Unit 42 details recent threat intelligence, highlighting cyberespionage, financial extortion, and the rapid adoption of AI across offensive workflows.
Source: Palo Alto Networks Unit 42 · 2026-11-02
Tag: threat intelligence
-
Deploying AI agents securely: how Kaspersky products mitigate AI threats
Introduction
AI agents and associated tooling are becoming increasingly common in corporate infrastructure. Agents can perform a range of actions with the user’s privileges, such as accessing data, running commands, and interacting with external services. This creates new security risks, especially when these tools are used without the security team’s oversight or well-designed policies.
Detecting, tracking, and controlling AI agents is becoming one of the most pressing tasks for security teams today. We closely follow technological developments and continuously update our solutions to respond to new threats in a timely manner amid a rapidly changing technology landscape. This post describes new expertise built into Kaspersky products that helps counter the threats posed by the proliferation of AI agents. We approach this problem from several angles.
First, you need to thoroughly understand the threat you are dealing with. To this end, we added profiles to the Kaspersky Threat Intelligence Portal that describe various AI agents and how attackers exploit them. At their core, AI agents are programs (processes) that run in the operating system on endpoints and can also launch other processes. This means that Endpoint Detection and Response solutions are among the key endpoint controls for this threat. These solutions detect the presence and launch of AI agents, track their activity, and identify potentially dangerous behavior. When needed, they also take action, such as stopping a suspicious process, blocking the activity, or isolating the host, to reduce the likelihood of an incident escalating. For this purpose, we developed specially adapted detection rules.
You can use Kaspersky Endpoint Security, now also available as Kaspersky Next, to control and restrict the launch of AI agents. This solution uses two components to detect AI agents and control how they are used. Application Control categorizes the application processes launched on endpoints, and Web Control manages access to specific categories of web resources for users on endpoints.
Finally, even harmless AI agents can contain malicious instructions (skills), such as those downloaded from unsafe external sources. Kaspersky Scan Engine analyzes installed applications to detect these threats and also checks LLM files for malicious code. Let’s take a closer look at these solutions and technologies.
Popular AI applications and services in organizations
Tools from Anthropic and OpenAI take the top spots in the September 2026 ranking of AI agents by popularity among Kaspersky users. This list is based on telemetry from Kaspersky solutions. It shows the number of users who had the relevant AI vendors’ products installed at the time of the study.
# AI product 1 Claude 2 Claude Code 3 Codex 4 OpenCode 5 Zed 6 Wispr Flow 7 LM Studio 8 ZCode 9 Chatbox 10 Cherry Studio The data shows that agentic systems, especially AI agents for software development, are the most popular AI applications. The TOP 10 also includes an application for running large language models locally (LM Studio) and a voice note-taking app (Wispr Flow).
According to open sources, these are the most widely used AI services in 2026:
# AI service 1 ChatGPT 2 Google Gemini 3 Claude 4 Grammarly 5 DeepSeek While analyzing the most popular and widely used apps, our experts also noticed a sharp rise in vulnerable versions of AI-related software and services. From 2025 to date, more than 2500 vulnerabilities have been published:
Number of published vulnerabilities in LLMs, AI tools, and plugins with similar functionality, 2025–2026 (download)
* Data for previous quarters was updated and may differ slightly from previously published data.
Application Control and Web Control
To enforce the organization’s security policy for AI agents and other AI applications on the corporate network, Kaspersky products offer application control based on KL categories. These categories classify installed software and give you granular control over which approved applications can run in the organization.
Application Control analyzes the processes launched on endpoints, tracking which AI agents are running in corporate systems at any given moment, on which hosts, and under which accounts. Application Control also shows how long a given program has been in use.
This makes it easier for the Kaspersky Security Center (KSC) administrator to control applications. Administrators can use KL categories to allow or block AI agents inside the company for specific groups of employees.
Here is what this functionality looks like to KSC administrators:
KL categories available when configuring Application Control
For details on how to configure Application Control in KSC, follow this link.
In Kaspersky Endpoint Security (KES), Application Control can operate in two modes:
- Denylist. In this mode, Application Control lets users run any applications except those blocked by Application Control rules. This is the default mode.
- Allowlist. In this mode, Application Control blocks users from running any applications except those explicitly allowed by Application Control rules.
