CrowdStrike’s 2026 Threat Hunting Report (CrowdStrike 2026 Threat Hunting Report | CrowdStrike) presents a clear warning: artificial intelligence is no longer an emerging capability sitting at the edge of adversary operations. It is now embedded across the attack lifecycle. Threat actors are using AI to generate payloads and commands, accelerate vulnerability exploitation, abuse enterprise large language models, compromise software supply chains, and scale operations across cloud environments. CrowdStrike reports that some China-linked actors exploited critical vulnerabilities within 24 hours of a public proof-of-concept release. It also documented a North Korea-linked campaign involving malicious code inserted into 131 trusted AI framework packages.
These findings reinforce a fundamental reality. The time between opportunity, targeting and exploitation is collapsing. However, they also expose a larger strategic gap in how many organizations define threat hunting. Modern threat hunting remains heavily centered on what can be observed across endpoints, identities, networks, cloud infrastructure, SaaS platforms and enterprise applications. Those data sources are essential, but they generally become useful after an adversary has selected a target, developed an access strategy or begun interacting with the environment.
In other words, the organization may be hunting for the intrusion while the adversary has already completed much of the hunt for the victim.
The Attack Does Not Begin at the Endpoint
Every sophisticated operation starts with a targeting decision. Before an attacker steals credentials, compromises an account or deploys malicious code, someone or something must determine who is worth targeting, why that person matters and which pathway is most likely to succeed. That process always occurs outside the enterprise security boundary.
Executives, employees, board members, public officials and their families operate inside a massive commercial surveillance ecosystem. Data brokers, public records, breached databases, social media platforms, location information, professional biographies, corporate websites and people-search services collectively expose extraordinary amounts of targeting intelligence.
An adversary can use that information to identify decision-makers, map trusted relationships, understand organizational responsibilities, infer travel or work routines, and determine which individuals may have access to money, systems, personnel, or sensitive information. AI significantly reduces the time and expertise required to turn this fragmented information into an operational targeting package. The result may be a tailored phishing campaign, executive impersonation, fraudulent payment request, account recovery attempt, synthetic-media operation, recruiter pretext, vendor compromise, or approach against a family member or executive assistant. None of those activities necessarily produces endpoint telemetry during the preparation stage.
By the time the attack becomes visible to the security operations center, the adversary may already know the target, the target’s relationships, the appropriate pretext, and the expected response.
Trust Has Become the Primary Attack Surface
One of the most important conclusions in CrowdStrike’s reporting is that adversaries are increasingly operating through legitimate and trusted pathways. CrowdStrike found that attackers are abusing authentication workflows, valid identities, and integrated SaaS applications to move quickly into cloud environments. Device-code phishing attempts reportedly increased fifteenfold during the first half of 2026, while voice-phishing intrusions doubled. In one observed incident, an attacker moved from account takeover to data theft in less than five minutes.
The danger is that many organizations still conceptualize cyber defense as a contest between malicious software and defensive technology, and that model is becoming obsolete.
The adversary may not need to defeat the endpoint protection platform, exploit a zero-day, or install malware. The attacker may only need to convince one trusted person to approve an authentication request, disclose a code, reset an account, open a remote-management session, or accept a fraudulent communication as legitimate. The attack path may run through an executive assistant, finance employee, system administrator, software developer, outside counsel, contractor, vendor or family member. These individuals are not merely users of enterprise technology; they are components of the organization’s trust architecture.
Threat hunting must move beyond identifying malicious behavior inside technology and begin identifying adversarial interest in the people who control, influence, or enable that technology.
AI Is an Accelerator, Not the Entire Threat
The cybersecurity industry often frames AI risk around deepfakes. Synthetic audio and video are important concerns, but they represent only one component of a much larger operational shift.
AI can assist an adversary with:
- Large-scale collection and correlation of personal information
- Identification of high-value individuals and vulnerable relationships
- Analysis of social networks and organizational structures
- Development of realistic personas and communications
- Translation and cultural adaptation
- Automated engagement across multiple platforms
- Creation of tailored phishing and social-engineering content
- Vulnerability research and code generation
- Rapid adjustment when an initial approach fails
CrowdStrike’s 2026 Global Threat Report found that attacks involving AI-enabled adversaries increased by 89% year over year. It also reported an average eCrime breakout time of 29 minutes, with the fastest observed breakout occurring in only 27 seconds.
Those statistics are significant, but speed inside the environment is only part of the problem. AI also compresses the time between identifying a human vulnerability and operationalizing it. What once required a team of researchers, linguists, fraud specialists and technical operators can increasingly be augmented by automated systems. That allows adversaries to conduct more targeting, create more convincing approaches and pursue more victims simultaneously.
The defensive challenge is therefore not simply detecting AI-generated content. It is identifying the adversarial targeting process and disrupting it before trust is successfully exploited.
Extending Threat Hunting Beyond Enterprise Telemetry
The next generation of threat hunting must connect internal security telemetry with external digital-risk intelligence. That means looking for evidence that an executive, employee or other high-value individual is being profiled, impersonated, discussed, exposed or operationally prepared for targeting.
Relevant signals may include:
- Newly exposed personal or breached information
- Impersonation accounts or fraudulent domains
- Changes in hostile narratives or targeted online discussion
- Increased collection of executive or employee information
- Exposure of credentials, session data or authentication artifacts
- Suspicious infrastructure built around a person or trusted brand
- Convergence between personal exposure and enterprise threat activity
No single signal proves that an attack is imminent. The value comes from correlation. An impersonation account may appear insignificant in isolation. A breached email address may appear routine. A hostile narrative may look like reputational noise. A fraudulent domain may resemble conventional brand abuse. When those signals converge around the same individual, organization, event or period of heightened exposure, they may indicate an emerging targeting operation. That is where digital-risk intelligence becomes threat intelligence.
A More Complete Defensive Model
Endpoint detection, identity protection, cloud security, threat intelligence and proactive hunting remain indispensable. The answer is not to replace those capabilities but to extend them. Organizations should treat the external exposure of high-value people as part of the enterprise attack surface. Protective intelligence, executive protection, fraud, cybersecurity, identity, legal, communications and physical security teams should not operate as isolated functions when adversaries move fluidly across all of those domains.
The defensive model must connect three stages:
- Before access: Identify targeting, exposure, impersonation, reconnaissance and pretext development.
- During access: Detect abnormal authentication, endpoint, SaaS, cloud and network behavior.
- After access: Contain the intrusion, revoke sessions, investigate impact, and remove the external infrastructure that may support continued operations.
Most organizations are strongest in the second and third stages, while the first remains dangerously underdeveloped.
Threat Hunting Must Hunt the Targeting Process
CrowdStrike is correct that AI is changing how attacks are planned, executed, and scaled. The organization’s 2026 findings demonstrate how quickly modern adversaries can exploit vulnerabilities, trusted software, authentication workflows and cloud environments. But the strategic implication extends beyond faster detection and response. Threat hunting must begin before the adversary reaches the endpoint; it must examine the external environment where high-value targets are identified, relationships are mapped, personas are constructed, and trust is prepared for exploitation.
The future of threat hunting is not limited to finding malicious activity inside the enterprise. It is understanding who the adversary is hunting, how that person is exposed, and which trusted pathway is likely to be weaponized next.
Originally published on LinkedIn.
