I've been reading about drones. I recommend it, in the way I'd recommend a horror movie.
Here's the short version. In Ukraine right now, drones cause 70 to 80 percent of all battlefield casualties. Not artillery. Not tanks. Quadcopters. Russia claims production rates approaching seven million of them a year. Ukraine builds four million. The drone that's winning the war costs roughly a thousand dollars and kills a five-million-dollar tank. The most advanced militaries on earth spent eighty years and trillions of dollars perfecting ultra-sophisticated platforms, and the future showed up looking like a hobby kit from a strip mall.
The Americans still make the best drone in the world. It costs $16 million. China sells one that essentially does the same job for $1.5 million, and they make them in volumes we can't touch. We keep telling ourselves that quality wins, but in modern warfare, the victor is whoever can make the millionth cheap drone fastest.
There's a second lesson buried in there, and it's the one that keeps me up. When jammers started knocking Ukrainian drones out of the sky, both sides switched to drones flown through a fiber-optic thread. A physical wire, twenty kilometers long, unspooling behind the drone like a fishing line. Can't jam it. Can't detect it. The counter to the counter arrived in weeks, not procurement cycles. Whole battlefields are now draped in glass thread like some awful Christmas.
So: cheap, massive, and iterating faster than defense can respond. Hold that thought.
Now let me tell you what's coming to your network.
For thirty years, cyber attacks have been expensive. Not in dollars — in talent. A serious intrusion needed a skilled human on the keyboard: someone to do reconnaissance, write the phish, move laterally, cover tracks. Talent was the constraint. It's why most companies could survive being a mediocre target. There weren't enough good attackers to go around, and you just had to be less attractive than the guy next door.
AI removes the constraint. An attack agent doesn't sleep, doesn't get bored, and doesn't cost $300K a year. It reads your entire public footprint in minutes, writes a phishing email in your CFO's actual voice, probes every credential it can find, and does it against ten thousand companies simultaneously. The masterful hacker is being replaced by the thousand-dollar drone. We're maybe two years from attack volume that looks less like crime and more like weather.
I know the objection. The defenders get AI too. True. And in Ukraine, the defenders got jammers. The lesson wasn't that defense is impossible — it's that defense at human speed is impossible. The side that survives is the side that automates its response loop, because the attacks iterate in weeks and your patch committee meets monthly. If a human has to read the alert, you've already lost the exchange.
Here's the thing that actually decides it, though, and it's not the shiny part. In Ukraine, the drones win by finding whatever moves. In your environment, the AI attackers will win by finding whatever logs in. Identity is the kill zone. Every service account nobody remembers creating, every AI agent you wired into production with standing credentials, every vendor login from 2019 — that's the open road the drone is watching. The companies that get hurt in the next two years won't be the ones with bad firewalls. They'll be the ones who couldn't answer a simple question: what, exactly, can log into our stuff, and what happens when something pretends to be it?
The war in Ukraine ends when one side runs out of what it can't manufacture. The looming war in your network works the same way. Attackers will never run out of attacks — those are free now. What you can run out of is time, and unwatched doors.
Cheap, massive, fast. That's the enemy's whole playbook. The good news is it's a playbook, which means you can prepare for it. The bad news is the clock started before you read this.