Below are the steps to configure Application Control to block AI tools.
Configuring Application Control for the AI Tools category in KES
With this setup, when a user tries to launch an AI agent, they get a notification and the agent doesn’t start.
KES notification about an attempt to launch an AI agent
For more on how to configure Application Control in KES, follow this link. Our public portal also lets you explore information on KL categories and the applications that fall under them, in particular details on how AI agents are categorized and how popular they are.
AI Tools KL category
The View applications drop-down list shows products for a specific vendor.
Similarly, Web Control lets you manage user access to web resources. If a user tries to open a denylisted website, KES blocks access and shows a warning.
KES notification about an attempt to access a prohibited web resource
When configuring access, the administrator can block websites that provide AI as a service.
Website categories
For more on configuring Web Control, follow this link. The help portal also provides information on website categories that can be assigned to resources to configure access control.
Kaspersky Endpoint Detection and Response
To an EDR solution, an AI agent is a regular process. It has its own executable, a tree of child processes, and network communications, all of which need to be monitored for suspicious activity. An attacker can use an AI agent as an automation tool. An AI agent installed as a legitimate user tool can also be leveraged in a ClickFix attack, where it executes a malicious instruction received from an untrusted source, such as a document, web page, or email. That said, unsafe actions by an agent do not always indicate an attack. There may be no malicious intent in the chain at all. An incident can result from what looks like an ordinary instruction from a user who doesn’t fully understand the consequences of having it executed. The mere fact that an agent was launched does not reveal whether it is being used in an attack. That is why Kaspersky EDR (KEDR) uses both conventional behavioral rules and rules written and adapted to detect AI tools. The latter identify risky agent actions and settings, and help determine which AI tool was involved in suspicious activity.
Conventional KEDR rules detect the vast majority of familiar malicious techniques, including when performed by an AI agent. A suspicious PowerShell launch, persistence via Task Scheduler, or an attempt to steal credentials leaves clear, identifiable traces. These traces look the same no matter what initiated the actions. The rules analyze launch parameters, process relationships, affected files, network activity, and other telemetry events.
For example, in a recent Armored Likho campaign, we found signs that AI had been used to create loader and dropper samples, which were later compiled with NSIS (Nullsoft Scriptable Install System). The key telltale artifacts were icons in the scripts and excessive comments on every function, which is uncharacteristic of human-written code. In addition, the group continues to generate new modules for its BusySnake Stealer and BusySnake RAT samples. For example, the attackers used AI to develop a module that runs multiple checks for virtual environment artifacts and calculates a score. Depending on the score, the sample either runs or exits with code 0. Even though the initial access samples, payloads, and their modules were AI-generated, the commands they execute via rundll32 and PowerShell are detected by the shell_creation_by_rundll32 and suspicious_powershell_cmd_or_script_spawning rules.
So, for detecting an attack like this, it is not important who wrote the loader, the payload, or its modules: they are given away by the commands they execute, process relationships, and other traces of activity in the system. AI can be involved both in preparing the code and in carrying out the attack directly on the device.
In the latter case, the attacker uses the agent to carry out their tasks and lets it choose and run the required commands within the privileges it has. For effective protection, it is critical to link suspicious actions back to the AI tool and the conditions under which it operates. In KEDR, several specialized rules handle this task.
We have created separate rules for popular AI agents, ai_agent_*_access_to_sensitive_file_**, where * is the tool name and ** is the operating system. They generate alerts when an agent accesses files that contain credentials, tokens, or keys.
The ai_agent_dangerous_execution_mode rule detects agents launched with auto-approval of all actions (so-called YOLO mode) or with the sandbox disabled. These settings do not indicate an attack on their own, but they let the agent perform dangerous actions without user confirmation.
The suspicious_mcp_server_artifact rule triggers when MCP server scripts are created or modified in hidden, temporary, or cache directories. Attackers can place an MCP server in these locations to quietly connect it to the agent: through the MCP server, they can pass instructions to the agent, call third-party tools, and access the user’s data.
The llm_api_access_by_unusual_apps rule generates an alert when an application on Windows, Linux, or macOS connects to the API of a known external LLM service, unless this activity falls under predefined exclusions. This helps spot model access by applications that do not normally behave this way.
