Revving Up but Not Going Anywhere in the AI Arms Race?

While policymakers and industry players are focused on frontier AI’s ability to discover new vulnerabilities, the far more immediate risk – especially for SMBs – is how AI is being used today to dramatically industrialize the majority of cyber-attacks that rely on existing weaknesses, such as phishing and social engineering, among others.

In July 2026, the US Commerce Department issued an export control directive ordering Anthropic to suspend all access to its most advanced models, Fable 5 and Mythos 5, citing concerns that their cybersecurity capabilities could be misused.

Closer to home, Singapore’s Coordinating Minister for National Security K Shanmugam has similarly flagged that threat actors are increasingly using frontier AI to aid cyberattacks, and that Singapore's critical infrastructure sectors are "high-value targets".

Sure, national security implications of frontier AI have never been more visible than over the last few months, but what should SMBs really be concerned about?

Arctic Wolf's 2025 Trends Report found 70% of Singapore businesses surveyed suffered a breach in the past year, while the nation’s Cyber Security Agency noted that three in five ransomware attacks hit SMBs.

Are organizations focusing too much on hypothetical frontier AI risks, while missing the reality of AI being used to scale everyday cyberattacks? We find out in an interview with Laura Ellis, Senior Vice President, Artificial Intelligence, Arctic Wolf.

Ellis says organizations should prioritize automated monitoring and human oversight over hypothetical zero-day scenarios.

As AI is making routine cyberattacks faster, more localized and easier to launch, she argues that organizations, particularly SMBs, should focus less on dramatic zero-day scenarios and more on phishing, social engineering, credential abuse and unpatched systems.

Why zero-day risks receive disproportionate attention

When asked whether policymakers and industry leaders are focusing too heavily on frontier AI’s ability to discover new vulnerabilities while overlooking the way AI is already scaling familiar attack methods, Ellis says attackers generally pursue the highest return on investment, making existing weaknesses more attractive than the expense of finding and exploiting a novel zero-day vulnerability.

Not every cyberattack involves a shadowy elite squad deploying a flawless, never

—Laura Ellis, Senior Vice President, Artificial Intelligence, Arctic Wolf

The far more immediate risk, especially for SMBs, is the frequency of attacks targeting existing weaknesses.

Ellis states categorically that a security team's most pressing challenge is, and always will be, the fundamental need to find and prevent immediate, everyday threats.

Our data clearly backs this up. When we surveyed nearly 2,000 IT and security practitioners for the 2025 edition of our AI Cybersecurity report, we found that organizations are firmly waking up to this reality.  We need to stop obsessing over edge cases and start focusing on protecting the foundational infrastructure.

—Laura Ellis

AI turns routine attacks into scalable operations

Ellis describes AI as a force multiplier that helps threat actors automate labor-intensive parts of cybercrime. Phishing campaigns can now produce large volumes of localized messages without the grammatical errors that previously exposed some fraudulent emails.

The same automation can support credential abuse and vulnerability scanning by examining many networks, identifying unpatched legacy systems and launching credential-stuffing attacks at speed.

Now, a low

—Laura Ellis

Malicious AI tools can scan thousands of networks simultaneously, identify unpatched legacy systems, and launch automated credential-stuffing attacks with terrifying speed and precision.

This dramatic shift, she says, is why 48% of organizations Arctic Wolf surveyed stated that the attackers’ use of AI is directly increasing their own sense of urgency to adopt the technology.

The adversary is using AI to achieve accuracy quickly, and legacy defense strategies simplycannot keep pace with that kind of volume.

—Laura Ellis

Security priorities for SMBs

While governments and large organizations are revving their AI engines to ready themselves and the digital economy for the onslaught of frontier AI cyberthreats, what should SMBs be concerned about?

For SMBs with limited cybersecurity resources, Ellis recommends prioritizing capabilities that address simultaneous, automated campaigns rather than attempting to counter every possible frontier-AI scenario.

Her first priority is 24x7 security operations automation, including continuous threat detection and initial triage to reduce the time between identifying an incident and containing it.

Because these automated campaigns hit simultaneously at any hour, you need AI

—Laura Ellis

Why human oversight remains essential

Ellis’s second priority is a strategic human-AI partnership. She says automated systems can sort through very large volumes of events and flag anomalies, but human analysts remain necessary to validate alerts, add context, provide strategic oversight and execute responses.

She likens AI to a powerful instrument such as the hammer: it can build or it can break, depending on the skill of the user.

AI cannot operate in a vacuum. While it excels at sorting through trillions of events to flag anomalies, you absolutely need human analysts to step in as alert validators to provide context, strategic oversight, and execution.

—Laura Ellis

She concludes that the organizations that successfully pair automated toolsets with trusted partners and human expertise to shut down attacks before they turn into breaches will be the ones that will win the cybersecurity AI arms race.