A recent campaign targeting e-commerce companies illustrates an important change in cybercrime. Researchers reported that one operator used three AI-agent frameworks to automate vulnerability research, exploitation and campaign orchestration.
In one five-day period, 105 attack projects were launched and at least 27 organizations were compromised to varying degrees. More than 600,000 unexpired payment-card records were taken from two victims, while web-skimming activity was associated with a broader set of online stores.
For enterprises, the most important lesson is not the headline number. It is the reduction in time, effort and cost required to execute attacks at scale.
The Economics of Cybercrime Are Shifting
Traditional offensive operations require human attention at multiple stages: reconnaissance, vulnerability analysis, exploitation, persistence, credential theft, lateral movement and data extraction.
AI agents can increasingly support or automate many of those steps.
This matters because an attacker no longer needs to spend the same amount of manual effort on every target. Agents can scan many systems, interpret results, select possible attack paths and continue working with limited supervision.
When the cost of attacking falls, more organizations become economically attractive targets.
That includes businesses that assumed they were too small to attract sophisticated attackers.
Security Controls Must Operate at the Same Speed
Many enterprise security programmes still work on human timelines.
A vulnerability may be discovered during a scheduled scan, placed into a backlog, assigned during the next team meeting and remediated weeks later. Security reviews may happen quarterly. Access reviews may be periodic. Logs may be collected without being actively analysed.
AI-enabled attackers create pressure on that model.
If reconnaissance and exploitation happen faster, exposure windows become more important. Organizations need to reduce the time between identifying a vulnerability and taking meaningful action.
That means moving toward continuous exposure management, risk-based vulnerability prioritisation, automated detection, faster patching for exploitable weaknesses and stronger monitoring of internet-facing systems.
E-Commerce and Payment Environments Need Particular Attention
The campaign also highlights a familiar but persistent risk: payment-card theft through compromised web infrastructure.
E-commerce businesses depend on applications, APIs, content-delivery networks, cloud services, third-party scripts and payment integrations. Each dependency can expand the attack surface.
Defence should therefore extend beyond perimeter security.
Organizations should monitor changes to web assets, protect administrative credentials, enforce strong multi-factor authentication, secure cloud secrets, review third-party code, segment payment environments and detect unauthorized modifications to checkout pages.
Secure development, application testing and timely remediation can reduce the weaknesses automated attackers look for.
AI Governance Is Now Cybersecurity Governance
Enterprises must also examine their own use of AI agents.
An internal agent connected to source code, cloud platforms, email, customer data or administrative tools can become extremely powerful. That power requires boundaries.
Organizations should define what agents can access, what requires human approval, how credentials are protected and how activity is logged.
AI security cannot be treated as a separate innovation project. It belongs inside identity management, data protection, secure development, risk management and incident response.
The Defensive Response Must Be Continuous
AI has not made cybersecurity fundamentals obsolete. It has made slow execution of those fundamentals more dangerous.
Strong asset visibility, least privilege, secure configuration, vulnerability management, application security, monitoring, tested backups and incident response remain essential.
What changes is the required tempo.
Attackers are increasingly using automation to compress days of work into hours. Enterprises need security controls capable of detecting and containing activity at comparable speed.
AI-powered cyberattacks are not simply another threat category. They are a force multiplier for existing threats.
For security leaders, the strategic question is clear:Can your defensive programme operate fast enough when the attacker is no longer working at human speed?
To know more about Anand Shinde and his work in cybersecurity, awareness, and books:
https://anandshinde.com/
Have knowledge, experience, or a powerful idea you want to turn into a book? Get your book published with DevOM Publishing:
https://www.devompublishing.com/
