Cybersecurity is undergoing a phase of structural transformation. Technological developments such as artificial intelligence, large language models (LLMs), agent-based systems, model context protocols (MCPs), and sophisticated deepfake technologies are fundamentally changing the threat landscape. Machines are encountering machines. Attacks are becoming more automated, scalable, and at the same time more precise. The barriers to entry for professional attack tools are falling, while at the same time the attack surface is continuously expanding due to cloud transformation, digital ecosystems, and networked operational technology environments.

The rules of the game are changing

Artificial intelligence now writes deceptively real phishing emails. Deepfakes imitate voices and image transmission of CEOs in real time. Autonomous agents analyze attack surfaces, and large language models and protocols such as MCP not only expand the possibilities for companies, they also expand the possibilities for attackers.

Cyberattacks are no longer primarily technically complex. They are becoming increasingly scalable, adaptive, and economically efficient.

And yet the core remains unchanged: In the end, it is all about 0 and 1. About data. About business-critical information. About systems that have to work. Cybersecurity is not a question of maximum protection, but a question of consciously defined risk appetite. It is a strategic decision:

• How resilient do we want to be?
• How digitally dependent are we?
• Which risks are we willing to take and which are we not?

The need to protect values holistically.

Anyone who sees cybersecurity today as a purely operational IT task is underestimating its significance. It determines ability to act, regulatory stability, trust in the market, and ultimately company value.

This is exactly where we come in

Over the past year, our Red, Blue, and Titanium teams have demonstrated what modern security work must and can achieve in a variety of challenging mandates. Realistic red team engagements not only revealed technical weaknesses, but also tested decision-making processes. Purple team formats broke down silos and measurably improved detection and response capabilities. OT initiatives made production environments more resilient. Security assessments in the context of LLMs and AI systems have made new risks tangible and manageable.

The list of projects is long. Something else is decisive: Impact.

The challenge of AI in red teaming

A similar principle applies to technically demanding red team projects. An uncontrolled rogue AI device or an autonomous agent in your own network is not proof of innovation, but rather an additional risk. In our numerous, often time-consuming red team mandates, one thing has become clear time and again: Successful attacks do not happen by chance, but through precise technical analysis and the systematic chaining of multiple vulnerabilities. Initial access, privilege escalation, credential abuse, lateral movement, or the exploitation of implicit positions of trust are rarely isolated events; they form structured attack paths.

Our engagements are deliberately designed to be realistic, with clearly defined objectives, strict rules of engagement, and in-depth technical implementation. The fact that we have been able to achieve the agreed objectives in every mandate to date is not an indication of spectacular individual gaps, but rather of methodical consistency and technical excellence. Above all, however, it shows how reproducible complex attack chains are, even in mature organizations.

Against this backdrop, AI agents can certainly accelerate operational subtasks, such as reconnaissance, the analysis of large identity and authorization structures, or the systematic variation of attack patterns. However, automation does not replace experience or tactical judgment. Autonomous systems must not be allowed to make escalation decisions or establish persistence strategies on their own. Machine versus machine is not currently a reality in a productive environment. Offensive security work remains a controlled, precisely managed process.

And this is precisely where the management dimension lies: Red teaming is not a technical experiment for its own sake, but a tool for validating strategic resilience. It answers not only the question of whether an attack is possible, but also how likely it is, how much effort it would require, and what the business impact would be. The insights gained from this form the basis for prioritization, investment decisions, and the conscious definition of one’s own risk appetite. Technical excellence creates transparency, strategic leadership creates consistency.

Challenge: Vibe Coding

The basis of robust cybersecurity remains a thorough understanding of the technologies used. This is especially true in an age when AI models generate production-ready code in seconds. Whether infrastructure as code (IaC), API integrations, automation scripts, or complex business logic: The generated output is often syntactically correct and follows common framework conventions. However, it is based on statistical probability, not on contextual security understanding.

In practice, typical patterns emerge: Missing or insufficient input validation, insecure deserialization, unprotected endpoints, hardcoded secrets, or overprivileged service accounts. Authorization checks are simplified or omitted, trust boundaries are not clearly defined, and default configurations are adopted without reflection. Logging mechanisms capture sensitive information in plain text, while error handling remains functionally correct but incomplete in terms of security.

