Emergency cybersecurity demand surges; hackers use AI to automate attacks

NBC News reports that demand for emergency cybersecurity services is surging, while some top cybersecurity companies are turning away new customers seeking urgent support.[1] Executives at Mandiant, CrowdStrike and Kroll told NBC News about the situation.[1] For organizations assessing their response arrangements, the report highlights a practical distinction: emergency support may not be available to every new customer when demand is high.[1] Kroll recognizes a shift from emergency support toward standing incident-response partnerships.[5]

CrowdStrike says Chinese state-linked hackers used AI to target more than 200 organizations in just 11 days, and that the popular DeepSeek model was among the targets.[2] The evidence also describes AI being used to attack governments and businesses worldwide.[2] Separately, Google Cloud says threat actors monetize compromised cloud and model resources, and that LLM-jacking attacks have cost victims hundreds of thousands in fraudulent cloud bills.[3] Underground markets target LLM credentials, according to Google Cloud.[3]

Kroll reports that 99% of businesses said they have an incident-response plan, while 3% update their plan only after an incident.[5] It says AI can accelerate investigations, identify patterns across large data sets and improve response times.[5] Kroll also recognizes a shift toward standing incident-response partnerships and says it launched an enhanced retainer.[5] The evidence does not specify the retainer’s price or terms, so teams comparing support options would need to ask Kroll for those details.[5]