Snyk Panel: AI Turns Accepted Risks Into Margin Calls For Enterprises

On October 14th in San Francisco, Snyk hosted an unfiltered AI security panel featuring leaders from OpenAI, Google, boldstart ventures, and Snyk. The group agreed that artificial intelligence has made cyberattacks cheap, fast, and widely available, effectively calling in every risk an organization has previously accepted.

The panelists emphasized that finding vulnerabilities is becoming easier every month, but the ability to fix them remains the primary constraint. Defenders will not close the gap until machines handle most remediation tasks. This must occur within real identity, permission, and intent controls to be effective.

The Mechanics Of AI-Driven Attacks

Manoj Nair, Snyk’s CTO, described AI as both a new attack surface and an insider threat. He stated that AI represents a margin call on all existing organizational risks. John Hultquist of Google Threat Intelligence Group explained that attackers have used autonomous technology for eight years, evolving from fake images to deepfake calls and full operations.

North Korean IT workers now run operations on models from start to finish. Hultquist noted that models help attackers troubleshoot mid-attack and move through networks faster. They can also turn a fresh patch into a working exploit before most defenders apply it, scaling these capabilities to a broader audience.

Agents As A New Threat Surface

Ed Sim of boldstart ventures highlighted recent South Korean bank breaches as a case study. CrowdStrike reported that a single 26-year-old operator likely used open-source AI agents and commercial coding tools to target at least nine banks. This allows one human to target many customers in a short period using AI power.

Hultquist pointed out the asymmetry in consequences. Online attackers experiment at very low cost and face no immediate physical repercussions like jail time. This low barrier to entry enables a global workforce of hackers to leverage machines with human oversight, creating a persistent threat that traditional defenses struggle to match.

What should you do?

The panel suggests that organizations must accept that manual remediation is no longer sufficient. Security teams need to implement systems where machines perform fixing tasks automatically. These systems must operate within strict boundaries defined by real identity, permissions, and intent to prevent abuse while accelerating response times.

Background: Threat intelligence program

A cyber intelligence program collects, analyzes, and distributes data about threats to help you defend your organization. It works by connecting external threat feeds to internal telemetry. You affect your security posture by prioritizing context over volume, ensuring every alert ties to a specific business risk or asset.

Read the full guide: Build a Cyber Intelligence Program That Cuts Noise and Finds Threats

What to do and how to stay safe: Snyk

• Audit existing accepted risks and prioritize those most vulnerable to automated AI exploitation
• Implement automated remediation workflows that operate within strict identity and permission controls
• Monitor for rapid exploit development that leverages AI to bypass fresh patches
• Review agent permissions to ensure they cannot escalate privileges or access sensitive data

Step-by-step guide: Social Engineering Warning Signs and How to Respond

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Why is AI considered a margin call on existing risks?

AI lowers the cost and time required to exploit vulnerabilities, forcing organizations to address legacy risks they previously accepted as manageable.

How are attackers using AI agents in recent breaches?

Attackers use autonomous AI agents to conduct penetration testing and coding, allowing a single operator to target multiple victims rapidly.

What is the main constraint for defenders against AI attacks?

The main constraint is the ability to fix vulnerabilities quickly enough, requiring machine-speed remediation within strict identity and permission controls.