美国一些最大的网络安全公司正努力应对由人工智能（AI）驱动的网络攻击激增。形势已变得如此严峻，以至于这些公司不得不拒绝那些急需帮助的新客户。
Some of America's biggest cybersecurity companies are struggling to handle a sharp rise in cyberattacks powered by artificial intelligence (AI). The situation has become so serious that companies are turning away new customers who need urgent help after being hacked.
谷歌旗下的 Mandiant、CrowdStrike 和 Kroll 这三家美国主要网络安全公司向 NBC News 表示，它们面临的网络攻击数量异常庞大。它们称，攻击量已达到前所未有的水平。
Three major US cybersecurity firms — Google's Mandiant, CrowdStrike and Kroll — told NBC News that they are facing an unusually high number of cyberattacks. They said the volume of attacks has reached a level they have not experienced before.
这些公司表示，攻击数量激增的最大原因是 AI 工具的使用。这些工具使黑客行动变得更快、更容易、成本更低。
The companies said that the biggest reason behind the growing number of attacks is the use of AI tools. These tools have made hacking operations much faster, easier and cheaper to carry out.
虽然黑客现在可以利用 AI 攻击数百家组织，但网络安全公司仍需时间、熟练工人和大量人力来调查并修复这些攻击造成的损害。网络安全公司拒绝客户Mandiant 首席技术官查尔斯·卡马卡尔表示，过去 12 个月公司一直非常忙碌。然而，过去两个月形势恶化得多，黑客攻击尝试急剧增加。他说，最新的激增令网络安全防御团队和应对网络攻击的公司都不堪重负。Mandiant 是谷歌的云网络安全公司。
While hackers can now use AI to attack hundreds of organisations, cybersecurity companies still need time, skilled workers and significant manpower to investigate and fix the damage caused by these attacks. Cybersecurity firms turn away customersCharles Carmakal, chief technology officer at Mandiant, said the company has been extremely busy over the past 12 months. However, the situation has become much worse over the past two months, with a sharp increase in hacking attempts. He said the latest surge is overwhelming both cybersecurity defence teams and companies that respond to cyberattacks. Mandiant is Google's cloud cybersecurity company.
主要网络安全公司通常与大型企业客户签有现有合同，即保留服务协议。这些合同允许企业在遭遇攻击时获得网络安全专家的帮助。
Major cybersecurity firms often have existing contracts, also known as retainers, with large corporate customers. These contracts allow companies to receive help from cybersecurity experts when they face an attack.
卡马卡尔说，由于网络攻击数量急剧增加，公司优先服务已有此类协议的客户。因此，没有现有合同的企业在被黑后难以找到专家提供帮助。卡马卡尔表示，应急响应公司正拒绝大多数寻求帮助的组织。
Since the number of cyberattacks has increased sharply, firms are giving priority to customers who already have these agreements. As a result, businesses that do not have existing contracts are struggling to find experts to help them after being hacked, Carmakal said. Carmakal said incident response companies are turning down most organisations that approach them for help.
他将这一问题描述为全行业性的危机，而非仅影响一两家网络安全公司的问题。AI使得极小规模的黑客团体也能实施大规模攻击。卡马卡尔表示，仅有几名成员的团队现在可以将其黑客行动扩展到数百家组织。AI黑客瞄准数百家组织CrowdStrike（众击）近期识别出的一次黑客行动展示了AI如何帮助成熟的黑客组织扩大其行动规模。据称该组织为中国情报机构效力，使用了一款今年早些时候发布的AI工具。该工具最初是为帮助网站开发人员识别其软件中的安全弱点而开发的。
He described the problem as an industrywide crisis, rather than something affecting just one or two cybersecurity firms.AI has made it possible for very small groups of hackers to carry out large-scale attacks. Carmakal said a team with only a few people can now expand its hacking operations to hundreds of organisations.AI hackers target hundreds of organisationsA recent hacking campaign identified by CrowdStrike shows how AI is helping sophisticated hacking groups expand their operations. The group, allegedly working for Chinese intelligence, used an AI tool released earlier this year. The tool was originally developed to help website developers identify security weaknesses in their software.
据称黑客利用该工具寻找漏洞并入侵计算机系统。CrowdStrike称，自10月中旬以来，该组织已攻破全球多家政府机构和公司的系统，并以数百家其他组织为目标。
The hackers allegedly used it to find vulnerabilities and break into computer systems. Since mid-October, the group has compromised several government agencies and companies across the world and targeted hundreds of other organisations, CrowdStrike said.
