AI Is Rewriting Offensive Cyber Security. Here's What It Means for Your Team
Offensive security has always been about thinking like an attacker. Penetration testers and red teams probe an organisation's defences, with permission, so weaknesses are found and fixed before criminals find them. Now artificial intelligence is changing how that work is done, on both sides.
Attackers are already using AI
The Australian Signals Directorate's Annual Cyber Threat Report 2025-26 was released on 27 October 2026. Launching it, Deputy Prime Minister Richard Marles called AI "the defining force in the cyber threat landscape". The report found that AI is lowering the barrier to cybercrime by automating reconnaissance, speeding up the search for vulnerabilities and making phishing and impersonation more convincing.
The numbers show the pressure:
- The ASD responded to more than 1,500 incidents, up over 20% on the previous year.
- Publicly reported vulnerabilities (CVEs) rose 30%.
- The average self-reported cost of cybercrime per business rose 16% to $93,500.
- Federal government agencies accounted for 32% of incidents.
When attackers can move faster with AI, defenders need to test faster too.
How AI is changing offensive security
Traditionally, a penetration test was a point-in-time exercise, often run once or twice a year. AI is shifting the model in three ways.
1. From periodic to continuous testing. AI-driven platforms can test systems around the clock rather than once a year. Gartner has forecast that many large enterprises will adopt continuous automated red teaming.
2. AI agents that find real vulnerabilities. In 2025, the AI system XBOW became the top-ranked hacker in the US on the HackerOne bug bounty platform, Resilient Cyber reports. In DARPA's AI Cyber Challenge, autonomous systems found 86% of planted vulnerabilities across 54 million lines of code. Investors have followed, with offensive AI start-ups raising hundreds of millions of dollars since 2025.
3. A new target: AI itself. As organisations deploy chatbots, large language models and autonomous agents, those systems need testing too. AI red teaming, which probes AI systems for risks like prompt injection, data leakage and unsafe behaviour, is quickly becoming its own specialty. The ASD report flags unintended AI agent behaviour as an emerging risk.
Humans still matter, and their roles are changing
AI is good at scale and repetition. It can scan, map and test far more than a human team. But it still struggles with the work that needs judgement:
- Testing complex business logic that a tool can't understand
- Simulating how a sophisticated, persistent threat actor would actually behave
- Checking AI findings for false positives
- Explaining risk in plain language to executives and boards
The result is a new kind of offensive security professional: someone who directs AI tools, validates their output and focuses on the hard problems.
The skills organisations now need
Australia was already short of cyber talent. A StickmanCyber analysis reported by Computer Weekly counted just 11,387 cyber security professionals nationally, about 3% of the ICT workforce, with penetration testing a particular shortage.
AI is adding new skill requirements on top of that gap. Roles in growing demand include:
- Penetration testers and red team operators who can work with AI-assisted tools
- AI security specialists and AI red teamers who test models, agents and AI applications
- Application and cloud security testers with automation and scripting skills
- Threat intelligence analysts who track how attackers are using AI
- Offensive security leads who can translate technical findings into business risk
In government and defence, many of these roles also require Baseline, NV1 or NV2 security clearance, which narrows the pool further.
What this means for employers and candidates
For employers: Review whether once-a-year testing is still enough. Upskill your existing testers in AI tools, and add AI systems to your testing scope. Experienced offensive security talent is scarce, so plan hiring early and look for adaptable people, not just a checklist of tools.
For cyber professionals: AI won't replace good testers, but testers who use AI will outpace those who don't. Build skills in AI-assisted testing, learn how AI systems can be attacked and defended, and keep certifications like OSCP or CREST current. Strong communication skills will set you apart.
How Hunter Professional can help
Hunter Professional connects organisations with cyber security talent across government, defence and the private sector, including penetration testers, red team specialists, security architects and cleared cyber professionals
Whether you're building an offensive security capability or looking for your next cyber role, talk to our team.
#CyberSecurity #OffensiveSecurity #PenetrationTesting #RedTeam #AISecurity #ArtificialIntelligence #CyberJobs #InfoSec #Recruitment #HunterProfessional