Cyber training at the new speed of attack

In regard to cyber threats, we’ve long followed a simple principle: train like you fight and fight like you train. The problem is that many organizations are focused on future risks while overlooking the threats currently present in their own environments. 

Highly capable foundation models are enabling faster, more sophisticated attacks. Recent research from Anthropic found that Mythos could generate Windows privilege-escalation exploits for about $15,700 in API credits. This boils down to roughly $2,000 per exploit. It’s still early and there’s a wide range in possible costs, but this research signals that the cost needed to develop exploits is falling fast.  

At the same time, frontier AI is compressing the timeline between vulnerability discovery and exploitation from months to minutes. Organizations are no longer defending against slow-moving threats, however most cyber response training still assumes they are. 

Technical testing allows organizations to understand what could happen and tabletop exercises walk teams through how they think they would respond. Both have value and are essential, but they operate in isolation. What’s missing is the ability to connect a real AI-driven attack path in your environment with your team’s real-time response and a clear view of how the incident could escalate into a broader business crisis. 

IBM X-Force is tackling this challenge by taking a different approach. This approach combines a realistic AI driven attack simulation with an immersive crisis exercise, for both business and technology leaders. This model helps organizations see first-hand how realistic threats – including those powered by AI - can escalate, and how their teams respond to them under pressure.  

Too often technical teams and executive leaders are trained in isolation. True preparedness comes from bringing them together to bridge the gap between operational response and strategic decision-making so they can function as a unified team when it matters most. 

In practice, that means having the adversary simulation team execute reconnaissance activities. These activities include things like using AI to build target profiles against an organization to build custom social engineering pretexts, as part of an initial access effort. Before the time of modern AI, this process that might have taken days, but now it could be completed in an hour. After that, attackers can move on to active initial access efforts attempting to bypass security controls and processes.  

The resulting findings then become the backbone of an immersive cyber response training exercise. By bringing these elements together, the simulation is calibrated to the organization’s actual exposure, not a generic scenario. It shifts the conversation from “what might happen” to “this is what would could happen in your environment today.”  

This approach helps organizations move from preparing for yesterday’s threats and start training at the new speed of attack. Grounding preparation in real attacker behavior provides clarity on what your environment surfaces, what it misses, and how your response holds up under pressure. It tests not only tools, but coordination, communication, and decision-making at speed—where breakdowns are most likely to occur. 

Too often, technical teams and executive leaders are trained in isolation. True preparedness comes from bringing them together, inevitably bridging the gap between operational response and strategic decision-making. Ultimately allowing them to function as a unified team when it matters most. 

We’ve seen kind of shift before. When organizations moved to remote work, the attack surface expanded overnight. Security teams had to adapt quickly, not just defending the new environment, but learning how to test and train against it.

With frontier AI, the attack surface is evolving faster and with far less visibility upfront. Organizations are not just defending new terrain, they’re defending against attacks that are happening at machine speed. That means moving beyond static training models and start preparing for dynamic, real-time scenarios. 

The AI era’s most pressing security challenge is time. Closing that gap requires practicing before a crisis occurs, building the experience, coordination and confidence needed to respond effectively, and under pressure. 

To request more information about this engagement, reach out today.  

Inquire now to learn about X-Force Cyber Range assessment, a fast engagement that maps your real attack surface, activates protections against top exposures, and leaves your team with a remediation playbook and continuous validation framework.