Jun 29, 2026 - Business

Axios C-Suite: AI's real cybersecurity threat is what you already know

Jim VandeHei

Illustration of a medical patient folder made out of bolted steel. — Illustration: Aïda Amer/Axios

CrowdStrike CTO Elia Zaitsev's message to CEOs and our boardrooms is blunt: Stop obsessing over which new AI model is scariest.

The things we should fear most are lightning-fast attacks on the massive stack of vulnerabilities, new and old.

Why it matters: Bad actors can now exploit these security gaps in hours, and it's headed toward minutes. So a pile of unpatched old vulnerabilities is vastly easier to penetrate.

The real shift: AI's edge is stitching together known flaws, not finding brand-new ones.

The risk math: Zaitsev framed it cleanly in an interview with me — risk = probability × magnitude.

AI has created so many new entry points for attackers that catastrophe has become that much more probable. The magnitude of the potential catastrophe hasn't changed. You can't do much worse than shutting down a company or a city.

What CEOs get wrong: The legacy approach to risk management is prioritizing vulnerability criticality scores and working through them, highest risk to lowest.

Instead, prioritize exposure, in-the-wild exploitation and attack paths, not a checklist.

📈 If you're a CEO or on a CEO's team: Ask to join Jim's new weekly Axios C-Suite newsletter.

Add Axios on Google

Axios C-Suite: AI's real cybersecurity threat is what you already know

What to read next