Attackers automate discovery, defenders automate response, and the gap between breach and damage collapses to minutes.
Published 14 October 2026 · 06:00 GMT
Last updated: October 2026
There is a war going on that has no front line, no declaration, and no ceasefire. It runs through hospital scheduling systems, water utilities, shipping ports, and election offices. It is the cyber war, and in the last two years it changed its character. Artificial intelligence did not invent cyberattacks. It industrialised them. The reconnaissance that once took a skilled attacker weeks now takes a machine hours. The phishing email that once fooled one careless employee in a hundred can now be personalised for each of the hundred. The vulnerability that once sat undiscovered for months is now found, weaponised, and exploited before the patch ships. On the other side, defenders have AI too — detection systems that spot anomalies, response tools that isolate machines in seconds, and models that triage ten thousand alerts before breakfast. The result is not a victory for either side. It is acceleration. The gap between breach and damage, once measured in weeks, is now measured in minutes. That compression is the defining fact of the new cyber era, and almost nobody's defences were built for it.
There is a war going on that has no front line, no declaration, and no ceasefire. It runs through hospital scheduling systems, water utilities, shipping ports, and election offices. It is the cyber war, and in the last two years it changed its character. Artificial intelligence did not invent cyberattacks. It industrialised them. The reconnaissance that once took a skilled attacker weeks now takes a machine hours. The phishing email that once fooled one careless employee in a hundred can now be personalised for each of the hundred. The vulnerability that once sat undiscovered for months is now found, weaponised, and exploited before the patch ships. On the other side, defenders have AI too — detection systems that spot anomalies, response tools that isolate machines in seconds, and models that triage ten thousand alerts before breakfast. The result is not a victory for either side. It is acceleration. The gap between breach and damage, once measured in weeks, is now measured in minutes. That compression is the defining fact of the new cyber era, and almost nobody's defences were built for it.
Understand what automation did to the attacker's economics. The old model was artisanal: a skilled operator chose a target, studied it, wrote a lure, waited, and improvised. The new model is industrial. AI agents scan the internet for exposed systems, test credentials leaked in old breaches, generate phishing lures in perfect local language for every employee on a company's public pages, and adapt in real time when a defence blocks them. Ransomware groups run like businesses, with affiliates, customer service, and quality control. The barrier to entry has collapsed: a criminal who cannot write code can rent the tooling. The targets have also shifted downmarket. Hospitals, schools, small municipalities, and mid-sized suppliers — organisations that cannot afford a twenty-person security team — are now the preferred victims, precisely because they are soft and because their downtime is intolerable. A hospital cannot wait a week to negotiate. That is the business model.
Defenders face an asymmetry that no amount of AI has yet fixed. The attacker needs to find one hole. The defender must close them all, across systems built over decades, running software nobody fully understands, used by people who will click. The basics still dominate: patch what is known, rotate credentials, segment the network so one breach does not become a total breach, back up data offline, and drill the response. Most organisations fail at the basics not from ignorance but from exhaustion — too many tools, too many alerts, too few people, too little money. AI helps at the margin: it filters noise, correlates signals, and automates the first response. But it also creates new failure modes. A detection model trained on yesterday's attacks misses tomorrow's. An automated response that isolates the wrong system can do the attacker's job for them. The defender's dilemma is not a lack of technology. It is that defence is a cost centre, attack is a profit centre, and the market rewards the latter more reliably than the former.
When cyberattacks hit a retailer, the damage is money and embarrassment. When they hit infrastructure, the damage is physical. A water utility whose pumps are manipulated, a power grid whose control systems are locked, a hospital whose records are encrypted during an emergency — these are not data incidents. They are public-safety incidents. Governments have responded with incident-reporting rules, minimum standards for critical sectors, and, in some cases, outright bans on paying ransoms. The results are uneven. Standards without enforcement become paperwork. Reporting without sharing becomes a filing cabinet. And the deepest problem is attribution: a cyberattack on infrastructure could be a criminal gang, a state proxy, a state itself, or a gang that rents to a state on weekends. Without attribution, deterrence is guesswork, and retaliation risks hitting the wrong target. The infrastructure stakes are why cyber has moved from the IT department to the national security council — and why it will stay there.
