Until recently, talking about artificial intelligence applied to cybersecurity mainly involved talking about tools capable of helping to carry out or stop a cyber attack. AI could analyze (among other things) large volumes of information, identify patterns or speed up certain tasks, but that scenario is changing.
In 2026, different threat intelligence teams have recorded operations in which AI-based systems have stopped acting solely as assistants, taking on more and more implementation, thus drastically changing the cybersecurity ecosystem known until now. In this way, the question arises: is Spain prepared to face a possible autonomous attack?
From AI as an assistant to AI that executes the attack
The evolution of the threat can be summarized in a change of role. Artificial intelligence is going from being a tool used by operators to an active component of offensive operations, even being capable of carrying out much of the work necessary to penetrate critical systems.
It is important to point out that we are not facing a scenario in which an AI decides by itself, for example, to start a conflict against a country, but nor is it the simple automation of an isolated task. The difference is in the ability to chain actions and the increased speed of execution.
Spain adapts its defense against autonomous cyber attacks
Spain is not starting from scratch in this scenario. In June of this year, the National Cryptology Center (CNN) published a specific guide on offensive AI in which it warns that these capabilities are already part of the operating environment of criminal and state actors, identifying risks such as automated recognition, exploitation of vulnerabilities or the generation of malware, but the most significant element is the response.
The CCN has incorporated a specific tool into its INÉS platform so that organizations subject to the National Security Scheme can evaluate their degree of preparation against threats enhanced by artificial intelligence. In addition, it has asked the public sector and its technology providers to analyze their exposure and response capacity, stating that offensive AI can no longer be treated as a future threat, but must be incorporated into the current cybersecurity management model.
The defense field is also moving in this direction. The Joint Cyberspace Command (MCCE) is developing specific artificial intelligence, automation and simulation capabilities, while the Ministry of Defense has placed AI and cyber defense among the technological priorities of the Defense Technology and Innovation Strategy (ETID) 2026.
The answer requires AI, but it must be under control
There is a paradox in this new technological race: the same technology that allows automating attacks can become one of the main defense tools.
Defensive AI can process large volumes of information, prioritize alerts and accelerate certain responses, and can also help security teams go from reacting to thousands of events to focusing on those that can truly compromise an organization.
Incorporating AI into defense does not mean delegating security decisions without limits, but rather using it as a governed defensive capability, with human supervision, traceability and clear limits of action.
Spain has national cybersecurity and cyberdefense capabilities, specialized organizations and a consolidated regulatory framework
To answer the question about whether Spain is prepared or not for an autonomous attack, at TRC we consider that the answer should not be a yes or no. Our country has national cybersecurity and cyberdefense capabilities, specialized organizations, a consolidated regulatory framework, a specific strategy for adaptation to offensive AI… but the fact that in 2026 the CCN has launched a specific tool to measure preparedness against the latter, also shows that this capacity is still in a period of evolution.
The challenge is not only to better protect current systems but also to ensure that the defense can perceive, interpret and respond to a threat that can act at a speed much faster than traditional human processes. Therefore, preparedness against offensive AI must be measured in terms of resilience, governed automation, anticipatory capacity and decision speed.
The goal is to build systems capable of recognizing when they should act, doing so quickly, and keeping humans in control of critical decisions.
