--- title: If you're not using AI to attack your own systems, your... description: AI agents are reshaping offensive and defensive cybersecurity: attackers are already using autonomous agent swarms to find and exploit vulnerabilities at... canonical: https://daily.dev/posts/if-you-re-not-using-ai-to-attack-your-own-systems-your-adversaries-will-vxcwnlrhi twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: If you're not using AI to attack your own systems, your adversaries will | daily.dev og:description: AI agents are reshaping offensive and defensive cybersecurity: attackers are already using autonomous agent swarms to find and exploit vulnerabilities at... og:url: https://daily.dev/posts/if-you-re-not-using-ai-to-attack-your-own-systems-your-adversaries-will-vxcwnlrhi og:image: https://api.daily.dev/og/posts/VxcwnLRhi.png og:image:alt: If you're not using AI to attack your own systems, your adversaries will og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # If you're not using AI to attack your own systems, your adversaries will **[The Register](https://daily.dev/sources/theregister)** · 9 min read · 5 upvotes · 1 comments ## Summary AI agents are reshaping offensive and defensive cybersecurity: attackers are already using autonomous agent swarms to find and exploit vulnerabilities at machine speed, while a new market of AI-native, continuous red-teaming and pen-testing tools is emerging to keep pace. Mandiant founder Kevin Mandia's new startup Armadin ran what it called the largest controlled live AI cyberattack on record, generating 17 million offensive actions and finding over 50 high-impact zero-days across customer environments in hours rather than months. Experts argue traditional annual or quarterly pen-testing can no longer match the speed, scope, and sophistication of AI-driven attackers, and that pen-testers must evolve into AI-security specialists who understand agentic behavior and business impact. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What is Armadin and what did its AI attack simulation find during its live test? Armadin, a startup founded by Mandiant's Kevin Mandia, builds swarms of thousands of AI agents that simulate real-life attackers inside organizations' infrastructure around the clock. In a three-day live exercise with agentic security operations provider Tenex.ai, Armadin's swarm generated 17 million offensive actions, discovered 38 validated attack paths, and produced 238 security findings, work that would otherwise take a five-person analyst team about 2,400 hours. _Teams weighing AI-driven red teaming against manual pen-testing follow developments like this on daily.dev._ ### Why is quarterly or annual penetration testing no longer considered sufficient against modern attackers? Because AI-powered attackers now scan and exploit systems continuously rather than during scheduled windows, while human-led pen-tests typically take about three months and only cover a limited scope. EC-Council's Jay Bavisi describes this as a speed, scope, and sophistication gap: attackers using algorithmic systems probe an entire organization constantly, whereas annual compliance-driven tests only sample a fraction of it. _Security teams rethinking testing cadence against AI-scale attackers can track this shift on daily.dev._ ## Community discussion Top comments from developers on daily.dev. **@gabibeyo** · 0 upvotes > Agree on the direction: if you’re not pressure-testing with agents, someone else is. > > > Where I’d sharpen it — “AI pen-test tool” still gets sold as a better scanner. The harder shift is cultural. We onboarded systems that are good at finding paths around fences, then told ourselves a tighter allowlist is the strategy. > > > Red team with agents is useful. Sleeping because the agent lives in a nicer box is not. > > > Practical bar for defenders: can you reconstruct what an approved coding agent did last week — tools, targets, data classes — without a developer diary? If not, the red-team report will... ## Similar posts on daily.dev - [How Autonomous Agents Are Fuelling AI-Powered Cyber Warfare](https://daily.dev/posts/how-autonomous-agents-are-fuelling-ai-powered-cyber-warfare-x2lkazadr) · Cyble · 0 upvotes · 0 comments - [Hackers Are Automating Cyberattacks With AI. Defenders Are Using It to Fight Back.](https://daily.dev/posts/hackers-are-automating-cyberattacks-with-ai-defenders-are-using-it-to-fight-back--i3iqiikn6) · Singularity Hub · 13 upvotes · 3 comments - [AI agents can't pull off fully autonomous cyberattacks - yet](https://daily.dev/posts/ai-agents-can-t-pull-off-fully-autonomous-cyberattacks---yet-lzyaqsq12) · The Register · 0 upvotes · 0 comments - [Schneier on Security](https://daily.dev/posts/schneier-on-security-ruhoefbfy) · Schneier on Security · 0 upvotes · 0 comments - [AI made software development unrecognizable. Is