Artificial intelligence is changing more than the speed of vulnerability discovery. It is changing the economics of offensive cyber operations, allowing sophisticated adversaries to analyze more software, identify more targets, and move from vulnerability discovery to exploitation at a scale that would previously have required far larger teams.
Shane Fry, CTO of RunSafe Security, has worked across both offensive and defensive cybersecurity, giving him a unique perspective on what this shift means for government agencies, defense organizations, and critical infrastructure operators.
In this Q&A, Fry discusses how he expects nation-state actors to use advanced AI over the next several years, why the advantage may disproportionately favor attackers, and what security leaders should be doing now to prepare.
How do you expect sophisticated threat actors, particularly nation-state groups, to use advanced AI over the next three to five years? Drawing from your experience on both the offensive and defensive sides of cybersecurity, where do you see the greatest change coming?
The most concerning near-term shift is in scale. Nation-state actors already have skilled offensive teams. What AI gives them is the ability to multiply that capability without a proportional increase in cost or personnel. A team that could previously analyze a few targets can now analyze thousands. Vulnerability discovery that once required senior researchers can be delegated to AI systems running continuously.
While it’s true that defensive cyber analysts can also use these AI tools, their focus, and thus budget, is generally constrained to only the software their company or product team writes. This budget asymmetry means that nation-states’ advantage is exponentially greater, as they can spend more money to scale their use of AI than defenders can.
Over the next three to five years, I expect to see AI used heavily in three areas. First, AI-assisted, automated vulnerability discovery will replace traditional SAST tooling at scale across both commercial software and open source dependencies that critical infrastructure relies on. Second, exploit generation will move from discovery to a working proof of concept far faster than any human team could. Third, and most concerning, AI-assisted target selection and campaign planning, where adversaries can identify which specific systems in which specific organizations are running vulnerable software and prioritize accordingly.
If AI changes the scale and economics of cyber operations in the way you describe, what should government agencies, defense organizations, and critical infrastructure operators be prioritizing now?
The first priority is acknowledging that the threat has structurally changed. AI has permanently compressed the exploitation timeline, and security programs built around quarterly patch cycles or annual penetration tests are not calibrated for that reality. Leadership needs to understand this and fund accordingly.
The second priority is hardening what cannot be patched. Across government and critical infrastructure, there are enormous amounts of deployed software that will not receive timely patches, whether because of operational constraints, vendor limitations, or sheer volume. That software needs automated mitigation applied now, not after the next incident.
The third priority is visibility into the software you are actually running. You cannot harden what you do not know you have. Agencies and operators should be building or maturing their Software Bills of Materials (SBOMs) so they have an accurate picture of their exposure when new vulnerabilities are disclosed. That is the foundation everything else depends on.
The longer-term priority is changing procurement. Agencies should be requiring software suppliers to demonstrate that they follow secure-by-design principles and that their products can be hardened when vulnerabilities are found. The current posture, where the burden falls entirely on the operator after delivery, is not sustainable when attackers have AI working for them around the clock.
We are already seeing AI accelerate vulnerability research. How is that changing the traditional lifecycle from vulnerability discovery to exploitation?
AI is speeding up the vulnerability lifecycle significantly. In just the three months following the announcement of Claude Mythos and other frontier AI models, we’ve seen an exponential increase in vulnerabilities discovered in some of the most complex and scrutinized software in existence, including Chrome, Linux, and others.
Beyond volume, AI can generate working exploits in hours or minutes. The window from discovery to exploitation has compressed so much that traditional patch cycles leave organizations dangerously exposed. That compression has also strained the CISA CVE program and other vulnerability intelligence sources that security teams depend on to assess exposure and prioritize response.
Organizations operating critical infrastructure were already struggling to patch on existing timelines. That window is now smaller, and the consequences of falling behind extend well beyond individual organizations.
You have argued that this compressed timeline requires a shift from vulnerability detection and remediation toward vulnerability mitigation. What does that distinction mean in practice?
AI has changed the economics and speed of cyberattacks. Because the window between discovery and exploitation is shrinking, remediation alone cannot keep pace. Mitigation is the best way to take control away from attackers.
The goal is to reduce exploitability even when vulnerabilities remain unpatched. If you can take entire classes of exploits off the table, the patch gap becomes less of an acute problem, and patching can become strategic rather than reactive.
Runtime exploit prevention is one example. It blocks attackers from exploiting common vulnerabilities such as buffer overflows and prevents Return-Oriented Programming attacks during execution, rather than relying solely on pre-deployment defenses like SAST or penetration testing. The bigger benefit is posture. Organizations can be proactive rather than perpetually reactive, hardening systems against classes of attacks before any specific vulnerability is ever identified.
What role do exploit prevention and software hardening technologies play in protecting organizations against AI-enabled cyber threats?
They become much more important as AI accelerates exploitation. When the window between vulnerability disclosure and working exploit shrinks from weeks to hours, the math changes. Organizations cannot staff or fund their way to a remediation velocity that keeps pace with AI-assisted attackers. Exploit prevention changes the equation by making a large class of vulnerabilities non-exploitable, regardless of whether a patch exists.
Software hardening techniques like memory tagging, address space layout randomization, and stack canaries have been around for years, but adoption in OT and embedded environments has been slow because it’s costly to implement and, for hardware-enabled features, increases the cost of goods sold for the manufacturer to buy the higher-end chips with those features.
Newer approaches, including advanced runtime exploit prevention techniques like Load-time Function Randomization, block exploitation attempts before they succeed, even if an attacker discovers a buffer overflow in a deployed system, for example. That does not make the vulnerability go away, but it buys time and reduces the leverage that AI gives attackers. Given the threat trajectory, that buffer matters a great deal.
AI has changed the economics of software security. For more on getting ahead of bad actors, learn about Operational Software Assurance and how Embedded Runtime Security is giving defenders an advantage.
