Microsoft says AI gives hackers a speed edge over security teams

Microsoft’s security research team warned that threat actors are already leveraging artificial‑intelligence tools to outpace defenders, widening the gap early in the AI‑driven cyber‑threat landscape.

The firm’s study highlights generative AI models and large‑language‑model assistants capable of automating the discovery of software vulnerabilities, drafting exploit code, and even polishing malicious payloads. By mechanizing tasks that previously took weeks of manual work, attackers can shift from finding a flaw to exploiting it within hours, speeding up the entire kill‑chain.

In contrast, defenders often still depend on traditional detection signatures and manual analysis processes. Microsoft observed that many security teams lack both the expertise and the tools needed to embed advanced AI into their workflows, leaving them exposed to the swift evolution of AI‑enabled threats.

The promise of AI for cybersecurity has been discussed for years, with expectations that machine learning could help triage alerts and forecast attacks. Yet those same technologies are now being turned against defenders. Large‑language‑model services that can write code, craft phishing emails, or produce obfuscated scripts are publicly accessible, lowering the entry barrier for less‑skilled actors to run sophisticated campaigns.

The tangible effect is already apparent. Faster vulnerability discovery leads to a greater number of zero‑day exploits entering the market, while AI‑generated malware can modify its behavior to dodge sandbox detection. Ransomware groups, for instance, can employ AI to automatically produce ransom notes in multiple languages, and supply‑chain attackers can design custom exploits for a wider array of software components.

Microsoft called on the wider security community to speed up the creation and deployment of AI‑enhanced defenses, stressing the need for collaboration among industry, academia and government. The company said upcoming research programs will aim to develop models that can predict attacker techniques and automate response actions, seeking to close the current advantage held by threat actors.