Some Kaspersky EDR rules tag events for investigation but do not generate alerts. For example, the
ai_agent_**_executionrules flag launches of known agents on Windows, Linux, and macOS. The local_ai_model_artifact rule records the creation or modification of AI model files in typical application, runtime, and cache directories. These events reveal AI tools on the device, including tools that run on local models and never call an external API.Kaspersky Threat Intelligence Portal
AI agent profiles
The Kaspersky Threat Intelligence Portal offers a large number of software profiles, including profiles of AI agents. You can sort them by the
ai_prefix:
AI agent profiles on Kaspersky TIP
The profile of an AI agent such as Claude Desktop includes a detailed description of the software, the privilege level required to run it, supported platforms, and threat actor groups known to use it. It also lists tactics and techniques mapped to the MITRE ATT&CK framework, with descriptions of the procedures the tool can be used for.
Claude profile on Kaspersky TIP
The description also lists ways to detect the software through standard system auditing mechanisms:
- Windows: events from standard audit logs and Sysmon events
- Linux: syscall audit events and Sysmon events
- Network auditing: a set of protocols and the traffic generated by the software
The detection section lists the main artifacts the software leaves in the system: command lines, possible launch parameters, names of the services and scheduled tasks it creates, and the key network artifacts.
Detection section in the Claude profile
Hunt Hub
In December 2025, the Kaspersky Threat Intelligence Portal added Hunt Hub (HH), a repository of detection rules. This is a unique Kaspersky project, and we developed it in response to growing market demand.
This functionality is available in the Threat Landscape section of the portal. It gives analysts access to detection rules: their descriptions and their mapping to MITRE ATT&CK tactics and techniques, as well as to the associated cybercriminal groups.
In the Hunt Hub section, customers can explore the detection logic of EDR, NDR, and NGFW products, including the logic for detecting AI agents.
Rules in the Hunt Hub repository
The rule card provides:
- Detailed description
- Rule’s severity level, confidence level, and alert format
- Detection tips
- Description of possible false positives
- Platforms the rule can run on
- Tactics, techniques, and sub-techniques covered by the rule
- Groups that use the technique covered by the rule
- Detection logic that shows what exactly triggers the rule
Detection rule card in Hunt Hub
Kaspersky Scan Engine
Skills are a key component of the AI agent ecosystem. They’re prewritten sets of natural-language instructions that extend agent functionality. We previously covered the risks that malicious skills pose to agent users. A skill can require the usage of additional programs and services, come with helper scripts (for example, written in Python), or contain a malicious command embedded right in the instruction text. This means that adding skills to an originally harmless AI agent opens up several new ways for malicious code to enter the system. To prevent this, any skills obtained from external sources must be scanned. Kaspersky Scan Engine is well suited for this task. This is a cyberthreat detection and response solution that seamlessly integrates with various applications. It can detect malicious code in agent skills, associated scripts, and in files generated by running agents.
Detection of a malicious agent skill in Kaspersky Scan Engine
Trained LLMs come in many formats. Some of them (PTH, PT, PKL, KERS, and others) also store parameters and weights (training datasets). These files can also contain malicious code, so it’s critical to scan them before running and using them. Kaspersky Scan Engine scans potentially dangerous LLM formats for infected data. It can deserialize and analyze models to detect malicious code regardless of model size.
Detection of an LLM with malicious code in Kaspersky Scan Engine
Conclusion
AI agents are rapidly making their way into corporate environments: they help employees work faster and take on a wide range of tasks, but they also open up new opportunities for attackers. To take advantage of this technology without compromising security, organizations need to build multi-layered protection and minimize risks. A range of Kaspersky solutions can help with this:
- Kaspersky TIP keeps you up to date on current scenarios in which attackers use AI agents, and its Hunt Hub section provides rules for detecting suspicious AI agent activity.
- Kaspersky EDR detects AI agents in the infrastructure and monitors their activity on endpoints. If it detects potentially dangerous actions, the product can log the event, notify the SOC, and take response actions, such as stopping the process or isolating the host.
- Application Control in Kaspersky products can fully restrict the use of AI agents within the company by using application categorization. The Web Control component can restrict access to AIaaS web resources.
- Kaspersky Scan Engine can be integrated into various company processes to detect malicious code in any files, including AI agent skills and LLMs.
