Google, CrowdStrike and Kroll struggle to handle surge in AI-powered cyberattacks

Some of America's biggest cybersecurity companies are struggling to handle a sharp rise in cyberattacks powered by artificial intelligence (AI). The situation has become so serious that companies are turning away new customers who need urgent help after being hacked.

Google Mandiant, CrowdStrike and Kroll face a surge in AI-powered cyberattacks. (via social media/ twitter )Three major US cybersecurity firms — Google's Mandiant, CrowdStrike and Kroll — told NBC News that they are facing an unusually high number of cyberattacks.

They said the volume of attacks has reached a level they have not experienced before. The companies said that the biggest reason behind the growing number of attacks is the use of AI tools. These tools have made hacking operations much faster, easier and cheaper to carry out.

While hackers can now use AI to attack hundreds of organisations, cybersecurity companies still need time, skilled workers and significant manpower to investigate and fix the damage caused by these attacks. Charles Carmakal, chief technology officer at Mandiant, said the company has been extremely busy over the past 12 months.

However, the situation has become much worse over the past two months, with a sharp increase in hacking attempts. He said the latest surge is overwhelming both cybersecurity defence teams and companies that respond to cyberattacks.

Mandiant is Google's cloud cybersecurity company. Major cybersecurity firms often have existing contracts, also known as retainers, with large corporate customers. These contracts allow companies to receive help from cybersecurity experts when they face an attack.

Since the number of cyberattacks has increased sharply, firms are giving priority to customers who already have these agreements. As a result, businesses that do not have existing contracts are struggling to find experts to help them after being hacked, Carmakal said.

Carmakal said incident response companies are turning down most organisations that approach them for help. He described the problem as an industrywide crisis, rather than something affecting just one or two cybersecurity firms.

AI has made it possible for very small groups of hackers to carry out large-scale attacks. Carmakal said a team with only a few people can now expand its hacking operations to hundreds of organisations. A recent hacking campaign identified by CrowdStrike shows how AI is helping sophisticated hacking groups expand their operations.

The group, allegedly working for Chinese intelligence, used an AI tool released earlier this year. The tool was originally developed to help website developers identify security weaknesses in their software. The hackers allegedly used it to find vulnerabilities and break into computer systems.

Since mid-October, the group has compromised several government agencies and companies across the world and targeted hundreds of other organisations, CrowdStrike said. CrowdStrike said agentic AI is allowing even less-skilled hackers to carry out attacks that were earlier associated with highly advanced government-backed hacking groups.

A CrowdStrike spokesperson said the threat from AI-powered hackers is already here and there are no signs that these attacks will slow down. The company said hackers are now using AI agents to carry out activities that were once largely limited to nation-state hacking groups.

AI tools have reduced the need for such expertise by helping hackers automate several steps. Many of these tools are also free to download and use, making it easier for more people to attempt cyberattacks. Max Henderson, global head of digital forensics and incident response at Kroll, said there is a major difference between how hackers and cybersecurity teams can use AI.

Hackers can experiment with AI tools repeatedly and try different methods until they find a way into a system. They do not have to worry as much about making mistakes during these attempts. However, cybersecurity companies must be much more careful when using AI to protect businesses and their systems.

Henderson said many organisations are currently trying to introduce AI tools into their cybersecurity defence systems. However, putting these tools into use takes time because companies must ensure that they work properly and safely.

On the other hand, hackers do not face the same restrictions and can focus mainly on speed. Kroll is actively recruiting more employees to deal with the rising number of cyberattacks, Henderson said. However, hiring new workers takes time, and the company must also make sure its existing employees are not overworked.