‘It's the AI cybersecurity apocalypse for threat actors’: Five ways CISOs can use ‘dark AI’ to their own advantage

Gartner analyst Leigh McMullen stands on a stage, lit in blue lights with slides behind him, as he gives a presentation to a full auditorium — (Image credit: ITPro/Ana Martins)

Threat actors are increasingly using AI in their attacks, with a 34% increase in vulnerability exploitation last year being a clear sign, according to Verizon’s data breach investigation report. Cybersecurity risk is only going to get worse before it gets better, as Gartner predicts that vulnerability discovery will “skyrocket” in the next few years.

While weaponized use of AI, also known as ‘dark AI’, will be a big challenge for CIOs to navigate, it can be more of an advantage than a threat, according to Leigh McMullen, distinguished VP analyst and Gartner fellow.

Speaking at the Gartner IT Symposium/Xpo 2026 in Barcelona, McMullen said CIOs need to start thinking about the questions board members are demanding answers to today, in order to manage the uncertain AI-enabled future confronting them.

Anthropic and the AI apocalypse

When Anthropic released its Mythos Preview in April, it took the sector by storm, catching zero days that no other tools ever had. For McMullen, it meant a flurry of tech leaders blowing up his phone.

1. Automation is a better business case

Cybersecurity has historically competed against threat actors through innovation, but McMullen says they need to be switching to automation instead, because “you can’t out-innovate a crowd”.

While AI may be making attackers faster, he says it’s making them weaker too. “They're becoming increasingly reliant upon AI-assisted kill chains and AI-assisted attack pathways already. That reliance is ultimately going to weaken them.” However, for cyber professionals, he said “automation is what we do for a living”.

As for why automation is a better business case, unlike usual technology investments, “an investment in cybersecurity automation often appreciates in value,” according to McMullen.

“The dollar you invested yesterday covers more tax service tomorrow, covers more revenue tomorrow… more mission service tomorrow than it did yesterday. Thus, it increased in value,” he said. “This is an opportunity for us to finally scale what we do in cybersecurity.”

CSOs are going to know about vulnerabilities before threat actors do, because threat actors don’t share information for free, according to McMullen.

“We're the ones that publish the CAP list. We're the ones that publish the CVE list. We mostly discover vulnerabilities before threat actors do already.”

He said cybersecurity professionals should band together and share insight, as “the more widely exploits are shared, the weaker threat actors become”.

“As we come together as communities of practice within our different industries, casting aside traditional industry competition, so that in cybersecurity we don't compete with each other… This is how we get stronger. This is how we use information latency to our advantage.”

3. AI weaponization latency

“We've got better AI than the bad guys,” and even if they can distill models relatively quickly, we’re still going to have them first, McMullen said.

“Whether that advantage is months or days or weeks or hours or minutes, it's still an advantage. And if they can operate at digital speed, we can operate at digital speed.”

He said the number one barrier CIOs will face is having good patching and vulnerability management. But, AI is already paving the way forward for this.

McMullen is already talking to people about how they can use AI-assisted software reverse engineering to create digital twins of their environment, because “it's not hard to do anymore”.

Using music technology as an example, he explained that over the last 30 days, almost all synthesizers have had end-user customized, end-user created firmware that's been reverse-engineered from the existing production firmware.

“Imagine if you could do that to your OT devices,” he asked the audience. “Imagine if you could do that even outside in mapping cloud and cloud vulnerabilities for your hybrid production environments. We could actually, maybe comprehensively test patches. We could maybe, actually, really do full CI/CD for real.”

4. CISOs know the terrain

Whilst he’s been having conversations about AI-assisted software engineering or reverse engineering, McMullen said Mythos still needs to have access to the source code to be able to find those vulnerabilities, “at least for today”.

Cybersecurity’s primary attack surface is still the open source world, which is great for CIOs, McMullen said, because “you know your terrain”.

“If you know what open source software you have, this gives you a source of advantage. You're the only one who knows your closed source stack, which is definitely a source of advantage.”

He said CIOs can leverage that advantage to gain better insight. “Use dark AI on yourself with AI-assisted pen-testing and red teaming, so that you can begin to find the unknown vulnerabilities that keep boards up at night.”

5. Costs favor defenders in an AI world

Mythos may be able to string together those “incredibly scary and ‘ooh keep me up at night’ seven part kill chains” out of seemingly nothing, but McMullen said the very nature of those complex tools defies their ability to be used at scale.

“They have to be custom to an environment. They have to be custom to a target,” he explained.

He pointed to a friend’s experience with Mythos Preview, finding a four-part kill chain that simply didn’t exist, and could not be configured the way Mythos wanted it to by a human being.

“Just because [Mythos] may be able to imagine some dark things doesn't mean that those dark things are always necessarily going to be meaningful.”

Looking at this landscape, McMullen said the basic token burn is going to be less than that of trying to spam attacks broadly across the internet. While he acknowledged that threat actors will steal tokens, like they steal Bitcoin and other resources, he said ultimately, that greater scale hurts threat actors.

“The larger you become, the easier you are to detect. The easier the easier you are to interdict. This is the AI cybersecurity apocalypse, but not how the doomers think. It's the AI cybersecurity apocalypse for the threat actors. It is, absolutely.”

Resilience is your best attack

Ultimately, to manage this uncertain future, CIOs need to accept that they're going to get attacked, because security breaches aren’t as big a deal as they’re being made out to be.

Gartner is seeing that, six months on, there's little to no earnings per share impact as a result of a breach. Though McMullen said it’s not an excuse to let companies get breached.

“We need to be playing offense,” he said, and the best way to play offense in cybersecurity is with resilience. “If cybersecurity can mitigate the harm of a threat actor, that's the same thing as preventing it, plus or minus a day or a euro or two, with the added advantage of the fact that you can comprehensively test and get better at resilience.”

For McMullen, the latter is key. He urged CIOs to get together with their CISOs and start doing recovery rehearsals, taking routine creation of deployment, test and production environments to real immutable backups. This way, teams would rehearse where those backups are, and what their axis and Bitlocker keys are. With “just a little effort”, teams could practice that resilience and offensive strategy. Effort, which McMullen said can be counterbalanced by AI, so that it becomes easier to do.

“Resilience is one of the things in cybersecurity that you can demonstrate continuous improvement in,” he said. “We can't demonstrate continuous improvement in protection architecture because zero days exist. But if [you] can stand up in front of the board and say, ‘Listen, we rebuild production once a month, once a quarter… Heck, we used Claude code to migrate our entire codebase from one language to another just to see if we can do it’.”

“If you can stand up in front of your board and actually say that with a straight face, then the next time you get a ransomware letter or some sort of data exploit threat letter, you can say, ‘Listen, don't pay the ransom because this doesn't matter’.”