Frontier AI models are reducing the time and cost required to perform parts of a cyberattack, but their performance is still uneven across the attack chain. That leaves defenders with practical choke points where identity controls, segmentation, endpoint detection and response, and behavioral monitoring can still create friction.
In this TNGlobal Q&A, Teo Xiang Zheng, Vice President of Advisory at Ensign InfoSecurity, discusses findings from the company’s 2026 Cyber Threat Landscape Report and its offensive AI cyber-range assessment. He explains why organizations should plan around an assumed-breach posture without abandoning prevention, and why laboratory benchmarks should be treated as indicators rather than predictions.
TNGlobal previously spoke with Ensign InfoSecurity about the defensive and offensive implications of generative AI. The latest assessment provides a more concrete view of how current frontier models perform across a simulated attack chain.
Ensign’s assessment suggests that gaining initial access is becoming relatively easy for frontier AI models. If organizations increasingly have to assume that some form of initial compromise will occur, what should change in how they allocate defensive resources?
Critically what has changed is the execution of cyber-attacks with machine speed and scale. Organizations need to continue building and maintaining good cyber hygiene, ensuring that foundational defenses are in place.
The conclusion is that organizations need to maintain an assumed-breach posture as the ability to deny access to threat actors is diminishing. Organizations need to prioritize their readiness to detect, respond to and recover from incidents as rapidly and efficiently as possible. This is only possible with adequate resourcing, capacity and confidence in operational processes and technology defenses.
Our evaluation of AI models found that while initial access was achieved by all 10 frontier AI models tested, model reliability was lowest at bypassing endpoint detection and response (EDR) at runtime, at 40%, with lateral movement also markedly less reliable at 67.5%. These are where defenders can still maintain meaningful resistance.
Investments should expand beyond cyber hygiene alone and be directed towards behavioral anomaly detection and rapid, temporary response measures, alongside network segmentation and containment to impede an attacker’s progression through the environment. Identity should also be protected as the primary control plane because, once compromised, detecting the compromise becomes much harder, creating opportunities to conceal themselves within normal user activity.
Even when the perimeter is porous, organizations should not neglect prevention. They should maintain a complete inventory of internet-facing assets and set firm deadlines to patch or retire anything exposed. Similarly, organizations should document all suppliers and their access to systems, services and information, and ensure that their controls are commensurate with the organization’s risk appetite. The objective is to make initial compromise harder, while ensuring that if it does occur, it does not turn into widespread compromise.
The models reportedly performed less consistently when attempting credential theft and lateral movement. What makes these stages harder to automate, and what does that tell defenders about the controls that still create meaningful friction for AI-enabled attackers?
The tests showed that protecting the “keys” to accessing a technology environment is still critical to preventing unauthorized access. Weaknesses continue to arise when organizations fail to adopt modern, more resistant authentication technologies such as multi-factor authentication (MFA) and passkeys with hardened configurations. Poor user practices in protecting identities and access, such as credential reuse, further weakens the defenses.
The tests reinforce the point that if the threat actors gain access to identities and authentication material, through stolen credentials, or stolen identities, they effectively assume insider access to the technology environment.
Our evaluations further confirm that deterministic controls, in the form of architectural robustness through network segmentation, can be highly resistant to adversary progression within the network. This is particularly important against frontier AI models which are probabilistic systems.
First, credential theft and lateral movement are multi-step, context-dependent processes that build progressively on successes at earlier stages. In our range, initial access was a more bounded objective against an exposed asset, whereas credential theft and lateral movement require the model to first discover which accounts, hosts and trust relationships exist, interpret that information correctly, and then choose the right next step.
Second, they take place inside the environment, where defensive controls are actively in play. The models had to contend with endpoint detection and response (EDR), authentication and access controls rather than a single exposed surface, and it was at runtime EDR bypass that model reliability was lowest.
Third, errors compound. A wrong assumption about a credential or host early in the chain can lead to failed attempts and retries later, so reliability falls as the number of dependent steps increases.
The drop in reliability was therefore not the result of a single technical barrier, but of the combination of task complexity, in-environment controls and the need to adapt to information gathered earlier. This evaluation provided a representation of the concept of “defense in depth and breadth”. It shows that the models’ capabilities did not translate into consistent execution across the full attack chain.
For defenders, this shows that controls which restrict access and movement inside the network can still create meaningful choke points. Strong authentication and privileged-access controls, alongside network segmentation, trust boundaries and containment, can limit how far an attacker progresses and force repeated attempts, making it harder and more costly to turn initial access into wider compromise.
Your assessment also suggests that capability-per-dollar is improving quickly, including among lower-cost and open models. Does this primarily increase the sophistication of attacks, or is the bigger risk that techniques once limited to skilled operators can now be attempted at much greater volume?
The bigger risk is broader access to capability. Broadly, AI models have provided economical access to above-average capabilities and, in the case of frontier AI, advanced capabilities to those who can afford them. With the availability of open-source, open-weight and low-cost models, access to these capabilities is high.
First, this means that threat groups have greater opportunities to increase the scale of their operations and attacks, given the lower cost of accessing these models.
Second, the level of capability and sophistication will depend on the continued development of frontier AI models. Based on our observations in the report, most models are advancing on a roughly two-month cadence in terms of capability development, with the possibility that this cycle could shorten in future.
Third, it cannot be ruled out that new threat groups may emerge as these capabilities develop, adding even more pressure and noise for cyber defenders. This may also result in the rapid emergence and disappearance of threat groups, as previously seen with fly-by-night ransomware groups and organised crime operators.
Fourth, there may be increasing convergence of capabilities among threat groups as they leverage commonly accessible models with shared knowledge contexts, albeit with differing capabilities. This will make it increasingly difficult to distinguish one threat actor from another, other than through specific behavioral traits and motivations.
