Executive Summary
AI-accelerated vulnerability discovery is inverting the defender-attacker asymmetry—collapsing the gap between vulnerability discovery and exploitation to near-zero while enabling resource-constrained state actors to achieve nation-state-level effects without proportional investment. Vulnerability exploitation as an initial access vector increased 34% in 2025, and cybersecurity spending projected at $240B in 2026 cannot close the gap against attackers operating at machine speed. Absent AI-native defense investment, this structural mismatch will persist and widen. Analytic Confidence: MODERATE — evidence is recent and multi-sourced, but most observed AI use by threat actors remains human-in-the-loop rather than fully autonomous.
Key Finding
AI-accelerated vulnerability discovery will fundamentally invert the defender-attacker asymmetry by collapsing the gap between vulnerability discovery and exploitation to near-zero, creating an asymmetry where defenders must invest continuously while attackers operate at machine speed—a dynamic that will persist without countervailing AI-native defense investment [Source: SentinelOne, 2026-02]. For resource-constrained state actors, autonomous AI agents (HACCAs) will relax traditional operator constraints by enabling a single deployment to perform the equivalent work of an entire organization, allowing attackers to set agents loose against entire sectors unsupervised [Source: Just Security, 2026-03].