How Frontier AI Is Changing Cybersecurity Strategy

Lewis & Nadeau (McKinsey, Inside the Strategy Room) — how frontier AI is changing cybersecurity strategy

▶ Watch on YouTube · McKinsey & Company · 50:11

As frontier AI models become more capable, the cybersecurity challenge facing business leaders is changing. The newest frontier large language models can identify, chain together, and exploit vulnerabilities in sophisticated enterprise systems, creating new risks even as they open opportunities to strengthen cyber defenses.

In this episode of Inside the Strategy Room, McKinsey’s Charlie Lewis and Marie-Claude Nadeau discuss the emerging threats posed by frontier AI, what they mean for enterprise cybersecurity, and how organizations can adapt their defenses while capturing the benefits of increasingly powerful AI models.

TL;DR

A 50-minute episode of Inside the Strategy Room, a McKinsey & Company podcast, published 21 October 2026. Host Sean Brown talks with Marie-Claude Nadeau (“MC”), senior partner and global co-leader of McKinsey’s risk and resilience practice, and Charlie Lewis, partner and global leader of its cybersecurity practice. Six claims:

1. The clock has changed. The time between a flaw being noticed and being weaponised is “collapsing from years or a year to a day or less” (Nadeau), and every budget cycle and change process “designed for an older slower clock” has to change.
2. AI compresses the attack life cycle rather than inventing a new one (Lewis). Reconnaissance is automated; known vulnerabilities move to exploitation “in a matter of hours or even minutes”; minor weaknesses are chained. “Sophisticated attacks were scarce because the people who could run them were scarce,” and AI removes that constraint.
3. Security teams become a diamond. The pyramid of many analysts under a few leaders becomes “a diamond of overseers”, with fewer repetitive roles and more people “orchestrating judgment, validation, exception handling,” and decision rights moved lower so the firm can respond in hours (Nadeau).
4. Diversified vendors can share one point of failure. Vendor diversification “doesn’t necessarily create dependency diversification if you’re all relying on the same fourth party or fifth party” (Lewis).
5. Fix the process before adding AI, and the harness matters. “AI-ifying a broken vulnerability management to patch remediation process is just going to give you increased cost on a broken process,” and “a really good harness and really strong prompting on a lower capable model will give you a better output than average harnesses and average prompting on the best” (Lewis).
6. Offence leads for now. “Offense is going to be way ahead for a period of time, a year, maybe two years,” and “open weight models will start catching up to where the frontier labs are today” (Lewis).

Key claims

Five shifts at once

Nadeau’s scene-setting: this is “bigger than just cyber leadership.” Attacks are faster, cheaper and “autonomous frankly”; AI is changing how the business itself operates (agents, new workflows, new governance); critical dependencies now run “into all the cloud data identity model infrastructure” a firm may use “even unknowingly”; the vendor landscape for defence moves daily; and the bar on fundamentals has risen, because “the cost of weaknesses, even small weaknesses… that may have existed for a long time… is increasing very fast.”

The attack life cycle, compressed

Lewis quotes a security firm’s blog (the name is unclear in the captions): “for most of the history of cyber security sophisticated attacks were scarce because the people who could run them were scarce,” and AI changes that constraint. Work that needed specialists, such as someone trained to break one kind of router, is automated or augmented. Two steps change most. Reconnaissance: mapping targets, choosing the most valuable, planning access. Exploitation: known vulnerabilities weaponised in hours, and minor weaknesses “chained together”, which changes the priority of flaws that were left alone because they seemed minor. His example of old debt: a Linux vulnerability from 2003, “23 years ago… they’d be probably working as an analyst in your company.” The response is to “decide, detect, contain, recover, and validate much faster.”

On building software, quality can no longer be separated from security, and AI also speeds up the security checks in a secure development lifecycle “in a way that does not slow the time to market”: agentic threat modelling and automated static and dynamic testing.

A diamond of overseers, and decision rights

Nadeau: security organisations have been pyramids, a small leadership layer over a large base doing the daily work. As agents take the repetitive work, “the pyramid starts to look… more like a diamond and we’re calling it a diamond of overseers.” Accountability stays at the top with CISOs and function leaders, who own risk appetite and regulatory obligations. The middle layer moves “from managing people to managing AI-driven work.” And “if the decision making rights don’t change, your speed of response is going to be slow”: responding in hours needs decisions made lower down, which “becomes actually a competitive variable.” It raises the training burden, because reviewing an agent’s work takes judgment, and it needs a definition of which decisions may be made at which level.

Lewis on keeping humans in control: leaders set the guardrails and keep accountability; agents find problems and escalate within those guardrails; and there is “full alignment within the industry on not deploying fixes without human reviews, especially on critical applications.” When attacks swarm, “the signal became the noise”, so each person has to be “ruthlessly focused,” agents need registered identities and guardrails so they do not become “an inadvertent insider risk,” and “maybe it’s just one more agent to build that helps filter for you… your post-meeting agent.”

Budget

Nadeau: “about 4% of cyber budgets” now go to agent security, and that “could probably quadruple or so in the next 3 years,” with the focus on identity and access management, governance, risk and compliance, and data security, because there will be “more and more nonhuman identities trying to access data.” She expects a shift in where money goes more than “a giant jump in budget size,” because automation offsets some of the load. Lewis on blockchain for tracing agents’ decisions: discussed internally, but “at its nascent stage.”

