AI Is Speeding Up Attackers, and Wiz Says Security Teams Must Move From Reacting to Hunting

Wiz Research says most security operations centre (SOC) teams only start work after a threat alert fires. By then, something has already happened. That approach was built for a time when attackers moved at human speed and mostly used known exploits.

The article points to two shifts happening together. First, organisations are shipping more custom code than ever, helped by AI-assisted development. These apps can contain logic flaws, such as broken authorisation and authentication bypasses, which signature-based scanners cannot detect. Second, attackers are using AI models to scan for exposed applications and weaponise vulnerabilities in hours instead of months. AI also lowers the barrier to entry, so more attackers can probe custom applications at scale. As a result, the first sign of a logic flaw is often the breach itself.

Wiz's answer is to use AI to fight AI, with continuous threat exposure management and offensive testing. It describes two agents: a Red Agent, an AI-powered attacker that finds and validates exploitable risk and raises it as pre-breach alerts, and a Blue Agent, an AI investigator that helps analysts examine active threats using cloud, code and runtime context. Wiz argues that validated, exploitable exposures deserve the same urgency as an active threat. Note that this summary covers only the opening of the article.