So far, agentic AI has proven more effective for cyberattacks than cyber defense, but that may be changing.
Theresa Lanowitz, principal analyst at Omdia, spoke with Dark Reading's senior news director, Rob Wright, at the News Desk at Black Hat USA 2026 about new research regarding shifting enterprise investments in offensive cybersecurity practices, such as penetration testing, vulnerability assessments, and red teaming, amid growing concerns about AI-driven threats.
Lanowitz explained how organizations are looking to increase spending on offensive cybersecurity practices to keep pace with the increasing speed with which threat actors are weaponizing new vulnerabilities and launching attacks. One way to address the AI-enhanced speed of adversaries is to use AI on defense as well, though she highlighted some of the risks for organizations.
"You want to limit the blast radius of what that agent is actually able to do," Lanowitz said, referencing some of the recent attacks by rogue AI models.
For all of our Dark Reading News Desk videos, please check out our YouTube channel, and our curated video articles.
Dark Reading News Desk With Theresa Lanowitz: Full Transcript
Dark Reading's Rob Wright: Hello and welcome to the Dark Reading News Desk at Black Hat USA 2026 in Las Vegas. I'm Rob Wright with Dark Reading, and I'm here with Theresa Lanowitz of Omdia. Theresa, thank you for joining.
Theresa Lanowitz: Thank you so much, Rob. I'm really excited to be here with you.
DR's Rob Wright: I'm excited to dig into this research here. You're doing ... you did research on offensive cybersecurity.
Theresa Lanowitz: Yes, the title of it officially is "Offensive Security Strategies: Granting the Same AI Advantages to the Defender."
DR's Rob Wright: I love it because there's a bit of an imbalance, right?
Theresa Lanowitz: Right, right.
DR's Rob Wright: So, how can AI be used for offensive cybersecurity in a, I guess, safe, responsible way? Is it possible?
Theresa Lanowitz: Well, that's the question, right? The safe, responsible way, building trust, and that's really, I think, where we are right now. We're at that inflection point, and so from the research that we just conducted, what we found out is there were three big key areas. The first is AI is certainly fueling the need for offensive security strategies. However, there are some concerns there, and that goes to the point of trust and responsibility that you just made.
The second is that those traditional cybersecurity practices that we've been using in offensive security — they're no longer working. If you think of your traditional pen testing, your traditional red teaming, vulnerability assessment, social engineering testing, those are no longer working.
And then third, there's a spending increase in offensive security, so organizations are saying yes, we're going to spend more for offensive security because we know we need it because everything is moving faster because of AI. The attacks are moving faster, the attackers are moving faster, the vulnerabilities are being exploited. That's moving faster as well. Speed is now the biggest concern, and so along with that, this idea of continuous visibility comes into play.