National Security · Cyber Threats & AI
The AI-Enabled Adversary
October 7, 2026 · Analysis
The most important thing AI may be giving attackers is not a new weapon. It is a workforce.
For years, sophistication was a clue about headcount. Extensive reconnaissance, custom tooling, convincing social engineering, and carefully timed execution suggested that different people had brought different skills: someone to find the target, someone to build the tool, someone to research the victim, someone to write the lure. Resources implied a team, and a team usually implied organized crime or a nation-state. That assumption is becoming less useful.
On September 22, 2026, Microsoft published an analysis of EvilTokens, an AI-enabled cybercrime platform linked to more than 12,000 compromised email inboxes across more than 10,000 organizations. The service did not simply help criminals send phishing emails. Once an account was compromised, its AI could analyze the inbox, identify trusted relationships, surface payment conversations, map organizational roles, and identify high-value targets. It could help determine not only what to say, but who to target and why that person was likely to believe it. EvilTokens sold that capability as a service: $1,500 for the initial purchase and $500 a month for continued access. The consequential change is not a new class of cyberweapon. It is the ability to rent the crew.
Business email compromise, phishing, and the message from an executive who is supposedly boarding a plane are all older than the current models. What AI changes is the research, personalization, and labor an attacker can put behind a familiar request. In September, Microsoft disclosed a separate campaign that sent more than one million financial-fraud emails impersonating corporate executives. The messages included fabricated invoices and fake forwarded threads, and they tried to persuade accounts-payable employees to process ACH payments approaching $50,000. Microsoft found multiple indicators consistent with generative AI being used to create and refine the templates.
The old version of that scam says the money has to move immediately. The informed version can work from a real executive, a plausible vendor relationship, a credible amount, familiar wording, and a fabricated thread that supplies context. The request arrives in a workflow where the recipient is already accustomed to acting.
The attack has not become magical. It has become informed.
That is harder to distinguish from an ordinary day at work, and it is where the problem stops being only a cybersecurity story. Firewalls, endpoints, authentication, and patching still matter, but many of the actions an adversary wants are already inside someone’s legitimate authority. A finance employee can transfer the money. An administrator can reset the credential. A researcher can release the file. A program manager can trust a message that appears to come from someone he knows. The attacker does not have to defeat every control around those people. Often the cheaper objective is to understand the organization well enough to persuade an authorized person to act voluntarily. The question is not only whether someone can penetrate the network. It is whether someone can manipulate the people, relationships, information, and authorities already inside it.
That distinction is familiar to Helix Stratus Group managing partner Christopher Serdinak from a 22-year FBI career spanning counterterrorism, counterintelligence, insider threat, and security, including senior leadership in the FBI’s Counterterrorism Division. Those disciplines never treated the wall as the whole environment. They treated the person who already held access, the authority that access conferred, the relationships around them, and the information available at the moment of decision as the security problem. A cleared employee who could be deceived into releasing a file, or persuaded that a request was routine, was already inside the model. AI does not replace that model. It reduces the labor constraint that used to limit who could exploit it. Inbox analysis can surface roles and payment habits, an approach can be written in the victim’s language, and multiple potential targets can be researched in parallel. The insider no longer has to be disloyal to be the path. Often the cheaper route is an employee having an ordinary day.
Microsoft’s 2026 Digital Defense Report puts identity and human behavior squarely in that model. The company says AI is compressing attack timelines and lowering the cost of sophisticated capabilities, while attackers continue to exploit trusted identities, relationships, and services. Microsoft detected more than 46 million business-contact impersonation attacks during the preceding 12 months.
Anthropic’s September threat-intelligence report makes the labor shift harder to dismiss. Across cases involving suspected state-sponsored actors, financially motivated criminals, and politically motivated operators, the company observed AI moving beyond the role of a chatbot. Some actors used multi-agent systems for reconnaissance, exploitation, data processing, and other tasks in parallel, while humans retained important decisions such as target selection and review of results. In one espionage case, operators ran what Anthropic described as agent swarms: a lead AI system dispatching work to multiple subagents, with separate workflows handling reconnaissance, vulnerability research, malware development, and intelligence collection. Another operation maintained 13 standing collection agents running on a schedule. These were selected notable misuse cases, not a representative measure of all attackers.
Historically, ambition was constrained by the number of skilled people available to do the work. Fifty potential targets once meant fifty research jobs competing for the same analyst’s afternoon; agents can increasingly run them in parallel. A criminal without fluency in the victim’s language once risked exposing the scam; a model can reduce that tell. Thousands of stolen messages once required someone to read them, understand the relationships, and locate the useful information; EvilTokens was already automating part of that work. The attacks Anthropic observed still depended heavily on familiar weaknesses—stolen credentials, exposed services, unpatched systems, phishing. The vulnerability may be five years old and the person exploiting it may be ordinary, while the labor available to that person is anything but.
Risk models still quietly assume that attackers have limited time. A sophisticated actor would not spend hours researching a mid-sized company. A criminal group would not assign personnel to map its executives and vendors. A foreign intelligence service would not devote significant resources to every potentially useful researcher or contractor. Sometimes that assumption was correct because the payoff was not worth the labor. When the labor cost falls, the threshold for becoming a worthwhile target falls with it.
Microsoft describes AI as changing the “physics” of cybersecurity: speed, scale, economics, and autonomy. AI can make weaknesses easier to discover, attacks easier to customize, and campaigns easier to scale. That changes the question organizations have to ask. It is no longer only who would devote the resources to targeting them. It is what happens when targeting them requires far fewer resources than it used to.
The wrong conclusion is that organizations should slow adoption until the threat is better understood. HSG’s position is the opposite, and it is Serdinak’s in particular: the United States, industry, and national-security organizations need to operationalize AI faster, not retreat from it. Advancing the capability is the competitive necessity. Waiting is the risk. Detection models can already correlate identity, email, endpoint, cloud, and a colleague’s reported suspicion far faster than a human team walking those systems one at a time. Buying the model is not the same thing as putting it on the decision. A detection platform cannot save a payment workflow in which one believable email can move $100,000, and it cannot compensate for a privileged account nobody revoked. The use of AI that changes the outcome is the one that assembles what the organization already knows and gets it to the person who can still stop the action.
The prior question is which decisions an adversary would want to manipulate: a transfer, a vendor banking change, a password reset, a release of controlled information, a grant of privileged access. From there, the trace becomes ordinary and specific. Who can authorize it? What does normal behavior look like? What outside information would make a fraudulent request convincing? Which signals does the organization already possess? Who sees them? And do they reach the person who can still stop the action?
That distance between information the organization possesses and information available to the person making the decision is what Helix Stratus Group calls the Intelligence Gap™.
Consider the employee looking at the payment request. The executive’s name is correct, the vendor exists, the amount looks reasonable, the project is familiar, and there may even be a convincing email thread. Nothing the employee can see makes the request look obviously fraudulent. From the approver’s vantage point, saying yes may be entirely rational.
Elsewhere, the organization may already possess the facts that would change that decision. An identity system recorded an impossible login. Security saw an unusual authentication event. The domain in the message was registered three days ago. A new device appeared on the account. Another employee reported a similar request that morning. None of those signals has to prove the fraud by itself. Together, they tell a different story—but they may sit in different systems, owned by different teams, while the person with the authority to move the money sees none of them. That is the split an AI-enabled adversary is built to exploit: not necessarily an organization that lacks information, but one that cannot connect what it already knows before someone acts.
The future threat is not necessarily a genius hacker. It may be a very average one who suddenly has a staff.