Notifications
Clear all
Topic starter
06/09/2026 6:21 pm
TL;DR: AI is shrinking attacker time-to-action across phishing, voice cloning, and exposed-asset discovery, while smaller organisations remain the ones most exposed to the resulting burden, according to Exaforce. The security problem is not AI itself but the asymmetry it creates between machine-speed attacks and human-scale response capacity.
NHIMG editorial — based on content published by Exaforce: San Francisco tattooed Exaforce’s first billboards campaign. And honestly, we get it
Questions worth separating out
Q: How should security teams respond to AI-generated phishing campaigns?
A: Security teams should assume the message quality will be good enough to fool users and focus on reducing what a successful click can do.
Q: Why do AI-assisted attacks increase identity risk for small security teams?
A: Because smaller teams have less detection coverage, fewer responders, and more manual handoffs.
Q: What are the signs that AI is overwhelming incident response capacity?
A: Watch for repeated identity alerts that cannot be triaged quickly, delayed credential revocation, and analysts spending more time gathering context than containing events.
Practitioner guidance
- Harden phishing-resistant authentication Prioritise phishing-resistant MFA, conditional access, and step-up verification for high-risk users and administrative roles so a synthetic lure cannot easily become a valid session.
- Shorten identity response windows Pre-stage revocation, session termination, and credential reset playbooks so your team can act in minutes rather than hours when suspicious activity appears.
- Reduce reliance on manual triage Automate enrichment for identity alerts with account context, recent privilege changes, and device posture so analysts are not assembling evidence by hand under pressure.
What's in the full article
Exaforce's full post covers the operational detail this post intentionally leaves for the source:
- How the billboard campaign was framed and why the audience reaction became part of the message.
- The company's perspective on AI-driven security pressure from the standpoint of a SOC and MDR provider.
- The practical context behind its comments on machine-speed attacks and small-team defense.
- The broader product and market framing that sits outside this independent analysis.
👉 Read Exaforce's analysis of AI attacks, small-team burden, and response speed →
AI attacks fast, responses slower: what should SOC teams do?
Explore further
06/09/2026 6:22 pm
AI has turned identity compromise into a speed problem, not just a trust problem. When phishing, deepfakes, and exposure scanning all happen faster, the limiting factor becomes how quickly defenders can verify identity and revoke access. That changes the role of IAM, PAM, and incident response from static control to time-sensitive containment. Practitioner conclusion: security programmes must be designed for compressed attack windows.
A question worth separating out:
Q: Should organisations prioritise identity controls or SOC automation first for AI threats?
A: Prioritise the control that closes the fastest path to misuse in your environment. If AI attacks are landing through identity abuse, improve authentication, privilege restriction, and session containment first, then use SOC automation to speed triage and response. The two work best together, but identity containment usually comes first.
👉 Read our full editorial: AI attacks are moving faster than small security teams can respond
