Black Hat 2025: Why your AI tools are becoming the next insider threat

Recent reports reveal a startling 136% increase in cloud intrusions within just six months, highlighting a new trend in cybersecurity threats. North Korean agents have infiltrated 320 companies by utilizing AI-generated identities, showcasing the alarming sophistication of modern cybercriminals. At the forefront of discussions during Black Hat 2025 was the emergence of agentic AI as a viable solution to combat these threats. Industry leaders, including CrowdStrike, showcased significant advancements in threat detection capabilities. The identification of 28 North Korean operatives acting as remote IT workers signals a shift from theoretical AI applications to actionable security measures. Security executives reported improved operational readiness, with many now able to manage a greater volume of alerts and reduce investigation times significantly. This practical efficiency highlighted the transition from speculative promises to tangible outcomes, as organizations begin to experience real benefits from agentic AI. The conference marked a critical inflection point, where the narrative shifted from AI's potential to its demonstrable impact on security operations. Numerous announcements were made regarding new agentic AI applications, illustrating a growing urgency among vendors to deliver measurable results rather than mere hype. Adam Meyers from CrowdStrike emphasized the necessity of integrating human threat hunters into the security process, acknowledging that while AI can handle many tasks, human oversight remains essential. The interaction between AI capabilities and human expertise is vital in navigating the complexities of modern cybersecurity challenges. Among the notable innovations presented was Microsoft's enhanced Security Copilot, which now boasts autonomous investigation capabilities across multiple security platforms. Additionally, Palo Alto Networks introduced new features in Cortex XSOAR, showcasing how their system can autonomously triage alerts and execute remediation. A highlight of the event was Cisco's launch of Foundation-sec-8B-Instruct, a groundbreaking conversational AI model tailored for cybersecurity. This open-source model, designed for deployment in various environments, promises to revolutionize how security teams operate without vendor lock-in. As adversaries increasingly leverage generative AI for insider operations, traditional security measures are becoming less effective. The FAMOUS CHOLLIMA group, known for their sophisticated infiltration tactics, exemplifies this trend, using AI tools to create synthetic identities and bypass security protocols. The cybersecurity landscape is evolving rapidly, with organizations facing a growing array of AI-driven threats. Experts warn that as companies become more reliant on AI, they may inadvertently lower their scrutiny of AI outputs, creating new vulnerabilities. The call for standardized AI security measures is becoming urgent, with industry leaders advocating for the governance of AI agents. As the threat landscape continues to shift, it is clear that the integration of AI in cybersecurity will not only enhance defensive capabilities but will also require a vigilant approach to ensure these systems are secure and effective against emerging threats. The stakes have never been higher, as businesses confront the dual challenges of protecting their intellectual property and maintaining customer trust in an increasingly complex digital world.