When companies combine the tools described above in a comprehensive approach, they can adopt AI agents in an informed way: with an understanding of the associated risks and effective means of minimizing them.
Source: Securelist (Kaspersky GReAT) · 2026-10-26
-
Preparing for 2027: Five Trends Shaping Enterprise Threat Intelligence
Table Of Contents
In the first half of 2026, Flashpoint tracked more than 22 million threat actor posts discussing, sharing, or advertising AI toolkits for criminal deployment. The figure reflects AI’s growing presence across the cybercriminal underground, where adversaries are using new capabilities to accelerate attacks and develop malicious tooling with fewer resources.
For enterprise defenders, these developments are adding pressure to threat intelligence programs already managing high alert volumes, limited analyst capacity, and expanding responsibilities.
During Flashpoint’s recent webinar, we examined the evolving threat landscape alongside findings from Flashpoint’s Global Threat Intelligence Report: 2026 Midyear Edition and new enterprise threat intelligence research.
Missed the live webinar? We’ve rounded up the key takeaways below, and the full session is now available to watch on demand.
AI Is Changing the Economics and Speed of Cybercrime
AI is helping threat actors develop capabilities and execute attacks faster, reducing the time and expertise required for activities that previously demanded greater resources.
Several developments illustrate the broader shift in cybercrime economics and attack velocity:
- Initial access costs have declined by approximately 69%, reflecting the continued commoditization of access to compromised environments.
- Attackers published 637 malicious package versions in just 22 minutes during a software supply chain compromise.
- Nearly one in five vulnerabilities disclosed during the first half of this year had public or functional exploit code available, narrowing the window for defenders to address exposed systems.
AI is primarily accelerating established techniques, particularly during the early stages of the attack chain, including reconnaissance, social engineering, vulnerability discovery, and exploitation.
For defenders, this creates an opportunity to identify and disrupt malicious activity during its preparation stages. However, it also raises expectations around how quickly intelligence teams can recognize emerging threats, prioritize relevant findings, and act before an attack progresses.
AI Is Changing How Cybercriminals Develop Tools and Share Knowledge
AI is also changing how threat actors acquire the skills and capabilities needed to carry out attacks, creating new challenges for intelligence collection.
Historically, underground communities enabled cybercriminals to collaborate, exchange expertise, and obtain specialized services. Increasingly, threat actors can use AI to troubleshoot code, develop malicious tooling, and learn unfamiliar techniques independently, reducing their reliance on public collaboration.
Reduced activity in underground communities does not necessarily mean cybercriminal activity is declining. While forums, encrypted messaging platforms, and other illicit communities remain important intelligence sources, collection strategies must account for changes in how and where adversaries develop and distribute their capabilities.
Threat Intelligence Teams Are Struggling to Keep Up with Growing Demands
As adversaries accelerate their operations, enterprise threat intelligence teams are contending with growing workloads and limited resources.
Independent research commissioned by Flashpoint surveying threat intelligence budget owners and influencers at large North American enterprises identified several leading operational challenges:
- 65% cited alert noise and false positives.
- 55% identified analyst bandwidth and effectiveness.
- 50% pointed to the evolving threat landscape.
- 50% cited tool integration and interoperability challenges.
Note: Respondents could select up to three challenges.
High alert volumes, disconnected systems, and manual investigations consume analyst time that could otherwise be spent addressing emerging threats.
As one healthcare threat intelligence leader explained:
“Good analysts take time to develop and train, and we can’t hire our way out of that problem.”
These challenges are prompting organizations to examine how they can improve existing workflows, reduce repetitive investigations, and make better use of analyst expertise.
Threat Intelligence Budgets Are Growing, with AI Threats Leading Investment Priorities
Despite operational pressures, organizations are continuing to invest in threat intelligence.
Flashpoint’s research found that 50% of respondents expect their threat intelligence budgets to increase over the next 12 months, including 35% anticipating increases of at least 10%. Another 40% expect budgets to remain essentially flat, while 0% anticipate a decrease.
AI-related threats emerged as the leading priority for expanded intelligence coverage, particularly:
- Deepfakes and synthetic media, including their use in impersonation, fraud, and social engineering.
- AI-accelerated vulnerability exploitation, as adversaries identify and exploit weaknesses more quickly.
