The New Economics of Cyber Risk in the Age of Frontier AI

The emergence of frontier artificial intelligence (AI) models has triggered a debate across the cybersecurity and risk management communities: What happens when attackers gain access to systems capable of discovering vulnerabilities, generating exploits, and reasoning through attack paths at unprecedented speed? While this is a reasonable debate, the framing risks overstating what is actually changing.

Social engineering remains one of the most successful methods of compromise. Criminal marketplaces offer access, malware, infrastructure, and ransomware capabilities at low cost. Cybercriminals already had highly effective and cost-efficient attack techniques before frontier AI arrived.

In many respects, frontier AI is less about industrialization and more about democratization. The criminal marketplace industrialized itself over the past decade through specialization, division of labor, and capability sold as a service. What frontier AI adds on top of that is a lower skill barrier.

Capabilities that previously required a specialist's expertise become available to a broader range of threat actors. The objective remains largely unchanged. Frontier AI does not fundamentally change what attackers are capable of achieving. It changes how quickly, cheaply, and efficiently they can achieve it. This distinction matters because it challenges several assumptions that underpin how organizations manage cyber risk.

Most organizations manage cyber risk through a combination of mitigation, transfer, acceptance, and avoidance. These decisions are ultimately intended to move risk toward, and maintain it within, an organization’s defined risk appetite.

Risk is not static, and cyber risk is unusual in having an adversary actively working against the defense. The challenge frontier AI poses is that the threat landscape may change at a velocity that outpaces the risk management programs built to track it.

While many stakeholders contribute to cyber risk management decisions, there are three groups that exert significant influence over their direction: the CISO, the cyber insurance market, and the enterprise risk management function. Each community views cyber risk through a different perspective, but all face the same question: How do we make effective decisions when the pace of change accelerates and uncertainty grows

This thought leadership series is a joint project with Mosaic Insurance and MITRE.