The romantic notion that the US can rapidly pivot its industrial base for war is a misleading myth. Today's weapons are vastly more complex and reliant on fragile global supply chains for components that are controlled by adversaries, making a WWII-style industrial mobilization impossible without years of preparation.

Warfare has evolved to a "sixth domain" where cyber becomes physical. Mass drone swarms act like a distributed software attack, requiring one-to-many defense systems analogous to antivirus software, rather than traditional one-missile-per-target defenses which cannot scale.

A key threshold in AI-driven hacking has been crossed. Models can now autonomously chain multiple, distinct vulnerabilities together to execute complex, multi-step attacks—a capability they lacked just months ago. This significantly increases their potential as offensive cyber weapons.

Unlike human attackers, AI can ingest a company's entire API surface to find and exploit combinations of access patterns that individual, siloed development teams would never notice. This makes it a powerful tool for discovering hidden security holes that arise from a lack of cross-team coordination.

AT&T's CEO frames cybersecurity not as a technical problem but a geopolitical one. For-profit companies are pitted against nation-state actors who have unlimited resources and are not constrained by financial performance, creating a fundamentally asymmetric conflict.

The US defense industry's error was creating a separate, "exquisite" industrial base. The solution is designing weapons that can be built using existing, scalable commercial manufacturing techniques, mirroring the successful approach used during World War II.

While sophisticated AI attacks are emerging, the vast majority of breaches will continue to exploit poor security fundamentals. Companies that haven't mastered basics like rotating static credentials are far more vulnerable. Focusing on core identity hygiene is the best way to future-proof against any attack, AI-driven or not.

Even when air-gapped, commercial foundation models are fundamentally compromised for military use. Their training on public web data makes them vulnerable to "data poisoning," where adversaries can embed hidden "sleeper agents" that trigger harmful behavior on command, creating a massive security risk.

When companies don't provide sanctioned AI tools, employees turn to unsecured public versions like ChatGPT. This exposes proprietary data like sales playbooks, creating a significant security vulnerability and expanding the company's digital "attack surface."