Pretoria, South Africa – September 2026
The uncomfortable truth for CIOs is that AI is making familiar attack techniques faster, cheaper, and easier to scale.
The evidence is becoming measurable
CrowdStrike reports that AI-enabled adversary operations increased 89% year-on-year in 2025, with AI being used across reconnaissance, credential theft, and evasion [https://www.crowdstrike.com/en-us/press-releases/2026-crowdstrike-global-threat-report/]. Microsoft reports that AI-driven phishing is now three times more effective than traditional campaigns [https://www.microsoft.com/en-us/security/security-insider/threat-landscape/microsoft-digital-defense-report-2025].
And speed is changing dramatically. In a controlled experiment, Palo Alto Networks Unit 42 integrated generative AI across a simulated attack chain and reduced time to data exfiltration from a real-world median of roughly two days to 25 minutes: approximately 100 times faster. This was a laboratory result, not a measure of all attacks in the wild, but it demonstrates what automation makes possible [https://www.paloaltonetworks.com/resources/research/unit-42-incident-response-report-2025].
The problem is that many enterprises are defending increasingly fast attacks with an incomplete map of their own environment.
Legacy estates can contain thousands of stored procedures, applications, databases, APIs, integrations, and configuration dependencies accumulated over decades. Hidden coupling, fragmented documentation, and critical knowledge reside with individual employees rather than in durable systems.
The vulnerability is often what you cannot see
This is not simply a technical-debt problem. It is a business-risk problem.
Unit 42 identifies complexity, gaps in visibility, and excessive trust as core factors enabling attackers. In its 2025 incident-response data, 70% of incidents crossed three or more attack surfaces, while 86% involved some form of business-impacting loss, including operational disruption, reputational damage, or increased legal and regulatory costs. In 19% of cases involving exfiltration, data was stolen within an hour.
ENISA similarly warns that digital dependencies increase systemic exposure: disruption in one component can propagate through interconnected suppliers, services, and infrastructure. Its latest threat landscape continues to identify ransomware as the most impactful short-term threat while noting increasing malicious use of AI.
For an executive team, the question therefore changes from “Do we have cybersecurity tools?” to “Do we know what this vulnerability actually connects to?”
A weakness buried inside one procedure may touch customer data, billing, authentication, external integrations, or a regulated workflow. Without dependency context, security teams are forced to prioritise from lists of findings rather than from an understanding of business impact.
And attackers increasingly have less reason to give them time.
Turn your software estate into something you can reason about
This is the problem Runestone is designed to address.
Rather than functioning as another point-security dashboard, Runestone creates a machine-readable, versioned intelligence layer across the software estate. Its read-only crawlers catalogue source code, stored procedures, database objects, APIs, configurations, and integrations without writing back into production. Those relationships feed RuneWeave, Runestone’s knowledge graph.
That changes vulnerability management from discovery to understanding.
RuneWeave can map a security finding to determine its blast radius: the downstream services, tables, APIs, systems, and potentially sensitive information connected to it. That gives security and engineering leaders a more defensible basis for prioritising remediation according to operational consequence rather than severity scores alone.
Runestone also continuously generates plain-language documentation, turning tribal knowledge into persistent organisational intelligence. Multi-model orchestration lets different AI models handle different analytical tasks, while versioned commits and audit trails provide traceability for findings and agent actions.
Its deployment model is deliberately defensive:
- read-only by architecture,
- tenant-first, with
- no exploit generation.
Code, graphs, and findings can remain within the customer’s cloud subscription and describe the platform as POPIA- and GDPR-aligned.
For CIOs, the opportunity is straightforward: before attackers use AI to understand your environment faster than you do, make your own estate intelligible.
Request a private Runestone briefing or demonstration and see what your software estate looks like when dependencies, risk and institutional knowledge become visible.