Notifications
Clear all
Topic starter
02/08/2026 11:54 am
TL;DR: AI-enabled attacks surged 89% year over year, and CrowdStrike says the average time from initial access to lateral movement is now 29 minutes, with the fastest breakout at 27 seconds. The post argues that defenders need AI-assisted testing to keep pace with attack chains that are now assembled and executed faster than human review cycles can absorb.
NHIMG editorial — based on content published by Aikido: How Security Teams Fight Back Against AI-Powered Hackers
By the numbers:
- AI-enabled attacks surged 89% year over year, according to CrowdStrike's 2026 Global Threat Report.
- The average time from initial access to lateral movement now sits at 29 minutes, according to CrowdStrike's 2026 Global Threat Report.
Questions worth separating out
Q: How should security teams defend against AI-assisted attack chains in production environments?
A: They should assume that attackers can generate fresh tooling, pivot quickly, and test multiple paths after first access.
Q: Why do reused credentials and exposed management ports become more dangerous when attackers use AI?
A: Because AI reduces the time and effort needed to turn basic access into a working intrusion chain.
Q: What breaks when security teams rely on single-step detection for AI-enabled attacks?
A: Single-step detection misses the way attackers chain reconnaissance, escalation, movement, and persistence into one intrusion path.
Practitioner guidance
- Test attack paths continuously on every deploy Run AI-assisted attack-path validation across application, identity, and cloud layers so that new exposures are found before production traffic or adversaries can reach them.
- Reduce the usefulness of exposed credentials Shorten credential lifetime, rotate secrets aggressively, and eliminate standing access where possible so that a stolen credential has less time and less privilege to support lateral movement.
- Instrument containment for fast breakout Build playbooks that isolate sessions, accounts, and network segments as soon as suspicious chaining appears.
What's in the full article
Aikido's full blog post covers the operational detail this analysis intentionally leaves for the source:
- Examples of the AI pentesting workflow used to probe attack paths across applications and release stages
- The product launch detail behind Aikido Infinite and how the workflow is positioned for continuous testing
- The specific attack-path coverage claims tied to OWASP Top 10 style findings and remediation flow
- The vendor's explanation of how findings are fed back into developer and security workflows
👉 Read Aikido's analysis of how AI-powered hackers are changing attack chains →
AI-powered hacking: what it means for security teams now?
Explore further
02/08/2026 1:02 pm
AI-assisted intrusion compresses the whole attack lifecycle into a governance problem. The main change is not simply faster exploitation, but shorter decision windows for every control that depends on human review. Identity, credential, and workload controls now need to assume that a prompt-driven attacker can move from access to abuse before a ticket is closed. The practical conclusion is that security programmes must validate control latency, not just control coverage.
A question worth separating out:
Q: What should teams do when AI-driven intrusion activity is moving faster than human triage?
A: Escalate containment before analysis is complete. If confirmation, ticketing, and manual review lag behind attacker movement, isolate affected identities, sessions, and network paths first, then investigate in parallel. The goal is to break the chain while the attacker is still inside a limited blast radius.
👉 Read our full editorial: AI-powered hackers are compressing attack chains to minutes
