Initial Access — LLM-Powered Phishing / Social Engineering

MITRE ATT&CK Tactics TA0001 – Initial Access Key Techniques T1566 – Phishing (Spearphishing Link / Attachment / Voice) T1656 – Impersonation T1204 – User Execution AI Enhancement LLM-generated spearphishing emails at scale AI voice cloning (vishing / executive impersonation) Target profiling using OSINT summarization Real-World Examples Scattered Spider (2023–2025) : Used highly tailored social engineering and helpdesk impersonation; emerging reporting shows the use of AI-written scripts to improve success rates Business Email Compromise (BEC) Campaigns (2024–2026) : Increasing use of generative AI to produce fluent, context-aware phishing emails Deepfake Voice Fraud (UK energy firm case, €220k theft) : AI-generated CEO voice used to authorize fund transfer

Vulnerability Identification — Code Model Scanning / Recon Automation

MITRE ATT&CK Tactics TA0043 – Reconnaissance TA0007 – Discovery Key Techniques T1595 – Active Scanning T1592 – Gather Victim Host Information T1046 – Network Service Discovery AI Enhancement Code LLMs identifying exploitable bugs in public repos Automated recon prioritization using AI clustering Natural language querying of attack surface (“find internet-exposed VPNs with CVE-2024-XXXX”) Real-World Examples Volt Typhoon (China-nexus, 2023–2025) : Extensive pre-positioning using stealthy discovery and infrastructure mapping Mass Exploitation Campaigns (MOVEit, Citrix Bleed) : Increasing evidence of automation accelerating vulnerability identification Bug Bounty and Adversary Overlap : Demonstrations of GPT-like models identifying exploitable patterns in code faster than manual review

Exploitation — AI-Guided Exploit Development

MITRE ATT&CK Tactics TA0002 – Execution TA0004 – Privilege Escalation Key Techniques T1203 – Exploitation for Client Execution T1068 – Exploitation for Privilege Escalation T1059 – Command and Scripting Interpreter AI Enhancement AI-assisted exploit dev (PoC generation, fuzzing augmentation) Rapid weaponization of N-day vulnerabilities Code generation for obfuscated payloads Real-World Examples Rapid CVE Weaponization (Log4Shell, MOVEit) : Time-to-exploit shrinking dramatically Ransomware Operators (LockBit, BlackCat) : Using automation to adapt payloads per environment Security researchers have repeatedly shown LLMs can generate functional exploit scaffolding

Lateral Movement — RL-Assisted Navigation / Autonomous Decisioning

MITRE ATT&CK Tactics TA0008 – Lateral Movement TA0006 – Credential Access Key Techniques T1021 – Remote Services (SMB/RDP/SSH) T1555 – Credentials from Password Stores T1078 – Valid Accounts AI Enhancement Reinforcement learning optimizing pathfinding in networks Automated privilege escalation chaining AI-assisted credential harvesting prioritization Real-World Examples Volt Typhoon : “Living off the land” lateral movement with minimal tooling footprint Ryuk / Conti ransomware : Highly effective lateral spread using credential reuse and automation Red Team Research (2024–2025) : Autonomous agents successfully navigating lab environments

Impact — Autonomous Attack Agents / Adaptive Ransomware

MITRE ATT&CK Tactics TA0040 – Im pact TA0011 – Command and Control Key Techniques T1486 – Data Encrypted for Impact (Ransomware) T1499 – Endpoint Denial of Service T1530 – Data from Cloud Storage (Exfiltration precursor) AI Enhancement Autonomous ransomware adapting to defenses in real time AI-driven exfiltration targeting “high-value” data first Dynamic C2 evasion using generative traffic patterns Real-World Examples ALPHV/BlackCat & LockBit : Increasing automation in targeting and extortion workflows Data Extortion Campaigns (2024–2026) : Prioritizing sensitive data via automated classification Wiper Malware (e.g., Ukraine conflicts) : Potential convergence with AI-driven targeting

Cyber

Kroll Perspectives: AI-Accelerated Cyber Risk Management

AI Has Changed Both Sides of the Fight

Attackers are using AI to exploit vulnerabilities more effectively. Businesses are using AI to drive efficiency and improve client outcomes. CISOs are using AI to strengthen their defense.

