Strategic AI predicts cyberattacks long before the strike 

In an era when digital infrastructure is as vulnerable as medieval castles once were, cybersecurity has become a question of prediction and strategy. With geopolitical tensions rising, anticipating the nature of future cyberattacks and strategically developing defensive capabilities in response is a prudent tactic. 

“During the age of castles, it was impossible to perfectly fortify against all enemies in all directions,” says Ernesto Damiani from the Center for Cyber-Physical Systems at Khalifa University. So, it was imperative to prioritize defenses according to your predictions about the besieging army’s approach. “Today, the same tensions play out in cybersecurity,” Damiani says. 

Modern cyberattack strategies are evolving; ranging from brute-force attacks that overwhelm critical online systems to stealth attacks that quietly infiltrate and compromise a system from the inside. Each requires a different kind of defense. 

If we could accurately forecast the types of cyberattack that we are most likely to face several years from now, this would be a powerful tool, Damiani says, because we could gain a head start on developing the right defensive tools to counter the threats. 

Subject matter experts’ forecasts are a good starting point, but they are prone to human subjectivity and bias. “We wanted to develop an AI capable of providing impartial, accurate strategic cybersecurity advice,” Damiani says. “But this challenge is very difficult to solve with vanilla AI.” 

“We wanted to develop an AI capable of providing impartial, accurate strategic cybersecurity advice.” 

Ernesto Damiani 

AI’s use in cybersecurity today is limited to immediate operational activities such as detecting attacks and guiding the response. “To develop a tactical AI to predict the cyber threats that will prevail three years from now, we had to develop specialized training,” says Damiani, who co-led the work. The team had to teach the AI to understand the temporal context of its training data, thereby enabling it to project forward and predict the future cyberattack landscape. 

The resulting AI strategic assistant was tested on part of the past that it had not encountered during its training. “We took the model five years back in time, asked it to predict cyberattack trends in the following three years. We then compared that with what actually happened,” Damiani says. The model’s predictions for the volume of different cyberattack types were highly accurate, within 10% of what really happened.  

Several cybersecurity companies have already expressed interest in the AI tool, Damiani says, but the immediate focus is on refining the model’s memory-encoding to further sharpen its predictive capabilities. The utility of an AI with medium-term strategic capability could be far-reaching. “I see potential applications for our specially trained strategic AI far beyond cybersecurity,” Damiani says. 

Reference

Almahmoud, Z., Yoo, P. D., Damiani, E., Choo, K.-K. R. & Yeun, C. Y. Forecasting cyber threats and pertinent mitigation technologies. Technol. Forecast. Soc. Change,  210, 123836, (2025). | Article