Thought for the week: Companies face cyber pain as hackers press AI advantage

A recent article from The Wall Street Journal reflects on how hackers have used AI to speed up their strikes, resulting in a wave of cyberattacks over the past month that have been dubbed "Black October." The article points out that "Corporate networks are riddled with cracks in old software or forgotten systems, while software makers continue to sell buggy new products. Advanced AI models let hackers find and attack those open wounds at a speed no human security team can match."

It is not really the case that the cybersecurity controls in organizations are getting worse. It's just that threat actors are leveraging AI to get better at it, with time compression and a rapid expanse in the scale, persistence and autonomy of attacks. The 2026 Microsoft Digital Defense Report provides an insightful summary of how the "physics" of cyberattacks are changing. Cyber defenders — both internal and external — are stretched thin across the board these days. In the face of this surge in cyber incidents, companies need to continue investing in security monitoring and controls, including AI-enhanced measures.

At this time of great challenge, beyond supporting the organization through ongoing incidents and regular exercises, legal and compliance professional should consider several key steps at this time.

Brief senior leadership

If your organization is experiencing cyber incidents these days, you are not alone. This is happening across all industry verticals. Senior leadership needs to understand that AI-fueled cyber risks are increasing. Companies need to respond with corresponding changes in investments in substantive cybersecurity protections, as well as incident response and business interruption protocols. 

Assess the value of prior retainers with key cyber providers

Some organizations have historically taken a view that retainers are not really needed in this space, as you can find the right provider when you need one. The shortage of availability of key cyber providers these days suggests it is a good time to reevaluate entering into retainers so as to assure proper resourcing when needed. 

Take a fresh look at contractual obligations with key vendors

Your organization may wish to revisit whether fast timing requirements for vendors to notify the organization of potential or possible breaches are actually in the organization’s best interest. It may be better to focus on establishing contractual terms that require notifications once the vendor has reason to believe your organization’s data is actually impacted, or if there is reason to believe security vulnerabilities could impact your network. A more moderated approach to vendor notification triggers could help make sure your team is focused on situations that really matter to your organization. 

During a response, double-check the facts before making any privacy notifications

The speed and frequency of these attacks are creating situations in which it is unclear whether an organization's data is truly impacted and whether privacy notices are needed. For example, an organization may receive an extortion note and have its company name posted to a leak site. This might suggest that it has impacted data and one or more privacy clocks ticking. However, after taking a closer look and engaging with the threat actor, the company may discover the threat actor's proof-of-life data does not actually relate to its organization, so it's a nonissue. Or the threat actor may provide proof-of-life information that seems, at first glance, to relate to the organization, but the formatting and structure of the proof-of-life documents do not match anything within use in the organization and appear to be AI-generated. 

Scrutinize any potential public company reporting obligations

Organizations should consider whether the overall surge in cyberattacks, particularly in their industry, when evaluating any public company notification obligations. For example, the Securities and Exchange Commission generally requires a report of a material cybersecurity incident on Form 8‑K within four business days of determining the incident is material. The materiality threshold is defined as information with a "substantial likelihood that a reasonable investor would consider it important" in making an investment decision. An incident that might have been material to a reasonable investor a few years ago might no longer reach those quantitative and qualitative standards today. These assessments need to be evaluated in light of the changing ecosystem and all relevant factors.

Strategically consider notice obligations with customers

There is no one-size-fits-all approach to customer notifications. Senior leadership should consider contractual and regulatory duties, as well as relationship issues, but should also ask the tough questions about what is in the best interests of customers. A broadcast message on a nonpublic event stating the organization does not know what data is impacted but is providing notice for transparency may not be helpful to customers. It could actually be harmful if it may have started the customers' clocks for their own notification duties, and it could start to absorb the customers' incident response resources before they can do anything productive and at a time when they are already stretched thin. 

Fold these developments into mergers and acquisitions activities

Cyber incidents are routinely top of mind for mergers and acquisitions transactions, but typically in the context of incidents that have occurred over prior years. When you are the buyer, it can be helpful to ask the target company with some frequency about any recent developments. If you are the seller, consider proactive notification aligned with contractual commitments and business considerations. 

My sense is that the intensity of cyberattacks are, unfortunately, not going to slow down anytime soon. This could easily be the new normal. So, back to basics please. Make sure you get to the gym. Eat some good food. Find a way to share the load with co-workers and get some sleep. Think of this as more of a marathon than a sprint.