- Emerging AI-enabled attack vectors, including changes in threat actor tactics, techniques, and procedures.
Organizations are also investing in additional intelligence feeds, expanded security use cases, and further development of their intelligence programs.
These priorities reinforce the importance of translating AI-related threats into specific intelligence requirements aligned with organizational risk.
Agentic AI Adoption Is Underway, but Trust and Measurable Value Remain Essential
Alongside investments in AI-related threat coverage, organizations are exploring how agentic AI can improve their own intelligence operations.
Flashpoint’s research found that:
- 25% are already using agentic AI in production.
- 20% are piloting agentic AI or conducting proofs of concept.
- 35% are planning adoption within the next 12 to 24 months.
- 20% are taking a wait-and-see approach.
Early implementations focus primarily on information retrieval, alert prioritization, contextual enrichment, intelligence platform queries, and MITRE ATT&CK mapping.
Organizations remain more cautious about granting agents autonomy over consequential actions, such as blocking IP addresses or changing security controls.
One research participant captured the concern:
“An agent that’s confidently wrong is worse than one that’s slow.”
Accuracy, data privacy, auditability, predictable costs, and human oversight remain central considerations. Organizations also expect AI investments to demonstrate measurable value through time savings, improved efficiency, and faster response.
Preparing Your Threat Intelligence Strategy for 2027
As organizations prepare for 2027, four priorities can help guide threat intelligence planning:
- Plan for threats you cannot readily observe. Identify potential gaps in intelligence collection and examine emerging attack methods, including weaknesses in internal security processes.
- Prepare for machine-speed attacks. Evaluate detection, prioritization, and response capabilities against increasingly compressed attack timelines.
- Turn AI threats into actionable intelligence requirements. Map emerging techniques to relevant adversaries, established frameworks, defensive controls, and business risks.
- Use agentic AI where it can extend analyst capacity. Prioritize repeatable workflows that deliver measurable value while maintaining appropriate data controls and human oversight.
Watch 22 Million Reasons to Rethink Your 2027 Threat Intelligence Strategy for a deeper look at the cybercriminal underground, enterprise threat intelligence investment trends, and practical considerations for agentic AI adoption.
See Flashpoint in Action
Source: Flashpoint · 2026-10-22
-
Top 5 Initial Access Threat Vectors Observed by Unit 42 in September 2026
Unit 42 details the top initial access vectors adversaries use to breach organizations, led by edge exploits, credential abuse and phishing
Source: Palo Alto Networks Unit 42 · 2026-10-16
-
The Enterprise Threat Intelligence Report: 2026
Table Of ContentsThreat intelligence teams are heading into 2027 with more than ever to monitor, driven by an acceleration in the AI threat landscape. However, their expanded mandate typically doesn’t come with a proportional budget windfall. Instead, teams are under pressure to get greater value from the intelligence, systems, and analyst expertise already available to them.
New independent research commissioned by Flashpoint shows where that pressure is being felt most. Alert noise and false positives are the most frequently cited challenges affecting threat intelligence program effectiveness, followed by analyst bandwidth, changes in the threat landscape, and integration across security tools. At the same time, AI-related threats have emerged as the leading area where practitioners want to expand intelligence coverage.
These findings point to some of the decisions that will shape threat intelligence programs in the year ahead: where to focus finite analyst capacity, how intelligence requirements need to evolve, and where AI can meaningfully support the work. Organizations are already evaluating agentic AI across threat intelligence workflows, but the research also shows that greater autonomy comes with higher expectations around accuracy, control, and measurable value.
For security leaders planning their 2027 threat intelligence strategy and budgets, this report examines:
- Which operational challenges are putting the greatest pressure on analyst capacity and threat intelligence programs today.
- How intelligence requirements are changing as AI-enabled threats create new coverage priorities.
- How threat intelligence budgets are trending in the next 12 months, and where incremental budgets will go.
- Where practitioners see the strongest applications for agentic AI, and which AI-powered workflows face a higher threshold for trust and autonomy.
- What teams need to prove before expanding AI investment, including the metrics practitioners are using to evaluate time savings, accuracy, risk reduction, and ROI.
Together, the findings provide a practical benchmark for teams evaluating their own intelligence operations: where to focus limited analyst time, where automation may have the greatest impact, and what to measure as AI becomes part of the workflow.