cybersecurity next?](https://daily.dev/posts/ai-made-software-development-unrecognizable-is-cybersecurity-next--tmxghrlts) · CSO Online · 1 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#ai-agents](https://daily.dev/tags/ai-agents), [#ai-security](https://daily.dev/tags/ai-security), [#red-teaming](https://daily.dev/tags/red-teaming) [View this post on daily.dev](https://daily.dev/posts/if-you-re-not-using-ai-to-attack-your-own-systems-your-adversaries-will-vxcwnlrhi) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"If you're not using AI to attack your own systems, your adversaries will","url":"https://daily.dev/posts/if-you-re-not-using-ai-to-attack-your-own-systems-your-adversaries-will-vxcwnlrhi","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/if-you-re-not-using-ai-to-attack-your-own-systems-your-adversaries-will-vxcwnlrhi"},"datePublished":"2026-08-22T15:04:09.579Z","dateModified":"2026-09-14T06:06:24.456Z","description":"AI agents are reshaping offensive and defensive cybersecurity: attackers are already using autonomous agent swarms to find and exploit vulnerabilities at...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/701cdae4dc8a50008283ec67ee2c6171?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/701cdae4dc8a50008283ec67ee2c6171?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"The Register","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"The Register","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/66aa2113fdad463992ffcbf0e8963fda","url":"https://daily.dev/sources/theregister"},"commentCount":1,"discussionUrl":"https://daily.dev/posts/if-you-re-not-using-ai-to-attack-your-own-systems-your-adversaries-will-vxcwnlrhi","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":5},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":1}],"keywords":"security,ai-agents,ai-security,red-teaming","timeRequired":"PT9M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"The Register","item":"https://daily.dev/sources/theregister"},{"@type":"ListItem","position":3,"name":"If you're not using AI to attack your own systems, your adversaries will"}]} {"@context":"https://schema.org","@type":"WebPage","@id":"https://daily.dev/posts/if-you-re-not-using-ai-to-attack-your-own-systems-your-adversaries-will-vxcwnlrhi","comment":[{"@type":"Comment","text":"Agree on the direction: if you’re not pressure-testing with agents, someone else is.\nWhere I’d sharpen it — “AI pen-test tool” still gets sold as a better scanner. The harder shift is cultural. We onboarded systems that are good at finding paths around fences, then told ourselves a tighter allowlist is the strategy.\nRed team with agents is useful. Sleeping because the agent lives in a nicer box is not.\nPractical bar for defenders: can you reconstruct what an approved coding agent did last week — tools, targets, data classes — without a developer diary? If not, the red-team report will describe a world your monitors can’t see.","datePublished":"2026-08-24T06:24:17.999Z","url":"https://daily.dev/posts/VxcwnLRhi#c-PCH0CYSwT","author":{"@type":"Person","name":"Gabi Beyo","url":"https://daily.dev/gabibeyo","image":"https://lh3.googleusercontent.com/a/ACg8ocLemxROLDZ6RYrC2zzv0zJ9ezzj62VOCNwxNCdVNa_M9tqvU4JI=s96-c"}}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/if-you-re-not-using-ai-to-attack-your-own-systems-your-adversaries-will-vxcwnlrhi#faq","mainEntity":[{"@type":"Question","name":"What is Armadin and what did its AI attack simulation find during its live test?","acceptedAnswer":{"@type":"Answer","text":"Armadin, a startup founded by Mandiant's Kevin Mandia, builds swarms of thousands of AI agents that simulate real-life attackers inside organizations' infrastructure around the clock. In a three-day live exercise with agentic security operations provider Tenex.ai, Armadin's swarm generated 17 million offensive actions, discovered 38 validated attack paths, and produced 238 security findings, work that would otherwise take a five-person analyst team about 2,400 hours. Teams weighing AI-driven red teaming against manual pen-testing follow developments like this on daily.dev."}},{"@type":"Question","name":"Why is quarterly or annual penetration testing no longer considered sufficient against modern attackers?","acceptedAnswer":{"@type":"Answer","text":"Because AI-powered attackers now scan and exploit systems continuously rather than during scheduled windows, while human-led pen-tests typically take about three months and only cover a limited scope. EC-Council's Jay Bavisi describes this as a speed, scope, and sophistication gap: attackers using algorithmic systems probe an entire organization constantly, whereas annual compliance-driven tests only sample a fraction of it. Security teams rethinking testing cadence against AI-scale attackers can track this shift on daily.dev."}}]} ```