Supply chains: the wafer problem

Lewis: third-party risk is no longer “compliance or check the box.” The question is “can we continue serving our customers… if something fails two or three layers below that vendor?” His illustration comes from a crisis war game with an ice-cream maker: an ice-cream sandwich needs wafers, few firms make them, and if one goes down “you lose your ability to provide ice cream sandwiches”, which matters more in July than in February. Firms spread risk across direct suppliers, but “several apparently independent vendors can… depend on the same cloud provider, identity service, data platform”, creating “hidden single points of failure.” Full visibility is not the goal: “chasing that perfect visibility is… actually the wrong goal.” Start from the critical business services and the “minimum viable company,” and ask of AI too: “How do you get the agents to show up to work if there’s an outage?”

Resilience after a breach

Nadeau: preparation makes “a breach… a bad week rather than a bad decade.” Leading organisations “have just pre-made a lot of decisions”: who declares an incident and at what threshold, who calls regulators, customers and the press. “A lot of the failures after a breach are not necessarily technology failures… they are communication failures,” typically undercommunicating first and then overcommunicating “at exactly the wrong moment.” Reacting within 24 hours keeps costs from growing exponentially.

Quantum: a hurricane, not a tornado

Lewis: quantum is “a long horizon sort of balance sheet type risk… not an urgent fire, but… more expensive to fix the longer you wait.” Estimates of Q-day range from 2035 to claims of readiness by 2029; he puts it within five to ten years. The present risk is harvest now, decrypt later: data stolen today may be decrypted later, so know which data has a ten-year life. Cryptographic migrations take years. It raises the bar on “continuous posture improvement” rather than changing what security is: “frontier AI… happened almost like a tornado… My view is this is more like a hurricane. We know it’s coming.”

Choosing models, and fixing the process first

Lewis’s sequence for clients: first the operating model and processes, because AI on a broken patch-remediation process adds cost and little risk reduction; then a bounded proof of value on one vulnerability scan, testing prompting and “the effectiveness of my harness”; then the tokenomics of which model runs which scan, since “from a token standpoint, it can get very costly very quickly.” Finding vulnerabilities and finding exploits may need different models, and a lower-capability model with a strong harness can beat the best model with an average one. Large banks and technology firms are ahead; most organisations should start with vulnerability scanning and the operating model. Nadeau: “this is not about selecting a technology vendor… a technology vendor will not do all these things for you.”

Fundamentals, and finance in the room

Lewis lists what clients are actually working on: identity and access management (just-in-time privilege), data protection and cloud security, and asset management: “If you don’t know where your assets are, it’s really hard to secure them,” including the spreadsheets agents will use that no one tracks. Zero trust remains a driver. Many firms want AI in the security operations centre for speed and cost; get the vulnerability process right first. His two biggest gaps: finance is not in the security planning meetings, though “everyone… think[s] AI can cut cost but there has to be an increased spend”; and flexibility for what comes next.

On the opportunity, both point to talent. Lewis: AI can take tier-one response and access reviews, labour-intensive work “that makes it very hard to retain talent.” Nadeau: “never waste a good crisis.”

Dynamic-capabilities reading

• contextual/external-triggers — frontier AI compressing attack timelines, open-weight models carrying offensive capability, and quantum on the horizon are outside forces every firm must answer.
• digital-transforming/redesigning-internal-structures — the pyramid becoming a diamond of overseers, the middle layer managing AI-driven work, and decision rights pushed lower so response takes hours.
• digital-sensing/digital-scenario-planning — the minimum viable company and failures two or three layers down the supply chain; quantum planned for as a hurricane with a known window; incident decisions made in advance.

How it connects

• attack-surface-management — the attacker’s window shrinking to hours, chained minor weaknesses, nth-party dependencies, and asset inventory as the precondition.
• agent-oversight-and-delegation — the diamond of overseers, decision rights at lower levels, and human review before fixes reach critical systems.
• agent-harness — a strong harness on a weaker model against an average harness on the best one.
• foundation-models — open weights catching up on offensive capability.
• Chow (Metalware) — Mythos-level capability available as open weights, from the defence side.
• Grinstead (Mozilla) — a production vulnerability-finding harness, credited half to the model and half to the harness.
• Cloudflare Investor Day — the time-to-exploit chart behind the same claim about the attacker’s window.

What was actually ingested

The full episode (50:11, length_seconds: 3011) from auto-generated captions only; names and terms are corrected in quotes (posture for “position”, SAST and DAST, SOC, nth-party). Two passages stay unclear and are not quoted: the source of the 2035 Q-day estimate, and a reference to Black Hat. The blog Lewis quotes on scarce attackers is not identified. No stills: a static title card throughout.

Linked entities and concepts

• McKinsey & Company — publisher; both guests lead its risk and cybersecurity practices. Updated in this ingest.
• attack-surface-management, agent-oversight-and-delegation, agent-harness, foundation-models — updated in this ingest.
• dynamic-capabilities — the three cells tagged above.

Dangling (single-source mention, deferred): Charlie Lewis, Marie-Claude Nadeau, Sean Brown (host of three Inside the Strategy Room sources, but author: is the channel).

Scope and reliability

Two consultants who sell cybersecurity and resilience work, on their firm’s podcast. The one budget figure (4% of cyber budgets on agent security, possibly quadrupling in three years) is “our analysis” without method; the time-to-exploit claim is stated, not sourced in the episode. The supply-chain and incident-response advice predates AI and is restated for it. What the episode adds is an operating-model account of AI-era security (the diamond of overseers, decision rights, process before tools) and a consultant’s corroboration that harness quality can outweigh model choice.