Executive Summary
As threat intelligence teams plan for 2027, the research shows them managing two simultaneous pressures: intelligence requirements are expanding, while the capacity available to address them remains constrained. AI is intensifying that pressure as adversaries adopt new capabilities, but also becoming part of how organizations are thinking about scaling their ability to defend their organizations.
Four findings stand out:
- The AI threat landscape is accelerating faster than threat intelligence teams can keep up. Alert noise and false positives were the most frequently cited challenge, identified by 65% of respondents, while 55% cited insufficient analyst bandwidth and half pointed to integration gaps across their security tools.
- Threat intelligence budgets are rising to close the gap. Half of respondents expect their budgets to increase over the next 12 months, including 35% anticipating meaningful increases of 10% or more. Another 40% expect spending to remain essentially flat. No respondents anticipate a decrease. Where budgets are growing, organizations are directing investment toward areas including AI-related threat coverage, additional intelligence feeds and modules, and broader program development.
- AI-related threats are the leading priority for expanded coverage and new investment. Practitioners pointed to deepfake detection, AI-accelerated vulnerability exploitation, and emerging AI-enabled threat vectors as areas where their intelligence requirements are expanding.
- Agentic AI adoption is underway, but teams are setting a high bar. Just 25% of organizations interviewed are using agentic AI in production today. Another 20% are piloting it, while 35% are planning adoption within the next 12 to 24 months. Rather than rushing toward autonomy, teams are evaluating where agents can improve workflows while maintaining intelligence quality, appropriate controls, and human oversight.
Taken together, the findings show where threat intelligence teams are feeling the greatest pressure, where they see opportunities to extend their capabilities with AI, and what will determine whether those tools earn a lasting place in the intelligence workflow. The sections that follow examine each of these findings in greater detail and what they mean for threat intelligence programs.
Operational Challenges Are Putting Pressure on Analyst Capacity
The rising AI threat landscape is increasing pressure on organizations to get more capacity from the people and systems they already have. Threat intelligence leaders therefore say the biggest barriers to program effectiveness are operational: too much noise, limited analyst bandwidth, and disconnected tools.
Alert noise and false positives emerged as the leading challenge affecting threat intelligence programs, cited by 65% of respondents. Analyst bandwidth followed at 55%, while half of respondents pointed to both the evolving threat landscape and integration gaps across their security tools.
The impact of these challenges becomes clearer at the workflow level. One healthcare practitioner described receiving alerts about email breaches that were seven or eight years old, with the same data resurfacing each time it was resold and requiring another investigation. Practitioners also described manual steps between intelligence feeds, SIEMs, SOAR platforms, ticketing systems, and response workflows.
Each unnecessary investigation or manual handoff consumes time that could otherwise go toward analysis. That becomes difficult to solve through hiring alone because threat intelligence expertise takes time to develop. As one healthcare threat intelligence leader explained:
“Good analysts take time to develop and train, and we can’t hire our way out of that problem.”
The research suggests an opportunity to look for capacity within the intelligence workflow itself. Reducing repetitive investigations, improving integration between systems, and helping analysts identify relevant intelligence faster can return more of their time to work that depends on context and judgment.
Threat Intelligence Investment Remains Resilient Heading Into 2027
The rise of AI-driven threats is driving increases in the intelligence budgets of many organizations. Among respondents who provided a budget outlook, 50% expect their threat intelligence budgets to increase over the next 12 months, while the remaining 40% expect budgets to stay essentially flat. None anticipate a decrease.
More than a third (35%) expect meaningful growth of at least 10%, suggesting that for many organizations, threat intelligence remains an area of active investment heading into 2027.
Where organizations are increasing investment is equally important. Respondents expecting meaningful growth described spending on AI defense capabilities, expanded threat intelligence feeds and modules, and broader program development. AI-related threat coverage also emerged across both flat and growing budgets as the most frequently cited area where teams want to expand coverage.
For teams heading into 2027, the findings suggest that the question is increasingly where to direct threat intelligence investment for the greatest impact. Organizations are evaluating how existing resources can address new intelligence requirements, where additional capabilities are needed, and which investments can demonstrate clear operational value.
