Application exploitation back in vogue, says IBM cyber unit | Computer Weekly

"Attackers aren't reinventing playbooks, they're speeding them up with AI. The core issue is the same: businesses are overwhelmed by software vulnerabilities. The difference now is speed. With so many vulnerabilities requiring no credentials, attackers can bypass humans and move straight from scanning to impact."

"In recent years, a quip that runs along the lines of 'attackers don't hack the cloud, they log in' has become a popular adage in the cyber community, reflecting a surge in attacks beginning with phished or stolen credentials. Logging in legitimately means threat actors do not have to burn valuable hoarded zero days."

"The exploitation of vulnerabilities, which its researchers claim formed the initial access vector in 40% of incidents it tracked last year, is seeing a renewed burst of enthusiasm among threat actors. AI tools may be driving this trend by making it easier for attackers to seek out misconfigured, unprotected or vulnerable applications."

IBM X-Force threat intelligence researchers report a significant shift in attack patterns, with exploitation of vulnerable public-facing applications now accounting for 40% of initial access vectors, a 44% increase that outpaces credential abuse attacks. While credential misuse still represents nearly one-third of incidents, the trend reverses years of attackers preferring legitimate login methods through phished or stolen credentials. AI tools are enabling threat actors to more efficiently identify misconfigured, unprotected, or vulnerable applications. Security leaders must adopt proactive approaches including stronger access controls, rigorous patching, secure deployment practices, and agentic-powered threat detection to address the accelerating speed of attacks.

Read at ComputerWeekly.com