Nation-State Hackers Are Using AI. That Should Get Your Attention.

There is a lot of noise around AI and cybersecurity right now, but underneath all of that hype, something important is happening. Nation-state threat actors are actively using AI in cyber operations, and this is no longer a theoretical discussion about what attackers might be able to do five years from now.

What interests me most is not the idea that AI is suddenly teaching sophisticated attackers how to hack. They already know how to do that. The real advantage AI gives them is speed, and in offensive security, speed matters a lot.

The Attackers Were Already Good

When people talk about malicious uses of AI, the conversation often jumps straight to autonomous systems discovering zero-days, writing malware, and compromising organizations without human involvement.

That future may eventually become real, and pieces of it are already starting to emerge. But focusing only on that scenario misses the more immediate risk.

Nation-state operators already have experienced offensive teams, infrastructure, funding, intelligence capabilities, and clear objectives. They understand reconnaissance, vulnerability exploitation, phishing, credential abuse, lateral movement, and the other techniques that make up a real intrusion.

AI does not suddenly give them expertise. It removes friction from the expertise they already have.

For a capable offensive operator, removing friction means spending less time researching unfamiliar technologies, debugging scripts, reading documentation, modifying exploits, interpreting tool output, and figuring out why something failed. Those are all tasks that take time, and AI is increasingly good at helping with them.

Anyone who has spent enough time penetration testing knows that the exploit itself can sometimes be the easy part. A huge portion of the engagement is spent researching, testing, troubleshooting, adjusting, and trying again.

I have spent more hours than I care to admit troubleshooting something ridiculous late at night because one dependency suddenly decided it no longer wanted to cooperate. That is just part of offensive security.

AI can accelerate a surprising amount of that work. The attacker may not become dramatically smarter, but they become significantly more efficient. They can research more targets, explore more attack paths, create more tooling, analyze more failures, and make more attempts within the same amount of time.

That is where the difference starts to matter.

We Are Already Seeing the Playbook Develop

This is not speculation anymore.

Google Threat Intelligence Group has reported state-sponsored actors associated with North Korea, Iran, and China using generative AI across multiple stages of their operations, including reconnaissance, phishing lure creation, command-and-control development, and data exfiltration.

Microsoft and OpenAI have reported similar activity. Their research has identified state-affiliated groups using large language models to support tasks including researching targets, understanding vulnerabilities, troubleshooting technical problems, developing scripts, and supporting social engineering.

There is an important detail in that research that I think gets overlooked: much of the observed activity has not involved AI inventing entirely new offensive capabilities.

Instead, attackers are applying AI to things they already know how to do.

That is arguably more relevant to defenders than the hypothetical AI super-hacker everyone likes talking about.

What we are seeing today still largely looks something like this:

Human operator → AI → Tool → Target

The human remains firmly in control. They decide what to investigate, what to execute, and what to try next, while AI helps accelerate individual steps along the way.

But that model is beginning to evolve.

An Assistant Answers Questions. An Agent Pursues Objectives.

A chatbot waits for a prompt. An agent can be given an objective and then use tools, evaluate results, determine what happened, decide what to do next, and continue working toward that goal.

From an offensive security perspective, that starts to look very familiar.

A penetration tester enumerates a target, analyzes what they find, chooses an attack path, executes it, evaluates the result, changes strategy when something fails, and continues exploring the environment.

None of those individual actions are revolutionary. What becomes interesting is connecting them into a reasoning loop where the system can decide what should happen next.

We are already beginning to see early indications of this transition. Google Threat Intelligence has reported malware incorporating AI during execution to dynamically generate or modify malicious functionality, moving beyond the earlier model of attackers simply using an AI assistant for technical support.

That was also one of the ideas behind Canima from the beginning. I did not want to build another vulnerability scanner with AI sprinkled on top of it and call it autonomous. There are already enough of those.

The goal was to build systems capable of reasoning through offensive security problems, because I think that is where both offensive and defensive security are going.

Nation States Don't Need Completely New Attacks

AI does not have to invent some incredible new class of cyberattack to change the threat landscape. Existing attacks work just fine.

A threat actor finding the same vulnerability twice as fast matters. Researching more targets matters. Adapting a script when it fails matters. Producing social engineering material more efficiently matters. Analyzing thousands of systems instead of hundreds matters.

Individually, none of these capabilities fundamentally change offensive security. Together, they change the economics of offensive operations.

Attackers can do more with the same number of people, and sophisticated nation-state groups already have significant resources behind them. Giving those operators tools that allow them to move faster and operate at greater scale creates a meaningful advantage.

