The Canadian Centre for Cyber Security put a number on something most defenders have felt but couldn't quite prove: the time between a vulnerability being found and being exploited is collapsing "in some cases from days or weeks to hours." That single line, buried in a statement on frontier AI models and cyber security, is the most consequential sentence a Canadian government agency has published on this subject in years. It means the attacker's side of the equation changed while most defensive playbooks stayed the same.
This is not a warning about a future threat. The Cyber Centre's language is present tense: frontier AI models "can help cyber threat actors find and exploit vulnerabilities — including software flaws and weaknesses in security controls — much faster than before." Faster reconnaissance, faster exploit development, faster iteration when the first attempt fails. The defender's traditional advantage — that attacks take planning time, and planning time creates windows for detection — is the exact thing AI tooling erodes.
What "AI-native" actually means
The distinction worth holding onto is between AI-assisted and AI-native attacks. AI-assisted means a human attacker uses a language model to write a more convincing phishing email or clean up broken code — useful, but still a human running each step. AI-native means the AI does the finding, the adapting, and in some cases the deciding, with a human setting the objective and stepping back.
The Canadian Centre for Cyber Security's guidance on adversarial AI use and its National Cyber Threat Assessment both point in the same direction: adversarial use of AI is not a hypothetical category anymore, it is an active and growing one. CRN's reporting on autonomous AI cyberattacks reinforces the operational consequence — experts interviewed there argue that the speed and volume an AI-driven campaign can generate risks overwhelming organizations that haven't already invested in automated detection and response. The point isn't that any single attack becomes unstoppable. It's that the number of attempts, and the speed at which each one adapts to a failed attempt, changes the arithmetic of defense.
Where this lands on a Canadian SMB
Large banks and federal departments have security operations centres built for this kind of pressure. Most Canadian organizations don't. Research from FusionComputing on AI-powered threats facing Canadian SMBs is specific about where the exposure sits: deepfake voice and video used for impersonation, AI-written phishing that no longer carries the broken grammar spam filters were trained to catch, and prompt-injection attacks aimed at the Microsoft Copilot deployments a lot of Canadian firms have rolled out over the past two years without a matching security review.
Picture — illustratively, because this is the mechanism the research describes rather than a documented case — a mid-sized Canadian firm where a controller receives what sounds exactly like the CFO's voice on a call, requesting an urgent wire transfer ahead of a closing deadline. The voice has the right cadence, the right impatience, even a plausible background noise. Five years ago, catching this required a suspicious employee. Today it requires a callback procedure that assumes voice can no longer be trusted as identity — because deepfake voice cloning has moved from novelty to commodity tooling. Darktrace's Canadian threat reporting for 2026 identifies exactly this preparedness gap: organizations are adopting AI tools faster than they're adapting the controls meant to catch AI-enabled deception.
The uncomfortable part is that this isn't a story about weak security. It's a story about controls designed for a slower, more human-paced attacker meeting an attacker that no longer moves at human pace.
The case against overreaction
The strongest pushback to this thesis deserves a fair hearing: layered, conventional security still catches a lot. Endpoint detection, network monitoring, and basic segmentation don't stop working just because an attacker used an AI tool somewhere in the chain. CRN's reporting on autonomous AI cyberattacks makes this point directly — organizations with genuinely mature security practices are better positioned to absorb AI-accelerated attacks than the framing of "everything has changed" suggests. A well-configured intrusion detection system will still flag anomalous transfer patterns whether the request that triggered them came from a human con artist or a cloned voice. The AI changes the front end of the attack — the lure, the speed, the personalization — far more than it changes what a transaction anomaly looks like on the back end.
That's a real limitation on the "everything is different now" narrative, and it matters: organizations that panic-buy AI-branded defensive tools without fixing basic control gaps — unsegmented networks, no callback verification for financial requests, minimal logging — are solving the wrong problem. The Cyber Centre's own guidance frames this as an amplification problem, not a replacement problem. AI is making known attack categories faster and more convincing. It is not, yet, inventing categories that render existing control frameworks obsolete.
The honest position sits between the vendor alarm and the "nothing has changed" comfort: existing controls remain necessary but are no longer sufficient on their own, because the thing they were tuned to detect — a slow, imperfect, occasionally clumsy human attacker — is being replaced in a growing share of incidents by something faster and less clumsy.
Why the numbers behind this are hard to pin down precisely
One honest caveat belongs here. Attributing a specific breach to "AI-native" tooling is difficult, and most public reporting — including the sources behind this piece — describes capability and trend rather than a confirmed, named Canadian incident of a fully autonomous attack chain. The Cyber Centre's language is about what frontier models can do for threat actors, based on direct engagement with industry through initiatives like Project Glasswing, not a public tally of confirmed AI-native breaches on Canadian soil. Canadians did lose a record $704 million to fraud in 2025 according to the Canadian Anti-Fraud Centre, with investment fraud as the largest single category — but that figure reflects total fraud losses, not a breakdown of how many of those schemes used generative AI or deepfake tooling specifically.
This matters for anyone making budget decisions. Treat vendor claims about "AI attack volume" with the same skepticism applied to any vendor selling the cure for the disease it just described. The credible, defensible claim is narrower than the marketing version: the tools exist, adversaries are using them, and the time available to detect and respond has measurably compressed for at least some categories of attack. That is enough to justify investment. It is not the same as saying every breach now involves autonomous AI.
What changes, concretely
For a Canadian security leader, three shifts follow from this that don't require new budget line items to start:
First, identity verification for high-value financial requests needs a channel that AI cannot easily clone — a pre-agreed callback number, a code phrase, a second approver who wasn't on the original call. Voice and video are no longer reliable proof of identity on their own.
Second, detection needs to shift weight from "recognizing known bad" toward "recognizing anomalous," because AI-generated phishing and deepfake content is specifically engineered to defeat pattern-matching defenses trained on last year's attacks.
Third, response time assumptions need revisiting. If exploitation can compress from weeks to hours, an incident response plan that assumes days of runway before serious damage is a plan built for a threat actor that increasingly doesn't exist.
None of this requires abandoning conventional security. It requires accepting that the attacker on the other end may no longer be a person working at a person's pace — and building the one or two controls that assumption changes, rather than the fifty that it doesn't.
What Leaders Should Do Security and technology leaders should treat AI systems and autonomous agents as governed identities, not informal tools. In practical terms, they should:
- Inventory critical ai dependencies.
- Assign an accountable owner for each agent or ai-enabled workflow.
- Document access controls, authentication, logging, approval boundaries, and revocation paths.
- Test fallback options and incident response playbooks.
- Include ai availability, jurisdictional risk, and auditability in procurement.