Korva
Tech

Even small criminals can now hack like nation-states

Defenses built for human reaction times cannot keep up once machines do the attacking.

AI image
Lightspeed Venture Partners · The End of Human-Based Cyber Defense | Yossi Torati, A Security

Criminals online are getting the sophistication once reserved for nation-states.

That is the shift described by Yossi Torati, founder and chief executive of the security startup A Security. Asked what is different when a machine attacks instead of a human, he points first to speed. Existing tools and practices, he says, were designed for human attackers and for the time defenders need to find them and stop them.

The second change is who can use top-level skill. Advanced hacking once belonged to nation-state teams and was aimed at very specific targets. Torati calls the change "a democratization of the most advanced offensive skills" that "will be available to all criminals" working online.

The result is a move from opportunistic attacks to comprehensive ones. Attackers no longer wait for a weak target to turn up; they can check everyone.

Questions people ask

What did nation-state hacking look like before AI?

It meant large, well funded government teams that spent months studying one target, built custom tools, and moved carefully to avoid detection. Only a few governments could afford that kind of patience and skill. Ordinary criminals mostly relied on simpler scams, stolen passwords, and known flaws.

How does AI actually make an ordinary criminal more sophisticated?

Modern AI tools can scan systems, write malicious code, draft convincing phishing emails, and adapt when blocked, all in seconds. That lets one person run work that once took a skilled team. The criminal still decides the goal, but the machine handles much of the technical labor.

Why does speed matter so much in cybersecurity?

Most defense assumes there is time to notice an intruder, investigate, and install a fix before serious damage is done. Machine-speed attacks can find a new weakness and exploit it in hours or minutes. When that window shrinks, human teams simply cannot react fast enough on their own.