Join the conversation with Microsoft security experts. Explore how AI intersects with familiar attacker behaviors and why security fundamentals still matter.
ASK MICROSOFT ANYTHING
How AI-powered attacks happen: Real threat scenarios and the security controls that stop them
Tuesday, October 27 | 9:00–10:00 a.m. Pacific time | Virtual | LIVE
Register for the live webinar or submit a question
How might attackers use AI
Artificial intelligence is creating new questions for cybersecurity. Defenders are exploring AI to analyze large volumes of information, identify suspicious activity, support investigations, and assist response teams. Attackers may explore similar capabilities, raising questions about which activities AI could influence and where practical limits remain.
That leads to an interesting question: What changes when attackers have access to the same AI capabilities similar to those that defenders use? Microsoft security experts will be exploring this topic through realistic threat scenarios and a practical discussion of current capabilities and limits.
How might AI affect familiar attacker behavior
Many cyberattacks begin with research into a target. Attackers map out a target’s people, systems, identities, applications, and entry points. Then they test ideas, craft convincing communications, modify scripts, sift through information, and adapt when an approach fails. Those behaviors aren’t new. The question is whether AI could change their speed, scale, or required effort.
Rather than assume the answer, we’ll examine where AI assistance might, and might not, change the time, expertise, or manual effort involved in specific attacker activities. For example:
- Could AI assistance change how attackers conduct reconnaissance? Could it affect the personalization of social engineering content?
- How might attackers use AI to examine stolen or publicly available information?
- Where can natural-language tools assist with creating, modifying, or troubleshooting scripts, and what are their limits?
- Could AI change how attackers test and refine their approaches?
One significant effect may come from how several capabilities work together, rather than from any single one. What changes when they are combined, and where do practical limits remain?
What does an AI-powered attack actually look like
That’s where the conversation gets interesting. Does AI enable genuinely new attacks, or does it change the effort, cost, and reach of familiar ones?
We’ll look at which attack stages AI assistance might influence, where its limits remain, and what changes when AI systems receive tools and permissions to act with human oversight. Most importantly, we’ll discuss which security controls remain important as attacker methods evolve.
These questions are at the heart of our upcoming live AMA session: How AI-powered attacks happen: Real threat scenarios and security controls that stop them. We’ll examine realistic scenarios and discuss where AI may intersect with attacker behavior. Then we’ll open the conversation to you. This fully live session opens with a focused 25–30-minute presentation, followed by a live AMA for your scenarios, questions, and challenges.
Watch the session on the Microsoft Community Learning YouTube channel or the Microsoft Tech Community event page.
Bring us the hard questions
Maybe you’re wondering:
- Where could AI assist parts of an attack, and what are its limits?
- How might generative AI affect phishing and social engineering?
- How should identity teams think about AI-assisted adversaries?
- What risks should defenders consider when attackers combine multiple AI-assisted capabilities?
- Which security controls deserve renewed attention as AI capabilities evolve?
- How should defenders separate realistic AI threats from hype?
Or maybe your question is simply, "What aren’t we thinking about yet?”
The fundamentals still matter
The other side of this conversation may matter even more. AI could change what attackers attempt, how they perform some tasks, and the expertise or effort certain techniques require. Attacker workflows may evolve, but their objectives still involve identities, devices, applications, data, permissions, and security boundaries. That gives defenders a practical lens to apply established security knowledge to AI-assisted attacks, and test whether existing principles still hold across the attack lifecycle.
That’s the conversation we want to have.
Bring your scenarios.
Bring the thing your security team has been debating.
Post your questions on the Microsoft Tech Community event pageand join us live on October 27.
Microsoft