows. They connect to APIs. They process internal context. They often inherit permissions that were granted for convenience rather than scrutiny. Compromise one of those accounts, and you may not just gain access to a tool. You gain insight into how an organization thinks, drafts, analyzes, and sometimes even decides.Identity has been called the new perimeter for years. With AI, that statement becomes literal. If we are not monitoring AI platform access with the same rigor as privileged accounts, we are behind.
The Governance Gap
In executive settings, I often hear thoughtful discussions about how AI can improve productivity and reduce cost. These are valid conversations. But they must be matched with equally disciplined questions:
How does AI change our threat model?
Where does AI sit in our risk register?
What new attack paths does it introduce?
Are we adjusting our incident response assumptions?
Attackers do not wait for policy cycles. They experiment in real time.
Enterprises, understandably, operate within structure and oversight. That structure is necessary. But it also means that we must be deliberate about anticipating risk, not reacting to headlines. AI does not remove fundamentals. It intensifies them. If 40% of attacks begin with vulnerability exploitation, patch discipline and exposure management remain decisive. If ransomware groups are growing by nearly 50%, resilience planning cannot be symbolic.
Sophisticated technology does not compensate for neglected basics.
Leadership in a Compressed Environment
AI is leverage. It increases capability on both sides. The difference is constraint. Adversaries innovate without governance. Enterprises innovate within it. That constraint is not a weakness. It is the price of operating responsibly. But responsible leadership requires clarity. AI is no longer just an innovation topic. It is an enterprise risk variable. It changes the speed of attack, the value of identity, and the scale at which exploitation can occur. The question for 2026 is not whether your organization is experimenting with AI. It is whether your threat model reflects the fact that your adversaries already are.
If that discussion is not happening at the highest level, it should be.