Artificial intelligence is cutting the time between a vulnerability being discovered and an attack being launched down to hours or even minutes. According to the latest report from CSIRT KNF, the tempo and scale of threats are changing dramatically.
The newest study by the Computer Security Incident Response Team of the Polish Financial Supervision Authority (CSIRT KNF) paints a worrying picture of the cybersecurity landscape in the Polish financial sector. Generative AI is no longer just a tool for creating more convincing phishing messages. It now automates the entire attack cycle: reconnaissance, attack surface analysis, vulnerability identification, exploit generation, access path planning, and adaptive social engineering.
Karol Paciorek, head of CSIRT KNF, does not believe AI will create entirely new categories of threats. – It is more likely that AI will accelerate and scale what we already observe today – he said in an interview with WNP.PL.
Automation of the attack cycle
In 2027, experts predict that AI will serve as an accelerator for the entire attack lifecycle. If previously a cybercriminal needed days or weeks to analyze a target, prepare social engineering, identify vulnerabilities, or develop an attack scenario, now much of that work can be automated. This means a shorter time from vulnerability disclosure to attempted exploitation, a higher number of parallel campaigns, and better tailoring of attacks to specific victims.
– AI can also lower the entry barrier for less advanced cybercriminals. This could lead to a surge in simpler phishing campaigns, social engineering attempts, and large-scale vulnerability scanning and exploitation – Paciorek added.
The report highlights that threats in 2026 are already combining different elements: cyberattacks, financial fraud, social engineering, identity theft, extortion, and reputation-damaging operations. Simple fraud schemes are becoming rare. Criminals now use multiple techniques within a single campaign.
The financial sector remains one of the most attractive targets for cybercriminals, state-sponsored groups, access brokers, ransomware operators, hacktivists, and actors conducting fraud and disinformation. This is due to the high value of processed data, the continuous availability of digital services, strong links to critical infrastructure, heavy reliance on technology vendors, and the importance of customer trust for market stability.
From vulnerability count to real risk
Paciorek argues that organizations must shift their approach to vulnerability management. – For years, organizations focused mainly on the number of vulnerabilities or their CVSS score. Today, it is increasingly clear that a risk-based approach is more effective. What matters is whether a system is exposed to the internet, whether the vulnerability is being actively exploited, how quickly it can be used, and what impact it would have on the organization – he explained.
The report cites a directive from CISA (Cybersecurity and Infrastructure Security Agency) that also prioritizes real risk over purely technical vulnerability assessments. Paciorek noted that in a world of accelerating offensive automation, the key factor will not be the number of detected vulnerabilities but the organization’s ability to understand its own exposure, properly prioritize risk, and quickly mitigate the most critical threats.
From a management perspective, priorities should include: full visibility of assets and their exposure, development of exposure management programs, shortening reaction time to critical vulnerabilities, strengthening security of web applications, APIs and SaaS services, developing detection capabilities, and regularly assessing ICT supplier risk.
The most exposed systems in this new reality will be edge systems, APIs, web applications, SaaS services, remote access tools, and components with high internet exposure. This forces a continuous attack exposure approach, real-time detection, and constant information sharing between sectors and individual CSIRTs.
Źródło: WNP.PL, Fot. Materiały prasowe / CSIRT KNF
