AI Is Changing the Mathematics of Defense
When machines can attack, observe, learn and adapt continuously, resilience may matter more than the promise of an impermeable defense.
Artificial intelligence does not need to make every attack successful. It only needs to make experimentation cheap enough that failure becomes a path to the next attempt.
Defense has always faced an asymmetry.
The attacker can choose the time, target and method. The defender must protect many possible targets against many possible methods, often without knowing which one will be used.
AI intensifies that imbalance because it reduces the cost of searching for weakness.
An AI-enabled attacker can generate alternatives, test them, observe the response, revise the plan and try again. Thousands of agents can work on different parts of the problem simultaneously. They do not all need to be brilliant. They need to be numerous, persistent and connected by a learning process.
The new offensive loop is simple:
ATTACK → OBSERVE → LEARN → ADAPT
When that loop operates faster than the defender’s ability to detect, decide and recover, the mathematics of defense changes.
THE DEFENDER MUST BE RIGHT EVERYWHERE
A traditional attacker with limited personnel must prioritize carefully. Reconnaissance takes time. Specialists are assigned to the most promising targets. Failed attempts consume attention and may expose the operation.
AI reduces several of those constraints.
One agent can survey public information. Another can examine software or network behavior. Another can generate variants. Others can manage credentials, infrastructure or reporting. A human team can supervise a much larger number of simultaneous experiments.
The defender still faces the full surface area of the organization: every employee, application, supplier, cloud account, facility and device.
The attacker needs one path that works.
FAILURE BECOMES INFORMATION
This is the most important change.
When attacks are expensive, failure is a loss. When attacks are cheap and automated, failure is data.
A rejected phishing message reveals something about the filter. A blocked exploit reveals the software configuration. A jammed drone reveals the electronic environment. An intercepted aircraft may expose the position or response time of an air-defense system.
Each interaction can improve the next attempt.
This does not guarantee that the attacker will succeed. Defenders also use automation and AI, and well-designed systems can deny useful feedback. But the side that learns faster gains a compounding advantage.
The relevant unit of competition is therefore not the individual attack.
It is the adaptation cycle.
CONCURRENCY IS A STRATEGIC WEAPON
Imagine one thousand specialized agents—not one thousand independent geniuses, but a coordinated workforce.
Some search for exposed infrastructure. Some analyze code. Some generate social-engineering variants. Some test routes around controls. Some study prior failures. A smaller number of human operators set priorities, review consequential actions and intervene when judgment is required.
The number one thousand is illustrative, not a claim about one specific current campaign.
The underlying mechanism, however, is already visible. Google Threat Intelligence has documented adversaries using agentic systems to manage vulnerability scanning, credential harvesting, troubleshooting and infrastructure rotation, as well as state-linked actors integrating generative AI across reconnaissance, malware development and post-exploitation work.
The critical change is simultaneous effort.
AI makes it possible to attack a problem from many directions at once, then combine the results.
THE SAME LOGIC IS ENTERING PHYSICAL WARFARE
Autonomous systems extend the attack-learning loop into the physical world.
A force can vary routes, altitudes, electronic signatures, timing and payloads. Some systems can function as decoys. Others collect information. Others attempt the strike. The defender’s response becomes observable evidence for the next mission.
Ukraine’s rapid drone-development ecosystem demonstrates how battlefield experience can move quickly into software and production. Russia’s mass drone attacks demonstrate how volume and variation can pressure even layered air defenses.
The analogy between cyber and physical warfare should not be pushed too far. Drones require materials, factories, logistics and launch sites. Physical losses cannot be copied at negligible cost.
But the strategic direction is similar.
Software makes adaptation faster. Mass makes experimentation affordable. AI makes more of the cycle independent of scarce human attention.
INTERCEPTION RATES CAN MISLEAD
A defense may destroy most incoming threats and still lose strategically.
If the threats are cheap enough, the attacker may accept a low penetration rate. If the few weapons that pass through halt a refinery, damage a transformer, close an airport or force the relocation of a critical operation, the campaign may remain economically favorable.
The proper calculation must include more than weapons destroyed.
It must include:
- the attacker’s cost per attempt;
- the defender’s cost per response;
- production or service lost;
- restoration time;
- defensive assets diverted;
- cascading effects on connected systems;
- and what each side learned.
A ninety-percent interception rate sounds impressive. It tells us very little without knowing what the remaining ten percent accomplished and what the defense consumed.
RESILIENCE CHANGES THE EQUATION
A purely protective strategy seeks to keep the attacker out.
A resilient strategy assumes that some attacks will penetrate and limits what happens next.
That requires redundancy, compartmentalization, rapid restoration and graceful degradation.
A network should prevent one compromised identity from becoming enterprise-wide control. A factory should avoid single points of failure and maintain replaceable components. A military should disperse critical assets, use decoys and rehearse operations under degraded communications. A power system should isolate failures before they cascade.
These measures do not eliminate risk. They reduce the information and strategic value the attacker receives from success.
If one pathway works but produces only local damage, if the system restores itself quickly and if the same method cannot be repeated across the entire network, the attacker’s learning loop is interrupted.
DEFENSE MUST LEARN FASTER
The answer to adaptive attack is adaptive defense.
Defenders need continuous telemetry, automated containment, rapid distribution of new rules and a command structure able to act before every decision reaches the top. They need preserved records of failed attacks, not only successful breaches. They need to treat exercises and near misses as sources of operational data.
Most importantly, they need feedback from the point of failure to reach designers, operators and suppliers quickly.
That is the defensive equivalent of the wartime manufacturing loop:
DETECT → CONTAIN → UNDERSTAND → REBUILD → DISTRIBUTE → TEST
The contest is no longer simply between weapons and defenses.
It is between learning systems.
THE NEW MATHEMATICS
AI increases the number of attacks that can be attempted, the speed at which they can be modified and the range of expertise available to the attacker.
The defender cannot answer that pressure by promising perfect protection across an expanding surface.
The more sustainable objective is to make successful attacks unprofitable.
That means raising the attacker’s cost, reducing the damage caused by penetration, restoring operations quickly and preventing one success from scaling into systemic failure.
In the AI era, resilience is not the consolation prize awarded after defense fails.
It is the defense.