Security leaders are stuck in decision paralysis over AI-enabled cyberattacks

Many security leaders at major companies, flush with expanded budgets to fend off AI-powered cyberattacks , are experiencing a level of decision fatigue that's freezing them in their tracks.

Why it matters: Those leaders are still trying to size up how autonomous cyberattacks will affect their businesses at a time when they need to be taking bold action and mobilizing quickly, experts told Axios.

The big picture: Companies have only a short window before AI models capable of end-to-end autonomous cyberattacks land in the hands of malicious attackers.

But four months after Anthropic released Mythos Preview to prepare for what's to come, many companies are still debating where to put their money and which controls to prioritize.

State of play: Ever since Anthropic rang the alarm on Mythos' abilities, security leaders have been wrestling with an increasingly complex security and regulatory landscape.

OpenAI started rolling out similarly powerful models to vetted cyber defenders, and the release of open-weight models like Kimi K3 and GLM-5.2 has raised fears about hackers' access to cyber-capable AI models.

Meanwhile, OpenAI's models colluded to hack Hugging Face, and Anthropic and Meta have shared stories about their models breaching third-party websites during safety tests.

Threat level: CrowdStrike observed an 89% surge in attacks using AI to "scale operations, accelerate tradecraft, and directly target AI infrastructure" in the last year, according to its annual threat hunting report.

Between the lines: Many companies are struggling to make decisions because security teams are stuck defining their AI governance strategies, including what constitutes AI risk and how they can responsibly deploy the technology, Nicole Carignan, senior vice president of security and AI strategy at Darktrace, told Axios.

These leaders are also stuck in a loop of constant education and research, she added, as new capabilities keep emerging from frontier and open-weight model maintainers.

Case in point: Evan Peña, co-founder and chief offensive security officer at Armadin, told Axios that he's seeing security leaders who are overwhelmed by the sheer number of products they could invest in to prepare for autonomous cyberattacks.

Many executives have been given new budgets and board buy-in and are debating whether to pour that money into attack simulation tools, vulnerability discovery, penetration testing or bug bounties.

Sherrod DeGrippo, vice president of threat intelligence at Palo Alto Networks' Unit 42, told Axios that she's heard from companies that are "grappling with all of these questions," including agent permissions, identity, logging and accountability.