Why 2026 is Different

What this episode is about

Who benefits more from artificial intelligence in cybersecurity — the attackers or the defenders? This is the question we stretch across the entire season. In episode one we set the frame by placing three reports next to each other that appeared within eighteen months and describe the same situation from three different stages of development.

The three situational reports

Microsoft and OpenAI, February 2024. The two companies publish the first named state actors using commercial LLMs — Forest Blizzard from Russia, Charcoal and Salmon Typhoon from China, Crimson Sandstorm from Iran, Emerald Sleet from North Korea. All accounts are suspended. Microsoft formulates the observation remarkably soberly: we see no attack techniques that wouldn’t have been possible without AI. What we see is pace. In the MITRE ATLAS framework, this lands under Resource Development — the model is a productivity tool, not a weapon. Lukas from research points to the work by Julian Hazell that had already proven this efficiency stage academically: GPT-4 produces personalized spear-phishing emails at cents per recipient with human-comparable conversion rates.

BACS Switzerland, semi-annual report 2025/1. The Swiss Federal Office for Cybersecurity reports 35,727 cyber incidents in the first half of 2025, 58 percent of which are fraud. In parallel, the Swiss Federal Council adopted its own report on the effect of AI on cybersecurity (Postulate 23.3861), whose core message is deliberately calm: AI acts as a catalyst for existing trends but does not change the fundamentals. Robert from practice confirms this observation from the MDR telemetry of his Swiss clients — dramatically more spear-phishing attempts, significantly improved language. Where typical translation errors were still recognizable in 2022, today’s emails read contextually consistent. Linguistic anomaly as a detection feature is dead.

Anthropic, August 2025. The third report describes not just efficiency, but operational takeover. Anthropic documents a campaign called “vibe hacking”: a single actor extorts seventeen organizations with Claude Code as an agentic operator — reconnaissance, credential collection, individual extortion letters per victim, parallelized. On top, two further case classes — North Korean sanctions evasion through fake remote employment, and a Chinese autonomous cyber-espionage campaign that Anthropic calls GTG-1002. Chris frames the difference to Microsoft technically: what has changed is the agentic loop. Tool-use and longer context windows turn the advising model into an operator that works autonomously inside a target system for days.

The thesis of the season

Three reports, three phases, one clear line. What was an efficiency boost two years ago is operational layer today — and the transition is gradient, not abrupt. Anyone building defender architectures in 2026 without pricing in this reality is building defense against 2022.

Three observations condense the thesis. From the research perspective — Lukas — it stands out that Microsoft observes the model side, not the endpoint. Who talks to ChatGPT is visible; what happens at the victim is not. A blind spot remains: an actor running an open-source model like Mixtral or Llama locally is invisible to this telemetry. From the practitioner’s perspective — Robert — the detection problem shifts into the identity and behavioral layer. Classic signature-based SIEM detection no longer catches the new spear-phishing quality. From the AI perspective — Chris — defenders and attackers depend on the same methodology. Frontier models are available via API with sub-cent costs per thousand tokens, open-source models run on two consumer GPUs. The cost curve no longer separates by actor type.

What you take away from this episode

Switzerland is structurally better positioned than the EU average because BACS was mandated early and is closely networked with the private sector. The research density in the DACH region — ETH, EPFL, OST and a leading German information-security research center — is a strategic strength that hasn’t yet fully translated into operational defensive capacity. The gap lies in the mid-market segment. That is exactly where attacks have reached a quality level in the last twelve months where they become economical — also against smaller targets. The core recommendation at the end of the episode: anyone as a CISO thinking AI is still future is already behind today. In the following episodes, we look at the offensive and defensive sides separately — beginning with frontier models that find vulnerabilities.