Recorded Future executive warns that AI accelerates cyberattacks, demanding a shift from manual analysis to machine-speed threat intelligence
November 9, 2026 · 3 min read
Yoon Kwang-taek, the head of Recorded Future, stated that the rapid acceleration of hacking techniques driven by artificial intelligence requires security teams to prioritize vulnerabilities that are actively being exploited over those that are merely identified. Speaking at the 2026 Artificial Intelligence Security Conference in Seoul, he emphasized that traditional methods of manual analysis are no longer sufficient to keep pace with modern threats. The conference, hosted by Dailysecu and supported by the Korea Internet and Security Agency and the Korea Information Security Industry Association, gathered approximately 700 security professionals on November 3, 2026.
The core of the presentation focused on the concept of machine speed, highlighting the disparity between attackers and defenders. Attackers utilize AI and cloud infrastructure to rapidly identify vulnerable systems and execute attacks, significantly reducing the time required for intrusion. In contrast, defenders face substantial delays and costs associated with system integration, analysis, and approval processes. Yoon explained that this asymmetry increases the operational burden on security teams, as the speed of attack outpaces the speed of traditional defensive response.
A key challenge identified was the sheer volume of vulnerabilities. Yoon noted that approximately 50,000 Common Vulnerabilities and Exposures were disclosed in 2025, yet fewer than 1 percent were actually exploited in real-world attacks. He argued that relying solely on severity scores, such as the Common Vulnerability Scoring System, is inefficient. A high score does not necessarily indicate immediate risk if the product is not used by the organization or if local access is required. Conversely, a lower score may demand urgent action if the vulnerability is currently being exploited and the organization's assets are exposed to the internet. Therefore, security teams must assess whether an attacker is actively using a flaw and whether their specific assets are affected.
Recorded Future has implemented AI to streamline the creation of vulnerability detection signatures. Previously, analysts spent significant time investigating vulnerabilities and setting up test environments. Now, AI pre-reviews remote attack possibilities and supports signature writing. The company reported an internal benchmark of approximately 31 minutes from vulnerability disclosure to signature deployment. This timeframe is intended to provide detection tools for selected vulnerabilities, allowing customers to verify the impact on their exposed assets quickly, rather than implying that all vulnerabilities are resolved within that window.
The executive also described how AI is applied to phishing site analysis. Instead of merely notifying security staff of similar domain creation, AI analyzes whether a site uses corporate logos, mimics login screens, or collects credentials. It then presents the necessity for a takedown request. The human role shifts from initial investigation to reviewing the AI's reasoning and approving the action. Similar approaches are being applied to vulnerability response, where AI agents query attack surface management data and vulnerability scan results to determine the sequence of necessary tasks.
To connect internal enterprise AI with external threat intelligence, Recorded Future utilizes the Model Context Protocol. This standard allows AI to access external data and tools. The company provides more than 80 tools that enable agents to query their intelligence. For instance, an AI can compare IP addresses from internal firewall logs with external threat data to identify associations with specific attack groups. Yoon stressed that data quality is as critical as the connection technology. If AI generates unfounded answers or inconsistent judgments, it becomes difficult to make blocking or response decisions based on those results. In environments where one agent passes analysis to another, incorrect information can propagate through the workflow.
During the question and answer session, Yoon addressed whether AI is creating new attack methods beyond known tactics, techniques, and procedures. He stated that he has not yet observed cases where AI discovered zero-day vulnerabilities and used them in actual attacks. However, he warned that even existing attacks can cause significant damage if the speed of finding and exploiting vulnerable targets outpaces human detection and judgment. He concluded that while AI assists in decision-making, the roles of judgment and supervision remain essential. Security professionals must verify that playbooks and automation flows are correctly configured and approve necessary actions.