Western coverage reads the cyber era as a contest between open societies and their adversaries — Russia, China, Iran, North Korea, and the criminal ecosystems that shelter under them. The policy answer has been layered: sanctions on ransomware actors, takedowns of botnets, mandatory incident reporting, and the slow construction of a norm that critical infrastructure is off-limits even in peacetime. There are real successes: joint takedowns have disrupted major ransomware operations, and information-sharing between governments and firms has improved. But the Western lens has a blind spot it rarely names: the West's own offensive cyber capabilities, its own exploit stockpiles, and its own history of attacks on infrastructure make its norms look selective to the rest of the world. Norms that bind only your enemies are not norms. They are talking points. The Western model will only hold if it applies its own rules to itself.
From Moscow and Beijing, the cyber story is about sovereignty over the information environment. Russia's doctrine treats cyber operations as a permanent, low-intensity instrument — espionage, influence, disruption — calibrated to stay below the threshold of war. China's approach pairs formidable offensive capability with an iron grip on domestic networks: data localisation, content control, and a national cyber force. Both see Western talk of a free and open internet as a cover for American platform dominance. Their answer is a sovereign internet: domestic infrastructure, domestic platforms, domestic rules, and the ability to disconnect when threatened. The Eastern lens has a cost its own advocates rarely count: a sovereign internet is also a censored internet, and the same tools that keep foreign attackers out keep domestic dissent down. But dismissing the sovereignty impulse as mere authoritarianism misses the real grievance. A country whose entire digital life runs on foreign infrastructure has a legitimate reason to want its own.
For most of the world, the cyber war is not a great-power chess match. It is a daily mugging. African, Latin American, and Asian organisations face the same ransomware gangs as everyone else, with a fraction of the budget, fewer skilled defenders, and regulators who often lack the tools to help. When a hospital in a low-income country is hit, there is no cyber insurance, no incident-response retainer, no national backup. There is a locked system and a ransom note. The Global South lens therefore measures cyber policy in practical terms: affordable security tools, training, backup infrastructure, and help that arrives in hours rather than in conference declarations. It also sees an opportunity the other lenses miss. The countries that build secure-by-default digital public infrastructure — identity, payments, health records — from the start will be safer than rich countries retrofitting security onto decades of legacy systems. The Global South does not need to inherit the West's vulnerabilities along with its technology.
Watch the time-to-damage metric: whether defenders can hold the line as the breach-to-damage window shrinks toward zero. Watch the first major AI-driven attack on infrastructure that is attributed quickly and publicly — attribution speed is the new deterrence. Watch ransomware payment policy: whether bans work or merely push payments underground. And watch the basics: the share of breaches that still begin with an unpatched system and a stolen password. That number is the report card for the whole cyber era, and it has barely moved in a decade.
AI did not invent cyberattacks — it industrialised them. The reconnaissance that once took an attacker weeks now takes a machine hours. The phishing email that once fooled one employee in a hundred can now be personalised for each of the hundred. The vulnerability that sat undiscovered for months is now found, weaponised, and exploited before the patch ships. On the other side, defenders have AI too, so the result is not victory for either side — it is acceleration.
The attacker needs to find one hole. The defender must close them all, across systems built over decades, running software nobody understands, used by people who will click. The basics dominate: patch what is known, rotate credentials, segment the network so one breach does not become a breach, back up data, and drill the response. Most organisations fail at the basics not from ignorance but from exhaustion — too many tools, too many alerts, too few people, too little money.
Ransomware groups have shifted downmarket because smaller organisations are soft and their downtime is intolerable. Hospitals, schools, small municipalities, and mid-sized suppliers cannot afford a twenty-person security team. A hospital cannot wait a week to negotiate. When a hospital in a low-income country is hit, there is no cyber insurance, no incident-response retainer, and no national backup — there is a locked system and a ransom note. That is the business model.
Watch the time-to-damage metric: whether defenders can hold the line as the breach-to-damage window shrinks toward zero. Watch the first major AI-driven attack on infrastructure that is attributed quickly and publicly, because attribution speed is the new deterrence. Watch ransomware payment policy: whether bans work or merely push payments underground. And watch the basics — the share of breaches that begin with an unpatched system and a stolen password.
