At RSAC 2026 I have joined Paul McCarty (OpenSourceMalware) and Adam Pennington (MITRE ATT&CK) on a panel moderated by Seeyew Mo, a former Assistant National Cyber Director at the White House. The room was full. The same week I was also hosting Adversary Village at RSAC.
I shared what I keep seeing in the field. Attackers and offensive teams both use AI now, mostly to build tooling faster and to work through the data they collect. AI has not produced a new kind of attack. It has made the old ones faster and harder to catch: phishing without the obvious mistakes, quicker recon, and malware that keeps changing to get past detection.
We also agreed on what not to do. Don't rip out defences that work to fund AI projects, and have a person check anything a model produces, detection rules included. Adam put the defender's side well: you will not block everything at this speed, so build to take the hit. That is why I believe in emulation. You cannot prepare for an adversary like this by guessing.