The important question is not whether AI will invent some attack we have never imagined before.

It is what happens when attacks we already understand can be executed faster, more frequently, and against significantly more targets.

The Problem Isn't the Pentest. It's the Time Between Them.

This is the part I find difficult to reconcile.

We are watching offensive capabilities become faster, more automated, and increasingly continuous, yet many organizations still have long periods of time between meaningful offensive security assessments.

That is not a criticism of manual penetration testing. I have built a career around it, I still operate a company dedicated to manual penetration testing today, and I continue to believe deeply in its value even as the capabilities of AI expand.

A skilled human pentester brings creativity, intuition, business context, and years of experience to an engagement. They can understand how an application is intended to work, question assumptions, investigate unusual behavior, and pursue attack paths that may not fit neatly into a predefined methodology.

The problem is not the value of that testing.

The problem is time.

A manual penetration test provides deep insight into an organization's security posture at a specific point in time. But the environment does not stop changing when the engagement ends.

New infrastructure gets deployed. Applications change. Credentials get exposed. Configurations drift. New vulnerabilities are published. Third-party systems change.

A penetration test performed six months ago can tell you something extremely valuable about the environment that was tested six months ago. What it cannot do is continuously tell you what changed afterward.

Attackers, somewhat inconveniently, do not follow the assessment schedule.

That problem existed long before AI. AI just makes it considerably harder to ignore.

The Defender Has Access to the Same Advantage

This is where I am actually optimistic.

The same technology that allows offensive operators to work faster also gives defenders the ability to continuously test themselves.

One of the best ways to understand whether an attacker can compromise your environment is to actually try to compromise your environment.

Not just scan it or compare software versions against a vulnerability database, but actively test whether weaknesses can be exploited and determine where those weaknesses can lead.

Reconnaissance, enumeration, exploitation, credential testing, privilege escalation, lateral movement, and attack-path discovery are all parts of understanding what an attacker could actually accomplish.

Then the process needs to happen again as the environment changes.

This is where I think autonomous and manual penetration testing complement each other particularly well.

Manual penetration testing provides human depth, creativity, context, and judgment. Autonomous testing provides frequency, scale, and the ability to continuously validate an environment between deeper human-led assessments.

A human pentester can spend time understanding complex business logic, exploring unusual attack paths, chaining subtle weaknesses together, and applying experience to problems that require genuine human judgment.

AI-driven offensive testing solves a different problem. It can continuously perform reconnaissance, enumeration, exploitation, credential testing, and attack-path discovery as an environment evolves, without waiting for the next scheduled engagement.

A human penetration tester cannot attack every part of an organization's infrastructure every hour of every day. There are only so many hours available, and there is a practical limit to how frequently even the best manual team can reassess an environment.

Software does not have that constraint.

That does not make one approach better than the other. It makes them useful for different reasons.

The strongest security programs will not have to choose between human expertise and autonomous testing. They can use each where it provides the greatest value.

The Window Between Vulnerability and Exploitation Is Shrinking

Cybersecurity has always been a race between the people discovering weaknesses and the people trying to exploit them.

A vulnerability exists. Someone discovers it. Someone figures out how to exploit it. Attackers begin using it, and defenders work to fix it.

AI compresses that timeline.

Research becomes faster. Code development becomes faster. Reconnaissance becomes faster. Troubleshooting becomes faster. Attack iteration becomes faster.

As agentic systems improve, more of that workflow will also be capable of happening without a human directing every individual action.

That changes what defenders need to prepare for.

I do not think the takeaway should be panic. It should be preparation.

If attackers can evaluate environments faster and more frequently, defenders need the ability to validate their own environments at a pace that can keep up.

Manual penetration testing remains an important part of that equation. It provides the human creativity and depth that I do not believe we should be trying to remove from offensive security.

Autonomous testing gives us the opportunity to add something we have historically struggled to provide at scale: continuity.

Put the two together, and security teams can have deep human-led assessments while continuously testing what changes in between them.

The question security teams need to start asking is no longer simply whether their environment is secure.

It is:

If somebody tried to compromise us today, what would actually work?

Then ask the same question tomorrow.

Because increasingly, that is exactly what the other side is going to do.

Sources & Further Reading

Google Threat Intelligence Group
GTIG AI Threat Tracker: Advances in Threat Actor Usage of AI Tools

Google Threat Intelligence Group
Adversaries Leverage AI for Vulnerability Exploitation, Augmented Operations, and Initial Access

OpenAI
Disrupting Malicious Uses of AI

Microsoft
Microsoft Digital Defense Report

Elias Marquez
CEO & Founder, Canima