Kroll can support clients with cyber risk management at every stage of their AI journey. Including advising on policy and governance, investigating autonomous agents, providing AI detection and response and conducting penetration testing for AI technologies, using AI-assisted techniques.

Six Shifts Driven by Frontier AI

In our conversations with clients since the Project Glasswing and Project QuiltWorks announcements, the question has moved from “What does this mean?” to “How do we operationalize our response?”

AI accelerates the clock while reinforcing the fundamentals

Security leaders still need inventory, ownership, prioritization, remediation and verification; those capabilities must now operate on compressed timelines.

Discovery is becoming abundant

Remediation velocity is becoming the scarce resource. The ability to prioritize what matters, assign owners, remediate and demonstrate risk reduction will define true resilience.

Threat Exposure Management is shifting from a security workflow to an enterprise risk discipline

CISOs, CFOs, general counsel, CROs and boards need a shared view of exposure, financial impact, legal posture, ownership and evidence.

Regulators are emphasizing evidence and accountability

The expectations center on governance, resilience, disclosure readiness, third-party oversight, documentation and defensible decisions.

The focus for security teams is shrinking the exposure window

Prioritize the paths that can affect the business and reduce those exposures before attackers can operationalize them.

CrowdStrike's Project QuiltWorks, with Kroll among its initial partners, was built for the next step

We help close the exposure gap at machine speed by enabling organizations to assess, prioritize and remediate AI-discovered vulnerabilities in production code.

27 sec

Fastest adversary breakout time

89%

Year-over-year rise in AI-powered attacks

0 sec

Time between discovery and exploit

Source: CrowdStrike 2026 Global Threat Report

How to Prepare

Frontier AI Risk Assessment

Kroll delivers frontier AI risk assessments that help organizations move from awareness to action through one continuous exposure-closure loop. We enable leaders to determine not only where they are exposed, but also which risks to prioritize, what actions are required, who owns them, and how to fund and verify remediation, accelerating remediation velocity.

We Help Clients

Assess exposure across the organization and validate how individual weaknesses can combine to create real attack paths.
Prioritize exposure using threat intelligence, attack paths, privilege impact and business context.
Operationalize remediation through workflows, SLAs, escalation paths and orchestration.
Validate closure of attack paths and continuously adapt as threats and environments evolve.

Our Clients Achieve

Faster discovery and prioritization
Remediation within defined SLAs
Reduced attack paths
Improved patching cadence
Clear, executive-ready reporting

Project QuiltWorks

Project QuiltWorks is an industry coalition including Kroll, built to close the AI vulnerability gap for enterprises. This coalition sets a new standard for vulnerability discovery and collaborative cybersecurity in AI.

Frontier AI models integrated across the Falcon platform through Project QuiltWorks uncover logic flaws, misconfigurations and novel exploit paths that scanners and human reviews may miss.

As part of Project QuiltWorks, Kroll is working with CrowdStrike to combine technology-enabled discovery, adversary-informed prioritization and guided remediation with Kroll’s expertise in consulting, incident response, regulatory compliance, AI risk management and remediation.

What Every C-Suite Should Be Asking

C-Suite Role	Key Considerations	Key Threats to Manage and Measure
CISO	Which exposures can an attacker realistically reach, chain and exploit? Where does remediation stall?	Threat-informed prioritization, ownership, mitigation plans, verification evidence and operational metrics.
CFO	What is the potential financial impact, which investments reduce risk most and where are we paying for activity rather than risk reduction?	Financial exposure scenarios, remediation capacity analysis, risk-reduction options and investment trade-offs.
General Counsel / CRO	What is material, what needs disclosure or notification, who accepted the risk and what evidence supports the decision?	Governance and risk management records, disclosure and notification playbooks, third-party obligations and defensible documentation.
Board / Audit or Risk Committee	Are we exposed in ways that affect operations, customers, regulated data, revenue or resilience?	Plain-language reporting on exposure trends, verified closure, accepted risks, residual exposure and investment decisions.

