The Human Didn't Leave the Loop. The Human Moved Up the Stack.

An AI agent just executed a ransomware attack from initial breach to ransom note. The victim count? Still zero — because a human still had to choose who to rob.

I read Sysdig's JadePuffer report twice. Not because the technical details were complex, but because the headline and the fine print tell completely opposite stories about what just happened to professional services.

The headline screams disruption: the first documented case of an AI agent performing the technical execution of a cyberattack autonomously. The fine print whispers something more important: a human operator selected the target, provisioned the infrastructure, compromised the credentials, and made every strategic decision. The AI didn't replace the attacker. It compressed the execution layer beneath them.

The human didn't get automated out of the attack. The human became the coach, and the AI became the team.

What Phil Jackson Knows About AI That Your Firm Doesn't

Phil Jackson never scored a basket for the Chicago Bulls. Put him on the court against any player on his roster and he'd lose. He won eleven championships anyway.

His value was never doing the work on the floor. It was setting the conditions, reading the situation, making the call, and owning the result. The players executed. Jackson decided what was worth executing.

That's the shift JadePuffer represents — not for cybersecurity, but for every knowledge work firm reading this.

I've watched this pattern play out four times now. Desktop publishing didn't eliminate graphic designers in the '90s — it eliminated the twenty steps between concept and output, and suddenly one designer could do the work of five. The designers who survived weren't the ones with the steadiest X-Acto knife. They were the ones whose judgment about what should be designed became more valuable than their ability to execute it.

Electronic trading didn't eliminate traders on the NYSE floor in the 2000s — it compressed the execution of trades to microseconds and moved human value to the strategy layer. The humans who got automated were the ones whose entire job was execution speed. The ones who thrived were the ones whose judgment about which trades to make became the entire game.

Now AI is doing it to the work your firm bills for.

The Execution Layer Just Repriced Itself

Here's what makes me uncomfortable about JadePuffer, and it's not the ransomware.

The attacker didn't need to know how to navigate a Linux filesystem, enumerate network resources, or write encryption routines. They needed to know which organization to target and what credentials would get them in. Everything between "pick the lock" and "leave the note" got compressed into a conversation with an AI agent.

That's not a cybersecurity problem. That's a professional services problem.

How much of what your firm bills at $250/hour is execution a machine can now do? The research, the drafts, the formatting, the routine analysis, the "let me look into that and get back to you" work that fills the space between the initial question and the final recommendation?

I was advising a client last month — a mid-sized accounting firm trying to figure out their AI strategy. The partner kept asking me which tools would make his team "more efficient." Wrong question. The right question is: if AI compresses 60 hours of work into 6, does your client want to pay you for 60 or 6?

Because your clients are running the same calculation you are. They're not asking "can AI do this?" anymore. They're asking "why am I paying someone else to do what AI can do?"

The execution layer just got cheaper. The judgment layer just got more valuable.

Autopilot Didn't Retire the Pilots

When autopilot technology matured in commercial aviation, pilots didn't disappear. The FAA didn't say "great, now we can fly planes with nobody in the cockpit."

What happened instead: pilot attention moved from continuous manual control to monitoring, intervention, and decision-making at critical moments. Takeoff. Landing. Weather. System failures. The moments where judgment, experience, and accountability actually matter.

The people who panicked about autopilot asked "will this replace pilots?" The people who understood disruption asked "what is a pilot's job now that the execution layer is automated?"

JadePuffer is your firm's autopilot moment.

The AI agent in that attack didn't decide whether the target was worth the risk. It didn't assess whether the ransom demand was realistic. It didn't negotiate. It didn't evaluate whether this attack would trigger a law enforcement response that would burn the entire operation. A human made every one of those calls, because those are judgment calls that require accountability.

The AI compressed everything in between.

The Uncomfortable Question You're Not Asking

Which part of your job is execution a machine can now do, and which part is the judgment only you can put your name on?

Not someday. Not in five years when the models get better. Right now, this quarter, when your clients are starting to notice that the thing they paid you $40,000 to analyze could be done by ChatGPT for $200.

I don't have a clean answer for you. I'm sitting with this tension myself. But here's what I know from watching the desktop publishing wave, the electronic trading wave, the internet wave, and the mobile wave:

The firms that survive are the ones that move their people up the stack before their clients move them out of the budget.

That means:

• Stop billing for execution you can't defend. If AI can draft it, research it, or format it in minutes, that's not a billable task anymore — it's overhead.

• Reprice judgment. The partner review that used to be 10% of the engagement fee? That's the whole engagement now. The strategic decision about whether to do something, not the execution of how to do it.

• Restructure for leverage. If one senior person can now oversee what used to take a team of five, your org chart is wrong. And your clients' org charts are wrong. And they're figuring that out faster than you are.

This isn't about technology adoption. It's about who owns the decision and whose name goes on the outcome.

What to Do Monday Morning

Here's the specific conversation I'm having with every professional services leader who'll listen:

Ask your team: "If a client asked us to justify our fee for [specific service], and said an AI tool could do 80% of the work, what would we say?"

Not hypothetically. Specifically. Pick your three highest-margin services and run that scenario.

If your answer is "well, the AI makes mistakes" or "clients value the relationship," you're six months from losing that client to someone who moved up the stack faster than you did.

If your answer is "we're selling the judgment about whether this is the right strategy, not the execution of the analysis" — and you can defend that in a room full of skeptical CFOs — you're ahead of this.

The human didn't leave the loop. The human moved up the stack. The question is whether you're moving with them, or waiting for the headline to catch up with the fine print.

What's the one thing your firm bills for that's execution, not judgment? And what happens when your client figures that out before you do?

I'm working with professional services firms navigating exactly this shift — not the theory of AI disruption, but the practical reality of repricing expertise when execution gets compressed. If your firm is having this conversation, I'd welcome the chance to compare notes: [email protected]