Cyber Has Entered Its Drone-Swarm Era

Anyone watching the war in Ukraine has seen the video: skies filled with uncountable, inexpensive drones.

Individually, many are expendable. Collectively, they have changed the economics of the battlefield.

Precision that once required expensive platforms and highly trained operators can now be distributed across large numbers of relatively cheap systems. Some will fail. Some will be destroyed. Enough won’t.

Cyber has crossed that threshold.

CrowdStrike reported this week that it uncovered four previously unreported threat actors using AI agents to make decisions and execute commands during real-world intrusion campaigns. 

An Indonesian-speaking actor with a limited grasp of security fundamentals used Claude Code and 819 largely publicly sourced offensive skills to compromise several government domains and private-sector organizations.

The attacker was not suddenly transformed into an elite hacker.

More of the expertise had moved into the weapon.

That is the significance of agentic AI.

Reconnaissance, exploitation, adaptation and persistence no longer have to depend entirely on scarce human expertise. They can increasingly be replicated in software, launched in parallel and allowed to pursue objectives with limited human direction.

The analogy is not that cyberattacks and kinetic warfare are equivalent.

It is that cheap, distributed offensive capability changes the mathematics of defense. And defensive doctrine must change with it.

A swarm can tolerate losses because individual failures are inexpensive. An AI-enabled attacker can do the same. Thousands of probes can fail. Most exploitation attempts can lead nowhere. Agents can abandon dead ends, share what they learn and keep searching.

The defender faces a different problem.

You cannot defeat thousands of autonomous attackers by hoping to recognize and respond to every hostile action faster than they can act.

The defense must change the economics of the attack.

In cyber, that means controlling the terrain the attacker must cross: the network.

Ridgeback is designed to put resistance in that terrain. Its Phantom resources respond to discovery attempts in unused address space, presenting synthetic targets that expose reconnaissance and record the source of contact. Exploration becomes an encounter with a surface the defender controls.

Under configured, approved policies, Phantom interaction can trigger automatic enforcement, including path denial or isolation of the originating host. Instead of turning every probe into another decision for an analyst, Ridgeback can apply a response defined in advance—constraining the paths an attacking agent can use.

The swarm makes attempts expendable. Ridgeback is designed to make those attempts consequential. Deceive discovery. Disrupt movement. Deny the next step. Don’t just watch the swarm. Make the network resist it.