In the context of LLM-based applications, additional risks arise: Insufficiently mitigated prompt injection attacks, lack of output validation, indirect data leaks via retrieval mechanisms, or tool integrations with far-reaching permissions. The code partially meets the technical requirements but may increase the attack surface or establish implicit dependencies that were never intended architecturally.

Those who are proficient in programming languages, security architectures, and principles such as least privilege, defense in depth, or secure by design will recognize these vulnerabilities early on. Structured threat modeling, clean code reviews, and targeted refactoring turn generated code into resilient, verifiable implementations. This is precisely where added value is created: Through classification, validation, and conscious control.

This is where we come full circle. Technological speed does not relieve us of strategic responsibility. The use of AI-generated components is not purely an operational decision, but a question of defined risk appetite.

• What dependencies do we accept?
• What implicit risks do we tolerate?
• What control mechanisms do we establish as binding?

AI can become an efficiency driver with an unclear risk profile. With clear governance, it becomes a strategic tool within a controlled security framework. Technology can generate code. Responsibility comes from understanding, control, and conscious management.

We combine an offensive perspective with defensive excellence and strategic classification. We don’t think in terms of individual measures, but holistically.

No let-up

This year, demand for precisely this approach is growing once again. Numerous new initiatives have already been launched or are in the planning stage, mandates have been assigned, and new technology trends are being monitored. From AI governance to red and purple teaming, resilient cloud architectures, machine-versus-machine test cycles, and strategic security assessments in the context of digital transformations.

Companies are not just looking for tests or reports. They are looking for guidance. They are looking for partners who understand technological developments, can classify them, and translate them into robust decisions.

Added value is created where security creates strategic clarity.

When new AI initiatives are introduced and governance issues are unresolved. When applications need to be tested for security and a meaningful assessment is required. When the board of directors needs a reliable picture of actual resilience. When OT environments are modernized without jeopardizing production stability. Or when existing security programs are in place but their effectiveness has never been validated in a realistic manner. In precisely these situations, we create transparency, prioritization, and decision-making bases that are technically sound and prepared in a management-friendly manner.

Continuous development

That is why we consistently invest in our own further development. We question our processes. We optimize our methods. We continue to develop our own tools and software solutions to increase efficiency and precision. Internal research projects ensure that we do not wait until trends become mainstream before discussing them. We analyze them before they become regulatory requirements. We evaluate them before they become a risk.

In a digitalized economy, trust is no longer a soft factor. It is a strategic asset.

For us, cybersecurity is not a reactive business. It is an active contribution to corporate sustainability.

Our claim is clear:

• We don’t just want to examine security landscapes, we want to help shape them.
• We don’t want to dramatize risks, we want to make them manageable.
• We don’t just want to secure technology, we want to make it usable in a responsible manner.

Conclusion

The threat situation is becoming more complex. Technologies are becoming more powerful. But the decisive difference lies not in individual tools or trends, but in the ability to classify developments at an early stage and use them strategically. Cybersecurity today is an expression of corporate maturity. Actively shape the future! Those who shape it with foresight not only create protective mechanisms, but also freedom of choice. Those who systematically build resilience strengthen trust among customers, partners, investors, and employees alike. Future viability arises where risks are understood, prioritized, and consciously managed.

Especially in the age of powerful AI, technology can analyze, simulate, and optimize. However, the direction is still determined by corporate management. Or, with a slight wink: Algorithms support decisions. Responsibility remains human.

Companies that actively embrace this responsibility not only secure their systems; they actively shape their digital future. Structured sparring on an equal footing often creates more clarity than any theoretical discussion. We look forward to the exchange.

About the Author

Simon Zumstein has been working in IT since the 1990s as an engineer, project lead, security consultant and CIO. Integral risk management while taking managerial-economic factors and the presentability to decision makers are his area of expertise.

Links

• https://scip.ch/publikationen/flyer/scip_company-flyer_plusTeams_2024_v01-de.pdf
• https://www.scip.ch/?defense
• https://www.scip.ch/?labs.20240523
• https://www.scip.ch/?labs.20241114
• https://www.scip.ch/?offense
• https://www.scip.ch/?research