Over the past two decades, the security community maintained an unspoken hierarchy. Nation-state hackers occupied the top tier, followed by criminal groups, while script kiddies who merely ran off-the-shelf tools without understanding errors sat at the bottom. This ranking carried an implicit assumption: attack capability scales directly with technical skill. Without reverse engineering expertise or the ability to write custom exploits, meaningful intrusions remained out of reach.
Generative AI is now dismantling that assumption. The technology will not instantly transform a complete novice into a top-tier threat actor, yet it can systematically fill knowledge gaps. Tasks that once required years of accumulated experience—researching documentation, explaining unfamiliar concepts, generating code, troubleshooting errors, and adapting established techniques to new targets—can now be advanced through dialogue. A young attacker with limited practical experience may complete sophisticated attack chains within weeks that previously demanded seasoned operators.
Adversaries have long sought an inexpensive, tireless, on-demand junior hacker. That resource has arrived. Each major technology wave first alters economic calculations. Cloud computing reduced infrastructure costs, open-source software lowered application development expenses, and large language models are now compressing the cost of offensive security knowledge. An attacker who previously spent weeks digesting a newly disclosed vulnerability can now delegate research, exploit prototyping, and environment adaptation to AI within minutes.
The label script kiddie no longer captures the emerging pattern. Today’s attackers increasingly work in tandem with an AI assistant, iteratively refining payloads, debugging code, and customizing known methods for specific environments. This workflow mirrors the developer practice known as vibe coding, in which natural language replaces most manual coding labor. Offensive security is following the same trajectory, giving rise to what some observers term vibe hacking.
Many enterprise security programs rest on the unstated premise that truly capable attackers remain scarce. Under this view, blocking elite threats suffices because lower-tier actors pose limited risk. That premise requires reevaluation. If AI enables more individuals to perform operations that once demanded professional experience, defenders should anticipate increased probing volume, faster technique adaptation, and higher overall attack frequency. The question shifts from whether adversaries possess advanced skills to whether defenses remain effective once opponents become more proficient at reconnaissance, exploit modification, and payload customization.
Most organizations already possess substantial visibility through vulnerability tracking, cloud configuration monitoring, endpoint detection, identity management, and attack surface management tools. The real bottleneck lies elsewhere: determining which weaknesses are genuinely critical before adversaries exploit them. AI is shortening the window between vulnerability disclosure and exploitation, rendering biannual penetration tests and periodic scans insufficient on their own. Continuous evidence is required that key attack paths remain closed, compensating controls stay effective, and security investments actually reduce exploitable risk rather than merely generating additional findings.
This requirement aligns with the principles of CTEM (Continuous Threat Exposure Management), which converts discovery, prioritization, validation, and remediation into an ongoing cycle. The validation step is operationalized through AEV (Adversarial Exposure Validation) and PTaaS (Penetration Testing as a Service), both of which test the precise paths AI-assisted attackers are likely to pursue. The focus therefore moves from “what did we find” to “does this control still hold.”
Paradoxically, wider AI adoption may increase the value of senior security experts. Automation excels at processing information and generating hypotheses, yet assessing the true business risk of a vulnerability still requires human judgment informed by runtime dependencies, organizational priorities, attacker intent, and contextual understanding that current models lack. Organizations that integrate these tools effectively will amplify rather than replace human expertise.
Attackers are already using AI to compensate for missing experience. The question for defenders is whether they are doing the same.
