Verizon's 2026 breach report, drawn from more than 31,000 real incidents and over 22,000 confirmed breaches across 145 countries, produced a headline result that has nothing to do with AI. For the first time in the report's history, exploitation of software vulnerabilities passed stolen credentials as the leading route to initial access, accounting for 31% of breaches. Ransomware appeared in 48% of them. Generative AI is in the data too, used across several stages of real attacks. But the numbers that moved are the old ones, and that gap is the most useful thing in the report.
The same report supplies the AI finding that gets quoted: attackers have already used generative AI to develop malware, select targets and obtain initial access. That moves AI-assisted intrusion out of the forecast column. It is part of the operating threat environment, present in the incident data alongside unpatched software and stolen logins.
What it is not, on this evidence, is the main adversary. AI functions as an accelerant. It makes attackers more efficient at reconnaissance, vulnerability discovery, social engineering and malware production, and it makes defenders faster at threat detection, event correlation, incident response and ranking the vulnerabilities they find. Organizations are still breached through the same doors: unpatched software, stolen credentials, human error, contractors and weak defensive architecture. The strategic question is not how to keep AI out of security. It is whether the architecture underneath can survive a world where both sides run increasingly capable systems.
That architecture is the actual problem, and it was broken long before agents arrived. For years security was built around a perimeter: firewalls around trusted internal networks, applications on company servers, staff in offices, data held inside the organization. That environment no longer exists. Employees work remotely from mobile devices, applications are spread across several clouds, corporate networks connect to IoT devices, IT and operational technology increasingly touch each other, business systems are open to external contractors, and sensitive data moves between organizations, platforms and jurisdictions. AI agents are now starting to sit in the middle of all of it, linking people, data and applications.
This is why Zero Trust matters more than it did: a user, device, application or digital identity should not be treated as trusted simply because it is on the network or has already authenticated. Access gets evaluated against identity, context, behavior, granted permissions and actual need. In an AI-heavy environment the principle has to extend past humans. Agents, automated services and machine identities become entities with permissions that can be issued, monitored, constrained and revoked, and each one needs four answers: what it can reach, what it can do, why it needs that access, and how quickly the access can be cut off.
A system that answers a prompt is one category of risk. An agent that reads databases, calls applications, writes code, makes decisions and acts on behalf of a person or a company is a different one. The pressure to feed models more corporate data is real, and more data does improve answers, but public information, internal business documents, intellectual property, personal data, financial records, medical records, operational technology details and national security material do not belong in one undifferentiated pool. An assistant that helps staff find published regulations does not need free access to the company's intellectual property. A customer support system should not automatically reach financial systems. A document analysis tool should not cross into the OT environment because the underlying network happens to allow it. Micro-segmentation, identity-based controls, data classification, encryption and continuous monitoring are what keep a compromised AI system from becoming a compromised organization.
In hospitals, financial institutions, industrial plants, energy systems, transport networks, telecoms infrastructure and national security systems, the calculation gets harder, because AI is genuinely useful there — monitoring industrial equipment, catching deviations, optimizing processes, supporting medical analysis. The recommendation is controlled integration rather than isolation: stronger authentication, tighter segmentation, restricted permissions, continuous audit, and in some cases access through controlled gateways or isolated runtimes instead of direct connections. Actions with serious consequences require separate authorization, particularly where an AI decision could touch financial assets, physical infrastructure, human safety or national security. An agent should not escalate its own privileges because it has concluded that would be more efficient, and it should not hand its authority to another agent without a policy that permits it. CISA and its partners are drafting guidance for AI integration into operational technology environments.
Here is what stands out in all of this. Every claim about the old threats carries a number: 31%, 48%, 31,000, 22,000, 145. The AI claim carries none. We are told generative AI appeared at several stages of attacks; we are not told in what share of the 22,000 confirmed breaches, or whether that share grew. Notably absent from the AI discussion is any quantity at all. That does not make the finding wrong — it makes the proportionality unknowable, which is exactly the condition under which security budgets get reallocated toward whatever is loudest.
The second thing worth saying plainly: the remedy list here is almost entirely the pre-AI list. Zero Trust, segmentation, strong identity, encryption, continuous monitoring, least privilege, public-private information sharing. These were the recommendations before agents existed and they remain correct. The genuinely new item is machine identity — treating an agent as a principal with issued, auditable, revocable permissions. That is the part most organizations have not built, and it is the part that gets one paragraph in an argument that gives five to things their security teams already know.
There is a third tension the argument raises without resolving. Defensive AI is presented as necessary, and the case for it is strong: correlating signals across systems, spotting anomalies, prioritizing vulnerabilities, processing telemetry volumes no human analyst can, separating real threats from alert noise, and automating containment steps under predefined rules — isolating a compromised endpoint, revoking credentials, blocking suspicious traffic, escalating the consequential decisions to a person. But a defensive agent that can revoke credentials and quarantine endpoints is, by construction, one of the most privileged identities on the network. Saying it too needs constraints is correct and insufficient.
The quantum section of the argument is the one with a real clock on it, and it is buried in the middle. A sufficiently powerful quantum computer would break the public key cryptography underneath current communications, transactions and identities, and adversaries can collect encrypted data now to decrypt later. Government records, defense information, intellectual property, medical data, financial information and strategic business communications all retain value for decades. NIST's position is that migration should start now; three finished post-quantum standards are available, the published transition schedule puts high-risk systems first, and quantum-vulnerable algorithms will eventually be removed from NIST standards. The migration is hard because cryptography is embedded in applications, cloud platforms, devices, communications systems and supply chains, and most organizations cannot produce a full inventory of which applications use which algorithms. AI is a plausible tool for building that inventory — finding vulnerable systems, mapping cryptographic dependencies, analyzing software lists, ordering the migration.
Cooperation between government and industry is the standard closing ask, through CISA, information sharing organizations, sector partnerships and the Joint Cyber Defense Collaborative. Individual companies cannot match state intelligence collection, law enforcement reach or visibility into state-linked groups; the state cannot defend an ecosystem it does not own. The admission inside the recommendation is that this sharing needs to become faster and more operational than it currently is — which is another way of saying the existing arrangement does not run at attack speed. It matters more now because the AI ecosystem is built almost entirely by private companies: the foundation models, cloud platforms, semiconductor technology and applications that will shape national security are commercial products.
The case is made by the author of Inside Cyber: How AI, 5G, IoT, and Quantum Computing Will Transform Privacy and Our Security, and it lands on resilience rather than prevention. No organization can guarantee it will not be breached. The work is to make attacks harder, reduce their impact, detect intrusion quickly and recover quickly — which means not pooling sensitive data in one place, segmenting critical systems so one compromise is not total, hardening encryption ahead of the quantum transition, and protecting recovery systems, because backups connected to the environment an attacker is working through are not backups.
Which leaves security teams holding two instructions that pull against each other: run more AI on defense, and give AI less access everywhere else. Both arrive in the same week, for the same network, from the same argument. The organizations that can tell which systems sit on which side of that line will be fine. The ones that cannot will end up with an agent that has read everything and a policy document explaining why it should not have.