CrowdStrike表示，智能体AI使得即使是技术不熟练的黑客也能实施此前主要与高水平政府支持的黑客组织相关的攻击。
CrowdStrike said agentic AI is allowing even less-skilled hackers to carry out attacks that were earlier associated with highly advanced government-backed hacking groups.A CrowdStrike spokesperson said the threat from AI-powered hackers is already here and there are no signs that these attacks will slow down.
CrowdStrike一位发言人表示，AI驱动的黑客威胁已经到来，且没有迹象表明这些攻击会放缓。该公司称，黑客现在正利用AI智能体实施此前主要局限于国家级黑客组织的活动。
The company said hackers are now using AI agents to carry out activities that were once largely limited to nation-state hacking groups.AI tools have reduced the need for such expertise by helping hackers automate several steps.
AI工具通过帮助黑客实现多个步骤的自动化，降低了对这类专业技能的需求。许多此类工具也可免费下载和使用，使得更多人能够尝试发动网络攻击。AI让黑客在防御者面前占据优势Kroll全球数字取证与事件响应主管马克斯·亨德森表示，黑客和网络安全团队利用AI的方式存在重大差异。
Many of these tools are also free to download and use, making it easier for more people to attempt cyberattacks.AI gives hackers an advantage over defendersMax Henderson, global head of digital forensics and incident response at Kroll, said there is a major difference between how hackers and cybersecurity teams can use AI.
黑客可以反复尝试 AI 工具，尝试不同方法，直到找到进入系统的途径。在这些尝试中，他们不必过多担心犯错。然而，网络安全公司在使用 AI 保护企业及其系统时，必须谨慎得多。亨德森表示，许多组织目前正试图将 AI 工具引入其网络安全防御体系。然而，投入使用需要时间，因为公司必须确保这些工具正常且安全地运行。另一方面，黑客不面临同样的限制，可以主要专注于速度。
Hackers can experiment with AI tools repeatedly and try different methods until they find a way into a system. They do not have to worry as much about making mistakes during these attempts. However, cybersecurity companies must be much more careful when using AI to protect businesses and their systems. Henderson said many organisations are currently trying to introduce AI tools into their cybersecurity defence systems. However, putting these tools into use takes time because companies must ensure that they work properly and safely. On the other hand, hackers do not face the same restrictions and can focus mainly on speed.
随着网络攻击持续增加，Kroll 正在积极招聘更多员工，亨德森表示。然而，招聘新员工需要时间，公司还必须确保现有员工不会过度劳累。不断增加的攻击给网络安全专家带来压力，他们必须调查事件并帮助受影响组织恢复。与此同时，Kroll 不得不告诉一些新客户，公司没有足够产能提供完整的恢复和修复服务。
Kroll hires staff as cyberattacks keep risingKroll is actively recruiting more employees to deal with the rising number of cyberattacks, Henderson said. However, hiring new workers takes time, and the company must also make sure its existing employees are not overworked. The growing number of attacks is putting pressure on cybersecurity experts who have to investigate incidents and help affected organisations recover. In the meantime, Kroll has had to tell some new customers that it does not have enough capacity to provide complete recovery and repair services.
亨德森表示，网络安全公司必须谨慎对待接受超出其处理能力的客户。承接过多案件可能影响工作质量，并使其应对现有客户的能力面临风险。
Henderson said cybersecurity firms have to be careful about accepting more customers than they can handle. Taking on too many cases could affect the quality of their work and put their ability to respond to existing customers at risk.
亨德森表示，过去几年网络安全工作更具季节性和可预测性。然而，今年网络攻击数量持续上升。每个月的攻击量都高于上个月。虽然网络安全公司预计激增最终会达到顶峰，但这一节点不断推迟。这意味着公司正为团队和资源持续承压做准备，而非指望局势立即好转。
Henderson said cybersecurity work was more seasonal and predictable over the past few years. However, this year has seen a continuous rise in the number of cyberattacks. Every month has brought a higher volume of attacks than the previous month. Although cybersecurity firms expect the surge to eventually reach a peak, that point keeps moving further away. This means companies are preparing for continued pressure on their teams and resources, rather than expecting the situation to improve immediately.