News

The bottleneck on sophisticated cyber operations that target nation states is breaking. Conducting a large-scale cyber attack used to mean scaling expert talent.

When the cost of adding a capable attacker approaches the cost of compute, the economics of offense fundamentally change.

This is already operational: Dream's threat research recovered an autonomous multi-agent framework that ran intrusion campaigns against government entities in Asia, executing twelve attack waves in four days with eight parallel agents, compromising 85 government accounts, and using a closed learning loop to adapt after failure.

The advantage is shifting from the number of experts to how effectively their expertise can be scaled.

AI benefits both attackers and defenders, but defenders start with a unique advantage: they already own the map attackers must discover.

Defenders that understand their environment can use AI to turn that knowledge into operational scale.

In July, our threat research team recovered the operational workspace of an autonomous multi-agent framework that had been conducting intrusion campaigns against government entities in Asia.

Over roughly four days, the framework executed twelve attack waves and ran up to eight AI agents in parallel. Built on the publicly available Hermes and OpenClaw frameworks, it compromised 85 government employee accounts and used 84 of them to pivot through a government single sign-on environment.

What’s really intriguing is its autonomous operational decision making.

Every discovery was assigned a Bayesian confidence score to assess different paths and then chose how to proceed, just like an actual team.

Similarly, when an attack path failed, the framework automatically entered what it called a Learning Cycle, searched vulnerability databases and security research techniques relevant to that government's technology stack, and tried again. The framework audited itself – it created a closed learning loop: investigate, validate, act, observe the result, update its operational knowledge, and try again.

This was not a self-improving model. It was a self-adapting cyber attacker – there is a real expert behind it, embedded as AI system. The fundamentals of this attack weren’t even particularly impressive or novel. It is the scale – and the prospect for nearly infinite scale – that is daunting.

Until recently, one of the limiting factors in scaling sophisticated offensive operations was the expert reasoning required to decide what to investigate, validate findings, connect them into viable attack paths, and adapt when those paths failed. It was expensive, both in dollars and in expertise. That scarcity placed a natural constraint on offensive scale - scaling a sophisticated operation meant scaling skilled people, time and coordination.

AI is beginning to automate precisely that expensive layer of the operation: deciding what to investigate, validating hypotheses, learning from failure and choosing what to try next. Talent still determines the quality of those decisions. But the number of talented people no longer has to determine how many times those decisions can be made in parallel.

What happens when scaling an offensive operation no longer requires scaling the number of experts behind it at the same rate?

As someone who has spent 15 years in both offensive and defensive cyber roles, it’s becoming clearer every day that AI has changed that equation - the historical relationship between the amount of expert talent an organization has and the scale at which it can operate is beginning to break down.

AI does not eliminate talent - it changes what talent can scale.

Government IT infrastructure is an interconnected ecosystem built over decades. It consists of ministries, municipalities, operational technology, legacy applications, cloud services, contractors, suppliers, and countless trust relationships connecting them together.

These connections typically exist for legitimate operational reasons (or at least historically legitimate reasons).

Of course, every connection is also a potential vulnerability.

This is how modern government attacks spread - not necessarily by exploiting one critical vulnerability, but by chaining together many ordinary ones.

Historically, this challenged both sides. No defensive team could continuously reason over every asset, identity, configuration, vulnerability and trust relationship across an entire country. But attackers faced a version of the same constraint. Their experts also had to decide where to spend their time to find a viable path from intrusion to crown jewel

Autonomous systems change that.

An autonomous attacker does not need to understand the entire government environment in advance. It can explore it continuously: discover a relationship, form a hypothesis, test it, learn from the result and move to the next one.

For the first time, governments may face adversaries capable of reasoning over national-scale attack surfaces faster than the institutions responsible for defending them.

The dramatic decline in the cost of offensive cyber expertise, via leveraging and weaponizing agents, is a tectonic shift. Until now, this was a skill limited to a select few and came with a high price tag.

Today, discovering, prioritizing and combining these techniques into viable attack paths is cheap, and one can repeat the process at machine speed.

With the pace of AI development, that statement becomes more true every day.

Offensive capability is becoming cheaper, faster and easier to reproduce.

But there is another side to this equation.

Defenders have always had structural advantages: more telemetry, deeper context, persistent access to their infrastructure, and knowledge of its configurations, identities and relationships, while also have a much better ability to act.

They too had the constraint of human capacity. No team could continuously reason over all that information, across every asset and relationship, all the time. The same AI that benefits attackers may operationalize defender’s historical edge at scale too.

This is where time plays a key role. Analyzing everything is not the same as defending everything. If AI detects a compromised identity in seconds but the credential remains active for six hours, the attacker still has six hours. If it identifies an exploitable path to a critical system but remediation takes three weeks, that path remains open for three weeks.

The opportunity, then, is not simply better analysis. It is reducing time-to-effective-action: the time between understanding a risk and changing the outcome.

And "effective" matters- disabling an identity, changing a firewall rule or patching a vulnerability is not enough. The system must verify that the attacker can no longer achieve its objective.

