Hacker Tech vs Defender Tech

By Ryan Kuhn, founder of Kuhn Capital, an M&A advisor to mid-market technology companies.

The Stakes

This post covers all major cyberattack and defense technologies. Learn which defenses work well on their own, which ones play nice with others, and that no defense currently appears to stop a new attack tech (but at least you can contain its damage).

Last year Cybersecurity Ventures projected total cyber losses at $10.5 trillion. That includes both reported and estimated unreported attacks plus associated costs like lost productivity and reputational harm.

How do you stop this thieves’ banquet? How well do the tools available work? What types of threats are growing?

Our CyberPulse Dashboard #5 pairs each hacker technology with the defenses built to stop it and shows which side is winning. Start with the Attacker/Defender Matrix.

The Major Conflicts

AI Transforms Both Attacker and Defender into Speed Demons

Attackers now use AI to find and exploit software flaws faster than defenders can find the holes. It used to run the other way. In 2018, a newly disclosed vulnerability took about 63 days to appear in real attacks, which gave defenders two months to locate affected systems, test a fix and deploy it.

But by last year, the bad guys began exploiting flaws an average of seven days before anybody developed a patch.

That figure goes negative because, of all vulnerabilities exploited in 2025, about 29% happened before defenders knew they existed (that is, 29% of exploits were “zero-day” hits, those with no warning). That’s up from 24% in 2024.

The good news is, defenders are gradually figuring out how to fight AI fire with AI fire. In 2025, the global average breach took 241 days to identify and contain. But organizations using AI-assisted detection tech drastically cut that to 51 days, saving about $1.9M per breach.

Lesson Learned?

Company owners must install AI-enabled attack detection ASAP, or risk sustaining inhumanly fast dynamic attacks out of the blue.

An Unsolvable Problem for Now: When Attackers Target Your AI

We talked about AI as nitro fuel. But AI has another cyber use as well, one different in kind, not degree.

As companies adopt AI copilots and agents, they unwittingly enter a cyber minefield that didn’t exist five years ago: “prompt injection.”

Prompt injection means tricking the victim’s AI system into following the attacker’s orders, not theirs. Hackers may bury malicious code in what looks like innocuous data. Three of four AIs recently tested had this vulnerability, and prompt injections now succeed somewhere between 50% and 85% of the time. Defense researchers are stymied: they have yet to devise effective ways to deter such attacks and some think it may be theoretically impossible.

It’s unlike phishing, which FIDO2 (a passwordless sign-in method that keeps encrypted keys securely on the user’s device) can nearly completely foil. And it’s also unlike ransomware, where defenders use immutable backups that can be made tamper-proof.

But thankfully, there are ways to limit the damage prompt injection can create. Like limiting what AI agents can do on their own.

Lesson Learned?

It’s now wise to assume that hackers can subvert your AI tools. Given that, concentrate on how to keep them from stealing your most precious assets — money, data, permissions, etc. If you can offer assurances that they won’t do much damage because they can’t act without a person signing off, or they have only least-privilege access, or you’re filtering their input/output and logging their activity – all these actions and others can limit the “blast radius” of a hijacked AI.

She Came in Through the Bathroom Window: Attacking Through Vendors

Today, about one in every eight vendor breaches leads to a ransomware attack on one of its clients. And once inside, thanks to the vendor’s privileged access, attackers can stop their hacking labors—they’re free to encrypt or extract the victim’s data and deliver extortionate demands. Nearly half of 2025’s third-party breaches involved reused supplier portals.

Lesson Learned?

Give your vendors compartmentalized access only to what’s clearly needed, and log and monitor it per session. Require more than a signed security questionnaire. You need evidence that they’ve built a robust defense perimeter — fewer than 40% of companies rate their own vendor risk controls as highly effective. Also, get their commitments to your defense in their supplier contracts.

Fewer Ransoms Paid, But Bigger Ones

The number of active ransomware groups hit a record high in 2025, as per CyberPulse Dashboard #1. Despite that, the share of victims who paid fell to an all-time low of less than a third, down from about two-thirds in 2024. So good news: companies are less willing to capitulate.

But those who do pay are paying much more. The median ransom payment jumped nearly five-fold from about $13K in 2024 to about $60K in 2025. Ransomware gangs are researching not only a victim’s vulnerabilities but also their ability and willingness to pay under extenuating circumstances.

Circumstances are especially extenuating when a company’s owners are in the midst of attracting M&A buyers, raising funds or negotiating terms. See our post on the heightened threat extortionists pose during the M&A process.

Lesson Learned?

If your company is mid-sized and looks financially healthy, and especially if it’s been in the news or shopping for capital or otherwise throwing off signals of a major imminent transaction, prepare yourself against the prospect of more frequent ransomware attempts and more aggressive demands. Also consider buying cyber insurance that covers not only ransomware payments but the often substantial costs of downstream cleanup.

Negligence Costs More Than Most Companies Realize

The costs of insider risk — mostly employees making mistakes, not malicious insiders — reached $19.5M per company in 2026, up from $17.4M the year before.

Two defense tactics help. Periodic phishing training drops the share of employees who fall for a fake email from about one-third to 5%. Behavior-monitoring software, which flags unusual account activity early, also dramatically cuts insider threat costs — Ponemon’s 2025 study put the average at $5.2M for organizations using it, versus $17.4M overall.

Lesson Learned?

Basic employee training pays for itself many times over because 1) it works; 2) it’s inexpensive: $12 to $36 per employee/year.

In Sum, What All This Means to Companies Contemplating Sale

Potential buyers, even lenders, no longer take a seller’s passing assurances that they’re managing cyber risk. It’s now a key everyday operating and due diligence item:

• Does your MFA cover everyone? Are former employees and suppliers off your servers?
• Are your data backups tested and protected against ransomware manipulation?
• Is vendor access limited and logged?
• Do you have an anti-phishing training program?
• If you use AI internally, is your security team trained to contain prompt injections?
• For checklists of other ways to maximize value before sale, see my posts Quick Ways to Increase Value Before Sale and Bigger Projects That Increase Value More.

Dashboard #5 shows what’s at stake for owners and potential investors in mid-market companies when the answer to key questions like these is no.

Stay tuned for the next post in our CyberPulse series: “The Cyber Defense Business,” where we look at the leading competitors segmented by attack/defense technologies.

Some Cyber Source Material
IBM Cost of a Data Breach 2025 · FBI IC3 Annual Report · Verizon Data Breach Investigations Report · Mandiant M-Trends 2026 · Cybersecurity Ventures 2025 Official Cybercrime Report · Chainalysis Crypto Ransomware 2026 · DeepStrike Ransomware Statistics 2025 · VulnCheck State of Exploitation 2026 · Sophos Active Adversary Report 2025 · Ponemon Cost of Insider Risks 2026 · KnowBe4 Phishing by Industry Benchmarking Report · CyberPulse Suite Dashboards