How much of the emerging threat is actually new tradecraft versus AI accelerating familiar techniques such as reconnaissance, vulnerability discovery, phishing, scripting, and living-off-the-land activity? Where does human attacker expertise still matter most?
Our observations from real-world incidents and evaluations show that there have been no material changes in the techniques victims face in cyberattacks, other than the speed and scale at which attacks can be executed.
Emerging threats are also targeting AI technology stacks that are already deployed and operational within victim organizations, which can provide insider-level access and authorizations that help threat actors advance their compromise.
Regardless of the above, we also observe that models operating without a harness, i.e. augmented tools, skills and instructions, can be noisy in their activities within victim environments. Their anomalous activities can therefore be detected relatively easily in a diligently monitored environment.
Human expertise still matters at key decision points such as setting objectives, choosing targets, interpreting results, understanding the environment and deciding when to change strategy. As model capabilities advance, the points at which human intervention is needed are likely to narrow. Our assessment tested how far a model could progress once it was directed towards attacker objectives and was not designed to show that an AI system would independently select an organization and decide to attack it.
None of the models in the assessment could confidently evade detection tools. As attackers increasingly use legitimate utilities and credentials rather than obviously malicious tooling, what kinds of telemetry and behavioral signals become more important for defenders?
Based on our findings, no model achieved High Success in bypassing EDR at runtime, although six achieved partial success. Defenders should focus on telemetry that shows how identities, endpoints, network connections and data flows are behaving. This includes anomalous login patterns, unusual locations or login times, risky sign-ins, unexpected service-account activity, suspicious process activity, unusual network connections, and changes in the volume or destination of data leaving the organization.
These signals matter because attackers can use valid credentials to log in or legitimate remote-access utilities that blend into expected activity. The anomaly may therefore be in the behavior – who is accessing what, from where, which systems are communicating, and what data is leaving, rather than in an obviously malicious tool or exploit.
Our testing reinforces why that matters: EDR created meaningful resistance, while behavioral anomaly detection, reinforced by structural and deterministic controls, was identified as one of the most durable safeguards.
Ensign argues that organizations should continuously validate their defenses as frontier models improve. What would a practical validation cycle look like for an enterprise? How frequently should organizations test against new AI capabilities without turning security testing into a permanently moving target?
Organizations should set a regular validation cadence that keeps pace with material advances in frontier AI capabilities. At the time of our testing in August 2026, Ensign observed frontier AI capability advancing on a roughly two-month cycle, which means security controls cannot afford to remain static. Agility in cyber defense is what distinguishes strong defenders from the rest.
We think the practical frequency will depend on the organization’s risk appetite. At a minimum, an annual assessment is recommended. For organizations with lower risk appetites, an assessment every quarter or every six months will help ensure that testing remains current with the rapid development of AI models.
A practical validation cycle starts by identifying the defensive controls that matter most, testing them against current model capabilities, addressing the weaknesses found, and then re-testing as those capabilities advance or when there is a material change in the threat or the organization’s environment. The results should then be used to re-baseline the organization’s defensibility, with exposure and control efficacy reported to the Board each cycle, rather than treating a successful test as permanent assurance.
Cyber-range testing inevitably differs from a real intrusion involving adaptive human attackers, incomplete information, and messy enterprise environments. How should CISOs interpret offensive AI benchmarks responsibly, and what conclusions should they avoid drawing from laboratory performance alone?
CISOs should treat these benchmarks as indicative of model capability against defenses, not as definitive predictions of what will happen in their own environment. Ensign’s Cyber Range provides a controlled and consistent environment for comparing models, but a conventional enterprise may have legacy systems, accepted vulnerabilities, integration gaps and its own defensive architecture.
The value of the testing is in understanding what current models are capable of, how reliably they can progress through an attack chain, and where defensive controls still create friction. CISOs should therefore avoid assuming that laboratory performance translates directly into either guaranteed attack success or guaranteed defensive effectiveness in their own environment.
The report highlights different patterns across ASEAN, East Asia and Australasia, including ransomware, identity-data theft, and growing attacks on critical infrastructure. What regional differences should security leaders in Asia-Pacific account for when deciding where to strengthen resilience first?
The regional reports provide clear distinctions of the motivations of the threat groups targeting each region, particularly the industry groups they target and the impacts they seek to create. Cybersecurity leaders should use the context provided to assess the relevance to their own organizations and reassess defensive posture against the recommended defensive actions.
They can choose to apply the defensive actions relevant to a single region. If their organizations operate across several regions, or if they want more comprehensive defenses, they can consider the recommended defensive actions across all regions.
In ASEAN, where ransomware activity doubled in 2025 and the sale of data tripled, the focus should be on protecting data and strengthening supply-chain resilience, particularly across business and professional services, manufacturing, and telecommunications, media and technology, including supply chains that rely heavily on SMEs.
In East Asia, where ransomware activity quadrupled, organizations should prioritize business-critical systems, intellectual property and resilience against operational disruption, particularly across manufacturing, technology, energy and utilities.
In Australasia, where ransomware increased more than sixfold and healthcare is among the sectors under pressure, organizations need to strengthen recovery capabilities while addressing concentration risk from critical service providers.
Their respective priorities should reflect where the greatest potential impact lies whether from data theft, operational disruption or supply-chain dependency.
Editor’s note: This Q&A has been lightly edited for clarity and TNGlobal house style. The responses remain those of the interviewee.
Share your perspective: TNGlobal welcomes contributed insights and expert commentary from across Asia’s technology and innovation ecosystem. Submit a contribution for editorial consideration, or explore more conversations in our interview archive.