The Extra Effort You Hate But Need

In a world where everything is urgent, nothing is. So we might as well spend a little extra effort avoiding the risks we can and make peace with the ones we cannot. Sometimes, probably both. 

AI has become the main default topic conversation. People are using it in ways that would have been hard to imagine four years ago, from speeding up real work to making ridiculous memes of animals.

A lot of the discussion is about where this technology is going: assistants that need less guidance, models that can handle increasingly complex tasks, and systems that operate more independently. Those possibilities are exciting. They also come with a less cheerful reality. The same tools can help someone look for vulnerabilities, test stolen credentials, write a convincing phishing message, or target more systems in much less time.

The unwelcomed new era

Just a decade ago, "hacker" had a mysterious, almost respectable meaning. People pictured a computer-savvy loner who might take down a server or leak sensitive information, with talent, code, and probably a high-end untraceable PC.

Anyone who has spent enough time around real systems knows that the reality is a lot less glamorous. It has never taken that much sophistication to cause damage. A few technical tricks and a few social ones were often enough, particularly when systems were built from rough demos, poorly protected credentials, and habits nobody had stopped to question.

Now give those tips and tricks to a generative model with broad access to the internet and the moral compass of a stone, and voilà: your own at-home hacker. That isn’t just speculation. In September 2026, Microsoft described a China-aligned group it calls Storm-0940, using an AI agent built for penetration testing against hundreds of organizations. In several cases, the time from first targeting to privileged access in a victim's cloud was under three hours. Microsoft also tied that same actor to a supply-chain compromise of a ConnectWise multi-tenant application. Hundreds of targets, and a coffee break.

Websites, servers, APIs, cloud environments, and forgotten admin panels are easier to find and probe. A project that skipped basic safeguards may be the first to fall, regardless of whether it belongs to a small company, a major cloud provider, or a government organization.

Microsoft's 2026 Digital Defense Report says the time from a vulnerability showing up in the wild to someone actually using it can be well under 24 hours, At that point, Knowing what you shipped and where it is running becomes pretty important. 

Embracing change

Unfortunately for undisciplined developers, this isn’t going away. We already have a huge amount of infrastructure in production, and the people looking for ways into it now have tools that can help them work faster.

That puts more pressure on some very basic security practices, including the ones teams tend to put off because something else seems more urgent. 

The first necessary change is in us. We need to be more suspicious of the message, link, attachment, or request for access that looks familiar enough to click without thinking. Employees are still the easiest ways into an organization, No organization will eliminate human error,  but the point is one mistake doesn’t turn into a much bigger problem. The numbers back that up. Verizon's 2026 Data Breach Investigations Report, found a human element in 62% of breaches in its dataset from 2024 to 2025, with. Social engineering involved in 16%. Microsoft, looking at intrusions it observed, says phishing rose from 7% in 2025 to 23% in 2026.

The simplest precautions are the ones people keep skipping: rotate keys and tokens on a schedule, adopt least-privilege roles, make cybersecurity training and drills part of normal work rather than annual presentation everyone forgets. And decide what you’re going to do when a machine or credential is exposed before it happens. That isn't a scenario you want to work out for the first time in the middle of an incident.

Code-wise, the changes are more complicated and more specific. There is plenty of documentation online available for nearly every tack in use, but teams still need to.  know what they actually depend on and keep track of what changes. 

There is a catch, though. The familiar "install the newest version" is not the whole rule anymore. 

In October 2026, attackers published a malicious release of LiteLLM, a widely used open-source AI gateway, through PyPI and official container images. Microsoft's write-up of version 1.107.0 describes a package built to steal cloud credentials and AI service secrets. A normal Python environment could pick it up as part of what looked like a routine update. Of course, that doesn't mean you stop updating software. Running outdated versions creates plenty of problems of its own. But updates shouldn't be automatic acts of faith either. Know what changed, pin the versions you use, and have a way back if something goes wrong. Newest and trustworthy are not the same thing.

There is another side to all of this that I think is worth exploring. With the proper authorization, we can use some of the same tools against our own systems. 

Run controlled exercises. See what an AI-assisted security tool finds. Test an exposed service. Look for the door you didn't realize you'd left open. 

Permission matters here, obviously. Testing something you own, or something you've explicitly been asked to assess, can teach you a lot. Pointing the same tools somewhere else crosses a very different line. 

AI isn't what gives somebody malicious intent. What it can do is make that person faster and give them much more reach. There is no reason defenders can't take advantage of some of that speed too, provided we use it responsibly. 

Keep up

None of this means we should be scared of using AI or spend our time imagining every possible attack. We just have to accept that attackers have better tools too and adjust accordingly. There is always something to do, and nothing should stop us from learning and getting better at work.

And not every problem is an AI problem., Technology can help us spot vulnerabilities, test systems and respond faster, but somebody still has to make the call: what to trust, what access to give, when something doesn't look right, and when the convenient answer isn't the safe one. Those decisions are still ours. 

So we keep learning, fix what needs fixing and get a little better at protecting the systems we build and use. If attackers don't stop, neither should we.