Briefing
Rise against the machine
A December 2025 briefing on what AI-assisted threat activity meant for CISO strategy. Our offensive team assessed Anthropic’s 2025 report on an AI-orchestrated espionage campaign, separated the hype from the real threat, and set out a 30 and 90 day action plan.
Why the threat was genuine but the hype overblown
What AI changed (speed, barrier to entry, volume) and what it didn’t
Why our team questioned the attribution, and what that meant for your risk profile
A 30-day and 90-day action plan for CISOs
Free download
The report was real. The hype was overblown.
In November 2025, Anthropic published a report on what it called the first AI-orchestrated cyber espionage campaign, with AI handling 80-90% of the tactical work across 30 targets. Headlines declared a new era of AI-powered cyber warfare.
CovertSwarm’s offensive team builds and deploys AI-assisted attack frameworks, and assessed the report from that practitioner perspective. Their conclusion at the time: the techniques weren’t new, but the speed and scale were. Validation on an annual cycle was already out of step with the pace of the threat.
This briefing explains what changes when AI drives the attack chain, what doesn’t, and the 30 and 90 day plan we recommended for CISOs.
It was hyper-automation, not new attacks.
The attack chain in the report was reconnaissance, vulnerability discovery, credential harvesting, lateral movement and exfiltration. Red teams and bug bounty hunters had automated the same tools for years. The difference was that an LLM was making the tactical decisions instead of a human.
Our view: if your controls stop manual attacks, they stop automated ones, provided they’re working continuously.
Faster, noisier and cheaper to run.
The briefing expected tasks that took experienced attackers days to take hours or minutes, lower-skilled actors to run mid-level attacks, and SOCs to face more scanning, alerts and telemetry.
The answer wasn’t more tooling. It was better signal-to-noise filtering and automated triage, so analysts see what matters.
Point-in-time testing couldn’t keep up.
If an attacker can scan and exploit your environment in hours, what is a test from three months ago worth? Infrastructure changes and configurations drift, often within weeks of the last assessment.
The briefing set out three actions for the first 30 days and three strategic shifts for the following 90, starting with continuous validation alongside traditional penetration testing.
Stop testing.
Start knowing.
You’ll know exactly where you stand, and you’ll be able to prove it. To your board, your regulator, and yourself.
Transform to a proactive, continuous offensive security program
Your budget is aimed at the risk that matters, not the one you were handed
You show the board what security prevented, not a request for more
Security clears the way for the business to move faster
You enter the boardroom in command
It starts with a 30-minute Attack Discovery call.
No access to your systems required.