Anthropic: AI-enabled attack risk can't be judged by technique count alone
Anthropic's threat intelligence team analyzed 832 accounts banned for malicious cyber activity between March 2025 and March 2026, mapping 13,873 actions across 482 techniques and all 14 MITRE ATT&CK tactics. A state-sponsored espionage campaign it disrupted in November 2025 used 30 techniques across 13 tactics — comparable to many medium-risk actors — yet scored the maximum 100 on Anthropic's own risk methodology. The data also shows AI use shifting toward post-compromise activity, with account discovery up 8.9% and AI-assisted phishing down 8.6%, while actors rated medium risk or higher rose from 33% to 56%.
If technique counts can't separate high-risk actors from ordinary ones, defenders need detection built on behavioral chains, sequencing and context.
When Anthropic's threat intelligence team ranked a year of AI-enabled cyberattacks, the most dangerous operation in the dataset didn't stand out by the measure the security industry has relied on for years.
Mapped against MITRE ATT&CK, the state-sponsored espionage campaign Anthropic disrupted in November 2025 used 30 techniques across 13 tactics, comparable to many medium-risk actors in the same dataset. Against Anthropic's own risk methodology, the same campaign scored the maximum of 100.
The fact that the highest-risk actor looked unremarkable by technique count exposes a weakness in conventional detection thinking. Technique breadth alone tells defenders relatively little about risk. More useful insight comes from understanding how techniques are combined, sequenced and executed over time.
The indicator was always the fragile part
Security operations spent two decades getting very good at recognizing evidence an attacker had already used. Malware hashes, malicious IP addresses and suspicious domains gave teams a practical way to identify known threats and block repeat attacks. Once an attacker exposed part of their infrastructure, thousands of organizations could benefit.
David Bianco's Pyramid of Pain outlined this weakness in 2013. The indicators defenders find easiest to consume are also the cheapest for attackers to discard. A hash can change when you modify a file, while an IP address can simply be replaced. The techniques and procedures an attacker relies on to reach an objective are far harder to change.