Berkeley Cyber Drills Show Teams Struggle to Decide Who Acts When AI Speeds Attacks

Three exercises, 63 experts

The exercises were conducted by researchers with the UC Berkeley Center for Long-Term Cybersecurity and the Berkeley Risk and Security Lab, in partnership with Fortinet. They took place at Berkeley in December 2024, in Singapore in October 2025 and in Tel Aviv last December. Their aim was to systematically test assumptions about the practical impact of AI on cybercrime.

In total, 63 experts took part, including cybersecurity practitioners, law enforcement officials, industry executives and government policymakers. The authors cite the World Economic Forum's Global Cybersecurity Outlook 2026, released in January 2026: 87% of nearly 900 surveyed leaders said they had experienced rising AI-related vulnerabilities in the past year, and 94% expected AI to be the dominant force shaping cybersecurity in 2026.

The Tel Aviv scenario involved an insurance company locked out of its systems by ransomware, with attackers demanding 40 bitcoin, about US$3.5 million. Legal counsel asked whether the incident was a criminal matter or a national security concern, since that determined whether paying was lawful. Nobody in the room knew.

Decisions come before evidence, and everything hits at once

The authors argue that AI compresses the time forensic teams normally have. An AI-orchestrated intrusion can move from initial access to exfiltration in hours, so a ransom decision may be due before scope is established. In Tel Aviv, the crisis team had to weigh paying without knowing whether data had been exfiltrated or what it contained.

At Berkeley, a participant noted there is still no reliable way to confirm mid-incident whether an attack was AI-augmented. In Singapore, participants playing corporate leaders demanded public guidance before forensics had determined the scope, and AI-generated fake news about breached defense networks spread faster than authorities could respond. The authors say existing disclosure rules and playbooks assume that waiting produces certainty, an assumption weakened when attackers can fabricate evidence cheaply and at scale. None of the groups had a mechanism for handling that uncertainty.

Response processes are also sequential by design: detect, attribute, notify, disclose. The scenarios collapsed these stages. In Singapore, energy, transport and water systems all reported problems within the first hour, and partners began disconnecting from shared information networks because they could not verify whether the channel itself was compromised. In Tel Aviv, legal authorization, board notification and regulatory disclosure triggered at the same time with no basis for ranking them.

The Berkeley exercise produced a circular problem: a private firm held the forensic data while the government held the legal authority to act. Information-sharing protocols required attribution before exchanging data, yet attribution required the data. Participants also questioned how the SEC disclosure rule, which sets a reporting deadline, applies when scope is unresolved.

Classification and attribution get harder

The type of attacker, whether criminal, state-sponsored or lone actor, shapes the response. The authors say AI lets attackers generate fake identities and false information, blurring attribution. A practitioner at Berkeley described how North Korean operatives have used AI-generated identities to pass background checks and gain jobs at cybersecurity firms, turning employment screening into an attack surface.

Singapore participants argued for prioritizing technical attribution, meaning the tools and techniques used, ahead of state attribution in the early phases, since the latter may be fundamentally less reliable than before.

What the authors recommend

The authors identify two underlying problems: coordinated response built for single-sector attacks struggles when several sectors are hit together, and it struggles when no one has agreed in advance who holds authority. These issues appeared across jurisdictions with different regulatory regimes and levels of maturity.

• Specify decision rights before an incident, including who decides on paying a ransom and who issues public statements.
• Settle whose priority prevails when legal, communications and security functions disagree.
• Agree verification thresholds for confirming an attack and issuing a public disclosure.
• Negotiate information-sharing terms so communication need not wait for attribution.

According to the authors, all of this fits inside existing institutions if the questions are settled in time. AI-assisted detection and triage can help defenders shorten these windows, but only once decision rights are fixed. Whether such arrangements work at AI speed remains open, and the authors call it the question to test next.