Cyberattacks and Defense Strategies in the AI Era: Decoding Offense and Defense from Wiz's Perspective
In recent years, as artificial intelligence (AI) has rapidly permeated software development and business processes, the cybersecurity landscape has been undergoing a major transformation. While leveraging AI dramatically increases productivity, it has also created new "entry points" for attackers.
In particular, Wiz Chief Technologist Ami Luttwak states that "cybersecurity is a mind game," while sounding an alarm about the new trends in offense and defense in the AI era.
In this article, we will organize the relationship between AI and cyberattacks from multiple perspectives and explain practical countermeasures that companies and startups should take.
1. Expansion of AI Utilization and the Attack Surface
1-1. The Coexistence of Development Speed and Risk
In recent years, companies have been strengthening moves to dramatically shorten development cycles through vibe coding (a method of automatically generating code using natural language prompts) and AI agent integration.
However, if security is put on the back burner in favor of speed, incomplete authentication implementations and overlooked vulnerabilities are more likely to occur. In tests conducted by Wiz, "inappropriate implementation of authentication processes" frequently appeared in applications using vibe coding. It has been pointed out that this is the result of "choosing the implementation that makes it work most easily."
1-2. Attackers Also Make Full Use of AI
The era has arrived where not only developers but also attackers are making full use of AI. Luttwak cites cases where "attackers use prompts to issue attack commands," stating that tactics such as having the AI system itself execute commands like "delete system files" or "output secret information" are beginning to be used.
As such, we must design our defenses with the premise that AI is not just a development support tool, but can also become a means of attack.
2. Supply Chain Attacks and Damage Cases
2-1. AI Tools Introduced Internally Become a Breakthrough
AI tools introduced by companies for efficiency (chatbots, data integration agents, etc.) often have access rights as third-party services, which makes them easily exploitable for supply chain attacks. For example, there was an incident where
Drift, which provides AI chatbots, was compromised, and Salesforce data from multiple companies (Cloudflare, Palo Alto Networks, Google, etc.) was leaked. Attackers stole tokens (API keys, etc.), impersonated the chatbot, made internal inquiries, and then moved laterally within the internal network.
Regarding this attack, Luttwak states, "The attack code itself was also created using vibe coding." In other words, the composition of AI-on-AI attacks—attack generation using AI followed by intrusion through AI—is becoming a reality.
2-2. "s1ingularity" Attack: Development Tools Targeted
As another typical example, there was an incident where a malware attack called "s1ingularity" was launched against Nx, a build tool widely used by JavaScript developers. It is reported that the attackers injected malware into Nx, scanned the installed environment, hijacked AI development tools (Claude, Gemini, etc.), and searched for confidential information. As a result, many developer tokens and keys were allegedly stolen.
The characteristic of this attack is that it weaponizes the AI development tools themselves to explore the company. In other words, the method of "attackers using AI tools as a stepping stone after intrusion" is spreading.
3. Response Strategies for Companies and Startups
3-1. Startups Should "Design for Security from the Start"
Luttwak strongly advocates for security awareness from the pre-development stage, stating, "You should think about security and compliance from day one," and "Even if you have a small number of people, you should appoint a CISO."
Specifically, the following design elements are important:
Design of audit logs
Establishment of authentication and authorization
Access control for production and development environments
Single Sign-On (SSO) and identity management
Architectural design (a structure where customer data remains within the customer's environment)
Furthermore, it is noted that Wiz itself achieved SOC2 compliance before it even had code, and that it is easier to establish security systems when the number of employees is small.
3-2. Avoiding "security debt"
In software development, if you proceed with development while ignoring security in the initial stages and add fixes or additions later, "security debt" accumulates. If left unaddressed, this makes significant costs and structural revisions in later processes unavoidable.
Therefore, a design philosophy of "incorporating mechanisms that can be used with peace of mind from the beginning" is essential.
3-3. Building an AI-era-ready security structure
To prepare for AI-based attacks, it is essential for the defense side to also utilize AI to implement mechanisms for proactive prediction, anomaly detection, and real-time response. Looking toward this direction, Wiz has deployed the following products:
Wiz Code: A tool that supports vulnerability detection and mitigation during the software development lifecycle (SDLC)
Wiz Defend: Protection features that detect and respond to runtime threats in cloud environments
These are vertically integrated approaches to embedding security throughout the "design phase to operational phase," and they are also an attempt to realize the "horizontal security (defense based on cross-sectional understanding)" advocated by Mr. Luttwak.
4. Future Prospects and Challenges
4-1. The AI security field is an open playing field
Mr. Luttwak states, "New attacks are emerging in every security domain, and a rethink is necessary. The game is open."
In other words, there is still plenty of room for startups to innovate in areas such as anti-phishing, email security, malware, endpoint protection, or "vibe security" (AI-assisted security automation).
4-2. Challenges and Risks
However, there are also the following challenges:
Model bias and hallucinations: The risk of AI making incorrect judgments
Increase in false positives: Operational disruption due to over-defense
Governance and privacy: Handling of customer data and accountability
Standardization and regulation: Development of cross-national and cross-industry security standards
To address these, it is necessary to build a strategy that integrates not only technical capabilities but also legal systems, ethics, and operational design.