AI-Related Threats Are Driving New Coverage Priorities
As organizations decide where to focus threat intelligence investment in the year ahead, AI is the clear priority. AI-related threats were the most frequently cited area where organizations want to expand intelligence coverage, including among teams with relatively flat budgets. Practitioners specifically pointed to deepfake detection, AI-accelerated vulnerability exploitation, and emerging AI-enabled threat vectors.
These priorities reflect activity already visible across the threat landscape. During the first half of 2026, Flashpoint tracked more than 22 million threat actor posts discussing, sharing, or advertising AI toolkits for criminal deployment. Flashpoint analysts observed AI being used across phishing, malware development, evasion, and vulnerability exploitation.
For threat intelligence teams, expanding AI coverage requires more specificity than treating “AI threats” as a single monitoring category. Deepfakes may matter because of executive impersonation or fraud. AI-accelerated exploitation may change vulnerability monitoring and prioritization. New attack tooling may affect the adversaries or TTPs a team already tracks.
The challenge extends beyond visibility into these threats. Organizations also need the expertise to understand how AI is changing adversary behavior and attack chains. That expertise is still developing. As one practitioner put it, “everybody’s learning it at the same time.”
Connecting those developments to existing PIRs and business risks gives analysts clearer collection priorities and helps teams determine what new sources, expertise, and monitoring they actually need.
Those requirements are also expanding at a time when analyst bandwidth is already constrained, creating a second question for threat intelligence leaders: where can AI support the intelligence workflow itself?
Agentic AI Adoption Is Underway
Nearly half of the organizations interviewed are already using or piloting agentic AI in threat intelligence workflows, while another 35% are planning adoption within the next 12 to 24 months. That makes agentic AI an important part of 2027 planning, but despite the attention surrounding it, threat intelligence teams are taking a measured approach. They are looking for clear business value, evidence that AI can maintain the quality of their intelligence workflows, and appropriate human oversight as agents take on more consequential tasks.
The work being handed to agents already varies considerably, from information retrieval and alert prioritization to more active tasks such as blocking IP addresses, updating blacklists, and monitoring suspicious traffic. Organizations in the pilot stage also described use cases spanning detection, validation, context generation, SIEM alert analysis, TIP querying, MITRE ATT&CK mapping, and reversible response actions.
As agents move from retrieving and analyzing information to taking actions that can directly affect security operations, accuracy and trust become increasingly important. One respondent captured the concern succinctly:
“An agent that’s confidently wrong is worse than one that’s slow.”
That concern is reflected across the research. Practitioners raised questions around data leakage, auditability, regulatory requirements, cost, and the level of control agents should have over security workflows. One retail respondent, for example, would only consider read-only AI assistants because of the risks associated with granting agents write permissions.
For teams evaluating agentic AI, that makes the workflow itself an important part of the decision. Tasks with reviewable outputs, reversible actions, and clear success criteria provide a practical starting point. As autonomy increases, teams need equally clear controls around what an agent can access, what it can change, where human approval is required, and how its actions are audited.
What the Findings Mean for Threat Intelligence Programs
As threat intelligence leaders plan for 2027, the research points to a clear set of priorities. Teams have more to monitor, limited analyst capacity, and growing interest in AI as a way to scale the work their programs already perform.
The findings also show that practitioners are selective about where they see that value. PIR coverage monitoring and intelligence briefings can extend coverage and reduce recurring work while keeping analysts involved in the intelligence process. As agents take on more consequential actions, questions around accuracy, permissions, auditability, and human oversight become more important.
For teams setting priorities for the year ahead, that creates a practical path forward: understand where analyst capacity is being consumed, connect new intelligence requirements to the risks that matter to the organization, identify workflows where automation can meaningfully extend the team, and establish clear measures of success before deployment.
The challenge for 2027 will be turning expanding intelligence requirements into an operating model that can scale for threat intelligence programs. That means making better use of existing data, systems, and analyst expertise while being deliberate about where agentic AI can extend those capabilities and where human judgment remains essential.
Methodology
Flashpoint commissioned independent qualitative research among a select group of more than 20 threat intelligence budget owners and influencers at large North American enterprises across financial services and insurance, healthcare and biotech, retail, and information technology and telecommunications during the early fall of 2026.
See Flashpoint in Action
Source: Flashpoint · 2026-10-13
