For years, cybersecurity operated on a rough but workable assumption: an attacker breaks in, moves through the network, and eventually gets caught, usually with enough time in between for a human analyst to notice and respond. That assumption no longer holds. The average time between initial access and lateral movement, known as breakout time, has collapsed to a fraction of what it was even two years ago, and in some documented cases attackers have moved from compromise to data theft in minutes.
This is the shift behind what security teams are now calling machine-speed cybersecurity. Attacks increasingly execute faster than a human team can detect, triage, and respond, which means the defense must operate at the same speed as the threat.
How Fast Are Cyberattacks Moving Today?
The numbers illustrate how dramatically this has changed. According to CrowdStrike’s 2026 Global Threat Report, the average eCrime breakout time fell to just 29 minutes in 2025, a 65% increase in speed compared to the year before. The fastest recorded breakout took only 27 seconds, and in one documented intrusion, attackers began exfiltrating data within four minutes of gaining initial access.
That acceleration is not incidental. The same report found that AI-enabled adversaries increased their operations by 89% year over year, using AI-generated scripts to speed up credential dumping, automate reconnaissance, and erase forensic evidence during an intrusion. Attackers no longer need deep technical expertise to move quickly. They need access to an AI tool that can generate the next step of the attack faster than a defender can read the alert.
This pattern is not limited to human-directed attacks using AI as a tool. Security researchers have documented cases of fully autonomous attack operations, where an AI agent independently selected vulnerabilities, launched exploits, and executed post-exploitation activity with minimal human oversight, a trend Ampcus Cyber’s threat intelligence team has tracked directly in incidents involving autonomous AI-driven attack frameworks.
Why Human-Speed Defense No Longer Works
Traditional security operations were built around a detect-triage-respond cycle that assumes minutes to hours of available response time. A SIEM generates an alert, a Tier 1 analyst reviews it, escalates if needed, and a responder takes containment action. That workflow made sense when breakout time was measured in hours or days.
At a 29-minute breakout time, much of that cycle simply does not fit. By the time an alert is triaged and assigned, an attacker using automated tooling may have already completed lateral movement and started exfiltrating data. The gap between mean time to detect and mean time to respond, a distinction covered in detail in our guide to MTTD versus MTTR, has become the defining constraint of modern security operations. Closing that gap now requires automation at the point of detection, not just faster human processes layered on top of the same manual workflow.
What Machine-Speed Defense Looks Like
Machine-speed defense does not mean removing people from the security operation. It means shifting the first line of detection and response to systems that can act within the same compressed timeframe attackers now operate in, while keeping human oversight focused on the judgment calls that require it.
- Automated detection and response: Modern Managed Detection and Response platforms combine continuous monitoring with automated containment actions, so a suspicious process can be isolated the moment it is flagged rather than waiting for a human to review a queue. This is the practical difference between a SOC that can keep pace with a 29-minute breakout window and one that cannot.
- Behavioral analytics over signature matching: Since a growing share of intrusions rely on valid credentials and legitimate administrative tools rather than traditional malware, detection increasingly depends on identifying unusual behavior patterns rather than matching known attack signatures, which by definition cannot catch a technique that has not been seen before.
- Governed autonomous agents on the defensive side too: As enterprises deploy their own AI agents for security operations, those agents need the same runtime oversight defenders are trying to apply to attacker activity. Our detailed look at Governor Agents covers how organizations can grant AI systems enough autonomy to act at machine speed while still enforcing policy boundaries and validating intent before a high-impact action executes.
- Continuous behavioral monitoring of AI systems themselves: Attackers are not only using AI to move faster. They are also targeting enterprise AI deployments directly. Our guide to agentic AI security outlines how autonomous agents with broad permissions have become high-value targets, since a compromised agent can exfiltrate data or trigger unauthorized actions faster than any human can intervene.
Human-Speed SOC vs. Machine-Speed Defense
| Dimension | Human-Speed SOC | Machine-Speed Defense |
| Detection approach | Signature and rule-based alerting | Continuous behavioral analytics |
| Response time | Minutes to hours, gated by human triage | Seconds to minutes, automated at the point of detection |
| Alert handling | Manual review of each alert in a queue | Automated correlation and containment, human review for edge cases |
| Coverage window | Assumes hours of dwell time before damage | Built for sub-30-minute breakout scenarios |
| AI system oversight | Rarely monitored as its own attack surface | Continuously governed, with runtime policy enforcement |
Building Toward Machine-Speed Readiness
Getting to machine-speed defense is a phased effort, not a single tool purchase. It starts with establishing accurate detection and response time baselines, since a security team cannot close a gap it has not measured. From there, automation should be layered in at the points where human triage introduces the most delay, typically initial alert correlation and first-response containment actions, while keeping human analysts focused on the investigation and judgment calls that benefit most from experience.
Organizations deploying their own AI agents, whether for customer service, internal automation, or security operations, also need to apply the same rigor to those systems that they apply to any other privileged account. The NIST AI Risk Management Framework provides a structured starting point for this, organizing AI governance around four functions: Govern, Map, Measure, and Manage, which map naturally onto the kind of oversight autonomous defensive agents also require.
The Business Case for CISOs and Security Leaders
Machine-speed cybersecurity is not a future consideration. Breakout times are already measured in minutes, and the organizations still relying entirely on manual triage are effectively conceding that window to the attacker before defense even begins. For CISOs, this reframes the investment conversation away from adding more analysts and toward closing the detection-to-response gap through automation, since headcount alone cannot compress response time below what a fully manual workflow allows.
It also changes how boards should think about security readiness. A breakout time measured against industry benchmarks gives leadership a concrete, comparable metric, one that speaks directly to whether the organization’s defenses can plausibly respond before an intrusion progresses, rather than an abstract sense of how many tools are deployed.
Ampcus Cyber helps organizations close the gap between attacker speed and defender response through managed detection and response, governed AI agents, and continuous monitoring built for machine-speed threats.
| Assess Your Managed Detection and Response Readiness to see how your current detection and response capabilities compare to today’s threat landscape. |
Enjoyed reading this blog? Stay updated with our latest exclusive content by following us on Twitter and LinkedIn.