The defensive loop cannot end with intelligence - or even with action. It has to end with a verified security outcome.

AI does not inevitably favor the attacker.

The framework we recovered had to steal its map of the environment, one probe at a time. Defenders already have that map. Every configuration, credential, telemetry stream and trust relationship could take an attacker – even an AI attacker – days to weeks to discover. What defenders could never do was reason over all the assets they had, continuously, due to the lack of talent capacity to do that.

AI begins to remove that human-attention constraint. It allows defenders to amplify expert talent across thousands of investigations in parallel, continuously identifying attack paths, prioritizing those that pose the greatest risk, and focusing action where it matters most.

Attackers get the same leverage. But they don't start from the same place. Defenders have a home-field advantage: they already know and control the environment the attacker must discover.

The gap that matters is no longer simply the number of experts on either side. It is how effectively each side can scale that expertise- and direct it toward the right risks first.

Ultimately, the race is not about who can know more.

It is about who can scale talent in the right way- and turn that scale into an outcome first.

We've ranked and reviewed the best antivirus software available.

This article was produced as part of TechRadar Pro Perspectives, our channel to feature the best and brightest minds in the technology industry today.

The views expressed here are those of the author and are not necessarily those of TechRadarPro or Future plc. If you are interested in contributing find out more here: https://www.techradar.com/pro/perspectives-how-to-submit

• Windows 11's latest update has arrived
• The September update brings in the ability to move the taskbar
• There are also new options for resizing the Start menu, and a really useful tweak for Windows 11's search function

Windows 11's latest update has arrived, and it packs some important new features for the interface of the desktop OS.

Bleeping Computer flagged all the additions in the September 2026 update for Windows 11, and there are three major highlights, which I'll pick out here, before providing a general roundup of some of the other tweaks that Microsoft has brought in this month.

As ever, some of these features are being rolled out in a phased manner, so even if you do install the September update today, you may still have to wait a while for certain pieces of functionality to make their way over to your PC.

Thanks to the September update you'll finally be able to move Windows 11's taskbar away from the bottom of the screen, to the top instead, or the sides if you prefer (an option that people with an ultra-wide monitor often want to use, as it suits that aspect ratio much better).

This is an ability which has always been in Windows 10, but was dropped for Windows 11 because porting it over was a thornier issue than you might think (or so Microsoft told us).

Finally, however, Microsoft has got its act together and the taskbar can now be repositioned in Windows 11 – although I've a feeling this will be one of the features on a slower rollout. Hopefully I'll be wrong on that score and you'll get this ability promptly if you've been keenly awaiting it for the last five years.

It's also worth noting that there's another option introduced here which can make the taskbar smaller, so it takes up less screen real-estate on devices with small displays.

Want a more compact Start menu? Your wish is Microsoft's command, as this choice has now been introduced to the Settings app for the Start menu. You can elect to have a standard (large) menu, or a small one, rather than leaving it at the default 'automatic' setting whereby Windows 11 chooses the size itself based on your device. The problem with leaving the OS to decide is that sometimes you get the bigger menu on a laptop screen, where it pretty much eats the whole desktop – and so in these scenarios you can now manually choose the more compact Start menu.

With options to remove sections of the Start menu coming on top of this, you can now trim this part of the interface down so it's truly minimal. This choice will be more important than the movable taskbar for many folks – myself included – and it's great to see it now being rolled out.

Another notable boon with the September update is that there are a few changes for Windows 11's core search functionality, and the most important is a new option that lets you turn off web results in search.

When you're searching for a file on your local drive, those web results often get in the way, so it'll be a relief for many to be able to switch them off. As well as web results (which open in Edge, with searches in Bing, of course), you can also turn off Microsoft Store suggestions. Essentially this is a general decluttering of Windows 11 search which is long overdue, frankly.

There's a performance boost for File Explorer in that the Home page now loads faster, and switching between virtual desktops in Windows 11 is now snappier, too.

Microsoft has made some reliability tweaks as well, including ensuring that the app history information in Task Manager is correct, and also that interacting with the Display panel within Settings is now more stable.

Furthermore, Microsoft informs us that there are some design tweaks here: "This update introduces updated progress indicators across Windows, providing a more consistent and modern experience during startup, sign-in, restart, shutdown, and update installation."

It's also worth noting that the weird mouse bug that affected the preview version of this September update (the optional update released at the end of August) has been resolved.

There's a fair bit happening here, and as one Redditor put it: "What's left for the 26H2 [update] then?"

Well, not a great deal in truth, and if you've been following along with Microsoft's annual updates, you may recall that 26H2 is going to be a very minor upgrade that doesn't do a lot. Indeed, some folks are wondering why Microsoft didn't save these juicy new interface features for 26H2, given that it's out next month.

The reason is likely to be because Microsoft wants to ensure that 26H2 runs as smoothly as possible (with no bigger changes involved). Although to be fair, as noted, due to the rollout process, a lot of folks won't be getting the new Start menu options and taskbar repositioning until October (or possibly later) anyway.