AI Attack Tools Push Cyber Risk Up CEO Agenda

Fran Rosch has watched the math change. As CEO of Imprivata, a digital identity company serving hospitals, energy firms and other life-or-mission-critical industries, he sees AI compressing the time and skill an attacker needs to cause real damage.

In a Forbes article published this week, Rosch described a world where AI systems now automate reconnaissance, generate phishing campaigns that actually fool people and find vulnerabilities faster than human teams can patch them. Capabilities that once required a highly skilled adversary are now accessible to anyone with a subscription. The consequence is that cybersecurity has moved from the IT department to the CEO's desk.

"Modern AI systems dramatically reduce the time and expertise required to discover vulnerabilities, generate convincing phishing campaigns, automate reconnaissance and accelerate other stages of an attack," Rosch wrote.

The old model of perimeter defense – lock down the network, secure the applications, assume everything inside is safe – no longer works. Employees log in from coffee shops. Critical applications live across three cloud providers. Third-party vendors need direct system access. And AI agents now work alongside human employees, querying databases and executing workflows without a badge.

"The perimeter has dissolved," Rosch wrote. "Identity has become the new control plane."

Under that framework, every employee, contractor, partner, application and AI agent is an identity that must be governed. The challenge, Rosch said, is managing those identities at scale. A hospital might have thousands of human users and, soon, hundreds of AI agents pulling patient records. Without clear governance, those agents operate with broad permissions and limited oversight.