Topic starter
19/08/2026 3:26 pm
TL;DR: AI can now generate working zero-day exploits in minutes and lower the cost of advanced attacks to near zero, according to Expel's RSAC 2026 analysis, while agentic AI can speed lateral movement, credential harvesting, and exfiltration beyond human response loops. The practical inflection point is not just faster malware, but a governance gap where identity, detection, and data controls must operate at machine speed.
Editorial analysis by NHI Mgmt Group, based on content published by Expel: “How fast can AI generate a zero-day? What security teams need to know”.
Key questions
Q: What breaks when static credentials are left in place for AI-driven attacks?
A: Static credentials turn a single stolen secret into durable access, which gives AI-assisted attackers room to automate reuse, escalation, and lateral movement.
Q: Why do AI-generated exploits increase risk even for well-patched environments?
A: Because the risk is not only whether a patch exists, but whether the attack can be developed and delivered before your environment is validated.
Q: What are the signs that NHI governance is failing under AI-speed attacks?
A: The strongest warning signs are repeated secret reuse, unexpected token chaining, and service accounts with broad access that are still active long after they should have been rotated or retired.
Practitioner guidance
- Tighten NHI secret lifetime and scope Inventory service accounts, API keys, and tokens, then shorten their usable lifetime and limit each credential to the smallest production scope it actually needs.
- Shift identity review to runtime controls Move from periodic access certification to event-driven checks on token use, privilege escalation, and cross-system chaining so abuse is visible while the session is active.
- Build detections for AI-shaped attack paths Tune SIEM content for rapid credential harvesting, unusual secret reuse, and lateral movement patterns that can unfold faster than a human analyst can triage.
Bottom line: AI-speed attacks are not only accelerating malware creation. They are collapsing the time available to patch, detect, and contain abuse before identities are weaponised.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
19/08/2026 4:10 pm
AI-speed attacks collapse the separation between vulnerability management and identity governance. When exploit generation takes minutes, the defender can no longer treat patching, access review, and detection as independent tracks. The control failure is not only delay. It is the assumption that identity exposure can be governed on a slower cadence than attack execution. Practitioners should treat exploitability and credential governance as one operating problem.
A few things that frame the scale:
- Gartner predicts that more than 40% of agentic AI projects will be cancelled by the end of 2027, citing rising costs, unclear value and insufficient risk controls.
A question worth separating out:
Q: How should security teams respond when agentic AI can move faster than analysts?
A: Teams should favour runtime containment, automated detection, and tighter access scope over manual investigation as the first line of defence. That does not replace analysts. It gives them a chance to respond after the first malicious sequence is constrained rather than after the environment has already been traversed.
👉 Read our full editorial: AI-speed attacks are collapsing patch windows and identity controls