As head of counter-adversary operations at CrowdStrike , Adam Meyers has a front-row seat to the threats facing companies. Yet even for him, a recent trip to South Korea was out of the ordinary. As he was preparing to sleep on the flight from the United States, Meyers received a message from colleagues informing him that six Korean banks had been hacked and that he would likely face questions about the incident upon landing.
By the time his flight touched down, his team at CrowdStrike had pinpointed the server used by the attacker, recovered records of their activity, and even identified a suspect. The alleged hacker had inadvertently left personal information behind while using AI tools to conduct the attacks.
The incident, which CrowdStrike subsequently investigated , involved Artex, an open-source AI-powered penetration-testing tool, alongside LLMs from a variety of providers. The scale and speed of the attack illustrate why artificial intelligence has fueled growing fears about the future of cybersecurity.
But Meyers isn’t panicking. “I thrive on chaos,” he says. And in a conversation with Fast Company at the company’s Fal.Con conference in Barcelona, he argues that much of the alarm surrounding AI-powered hacking is misplaced. “Fundamentally, this is nothing new. It’s just speed and volume,” he says. “AI hasn’t come up with new exploit paths or new vulnerability classes, right? It’s all the same stuff we’re already aware of.”
That doesn’t mean the technology is harmless. But Meyers believes the cybersecurity industry risks confusing the capabilities of increasingly sophisticated AI models with the actual threat they pose to organizations.
He’s not alone. Ciaran Martin, the former head of the U.K.’s National Cyber Security Centre, argues that much of the discussion around AI-enabled hacking has become detached from the realities of cybercrime. “To some extent, we’ve lost our mind in 2026 because of the extent of the capabilities,” he says.
Martin believes companies developing frontier AI models have focused heavily on what their systems can theoretically accomplish without paying enough attention to the motivations and constraints of actual attackers. “They don’t understand threat actors. They don’t understand hackers. They don’t understand the economics and the sociology and the politics of hacking,” he says.
The result, Martin suggests, is an industry increasingly alarmed by suspicious activity, even as the growing volume of automated attacks doesn’t necessarily translate into more successful compromises. That disconnect is putting pressure on security teams, which must sift through an ever-growing number of potential threats.
Eerke Boiten, a cybersecurity professor at De Montfort University in the U.K., sees a similar challenge. AI is accelerating the discovery of vulnerabilities, he explains, but the ability to exploit them isn’t necessarily advancing at the same pace. That leaves already overwhelmed security teams struggling to determine which threats warrant their attention. There is, however, a potential upside: The same AI capabilities that help attackers identify vulnerabilities could also help defenders fix them and assess how difficult they are to exploit.
When every vulnerability becomes an emergency
For Meyers, the challenge underscores a long-standing problem with how organizations assess cybersecurity risks. He argues that the industry has become too reliant on the Common Vulnerability Scoring System, or CVSS, which assigns numerical scores to security flaws on a scale of one to 10. PHP2Shell, a pair of vulnerabilities in the widely used PHP programming language that drew widespread attention, each received a score of 9.2.
Meyers says CrowdStrike examined the issue before its public disclosure and concluded that exploiting the vulnerabilities would be far from straightforward. Woodward agrees, noting that doing so required exceptionally precise timing and chaining vulnerabilities together. Still, the flaws weren’t merely theoretical: The Cybersecurity and Infrastructure Security Agency, part of the U.S. Department of Homeland Security, added both to its catalog of known exploited vulnerabilities on October 26, calling for urgent action.
Woodward maintains that CVSS remains useful because it accounts for the potential impact of an attack. Meyers, however, argues that severity scores shouldn’t be the sole factor determining how defenders respond. Instead, organizations should also consider evidence of attacks taking place in the wild. “I like to think about things in terms of what’s being actively exploited,” he says.
Otherwise, the industry risks creating a boy-who-cried-wolf scenario. “The more people get burned out, the more they’re going to make mistakes,” Meyers warns.
Boiten, for his part, sees reason for optimism. He believes that the collaboration underpinning vulnerability identification could eventually extend to fixing flaws, with AI-assisted coding potentially reducing the number introduced in the first place. That’s a notable shift in his thinking. Just a year ago, he expected the rise of vibe coding to produce even more vulnerabilities.
Amid the growing focus on AI, however, it’s easy to overlook one of cybersecurity’s most persistent vulnerabilities: humans. For all the technological advances transforming cybercrime, attackers still frequently gain access by exploiting human weaknesses.
Who benefits from the AI panic?
So why has AI captured so much attention? Meyers believes the companies developing the technology have played a significant role. “There’s a lot of fearmongering going on, and I think the frontier labs have been stoking that fire for their own benefit,” he says.
Meyers suggests that frightening predictions about AI capabilities could serve the commercial and regulatory interests of frontier AI companies, particularly as they consider going public. By emphasizing the potentially catastrophic consequences of their own technology, these companies may also be reinforcing perceptions of their power and importance.
The danger isn’t simply that organizations might devote too many resources to the wrong threats. It’s that a steady drumbeat of warnings could make them less responsive when a truly serious threat emerges.
“I think we need to be careful not to overhype it or we’ll find people stop listening, and then there will be something they really need to take care of,” says Woodward.
