Fast Facts
Dhananjay Ganjoo, Managing Director – India & SAARC
-
AI-enabled attacks can adapt mid-operation, changing techniques as they learn from an application’s responses—turning defence into a moving-target challenge.
-
Known-threat tools remain essential, but aren’t enough. With APIs and applications changing constantly, defenders need continuous runtime visibility to spot suspicious behaviour and attack patterns as they develop.
-
Detection must lead to precise, immediate enforcement—blocking or limiting malicious activity while keeping legitimate users and critical services online.
- Resilience depends on consistent protection across hybrid and multicloud environments. The goal is to catch behavioural changes before they become business disruption; API-, bot- and DDoS-related incidents take an average of 2.8 hours to resolve.
Problem Explained
Anthropic’s 2026 analysis of 832 accounts banned for malicious cyber activity points to a shift: some attackers are using AI during live operations to probe systems, learn from responses, and change tactics as they go. Rather than follow one fixed attack pattern, they can alter requests, switch API endpoints, or exploit legitimate functions when an approach fails. Dhananjay Ganjoo, Managing Director for India and SAARC, reports that this adaptability makes attacks harder to detect with tools designed mainly to recognise known threats.
The risk falls on organisations whose applications and APIs span cloud, on-premises, Kubernetes, and edge environments. It reaches sectors such as healthcare, payments, e-commerce, and industry, where disruption can affect essential services and business operations. Ganjoo argues that because both attacks and application environments change rapidly, defenders need continuous visibility into live traffic, behavioural detection, and enforcement that can stop suspicious activity without unnecessarily blocking legitimate users.
Potential Risks
“When Threats Don’t Wait, Security Can’t Either” applies to every business, regardless of size or industry. A phishing email, stolen credential, or vulnerable system can become an incident before a team has time to respond. When defenses or decisions lag, attackers can disrupt operations, expose sensitive data, and impose costly recovery, legal, and regulatory burdens. Moreover, customers may lose confidence, partners may reconsider their relationships, and reputational damage can linger long after systems are restored. Therefore, prompt detection and response are not merely technical priorities; they help protect a business’s continuity, finances, and trust.
Possible Next Steps
When threats move quickly, timely remediation limits exposure, disrupts attacker activity, and reduces operational harm—an imperative reflected across the NIST Cybersecurity Framework (CSF).
Mitigation Steps
- Prioritize the risk: Triage alerts and vulnerabilities by severity, exploitability, and potential business impact; assign clear owners and deadlines. (Identify)
- Apply fixes promptly: Patch affected systems, update insecure configurations, or disable vulnerable services. Test urgent changes where feasible, without letting testing become a reason for avoidable delay. (Protect)
- Contain active threats: Isolate compromised devices, block malicious domains or traffic, and restrict affected accounts or network access. (Respond)
- Remove attacker access: Eliminate malware and persistence mechanisms; rotate exposed passwords, revoke compromised tokens, and restore secure account settings. (Respond)
- Check for wider exposure: Search logs and systems for related indicators, affected assets, and signs of continued access. (Detect; Respond)
- Recover safely: Restore clean systems and data from verified backups, then confirm that services operate securely before returning them to normal use. (Recover)
- Communicate and improve: Notify relevant stakeholders, document actions and decisions, and update controls or procedures to address what allowed the issue. (Govern; Improve)
Stay Ahead in Cybersecurity
Stay informed on the latest Threat Intelligence and Cyberattacks.
Learn more about global cybersecurity standards through the NIST Cybersecurity Framework.
Disclaimer: The information provided may not always be accurate or up to date. Please do your own research, as the cybersecurity landscape evolves rapidly. Intended for secondary references purposes only.
Cyberattacks-V1