AI-Enhanced Vulnerability Exploitation Pathway

Kroll Perspectives: AI-Accelerated Cyber Risk Management

MITRE ATT&CK Tactics

TA0001 – Initial Access

Key Techniques

T1566 – Phishing (Spearphishing Link / Attachment / Voice)
T1656 – Impersonation
T1204 – User Execution

AI Enhancement

LLM-generated spearphishing emails at scale
AI voice cloning (vishing / executive impersonation)
Target profiling using OSINT summarization

Real-World Examples

Scattered Spider (2023–2025): Used highly tailored social engineering and helpdesk impersonation; emerging reporting shows the use of AI-written scripts to improve success rates
Business Email Compromise (BEC) Campaigns (2024–2026): Increasing use of generative AI to produce fluent, context-aware phishing emails
Deepfake Voice Fraud (UK energy firm case, €220k theft): AI-generated CEO voice used to authorize fund transfer

What Executives Can Do Now

Immediate Actions

Align security, legal, finance, risk and business leaders on how exposure decisions will be made and escalated.
Establish a shared view of critical exposures, accountable owners and business impact.
Review how AI-enabled systems, agents, third parties and non-human identities are incorporated into existing risk management processes.
Connect exposure management with incident response, crisis management and disclosure planning.
Identify where remediation, mitigation or risk acceptance decisions are slowing down.

Near-Term Actions

Evolve prioritization to include exploitability, attack paths, business impact, resilience impact and mitigation options.
Strengthen the operating model for exposure management, including ownership, escalation, governance and executive reporting.
Test how quickly the organization can respond to a high-impact exposure across security, IT, legal, finance and the business.
Refresh incident response, BCP and DR planning for AI-enabled systems, third-party dependencies and accelerated exploitation scenarios.
Develop board-level reporting that shows exposure reduction, decision quality, accepted risk and remediation capacity.

Explore Insights

September 24, 2026

Penetration Testing

Agentic AI-Assisted Penetration Testing: AI Scale. Human Precision

Alex Cowperthwaite, Krishna Raja

August 5, 2026

Cyber

Agentic AI: From Model Risk to Enterprise Risk

Victor Wingsing Jr.

June 17, 2026

Project QuiltWorks and the Next Phase of Threat Exposure Management

Managing Cyber Exposure at AI Speed

June 11, 2026

Cyber

The Regulatory Cliff Edge

Dave Burg, Tiernan Connolly, Victor Wingsing Jr.

Stay Ahead With Kroll

Kroll supports thousands of clients on the frontier of AI and risk, leveraging global, market-leading expertise in a wide range of risk mitigation disciplines. Learn more about the core areas of expertise that we leverage to build our bespoke solutions.

Why Choose Kroll?

Deep technical and vulnerability management expertise, gained from more than 150k hours of security testing per year
Unparalleled incident response experience
Frontline intelligence from thousands of investigations every year
A broad range of services for security, risk, investigations and compliance

Talk to a Kroll Expert

Connect with Us

Robb Mayeski

Global Head of Engineered Defense and CrowdStrike Services Portfolio Owner

Cyber and Data Resilience

Washington DC

[email protected]+1 2124502834

Alex Cowperthwaite

Technical Director of Research and Development

Cyber and Data Resilience

Toronto

[email protected]+1 4166433549

Dave Burg

Global Group Head of Cyber and Data Resilience

Washington DC

Dave Burg [email protected]+1 2024491844

Nicole Koopman

Global Head of Commercial Office and Managing Director, Enterprise

Cyber and Data Resilience

New York

Nicole Koopman [email protected]+1 2128333258

Stay Ahead with Kroll

Cyber Risk Assessments

Kroll's cyber risk assessments and advisory services deliver actionable recommendations to improve security, using industry best practices & the best technology available.

Learn more

Threat Exposure Management

Kroll’s field-proven cyber security assessment and testing solutions help identify, evaluate and prioritize risks to people, data, operations and technologies worldwide.

Learn more

Technology Expert Services

Our team has decades of experience serving as independent advisors, and our client-focused approach and deep technical expertise allows us to work across a spectrum of technologies, industries and data issues.

Learn more

Cyber Transformation

Implement, configure and run scalable cybersecurity programs at the pace of digital transformation

Learn more

Regulatory Compliance Assessments

Expert support to comply with a wide range of cybersecurity compliance requirements and build long-term cyber resilience.

Learn more

Cyber Litigation Support

Whether responding to an investigatory matter, forensic discovery demand, or information security incident, Kroll’s forensic engineers have extensive experience providing litigation support and global eDiscovery services to help clients win cases and mitigate losses.

Learn more