Why the basics still matter for cybersecurity in the AI era
Microsoft highlights that despite AI-driven advancements in cyberattacks, traditional security weaknesses remain critical vulnerabilities that adversaries exploit with greater speed and persistence.
AI has accelerated cyberattackers' ability to test multiple paths, adapt techniques, and move across digital environments, but the weaknesses they exploit—such as excessive permissions, unpatched systems, and exposed execution paths—remain unchanged. What has shifted is the speed at which these weaknesses combine into complex attack paths spanning identities, endpoints, applications, networks, and AI systems. A single initial compromise can now escalate rapidly, complicating prioritization for security teams as organizations integrate AI tools and workflows.
Microsoft introduced Secure Now within Microsoft Security Exposure Management in May 2026 to help security practitioners focus on foundational security improvements essential for AI adoption. The tool provides actionable guidance to address areas where autonomous attacks could create disproportionate exposure, emphasizing continuous exposure reduction. Recent disclosures, including incidents reported by OpenAI and Anthropic, demonstrate how autonomous agents are testing boundaries, exploiting familiar weaknesses like SQL injection and exposed credentials, and reaching production systems.
Microsoft Threat Intelligence identified Storm-2945, a subcluster of Midnight Blizzard, conducting the CaptiveCrunch campaign across hospitality networks. Attackers redirected travelers through device-code phishing via a legitimate Microsoft sign-in page or fake software updates delivering malware, enabling either cloud identity access or endpoint compromise. The malware collected credentials, session tokens, security configurations, and remote-access history, underscoring the need to secure authentication flows and credentials alongside endpoint protections.
In another campaign, attackers impersonated IT support via Microsoft Teams, tricking a user into granting control through legitimate remote-support software. Using PowerShell, they downloaded a malicious MSI package, staged a Node.js runtime, and established persistent command-and-control to map Active Directory and attempt lateral movement. Microsoft recommends phishing-resistant access controls, managed-device requirements, endpoint attack surface-reduction rules, and stricter controls on remote-support tools and WinRM to disrupt such paths.