# AI, Automation and Attacks: Unpacking the Unit 42 2026 Global Incident Response Report > Source: > Published: 2026-07-16 23:00:59+00:00 [Unit 42’s 2026 Global Incident Response Report](https://www.paloaltonetworks.com/resources/research/unit-42-incident-response-report) offers frontline intelligence drawn directly from global investigations. The report spotlights four defining trends shaping the threat landscape. We’ll take a closer look at Trend 1: AI Has Become a Force Multiplier for Attackers. What the Report Explains Drawing on hundreds of incident response engagements, the Unit 42 2026 Global Incident Response (IR) Report provides evidence-backed insights that illustrate how threat actors leverage AI to reduce the friction behind attacks. Specific use cases include shortening development cycles, automating content generation and streamlining reconnaissance techniques. These operational efficiencies have effectively compressed the attack lifecycle, transforming what once took days into a matter of hours. Yet, while the speed of AI has undoubtedly impacted the attack surface, the fundamental threat landscape has remained relatively consistent over the past year. The attacks observed in recent investigations are largely consistent with historical patterns. Threat actors continue to rely on established techniques such as credential theft, phishing, exploitation of known vulnerabilities and ransomware deployment. This points us to the conclusion that AI is acting as a force multiplier to increase the speed and efficiency of attacks, but is not significantly redefining methods of compromise. This also implies that defenders already have the knowledge and capabilities to prevent, detect and respond to AI-enhanced cyberattacks. Ria’s Thoughts As an intern at Palo Alto Networks and a full-time college student, I have had the chance to observe perspectives surrounding AI from both academic and industry organizations. AI has transformed cybersecurity, but its presence in academia remains limited. The speed of AI innovation, as well as concerns regarding academic integrity, have restricted the incorporation of AI platforms into curriculum, leading to an almost “anti-AI” mindset. Rapid AI integration within workplace operations poses challenges for students with limited formal education in these tools. This disconnect challenges the traditional assumption that higher educational institutions adequately prepare students for the workforce and reflects a larger problem: technologies are evolving much faster than established systems can adapt to them. While this grants opportunities for the select few familiar with AI tools, it ultimately expands the skills gap between employers and students, leading to increased job uncertainty. For students and emerging cybersecurity professionals, understanding AI is as essential as understanding the security technologies and principles it can support. As AI becomes increasingly embedded within the cybersecurity industry, organizations are prioritizing professionals who can use it effectively — not just to automate basic tasks, but to deepen analysis, enhance decision making and identify missing gaps. Equally important is recognizing AI’s limitations. Practitioners must be able to validate AI-generated responses, think critically, identify hallucinations or inaccuracies and know when human expertise is required. As AI continues to amplify attackers’ operations, the strongest practitioners will be those who combine strong technical foundations with AI proficiency and the judgement to recognize when human intervention is needed. What Unit 42 Has to Say Because AI continues to advance at record speeds, the threat landscape looks different today than it did when we published the IR Report in February 2026. To gain the latest updates on how these tactics have evolved, I interviewed Andy Piazza, senior director of threat intelligence, Unit 42, and Richard Emerson, senior manager of reactive intelligence, Unit 42. Andy’s Thoughts According to Andy, AI-assisted cyberattacks have still not yet reached a level that urges organizations to redesign their cyber defense strategy — but the initial signals of AI-adoption are beginning to emerge. Threat actors are leveraging AI to lower the barrier to entry and to streamline certain stages of an attack. Between the market demand for “AI impact” driving a hype cycle, and initial signs that threat actors are exploring AI-enabled attacks, these campaigns appear louder or more visible in media coverage than they really are present in the threat landscape. However, the underlying tradecraft remains largely unchanged — the techniques for compromising systems are based on the underlying technology of the compromised hosts, not the technology that is compromising them. At this stage, Unit 42 has not observed a meaningful shift in capabilities related to AI-enabled attacks. Rather, adversaries are applying AI to the established tactics, techniques and procedures (TTPs) that they already engage in. Still, the operational efficiency gains AI offers adversaries should not be dismissed. We are seeing threat actors test AI in their attacks. From malware written using AI to malware that calls out to a large language model (LLM) or Model Context Protocol (MCP) server for command and control instructions, attackers are exploring many use cases for AI-enabled threats, just like defenders are across most enterprises. To date, these campaigns are nascent and have not had major impacts. Yet, that is a temporal assessment that is likely to change as adoption increases. If AI enables attackers to operate faster or at greater scale, organizations that rely primarily on detect-and-respond models may struggle to keep up. This reinforces the need to emphasize prevention controls, rather than assuming security operations center (SOC) teams can absorb high increases in alert volume. Andy’s advice: AI-driven threats should be treated as a strategic priority, particularly as the technology continues to evolve. However, they do not currently represent a fundamentally new class of risk. Defenders can mitigate these threats using existing processes and controls, but it is critical to continue to adapt and remain informed on emerging technologies. Richard’s Thoughts Richard agrees that AI has not introduced fundamentally different attack vectors. He does, however, emphasize more strongly that threat actors are leveraging AI in more sophisticated and scalable ways. In one instance, researchers identified [agentic ransomware](https://cyberscoop.com/sysdig-judepuffer-ai-agentic-ransomware-attack/) managing multiple stages of an extortion operation. While the AI agent was not fully autonomous, it operated from end to end across the attack lifecycle, significantly reducing operational complexity and compressing the timeline for the threat actors involved. Richard also points to the rise of [token jacking](https://labs.cloudsecurityalliance.org/research/csa-research-note-llmjacking-black-market-ai-model-hijacking/), where threat actors exploit exposed credentials to gain unauthorized access to cloud AI services and LLM API tokens. This can potentially generate millions of dollars in unauthorized compute charges at the victim's expense. Recent trends suggest that adversaries are evolving past simply misusing the stolen tokens to training their own malicious models as well. Looking ahead, Richard expects threat actors to continue using AI to optimize existing stages of the attack lifecycle rather than creating entirely new attack vectors. He anticipates broader adoption of AI for processes such as vulnerability discovery, malware development and decision-making during active intrusions. Although he believes that fully autonomous agentic attacks remain an emerging capability, he warns that these systems will eventually operate at speeds that outpace human defenders alone. As a result, organizations must combat AI with AI to respond to these threats in real time. That being said, defenders must still think critically and understand the logic behind these agents to identify their mistakes and manually redirect defense efforts when they fail. Final Thoughts My conversations with Andy and Richard have reinforced one clear idea: AI is changing the speed and scale of cyberattacks more than it is changing the attacks themselves. This distinction is critical. From a defense perspective, this means that foundational security knowledge is still as relevant as ever, with AI being an additional piece of the puzzle. AI is a force multiplier for attackers, but it has the potential to become an equally powerful force multiplier for defenders. As students and emerging professionals entering the dynamic world of cybersecurity, our responsibility is to understand these technologies and guide how they can be used. The future of cybersecurity will be shaped by those who are willing to continuously learn, adapt to new tools, and leverage technology to protect our digital way of life. Additional Resources [Global Incident Response Report 2026](https://www.paloaltonetworks.com/resources/research/unit-42-incident-response-report)– Unit 42[Analyzing the Current State of AI Use in Malware](https://unit42.paloaltonetworks.com/ai-use-in-malware/)– Unit 42