CISOs Fear AI Will Make Attack-Path Chaining Cheap and Scalable

Security leaders are less concerned about rogue autonomous agents than attackers using AI to connect ordinary weaknesses into viable paths toward critical assets, according to an Alt Security report informed by conversations with more than 100 CISOs.

The company argues that AI changes the economics of offensive security by reasoning across vulnerabilities, credentials, privileges and misconfigurations. A group of low- or medium-severity issues can become critical when combined, even if no individual finding appears urgent.

Alt proposes measuring “time to path closure,” or how quickly an organization can identify and break attack paths capable of producing business impact. That metric shifts attention away from raw vulnerability counts and toward the combinations an attacker could actually use.

The report reflects Alt's commercial perspective and its cost projections are forecasts, not observed outcomes. The broader security point is sound: prioritization should account for reachability, privilege and asset value, especially as AI lowers the effort required to test many possible paths.