When Advanced Attacks Cost So Little, How Do Defenders Keep Up?

Security leaders often view cyber defense as a battle of wits between a cunning adversary on one side and an equally brilliant SOC team on the other. The reality is more mundane. Every attack needs people skilled enough to plan it and infrastructure robust enough to run it. Whenever either resource gets cheaper, attack volume goes up. It’s about as simple as economics gets.

Artificial intelligence has lowered the cost of entry on both fronts. Advanced techniques are now within almost anyone’s reach, meaning more sophisticated attacks than any human team could ever hope to handle.

Amateur Hour Is Over

For years, the threat landscape followed a fairly predictable pattern. Highly advanced, top-of-pyramid attacks were rare and targeted, and they mostly came from state actors or sophisticated hacking groups. At the bottom sat a much larger crowd of script kiddies armed with a laptop and off-the-shelf tools. They didn’t write their own code or discover new vulnerabilities; instead, they copy-pasted known tactics. Security teams could safely leave their rule-based tools to deal with these basic attacks, saving their analysts for advanced threats.

AI has raised the capabilities of that whole bottom tier. What once demanded a specialist crew and large arrays of command-and-control servers now depends on how many tokens or GPUs someone is willing to rent. The script kiddie can now pull off attacks that, a few years ago, would have pointed to a well-funded criminal group. And there are far more amateur hackers than there are criminal gangs. 

That leaves defenders with a distribution problem. The sophisticated attacks once reserved for human analysts now arrive in far greater numbers, and the more a team depends on those analysts, the faster it runs out of capacity.

Smart Enough to Be Dangerous

Many security teams judge AI threats by asking how smart the models are, and anyone who has watched a model hallucinate its way through a simple analysis might reasonably conclude it poses little danger. 

This viewpoint ignores two realities. The first is that the models are more capable than many people assume—the best open-weight models, such as GLM or DeepSeek, already score well on cyber benchmarks. The second is attack economics. Even a weaker model becomes dangerous when it costs almost nothing to run. Attackers can deploy these models at enormous scale, multiplying the intelligence they have at their disposal.

The guardrails are also weaker than you might think. Commercial AI tools are fine-tuned for safety, meaning they are trained to refuse harmful requests. Most route prompts through two filters: the first checks the prompt itself for harmful content before the model sees it, and the second checks responses for malware and other dangerous content. The model itself is a third safeguard, since each lab trains its model to refuse requests the lab considers immoral. 

It all sounds reassuring, but those protections aren’t guaranteed. Downloadable open-source models come without these filters, making the model’s built-in moral compass its only defense. And thanks to a technique called abliteration, even that can be stripped out: attackers isolate the AI’s exact mathematical ‘refusal vector’ and surgically delete it from the model’s weights. Once removed, the model retains its full intelligence and reasoning capabilities, but it becomes entirely uncensored.

Hack Me If You Can

To see how far an amateur could go with today’s tools, I ran an experiment. I took an open-source model and used abliteration to strip out its ability to refuse a request. Then I spun up 100 AI agents on rented GPUs, and gave them the simple prompt to “hack me” and get into my online accounts.

The agents compromised five accounts, mostly with unsophisticated techniques. But they searched my GitHub account and social media profiles with remarkable breadth and depth. Eventually, the agents surfaced a long-forgotten college hackathon project that still held an exposed Google Cloud credential, and used it to get into my email. I wrote more about the experiment on my Substack.

Five years ago, even a skilled researcher might have come up empty-handed searching for vulnerabilities in the sprawling digital footprint most people leave behind. It's a needle-in-a-haystack exercise. But a hundred AI agents running on a loop? They can keep searching until they find even the smallest opening. And protecting against every possible point of entry takes far more resources than most organizations plan for.

Fighting Fire With Fire

Those who underestimate offensive AI often underestimate defensive AI too. Plenty of CISOs keep a human analyst in the loop for sophisticated threats like business email compromise and vendor fraud because they question whether AI can be trusted to handle them. 

There’s a common fear that a model will hallucinate or miss subtle details that only a human would catch. It’s a fair worry when AI judges an email on its content alone, since traditional red flags like grammar errors and clumsy phrasing are absent from LLM-generated content. 

But the fear doesn't hold up against behavioral AI. 

Abnormal’s behavioral AI platform draws on thousands of signals, including sign-in patterns, communication habits, payment workflows, and attachment types, to build a baseline of normal behavior for every user in an organization. 

The model weighs every new message against that baseline. This allows it to flag an email that falls outside the boundaries of “business as usual” while appearing entirely legitimate at face value. So when a support rep who rarely handles billing gets a polite request for a billing change from a “customer” with a Gmail address, the model flags it, even though nothing in the content itself looks suspicious. 

Behavioral AI can catch advanced attacks with the accuracy of an experienced analyst, but autonomously and at a far greater scale. A human analyst might investigate five or ten threats in a day; behavioral AI has no such limit.

That's a significant advantage when a single cybercriminal or automated agent can launch hundreds or thousands of attacks in the same period. By handling investigations autonomously, behavioral AI frees analysts to harden the security stack and address the rare edge cases it flags for review.

No Agent Is an Island

AI can strengthen defenses, but it also widens attack surfaces. This summer, an AI agent that OpenAI was testing broke out of its sandbox and hacked Hugging Face. Many concluded the answer was to wall agents in more tightly. But an agent cut off from live data can’t do its job: who wants a meeting assistant that can’t read their inbox?

The answer is the same behavioral approach that protects email. By establishing a baseline of normal activity for each AI agent, security teams can detect unusual behavior that could indicate a threat. With this in mind, we’re extending Abnormal’s behavioral detection capabilities to identify threats involving AI agents as they interact with internal applications and external SaaS platforms.

More Bang for Your Buck

Detection is half the story—the other half is cost. Throw the most powerful defensive AI model at every incoming email, and you could spend millions without buying much extra protection. 

Well-architected platforms solve this by routing each email to the necessary level of analysis. Simple rules and traditional machine learning clear the obvious, commodity threats, while smaller AI models handle the middle ground. Heavyweight models step in only for the complex, high-risk cases.

Here’s an example: we've seen an uptick in attackers using CAPTCHA-like techniques to hide malicious payloads in formats that are easier for humans to interpret than automated security tools. One technique involves creating a QR code out of ASCII characters. To a lightweight detection model, it looks like a harmless jumble of text. But when rendered visually, it becomes a QR code that could direct the recipient to a malicious website.

This is where layered detection comes in. A lightweight model might pick up a behavioral signal, such as something unusual about the sender, even if it can't interpret the QR code itself. That could trigger an escalation to a more advanced multimodal model, which can render the email as a human would see it and identify the link to a phishing page.

By using more powerful, expensive models only when they're needed, the platform can keep detection costs under control while maintaining the ability to identify complex threats. 

The New Economics of Defense 

Cyberattacks now strike at industrial scale, and every new release hands attackers a little more to work with. As you plan for the next 12 months, my advice is to take action in four key areas:

• Update your view of attack economics. Plan for where attacks are heading, and revisit that plan with every major model release.

• Scale your defenses to match. Let autonomous behavioral detection cover all your organization's inboxes; save your human analysts for the edge cases it surfaces. 

• Treat AI agents like any other identity. Assume that agents will need access to external systems, and establish a baseline of normal behavior for them.

• Keep defense costs from rising exponentially. Ask vendors whether their platform routes each email to the right model, so you get top-tier detection without paying top-tier prices on every message.

Attackers have already run the numbers. It’s time defenders did too.

Attackers have already run the numbers. See how Abnormal AI's security suite keeps your defense costs from rising with them.